From: Sasha Levin Date: Fri, 22 Mar 2024 16:53:54 +0000 (-0400) Subject: Fixes for 6.7 X-Git-Tag: v6.8.2~88 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9676bf858d72871d05918170925486d742b7c399;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.7 Signed-off-by: Sasha Levin --- diff --git a/queue-6.7/acpi-cppc-enable-amd-cppc-v2-support-for-family-17h-.patch b/queue-6.7/acpi-cppc-enable-amd-cppc-v2-support-for-family-17h-.patch new file mode 100644 index 00000000000..9185164c782 --- /dev/null +++ b/queue-6.7/acpi-cppc-enable-amd-cppc-v2-support-for-family-17h-.patch @@ -0,0 +1,47 @@ +From 1305f7c5ba7ca3e71c2e21f39477a802492467f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Feb 2024 11:46:28 +0800 +Subject: ACPI: CPPC: enable AMD CPPC V2 support for family 17h processors + +From: Perry Yuan + +[ Upstream commit a51ab63b297ce9e26e3ffb9be896018a42d5f32f ] + +As there are some AMD processors which only support CPPC V2 firmware and +BIOS implementation, the amd_pstate driver will be failed to load when +system booting with below kernel warning message: + +[ 0.477523] amd_pstate: the _CPC object is not present in SBIOS or ACPI disabled + +To make the amd_pstate driver can be loaded on those TR40 processors, it +needs to match x86_model from 0x30 to 0x7F for family 17H. +With the change, the system can load amd_pstate driver as expected. + +Reviewed-by: Mario Limonciello +Reported-by: Gino Badouri +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218171 +Fixes: fbd74d1689 ("ACPI: CPPC: Fix enabling CPPC on AMD systems with shared memory") +Signed-off-by: Perry Yuan +Reviewed-by: Gautham R. Shenoy +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/acpi/cppc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/acpi/cppc.c b/arch/x86/kernel/acpi/cppc.c +index 8d8752b44f113..ff8f25faca3dd 100644 +--- a/arch/x86/kernel/acpi/cppc.c ++++ b/arch/x86/kernel/acpi/cppc.c +@@ -20,7 +20,7 @@ bool cpc_supported_by_cpu(void) + (boot_cpu_data.x86_model >= 0x20 && boot_cpu_data.x86_model <= 0x2f))) + return true; + else if (boot_cpu_data.x86 == 0x17 && +- boot_cpu_data.x86_model >= 0x70 && boot_cpu_data.x86_model <= 0x7f) ++ boot_cpu_data.x86_model >= 0x30 && boot_cpu_data.x86_model <= 0x7f) + return true; + return boot_cpu_has(X86_FEATURE_CPPC); + } +-- +2.43.0 + diff --git a/queue-6.7/acpi-processor_idle-fix-memory-leak-in-acpi_processo.patch b/queue-6.7/acpi-processor_idle-fix-memory-leak-in-acpi_processo.patch new file mode 100644 index 00000000000..af18ef40167 --- /dev/null +++ b/queue-6.7/acpi-processor_idle-fix-memory-leak-in-acpi_processo.patch @@ -0,0 +1,61 @@ +From 3d36fc002b1c456ac909341bd0131670d7dd6f94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 01:41:58 +0100 +Subject: ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() + +From: Armin Wolf + +[ Upstream commit e18afcb7b2a12b635ac10081f943fcf84ddacc51 ] + +After unregistering the CPU idle device, the memory associated with +it is not freed, leading to a memory leak: + +unreferenced object 0xffff896282f6c000 (size 1024): + comm "swapper/0", pid 1, jiffies 4294893170 + hex dump (first 32 bytes): + 00 00 00 00 0b 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace (crc 8836a742): + [] kmalloc_trace+0x29d/0x340 + [] acpi_processor_power_init+0xf3/0x1c0 + [] __acpi_processor_start+0xd3/0xf0 + [] acpi_processor_start+0x2c/0x50 + [] really_probe+0xe2/0x480 + [] __driver_probe_device+0x78/0x160 + [] driver_probe_device+0x1f/0x90 + [] __driver_attach+0xce/0x1c0 + [] bus_for_each_dev+0x70/0xc0 + [] bus_add_driver+0x112/0x210 + [] driver_register+0x55/0x100 + [] acpi_processor_driver_init+0x3b/0xc0 + [] do_one_initcall+0x41/0x300 + [] kernel_init_freeable+0x320/0x470 + [] kernel_init+0x16/0x1b0 + [] ret_from_fork+0x2d/0x50 + +Fix this by freeing the CPU idle device after unregistering it. + +Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure") +Signed-off-by: Armin Wolf +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/processor_idle.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c +index 55437f5e0c3ae..bd6a7857ce058 100644 +--- a/drivers/acpi/processor_idle.c ++++ b/drivers/acpi/processor_idle.c +@@ -1430,6 +1430,8 @@ int acpi_processor_power_exit(struct acpi_processor *pr) + acpi_processor_registered--; + if (acpi_processor_registered == 0) + cpuidle_unregister_driver(&acpi_idle_driver); ++ ++ kfree(dev); + } + + pr->flags.power_setup_done = 0; +-- +2.43.0 + diff --git a/queue-6.7/acpi-resource-add-infinity-laptops-to-irq1_edge_low_.patch b/queue-6.7/acpi-resource-add-infinity-laptops-to-irq1_edge_low_.patch new file mode 100644 index 00000000000..fd30a3e187d --- /dev/null +++ b/queue-6.7/acpi-resource-add-infinity-laptops-to-irq1_edge_low_.patch @@ -0,0 +1,51 @@ +From 445ab0a792269b04298a84b2c82e55318d4f269e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jan 2024 12:55:18 -0400 +Subject: ACPI: resource: Add Infinity laptops to irq1_edge_low_force_override + +From: David McFarland + +[ Upstream commit e2605d4039a42a03000856b3229932455717b48b ] + +A user reported a keyboard problem similar to ones reported with other +Zen laptops, on an Infinity E15-5A165-BM. + +Add board name matches for this model and one (untested) close relative +to irq1_edge_low_force_override. + +Link: https://lemmy.ml/post/9864736 +Link: https://www.infinitygaming.com.au/bios/ +Link: https://lore.kernel.org/linux-acpi/20231006123304.32686-1-hdegoede@redhat.com +Signed-off-by: Rafael J. Wysocki +Stable-dep-of: 021a67d09615 ("ACPI: resource: Add MAIBENBEN X577 to irq1_edge_low_force_override") +Signed-off-by: Sasha Levin +--- + drivers/acpi/resource.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c +index 03b52d31a3e3f..dacad1d846c0d 100644 +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -576,6 +576,18 @@ static const struct dmi_system_id irq1_edge_low_force_override[] = { + DMI_MATCH(DMI_BOARD_NAME, "GM6BG0Q"), + }, + }, ++ { ++ /* Infinity E15-5A165-BM */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "GM5RG1E0009COM"), ++ }, ++ }, ++ { ++ /* Infinity E15-5A305-1M */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "GM5RGEE0016COM"), ++ }, ++ }, + { } + }; + +-- +2.43.0 + diff --git a/queue-6.7/acpi-resource-add-maibenben-x577-to-irq1_edge_low_fo.patch b/queue-6.7/acpi-resource-add-maibenben-x577-to-irq1_edge_low_fo.patch new file mode 100644 index 00000000000..c95ee276ff5 --- /dev/null +++ b/queue-6.7/acpi-resource-add-maibenben-x577-to-irq1_edge_low_fo.patch @@ -0,0 +1,49 @@ +From bf085efefd8b1c454c1ce6001cfeb53d20d926f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 19:24:08 +0300 +Subject: ACPI: resource: Add MAIBENBEN X577 to irq1_edge_low_force_override + +From: Maxim Kudinov + +[ Upstream commit 021a67d096154893cd1d883c7be0097e2ee327fd ] + +A known issue on some Zen laptops, keyboard stopped working due to commit +9946e39fe8d0 fael@kernel.org("ACPI: resource: skip IRQ override on AMD +Zen platforms") on kernel 5.19.10. + +The ACPI IRQ override is required for this board due to buggy DSDT, thus +adding the board vendor and name to irq1_edge_low_force_override fixes +the issue. + +Fixes: 9946e39fe8d0 ("ACPI: resource: skip IRQ override on AMD Zen platforms") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217394 +Link: https://lore.kernel.org/linux-acpi/20231006123304.32686-1-hdegoede@redhat.com/ +Tested-by: Maxim Trofimov +Signed-off-by: Maxim Kudinov +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/resource.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c +index 3ebb74eb768a5..c843feb02e980 100644 +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -602,6 +602,13 @@ static const struct dmi_system_id irq1_edge_low_force_override[] = { + DMI_MATCH(DMI_BOARD_NAME, "LL6FA"), + }, + }, ++ { ++ /* MAIBENBEN X577 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "MAIBENBEN"), ++ DMI_MATCH(DMI_BOARD_NAME, "X577"), ++ }, ++ }, + { } + }; + +-- +2.43.0 + diff --git a/queue-6.7/acpi-resource-do-irq-override-on-lunnen-ground-lapto.patch b/queue-6.7/acpi-resource-do-irq-override-on-lunnen-ground-lapto.patch new file mode 100644 index 00000000000..c590c834781 --- /dev/null +++ b/queue-6.7/acpi-resource-do-irq-override-on-lunnen-ground-lapto.patch @@ -0,0 +1,51 @@ +From 9c1da41a9f1c0e0c38312d2514908d2541e0ec84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 12:30:09 +0000 +Subject: ACPI: resource: Do IRQ override on Lunnen Ground laptops + +From: Alexey I. Froloff + +[ Upstream commit e23ad54fef186aa66007895be1382c88f1ee2bf7 ] + +The Lunnen Ground 15 and 16 needs IRQ overriding for the keyboard to +work. + +Adding an entries for these laptops to the override_table makes the +internal keyboard functional. + +Signed-off-by: Alexey I. Froloff +Signed-off-by: Rafael J. Wysocki +Stable-dep-of: 021a67d09615 ("ACPI: resource: Add MAIBENBEN X577 to irq1_edge_low_force_override") +Signed-off-by: Sasha Levin +--- + drivers/acpi/resource.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c +index dacad1d846c0d..3ebb74eb768a5 100644 +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -588,6 +588,20 @@ static const struct dmi_system_id irq1_edge_low_force_override[] = { + DMI_MATCH(DMI_BOARD_NAME, "GM5RGEE0016COM"), + }, + }, ++ { ++ /* Lunnen Ground 15 / AMD Ryzen 5 5500U */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Lunnen"), ++ DMI_MATCH(DMI_BOARD_NAME, "LLL5DAW"), ++ }, ++ }, ++ { ++ /* Lunnen Ground 16 / AMD Ryzen 7 5800U */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Lunnen"), ++ DMI_MATCH(DMI_BOARD_NAME, "LL6FA"), ++ }, ++ }, + { } + }; + +-- +2.43.0 + diff --git a/queue-6.7/acpi-scan-fix-device-check-notification-handling.patch b/queue-6.7/acpi-scan-fix-device-check-notification-handling.patch new file mode 100644 index 00000000000..3a0a0ddddac --- /dev/null +++ b/queue-6.7/acpi-scan-fix-device-check-notification-handling.patch @@ -0,0 +1,57 @@ +From 16634ae313b6222f05a55135a66bfb50b0cacffa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Feb 2024 17:35:27 +0100 +Subject: ACPI: scan: Fix device check notification handling + +From: Rafael J. Wysocki + +[ Upstream commit 793551c965116d9dfaf0550dacae1396a20efa69 ] + +It is generally invalid to fail a Device Check notification if the scan +handler has not been attached to the given device after a bus rescan, +because there may be valid reasons for the scan handler to refuse +attaching to the device (for example, the device is not ready). + +For this reason, modify acpi_scan_device_check() to return 0 in that +case without printing a warning. + +While at it, reduce the log level of the "already enumerated" message +in the same function, because it is only interesting when debugging +notification handling + +Fixes: 443fc8202272 ("ACPI / hotplug: Rework generic code to handle suprise removals") +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/acpi/scan.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c +index 02bb2cce423f4..35ad5781f0a5e 100644 +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -314,18 +314,14 @@ static int acpi_scan_device_check(struct acpi_device *adev) + * again). + */ + if (adev->handler) { +- dev_warn(&adev->dev, "Already enumerated\n"); +- return -EALREADY; ++ dev_dbg(&adev->dev, "Already enumerated\n"); ++ return 0; + } + error = acpi_bus_scan(adev->handle); + if (error) { + dev_warn(&adev->dev, "Namespace scan failure\n"); + return error; + } +- if (!adev->handler) { +- dev_warn(&adev->dev, "Enumeration failure\n"); +- error = -ENODEV; +- } + } else { + error = acpi_scan_device_not_enumerated(adev); + } +-- +2.43.0 + diff --git a/queue-6.7/af_unix-annotate-data-race-of-gc_in_progress-in-wait.patch b/queue-6.7/af_unix-annotate-data-race-of-gc_in_progress-in-wait.patch new file mode 100644 index 00000000000..9315ddb2387 --- /dev/null +++ b/queue-6.7/af_unix-annotate-data-race-of-gc_in_progress-in-wait.patch @@ -0,0 +1,39 @@ +From 0f19facb287d3698b24d367dfb977501a76a9d6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 09:08:52 -0800 +Subject: af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc(). + +From: Kuniyuki Iwashima + +[ Upstream commit 31e03207119a535d0b0e3b3a7f91983aeb2cb14d ] + +gc_in_progress is changed under spin_lock(&unix_gc_lock), +but wait_for_unix_gc() reads it locklessly. + +Let's use READ_ONCE(). + +Fixes: 5f23b734963e ("net: Fix soft lockups/OOM issues w/ unix garbage collector") +Signed-off-by: Kuniyuki Iwashima +Link: https://lore.kernel.org/r/20240123170856.41348-2-kuniyu@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/unix/garbage.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/unix/garbage.c b/net/unix/garbage.c +index 2a81880dac7b7..027c86e804f8a 100644 +--- a/net/unix/garbage.c ++++ b/net/unix/garbage.c +@@ -198,7 +198,7 @@ void wait_for_unix_gc(void) + if (READ_ONCE(unix_tot_inflight) > UNIX_INFLIGHT_TRIGGER_GC && + !READ_ONCE(gc_in_progress)) + unix_gc(); +- wait_event(unix_gc_wait, gc_in_progress == false); ++ wait_event(unix_gc_wait, !READ_ONCE(gc_in_progress)); + } + + /* The external entry point: unix_gc() */ +-- +2.43.0 + diff --git a/queue-6.7/afs-revert-afs-hide-silly-rename-files-from-userspac.patch b/queue-6.7/afs-revert-afs-hide-silly-rename-files-from-userspac.patch new file mode 100644 index 00000000000..519aaf98353 --- /dev/null +++ b/queue-6.7/afs-revert-afs-hide-silly-rename-files-from-userspac.patch @@ -0,0 +1,55 @@ +From 95ae1c3f6ad828e22aedeea2d80e569536b2ae69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 11:08:41 +0000 +Subject: afs: Revert "afs: Hide silly-rename files from userspace" + +From: David Howells + +[ Upstream commit 0aec3847d044273733285dcff90afda89ad461d2 ] + +This reverts commit 57e9d49c54528c49b8bffe6d99d782ea051ea534. + +This undoes the hiding of .__afsXXXX silly-rename files. The problem with +hiding them is that rm can't then manually delete them. + +This also reverts commit 5f7a07646655fb4108da527565dcdc80124b14c4 ("afs: Fix +endless loop in directory parsing") as that's a bugfix for the above. + +Fixes: 57e9d49c5452 ("afs: Hide silly-rename files from userspace") +Reported-by: Markus Suvanto +Link: https://lists.infradead.org/pipermail/linux-afs/2024-February/008102.html +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/3085695.1710328121@warthog.procyon.org.uk +Reviewed-by: Jeffrey E Altman +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/afs/dir.c | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/fs/afs/dir.c b/fs/afs/dir.c +index c097da6e9c5b2..7761f25a77f39 100644 +--- a/fs/afs/dir.c ++++ b/fs/afs/dir.c +@@ -474,16 +474,6 @@ static int afs_dir_iterate_block(struct afs_vnode *dvnode, + continue; + } + +- /* Don't expose silly rename entries to userspace. */ +- if (nlen > 6 && +- dire->u.name[0] == '.' && +- ctx->actor != afs_lookup_filldir && +- ctx->actor != afs_lookup_one_filldir && +- memcmp(dire->u.name, ".__afs", 6) == 0) { +- ctx->pos = blkoff + next * sizeof(union afs_xdr_dirent); +- continue; +- } +- + /* found the next entry */ + if (!dir_emit(ctx, dire->u.name, nlen, + ntohl(dire->u.vnode), +-- +2.43.0 + diff --git a/queue-6.7/alsa-hda-cs35l41-set-channel-index-correctly-when-sy.patch b/queue-6.7/alsa-hda-cs35l41-set-channel-index-correctly-when-sy.patch new file mode 100644 index 00000000000..f66f7945662 --- /dev/null +++ b/queue-6.7/alsa-hda-cs35l41-set-channel-index-correctly-when-sy.patch @@ -0,0 +1,69 @@ +From ff40391682a8f4061a0196446ab49b4c85a62123 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 16:40:02 +0000 +Subject: ALSA: hda: cs35l41: Set Channel Index correctly when system is + missing _DSD + +From: Stefan Binding + +[ Upstream commit 135096ebfab656823d0037102a00776f3914fee3 ] + +Current method to set Channel Index when the system is missing _DSD +assumes that the channels alternate, which is not guaranteed. +Instead use the same methodology as the main driver does when _DSD +exists. + +Fixes: 8c4c216db8fb ("ALSA: hda: cs35l41: Add config table to support many laptops without _DSD") + +Signed-off-by: Stefan Binding +Link: https://lore.kernel.org/r/20240126164005.367021-2-sbinding@opensource.cirrus.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/cs35l41_hda_property.c | 16 ++++++---------- + 1 file changed, 6 insertions(+), 10 deletions(-) + +diff --git a/sound/pci/hda/cs35l41_hda_property.c b/sound/pci/hda/cs35l41_hda_property.c +index 5a5f4b499fd94..b5b24fefb20cf 100644 +--- a/sound/pci/hda/cs35l41_hda_property.c ++++ b/sound/pci/hda/cs35l41_hda_property.c +@@ -207,6 +207,7 @@ static int generic_dsd_config(struct cs35l41_hda *cs35l41, struct device *physde + struct spi_device *spi; + bool dsd_found; + int ret; ++ int i; + + for (cfg = cs35l41_config_table; cfg->ssid; cfg++) { + if (!strcasecmp(cfg->ssid, cs35l41->acpi_subsystem_id)) +@@ -292,16 +293,6 @@ static int generic_dsd_config(struct cs35l41_hda *cs35l41, struct device *physde + cs35l41->index = id == 0x40 ? 0 : 1; + } + +- if (cfg->num_amps == 3) +- /* 3 amps means a center channel, so no duplicate channels */ +- cs35l41->channel_index = 0; +- else +- /* +- * if 4 amps, there are duplicate channels, so they need different indexes +- * if 2 amps, no duplicate channels, channel_index would be 0 +- */ +- cs35l41->channel_index = cs35l41->index / 2; +- + cs35l41->reset_gpio = fwnode_gpiod_get_index(acpi_fwnode_handle(cs35l41->dacpi), "reset", + cs35l41->index, GPIOD_OUT_LOW, + "cs35l41-reset"); +@@ -309,6 +300,11 @@ static int generic_dsd_config(struct cs35l41_hda *cs35l41, struct device *physde + + hw_cfg->spk_pos = cfg->channel[cs35l41->index]; + ++ cs35l41->channel_index = 0; ++ for (i = 0; i < cs35l41->index; i++) ++ if (cfg->channel[i] == hw_cfg->spk_pos) ++ cs35l41->channel_index++; ++ + if (cfg->boost_type == INTERNAL) { + hw_cfg->bst_type = CS35L41_INT_BOOST; + hw_cfg->bst_ind = cfg->boost_ind_nanohenry; +-- +2.43.0 + diff --git a/queue-6.7/alsa-hda-realtek-fix-alc285-issues-on-hp-envy-x360-l.patch b/queue-6.7/alsa-hda-realtek-fix-alc285-issues-on-hp-envy-x360-l.patch new file mode 100644 index 00000000000..0bddda4ca1f --- /dev/null +++ b/queue-6.7/alsa-hda-realtek-fix-alc285-issues-on-hp-envy-x360-l.patch @@ -0,0 +1,147 @@ +From da5b8bf1f0331f06396d91d966e1a6cc5af8c7e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Mar 2024 20:58:44 +0700 +Subject: ALSA: hda/realtek: fix ALC285 issues on HP Envy x360 laptops + +From: Athaariq Ardhiansyah + +[ Upstream commit c062166995c9e57d5cd508b332898f79da319802 ] + +Realtek codec on HP Envy laptop series are heavily modified by vendor. +Therefore, need intervention to make it work properly. The patch fixes: + +- B&O soundbar speakers (between lid and keyboard) activation +- Enable LED on mute button +- Add missing process coefficient which affects the output amplifier +- Volume control synchronization between B&O soundbar and side speakers +- Unmute headset output on several HP Envy models +- Auto-enable headset mic when plugged + +This patch was tested on HP Envy x360 13-AR0107AU with Realtek ALC285 + +The only unsolved problem is output amplifier of all built-in speakers +is too weak, which causes volume of built-in speakers cannot be loud +as vendor's proprietary driver due to missing _DSD parameter in the +firmware. The solution is currently on research. Expected to has another +patch in the future. + +Potential fix to related issues, need test before close those issues: + +- https://bugzilla.kernel.org/show_bug.cgi?id=189331 +- https://bugzilla.kernel.org/show_bug.cgi?id=216632 +- https://bugzilla.kernel.org/show_bug.cgi?id=216311 +- https://bugzilla.kernel.org/show_bug.cgi?id=213507 + +Signed-off-by: Athaariq Ardhiansyah +Message-ID: <20240310140249.3695-1-foss@athaariq.my.id> +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 63 +++++++++++++++++++++++++++++++++++ + 1 file changed, 63 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index baf550b5a7c49..0c746613c5ae0 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6696,6 +6696,60 @@ static void alc285_fixup_hp_spectre_x360(struct hda_codec *codec, + } + } + ++static void alc285_fixup_hp_envy_x360(struct hda_codec *codec, ++ const struct hda_fixup *fix, ++ int action) ++{ ++ static const struct coef_fw coefs[] = { ++ WRITE_COEF(0x08, 0x6a0c), WRITE_COEF(0x0d, 0xa023), ++ WRITE_COEF(0x10, 0x0320), WRITE_COEF(0x1a, 0x8c03), ++ WRITE_COEF(0x25, 0x1800), WRITE_COEF(0x26, 0x003a), ++ WRITE_COEF(0x28, 0x1dfe), WRITE_COEF(0x29, 0xb014), ++ WRITE_COEF(0x2b, 0x1dfe), WRITE_COEF(0x37, 0xfe15), ++ WRITE_COEF(0x38, 0x7909), WRITE_COEF(0x45, 0xd489), ++ WRITE_COEF(0x46, 0x00f4), WRITE_COEF(0x4a, 0x21e0), ++ WRITE_COEF(0x66, 0x03f0), WRITE_COEF(0x67, 0x1000), ++ WRITE_COEF(0x6e, 0x1005), { } ++ }; ++ ++ static const struct hda_pintbl pincfgs[] = { ++ { 0x12, 0xb7a60130 }, /* Internal microphone*/ ++ { 0x14, 0x90170150 }, /* B&O soundbar speakers */ ++ { 0x17, 0x90170153 }, /* Side speakers */ ++ { 0x19, 0x03a11040 }, /* Headset microphone */ ++ { } ++ }; ++ ++ switch (action) { ++ case HDA_FIXUP_ACT_PRE_PROBE: ++ snd_hda_apply_pincfgs(codec, pincfgs); ++ ++ /* Fixes volume control problem for side speakers */ ++ alc295_fixup_disable_dac3(codec, fix, action); ++ ++ /* Fixes no sound from headset speaker */ ++ snd_hda_codec_amp_stereo(codec, 0x21, HDA_OUTPUT, 0, -1, 0); ++ ++ /* Auto-enable headset mic when plugged */ ++ snd_hda_jack_set_gating_jack(codec, 0x19, 0x21); ++ ++ /* Headset mic volume enhancement */ ++ snd_hda_codec_set_pin_target(codec, 0x19, PIN_VREF50); ++ break; ++ case HDA_FIXUP_ACT_INIT: ++ alc_process_coef_fw(codec, coefs); ++ break; ++ case HDA_FIXUP_ACT_BUILD: ++ rename_ctl(codec, "Bass Speaker Playback Volume", ++ "B&O-Tuned Playback Volume"); ++ rename_ctl(codec, "Front Playback Switch", ++ "B&O Soundbar Playback Switch"); ++ rename_ctl(codec, "Bass Speaker Playback Switch", ++ "Side Speaker Playback Switch"); ++ break; ++ } ++} ++ + /* for hda_fixup_thinkpad_acpi() */ + #include "thinkpad_helper.c" + +@@ -7291,6 +7345,7 @@ enum { + ALC280_FIXUP_HP_9480M, + ALC245_FIXUP_HP_X360_AMP, + ALC285_FIXUP_HP_SPECTRE_X360_EB1, ++ ALC285_FIXUP_HP_ENVY_X360, + ALC288_FIXUP_DELL_HEADSET_MODE, + ALC288_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC288_FIXUP_DELL_XPS_13, +@@ -9266,6 +9321,12 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_hp_spectre_x360_eb1 + }, ++ [ALC285_FIXUP_HP_ENVY_X360] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc285_fixup_hp_envy_x360, ++ .chained = true, ++ .chain_id = ALC285_FIXUP_HP_GPIO_AMP_INIT, ++ }, + [ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_ideapad_s740_coef, +@@ -9848,6 +9909,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3), + SND_PCI_QUIRK(0x103c, 0x8519, "HP Spectre x360 15-df0xxx", ALC285_FIXUP_HP_SPECTRE_X360), + SND_PCI_QUIRK(0x103c, 0x8537, "HP ProBook 440 G6", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), ++ SND_PCI_QUIRK(0x103c, 0x85de, "HP Envy x360 13-ar0xxx", ALC285_FIXUP_HP_ENVY_X360), + SND_PCI_QUIRK(0x103c, 0x860f, "HP ZBook 15 G6", ALC285_FIXUP_HP_GPIO_AMP_INIT), + SND_PCI_QUIRK(0x103c, 0x861f, "HP Elite Dragonfly G1", ALC285_FIXUP_HP_GPIO_AMP_INIT), + SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED), +@@ -10541,6 +10603,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { + {.id = ALC295_FIXUP_HP_OMEN, .name = "alc295-hp-omen"}, + {.id = ALC285_FIXUP_HP_SPECTRE_X360, .name = "alc285-hp-spectre-x360"}, + {.id = ALC285_FIXUP_HP_SPECTRE_X360_EB1, .name = "alc285-hp-spectre-x360-eb1"}, ++ {.id = ALC285_FIXUP_HP_ENVY_X360, .name = "alc285-hp-envy-x360"}, + {.id = ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP, .name = "alc287-ideapad-bass-spk-amp"}, + {.id = ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN, .name = "alc287-yoga9-bass-spk-pin"}, + {.id = ALC623_FIXUP_LENOVO_THINKSTATION_P340, .name = "alc623-lenovo-thinkstation-p340"}, +-- +2.43.0 + diff --git a/queue-6.7/alsa-hda-tas2781-add-lock-to-system_suspend.patch b/queue-6.7/alsa-hda-tas2781-add-lock-to-system_suspend.patch new file mode 100644 index 00000000000..ec2031ddcba --- /dev/null +++ b/queue-6.7/alsa-hda-tas2781-add-lock-to-system_suspend.patch @@ -0,0 +1,41 @@ +From 4a1b6688dfc0ae18c215f7dd12d66e69e3aaf9d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 18:41:41 +0100 +Subject: ALSA: hda/tas2781: add lock to system_suspend + +From: Gergo Koteles + +[ Upstream commit c58e6ed55a1bb9811d6d936d001b068bb0419467 ] + +Add the missing lock around tasdevice_tuning_switch(). + +Fixes: 5be27f1e3ec9 ("ALSA: hda/tas2781: Add tas2781 HDA driver") +Signed-off-by: Gergo Koteles +Signed-off-by: Takashi Iwai +Message-ID: +Signed-off-by: Sasha Levin +--- + sound/pci/hda/tas2781_hda_i2c.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/pci/hda/tas2781_hda_i2c.c b/sound/pci/hda/tas2781_hda_i2c.c +index c39a5404fb392..10b5624b1f1f0 100644 +--- a/sound/pci/hda/tas2781_hda_i2c.c ++++ b/sound/pci/hda/tas2781_hda_i2c.c +@@ -796,9 +796,13 @@ static int tas2781_system_suspend(struct device *dev) + if (ret) + return ret; + ++ mutex_lock(&tas_hda->priv->codec_lock); ++ + /* Shutdown chip before system suspend */ + tasdevice_tuning_switch(tas_hda->priv, 1); + ++ mutex_unlock(&tas_hda->priv->codec_lock); ++ + /* + * Reset GPIO may be shared, so cannot reset here. + * However beyond this point, amps may be powered down. +-- +2.43.0 + diff --git a/queue-6.7/alsa-hda-tas2781-add-ptrs-to-calibration-functions.patch b/queue-6.7/alsa-hda-tas2781-add-ptrs-to-calibration-functions.patch new file mode 100644 index 00000000000..7469a8bd929 --- /dev/null +++ b/queue-6.7/alsa-hda-tas2781-add-ptrs-to-calibration-functions.patch @@ -0,0 +1,160 @@ +From c4da03f58cbf9e7905ad03d3c0a376520878f058 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Dec 2023 01:09:42 +0100 +Subject: ALSA: hda/tas2781: add ptrs to calibration functions + +From: Gergo Koteles + +[ Upstream commit 76f5f55c45b906710c9565a7e68c8d782c46b394 ] + +Make calibration functions configurable to support different calibration +data storage modes. + +Signed-off-by: Gergo Koteles +Link: https://lore.kernel.org/r/5859c77ffef752b8a9784713b412d815d7e2688c.1703891777.git.soyer@irl.hu +Signed-off-by: Takashi Iwai +Stable-dep-of: 5f51de7e30c7 ("ALSA: hda/tas2781: do not call pm_runtime_force_* in system_resume/suspend") +Signed-off-by: Sasha Levin +--- + include/sound/tas2781.h | 5 +++++ + sound/pci/hda/tas2781_hda_i2c.c | 25 +++++++++++-------------- + sound/soc/codecs/tas2781-comlib.c | 15 +++++++++++++++ + 3 files changed, 31 insertions(+), 14 deletions(-) + +diff --git a/include/sound/tas2781.h b/include/sound/tas2781.h +index 475294c853aa4..be58d870505a4 100644 +--- a/include/sound/tas2781.h ++++ b/include/sound/tas2781.h +@@ -131,6 +131,9 @@ struct tasdevice_priv { + const struct firmware *fmw, int offset); + int (*tasdevice_load_block)(struct tasdevice_priv *tas_priv, + struct tasdev_blk *block); ++ ++ int (*save_calibration)(struct tasdevice_priv *tas_priv); ++ void (*apply_calibration)(struct tasdevice_priv *tas_priv); + }; + + void tas2781_reset(struct tasdevice_priv *tas_dev); +@@ -140,6 +143,8 @@ int tascodec_init(struct tasdevice_priv *tas_priv, void *codec, + struct tasdevice_priv *tasdevice_kzalloc(struct i2c_client *i2c); + int tasdevice_init(struct tasdevice_priv *tas_priv); + void tasdevice_remove(struct tasdevice_priv *tas_priv); ++int tasdevice_save_calibration(struct tasdevice_priv *tas_priv); ++void tasdevice_apply_calibration(struct tasdevice_priv *tas_priv); + int tasdevice_dev_read(struct tasdevice_priv *tas_priv, + unsigned short chn, unsigned int reg, unsigned int *value); + int tasdevice_dev_write(struct tasdevice_priv *tas_priv, +diff --git a/sound/pci/hda/tas2781_hda_i2c.c b/sound/pci/hda/tas2781_hda_i2c.c +index 04539abf9e716..167ee2f89e9d0 100644 +--- a/sound/pci/hda/tas2781_hda_i2c.c ++++ b/sound/pci/hda/tas2781_hda_i2c.c +@@ -479,7 +479,7 @@ static int tas2781_save_calibration(struct tasdevice_priv *tas_priv) + dev_dbg(tas_priv->dev, "%4ld-%2d-%2d, %2d:%2d:%2d\n", + tm->tm_year, tm->tm_mon, tm->tm_mday, + tm->tm_hour, tm->tm_min, tm->tm_sec); +- tas2781_apply_calib(tas_priv); ++ tasdevice_apply_calibration(tas_priv); + } else + tas_priv->cali_data.total_sz = 0; + +@@ -582,7 +582,7 @@ static void tasdev_fw_ready(const struct firmware *fmw, void *context) + /* If calibrated data occurs error, dsp will still works with default + * calibrated data inside algo. + */ +- tas2781_save_calibration(tas_priv); ++ tasdevice_save_calibration(tas_priv); + + out: + mutex_unlock(&tas_hda->priv->codec_lock); +@@ -683,10 +683,6 @@ static int tas2781_hda_i2c_probe(struct i2c_client *clt) + const char *device_name; + int ret; + +- if (strstr(dev_name(&clt->dev), "TIAS2781")) +- device_name = "TIAS2781"; +- else +- return -ENODEV; + + tas_hda = devm_kzalloc(&clt->dev, sizeof(*tas_hda), GFP_KERNEL); + if (!tas_hda) +@@ -699,6 +695,13 @@ static int tas2781_hda_i2c_probe(struct i2c_client *clt) + if (!tas_hda->priv) + return -ENOMEM; + ++ if (strstr(dev_name(&clt->dev), "TIAS2781")) { ++ device_name = "TIAS2781"; ++ tas_hda->priv->save_calibration = tas2781_save_calibration; ++ tas_hda->priv->apply_calibration = tas2781_apply_calib; ++ } else ++ return -ENODEV; ++ + tas_hda->priv->irq_info.irq = clt->irq; + ret = tas2781_read_acpi(tas_hda->priv, device_name); + if (ret) +@@ -758,8 +761,6 @@ static int tas2781_runtime_suspend(struct device *dev) + static int tas2781_runtime_resume(struct device *dev) + { + struct tas2781_hda *tas_hda = dev_get_drvdata(dev); +- unsigned long calib_data_sz = +- tas_hda->priv->ndev * TASDEVICE_SPEAKER_CALIBRATION_SIZE; + + dev_dbg(tas_hda->dev, "Runtime Resume\n"); + +@@ -770,8 +771,7 @@ static int tas2781_runtime_resume(struct device *dev) + /* If calibrated data occurs error, dsp will still works with default + * calibrated data inside algo. + */ +- if (tas_hda->priv->cali_data.total_sz > calib_data_sz) +- tas2781_apply_calib(tas_hda->priv); ++ tasdevice_apply_calibration(tas_hda->priv); + + mutex_unlock(&tas_hda->priv->codec_lock); + +@@ -806,8 +806,6 @@ static int tas2781_system_suspend(struct device *dev) + static int tas2781_system_resume(struct device *dev) + { + struct tas2781_hda *tas_hda = dev_get_drvdata(dev); +- unsigned long calib_data_sz = +- tas_hda->priv->ndev * TASDEVICE_SPEAKER_CALIBRATION_SIZE; + int i, ret; + + dev_dbg(tas_hda->priv->dev, "System Resume\n"); +@@ -829,8 +827,7 @@ static int tas2781_system_resume(struct device *dev) + /* If calibrated data occurs error, dsp will still work with default + * calibrated data inside algo. + */ +- if (tas_hda->priv->cali_data.total_sz > calib_data_sz) +- tas2781_apply_calib(tas_hda->priv); ++ tasdevice_apply_calibration(tas_hda->priv); + mutex_unlock(&tas_hda->priv->codec_lock); + + return 0; +diff --git a/sound/soc/codecs/tas2781-comlib.c b/sound/soc/codecs/tas2781-comlib.c +index add16302f711e..5d0e5348b361a 100644 +--- a/sound/soc/codecs/tas2781-comlib.c ++++ b/sound/soc/codecs/tas2781-comlib.c +@@ -413,6 +413,21 @@ void tasdevice_remove(struct tasdevice_priv *tas_priv) + } + EXPORT_SYMBOL_GPL(tasdevice_remove); + ++int tasdevice_save_calibration(struct tasdevice_priv *tas_priv) ++{ ++ if (tas_priv->save_calibration) ++ return tas_priv->save_calibration(tas_priv); ++ return -EINVAL; ++} ++EXPORT_SYMBOL_GPL(tasdevice_save_calibration); ++ ++void tasdevice_apply_calibration(struct tasdevice_priv *tas_priv) ++{ ++ if (tas_priv->apply_calibration && tas_priv->cali_data.total_sz) ++ tas_priv->apply_calibration(tas_priv); ++} ++EXPORT_SYMBOL_GPL(tasdevice_apply_calibration); ++ + static int tasdevice_clamp(int val, int max, unsigned int invert) + { + if (val > max) +-- +2.43.0 + diff --git a/queue-6.7/alsa-hda-tas2781-configure-the-amp-after-firmware-lo.patch b/queue-6.7/alsa-hda-tas2781-configure-the-amp-after-firmware-lo.patch new file mode 100644 index 00000000000..dce367319ae --- /dev/null +++ b/queue-6.7/alsa-hda-tas2781-configure-the-amp-after-firmware-lo.patch @@ -0,0 +1,39 @@ +From 785515a0525bd247906eecae83be748b2da6e73e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Dec 2023 01:13:41 +0100 +Subject: ALSA: hda/tas2781: configure the amp after firmware load + +From: Gergo Koteles + +[ Upstream commit 68f7f3ff6c2a0998be9dc07622bd0d16fd1fda20 ] + +Make the amp available immediately after a module +load to avoid having to wait for a PCM hook action. +(eg. unloading & loading the module while listening +music) + +Signed-off-by: Gergo Koteles +Link: https://lore.kernel.org/r/7f2f65d9212aa16edd4db8725489ae59dbe74c66.1703895108.git.soyer@irl.hu +Signed-off-by: Takashi Iwai +Stable-dep-of: 9fc91a6fe37c ("ALSA: hda/tas2781: restore power state after system_resume") +Signed-off-by: Sasha Levin +--- + sound/pci/hda/tas2781_hda_i2c.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/pci/hda/tas2781_hda_i2c.c b/sound/pci/hda/tas2781_hda_i2c.c +index 0479ae6e3644a..4b6e22a4b0c11 100644 +--- a/sound/pci/hda/tas2781_hda_i2c.c ++++ b/sound/pci/hda/tas2781_hda_i2c.c +@@ -584,6 +584,8 @@ static void tasdev_fw_ready(const struct firmware *fmw, void *context) + */ + tasdevice_save_calibration(tas_priv); + ++ tasdevice_tuning_switch(tas_hda->priv, 0); ++ + out: + mutex_unlock(&tas_hda->priv->codec_lock); + if (fmw) +-- +2.43.0 + diff --git a/queue-6.7/alsa-hda-tas2781-do-not-call-pm_runtime_force_-in-sy.patch b/queue-6.7/alsa-hda-tas2781-do-not-call-pm_runtime_force_-in-sy.patch new file mode 100644 index 00000000000..ec9734223cf --- /dev/null +++ b/queue-6.7/alsa-hda-tas2781-do-not-call-pm_runtime_force_-in-sy.patch @@ -0,0 +1,64 @@ +From ced53b8138070c2e1577ed3058eb8478c6ef241c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 18:41:43 +0100 +Subject: ALSA: hda/tas2781: do not call pm_runtime_force_* in + system_resume/suspend + +From: Gergo Koteles + +[ Upstream commit 5f51de7e30c7282162a631af8a425b54a4576346 ] + +The runtime_resume function calls prmg_load and apply_calibration +functions, but system_resume also calls them, so calling +pm_runtime_force_resume before reset is unnecessary. + +For consistency, do not call the pm_runtime_force_suspend in +system_suspend, as runtime_suspend does the same. + +Fixes: 5be27f1e3ec9 ("ALSA: hda/tas2781: Add tas2781 HDA driver") +Signed-off-by: Gergo Koteles +Signed-off-by: Takashi Iwai +Message-ID: +Signed-off-by: Sasha Levin +--- + sound/pci/hda/tas2781_hda_i2c.c | 11 +---------- + 1 file changed, 1 insertion(+), 10 deletions(-) + +diff --git a/sound/pci/hda/tas2781_hda_i2c.c b/sound/pci/hda/tas2781_hda_i2c.c +index 167ee2f89e9d0..0479ae6e3644a 100644 +--- a/sound/pci/hda/tas2781_hda_i2c.c ++++ b/sound/pci/hda/tas2781_hda_i2c.c +@@ -781,14 +781,9 @@ static int tas2781_runtime_resume(struct device *dev) + static int tas2781_system_suspend(struct device *dev) + { + struct tas2781_hda *tas_hda = dev_get_drvdata(dev); +- int ret; + + dev_dbg(tas_hda->priv->dev, "System Suspend\n"); + +- ret = pm_runtime_force_suspend(dev); +- if (ret) +- return ret; +- + mutex_lock(&tas_hda->priv->codec_lock); + + /* Shutdown chip before system suspend */ +@@ -806,14 +801,10 @@ static int tas2781_system_suspend(struct device *dev) + static int tas2781_system_resume(struct device *dev) + { + struct tas2781_hda *tas_hda = dev_get_drvdata(dev); +- int i, ret; ++ int i; + + dev_dbg(tas_hda->priv->dev, "System Resume\n"); + +- ret = pm_runtime_force_resume(dev); +- if (ret) +- return ret; +- + mutex_lock(&tas_hda->priv->codec_lock); + + for (i = 0; i < tas_hda->priv->ndev; i++) { +-- +2.43.0 + diff --git a/queue-6.7/alsa-hda-tas2781-do-not-reset-cur_-values-in-runtime.patch b/queue-6.7/alsa-hda-tas2781-do-not-reset-cur_-values-in-runtime.patch new file mode 100644 index 00000000000..d58056172a3 --- /dev/null +++ b/queue-6.7/alsa-hda-tas2781-do-not-reset-cur_-values-in-runtime.patch @@ -0,0 +1,53 @@ +From c3a827b2c61c3323a70cb2617182874267feb8ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 18:41:42 +0100 +Subject: ALSA: hda/tas2781: do not reset cur_* values in runtime_suspend + +From: Gergo Koteles + +[ Upstream commit bec7760a6c5fa59593dac264fa0c628e46815986 ] + +The amplifier doesn't loose register state in software shutdown mode, so +there is no need to reset the cur_* values. + +Without these resets, the amplifier can be turned on after +runtime_suspend without waiting for the program and +profile to be restored. + +Fixes: 5be27f1e3ec9 ("ALSA: hda/tas2781: Add tas2781 HDA driver") +Signed-off-by: Gergo Koteles +Signed-off-by: Takashi Iwai +Message-ID: +Signed-off-by: Sasha Levin +--- + sound/pci/hda/tas2781_hda_i2c.c | 7 ------- + 1 file changed, 7 deletions(-) + +diff --git a/sound/pci/hda/tas2781_hda_i2c.c b/sound/pci/hda/tas2781_hda_i2c.c +index 10b5624b1f1f0..04539abf9e716 100644 +--- a/sound/pci/hda/tas2781_hda_i2c.c ++++ b/sound/pci/hda/tas2781_hda_i2c.c +@@ -740,7 +740,6 @@ static void tas2781_hda_i2c_remove(struct i2c_client *clt) + static int tas2781_runtime_suspend(struct device *dev) + { + struct tas2781_hda *tas_hda = dev_get_drvdata(dev); +- int i; + + dev_dbg(tas_hda->dev, "Runtime Suspend\n"); + +@@ -751,12 +750,6 @@ static int tas2781_runtime_suspend(struct device *dev) + tas_hda->priv->playback_started = false; + } + +- for (i = 0; i < tas_hda->priv->ndev; i++) { +- tas_hda->priv->tasdevice[i].cur_book = -1; +- tas_hda->priv->tasdevice[i].cur_prog = -1; +- tas_hda->priv->tasdevice[i].cur_conf = -1; +- } +- + mutex_unlock(&tas_hda->priv->codec_lock); + + return 0; +-- +2.43.0 + diff --git a/queue-6.7/alsa-hda-tas2781-restore-power-state-after-system_re.patch b/queue-6.7/alsa-hda-tas2781-restore-power-state-after-system_re.patch new file mode 100644 index 00000000000..6d5651e90bc --- /dev/null +++ b/queue-6.7/alsa-hda-tas2781-restore-power-state-after-system_re.patch @@ -0,0 +1,84 @@ +From 4d625a97cf22d7fbdc72cb93b8f5903fc74b775e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 18:41:44 +0100 +Subject: ALSA: hda/tas2781: restore power state after system_resume + +From: Gergo Koteles + +[ Upstream commit 9fc91a6fe37c78ef301aed4251f7e50b8524e72d ] + +After system_resume the amplifers will remain off, even if they were on +before system_suspend. + +Use playback_started bool to save the playback state, and restore power +state based on it. + +Fixes: 5be27f1e3ec9 ("ALSA: hda/tas2781: Add tas2781 HDA driver") +Signed-off-by: Gergo Koteles +Signed-off-by: Takashi Iwai +Message-ID: <1742b61901781826f6e6212ffe1d21af542d134a.1709918447.git.soyer@irl.hu> +Signed-off-by: Sasha Levin +--- + sound/pci/hda/tas2781_hda_i2c.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/hda/tas2781_hda_i2c.c b/sound/pci/hda/tas2781_hda_i2c.c +index 4b6e22a4b0c11..5179b69e403ac 100644 +--- a/sound/pci/hda/tas2781_hda_i2c.c ++++ b/sound/pci/hda/tas2781_hda_i2c.c +@@ -142,11 +142,13 @@ static void tas2781_hda_playback_hook(struct device *dev, int action) + pm_runtime_get_sync(dev); + mutex_lock(&tas_hda->priv->codec_lock); + tasdevice_tuning_switch(tas_hda->priv, 0); ++ tas_hda->priv->playback_started = true; + mutex_unlock(&tas_hda->priv->codec_lock); + break; + case HDA_GEN_PCM_ACT_CLOSE: + mutex_lock(&tas_hda->priv->codec_lock); + tasdevice_tuning_switch(tas_hda->priv, 1); ++ tas_hda->priv->playback_started = false; + mutex_unlock(&tas_hda->priv->codec_lock); + + pm_runtime_mark_last_busy(dev); +@@ -585,6 +587,7 @@ static void tasdev_fw_ready(const struct firmware *fmw, void *context) + tasdevice_save_calibration(tas_priv); + + tasdevice_tuning_switch(tas_hda->priv, 0); ++ tas_hda->priv->playback_started = true; + + out: + mutex_unlock(&tas_hda->priv->codec_lock); +@@ -750,6 +753,9 @@ static int tas2781_runtime_suspend(struct device *dev) + + mutex_lock(&tas_hda->priv->codec_lock); + ++ /* The driver powers up the amplifiers at module load time. ++ * Stop the playback if it's unused. ++ */ + if (tas_hda->priv->playback_started) { + tasdevice_tuning_switch(tas_hda->priv, 1); + tas_hda->priv->playback_started = false; +@@ -789,7 +795,8 @@ static int tas2781_system_suspend(struct device *dev) + mutex_lock(&tas_hda->priv->codec_lock); + + /* Shutdown chip before system suspend */ +- tasdevice_tuning_switch(tas_hda->priv, 1); ++ if (tas_hda->priv->playback_started) ++ tasdevice_tuning_switch(tas_hda->priv, 1); + + mutex_unlock(&tas_hda->priv->codec_lock); + +@@ -821,6 +828,10 @@ static int tas2781_system_resume(struct device *dev) + * calibrated data inside algo. + */ + tasdevice_apply_calibration(tas_hda->priv); ++ ++ if (tas_hda->priv->playback_started) ++ tasdevice_tuning_switch(tas_hda->priv, 0); ++ + mutex_unlock(&tas_hda->priv->codec_lock); + + return 0; +-- +2.43.0 + diff --git a/queue-6.7/alsa-hda-tas2781-use-dev_dbg-in-system_resume.patch b/queue-6.7/alsa-hda-tas2781-use-dev_dbg-in-system_resume.patch new file mode 100644 index 00000000000..ff92e3d66e4 --- /dev/null +++ b/queue-6.7/alsa-hda-tas2781-use-dev_dbg-in-system_resume.patch @@ -0,0 +1,39 @@ +From d8f9276bd8cc5e36c54fc415ecfa0e262e5d569e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 18:41:40 +0100 +Subject: ALSA: hda/tas2781: use dev_dbg in system_resume + +From: Gergo Koteles + +[ Upstream commit c850c9121cc8de867ce3ac36b9ae9d05f62bef14 ] + +The system_resume function uses dev_info for tracing, but the other pm +functions use dev_dbg. + +Use dev_dbg as the other pm functions. + +Fixes: 5be27f1e3ec9 ("ALSA: hda/tas2781: Add tas2781 HDA driver") +Signed-off-by: Gergo Koteles +Signed-off-by: Takashi Iwai +Message-ID: <140f3c689c9eb5874e6eb48a570fcd8207f06a41.1709918447.git.soyer@irl.hu> +Signed-off-by: Sasha Levin +--- + sound/pci/hda/tas2781_hda_i2c.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/hda/tas2781_hda_i2c.c b/sound/pci/hda/tas2781_hda_i2c.c +index 9f98965742e83..c39a5404fb392 100644 +--- a/sound/pci/hda/tas2781_hda_i2c.c ++++ b/sound/pci/hda/tas2781_hda_i2c.c +@@ -813,7 +813,7 @@ static int tas2781_system_resume(struct device *dev) + tas_hda->priv->ndev * TASDEVICE_SPEAKER_CALIBRATION_SIZE; + int i, ret; + +- dev_info(tas_hda->priv->dev, "System Resume\n"); ++ dev_dbg(tas_hda->priv->dev, "System Resume\n"); + + ret = pm_runtime_force_resume(dev); + if (ret) +-- +2.43.0 + diff --git a/queue-6.7/alsa-seq-fix-function-cast-warnings.patch b/queue-6.7/alsa-seq-fix-function-cast-warnings.patch new file mode 100644 index 00000000000..7c4912e7125 --- /dev/null +++ b/queue-6.7/alsa-seq-fix-function-cast-warnings.patch @@ -0,0 +1,95 @@ +From 463b6181750ca755f9c6e1ebcfb864f483bee75d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 14:53:43 +0100 +Subject: ALSA: seq: fix function cast warnings + +From: Takashi Iwai + +[ Upstream commit d7bf73809849463f76de42aad62c850305dd6c5d ] + +clang-16 points out a control flow integrity (kcfi) issue when event +callbacks get converted to incompatible types: + +sound/core/seq/seq_midi.c:135:30: error: cast from 'int (*)(struct snd_rawmidi_substream *, const char *, int)' to 'snd_seq_dump_func_t' (aka 'int (*)(void *, void *, int)') converts to incompatible function type [-Werror,-Wcast-function-type-strict] + 135 | snd_seq_dump_var_event(ev, (snd_seq_dump_func_t)dump_midi, substream); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +sound/core/seq/seq_virmidi.c:83:31: error: cast from 'int (*)(struct snd_rawmidi_substream *, const unsigned char *, int)' to 'snd_seq_dump_func_t' (aka 'int (*)(void *, void *, int)') converts to incompatible function type [-Werror,-Wcast-function-type-strict] + 83 | snd_seq_dump_var_event(ev, (snd_seq_dump_func_t)snd_rawmidi_receive, vmidi->substream); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +For addressing those errors, introduce wrapper functions that are used +for callbacks and bridge to the actual function call with pointer +cast. + +The code was originally added with the initial ALSA merge in linux-2.5.4. + +[ the patch description shamelessly copied from Arnd's original patch + -- tiwai ] + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20240213101020.459183-1-arnd@kernel.org +Link: https://lore.kernel.org/r/20240213135343.16411-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/seq/seq_midi.c | 8 +++++++- + sound/core/seq/seq_virmidi.c | 9 ++++++++- + 2 files changed, 15 insertions(+), 2 deletions(-) + +diff --git a/sound/core/seq/seq_midi.c b/sound/core/seq/seq_midi.c +index 18320a248aa7d..78dcb0ea15582 100644 +--- a/sound/core/seq/seq_midi.c ++++ b/sound/core/seq/seq_midi.c +@@ -113,6 +113,12 @@ static int dump_midi(struct snd_rawmidi_substream *substream, const char *buf, i + return 0; + } + ++/* callback for snd_seq_dump_var_event(), bridging to dump_midi() */ ++static int __dump_midi(void *ptr, void *buf, int count) ++{ ++ return dump_midi(ptr, buf, count); ++} ++ + static int event_process_midi(struct snd_seq_event *ev, int direct, + void *private_data, int atomic, int hop) + { +@@ -132,7 +138,7 @@ static int event_process_midi(struct snd_seq_event *ev, int direct, + pr_debug("ALSA: seq_midi: invalid sysex event flags = 0x%x\n", ev->flags); + return 0; + } +- snd_seq_dump_var_event(ev, (snd_seq_dump_func_t)dump_midi, substream); ++ snd_seq_dump_var_event(ev, __dump_midi, substream); + snd_midi_event_reset_decode(msynth->parser); + } else { + if (msynth->parser == NULL) +diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c +index 1b9260108e482..1678737f11be7 100644 +--- a/sound/core/seq/seq_virmidi.c ++++ b/sound/core/seq/seq_virmidi.c +@@ -62,6 +62,13 @@ static void snd_virmidi_init_event(struct snd_virmidi *vmidi, + /* + * decode input event and put to read buffer of each opened file + */ ++ ++/* callback for snd_seq_dump_var_event(), bridging to snd_rawmidi_receive() */ ++static int dump_to_rawmidi(void *ptr, void *buf, int count) ++{ ++ return snd_rawmidi_receive(ptr, buf, count); ++} ++ + static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev, + struct snd_seq_event *ev, + bool atomic) +@@ -80,7 +87,7 @@ static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev, + if (ev->type == SNDRV_SEQ_EVENT_SYSEX) { + if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) != SNDRV_SEQ_EVENT_LENGTH_VARIABLE) + continue; +- snd_seq_dump_var_event(ev, (snd_seq_dump_func_t)snd_rawmidi_receive, vmidi->substream); ++ snd_seq_dump_var_event(ev, dump_to_rawmidi, vmidi->substream); + snd_midi_event_reset_decode(vmidi->parser); + } else { + len = snd_midi_event_decode(vmidi->parser, msg, sizeof(msg), ev); +-- +2.43.0 + diff --git a/queue-6.7/alsa-usb-audio-stop-parsing-channels-bits-when-all-c.patch b/queue-6.7/alsa-usb-audio-stop-parsing-channels-bits-when-all-c.patch new file mode 100644 index 00000000000..8535d9b565e --- /dev/null +++ b/queue-6.7/alsa-usb-audio-stop-parsing-channels-bits-when-all-c.patch @@ -0,0 +1,43 @@ +From 2a2fc04ea00e9d9f04fb1962965ede5bbc270620 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 09:15:09 +0100 +Subject: ALSA: usb-audio: Stop parsing channels bits when all channels are + found. + +From: Johan Carlsson + +[ Upstream commit a39d51ff1f52cd0b6fe7d379ac93bd8b4237d1b7 ] + +If a usb audio device sets more bits than the amount of channels +it could write outside of the map array. + +Signed-off-by: Johan Carlsson +Fixes: 04324ccc75f9 ("ALSA: usb-audio: add channel map support") +Message-ID: <20240313081509.9801-1-johan.carlsson@teenage.engineering> +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/stream.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/usb/stream.c b/sound/usb/stream.c +index 3d4add94e367d..d5409f3879455 100644 +--- a/sound/usb/stream.c ++++ b/sound/usb/stream.c +@@ -300,9 +300,12 @@ static struct snd_pcm_chmap_elem *convert_chmap(int channels, unsigned int bits, + c = 0; + + if (bits) { +- for (; bits && *maps; maps++, bits >>= 1) ++ for (; bits && *maps; maps++, bits >>= 1) { + if (bits & 1) + chmap->map[c++] = *maps; ++ if (c == chmap->channels) ++ break; ++ } + } else { + /* If we're missing wChannelConfig, then guess something + to make sure the channel map is not skipped entirely */ +-- +2.43.0 + diff --git a/queue-6.7/aoe-fix-the-potential-use-after-free-problem-in-aoec.patch b/queue-6.7/aoe-fix-the-potential-use-after-free-problem-in-aoec.patch new file mode 100644 index 00000000000..8c5b12ccd0b --- /dev/null +++ b/queue-6.7/aoe-fix-the-potential-use-after-free-problem-in-aoec.patch @@ -0,0 +1,88 @@ +From 900af46b20ae9dbc29355ae7e15f2272ee5120ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 16:20:48 +0800 +Subject: aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts + +From: Chun-Yi Lee + +[ Upstream commit f98364e926626c678fb4b9004b75cacf92ff0662 ] + +This patch is against CVE-2023-6270. The description of cve is: + + A flaw was found in the ATA over Ethernet (AoE) driver in the Linux + kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on + `struct net_device`, and a use-after-free can be triggered by racing + between the free on the struct and the access through the `skbtxq` + global queue. This could lead to a denial of service condition or + potential code execution. + +In aoecmd_cfg_pkts(), it always calls dev_put(ifp) when skb initial +code is finished. But the net_device ifp will still be used in +later tx()->dev_queue_xmit() in kthread. Which means that the +dev_put(ifp) should NOT be called in the success path of skb +initial code in aoecmd_cfg_pkts(). Otherwise tx() may run into +use-after-free because the net_device is freed. + +This patch removed the dev_put(ifp) in the success path in +aoecmd_cfg_pkts(), and added dev_put() after skb xmit in tx(). + +Link: https://nvd.nist.gov/vuln/detail/CVE-2023-6270 +Fixes: 7562f876cd93 ("[NET]: Rework dev_base via list_head (v3)") +Signed-off-by: Chun-Yi Lee +Link: https://lore.kernel.org/r/20240305082048.25526-1-jlee@suse.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/aoe/aoecmd.c | 12 ++++++------ + drivers/block/aoe/aoenet.c | 1 + + 2 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c +index d7317425be510..cc9077b588d7e 100644 +--- a/drivers/block/aoe/aoecmd.c ++++ b/drivers/block/aoe/aoecmd.c +@@ -419,13 +419,16 @@ aoecmd_cfg_pkts(ushort aoemajor, unsigned char aoeminor, struct sk_buff_head *qu + rcu_read_lock(); + for_each_netdev_rcu(&init_net, ifp) { + dev_hold(ifp); +- if (!is_aoe_netif(ifp)) +- goto cont; ++ if (!is_aoe_netif(ifp)) { ++ dev_put(ifp); ++ continue; ++ } + + skb = new_skb(sizeof *h + sizeof *ch); + if (skb == NULL) { + printk(KERN_INFO "aoe: skb alloc failure\n"); +- goto cont; ++ dev_put(ifp); ++ continue; + } + skb_put(skb, sizeof *h + sizeof *ch); + skb->dev = ifp; +@@ -440,9 +443,6 @@ aoecmd_cfg_pkts(ushort aoemajor, unsigned char aoeminor, struct sk_buff_head *qu + h->major = cpu_to_be16(aoemajor); + h->minor = aoeminor; + h->cmd = AOECMD_CFG; +- +-cont: +- dev_put(ifp); + } + rcu_read_unlock(); + } +diff --git a/drivers/block/aoe/aoenet.c b/drivers/block/aoe/aoenet.c +index c51ea95bc2ce4..923a134fd7665 100644 +--- a/drivers/block/aoe/aoenet.c ++++ b/drivers/block/aoe/aoenet.c +@@ -63,6 +63,7 @@ tx(int id) __must_hold(&txlock) + pr_warn("aoe: packet could not be sent on %s. %s\n", + ifp ? ifp->name : "netif", + "consider increasing tx_queue_len"); ++ dev_put(ifp); + spin_lock_irq(&txlock); + } + return 0; +-- +2.43.0 + diff --git a/queue-6.7/arch-powerpc-remove-linux-fb.h-from-backlight-code.patch b/queue-6.7/arch-powerpc-remove-linux-fb.h-from-backlight-code.patch new file mode 100644 index 00000000000..29d5adcb8d6 --- /dev/null +++ b/queue-6.7/arch-powerpc-remove-linux-fb.h-from-backlight-code.patch @@ -0,0 +1,98 @@ +From 6abb12e2065a3fe1a5c9941f814108794ba502a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 13:28:20 +0100 +Subject: arch/powerpc: Remove from backlight code + +From: Thomas Zimmermann + +[ Upstream commit 838f865802b9f26135ea7df4e30f89ac2f50c23e ] + +Replace with a forward declaration in to +resolve an unnecessary dependency. Remove pmac_backlight_curve_lookup() +and struct fb_info from source and header files. The function and the +framebuffer struct are unused. No functional changes. + +v3: + * Add Fixes tag (Christophe) + * fix typos in commit message (Jani) + +Signed-off-by: Thomas Zimmermann +Fixes: d565dd3b0824 ("[PATCH] powerpc: More via-pmu backlight fixes") +Reviewed-by: Jani Nikula +Acked-by: Michael Ellerman # (powerpc) +Link: https://patchwork.freedesktop.org/patch/msgid/20240306122935.10626-4-tzimmermann@suse.de +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/backlight.h | 5 ++-- + arch/powerpc/platforms/powermac/backlight.c | 26 --------------------- + 2 files changed, 2 insertions(+), 29 deletions(-) + +diff --git a/arch/powerpc/include/asm/backlight.h b/arch/powerpc/include/asm/backlight.h +index 1b5eab62ed047..061a910d74929 100644 +--- a/arch/powerpc/include/asm/backlight.h ++++ b/arch/powerpc/include/asm/backlight.h +@@ -10,15 +10,14 @@ + #define __ASM_POWERPC_BACKLIGHT_H + #ifdef __KERNEL__ + +-#include + #include + ++struct backlight_device; ++ + /* For locking instructions, see the implementation file */ + extern struct backlight_device *pmac_backlight; + extern struct mutex pmac_backlight_mutex; + +-extern int pmac_backlight_curve_lookup(struct fb_info *info, int value); +- + extern int pmac_has_backlight_type(const char *type); + + extern void pmac_backlight_key(int direction); +diff --git a/arch/powerpc/platforms/powermac/backlight.c b/arch/powerpc/platforms/powermac/backlight.c +index aeb79a8b3e109..12bc01353bd3c 100644 +--- a/arch/powerpc/platforms/powermac/backlight.c ++++ b/arch/powerpc/platforms/powermac/backlight.c +@@ -9,7 +9,6 @@ + */ + + #include +-#include + #include + #include + #include +@@ -72,31 +71,6 @@ int pmac_has_backlight_type(const char *type) + return 0; + } + +-int pmac_backlight_curve_lookup(struct fb_info *info, int value) +-{ +- int level = (FB_BACKLIGHT_LEVELS - 1); +- +- if (info && info->bl_dev) { +- int i, max = 0; +- +- /* Look for biggest value */ +- for (i = 0; i < FB_BACKLIGHT_LEVELS; i++) +- max = max((int)info->bl_curve[i], max); +- +- /* Look for nearest value */ +- for (i = 0; i < FB_BACKLIGHT_LEVELS; i++) { +- int diff = abs(info->bl_curve[i] - value); +- if (diff < max) { +- max = diff; +- level = i; +- } +- } +- +- } +- +- return level; +-} +- + static void pmac_backlight_key_worker(struct work_struct *work) + { + if (atomic_read(&kernel_backlight_disabled)) +-- +2.43.0 + diff --git a/queue-6.7/arm-dts-arm-realview-fix-development-chip-rom-compat.patch b/queue-6.7/arm-dts-arm-realview-fix-development-chip-rom-compat.patch new file mode 100644 index 00000000000..ce9cd1e8796 --- /dev/null +++ b/queue-6.7/arm-dts-arm-realview-fix-development-chip-rom-compat.patch @@ -0,0 +1,43 @@ +From 273b6acfc4723de38c9f69f479a39c9dbb38f411 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Aug 2023 17:03:04 +0200 +Subject: ARM: dts: arm: realview: Fix development chip ROM compatible value + +From: Geert Uytterhoeven + +[ Upstream commit 3baa4c5143d65ebab2de0d99a395e5f4f1f46608 ] + +When the development chip ROM was added, the "direct-mapped" compatible +value was already obsolete. In addition, the device node lacked the +accompanying "probe-type" property, causing the old physmap_of_core +driver to fall back to trying all available probe types. +Unfortunately this fallback was lost when the DT and pdata cases were +merged. + +Fix this by using the modern "mtd-rom" compatible value instead. + +Fixes: 5c3f5edbe0a1dff3 ("ARM: realview: add flash devices to the PB1176 DTS") +Fixes: 642b1e8dbed7bbbf ("mtd: maps: Merge physmap_of.c into physmap-core.c") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/arm/arm-realview-pb1176.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/arm/arm-realview-pb1176.dts b/arch/arm/boot/dts/arm/arm-realview-pb1176.dts +index efed325af88d2..d99bac02232b3 100644 +--- a/arch/arm/boot/dts/arm/arm-realview-pb1176.dts ++++ b/arch/arm/boot/dts/arm/arm-realview-pb1176.dts +@@ -451,7 +451,7 @@ pb1176_serial3: serial@1010f000 { + + /* Direct-mapped development chip ROM */ + pb1176_rom@10200000 { +- compatible = "direct-mapped"; ++ compatible = "mtd-rom"; + reg = <0x10200000 0x4000>; + bank-width = <1>; + }; +-- +2.43.0 + diff --git a/queue-6.7/arm-dts-imx6dl-yapp4-fix-typo-in-the-qca-switch-regi.patch b/queue-6.7/arm-dts-imx6dl-yapp4-fix-typo-in-the-qca-switch-regi.patch new file mode 100644 index 00000000000..7fb62751349 --- /dev/null +++ b/queue-6.7/arm-dts-imx6dl-yapp4-fix-typo-in-the-qca-switch-regi.patch @@ -0,0 +1,42 @@ +From 6c7c5710ca868511d5827dc278f79a67f04d6a33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 10:03:27 +0100 +Subject: ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michal Vokáč + +[ Upstream commit 023bd910d3ab735459f84b22bb99fb9e00bd9d76 ] + +This change does not have any functional effect. The switch works just +fine without this patch as it has full access to all the addresses +on the bus. This is simply a clean-up to set the node name address +and reg address to the same value. + +Fixes: 15b43e497ffd ("ARM: dts: imx6dl-yapp4: Use correct pseudo PHY address for the switch") +Signed-off-by: Michal Vokáč +Reviewed-by: Andrew Lunn +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/nxp/imx/imx6dl-yapp4-common.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/nxp/imx/imx6dl-yapp4-common.dtsi b/arch/arm/boot/dts/nxp/imx/imx6dl-yapp4-common.dtsi +index 3be38a3c4bb11..d2b3e09eb7df8 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6dl-yapp4-common.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6dl-yapp4-common.dtsi +@@ -127,7 +127,7 @@ phy_port3: phy@2 { + + switch@10 { + compatible = "qca,qca8334"; +- reg = <10>; ++ reg = <0x10>; + reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>; + + switch_ports: ports { +-- +2.43.0 + diff --git a/queue-6.7/arm-dts-imx6dl-yapp4-move-the-internal-switch-phys-u.patch b/queue-6.7/arm-dts-imx6dl-yapp4-move-the-internal-switch-phys-u.patch new file mode 100644 index 00000000000..d4a87f19e60 --- /dev/null +++ b/queue-6.7/arm-dts-imx6dl-yapp4-move-the-internal-switch-phys-u.patch @@ -0,0 +1,98 @@ +From 2dc3e05cb44e99bb9da91ad2e0cca7f991aa423c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 10:03:28 +0100 +Subject: ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the + switch node +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michal Vokáč + +[ Upstream commit 79978bff2e4b8e05ebdf5fc3ee6b794002393484 ] + +We identified that the PHYs actually do not work since commit 7da7b84fee58 +("ARM: dts: imx6dl-yapp4: Move phy reset into switch node") as +a coincidence of several circumstances. + +The reset signal is kept asserted by a pull-down resistor on the board +unless it is deasserted by GPIO from the SoC. This is to keep the switch +dead until it is configured properly by the kernel and user space. + +Prior to the referenced commit the switch was reset by the FEC driver +and the reset GPIO was actively deasserted. The mdio-bus was scanned +and the attached switch and its PHYs were found and configured. + +With the referenced commit the switch is reset by the qca8k driver. +Because of another bug in the qca8k driver, functionality of the reset +pin depends on its pre-kernel configuration. See commit c44fc98f0a8f +("net: dsa: qca8k: fix illegal usage of GPIO") + +The problem did not appear until we removed support for the switch +and configuration of its reset pin from the bootloader. + +To fix that, properly describe the internal mdio-bus configuration of +the qca8334 switch. The PHYs are internal to the switch and sit on its +internal mdio-bus. + +Fixes: 7da7b84fee58 ("ARM: dts: imx6dl-yapp4: Move phy reset into switch node") +Signed-off-by: Michal Vokáč +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../boot/dts/nxp/imx/imx6dl-yapp4-common.dtsi | 23 ++++++++++++------- + 1 file changed, 15 insertions(+), 8 deletions(-) + +diff --git a/arch/arm/boot/dts/nxp/imx/imx6dl-yapp4-common.dtsi b/arch/arm/boot/dts/nxp/imx/imx6dl-yapp4-common.dtsi +index d2b3e09eb7df8..c32ea040fecdd 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6dl-yapp4-common.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6dl-yapp4-common.dtsi +@@ -117,14 +117,6 @@ mdio { + #address-cells = <1>; + #size-cells = <0>; + +- phy_port2: phy@1 { +- reg = <1>; +- }; +- +- phy_port3: phy@2 { +- reg = <2>; +- }; +- + switch@10 { + compatible = "qca,qca8334"; + reg = <0x10>; +@@ -149,15 +141,30 @@ fixed-link { + eth2: port@2 { + reg = <2>; + label = "eth2"; ++ phy-mode = "internal"; + phy-handle = <&phy_port2>; + }; + + eth1: port@3 { + reg = <3>; + label = "eth1"; ++ phy-mode = "internal"; + phy-handle = <&phy_port3>; + }; + }; ++ ++ mdio { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ phy_port2: ethernet-phy@1 { ++ reg = <1>; ++ }; ++ ++ phy_port3: ethernet-phy@2 { ++ reg = <2>; ++ }; ++ }; + }; + }; + }; +-- +2.43.0 + diff --git a/queue-6.7/arm-dts-qcom-msm8974-correct-qfprom-node-size.patch b/queue-6.7/arm-dts-qcom-msm8974-correct-qfprom-node-size.patch new file mode 100644 index 00000000000..d1916a5eb87 --- /dev/null +++ b/queue-6.7/arm-dts-qcom-msm8974-correct-qfprom-node-size.patch @@ -0,0 +1,46 @@ +From f2917990636182c9caad36820f399b3e0b5d796a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Feb 2024 17:45:40 +0100 +Subject: ARM: dts: qcom: msm8974: correct qfprom node size + +From: Craig Tatlor + +[ Upstream commit 724c4bf0e4bf81dba77736afb93964c986c3c123 ] + +The qfprom actually is bigger than 0x1000, so adjust the reg. + +Note that the non-ECC-corrected qfprom can be found at 0xfc4b8000 +(-0x4000). The current reg points to the ECC-corrected qfprom block +which should have equivalent values at all offsets compared to the +non-corrected version. + +[luca@z3ntu.xyz: extract to standalone patch and adjust for review +comments] + +Fixes: c59ffb519357 ("arm: dts: msm8974: Add thermal zones, tsens and qfprom nodes") +Signed-off-by: Craig Tatlor +Signed-off-by: Luca Weiss +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240210-msm8974-qfprom-v3-1-26c424160334@z3ntu.xyz +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom/qcom-msm8974.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/qcom/qcom-msm8974.dtsi b/arch/arm/boot/dts/qcom/qcom-msm8974.dtsi +index 0bc2e66d15b15..f41cc4b4b518b 100644 +--- a/arch/arm/boot/dts/qcom/qcom-msm8974.dtsi ++++ b/arch/arm/boot/dts/qcom/qcom-msm8974.dtsi +@@ -1226,7 +1226,7 @@ restart@fc4ab000 { + + qfprom: qfprom@fc4bc000 { + compatible = "qcom,msm8974-qfprom", "qcom,qfprom"; +- reg = <0xfc4bc000 0x1000>; ++ reg = <0xfc4bc000 0x2100>; + #address-cells = <1>; + #size-cells = <1>; + +-- +2.43.0 + diff --git a/queue-6.7/arm-dts-renesas-r8a73a4-fix-external-clocks-and-cloc.patch b/queue-6.7/arm-dts-renesas-r8a73a4-fix-external-clocks-and-cloc.patch new file mode 100644 index 00000000000..0c903493202 --- /dev/null +++ b/queue-6.7/arm-dts-renesas-r8a73a4-fix-external-clocks-and-cloc.patch @@ -0,0 +1,82 @@ +From 21b3f861f3cb48225356f29d61d23c9b82192a55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jan 2024 12:03:03 +0100 +Subject: ARM: dts: renesas: r8a73a4: Fix external clocks and clock rate +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit 090c4094574705b0afc7d37825cdc5d06f0e7e02 ] + +External clocks should be defined as zero-Hz clocks in the SoC .dtsi, +and overridden in the board .dts when present. + +Correct the clock rate of extal1 from 25 to 26 MHz, to match the crystal +oscillator present on the APE6-EVM board. + +Fixes: a76809a329d6ebae ("ARM: shmobile: r8a73a4: Common clock framework DT description") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Niklas Söderlund +Link: https://lore.kernel.org/r/1692bc8cd465d62168cbf110522ad62a7af3f606.1705315614.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/renesas/r8a73a4-ape6evm.dts | 12 ++++++++++++ + arch/arm/boot/dts/renesas/r8a73a4.dtsi | 9 ++++++--- + 2 files changed, 18 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/renesas/r8a73a4-ape6evm.dts b/arch/arm/boot/dts/renesas/r8a73a4-ape6evm.dts +index ed75c01dbee10..3d02f065f71c2 100644 +--- a/arch/arm/boot/dts/renesas/r8a73a4-ape6evm.dts ++++ b/arch/arm/boot/dts/renesas/r8a73a4-ape6evm.dts +@@ -209,6 +209,18 @@ &cmt1 { + status = "okay"; + }; + ++&extal1_clk { ++ clock-frequency = <26000000>; ++}; ++ ++&extal2_clk { ++ clock-frequency = <48000000>; ++}; ++ ++&extalr_clk { ++ clock-frequency = <32768>; ++}; ++ + &pfc { + scifa0_pins: scifa0 { + groups = "scifa0_data"; +diff --git a/arch/arm/boot/dts/renesas/r8a73a4.dtsi b/arch/arm/boot/dts/renesas/r8a73a4.dtsi +index c39066967053f..d1f4cbd099efb 100644 +--- a/arch/arm/boot/dts/renesas/r8a73a4.dtsi ++++ b/arch/arm/boot/dts/renesas/r8a73a4.dtsi +@@ -450,17 +450,20 @@ clocks { + extalr_clk: extalr { + compatible = "fixed-clock"; + #clock-cells = <0>; +- clock-frequency = <32768>; ++ /* This value must be overridden by the board. */ ++ clock-frequency = <0>; + }; + extal1_clk: extal1 { + compatible = "fixed-clock"; + #clock-cells = <0>; +- clock-frequency = <25000000>; ++ /* This value must be overridden by the board. */ ++ clock-frequency = <0>; + }; + extal2_clk: extal2 { + compatible = "fixed-clock"; + #clock-cells = <0>; +- clock-frequency = <48000000>; ++ /* This value must be overridden by the board. */ ++ clock-frequency = <0>; + }; + fsiack_clk: fsiack { + compatible = "fixed-clock"; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-allwinner-h6-add-rx-dma-channel-for-spdif.patch b/queue-6.7/arm64-dts-allwinner-h6-add-rx-dma-channel-for-spdif.patch new file mode 100644 index 00000000000..910a1fc65db --- /dev/null +++ b/queue-6.7/arm64-dts-allwinner-h6-add-rx-dma-channel-for-spdif.patch @@ -0,0 +1,83 @@ +From f9bb2c3df18d5869dfc68fb2cb084a4ab5526fed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Jan 2024 00:32:45 +0800 +Subject: arm64: dts: allwinner: h6: Add RX DMA channel for SPDIF + +From: Chen-Yu Tsai + +[ Upstream commit 7b59348c11f3355e284d77bbe3d33632ddadcfc2 ] + +The SPDIF hardware found on the H6 supports both transmit and receive +functions. However it is missing the RX DMA channel. + +Add the SPDIF hardware block's RX DMA channel. Also remove the +by-default pinmux, since the end device can choose to implement +either or both functionalities. + +Fixes: f95b598df419 ("arm64: dts: allwinner: Add SPDIF node for Allwinner H6") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: Andre Przywara +Reviewed-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20240127163247.384439-6-wens@kernel.org +Signed-off-by: Jernej Skrabec +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts | 2 ++ + arch/arm64/boot/dts/allwinner/sun50i-h6-tanix.dtsi | 2 ++ + arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi | 7 +++---- + 3 files changed, 7 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts +index 9ec49ac2f6fd5..381d58cea092d 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts +@@ -291,6 +291,8 @@ sw { + }; + + &spdif { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&spdif_tx_pin>; + status = "okay"; + }; + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-tanix.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h6-tanix.dtsi +index 4903d6358112d..855b7d43bc503 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-tanix.dtsi ++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-tanix.dtsi +@@ -166,6 +166,8 @@ &r_ir { + }; + + &spdif { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&spdif_tx_pin>; + status = "okay"; + }; + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi +index ca1d287a0a01d..d11e5041bae9a 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi ++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi +@@ -406,6 +406,7 @@ spi1_cs_pin: spi1-cs-pin { + function = "spi1"; + }; + ++ /omit-if-no-ref/ + spdif_tx_pin: spdif-tx-pin { + pins = "PH7"; + function = "spdif"; +@@ -655,10 +656,8 @@ spdif: spdif@5093000 { + clocks = <&ccu CLK_BUS_SPDIF>, <&ccu CLK_SPDIF>; + clock-names = "apb", "spdif"; + resets = <&ccu RST_BUS_SPDIF>; +- dmas = <&dma 2>; +- dma-names = "tx"; +- pinctrl-names = "default"; +- pinctrl-0 = <&spdif_tx_pin>; ++ dmas = <&dma 2>, <&dma 2>; ++ dma-names = "rx", "tx"; + status = "disabled"; + }; + +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-imx8mm-kontron-disable-pull-resistors-for-.patch b/queue-6.7/arm64-dts-imx8mm-kontron-disable-pull-resistors-for-.patch new file mode 100644 index 00000000000..9a4a4baf84e --- /dev/null +++ b/queue-6.7/arm64-dts-imx8mm-kontron-disable-pull-resistors-for-.patch @@ -0,0 +1,80 @@ +From eae347ccb5f4e01ec12b7b03fe4ad83870d7e844 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jan 2024 09:49:02 +0100 +Subject: arm64: dts: imx8mm-kontron: Disable pull resistors for SD card + signals on BL OSM-S board + +From: Frieder Schrempf + +[ Upstream commit 5a940ba3e4d7c8710c9073ff5d0ca4644d4da9db ] + +Some signals have external pullup resistors on the board and don't need +the internal ones to be enabled. Due to silicon errata ERR050080 let's +disable the internal pull resistors whererever possible and prevent +any unwanted behavior in case they wear out. + +Fixes: de9618e84f76 ("arm64: dts: Add support for Kontron SL/BL i.MX8MM OSM-S") +Signed-off-by: Frieder Schrempf +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../dts/freescale/imx8mm-kontron-bl-osm-s.dts | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts +index 1dd03ef0a7835..d9fa0deea7002 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts +@@ -337,40 +337,40 @@ MX8MM_IOMUXC_NAND_CE1_B_GPIO3_IO2 0x19 + + pinctrl_usdhc2: usdhc2grp { + fsl,pins = < +- MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK 0x190 ++ MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK 0x90 + MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD 0x1d0 + MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0 0x1d0 + MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1 0x1d0 + MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2 0x1d0 + MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d0 +- MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12 0x019 +- MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x1d0 ++ MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12 0x19 ++ MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0xd0 + >; + }; + + pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp { + fsl,pins = < +- MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK 0x194 ++ MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK 0x94 + MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD 0x1d4 + MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0 0x1d4 + MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1 0x1d4 + MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2 0x1d4 + MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d4 +- MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12 0x019 +- MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x1d0 ++ MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12 0x19 ++ MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0xd0 + >; + }; + + pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp { + fsl,pins = < +- MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK 0x196 ++ MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK 0x96 + MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD 0x1d6 + MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0 0x1d6 + MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1 0x1d6 + MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2 0x1d6 + MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d6 +- MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12 0x019 +- MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x1d0 ++ MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12 0x19 ++ MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0xd0 + >; + }; + }; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-imx8mm-kontron-disable-pull-resistors-for-.patch-11406 b/queue-6.7/arm64-dts-imx8mm-kontron-disable-pull-resistors-for-.patch-11406 new file mode 100644 index 00000000000..82468e1b793 --- /dev/null +++ b/queue-6.7/arm64-dts-imx8mm-kontron-disable-pull-resistors-for-.patch-11406 @@ -0,0 +1,80 @@ +From 0c5cc929888f590f62975f2770dbf62f2ea1d568 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jan 2024 09:49:03 +0100 +Subject: arm64: dts: imx8mm-kontron: Disable pull resistors for SD card + signals on BL board + +From: Frieder Schrempf + +[ Upstream commit 008820524844326ffb3123cebceba1960c0ad0dc ] + +Some signals have external pullup resistors on the board and don't need +the internal ones to be enabled. Due to silicon errata ERR050080 let's +disable the internal pull resistors whererever possible and prevent +any unwanted behavior in case they wear out. + +Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards") +Signed-off-by: Frieder Schrempf +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../boot/dts/freescale/imx8mm-kontron-bl.dts | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts +index ee93db11c0d06..aab8e24216501 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts +@@ -316,40 +316,40 @@ MX8MM_IOMUXC_NAND_CE1_B_GPIO3_IO2 0x19 + + pinctrl_usdhc2: usdhc2grp { + fsl,pins = < +- MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK 0x190 ++ MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK 0x90 + MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD 0x1d0 + MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0 0x1d0 + MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1 0x1d0 + MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2 0x1d0 + MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d0 +- MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12 0x019 +- MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x1d0 ++ MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12 0x19 ++ MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0xd0 + >; + }; + + pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp { + fsl,pins = < +- MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK 0x194 ++ MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK 0x94 + MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD 0x1d4 + MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0 0x1d4 + MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1 0x1d4 + MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2 0x1d4 + MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d4 +- MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12 0x019 +- MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x1d0 ++ MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12 0x19 ++ MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0xd0 + >; + }; + + pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp { + fsl,pins = < +- MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK 0x196 ++ MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK 0x96 + MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD 0x1d6 + MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0 0x1d6 + MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1 0x1d6 + MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2 0x1d6 + MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d6 +- MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12 0x019 +- MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x1d0 ++ MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12 0x19 ++ MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0xd0 + >; + }; + }; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-imx8mm-kontron-disable-pullups-for-i2c-sig.patch b/queue-6.7/arm64-dts-imx8mm-kontron-disable-pullups-for-i2c-sig.patch new file mode 100644 index 00000000000..a1deddbe198 --- /dev/null +++ b/queue-6.7/arm64-dts-imx8mm-kontron-disable-pullups-for-i2c-sig.patch @@ -0,0 +1,56 @@ +From 0eda5b02c4fd906c7302419f34c46bd395bb38ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jan 2024 09:48:58 +0100 +Subject: arm64: dts: imx8mm-kontron: Disable pullups for I2C signals on OSM-S + i.MX8MM + +From: Frieder Schrempf + +[ Upstream commit 96293af54f6aa859015d8ca40a1437d3115ad50c ] + +There are external pullup resistors on the board and due to silicon +errata ERR050080 let's disable the internal ones to prevent any +unwanted behavior in case they wear out. + +Fixes: de9618e84f76 ("arm64: dts: Add support for Kontron SL/BL i.MX8MM OSM-S") +Signed-off-by: Frieder Schrempf +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts | 4 ++-- + arch/arm64/boot/dts/freescale/imx8mm-kontron-osm-s.dtsi | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts +index 8b16bd68576c0..0730c22e5b6b9 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts +@@ -294,8 +294,8 @@ MX8MM_IOMUXC_SAI3_MCLK_GPIO5_IO2 0x19 + + pinctrl_i2c4: i2c4grp { + fsl,pins = < +- MX8MM_IOMUXC_I2C4_SCL_I2C4_SCL 0x400001c3 +- MX8MM_IOMUXC_I2C4_SDA_I2C4_SDA 0x400001c3 ++ MX8MM_IOMUXC_I2C4_SCL_I2C4_SCL 0x40000083 ++ MX8MM_IOMUXC_I2C4_SDA_I2C4_SDA 0x40000083 + >; + }; + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-osm-s.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-kontron-osm-s.dtsi +index 6e75ab879bf59..3e7db968f7e64 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-osm-s.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-osm-s.dtsi +@@ -252,8 +252,8 @@ MX8MM_IOMUXC_ECSPI1_SS0_GPIO5_IO9 0x19 + + pinctrl_i2c1: i2c1grp { + fsl,pins = < +- MX8MM_IOMUXC_I2C1_SCL_I2C1_SCL 0x400001c3 +- MX8MM_IOMUXC_I2C1_SDA_I2C1_SDA 0x400001c3 ++ MX8MM_IOMUXC_I2C1_SCL_I2C1_SCL 0x40000083 ++ MX8MM_IOMUXC_I2C1_SDA_I2C1_SDA 0x40000083 + >; + }; + +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-imx8mm-kontron-disable-pullups-for-i2c-sig.patch-15768 b/queue-6.7/arm64-dts-imx8mm-kontron-disable-pullups-for-i2c-sig.patch-15768 new file mode 100644 index 00000000000..5a9e4a723f8 --- /dev/null +++ b/queue-6.7/arm64-dts-imx8mm-kontron-disable-pullups-for-i2c-sig.patch-15768 @@ -0,0 +1,56 @@ +From 331cd728a799d74d90c52cab26def3299db57a60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jan 2024 09:48:59 +0100 +Subject: arm64: dts: imx8mm-kontron: Disable pullups for I2C signals on SL/BL + i.MX8MM + +From: Frieder Schrempf + +[ Upstream commit f19e5bb91d53264d7dac5d845a4825afadf72440 ] + +There are external pullup resistors on the board and due to silicon +errata ERR050080 let's disable the internal ones to prevent any +unwanted behavior in case they wear out. + +Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards") +Signed-off-by: Frieder Schrempf +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts | 4 ++-- + arch/arm64/boot/dts/freescale/imx8mm-kontron-sl.dtsi | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts +index dcec57c20399e..5fd2e45258b11 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts +@@ -279,8 +279,8 @@ MX8MM_IOMUXC_SAI3_MCLK_GPIO5_IO2 0x19 + + pinctrl_i2c4: i2c4grp { + fsl,pins = < +- MX8MM_IOMUXC_I2C4_SCL_I2C4_SCL 0x400001c3 +- MX8MM_IOMUXC_I2C4_SDA_I2C4_SDA 0x400001c3 ++ MX8MM_IOMUXC_I2C4_SCL_I2C4_SCL 0x40000083 ++ MX8MM_IOMUXC_I2C4_SDA_I2C4_SDA 0x40000083 + >; + }; + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-sl.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-kontron-sl.dtsi +index 1f8326613ee9e..2076148e08627 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-sl.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-sl.dtsi +@@ -237,8 +237,8 @@ MX8MM_IOMUXC_ECSPI1_SS0_GPIO5_IO9 0x19 + + pinctrl_i2c1: i2c1grp { + fsl,pins = < +- MX8MM_IOMUXC_I2C1_SCL_I2C1_SCL 0x400001c3 +- MX8MM_IOMUXC_I2C1_SDA_I2C1_SDA 0x400001c3 ++ MX8MM_IOMUXC_I2C1_SCL_I2C1_SCL 0x40000083 ++ MX8MM_IOMUXC_I2C1_SDA_I2C1_SDA 0x40000083 + >; + }; + +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-imx8mm-kontron-disable-pullups-for-onboard.patch b/queue-6.7/arm64-dts-imx8mm-kontron-disable-pullups-for-onboard.patch new file mode 100644 index 00000000000..0e80957de6a --- /dev/null +++ b/queue-6.7/arm64-dts-imx8mm-kontron-disable-pullups-for-onboard.patch @@ -0,0 +1,58 @@ +From 1a50eb70bd136bf3dac2942029d30b7d85332977 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jan 2024 09:49:00 +0100 +Subject: arm64: dts: imx8mm-kontron: Disable pullups for onboard UART signals + on BL OSM-S board + +From: Frieder Schrempf + +[ Upstream commit c6d9b5672a0e2c4b1079a50d2fc8780c40cfd3eb ] + +These signals are actively driven by the SoC or by the onboard +transceiver. There's no need to enable the internal pull resistors +and due to silicon errata ERR050080 let's disable the internal ones +to prevent any unwanted behavior in case they wear out. + +Fixes: de9618e84f76 ("arm64: dts: Add support for Kontron SL/BL i.MX8MM OSM-S") +Signed-off-by: Frieder Schrempf +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../dts/freescale/imx8mm-kontron-bl-osm-s.dts | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts +index 0730c22e5b6b9..1dd03ef0a7835 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts +@@ -313,19 +313,19 @@ MX8MM_IOMUXC_SAI5_MCLK_GPIO3_IO25 0x19 + + pinctrl_uart1: uart1grp { + fsl,pins = < +- MX8MM_IOMUXC_SAI2_RXC_UART1_DCE_RX 0x140 +- MX8MM_IOMUXC_SAI2_RXFS_UART1_DCE_TX 0x140 +- MX8MM_IOMUXC_SAI2_RXD0_UART1_DCE_RTS_B 0x140 +- MX8MM_IOMUXC_SAI2_TXFS_UART1_DCE_CTS_B 0x140 ++ MX8MM_IOMUXC_SAI2_RXC_UART1_DCE_RX 0x0 ++ MX8MM_IOMUXC_SAI2_RXFS_UART1_DCE_TX 0x0 ++ MX8MM_IOMUXC_SAI2_RXD0_UART1_DCE_RTS_B 0x0 ++ MX8MM_IOMUXC_SAI2_TXFS_UART1_DCE_CTS_B 0x0 + >; + }; + + pinctrl_uart2: uart2grp { + fsl,pins = < +- MX8MM_IOMUXC_SAI3_TXFS_UART2_DCE_RX 0x140 +- MX8MM_IOMUXC_SAI3_TXC_UART2_DCE_TX 0x140 +- MX8MM_IOMUXC_SAI3_RXD_UART2_DCE_RTS_B 0x140 +- MX8MM_IOMUXC_SAI3_RXC_UART2_DCE_CTS_B 0x140 ++ MX8MM_IOMUXC_SAI3_TXFS_UART2_DCE_RX 0x0 ++ MX8MM_IOMUXC_SAI3_TXC_UART2_DCE_TX 0x0 ++ MX8MM_IOMUXC_SAI3_RXD_UART2_DCE_RTS_B 0x0 ++ MX8MM_IOMUXC_SAI3_RXC_UART2_DCE_CTS_B 0x0 + >; + }; + +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-imx8mm-kontron-disable-pullups-for-onboard.patch-13585 b/queue-6.7/arm64-dts-imx8mm-kontron-disable-pullups-for-onboard.patch-13585 new file mode 100644 index 00000000000..80c46de234c --- /dev/null +++ b/queue-6.7/arm64-dts-imx8mm-kontron-disable-pullups-for-onboard.patch-13585 @@ -0,0 +1,58 @@ +From 4b988e78b148a77a2ac1f905d78e264eea971b97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jan 2024 09:49:01 +0100 +Subject: arm64: dts: imx8mm-kontron: Disable pullups for onboard UART signals + on BL board + +From: Frieder Schrempf + +[ Upstream commit 162aadaa0df8217b0cc49d919dd00022fef65e78 ] + +These signals are actively driven by the SoC or by the onboard +transceiver. There's no need to enable the internal pull resistors +and due to silicon errata ERR050080 let's disable the internal ones +to prevent any unwanted behavior in case they wear out. + +Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards") +Signed-off-by: Frieder Schrempf +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../boot/dts/freescale/imx8mm-kontron-bl.dts | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts +index 5fd2e45258b11..ee93db11c0d06 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts +@@ -292,19 +292,19 @@ MX8MM_IOMUXC_SPDIF_RX_PWM2_OUT 0x19 + + pinctrl_uart1: uart1grp { + fsl,pins = < +- MX8MM_IOMUXC_SAI2_RXC_UART1_DCE_RX 0x140 +- MX8MM_IOMUXC_SAI2_RXFS_UART1_DCE_TX 0x140 +- MX8MM_IOMUXC_SAI2_RXD0_UART1_DCE_RTS_B 0x140 +- MX8MM_IOMUXC_SAI2_TXFS_UART1_DCE_CTS_B 0x140 ++ MX8MM_IOMUXC_SAI2_RXC_UART1_DCE_RX 0x0 ++ MX8MM_IOMUXC_SAI2_RXFS_UART1_DCE_TX 0x0 ++ MX8MM_IOMUXC_SAI2_RXD0_UART1_DCE_RTS_B 0x0 ++ MX8MM_IOMUXC_SAI2_TXFS_UART1_DCE_CTS_B 0x0 + >; + }; + + pinctrl_uart2: uart2grp { + fsl,pins = < +- MX8MM_IOMUXC_SAI3_TXFS_UART2_DCE_RX 0x140 +- MX8MM_IOMUXC_SAI3_TXC_UART2_DCE_TX 0x140 +- MX8MM_IOMUXC_SAI3_RXD_UART2_DCE_RTS_B 0x140 +- MX8MM_IOMUXC_SAI3_RXC_UART2_DCE_CTS_B 0x140 ++ MX8MM_IOMUXC_SAI3_TXFS_UART2_DCE_RX 0x0 ++ MX8MM_IOMUXC_SAI3_TXC_UART2_DCE_TX 0x0 ++ MX8MM_IOMUXC_SAI3_RXD_UART2_DCE_RTS_B 0x0 ++ MX8MM_IOMUXC_SAI3_RXC_UART2_DCE_CTS_B 0x0 + >; + }; + +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-imx8mm-kontron-fix-interrupt-for-rtc-on-os.patch b/queue-6.7/arm64-dts-imx8mm-kontron-fix-interrupt-for-rtc-on-os.patch new file mode 100644 index 00000000000..78c0e262850 --- /dev/null +++ b/queue-6.7/arm64-dts-imx8mm-kontron-fix-interrupt-for-rtc-on-os.patch @@ -0,0 +1,36 @@ +From e534a1e141ec66f0c39dc161db933f8438f25a58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jan 2024 09:49:04 +0100 +Subject: arm64: dts: imx8mm-kontron: Fix interrupt for RTC on OSM-S i.MX8MM + module + +From: Frieder Schrempf + +[ Upstream commit 8d0f39b7d04d864e89b84063b124fd10aa4b8809 ] + +The level of the interrupt signal is active low instead. Fix this. + +Fixes: de9618e84f76 ("arm64: dts: Add support for Kontron SL/BL i.MX8MM OSM-S") +Signed-off-by: Frieder Schrempf +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm-kontron-osm-s.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-osm-s.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-kontron-osm-s.dtsi +index 3e7db968f7e64..60abcb636cedf 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-osm-s.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-osm-s.dtsi +@@ -210,7 +210,7 @@ rv3028: rtc@52 { + reg = <0x52>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_rtc>; +- interrupts-extended = <&gpio4 1 IRQ_TYPE_LEVEL_HIGH>; ++ interrupts-extended = <&gpio4 1 IRQ_TYPE_LEVEL_LOW>; + trickle-diode-disable; + }; + }; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-imx8mm-venice-gw71xx-fix-usb-otg-vbus.patch b/queue-6.7/arm64-dts-imx8mm-venice-gw71xx-fix-usb-otg-vbus.patch new file mode 100644 index 00000000000..317dec3cb1d --- /dev/null +++ b/queue-6.7/arm64-dts-imx8mm-venice-gw71xx-fix-usb-otg-vbus.patch @@ -0,0 +1,85 @@ +From 0431afef828c1dd45c643db17aa790ba21aace8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Dec 2023 15:30:46 -0800 +Subject: arm64: dts: imx8mm-venice-gw71xx: fix USB OTG VBUS + +From: Tim Harvey + +[ Upstream commit ec2cb52fcfef5d58574f2cfbc9a99ffc20ae5a9d ] + +The GW71xx does not have a gpio controlled vbus regulator but it does +require some pinctrl. Remove the regulator and move the valid pinctrl +into the usbotg1 node. + +Fixes: bd306fdb4e60 ("arm64: dts: imx8mm-venice-gw71xx: fix USB OTG VBUS") +Signed-off-by: Tim Harvey +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../dts/freescale/imx8mm-venice-gw71xx.dtsi | 29 ++++++------------- + 1 file changed, 9 insertions(+), 20 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw71xx.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw71xx.dtsi +index 6425773f68e0a..bbbaf2165ea28 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw71xx.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw71xx.dtsi +@@ -47,17 +47,6 @@ pps { + gpios = <&gpio1 15 GPIO_ACTIVE_HIGH>; + status = "okay"; + }; +- +- reg_usb_otg1_vbus: regulator-usb-otg1 { +- pinctrl-names = "default"; +- pinctrl-0 = <&pinctrl_reg_usb1_en>; +- compatible = "regulator-fixed"; +- regulator-name = "usb_otg1_vbus"; +- gpio = <&gpio1 10 GPIO_ACTIVE_HIGH>; +- enable-active-high; +- regulator-min-microvolt = <5000000>; +- regulator-max-microvolt = <5000000>; +- }; + }; + + /* off-board header */ +@@ -144,9 +133,10 @@ &uart3 { + }; + + &usbotg1 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&pinctrl_usbotg1>; + dr_mode = "otg"; + over-current-active-low; +- vbus-supply = <®_usb_otg1_vbus>; + status = "okay"; + }; + +@@ -204,14 +194,6 @@ MX8MM_IOMUXC_GPIO1_IO15_GPIO1_IO15 0x41 + >; + }; + +- pinctrl_reg_usb1_en: regusb1grp { +- fsl,pins = < +- MX8MM_IOMUXC_GPIO1_IO10_GPIO1_IO10 0x41 +- MX8MM_IOMUXC_GPIO1_IO12_GPIO1_IO12 0x141 +- MX8MM_IOMUXC_GPIO1_IO13_USB1_OTG_OC 0x41 +- >; +- }; +- + pinctrl_spi2: spi2grp { + fsl,pins = < + MX8MM_IOMUXC_ECSPI2_SCLK_ECSPI2_SCLK 0xd6 +@@ -234,4 +216,11 @@ MX8MM_IOMUXC_UART3_RXD_UART3_DCE_RX 0x140 + MX8MM_IOMUXC_UART3_TXD_UART3_DCE_TX 0x140 + >; + }; ++ ++ pinctrl_usbotg1: usbotg1grp { ++ fsl,pins = < ++ MX8MM_IOMUXC_GPIO1_IO12_GPIO1_IO12 0x141 ++ MX8MM_IOMUXC_GPIO1_IO13_USB1_OTG_OC 0x41 ++ >; ++ }; + }; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-imx8mp-evk-fix-hdmi-3d-node.patch b/queue-6.7/arm64-dts-imx8mp-evk-fix-hdmi-3d-node.patch new file mode 100644 index 00000000000..79971153811 --- /dev/null +++ b/queue-6.7/arm64-dts-imx8mp-evk-fix-hdmi-3d-node.patch @@ -0,0 +1,119 @@ +From 4b23c53d2e5083490f539c0c8b33906d3db1274e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 10:57:38 +0800 +Subject: arm64: dts: imx8mp-evk: Fix hdmi@3d node + +From: Liu Ying + +[ Upstream commit 0ff08803eca417dfa9372194bebf3d1b1f501f98 ] + +The hdmi@3d node's compatible string is "adi,adv7535" instead of +"adi,adv7533" or "adi,adv751*". + +Fix the hdmi@3d node by means of: +* Use default register addresses for "cec", "edid" and "packet", because + there is no need to use a non-default address map. +* Add missing interrupt related properties. +* Drop "adi,input-*" properties which are only valid for adv751*. +* Add VEXT_3V3 fixed regulator. +* Add "*-supply" properties, since most are required. +* Fix label names - s/adv7533/adv7535/. + +Fixes: 65344b9bed3a ("arm64: dts: imx8mp-evk: Add HDMI support") +Signed-off-by: Liu Ying +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp-evk.dts | 33 +++++++++++++------- + 1 file changed, 21 insertions(+), 12 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-evk.dts b/arch/arm64/boot/dts/freescale/imx8mp-evk.dts +index cc9d468b43ab8..92f8cc05fe9da 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-evk.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mp-evk.dts +@@ -23,7 +23,7 @@ hdmi-connector { + + port { + hdmi_connector_in: endpoint { +- remote-endpoint = <&adv7533_out>; ++ remote-endpoint = <&adv7535_out>; + }; + }; + }; +@@ -107,6 +107,13 @@ reg_usdhc2_vmmc: regulator-usdhc2 { + enable-active-high; + }; + ++ reg_vext_3v3: regulator-vext-3v3 { ++ compatible = "regulator-fixed"; ++ regulator-name = "VEXT_3V3"; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ }; ++ + sound { + compatible = "simple-audio-card"; + simple-audio-card,name = "wm8960-audio"; +@@ -342,7 +349,7 @@ BUCK4 { + regulator-always-on; + }; + +- BUCK5 { ++ reg_buck5: BUCK5 { + regulator-name = "BUCK5"; + regulator-min-microvolt = <1650000>; + regulator-max-microvolt = <1950000>; +@@ -393,14 +400,16 @@ &i2c2 { + + hdmi@3d { + compatible = "adi,adv7535"; +- reg = <0x3d>, <0x3c>, <0x3e>, <0x3f>; +- reg-names = "main", "cec", "edid", "packet"; ++ reg = <0x3d>; ++ interrupt-parent = <&gpio1>; ++ interrupts = <9 IRQ_TYPE_EDGE_FALLING>; + adi,dsi-lanes = <4>; +- adi,input-depth = <8>; +- adi,input-colorspace = "rgb"; +- adi,input-clock = "1x"; +- adi,input-style = <1>; +- adi,input-justification = "evenly"; ++ avdd-supply = <®_buck5>; ++ dvdd-supply = <®_buck5>; ++ pvdd-supply = <®_buck5>; ++ a2vdd-supply = <®_buck5>; ++ v3p3-supply = <®_vext_3v3>; ++ v1p2-supply = <®_buck5>; + + ports { + #address-cells = <1>; +@@ -409,7 +418,7 @@ ports { + port@0 { + reg = <0>; + +- adv7533_in: endpoint { ++ adv7535_in: endpoint { + remote-endpoint = <&dsi_out>; + }; + }; +@@ -417,7 +426,7 @@ adv7533_in: endpoint { + port@1 { + reg = <1>; + +- adv7533_out: endpoint { ++ adv7535_out: endpoint { + remote-endpoint = <&hdmi_connector_in>; + }; + }; +@@ -502,7 +511,7 @@ port@1 { + reg = <1>; + + dsi_out: endpoint { +- remote-endpoint = <&adv7533_in>; ++ remote-endpoint = <&adv7535_in>; + data-lanes = <1 2 3 4>; + }; + }; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-imx8mp-set-spi-nor-to-max-40-mhz-on-data-m.patch b/queue-6.7/arm64-dts-imx8mp-set-spi-nor-to-max-40-mhz-on-data-m.patch new file mode 100644 index 00000000000..b04e23ee68e --- /dev/null +++ b/queue-6.7/arm64-dts-imx8mp-set-spi-nor-to-max-40-mhz-on-data-m.patch @@ -0,0 +1,38 @@ +From 803ca0ef8ee7497dc6025dca4fa6b956e9d33892 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Feb 2024 22:33:30 +0100 +Subject: arm64: dts: imx8mp: Set SPI NOR to max 40 MHz on Data Modul i.MX8M + Plus eDM SBC + +From: Marek Vasut + +[ Upstream commit 13ab6f174a6b577bd7d09124b47ec8ace2682e42 ] + +The SPI NOR bus routing on this board cannot go above 50 MHz, +set the clock frequency to maximum of 40 MHz to be within a +safe margin. Remove the comment as well. + +Fixes: 562d222f23f0 ("arm64: dts: imx8mp: Add support for Data Modul i.MX8M Plus eDM SBC") +Signed-off-by: Marek Vasut +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts b/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts +index 5828c9d7821de..b5ce7b14b5434 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts +@@ -121,7 +121,7 @@ &ecspi1 { + flash@0 { /* W25Q128JVEI */ + compatible = "jedec,spi-nor"; + reg = <0>; +- spi-max-frequency = <100000000>; /* Up to 133 MHz */ ++ spi-max-frequency = <40000000>; + spi-tx-bus-width = <1>; + spi-rx-bus-width = <1>; + }; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-imx8qm-align-edma3-power-domains-resources.patch b/queue-6.7/arm64-dts-imx8qm-align-edma3-power-domains-resources.patch new file mode 100644 index 00000000000..28cb7625eae --- /dev/null +++ b/queue-6.7/arm64-dts-imx8qm-align-edma3-power-domains-resources.patch @@ -0,0 +1,48 @@ +From ac71ee606c117c6a21ccc6b40e1611f2cf220d41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Dec 2023 14:46:54 -0500 +Subject: arm64: dts: imx8qm: Align edma3 power-domains resources indentation + +From: Frank Li + +[ Upstream commit 7edee2b297e5a4f805e5b945c0c0e6f4f8f719b5 ] + +<&pd IMX_SC_R_DMA_1_CH*> is now properly aligned with the previous line +for improved code readability. + +Signed-off-by: Frank Li +Signed-off-by: Shawn Guo +Stable-dep-of: 5136ea6b109d ("arm64: dts: imx8qm: Correct edma3 power-domains and interrupt numbers") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi b/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi +index 8439dd6b39353..13a3531873401 100644 +--- a/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi +@@ -98,13 +98,13 @@ &edma2 { + + &edma3 { + power-domains = <&pd IMX_SC_R_DMA_1_CH0>, +- <&pd IMX_SC_R_DMA_1_CH1>, +- <&pd IMX_SC_R_DMA_1_CH2>, +- <&pd IMX_SC_R_DMA_1_CH3>, +- <&pd IMX_SC_R_DMA_1_CH4>, +- <&pd IMX_SC_R_DMA_1_CH5>, +- <&pd IMX_SC_R_DMA_1_CH6>, +- <&pd IMX_SC_R_DMA_1_CH7>; ++ <&pd IMX_SC_R_DMA_1_CH1>, ++ <&pd IMX_SC_R_DMA_1_CH2>, ++ <&pd IMX_SC_R_DMA_1_CH3>, ++ <&pd IMX_SC_R_DMA_1_CH4>, ++ <&pd IMX_SC_R_DMA_1_CH5>, ++ <&pd IMX_SC_R_DMA_1_CH6>, ++ <&pd IMX_SC_R_DMA_1_CH7>; + }; + + &flexcan1 { +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-imx8qm-correct-edma3-power-domains-and-int.patch b/queue-6.7/arm64-dts-imx8qm-correct-edma3-power-domains-and-int.patch new file mode 100644 index 00000000000..008f1e08575 --- /dev/null +++ b/queue-6.7/arm64-dts-imx8qm-correct-edma3-power-domains-and-int.patch @@ -0,0 +1,65 @@ +From 578cea3c7b8084a4890b8cd27e4dca9fc5aeaa87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Dec 2023 14:46:55 -0500 +Subject: arm64: dts: imx8qm: Correct edma3 power-domains and interrupt numbers + +From: Frank Li + +[ Upstream commit 5136ea6b109de66b1327a3069f88ad8f5efb37b2 ] + +It is eDMA1 at QM, which have the same register with eDMA3 at qxp. + +The below commit fix panic problem. +commit b37e75bddc35 ("arm64: dts: imx8qm: Add imx8qm's own pm to avoid panic during startup") + +This fixes the IRQ and DMA channel numbers. While QM eDMA1 technically has +32 channels, only 10 channels are likely used for I2C. The exact IRQ +numbers for the remaining channels were unclear in the reference manual. + +Fixes: e4d7a330fb7a ("arm64: dts: imx8: add edma[0..3]") +Signed-off-by: Frank Li +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi b/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi +index 13a3531873401..459ba2b9b7f31 100644 +--- a/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi +@@ -96,7 +96,20 @@ &edma2 { + status = "okay"; + }; + ++/* It is eDMA1 in 8QM RM, but 8QXP it is eDMA3 */ + &edma3 { ++ reg = <0x5a9f0000 0x210000>; ++ dma-channels = <10>; ++ interrupts = , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ ; + power-domains = <&pd IMX_SC_R_DMA_1_CH0>, + <&pd IMX_SC_R_DMA_1_CH1>, + <&pd IMX_SC_R_DMA_1_CH2>, +@@ -104,7 +117,9 @@ &edma3 { + <&pd IMX_SC_R_DMA_1_CH4>, + <&pd IMX_SC_R_DMA_1_CH5>, + <&pd IMX_SC_R_DMA_1_CH6>, +- <&pd IMX_SC_R_DMA_1_CH7>; ++ <&pd IMX_SC_R_DMA_1_CH7>, ++ <&pd IMX_SC_R_DMA_1_CH8>, ++ <&pd IMX_SC_R_DMA_1_CH9>; + }; + + &flexcan1 { +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-marvell-reorder-crypto-interrupts-on-armad.patch b/queue-6.7/arm64-dts-marvell-reorder-crypto-interrupts-on-armad.patch new file mode 100644 index 00000000000..840e6b2d693 --- /dev/null +++ b/queue-6.7/arm64-dts-marvell-reorder-crypto-interrupts-on-armad.patch @@ -0,0 +1,88 @@ +From 65050da968d99dabbf9a88f490e6ef7a19146b5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 13:22:58 +0100 +Subject: arm64: dts: marvell: reorder crypto interrupts on Armada SoCs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit ec55a22149d64f9ac41845d923b884d4a666bf4d ] + +Match order specified in binding documentation. It says "mem" should be +the last interrupt. + +This fixes: +arch/arm64/boot/dts/marvell/armada-3720-db.dtb: crypto@90000: interrupt-names:0: 'ring0' was expected + from schema $id: http://devicetree.org/schemas/crypto/inside-secure,safexcel.yaml# +arch/arm64/boot/dts/marvell/armada-3720-db.dtb: crypto@90000: interrupt-names:1: 'ring1' was expected + from schema $id: http://devicetree.org/schemas/crypto/inside-secure,safexcel.yaml# +arch/arm64/boot/dts/marvell/armada-3720-db.dtb: crypto@90000: interrupt-names:2: 'ring2' was expected + from schema $id: http://devicetree.org/schemas/crypto/inside-secure,safexcel.yaml# +arch/arm64/boot/dts/marvell/armada-3720-db.dtb: crypto@90000: interrupt-names:3: 'ring3' was expected + from schema $id: http://devicetree.org/schemas/crypto/inside-secure,safexcel.yaml# +arch/arm64/boot/dts/marvell/armada-3720-db.dtb: crypto@90000: interrupt-names:4: 'eip' was expected + from schema $id: http://devicetree.org/schemas/crypto/inside-secure,safexcel.yaml# +arch/arm64/boot/dts/marvell/armada-3720-db.dtb: crypto@90000: interrupt-names:5: 'mem' was expected + from schema $id: http://devicetree.org/schemas/crypto/inside-secure,safexcel.yaml# + +Signed-off-by: Rafał Miłecki +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/marvell/armada-37xx.dtsi | 10 +++++----- + arch/arm64/boot/dts/marvell/armada-cp11x.dtsi | 10 +++++----- + 2 files changed, 10 insertions(+), 10 deletions(-) + +diff --git a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi +index e300145ad1a6f..1cc3fa1c354de 100644 +--- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi ++++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi +@@ -431,14 +431,14 @@ xor11 { + crypto: crypto@90000 { + compatible = "inside-secure,safexcel-eip97ies"; + reg = <0x90000 0x20000>; +- interrupts = , +- , ++ interrupts = , + , + , + , +- ; +- interrupt-names = "mem", "ring0", "ring1", +- "ring2", "ring3", "eip"; ++ , ++ ; ++ interrupt-names = "ring0", "ring1", "ring2", ++ "ring3", "eip", "mem"; + clocks = <&nb_periph_clk 15>; + }; + +diff --git a/arch/arm64/boot/dts/marvell/armada-cp11x.dtsi b/arch/arm64/boot/dts/marvell/armada-cp11x.dtsi +index 4ec1aae0a3a9c..7e595ac80043a 100644 +--- a/arch/arm64/boot/dts/marvell/armada-cp11x.dtsi ++++ b/arch/arm64/boot/dts/marvell/armada-cp11x.dtsi +@@ -511,14 +511,14 @@ CP11X_LABEL(sdhci0): mmc@780000 { + CP11X_LABEL(crypto): crypto@800000 { + compatible = "inside-secure,safexcel-eip197b"; + reg = <0x800000 0x200000>; +- interrupts = <87 IRQ_TYPE_LEVEL_HIGH>, +- <88 IRQ_TYPE_LEVEL_HIGH>, ++ interrupts = <88 IRQ_TYPE_LEVEL_HIGH>, + <89 IRQ_TYPE_LEVEL_HIGH>, + <90 IRQ_TYPE_LEVEL_HIGH>, + <91 IRQ_TYPE_LEVEL_HIGH>, +- <92 IRQ_TYPE_LEVEL_HIGH>; +- interrupt-names = "mem", "ring0", "ring1", +- "ring2", "ring3", "eip"; ++ <92 IRQ_TYPE_LEVEL_HIGH>, ++ <87 IRQ_TYPE_LEVEL_HIGH>; ++ interrupt-names = "ring0", "ring1", "ring2", "ring3", ++ "eip", "mem"; + clock-names = "core", "reg"; + clocks = <&CP11X_LABEL(clk) 1 26>, + <&CP11X_LABEL(clk) 1 17>; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-mediatek-mt7622-add-missing-device_type-to.patch b/queue-6.7/arm64-dts-mediatek-mt7622-add-missing-device_type-to.patch new file mode 100644 index 00000000000..1e500ae5536 --- /dev/null +++ b/queue-6.7/arm64-dts-mediatek-mt7622-add-missing-device_type-to.patch @@ -0,0 +1,57 @@ +From e78c7b31e5113bd518814011daf5b7eb846fbd8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jan 2024 14:23:57 +0100 +Subject: arm64: dts: mediatek: mt7622: add missing "device_type" to memory + nodes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 99d100e00144bc01b49a697f4bc4398f2f7e7ce4 ] + +This fixes: +arch/arm64/boot/dts/mediatek/mt7622-rfb1.dtb: /: memory@40000000: 'device_type' is a required property + from schema $id: http://devicetree.org/schemas/memory.yaml# +arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dtb: /: memory@40000000: 'device_type' is a required property + from schema $id: http://devicetree.org/schemas/memory.yaml# + +Signed-off-by: Rafał Miłecki +Reviewed-by: Matthias Brugger +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240122132357.31264-1-zajec5@gmail.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts | 1 + + arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts +index c46682150e502..26cb3268ccbaa 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts ++++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts +@@ -75,6 +75,7 @@ led-1 { + + memory@40000000 { + reg = <0 0x40000000 0 0x40000000>; ++ device_type = "memory"; + }; + + reg_1p8v: regulator-1p8v { +diff --git a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts +index 2dc1bdc74e212..5c26021fc4cf1 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts ++++ b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts +@@ -57,6 +57,7 @@ key-wps { + + memory@40000000 { + reg = <0 0x40000000 0 0x20000000>; ++ device_type = "memory"; + }; + + reg_1p8v: regulator-1p8v { +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-mediatek-mt7986-add-reset-cells-to-infracf.patch b/queue-6.7/arm64-dts-mediatek-mt7986-add-reset-cells-to-infracf.patch new file mode 100644 index 00000000000..06d5ba751d5 --- /dev/null +++ b/queue-6.7/arm64-dts-mediatek-mt7986-add-reset-cells-to-infracf.patch @@ -0,0 +1,47 @@ +From e7bbb648705cb861240fb79969d5aceae54d5d33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jan 2024 19:20:40 +0100 +Subject: arm64: dts: mediatek: mt7986: add "#reset-cells" to infracfg +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit d993daff5962b2dd08f32a83bb1c0e5fa75732ea ] + +MT7986's Infrastructure System Configuration Controller includes reset +controller. It can reset blocks as specified in the +include/dt-bindings/reset/mt7986-resets.h . Add #reset-cells so it can +be referenced properly. + +This fixes: +arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dtb: infracfg@10001000: '#reset-cells' is a required property + from schema $id: http://devicetree.org/schemas/arm/mediatek/mediatek,infracfg.yaml# + +Fixes: 1f9986b258c2 ("arm64: dts: mediatek: add clock support for mt7986a") +Cc: Sam Shih +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20240101182040.28538-2-zajec5@gmail.com +Signed-off-by: Matthias Brugger +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi +index 7b6591509c54d..d974739eae1c9 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi +@@ -153,6 +153,7 @@ infracfg: infracfg@10001000 { + compatible = "mediatek,mt7986-infracfg", "syscon"; + reg = <0 0x10001000 0 0x1000>; + #clock-cells = <1>; ++ #reset-cells = <1>; + }; + + wed_pcie: wed-pcie@10003000 { +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-mediatek-mt7986-drop-clock-cells-from-pwm.patch b/queue-6.7/arm64-dts-mediatek-mt7986-drop-clock-cells-from-pwm.patch new file mode 100644 index 00000000000..f447a724689 --- /dev/null +++ b/queue-6.7/arm64-dts-mediatek-mt7986-drop-clock-cells-from-pwm.patch @@ -0,0 +1,45 @@ +From 165dd1c6e2744a3a140184e5b67875ac621c6c6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jan 2024 19:20:39 +0100 +Subject: arm64: dts: mediatek: mt7986: drop "#clock-cells" from PWM +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 0b721691f0c80af682d0ef3aa4a177c23d41b072 ] + +PWM is not a clock provider and its binding doesn't specify +"#clock-cells" property. + +This fixes: +arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dtb: pwm@10048000: '#clock-cells' does not match any of the regexes: 'pinctrl-[0-9]+' + from schema $id: http://devicetree.org/schemas/pwm/mediatek,mt2712-pwm.yaml# + +Fixes: eabb04df46c6 ("arm64: dts: mt7986: add PWM") +Cc: Daniel Golle +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20240101182040.28538-1-zajec5@gmail.com +Signed-off-by: Matthias Brugger +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi +index a7d9c3246a875..7b6591509c54d 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi +@@ -242,7 +242,6 @@ crypto: crypto@10320000 { + pwm: pwm@10048000 { + compatible = "mediatek,mt7986-pwm"; + reg = <0 0x10048000 0 0x1000>; +- #clock-cells = <1>; + #pwm-cells = <2>; + interrupts = ; + clocks = <&topckgen CLK_TOP_PWM_SEL>, +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-mediatek-mt7986-drop-crypto-s-unneeded-inv.patch b/queue-6.7/arm64-dts-mediatek-mt7986-drop-crypto-s-unneeded-inv.patch new file mode 100644 index 00000000000..abfd13dee6a --- /dev/null +++ b/queue-6.7/arm64-dts-mediatek-mt7986-drop-crypto-s-unneeded-inv.patch @@ -0,0 +1,46 @@ +From 2cbf9b421ea55dc15ac1f496db774538a8bd3af5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Nov 2023 14:24:11 +0100 +Subject: arm64: dts: mediatek: mt7986: drop crypto's unneeded/invalid clock + name +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit bb69d19c649669f700149df309245cd925612f7c ] + +According to the "inside-secure,safexcel-eip97" binding "clock-names" is +required only if there are two clocks specified. If present the first +name must by "core". + +Name "infra_eip97_ck" is invalid and was probably just a typo. Drop it. + +Fixes: ecc5287cfe53 ("arm64: dts: mt7986: add crypto related device nodes") +Cc: Sam Shih +Signed-off-by: Rafał Miłecki +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20231116132411.7665-1-zajec5@gmail.com +Signed-off-by: Matthias Brugger +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi +index fc751e049953c..a7d9c3246a875 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi +@@ -234,7 +234,6 @@ crypto: crypto@10320000 { + ; + interrupt-names = "ring0", "ring1", "ring2", "ring3"; + clocks = <&infracfg CLK_INFRA_EIP97_CK>; +- clock-names = "infra_eip97_ck"; + assigned-clocks = <&topckgen CLK_TOP_EIP_B_SEL>; + assigned-clock-parents = <&apmixedsys CLK_APMIXED_NET2PLL>; + status = "disabled"; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-mediatek-mt7986-fix-reference-to-pwm-in-fa.patch b/queue-6.7/arm64-dts-mediatek-mt7986-fix-reference-to-pwm-in-fa.patch new file mode 100644 index 00000000000..12fcc55bd8c --- /dev/null +++ b/queue-6.7/arm64-dts-mediatek-mt7986-fix-reference-to-pwm-in-fa.patch @@ -0,0 +1,44 @@ +From 9fb36a5e08c8aece6e4fa0236aab7ac44009b1d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Nov 2023 14:08:16 +0100 +Subject: arm64: dts: mediatek: mt7986: fix reference to PWM in fan node +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 7865abbbdf1e1ee57a0bb8ec83079f8840c16854 ] + +This fixes typo and resolves following validation error: +arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dtb: pwm-fan: pwms: [[54, 0, 10000], [0]] is too long + from schema $id: http://devicetree.org/schemas/hwmon/pwm-fan.yaml# + +Fixes: c26f779a2295 ("arm64: dts: mt7986: add pwm-fan and cooling-maps to BPI-R3 dts") +Cc: Daniel Golle +Signed-off-by: Rafał Miłecki +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20231116130816.4932-1-zajec5@gmail.com +Signed-off-by: Matthias Brugger +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts b/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts +index b876e501216be..e1ec2cccf4444 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts ++++ b/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts +@@ -43,7 +43,7 @@ fan: pwm-fan { + #cooling-cells = <2>; + /* cooling level (0, 1, 2) - pwm inverted */ + cooling-levels = <255 96 0>; +- pwms = <&pwm 0 10000 0>; ++ pwms = <&pwm 0 10000>; + status = "okay"; + }; + +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-mediatek-mt7986-fix-spi-bus-width-properti.patch b/queue-6.7/arm64-dts-mediatek-mt7986-fix-spi-bus-width-properti.patch new file mode 100644 index 00000000000..2a7889d3855 --- /dev/null +++ b/queue-6.7/arm64-dts-mediatek-mt7986-fix-spi-bus-width-properti.patch @@ -0,0 +1,63 @@ +From 6525a4b2f94776b89a55c302c038bd3d2b28676f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Nov 2023 14:09:51 +0100 +Subject: arm64: dts: mediatek: mt7986: fix SPI bus width properties +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 4e7dc18a753cec130b06f1ddbae10ea9dcfb1723 ] + +This fixes SPI setup and resolves following validation errors: +arch/arm64/boot/dts/mediatek/mt7986a-rfb.dtb: spi_nand@0: Unevaluated properties are not allowed ('spi-rx-buswidth', 'spi-tx-buswidth' were unexpected) + from schema $id: http://devicetree.org/schemas/mtd/spi-nand.yaml# +arch/arm64/boot/dts/mediatek/mt7986b-rfb.dtb: spi_nand@0: Unevaluated properties are not allowed ('spi-rx-buswidth', 'spi-tx-buswidth' were unexpected) + from schema $id: http://devicetree.org/schemas/mtd/spi-nand.yaml# + +Fixes: 885e153ed7c1 ("arm64: dts: mt7986: add spi related device nodes") +Signed-off-by: Rafał Miłecki +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20231116130952.5099-1-zajec5@gmail.com +Signed-off-by: Matthias Brugger +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7986a-rfb.dts | 4 ++-- + arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dts b/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dts +index 3ef371ca254e8..bcb3ebb85d708 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dts ++++ b/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dts +@@ -241,8 +241,8 @@ spi_nand: spi_nand@0 { + compatible = "spi-nand"; + reg = <0>; + spi-max-frequency = <10000000>; +- spi-tx-buswidth = <4>; +- spi-rx-buswidth = <4>; ++ spi-tx-bus-width = <4>; ++ spi-rx-bus-width = <4>; + }; + }; + +diff --git a/arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts b/arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts +index dde190442e386..48fe50e671779 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts ++++ b/arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts +@@ -156,8 +156,8 @@ spi_nand: spi_nand@0 { + compatible = "spi-nand"; + reg = <0>; + spi-max-frequency = <10000000>; +- spi-tx-buswidth = <4>; +- spi-rx-buswidth = <4>; ++ spi-tx-bus-width = <4>; ++ spi-rx-bus-width = <4>; + }; + }; + +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-mediatek-mt7986-fix-spi-nodename.patch b/queue-6.7/arm64-dts-mediatek-mt7986-fix-spi-nodename.patch new file mode 100644 index 00000000000..79b6579b9b0 --- /dev/null +++ b/queue-6.7/arm64-dts-mediatek-mt7986-fix-spi-nodename.patch @@ -0,0 +1,61 @@ +From 05461cbf70de401a94e3b4adc3a6547c882e8ab1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Nov 2023 14:09:52 +0100 +Subject: arm64: dts: mediatek: mt7986: fix SPI nodename +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit bbe266c70e1343ee3e71ca31138141b3da265085 ] + +This fixes following validation errors: +arch/arm64/boot/dts/mediatek/mt7986a-rfb.dtb: spi_nand@0: $nodename:0: 'spi_nand@0' does not match '^(flash|.*sram|nand)(@.*)?$' + from schema $id: http://devicetree.org/schemas/mtd/spi-nand.yaml# +arch/arm64/boot/dts/mediatek/mt7986b-rfb.dtb: spi_nand@0: $nodename:0: 'spi_nand@0' does not match '^(flash|.*sram|nand)(@.*)?$' + from schema $id: http://devicetree.org/schemas/mtd/spi-nand.yaml# + +Fixes: 885e153ed7c1 ("arm64: dts: mt7986: add spi related device nodes") +Signed-off-by: Rafał Miłecki +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20231116130952.5099-2-zajec5@gmail.com +Signed-off-by: Matthias Brugger +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7986a-rfb.dts | 3 ++- + arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts | 3 ++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dts b/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dts +index bcb3ebb85d708..2f884c24f1eb4 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dts ++++ b/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dts +@@ -237,7 +237,8 @@ &spi0 { + pinctrl-0 = <&spi_flash_pins>; + cs-gpios = <0>, <0>; + status = "okay"; +- spi_nand: spi_nand@0 { ++ ++ spi_nand: flash@0 { + compatible = "spi-nand"; + reg = <0>; + spi-max-frequency = <10000000>; +diff --git a/arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts b/arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts +index 48fe50e671779..57dcaeef31d7f 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts ++++ b/arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts +@@ -152,7 +152,8 @@ &spi0 { + pinctrl-0 = <&spi_flash_pins>; + cs-gpios = <0>, <0>; + status = "okay"; +- spi_nand: spi_nand@0 { ++ ++ spi_nand: flash@0 { + compatible = "spi-nand"; + reg = <0>; + spi-max-frequency = <10000000>; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-mediatek-mt8186-add-missing-clocks-to-ssus.patch b/queue-6.7/arm64-dts-mediatek-mt8186-add-missing-clocks-to-ssus.patch new file mode 100644 index 00000000000..c2d9a409f5b --- /dev/null +++ b/queue-6.7/arm64-dts-mediatek-mt8186-add-missing-clocks-to-ssus.patch @@ -0,0 +1,64 @@ +From d4ae5cead7b7e70100a693aeac3e3a307783cc99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 10:02:37 -0500 +Subject: arm64: dts: mediatek: mt8186: Add missing clocks to ssusb power + domains +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit a00d4a98af44e025891e97c490b2545368a25e08 ] + +The ssusb power domains currently don't list any clocks, despite +depending on some, and thus rely on the bootloader leaving the required +clocks on in order to work. + +When booting with the upstream arm64 defconfig, the power domain +controller will defer probe until modules have loaded since it has an +indirect dependency on CONFIG_MTK_CMDQ, which is configured as a module. +However at the point where modules are loaded, unused clocks are also +disabled, causing the ssusb domains to fail to be enabled and +consequently the controller to fail probe: + +mtk-power-controller 10006000.syscon:power-controller: /soc/syscon@10006000/power-controller/power-domain@4: failed to power on domain: -110 +mtk-power-controller: probe of 10006000.syscon:power-controller failed with error -110 + +Add the missing clocks for the ssusb power domains so that they can +successfully probe without relying on the bootloader state. + +Fixes: d9e43c1e7a38 ("arm64: dts: mt8186: Add power domains controller") +Signed-off-by: Nícolas F. R. A. Prado +Link: https://lore.kernel.org/r/20240213-mt8186-ssusb-domain-clk-fix-v2-1-1f981d35f3fd@collabora.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8186.dtsi | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8186.dtsi b/arch/arm64/boot/dts/mediatek/mt8186.dtsi +index ee0feadbf9619..4fd25f0f313d2 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8186.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8186.dtsi +@@ -931,11 +931,17 @@ power-domain@MT8186_POWER_DOMAIN_CSIRX_TOP { + + power-domain@MT8186_POWER_DOMAIN_SSUSB { + reg = ; ++ clocks = <&topckgen CLK_TOP_USB_TOP>, ++ <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_REF>; ++ clock-names = "sys_ck", "ref_ck"; + #power-domain-cells = <0>; + }; + + power-domain@MT8186_POWER_DOMAIN_SSUSB_P1 { + reg = ; ++ clocks = <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_P1_SYS>, ++ <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_P1_REF>; ++ clock-names = "sys_ck", "ref_ck"; + #power-domain-cells = <0>; + }; + +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-mediatek-mt8186-add-missing-xhci-clock-to-.patch b/queue-6.7/arm64-dts-mediatek-mt8186-add-missing-xhci-clock-to-.patch new file mode 100644 index 00000000000..afc44bc1ca1 --- /dev/null +++ b/queue-6.7/arm64-dts-mediatek-mt8186-add-missing-xhci-clock-to-.patch @@ -0,0 +1,74 @@ +From 32d6e40b15770ced39ab90f12f1d659b02acaf59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 10:02:38 -0500 +Subject: arm64: dts: mediatek: mt8186: Add missing xhci clock to usb + controllers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 1af98c3e53da5a8f627855cecd68b017e753ffd3 ] + +The mtu3 usb controllers don't list the xhci clock, though they require +it, and thus rely on the bootloader leaving it on in order to work. + +When booting with the upstream arm64 defconfig, the usb controllers will +defer probe until modules have loaded since they have an indirect +dependency on CONFIG_MTK_CMDQ, which is configured as a module. However +at the point where modules are loaded, unused clocks are also disabled, +causing the usb controllers to probe without the xhci clock enabled and +fail to probe: + +mtu3 11201000.usb: clks of sts1 are not stable! +mtu3 11201000.usb: device enable failed -110 +mtu3 11201000.usb: mtu3 hw init failed:-110 +mtu3 11201000.usb: failed to initialize gadget +mtu3: probe of 11201000.usb failed with error -110 + +(and same for the one at 11281000) + +Add the missing clock for the usb controllers so that they can +successfully probe without relying on the bootloader state. + +Fixes: f6c3e61c5486 ("arm64: dts: mediatek: mt8186: Add MTU3 nodes") +Signed-off-by: Nícolas F. R. A. Prado +Link: https://lore.kernel.org/r/20240213-mt8186-ssusb-domain-clk-fix-v2-2-1f981d35f3fd@collabora.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8186.dtsi | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8186.dtsi b/arch/arm64/boot/dts/mediatek/mt8186.dtsi +index 4fd25f0f313d2..84ec6c1aa12b9 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8186.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8186.dtsi +@@ -1536,8 +1536,9 @@ ssusb0: usb@11201000 { + clocks = <&topckgen CLK_TOP_USB_TOP>, + <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_REF>, + <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_HCLK>, +- <&infracfg_ao CLK_INFRA_AO_ICUSB>; +- clock-names = "sys_ck", "ref_ck", "mcu_ck", "dma_ck"; ++ <&infracfg_ao CLK_INFRA_AO_ICUSB>, ++ <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_XHCI>; ++ clock-names = "sys_ck", "ref_ck", "mcu_ck", "dma_ck", "xhci_ck"; + interrupts = ; + phys = <&u2port0 PHY_TYPE_USB2>; + power-domains = <&spm MT8186_POWER_DOMAIN_SSUSB>; +@@ -1601,8 +1602,9 @@ ssusb1: usb@11281000 { + clocks = <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_P1_SYS>, + <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_P1_REF>, + <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_P1_HCLK>, +- <&clk26m>; +- clock-names = "sys_ck", "ref_ck", "mcu_ck", "dma_ck"; ++ <&clk26m>, ++ <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_P1_XHCI>; ++ clock-names = "sys_ck", "ref_ck", "mcu_ck", "dma_ck", "xhci_ck"; + interrupts = ; + phys = <&u2port1 PHY_TYPE_USB2>, <&u3port1 PHY_TYPE_USB3>; + power-domains = <&spm MT8186_POWER_DOMAIN_SSUSB_P1>; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-mediatek-mt8186-fix-venc-power-domain-cloc.patch b/queue-6.7/arm64-dts-mediatek-mt8186-fix-venc-power-domain-cloc.patch new file mode 100644 index 00000000000..37b030a9ede --- /dev/null +++ b/queue-6.7/arm64-dts-mediatek-mt8186-fix-venc-power-domain-cloc.patch @@ -0,0 +1,38 @@ +From 425bf4e4440017d48dcb0c786b7f450779bfd081 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Dec 2023 13:32:44 +0200 +Subject: arm64: dts: mediatek: mt8186: fix VENC power domain clocks + +From: Eugen Hristev + +[ Upstream commit 09860910c589a3bb3b5268ff6f704cf6b18ada73 ] + +The larb clock is in fact a subsys clock, so it must be prefixed by +'subsys-' to be correctly identified in the driver. + +Fixes: d9e43c1e7a38 ("arm64: dts: mt8186: Add power domains controller") +Signed-off-by: Eugen Hristev +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20231228113245.174706-6-eugen.hristev@collabora.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8186.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8186.dtsi b/arch/arm64/boot/dts/mediatek/mt8186.dtsi +index 2fec6fd1c1a71..ee0feadbf9619 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8186.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8186.dtsi +@@ -1061,7 +1061,7 @@ power-domain@MT8186_POWER_DOMAIN_VENC { + reg = ; + clocks = <&topckgen CLK_TOP_VENC>, + <&vencsys CLK_VENC_CKE1_VENC>; +- clock-names = "venc0", "larb"; ++ clock-names = "venc0", "subsys-larb"; + mediatek,infracfg = <&infracfg_ao>; + #power-domain-cells = <0>; + }; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-mediatek-mt8192-asurada-remove-crosec-base.patch b/queue-6.7/arm64-dts-mediatek-mt8192-asurada-remove-crosec-base.patch new file mode 100644 index 00000000000..30f6d10d448 --- /dev/null +++ b/queue-6.7/arm64-dts-mediatek-mt8192-asurada-remove-crosec-base.patch @@ -0,0 +1,49 @@ +From 761faf606bf02ce7c64f163e9f14cc670a1b02b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Feb 2024 15:08:42 -0500 +Subject: arm64: dts: mediatek: mt8192-asurada: Remove CrosEC base detection + node +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 9b49cabe631b0a25aaf8fc2ba81b5b9ea6ff01b7 ] + +The commit adding the ChromeOS EC to the Asurada Devicetree mistakenly +added a base detection node. While tablet mode detection is supported by +CrosEC and used by Hayato, it is done through the cros-ec-keyb driver. +The base detection node, which is handled by the hid-google-hammer +driver, also provides tablet mode detection but by checking base +attachment status on the CrosEC, which is not supported for Asurada. + +Hence, remove the unused CrosEC base detection node for Asurada. + +Fixes: eb188a2aaa82 ("arm64: dts: mediatek: asurada: Add ChromeOS EC") +Signed-off-by: Nícolas F. R. A. Prado +Link: https://lore.kernel.org/r/20240207-mt8192-asurada-cbas-remove-v1-1-04cb65951975@collabora.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi b/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi +index f2281250ac35d..02ce05bc151ae 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi +@@ -1336,10 +1336,6 @@ cros_ec: ec@0 { + #address-cells = <1>; + #size-cells = <0>; + +- base_detection: cbas { +- compatible = "google,cros-cbas"; +- }; +- + cros_ec_pwm: pwm { + compatible = "google,cros-ec-pwm"; + #pwm-cells = <1>; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-mediatek-mt8192-fix-vencoder-clock-name.patch b/queue-6.7/arm64-dts-mediatek-mt8192-fix-vencoder-clock-name.patch new file mode 100644 index 00000000000..1e459ae8df0 --- /dev/null +++ b/queue-6.7/arm64-dts-mediatek-mt8192-fix-vencoder-clock-name.patch @@ -0,0 +1,40 @@ +From 4d555574a9c64946db0b2b11ed165e3f4bb1f79d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Dec 2023 13:32:42 +0200 +Subject: arm64: dts: mediatek: mt8192: fix vencoder clock name + +From: Eugen Hristev + +[ Upstream commit 76aac0f2a46847ed4a7a4fdd848dd66023c19ad1 ] + +Clock name should be `venc_sel` as per binding. +Fix the warning message : +arch/arm64/boot/dts/mediatek/mt8192-asurada-hayato-r1.dtb: vcodec@17020000: clock-names:0: 'venc_sel' was expected + from schema $id: http://devicetree.org/schemas/media/mediatek,vcodec-encoder.yaml# + +Fixes: aa8f3711fc87 ("arm64: dts: mt8192: Add H264 venc device node") +Signed-off-by: Eugen Hristev +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20231228113245.174706-4-eugen.hristev@collabora.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8192.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +index 69f4cded5dbbf..f1fc14e53f8c7 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +@@ -1770,7 +1770,7 @@ vcodec_enc: vcodec@17020000 { + mediatek,scp = <&scp>; + power-domains = <&spm MT8192_POWER_DOMAIN_VENC>; + clocks = <&vencsys CLK_VENC_SET1_VENC>; +- clock-names = "venc-set1"; ++ clock-names = "venc_sel"; + assigned-clocks = <&topckgen CLK_TOP_VENC_SEL>; + assigned-clock-parents = <&topckgen CLK_TOP_UNIVPLL_D4>; + }; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-mt8183-move-crosec-base-detection-node-to-.patch b/queue-6.7/arm64-dts-mt8183-move-crosec-base-detection-node-to-.patch new file mode 100644 index 00000000000..027cb0aa836 --- /dev/null +++ b/queue-6.7/arm64-dts-mt8183-move-crosec-base-detection-node-to-.patch @@ -0,0 +1,106 @@ +From 71d305066a50d06d5fc6af5662743f889a4c31d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jan 2024 18:38:34 -0300 +Subject: arm64: dts: mt8183: Move CrosEC base detection node to kukui-based + DTs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 04bd6411f506357fd1faedc2b2156e7ef206aa9a ] + +The cbas node is used to describe base detection functionality in the +ChromeOS EC, which is used for units that have a detachable keyboard and +thus rely on this functionality to switch between tablet and laptop +mode. + +Despite the original commit having added the cbas node to the +mt8183-kukui.dtsi, not all machines that include it are detachables. In +fact all machines that include from mt8183-kukui-jacuzzi.dtsi are either +clamshells (ie normal laptops) or convertibles, meaning the keyboard can +be flipped but not detached. The detection for the keyboard getting +flipped is handled by the driver bound to the keyboard-controller node +in the EC. + +Move the base detection node from the base kukui dtsi to the dtsis where +all machines are detachables, and thus actually make use of the node. + +Fixes: 4fa8492d1e5b ("arm64: dts: mt8183: add cbas node under cros_ec") +Signed-off-by: Nícolas F. R. A. Prado +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240116-mt8183-kukui-cbas-remove-v3-1-055e21406e86@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi | 4 ++++ + arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi | 4 ++++ + arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi | 4 ++++ + arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 4 ---- + 4 files changed, 12 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi +index a11adeb29b1f2..0d3c7b8162ff0 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi +@@ -373,6 +373,10 @@ pen_eject { + }; + + &cros_ec { ++ cbas { ++ compatible = "google,cros-cbas"; ++ }; ++ + keyboard-controller { + compatible = "google,cros-ec-keyb-switches"; + }; +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi +index 4864c39e53a4f..e73113cb51f53 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi +@@ -340,6 +340,10 @@ touch_pin_reset: pin_reset { + }; + + &cros_ec { ++ cbas { ++ compatible = "google,cros-cbas"; ++ }; ++ + keyboard-controller { + compatible = "google,cros-ec-keyb-switches"; + }; +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi +index d5f41c6c98814..181da69d18f46 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi +@@ -344,6 +344,10 @@ rst_pin { + }; + + &cros_ec { ++ cbas { ++ compatible = "google,cros-cbas"; ++ }; ++ + keyboard-controller { + compatible = "google,cros-ec-keyb-switches"; + }; +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi +index 7881a27be0297..49a1c3ccb0041 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi +@@ -935,10 +935,6 @@ usbc_extcon: extcon0 { + google,usb-port-id = <0>; + }; + +- cbas { +- compatible = "google,cros-cbas"; +- }; +- + typec { + compatible = "google,cros-ec-typec"; + #address-cells = <1>; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-mt8195-cherry-tomato-change-watchdog-reset.patch b/queue-6.7/arm64-dts-mt8195-cherry-tomato-change-watchdog-reset.patch new file mode 100644 index 00000000000..b269144e3ca --- /dev/null +++ b/queue-6.7/arm64-dts-mt8195-cherry-tomato-change-watchdog-reset.patch @@ -0,0 +1,66 @@ +From 520f3c6e6a93c230aec62a0dc8a01db6a6f8c0f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jan 2024 07:51:57 +0000 +Subject: arm64: dts: mt8195-cherry-tomato: change watchdog reset boot flow + +From: Hsin-Te Yuan + +[ Upstream commit ef569d5db50e7edd709e482157769a5b3c367e22 ] + +The external output reset signal was originally disabled and sent from +firmware. However, an unfixed bug in the firmware on tomato prevents +the signal from being sent, causing the device to fail to boot. To fix +this, enable external output reset signal to allow the device to reboot +normally. + +Fixes: 5eb2e303ec6b ("arm64: dts: mediatek: Introduce MT8195 Cherry platform's Tomato") +Signed-off-by: Hsin-Te Yuan +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240124-send-upstream-v3-1-5097c9862a73@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r1.dts | 4 ++++ + arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r2.dts | 4 ++++ + arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r3.dts | 4 ++++ + 3 files changed, 12 insertions(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r1.dts b/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r1.dts +index 2d5e8f371b6de..a82d716f10d44 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r1.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r1.dts +@@ -23,3 +23,7 @@ &sound { + &ts_10 { + status = "okay"; + }; ++ ++&watchdog { ++ /delete-property/ mediatek,disable-extrst; ++}; +diff --git a/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r2.dts b/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r2.dts +index 2586c32ce6e6f..2fe20e0dad836 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r2.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r2.dts +@@ -43,3 +43,7 @@ &sound { + &ts_10 { + status = "okay"; + }; ++ ++&watchdog { ++ /delete-property/ mediatek,disable-extrst; ++}; +diff --git a/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r3.dts b/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r3.dts +index f54f9477b99da..dd294ca98194c 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r3.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r3.dts +@@ -44,3 +44,7 @@ &sound { + &ts_10 { + status = "okay"; + }; ++ ++&watchdog { ++ /delete-property/ mediatek,disable-extrst; ++}; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-msm8996-define-ufs-unipro-clock-limit.patch b/queue-6.7/arm64-dts-qcom-msm8996-define-ufs-unipro-clock-limit.patch new file mode 100644 index 00000000000..5978c8412bb --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-msm8996-define-ufs-unipro-clock-limit.patch @@ -0,0 +1,42 @@ +From a98f1669d04894036c2f64dcc458ab0806bb4d5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Dec 2023 13:39:42 +0000 +Subject: arm64: dts: qcom: msm8996: Define UFS UniPro clock limits + +From: Yassine Oudjana + +[ Upstream commit 68c4c20848d71b0e69c3403becb5dd23e89e5896 ] + +These limits were always defined as 0, but that didn't cause any issue +since the driver had hardcoded limits. In commit b4e13e1ae95e ("scsi: ufs: +qcom: Add multiple frequency support for MAX_CORE_CLK_1US_CYCLES") the +hardcoded limits were removed and the driver started reading them from DT, +causing UFS to stop working on MSM8996. Add real UniPro clock limits to fix +UFS. + +Signed-off-by: Yassine Oudjana +Fixes: 57fc67ef0d35 ("arm64: dts: qcom: msm8996: Add ufs related nodes") +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20231218133917.78770-1-y.oudjana@protonmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8996.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index b7afd7c47a02e..59bfbf9bc46f8 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -2096,7 +2096,7 @@ ufshc: ufshc@624000 { + <0 0>, + <0 0>, + <150000000 300000000>, +- <0 0>, ++ <75000000 150000000>, + <0 0>, + <0 0>, + <0 0>, +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-msm8996-fix-ufs-phy-clocks.patch b/queue-6.7/arm64-dts-qcom-msm8996-fix-ufs-phy-clocks.patch new file mode 100644 index 00000000000..42fbaa78fce --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-msm8996-fix-ufs-phy-clocks.patch @@ -0,0 +1,42 @@ +From 1300b769e50f7f711f51949bb4400e6c8b860741 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 12:37:28 +0530 +Subject: arm64: dts: qcom: msm8996: Fix UFS PHY clocks + +From: Manivannan Sadhasivam + +[ Upstream commit c83fdb4335cec507d685ba9661ed7c4ccbaf12ff ] + +QMP PHY used in MSM8996 requires 2 clocks: + +* ref - 19.2MHz reference clock from RPM +* qref - QREF clock from GCC + +Fixes: 27520210e881 ("arm64: dts: qcom: msm8996: Use generic QMP driver for UFS") +Reviewed-by: Konrad Dybcio +Signed-off-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-5-58a49d2f4605@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8996.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index fa8ec92ce4904..b7afd7c47a02e 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -2118,8 +2118,8 @@ ufsphy: phy@627000 { + #size-cells = <1>; + ranges; + +- clocks = <&gcc GCC_UFS_CLKREF_CLK>; +- clock-names = "ref"; ++ clocks = <&rpmcc RPM_SMD_LN_BB_CLK>, <&gcc GCC_UFS_CLKREF_CLK>; ++ clock-names = "ref", "qref"; + + resets = <&ufshc 0>; + reset-names = "ufsphy"; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-msm8998-declare-vls-clamp-register-fo.patch b/queue-6.7/arm64-dts-qcom-msm8998-declare-vls-clamp-register-fo.patch new file mode 100644 index 00000000000..6eb5c67cc71 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-msm8998-declare-vls-clamp-register-fo.patch @@ -0,0 +1,53 @@ +From 38b6db02df6c54de9f5140e4575ddebaeb89e230 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jan 2024 16:04:25 +0200 +Subject: arm64: dts: qcom: msm8998: declare VLS CLAMP register for USB3 PHY + +From: Dmitry Baryshkov + +[ Upstream commit fc835b2311d4deb85d776c1d73562338462aa7ac ] + +The USB3 PHY on the MSM8998 platform doesn't have built-in +PCS_MISC_CLAMP_ENABLE register. Instead clamping is handled separately +via the register in the TCSR space. Declare corresponding register. + +Fixes: 026dad8f5873 ("arm64: dts: qcom: msm8998: Add USB-related nodes") +Cc: Jeffrey Hugo +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Reviewed-by: Jeffrey Hugo +Link: https://lore.kernel.org/r/20240117-usbc-phy-vls-clamp-v2-4-a950c223f10f@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8998.dtsi | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi +index 7dd0d4ce25ef4..610ffd0f9e18e 100644 +--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi +@@ -1082,6 +1082,11 @@ tcsr_regs_1: syscon@1f60000 { + reg = <0x01f60000 0x20000>; + }; + ++ tcsr_regs_2: syscon@1fc0000 { ++ compatible = "qcom,msm8998-tcsr", "syscon"; ++ reg = <0x01fc0000 0x26000>; ++ }; ++ + tlmm: pinctrl@3400000 { + compatible = "qcom,msm8998-pinctrl"; + reg = <0x03400000 0xc00000>; +@@ -2185,6 +2190,8 @@ usb3phy: phy@c010000 { + reset-names = "phy", + "phy_phy"; + ++ qcom,tcsr-reg = <&tcsr_regs_2 0xb244>; ++ + status = "disabled"; + }; + +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-msm8998-fix-ufs-phy-clocks.patch b/queue-6.7/arm64-dts-qcom-msm8998-fix-ufs-phy-clocks.patch new file mode 100644 index 00000000000..a705ef865b5 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-msm8998-fix-ufs-phy-clocks.patch @@ -0,0 +1,51 @@ +From a96cce09ab369521f2d71808dc0e404a1f1ece39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 12:37:29 +0530 +Subject: arm64: dts: qcom: msm8998: Fix UFS PHY clocks + +From: Manivannan Sadhasivam + +[ Upstream commit 5e653a7ff4426242f22dd8bc6af7f29e10ee0d68 ] + +QMP PHY used in MSM8998 requires 3 clocks: + +* ref - 19.2MHz reference clock from RPM +* ref_aux - Auxiliary reference clock from GCC +* qref - QREF clock from GCC + +Fixes: cd3dbe2a4e6c ("arm64: dts: qcom: msm8998: Add UFS nodes") +Reviewed-by: Konrad Dybcio +Signed-off-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-6-58a49d2f4605@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8998.dtsi | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi +index 610ffd0f9e18e..2b22bf795a447 100644 +--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi +@@ -1051,12 +1051,12 @@ ufsphy: phy@1da7000 { + status = "disabled"; + ranges; + +- clock-names = +- "ref", +- "ref_aux"; +- clocks = +- <&gcc GCC_UFS_CLKREF_CLK>, +- <&gcc GCC_UFS_PHY_AUX_CLK>; ++ clocks = <&rpmcc RPM_SMD_LN_BB_CLK1>, ++ <&gcc GCC_UFS_PHY_AUX_CLK>, ++ <&gcc GCC_UFS_CLKREF_CLK>; ++ clock-names = "ref", ++ "ref_aux", ++ "qref"; + + reset-names = "ufsphy"; + resets = <&ufshc 0>; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-msm8998-switch-usb-qmp-phy-to-new-sty.patch b/queue-6.7/arm64-dts-qcom-msm8998-switch-usb-qmp-phy-to-new-sty.patch new file mode 100644 index 00000000000..b660c52f91d --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-msm8998-switch-usb-qmp-phy-to-new-sty.patch @@ -0,0 +1,85 @@ +From 9cf7179d579b1eff83d3f3c2ab042fe93a45d023 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Aug 2023 00:19:46 +0300 +Subject: arm64: dts: qcom: msm8998: switch USB QMP PHY to new style of + bindings + +From: Dmitry Baryshkov + +[ Upstream commit b7efebfeb2e8ad8187cdabba5f0212ba2e6c1069 ] + +Change the USB QMP PHY to use newer style of QMP PHY bindings (single +resource region, no per-PHY subnodes). + +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20230824211952.1397699-11-dmitry.baryshkov@linaro.org +Signed-off-by: Bjorn Andersson +Stable-dep-of: fc835b2311d4 ("arm64: dts: qcom: msm8998: declare VLS CLAMP register for USB3 PHY") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8998.dtsi | 35 +++++++++++---------------- + 1 file changed, 14 insertions(+), 21 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi +index ebc5ba1b369e9..7dd0d4ce25ef4 100644 +--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi +@@ -2157,7 +2157,7 @@ usb3_dwc3: usb@a800000 { + interrupts = ; + snps,dis_u2_susphy_quirk; + snps,dis_enblslpm_quirk; +- phys = <&qusb2phy>, <&usb1_ssphy>; ++ phys = <&qusb2phy>, <&usb3phy>; + phy-names = "usb2-phy", "usb3-phy"; + snps,has-lpm-erratum; + snps,hird-threshold = /bits/ 8 <0x10>; +@@ -2166,33 +2166,26 @@ usb3_dwc3: usb@a800000 { + + usb3phy: phy@c010000 { + compatible = "qcom,msm8998-qmp-usb3-phy"; +- reg = <0x0c010000 0x18c>; +- status = "disabled"; +- #address-cells = <1>; +- #size-cells = <1>; +- ranges; ++ reg = <0x0c010000 0x1000>; + + clocks = <&gcc GCC_USB3_PHY_AUX_CLK>, ++ <&gcc GCC_USB3_CLKREF_CLK>, + <&gcc GCC_USB_PHY_CFG_AHB2PHY_CLK>, +- <&gcc GCC_USB3_CLKREF_CLK>; +- clock-names = "aux", "cfg_ahb", "ref"; ++ <&gcc GCC_USB3_PHY_PIPE_CLK>; ++ clock-names = "aux", ++ "ref", ++ "cfg_ahb", ++ "pipe"; ++ clock-output-names = "usb3_phy_pipe_clk_src"; ++ #clock-cells = <0>; ++ #phy-cells = <0>; + + resets = <&gcc GCC_USB3_PHY_BCR>, + <&gcc GCC_USB3PHY_PHY_BCR>; +- reset-names = "phy", "common"; ++ reset-names = "phy", ++ "phy_phy"; + +- usb1_ssphy: phy@c010200 { +- reg = <0xc010200 0x128>, +- <0xc010400 0x200>, +- <0xc010c00 0x20c>, +- <0xc010600 0x128>, +- <0xc010800 0x200>; +- #phy-cells = <0>; +- #clock-cells = <0>; +- clocks = <&gcc GCC_USB3_PHY_PIPE_CLK>; +- clock-names = "pipe0"; +- clock-output-names = "usb3_phy_pipe_clk_src"; +- }; ++ status = "disabled"; + }; + + qusb2phy: phy@c012000 { +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-qcm2290-declare-vls-clamp-register-fo.patch b/queue-6.7/arm64-dts-qcom-qcm2290-declare-vls-clamp-register-fo.patch new file mode 100644 index 00000000000..3cb44a0e7d8 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-qcm2290-declare-vls-clamp-register-fo.patch @@ -0,0 +1,51 @@ +From 2eb740b8ba919816f2939316d73ec6b4c9f6dc3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jan 2024 16:04:26 +0200 +Subject: arm64: dts: qcom: qcm2290: declare VLS CLAMP register for USB3 PHY + +From: Dmitry Baryshkov + +[ Upstream commit acb94d67f5a23dbb2e0021b6c30609ed05d7d6a5 ] + +The USB3 PHY on the QCM2290 platform doesn't have built-in +PCS_MISC_CLAMP_ENABLE register. Instead clamping is handled separately +via the register in the TCSR space. Declare corresponding register. + +Fixes: 0c55f6229bc3 ("arm64: dts: qcom: qcm2290: Add USB3 PHY") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240117-usbc-phy-vls-clamp-v2-5-a950c223f10f@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/qcm2290.dtsi | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/qcm2290.dtsi b/arch/arm64/boot/dts/qcom/qcm2290.dtsi +index d46e591e72b5c..40a8506553ef5 100644 +--- a/arch/arm64/boot/dts/qcom/qcm2290.dtsi ++++ b/arch/arm64/boot/dts/qcom/qcm2290.dtsi +@@ -418,6 +418,11 @@ tcsr_mutex: hwlock@340000 { + #hwlock-cells = <1>; + }; + ++ tcsr_regs: syscon@3c0000 { ++ compatible = "qcom,qcm2290-tcsr", "syscon"; ++ reg = <0x0 0x003c0000 0x0 0x40000>; ++ }; ++ + tlmm: pinctrl@500000 { + compatible = "qcom,qcm2290-tlmm"; + reg = <0x0 0x00500000 0x0 0x300000>; +@@ -665,6 +670,8 @@ usb_qmpphy: phy@1615000 { + + #phy-cells = <0>; + ++ qcom,tcsr-reg = <&tcsr_regs 0xb244>; ++ + status = "disabled"; + }; + +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sa8540p-drop-gfx.lvl-as-power-domain-.patch b/queue-6.7/arm64-dts-qcom-sa8540p-drop-gfx.lvl-as-power-domain-.patch new file mode 100644 index 00000000000..09c123906f9 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sa8540p-drop-gfx.lvl-as-power-domain-.patch @@ -0,0 +1,41 @@ +From 8524a3d73471da4a766239eb515749cd5b2eab25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jan 2024 13:05:11 -0800 +Subject: arm64: dts: qcom: sa8540p: Drop gfx.lvl as power-domain for gpucc + +From: Bjorn Andersson + +[ Upstream commit fd5821a1a83c969ed2dcc72fef885f3a82c1d978 ] + +The SA8295P and SA8540P uses an external regulator (max20411), and +gfx.lvl is not provided by rpmh. Drop the power-domains property of the +gpucc node to reflect this. + +Fixes: eec51ab2fd6f ("arm64: dts: qcom: sc8280xp: Add GPU related nodes") +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20240125-sa8295p-gpu-v4-5-7011c2a63037@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sa8540p.dtsi | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sa8540p.dtsi b/arch/arm64/boot/dts/qcom/sa8540p.dtsi +index 96b2c59ad02b4..23888029cc117 100644 +--- a/arch/arm64/boot/dts/qcom/sa8540p.dtsi ++++ b/arch/arm64/boot/dts/qcom/sa8540p.dtsi +@@ -168,6 +168,9 @@ opp-2592000000 { + }; + + &gpucc { ++ /* SA8295P and SA8540P doesn't provide gfx.lvl */ ++ /delete-property/ power-domains; ++ + status = "disabled"; + }; + +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sc8180x-add-missing-cpu-off-state.patch b/queue-6.7/arm64-dts-qcom-sc8180x-add-missing-cpu-off-state.patch new file mode 100644 index 00000000000..ba709ef7b27 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sc8180x-add-missing-cpu-off-state.patch @@ -0,0 +1,54 @@ +From c6a0876cf287b7c47d6378370c69e074b380c52b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Dec 2023 01:05:05 +0100 +Subject: arm64: dts: qcom: sc8180x: Add missing CPU off state + +From: Konrad Dybcio + +[ Upstream commit 07b600dfdfea65d58dd80ea25becd8cff69bfafc ] + +The CPUs can be powered off without pulling the plug from the rest of +the system. Describe the idle state responsible for this. + +Fixes: 8575f197b077 ("arm64: dts: qcom: Introduce the SC8180x platform") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20231230-topic-8180_more_fixes-v1-4-93b5c107ed43@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8180x.dtsi | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8180x.dtsi b/arch/arm64/boot/dts/qcom/sc8180x.dtsi +index f2eedbdc025c3..a7acaa8ca6055 100644 +--- a/arch/arm64/boot/dts/qcom/sc8180x.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8180x.dtsi +@@ -297,7 +297,15 @@ BIG_CPU_SLEEP_0: cpu-sleep-1-0 { + }; + + domain-idle-states { +- CLUSTER_SLEEP_0: cluster-sleep-0 { ++ CLUSTER_SLEEP_APSS_OFF: cluster-sleep-0 { ++ compatible = "domain-idle-state"; ++ arm,psci-suspend-param = <0x41000044>; ++ entry-latency-us = <3300>; ++ exit-latency-us = <3300>; ++ min-residency-us = <6000>; ++ }; ++ ++ CLUSTER_SLEEP_AOSS_SLEEP: cluster-sleep-1 { + compatible = "domain-idle-state"; + arm,psci-suspend-param = <0x4100a344>; + entry-latency-us = <3263>; +@@ -581,7 +589,7 @@ CPU_PD7: power-domain-cpu7 { + + CLUSTER_PD: power-domain-cpu-cluster0 { + #power-domain-cells = <0>; +- domain-idle-states = <&CLUSTER_SLEEP_0>; ++ domain-idle-states = <&CLUSTER_SLEEP_APSS_OFF &CLUSTER_SLEEP_AOSS_SLEEP>; + }; + }; + +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sc8180x-don-t-hold-mdp-core-clock-at-.patch b/queue-6.7/arm64-dts-qcom-sc8180x-don-t-hold-mdp-core-clock-at-.patch new file mode 100644 index 00000000000..9f0c5257f93 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sc8180x-don-t-hold-mdp-core-clock-at-.patch @@ -0,0 +1,40 @@ +From 2c7bb7762bdd6e54d38ed3eff56d1765af71b3c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Dec 2023 01:05:07 +0100 +Subject: arm64: dts: qcom: sc8180x: Don't hold MDP core clock at FMAX + +From: Konrad Dybcio + +[ Upstream commit 309b5774f45aafd002efdb2656673542419abd6f ] + +There's an OPP table to handle this, drop the permanent vote. + +Fixes: 494dec9b6f54 ("arm64: dts: qcom: sc8180x: Add display and gpu nodes") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20231230-topic-8180_more_fixes-v1-6-93b5c107ed43@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8180x.dtsi | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8180x.dtsi b/arch/arm64/boot/dts/qcom/sc8180x.dtsi +index df40157f2ec63..687efe3404ce5 100644 +--- a/arch/arm64/boot/dts/qcom/sc8180x.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8180x.dtsi +@@ -2723,10 +2723,8 @@ mdss_mdp: mdp@ae01000 { + "core", + "vsync"; + +- assigned-clocks = <&dispcc DISP_CC_MDSS_MDP_CLK>, +- <&dispcc DISP_CC_MDSS_VSYNC_CLK>; +- assigned-clock-rates = <460000000>, +- <19200000>; ++ assigned-clocks = <&dispcc DISP_CC_MDSS_VSYNC_CLK>; ++ assigned-clock-rates = <19200000>; + + operating-points-v2 = <&mdp_opp_table>; + power-domains = <&rpmhpd SC8180X_MMCX>; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sc8180x-fix-edp-phy-power-domains.patch b/queue-6.7/arm64-dts-qcom-sc8180x-fix-edp-phy-power-domains.patch new file mode 100644 index 00000000000..5eedc474890 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sc8180x-fix-edp-phy-power-domains.patch @@ -0,0 +1,37 @@ +From 901ab27766bc504e82fb5db8c7b479108f1d8c02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Dec 2023 01:05:06 +0100 +Subject: arm64: dts: qcom: sc8180x: Fix eDP PHY power-domains + +From: Konrad Dybcio + +[ Upstream commit 24e98cb3d5e2c86565680e00008a794b4eac0040 ] + +The (e)DP PHYs are powered by the MX line, not through the MDSS GDSC. +Fix that up. + +Fixes: 494dec9b6f54 ("arm64: dts: qcom: sc8180x: Add display and gpu nodes") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20231230-topic-8180_more_fixes-v1-5-93b5c107ed43@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8180x.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8180x.dtsi b/arch/arm64/boot/dts/qcom/sc8180x.dtsi +index a7acaa8ca6055..df40157f2ec63 100644 +--- a/arch/arm64/boot/dts/qcom/sc8180x.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8180x.dtsi +@@ -3186,7 +3186,7 @@ edp_phy: phy@aec2a00 { + <&dispcc DISP_CC_MDSS_AHB_CLK>; + clock-names = "aux", "cfg_ahb"; + +- power-domains = <&dispcc MDSS_GDSC>; ++ power-domains = <&rpmhpd SC8180X_MX>; + + #clock-cells = <1>; + #phy-cells = <0>; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sc8180x-fix-up-big-cpu-idle-state-ent.patch b/queue-6.7/arm64-dts-qcom-sc8180x-fix-up-big-cpu-idle-state-ent.patch new file mode 100644 index 00000000000..01476696bf0 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sc8180x-fix-up-big-cpu-idle-state-ent.patch @@ -0,0 +1,37 @@ +From 49cf1f5e0d6a8db181fc19b10c08f0b56564e15f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Dec 2023 01:05:04 +0100 +Subject: arm64: dts: qcom: sc8180x: Fix up big CPU idle state entry latency + +From: Konrad Dybcio + +[ Upstream commit 266a3a92044b89c392b3e9cfcc328d4167c18294 ] + +The entry latency was oddly low.. Turns out somebody forgot about a +second '1'! Fix it. + +Fixes: 8575f197b077 ("arm64: dts: qcom: Introduce the SC8180x platform") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20231230-topic-8180_more_fixes-v1-3-93b5c107ed43@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8180x.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8180x.dtsi b/arch/arm64/boot/dts/qcom/sc8180x.dtsi +index b1d9853419415..f2eedbdc025c3 100644 +--- a/arch/arm64/boot/dts/qcom/sc8180x.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8180x.dtsi +@@ -289,7 +289,7 @@ LITTLE_CPU_SLEEP_0: cpu-sleep-0-0 { + BIG_CPU_SLEEP_0: cpu-sleep-1-0 { + compatible = "arm,idle-state"; + arm,psci-suspend-param = <0x40000004>; +- entry-latency-us = <241>; ++ entry-latency-us = <2411>; + exit-latency-us = <1461>; + min-residency-us = <4488>; + local-timer-stop; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sc8180x-hook-up-vdd_cx-as-gcc-parent-.patch b/queue-6.7/arm64-dts-qcom-sc8180x-hook-up-vdd_cx-as-gcc-parent-.patch new file mode 100644 index 00000000000..af44fc8af06 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sc8180x-hook-up-vdd_cx-as-gcc-parent-.patch @@ -0,0 +1,36 @@ +From d625271e7730d4897e4f700b20e730729faebf6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Dec 2023 01:05:03 +0100 +Subject: arm64: dts: qcom: sc8180x: Hook up VDD_CX as GCC parent domain + +From: Konrad Dybcio + +[ Upstream commit 3c58b96df110a80e78fa36ef928f1e6c375008e3 ] + +Most of GCC is powered by the CX rail. Describe that relationship to +let the performance state requests trickle up the chain. + +Fixes: 8575f197b077 ("arm64: dts: qcom: Introduce the SC8180x platform") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20231230-topic-8180_more_fixes-v1-2-93b5c107ed43@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8180x.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/qcom/sc8180x.dtsi b/arch/arm64/boot/dts/qcom/sc8180x.dtsi +index b389d49d3ec8c..b1d9853419415 100644 +--- a/arch/arm64/boot/dts/qcom/sc8180x.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8180x.dtsi +@@ -781,6 +781,7 @@ gcc: clock-controller@100000 { + clock-names = "bi_tcxo", + "bi_tcxo_ao", + "sleep_clk"; ++ power-domains = <&rpmhpd SC8180X_CX>; + }; + + qupv3_id_0: geniqup@8c0000 { +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sc8180x-require-low_svs-vote-for-mmcx.patch b/queue-6.7/arm64-dts-qcom-sc8180x-require-low_svs-vote-for-mmcx.patch new file mode 100644 index 00000000000..d038446e3ea --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sc8180x-require-low_svs-vote-for-mmcx.patch @@ -0,0 +1,37 @@ +From d30388accdff2c6429893b3882465baabe8dd30f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Dec 2023 01:05:08 +0100 +Subject: arm64: dts: qcom: sc8180x: Require LOW_SVS vote for MMCX if DISPCC is + on + +From: Konrad Dybcio + +[ Upstream commit 6d9fb9e4c473cdfd2adca019b46d8e482105cae7 ] + +To ensure the PLLs are getting enough power, cast a vote with DISPCC so +that MMCX is at least at LOW_SVS. + +Fixes: 494dec9b6f54 ("arm64: dts: qcom: sc8180x: Add display and gpu nodes") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20231230-topic-8180_more_fixes-v1-7-93b5c107ed43@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8180x.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/qcom/sc8180x.dtsi b/arch/arm64/boot/dts/qcom/sc8180x.dtsi +index 687efe3404ce5..881b4e0d5b8b4 100644 +--- a/arch/arm64/boot/dts/qcom/sc8180x.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8180x.dtsi +@@ -3210,6 +3210,7 @@ dispcc: clock-controller@af00000 { + "edp_phy_pll_link_clk", + "edp_phy_pll_vco_div_clk"; + power-domains = <&rpmhpd SC8180X_MMCX>; ++ required-opps = <&rpmhpd_opp_low_svs>; + #clock-cells = <1>; + #reset-cells = <1>; + #power-domain-cells = <1>; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sc8180x-shrink-aoss_qmp-register-spac.patch b/queue-6.7/arm64-dts-qcom-sc8180x-shrink-aoss_qmp-register-spac.patch new file mode 100644 index 00000000000..d894dae9f9c --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sc8180x-shrink-aoss_qmp-register-spac.patch @@ -0,0 +1,37 @@ +From 37b87cce843d073ceee68273f7645300b3619d46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Dec 2023 01:05:10 +0100 +Subject: arm64: dts: qcom: sc8180x: Shrink aoss_qmp register space size + +From: Konrad Dybcio + +[ Upstream commit dcad0590d1ea4278a55c30dd2903611a96111601 ] + +The AOSS_QMP region is overallocated, bleeding into space that's supposed +to be used by other peripherals. Fix it. + +Fixes: 8575f197b077 ("arm64: dts: qcom: Introduce the SC8180x platform") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20231230-topic-8180_more_fixes-v1-9-93b5c107ed43@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8180x.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8180x.dtsi b/arch/arm64/boot/dts/qcom/sc8180x.dtsi +index 881b4e0d5b8b4..6760f6a340975 100644 +--- a/arch/arm64/boot/dts/qcom/sc8180x.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8180x.dtsi +@@ -3249,7 +3249,7 @@ tsens1: thermal-sensor@c265000 { + + aoss_qmp: power-controller@c300000 { + compatible = "qcom,sc8180x-aoss-qmp", "qcom,aoss-qmp"; +- reg = <0x0 0x0c300000 0x0 0x100000>; ++ reg = <0x0 0x0c300000 0x0 0x400>; + interrupts = ; + mboxes = <&apss_shared 0>; + +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sc8280xp-fix-ufs-phy-clocks.patch b/queue-6.7/arm64-dts-qcom-sc8280xp-fix-ufs-phy-clocks.patch new file mode 100644 index 00000000000..3f48de1cdb6 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sc8280xp-fix-ufs-phy-clocks.patch @@ -0,0 +1,63 @@ +From f96256045c7e5939008f0f7182934c2443150014 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 12:37:37 +0530 +Subject: arm64: dts: qcom: sc8280xp: Fix UFS PHY clocks + +From: Manivannan Sadhasivam + +[ Upstream commit 1d4ef9644e219202ed89ac42f3e1defebcab9c7d ] + +QMP PHY used in SC8280XP requires 3 clocks: + +* ref - 19.2MHz reference clock from RPMh +* ref_aux - Auxiliary reference clock from GCC +* qref - QREF clock from GCC + +Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") +Signed-off-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-14-58a49d2f4605@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +index b8081513176ac..8732a510245c8 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +@@ -2256,9 +2256,12 @@ ufs_mem_phy: phy@1d87000 { + compatible = "qcom,sc8280xp-qmp-ufs-phy"; + reg = <0 0x01d87000 0 0x1000>; + +- clocks = <&gcc GCC_UFS_CARD_CLKREF_CLK>, +- <&gcc GCC_UFS_PHY_PHY_AUX_CLK>; +- clock-names = "ref", "ref_aux"; ++ clocks = <&rpmhcc RPMH_CXO_CLK>, ++ <&gcc GCC_UFS_PHY_PHY_AUX_CLK>, ++ <&gcc GCC_UFS_CARD_CLKREF_CLK>; ++ clock-names = "ref", ++ "ref_aux", ++ "qref"; + + power-domains = <&gcc UFS_PHY_GDSC>; + +@@ -2318,9 +2321,12 @@ ufs_card_phy: phy@1da7000 { + compatible = "qcom,sc8280xp-qmp-ufs-phy"; + reg = <0 0x01da7000 0 0x1000>; + +- clocks = <&gcc GCC_UFS_1_CARD_CLKREF_CLK>, +- <&gcc GCC_UFS_CARD_PHY_AUX_CLK>; +- clock-names = "ref", "ref_aux"; ++ clocks = <&rpmhcc RPMH_CXO_CLK>, ++ <&gcc GCC_UFS_CARD_PHY_AUX_CLK>, ++ <&gcc GCC_UFS_1_CARD_CLKREF_CLK>; ++ clock-names = "ref", ++ "ref_aux", ++ "qref"; + + power-domains = <&gcc UFS_CARD_GDSC>; + +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sdm845-db845c-correct-pcie-wake-gpios.patch b/queue-6.7/arm64-dts-qcom-sdm845-db845c-correct-pcie-wake-gpios.patch new file mode 100644 index 00000000000..ba999e89046 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sdm845-db845c-correct-pcie-wake-gpios.patch @@ -0,0 +1,40 @@ +From 1d8d77c29cdc6a3f1a102e3abea129c2bd8cda56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jan 2024 14:12:15 +0100 +Subject: arm64: dts: qcom: sdm845-db845c: correct PCIe wake-gpios + +From: Krzysztof Kozlowski + +[ Upstream commit 584a327c5cffc36369b2a8953d9448826240f1ac ] + +Bindings allow a "wake", not "enable", GPIO. Schematics also use WAKE +name for the pin: + + sdm845-db845c.dtb: pcie@1c00000: Unevaluated properties are not allowed ('enable-gpio' was unexpected) + +Fixes: 4a657c264b78 ("arm64: dts: qcom: db845c: Enable PCIe controllers") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240108131216.53867-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts +index 7e7bf3fb3be63..0a891a0122446 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts ++++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts +@@ -580,7 +580,7 @@ &mss_pil { + &pcie0 { + status = "okay"; + perst-gpios = <&tlmm 35 GPIO_ACTIVE_LOW>; +- enable-gpio = <&tlmm 134 GPIO_ACTIVE_HIGH>; ++ wake-gpios = <&tlmm 134 GPIO_ACTIVE_HIGH>; + + vddpe-3v3-supply = <&pcie0_3p3v_dual>; + +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sdm845-fix-ufs-phy-clocks.patch b/queue-6.7/arm64-dts-qcom-sdm845-fix-ufs-phy-clocks.patch new file mode 100644 index 00000000000..3e48de268c3 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sdm845-fix-ufs-phy-clocks.patch @@ -0,0 +1,51 @@ +From 99f9513ffb6899563d12a59c3abe28ee977d2cf4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 12:37:30 +0530 +Subject: arm64: dts: qcom: sdm845: Fix UFS PHY clocks + +From: Manivannan Sadhasivam + +[ Upstream commit ca8fb2bd2248ae05890c011d691ba5d4a1e7d8d6 ] + +QMP PHY used in SDM845 requires 3 clocks: + +* ref - 19.2MHz reference clock from RPMh +* ref_aux - Auxiliary reference clock from GCC +* qref - QREF clock from GCC + +While at it, let's move 'clocks' property before 'clock-names' to match +the style used commonly. + +Fixes: cc16687fbd74 ("arm64: dts: qcom: sdm845: add UFS controller") +Reviewed-by: Konrad Dybcio +Signed-off-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-7-58a49d2f4605@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845.dtsi | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index 4d1396325f667..5fda325e4f45e 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -2617,10 +2617,12 @@ ufs_mem_phy: phy@1d87000 { + compatible = "qcom,sdm845-qmp-ufs-phy"; + reg = <0 0x01d87000 0 0x1000>; + ++ clocks = <&rpmhcc RPMH_CXO_CLK>, ++ <&gcc GCC_UFS_PHY_PHY_AUX_CLK>, ++ <&gcc GCC_UFS_MEM_CLKREF_CLK>; + clock-names = "ref", +- "ref_aux"; +- clocks = <&gcc GCC_UFS_MEM_CLKREF_CLK>, +- <&gcc GCC_UFS_PHY_PHY_AUX_CLK>; ++ "ref_aux", ++ "qref"; + + resets = <&ufs_mem_hc 0>; + reset-names = "ufsphy"; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sdm845-oneplus-common-improve-dai-nod.patch b/queue-6.7/arm64-dts-qcom-sdm845-oneplus-common-improve-dai-nod.patch new file mode 100644 index 00000000000..ae40e325bc1 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sdm845-oneplus-common-improve-dai-nod.patch @@ -0,0 +1,54 @@ +From 0c5ecc51f01aede7f002d17f50c6c98099ecf2d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Dec 2023 21:02:33 +0100 +Subject: arm64: dts: qcom: sdm845-oneplus-common: improve DAI node naming + +From: David Heidelberg + +[ Upstream commit afe9867a0c0e10ba618c15d4ef6f8699872f6cc3 ] + +Make it easier to understand what the reg in those nodes is by using the +constants provided by qcom,q6dsp-lpass-ports.h. + +Name nodes according to dt-binding expectations. + +Fix for +``` +arch/arm64/boot/dts/qcom/sdm845-oneplus-enchilada.dtb: service@4: dais: Unevaluated properties are not allowed ('qi2s@22', 'qi2s@23' were unexpected) +``` + +Fixes: b7b734286856 ("arm64: dts: qcom: sdm845-oneplus-*: add audio devices") +Signed-off-by: David Heidelberg +Reviewed-by: Luca Weiss +Link: https://lore.kernel.org/r/20231229200245.259689-1-david@ixit.cz +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi +index b523b5fff7022..13d7e088aa2e1 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi +@@ -485,13 +485,13 @@ &pmi8998_charger { + }; + + &q6afedai { +- qi2s@22 { +- reg = <22>; ++ dai@22 { ++ reg = ; + qcom,sd-lines = <1>; + }; + +- qi2s@23 { +- reg = <23>; ++ dai@23 { ++ reg = ; + qcom,sd-lines = <0>; + }; + }; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sdm845-switch-ufs-qmp-phy-to-new-styl.patch b/queue-6.7/arm64-dts-qcom-sdm845-switch-ufs-qmp-phy-to-new-styl.patch new file mode 100644 index 00000000000..6b5ec652adc --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sdm845-switch-ufs-qmp-phy-to-new-styl.patch @@ -0,0 +1,70 @@ +From d4983beb17858ade407d64a0d3ea23793d76df74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 06:25:46 +0300 +Subject: arm64: dts: qcom: sdm845: switch UFS QMP PHY to new style of bindings + +From: Dmitry Baryshkov + +[ Upstream commit 760baba5e79bae651c59df89d441fad2bd0be4a5 ] + +Change the UFS QMP PHY to use newer style of QMP PHY bindings (single +resource region, no per-PHY subnodes). + +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20231205032552.1583336-4-dmitry.baryshkov@linaro.org +Signed-off-by: Bjorn Andersson +Stable-dep-of: ca8fb2bd2248 ("arm64: dts: qcom: sdm845: Fix UFS PHY clocks") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845.dtsi | 19 +++++-------------- + 1 file changed, 5 insertions(+), 14 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index 9e594d21ecd80..4d1396325f667 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -2565,7 +2565,7 @@ ufs_mem_hc: ufshc@1d84000 { + <0 0x01d90000 0 0x8000>; + reg-names = "std", "ice"; + interrupts = ; +- phys = <&ufs_mem_phy_lanes>; ++ phys = <&ufs_mem_phy>; + phy-names = "ufsphy"; + lanes-per-direction = <2>; + power-domains = <&gcc UFS_PHY_GDSC>; +@@ -2615,10 +2615,8 @@ ufs_mem_hc: ufshc@1d84000 { + + ufs_mem_phy: phy@1d87000 { + compatible = "qcom,sdm845-qmp-ufs-phy"; +- reg = <0 0x01d87000 0 0x18c>; +- #address-cells = <2>; +- #size-cells = <2>; +- ranges; ++ reg = <0 0x01d87000 0 0x1000>; ++ + clock-names = "ref", + "ref_aux"; + clocks = <&gcc GCC_UFS_MEM_CLKREF_CLK>, +@@ -2626,16 +2624,9 @@ ufs_mem_phy: phy@1d87000 { + + resets = <&ufs_mem_hc 0>; + reset-names = "ufsphy"; +- status = "disabled"; + +- ufs_mem_phy_lanes: phy@1d87400 { +- reg = <0 0x01d87400 0 0x108>, +- <0 0x01d87600 0 0x1e0>, +- <0 0x01d87c00 0 0x1dc>, +- <0 0x01d87800 0 0x108>, +- <0 0x01d87a00 0 0x1e0>; +- #phy-cells = <0>; +- }; ++ #phy-cells = <0>; ++ status = "disabled"; + }; + + cryptobam: dma-controller@1dc4000 { +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sdm845-use-the-low-power-island-cx-mx.patch b/queue-6.7/arm64-dts-qcom-sdm845-use-the-low-power-island-cx-mx.patch new file mode 100644 index 00000000000..4cae427e990 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sdm845-use-the-low-power-island-cx-mx.patch @@ -0,0 +1,39 @@ +From e71c18e8dc2051138ce6025d3b8c05409c03b5c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Dec 2023 15:15:11 +0100 +Subject: arm64: dts: qcom: sdm845: Use the Low Power Island CX/MX for SLPI + +From: Konrad Dybcio + +[ Upstream commit 5dd227ccfb9568935bdaf82bc1893b36457dd4d3 ] + +The SLPI is powered by the Low Power Island power rails. Fix the incorrect +assignment. + +Fixes: 74588aada59a ("arm64: dts: qcom: sdm845: add SLPI remoteproc") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20231220-topic-sdm845_slpi_lcxmx-v1-1-db7c72ef99ae@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index 5fda325e4f45e..0a752fb190cdd 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -3346,8 +3346,8 @@ slpi_pas: remoteproc@5c00000 { + + qcom,qmp = <&aoss_qmp>; + +- power-domains = <&rpmhpd SDM845_CX>, +- <&rpmhpd SDM845_MX>; ++ power-domains = <&rpmhpd SDM845_LCX>, ++ <&rpmhpd SDM845_LMX>; + power-domain-names = "lcx", "lmx"; + + memory-region = <&slpi_mem>; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sm6115-declare-vls-clamp-register-for.patch b/queue-6.7/arm64-dts-qcom-sm6115-declare-vls-clamp-register-for.patch new file mode 100644 index 00000000000..411699c6588 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sm6115-declare-vls-clamp-register-for.patch @@ -0,0 +1,51 @@ +From e91a41f16e6c14ff23d0ee42bfbb21936096bd30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jan 2024 16:04:27 +0200 +Subject: arm64: dts: qcom: sm6115: declare VLS CLAMP register for USB3 PHY + +From: Dmitry Baryshkov + +[ Upstream commit 95d739ed962c9aaa17d77b739606dbdf31879f6e ] + +The USB3 PHY on the SM6115 platform doesn't have built-in +PCS_MISC_CLAMP_ENABLE register. Instead clamping is handled separately +via the register in the TCSR space. Declare corresponding register. + +Fixes: 9dd5f6dba729 ("arm64: dts: qcom: sm6115: Add USB SS qmp phy node") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240117-usbc-phy-vls-clamp-v2-6-a950c223f10f@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm6115.dtsi | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm6115.dtsi b/arch/arm64/boot/dts/qcom/sm6115.dtsi +index 839c603512403..87cbc4e8b1ed5 100644 +--- a/arch/arm64/boot/dts/qcom/sm6115.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm6115.dtsi +@@ -591,6 +591,11 @@ tcsr_mutex: hwlock@340000 { + #hwlock-cells = <1>; + }; + ++ tcsr_regs: syscon@3c0000 { ++ compatible = "qcom,sm6115-tcsr", "syscon"; ++ reg = <0x0 0x003c0000 0x0 0x40000>; ++ }; ++ + tlmm: pinctrl@500000 { + compatible = "qcom,sm6115-tlmm"; + reg = <0x0 0x00500000 0x0 0x400000>, +@@ -856,6 +861,8 @@ usb_qmpphy: phy@1615000 { + + #phy-cells = <0>; + ++ qcom,tcsr-reg = <&tcsr_regs 0xb244>; ++ + status = "disabled"; + }; + +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sm6115-fix-ufs-phy-clocks.patch b/queue-6.7/arm64-dts-qcom-sm6115-fix-ufs-phy-clocks.patch new file mode 100644 index 00000000000..fbf77efc588 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sm6115-fix-ufs-phy-clocks.patch @@ -0,0 +1,47 @@ +From 56accb7a1df77daabd2beeac8ede4469d30d784b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 12:37:31 +0530 +Subject: arm64: dts: qcom: sm6115: Fix UFS PHY clocks + +From: Manivannan Sadhasivam + +[ Upstream commit a820a285ef1b7c7fd94055bbb114c0413c04b96b ] + +QMP PHY used in SM6115 requires 3 clocks: + +* ref - 19.2MHz reference clock from RPM +* ref_aux - Auxiliary reference clock from GCC +* qref - QREF clock from GCC + +Fixes: 97e563bf5ba1 ("arm64: dts: qcom: sm6115: Add basic soc dtsi") +Reviewed-by: Konrad Dybcio +Signed-off-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-8-58a49d2f4605@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm6115.dtsi | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm6115.dtsi b/arch/arm64/boot/dts/qcom/sm6115.dtsi +index 87cbc4e8b1ed5..442c821fc18d9 100644 +--- a/arch/arm64/boot/dts/qcom/sm6115.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm6115.dtsi +@@ -1040,8 +1040,12 @@ ufs_mem_phy: phy@4807000 { + #size-cells = <2>; + ranges; + +- clocks = <&gcc GCC_UFS_CLKREF_CLK>, <&gcc GCC_UFS_PHY_PHY_AUX_CLK>; +- clock-names = "ref", "ref_aux"; ++ clocks = <&rpmcc RPM_SMD_XO_CLK_SRC>, ++ <&gcc GCC_UFS_PHY_PHY_AUX_CLK>, ++ <&gcc GCC_UFS_CLKREF_CLK>; ++ clock-names = "ref", ++ "ref_aux", ++ "qref"; + + resets = <&ufs_mem_hc 0>; + reset-names = "ufsphy"; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sm6125-fix-ufs-phy-clocks.patch b/queue-6.7/arm64-dts-qcom-sm6125-fix-ufs-phy-clocks.patch new file mode 100644 index 00000000000..e921d28d284 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sm6125-fix-ufs-phy-clocks.patch @@ -0,0 +1,48 @@ +From a42ba778589dc025570fa4ef0183c51a9b4d4601 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 12:37:32 +0530 +Subject: arm64: dts: qcom: sm6125: Fix UFS PHY clocks + +From: Manivannan Sadhasivam + +[ Upstream commit 3823a877f25baa152e34325818d5140990d6464f ] + +QMP PHY used in SM6125 requires 3 clocks: + +* ref - 19.2MHz reference clock from RPM +* ref_aux - Auxiliary reference clock from GCC +* qref - QREF clock from GCC + +Fixes: f8399e8a2f80 ("arm64: dts: qcom: sm6125: Add UFS nodes") +Reviewed-by: Konrad Dybcio +Signed-off-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-9-58a49d2f4605@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm6125.dtsi | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm6125.dtsi b/arch/arm64/boot/dts/qcom/sm6125.dtsi +index 1dd3a4056e26f..e180f7c6e8c93 100644 +--- a/arch/arm64/boot/dts/qcom/sm6125.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm6125.dtsi +@@ -812,10 +812,12 @@ ufs_mem_phy: phy@4807000 { + compatible = "qcom,sm6125-qmp-ufs-phy"; + reg = <0x04807000 0xdb8>; + +- clocks = <&gcc GCC_UFS_MEM_CLKREF_CLK>, +- <&gcc GCC_UFS_PHY_PHY_AUX_CLK>; ++ clocks = <&rpmcc RPM_SMD_XO_CLK_SRC>, ++ <&gcc GCC_UFS_PHY_PHY_AUX_CLK>, ++ <&gcc GCC_UFS_MEM_CLKREF_CLK>; + clock-names = "ref", +- "ref_aux"; ++ "ref_aux", ++ "qref"; + + resets = <&ufs_mem_hc 0>; + reset-names = "ufsphy"; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sm6350-fix-ufs-phy-clocks.patch b/queue-6.7/arm64-dts-qcom-sm6350-fix-ufs-phy-clocks.patch new file mode 100644 index 00000000000..4de31a9cff2 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sm6350-fix-ufs-phy-clocks.patch @@ -0,0 +1,51 @@ +From 9e7c8b5309b638f26a0bec52d90d15f81d2b7326 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 12:37:33 +0530 +Subject: arm64: dts: qcom: sm6350: Fix UFS PHY clocks + +From: Manivannan Sadhasivam + +[ Upstream commit 68f9fcba3a0c015d649907805534fe66c9c60865 ] + +QMP PHY used in SM6350 requires 3 clocks: + +* ref - 19.2MHz reference clock from RPMh +* ref_aux - Auxiliary reference clock from GCC +* qref - QREF clock from GCC + +While at it, let's move 'clocks' property before 'clock-names' to match +the style used commonly. + +Fixes: 5a814af5fc22 ("arm64: dts: qcom: sm6350: Add UFS nodes") +Reviewed-by: Konrad Dybcio +Signed-off-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-10-58a49d2f4605@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm6350.dtsi | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm6350.dtsi b/arch/arm64/boot/dts/qcom/sm6350.dtsi +index 6464e144c228c..6eb2e4bfff4c6 100644 +--- a/arch/arm64/boot/dts/qcom/sm6350.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm6350.dtsi +@@ -1192,10 +1192,12 @@ ufs_mem_phy: phy@1d87000 { + #size-cells = <2>; + ranges; + ++ clocks = <&rpmhcc RPMH_CXO_CLK>, ++ <&gcc GCC_UFS_PHY_PHY_AUX_CLK>, ++ <&gcc GCC_UFS_MEM_CLKREF_CLK>; + clock-names = "ref", +- "ref_aux"; +- clocks = <&gcc GCC_UFS_MEM_CLKREF_CLK>, +- <&gcc GCC_UFS_PHY_PHY_AUX_CLK>; ++ "ref_aux", ++ "qref"; + + resets = <&ufs_mem_hc 0>; + reset-names = "ufsphy"; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sm8150-correct-pcie-wake-gpios.patch b/queue-6.7/arm64-dts-qcom-sm8150-correct-pcie-wake-gpios.patch new file mode 100644 index 00000000000..2d7d3e31c71 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sm8150-correct-pcie-wake-gpios.patch @@ -0,0 +1,40 @@ +From e4f3a261a87ac03029d20ba434b0e7400caab5fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jan 2024 14:12:16 +0100 +Subject: arm64: dts: qcom: sm8150: correct PCIe wake-gpios + +From: Krzysztof Kozlowski + +[ Upstream commit 7c38989d0f7a35c83e7c4781271d42662903fa8d ] + +Bindings allow a "wake", not "enable", GPIO. Schematics also use WAKE +name for the pin: + + sa8155p-adp.dtb: pcie@1c00000: Unevaluated properties are not allowed ('enable-gpio' was unexpected) + +Fixes: a1c86c680533 ("arm64: dts: qcom: sm8150: Add PCIe nodes") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240108131216.53867-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8150.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi +index 151bb3443db92..cb874a8dd0d86 100644 +--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi +@@ -1879,7 +1879,7 @@ pcie0: pci@1c00000 { + phy-names = "pciephy"; + + perst-gpios = <&tlmm 35 GPIO_ACTIVE_HIGH>; +- enable-gpio = <&tlmm 37 GPIO_ACTIVE_HIGH>; ++ wake-gpios = <&tlmm 37 GPIO_ACTIVE_HIGH>; + + pinctrl-names = "default"; + pinctrl-0 = <&pcie0_default_state>; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sm8150-fix-ufs-phy-clocks.patch b/queue-6.7/arm64-dts-qcom-sm8150-fix-ufs-phy-clocks.patch new file mode 100644 index 00000000000..5b3939d5004 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sm8150-fix-ufs-phy-clocks.patch @@ -0,0 +1,51 @@ +From 134b74164af059eef227434375ffd59a6c72f4f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 12:37:34 +0530 +Subject: arm64: dts: qcom: sm8150: Fix UFS PHY clocks + +From: Manivannan Sadhasivam + +[ Upstream commit eff7496b72810ca54da8c9c4542bf2aca479dd44 ] + +QMP PHY used in SM8150 requires 3 clocks: + +* ref - 19.2MHz reference clock from RPMh +* ref_aux - Auxiliary reference clock from GCC +* qref - QREF clock from GCC + +While at it, let's move 'clocks' property before 'clock-names' to match +the style used commonly. + +Fixes: 3834a2e92229 ("arm64: dts: qcom: sm8150: Add ufs nodes") +Reviewed-by: Konrad Dybcio +Signed-off-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-11-58a49d2f4605@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8150.dtsi | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi +index 7a57acbe19acc..22854d5036214 100644 +--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi +@@ -2063,10 +2063,12 @@ ufs_mem_phy: phy@1d87000 { + compatible = "qcom,sm8150-qmp-ufs-phy"; + reg = <0 0x01d87000 0 0x1000>; + ++ clocks = <&rpmhcc RPMH_CXO_CLK>, ++ <&gcc GCC_UFS_PHY_PHY_AUX_CLK>, ++ <&gcc GCC_UFS_MEM_CLKREF_CLK>; + clock-names = "ref", +- "ref_aux"; +- clocks = <&gcc GCC_UFS_MEM_CLKREF_CLK>, +- <&gcc GCC_UFS_PHY_PHY_AUX_CLK>; ++ "ref_aux", ++ "qref"; + + power-domains = <&gcc UFS_PHY_GDSC>; + +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sm8150-switch-ufs-qmp-phy-to-new-styl.patch b/queue-6.7/arm64-dts-qcom-sm8150-switch-ufs-qmp-phy-to-new-styl.patch new file mode 100644 index 00000000000..ad57439a77c --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sm8150-switch-ufs-qmp-phy-to-new-styl.patch @@ -0,0 +1,71 @@ +From 4c280e4f98c4bf62ab7eb0a003d4949fdd6c311a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 06:25:49 +0300 +Subject: arm64: dts: qcom: sm8150: switch UFS QMP PHY to new style of bindings + +From: Dmitry Baryshkov + +[ Upstream commit 935c76f7f85912962d72eceabdfa2c38c4c07f02 ] + +Change the UFS QMP PHY to use newer style of QMP PHY bindings (single +resource region, no per-PHY subnodes). + +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20231205032552.1583336-7-dmitry.baryshkov@linaro.org +Signed-off-by: Bjorn Andersson +Stable-dep-of: eff7496b7281 ("arm64: dts: qcom: sm8150: Fix UFS PHY clocks") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8150.dtsi | 20 ++++++-------------- + 1 file changed, 6 insertions(+), 14 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi +index 3221478663ac6..7a57acbe19acc 100644 +--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi +@@ -2016,7 +2016,7 @@ ufs_mem_hc: ufshc@1d84000 { + <0 0x01d90000 0 0x8000>; + reg-names = "std", "ice"; + interrupts = ; +- phys = <&ufs_mem_phy_lanes>; ++ phys = <&ufs_mem_phy>; + phy-names = "ufsphy"; + lanes-per-direction = <2>; + #reset-cells = <1>; +@@ -2061,10 +2061,8 @@ ufs_mem_hc: ufshc@1d84000 { + + ufs_mem_phy: phy@1d87000 { + compatible = "qcom,sm8150-qmp-ufs-phy"; +- reg = <0 0x01d87000 0 0x1c0>; +- #address-cells = <2>; +- #size-cells = <2>; +- ranges; ++ reg = <0 0x01d87000 0 0x1000>; ++ + clock-names = "ref", + "ref_aux"; + clocks = <&gcc GCC_UFS_MEM_CLKREF_CLK>, +@@ -2074,16 +2072,10 @@ ufs_mem_phy: phy@1d87000 { + + resets = <&ufs_mem_hc 0>; + reset-names = "ufsphy"; +- status = "disabled"; + +- ufs_mem_phy_lanes: phy@1d87400 { +- reg = <0 0x01d87400 0 0x16c>, +- <0 0x01d87600 0 0x200>, +- <0 0x01d87c00 0 0x200>, +- <0 0x01d87800 0 0x16c>, +- <0 0x01d87a00 0 0x200>; +- #phy-cells = <0>; +- }; ++ #phy-cells = <0>; ++ ++ status = "disabled"; + }; + + cryptobam: dma-controller@1dc4000 { +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sm8150-use-gpios-suffix-for-pci-gpios.patch b/queue-6.7/arm64-dts-qcom-sm8150-use-gpios-suffix-for-pci-gpios.patch new file mode 100644 index 00000000000..c8c720dee6b --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sm8150-use-gpios-suffix-for-pci-gpios.patch @@ -0,0 +1,48 @@ +From e8944772ea9e58897bd594c9e47324fc4cd0fb5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Nov 2023 17:42:26 +0100 +Subject: arm64: dts: qcom: sm8150: use 'gpios' suffix for PCI GPIOs + +From: Krzysztof Kozlowski + +[ Upstream commit af6f6778d34cb40e60368e288767f674cc0c5f60 ] + +Linux handles both versions, but bindings expect GPIO properties to +have 'gpios' suffix instead of 'gpio': + + sa8155p-adp.dtb: pci@1c00000: Unevaluated properties are not allowed ('perst-gpio' was unexpected) + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20231111164229.63803-3-krzysztof.kozlowski@linaro.org +Signed-off-by: Bjorn Andersson +Stable-dep-of: 7c38989d0f7a ("arm64: dts: qcom: sm8150: correct PCIe wake-gpios") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8150.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi +index 22854d5036214..151bb3443db92 100644 +--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi +@@ -1878,7 +1878,7 @@ pcie0: pci@1c00000 { + phys = <&pcie0_phy>; + phy-names = "pciephy"; + +- perst-gpio = <&tlmm 35 GPIO_ACTIVE_HIGH>; ++ perst-gpios = <&tlmm 35 GPIO_ACTIVE_HIGH>; + enable-gpio = <&tlmm 37 GPIO_ACTIVE_HIGH>; + + pinctrl-names = "default"; +@@ -1972,7 +1972,7 @@ pcie1: pci@1c08000 { + phys = <&pcie1_phy>; + phy-names = "pciephy"; + +- perst-gpio = <&tlmm 102 GPIO_ACTIVE_HIGH>; ++ perst-gpios = <&tlmm 102 GPIO_ACTIVE_HIGH>; + enable-gpio = <&tlmm 104 GPIO_ACTIVE_HIGH>; + + pinctrl-names = "default"; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sm8250-fix-ufs-phy-clocks.patch b/queue-6.7/arm64-dts-qcom-sm8250-fix-ufs-phy-clocks.patch new file mode 100644 index 00000000000..2a93a52a19a --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sm8250-fix-ufs-phy-clocks.patch @@ -0,0 +1,51 @@ +From ebf5cb746b99e61f1745cb7f808ee4590faebb3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 12:37:35 +0530 +Subject: arm64: dts: qcom: sm8250: Fix UFS PHY clocks + +From: Manivannan Sadhasivam + +[ Upstream commit 55ee02b10bdd9577b6eabe98ebb383ec4e0674a7 ] + +QMP PHY used in SM8250 requires 3 clocks: + +* ref - 19.2MHz reference clock from RPMh +* ref_aux - Auxiliary reference clock from GCC +* qref - QREF clock from GCC + +While at it, let's move 'clocks' property before 'clock-names' to match +the style used commonly. + +Fixes: b7e2fba06622 ("arm64: dts: qcom: sm8250: Add UFS controller and PHY") +Reviewed-by: Konrad Dybcio +Signed-off-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-12-58a49d2f4605@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8250.dtsi | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi +index ed111145afd2d..8e10f2a920186 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi +@@ -2484,10 +2484,12 @@ ufs_mem_phy: phy@1d87000 { + compatible = "qcom,sm8250-qmp-ufs-phy"; + reg = <0 0x01d87000 0 0x1000>; + +- clock-names = "ref", +- "ref_aux"; + clocks = <&rpmhcc RPMH_CXO_CLK>, +- <&gcc GCC_UFS_PHY_PHY_AUX_CLK>; ++ <&gcc GCC_UFS_PHY_PHY_AUX_CLK>, ++ <&gcc GCC_UFS_1X_CLKREF_EN>; ++ clock-names = "ref", ++ "ref_aux", ++ "qref"; + + resets = <&ufs_mem_hc 0>; + reset-names = "ufsphy"; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sm8250-switch-ufs-qmp-phy-to-new-styl.patch b/queue-6.7/arm64-dts-qcom-sm8250-switch-ufs-qmp-phy-to-new-styl.patch new file mode 100644 index 00000000000..58a35d7b77f --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sm8250-switch-ufs-qmp-phy-to-new-styl.patch @@ -0,0 +1,71 @@ +From f45fde3c1e9af3b39f2868fabe543f7214796743 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 06:25:50 +0300 +Subject: arm64: dts: qcom: sm8250: switch UFS QMP PHY to new style of bindings + +From: Dmitry Baryshkov + +[ Upstream commit ba865bdcc688932980b8e5ec2154eaa33cd4a981 ] + +Change the UFS QMP PHY to use newer style of QMP PHY bindings (single +resource region, no per-PHY subnodes). + +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20231205032552.1583336-8-dmitry.baryshkov@linaro.org +Signed-off-by: Bjorn Andersson +Stable-dep-of: 55ee02b10bdd ("arm64: dts: qcom: sm8250: Fix UFS PHY clocks") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8250.dtsi | 20 ++++++-------------- + 1 file changed, 6 insertions(+), 14 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi +index d59a99ca872c0..ed111145afd2d 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi +@@ -2434,7 +2434,7 @@ ufs_mem_hc: ufshc@1d84000 { + "jedec,ufs-2.0"; + reg = <0 0x01d84000 0 0x3000>; + interrupts = ; +- phys = <&ufs_mem_phy_lanes>; ++ phys = <&ufs_mem_phy>; + phy-names = "ufsphy"; + lanes-per-direction = <2>; + #reset-cells = <1>; +@@ -2482,10 +2482,8 @@ ufs_mem_hc: ufshc@1d84000 { + + ufs_mem_phy: phy@1d87000 { + compatible = "qcom,sm8250-qmp-ufs-phy"; +- reg = <0 0x01d87000 0 0x1c0>; +- #address-cells = <2>; +- #size-cells = <2>; +- ranges; ++ reg = <0 0x01d87000 0 0x1000>; ++ + clock-names = "ref", + "ref_aux"; + clocks = <&rpmhcc RPMH_CXO_CLK>, +@@ -2493,16 +2491,10 @@ ufs_mem_phy: phy@1d87000 { + + resets = <&ufs_mem_hc 0>; + reset-names = "ufsphy"; +- status = "disabled"; + +- ufs_mem_phy_lanes: phy@1d87400 { +- reg = <0 0x01d87400 0 0x16c>, +- <0 0x01d87600 0 0x200>, +- <0 0x01d87c00 0 0x200>, +- <0 0x01d87800 0 0x16c>, +- <0 0x01d87a00 0 0x200>; +- #phy-cells = <0>; +- }; ++ #phy-cells = <0>; ++ ++ status = "disabled"; + }; + + cryptobam: dma-controller@1dc4000 { +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sm8350-fix-ufs-phy-clocks.patch b/queue-6.7/arm64-dts-qcom-sm8350-fix-ufs-phy-clocks.patch new file mode 100644 index 00000000000..f58644e9baf --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sm8350-fix-ufs-phy-clocks.patch @@ -0,0 +1,51 @@ +From e772a8fd2ceb78401760fc154997ca7ee1afafbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 12:37:38 +0530 +Subject: arm64: dts: qcom: sm8350: Fix UFS PHY clocks + +From: Manivannan Sadhasivam + +[ Upstream commit 8edbdefee1c9eb24690d5794556af08f00ecc576 ] + +QMP PHY used in SM8350 requires 3 clocks: + +* ref - 19.2MHz reference clock from RPMh +* ref_aux - Auxiliary reference clock from GCC +* qref - QREF clock from GCC + +While at it, let's move 'clocks' property before 'clock-names' to match +the style used commonly. + +Fixes: 59c7cf814783 ("arm64: dts: qcom: sm8350: Add UFS nodes") +Reviewed-by: Konrad Dybcio +Signed-off-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-15-58a49d2f4605@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8350.dtsi | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi +index 19172ed7ec2be..4ad4cefa0b75f 100644 +--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi +@@ -1725,10 +1725,12 @@ ufs_mem_phy: phy@1d87000 { + compatible = "qcom,sm8350-qmp-ufs-phy"; + reg = <0 0x01d87000 0 0x1000>; + +- clock-names = "ref", +- "ref_aux"; + clocks = <&rpmhcc RPMH_CXO_CLK>, +- <&gcc GCC_UFS_PHY_PHY_AUX_CLK>; ++ <&gcc GCC_UFS_PHY_PHY_AUX_CLK>, ++ <&gcc GCC_UFS_1_CLKREF_EN>; ++ clock-names = "ref", ++ "ref_aux", ++ "qref"; + + resets = <&ufs_mem_hc 0>; + reset-names = "ufsphy"; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sm8350-switch-ufs-qmp-phy-to-new-styl.patch b/queue-6.7/arm64-dts-qcom-sm8350-switch-ufs-qmp-phy-to-new-styl.patch new file mode 100644 index 00000000000..c57a4063899 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sm8350-switch-ufs-qmp-phy-to-new-styl.patch @@ -0,0 +1,86 @@ +From 880369e216f961cf020da91da9585f428eff3391 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 06:25:51 +0300 +Subject: arm64: dts: qcom: sm8350: switch UFS QMP PHY to new style of bindings + +From: Dmitry Baryshkov + +[ Upstream commit 002a13ed10136e4f59013adbf097b31d608caf67 ] + +Change the UFS QMP PHY to use newer style of QMP PHY bindings (single +resource region, no per-PHY subnodes). + +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20231205032552.1583336-9-dmitry.baryshkov@linaro.org +Signed-off-by: Bjorn Andersson +Stable-dep-of: 8edbdefee1c9 ("arm64: dts: qcom: sm8350: Fix UFS PHY clocks") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8350.dtsi | 28 ++++++++++------------------ + 1 file changed, 10 insertions(+), 18 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi +index a72f3c470089b..19172ed7ec2be 100644 +--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi +@@ -677,9 +677,9 @@ gcc: clock-controller@100000 { + <0>, + <0>, + <0>, +- <&ufs_mem_phy_lanes 0>, +- <&ufs_mem_phy_lanes 1>, +- <&ufs_mem_phy_lanes 2>, ++ <&ufs_mem_phy 0>, ++ <&ufs_mem_phy 1>, ++ <&ufs_mem_phy 2>, + <&usb_1_qmpphy QMP_USB43DP_USB3_PIPE_CLK>, + <0>; + }; +@@ -1679,7 +1679,7 @@ ufs_mem_hc: ufshc@1d84000 { + "jedec,ufs-2.0"; + reg = <0 0x01d84000 0 0x3000>; + interrupts = ; +- phys = <&ufs_mem_phy_lanes>; ++ phys = <&ufs_mem_phy>; + phy-names = "ufsphy"; + lanes-per-direction = <2>; + #reset-cells = <1>; +@@ -1723,10 +1723,8 @@ ufs_mem_hc: ufshc@1d84000 { + + ufs_mem_phy: phy@1d87000 { + compatible = "qcom,sm8350-qmp-ufs-phy"; +- reg = <0 0x01d87000 0 0x1c4>; +- #address-cells = <2>; +- #size-cells = <2>; +- ranges; ++ reg = <0 0x01d87000 0 0x1000>; ++ + clock-names = "ref", + "ref_aux"; + clocks = <&rpmhcc RPMH_CXO_CLK>, +@@ -1734,17 +1732,11 @@ ufs_mem_phy: phy@1d87000 { + + resets = <&ufs_mem_hc 0>; + reset-names = "ufsphy"; +- status = "disabled"; + +- ufs_mem_phy_lanes: phy@1d87400 { +- reg = <0 0x01d87400 0 0x188>, +- <0 0x01d87600 0 0x200>, +- <0 0x01d87c00 0 0x200>, +- <0 0x01d87800 0 0x188>, +- <0 0x01d87a00 0 0x200>; +- #clock-cells = <1>; +- #phy-cells = <0>; +- }; ++ #clock-cells = <1>; ++ #phy-cells = <0>; ++ ++ status = "disabled"; + }; + + cryptobam: dma-controller@1dc4000 { +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sm8450-add-missing-interconnects-to-s.patch b/queue-6.7/arm64-dts-qcom-sm8450-add-missing-interconnects-to-s.patch new file mode 100644 index 00000000000..52325688f64 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sm8450-add-missing-interconnects-to-s.patch @@ -0,0 +1,59 @@ +From e171f347892390e6995b59f4b73358e9f607c7b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jan 2024 13:25:44 +0100 +Subject: arm64: dts: qcom: sm8450: Add missing interconnects to serial + +From: Konrad Dybcio + +[ Upstream commit 6e115b75b43bd12d4061e53c8ff175e387783d8a ] + +The serial ports did not have their interconnect paths specified when +they were first introduced. Fix that. + +Fixes: 5188049c9b36 ("arm64: dts: qcom: Add base SM8450 DTSI") +Fixes: f5837418479a ("arm64: dts: qcom: sm8450: add uart20 node") +Reported-by: Krzysztof Kozlowski +Suggested-by: Georgi Djakov +Signed-off-by: Konrad Dybcio +Reviewed-by: Krzysztof Kozlowski +Tested-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20240116-topic-8450serial-v1-1-b685e6a5ad78@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8450.dtsi | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi +index f82480570d4b6..9d06fb0d4d1fd 100644 +--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi +@@ -1026,6 +1026,12 @@ uart20: serial@894000 { + pinctrl-names = "default"; + pinctrl-0 = <&qup_uart20_default>; + interrupts = ; ++ interconnects = <&clk_virt MASTER_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS ++ &clk_virt SLAVE_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS>, ++ <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS ++ &config_noc SLAVE_QUP_2 QCOM_ICC_TAG_ALWAYS>; ++ interconnect-names = "qup-core", ++ "qup-config"; + status = "disabled"; + }; + +@@ -1418,6 +1424,12 @@ uart7: serial@99c000 { + pinctrl-names = "default"; + pinctrl-0 = <&qup_uart7_tx>, <&qup_uart7_rx>; + interrupts = ; ++ interconnects = <&clk_virt MASTER_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS ++ &clk_virt SLAVE_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS>, ++ <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS ++ &config_noc SLAVE_QUP_2 QCOM_ICC_TAG_ALWAYS>; ++ interconnect-names = "qup-core", ++ "qup-config"; + status = "disabled"; + }; + }; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sm8550-fix-spmi-channels-size.patch b/queue-6.7/arm64-dts-qcom-sm8550-fix-spmi-channels-size.patch new file mode 100644 index 00000000000..804af25b1f3 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sm8550-fix-spmi-channels-size.patch @@ -0,0 +1,44 @@ +From e178955f178e565809183b53fe344a6b3d56a0c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Feb 2024 15:04:25 +0200 +Subject: arm64: dts: qcom: sm8550: Fix SPMI channels size + +From: Abel Vesa + +[ Upstream commit 77dd1e50ffcba33c3195ae4fc78f354368ddacb2 ] + +The actual size of the channels registers region is 4MB, according to the +documentation. This issue was not caught until now because the driver was +supposed to allow same regions being mapped multiple times for supporting +multiple buses. Thie driver is using platform_get_resource_byname() and +devm_ioremap() towards that purpose, which intentionally avoids +devm_request_mem_region() altogether. + +Fixes: ffc50b2d3828 ("arm64: dts: qcom: Add base SM8550 dtsi") +Reviewed-by: Neil Armstrong +Signed-off-by: Abel Vesa +Reviewed-by: Konrad Dybcio +Tested-by: Neil Armstrong # on SM8550-QRD +Link: https://lore.kernel.org/r/20240221-dts-qcom-sm8550-fix-spmi-chnls-size-v2-1-72b5efd9dc4f@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8550.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8550.dtsi b/arch/arm64/boot/dts/qcom/sm8550.dtsi +index f5d07af9c5cd5..13368664a80ca 100644 +--- a/arch/arm64/boot/dts/qcom/sm8550.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8550.dtsi +@@ -3050,7 +3050,7 @@ sram@c3f0000 { + spmi_bus: spmi@c400000 { + compatible = "qcom,spmi-pmic-arb"; + reg = <0 0x0c400000 0 0x3000>, +- <0 0x0c500000 0 0x4000000>, ++ <0 0x0c500000 0 0x400000>, + <0 0x0c440000 0 0x80000>, + <0 0x0c4c0000 0 0x20000>, + <0 0x0c42d000 0 0x4000>; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-sm8550-fix-ufs-phy-clocks.patch b/queue-6.7/arm64-dts-qcom-sm8550-fix-ufs-phy-clocks.patch new file mode 100644 index 00000000000..d2e6c425553 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-sm8550-fix-ufs-phy-clocks.patch @@ -0,0 +1,49 @@ +From 09350bb378f76500d7c9adf8c254d76fc26c6868 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 12:37:39 +0530 +Subject: arm64: dts: qcom: sm8550: Fix UFS PHY clocks + +From: Manivannan Sadhasivam + +[ Upstream commit 746ae23ad02004fe283e2edb45b7a060bbc36d46 ] + +QMP PHY used in SM8550 requires 3 clocks: + +* ref - 19.2MHz reference clock from RPMh +* ref_aux - Auxiliary reference clock from GCC +* qref - QREF clock from TCSR + +Fixes: 35cf1aaab169 ("arm64: dts: qcom: sm8550: Add UFS host controller and phy nodes") +Reviewed-by: Can Guo +Reviewed-by: Konrad Dybcio +Signed-off-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-16-58a49d2f4605@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8550.dtsi | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8550.dtsi b/arch/arm64/boot/dts/qcom/sm8550.dtsi +index e15564ed54cef..f5d07af9c5cd5 100644 +--- a/arch/arm64/boot/dts/qcom/sm8550.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8550.dtsi +@@ -1901,9 +1901,12 @@ crypto: crypto@1dfa000 { + ufs_mem_phy: phy@1d80000 { + compatible = "qcom,sm8550-qmp-ufs-phy"; + reg = <0x0 0x01d80000 0x0 0x2000>; +- clocks = <&tcsr TCSR_UFS_CLKREF_EN>, +- <&gcc GCC_UFS_PHY_PHY_AUX_CLK>; +- clock-names = "ref", "ref_aux"; ++ clocks = <&rpmhcc RPMH_CXO_CLK>, ++ <&gcc GCC_UFS_PHY_PHY_AUX_CLK>, ++ <&tcsr TCSR_UFS_CLKREF_EN>; ++ clock-names = "ref", ++ "ref_aux", ++ "qref"; + + power-domains = <&gcc UFS_MEM_PHY_GDSC>; + +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-renesas-r8a779a0-correct-avb-01-reg-sizes.patch b/queue-6.7/arm64-dts-renesas-r8a779a0-correct-avb-01-reg-sizes.patch new file mode 100644 index 00000000000..c4b3a74983f --- /dev/null +++ b/queue-6.7/arm64-dts-renesas-r8a779a0-correct-avb-01-reg-sizes.patch @@ -0,0 +1,48 @@ +From 6cff0c79459ced27a23feb72d67620996039d2dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Feb 2024 15:21:30 +0100 +Subject: arm64: dts: renesas: r8a779a0: Correct avb[01] reg sizes + +From: Geert Uytterhoeven + +[ Upstream commit 0c51912331f8ba5ce5fb52f46e340945160672a3 ] + +All Ethernet AVB instances on R-Car V3U have registers related to UDP/IP +support, but the declared register blocks for the first two instances +are too small to cover them. + +Fix this by extending the register block sizes. + +Fixes: 5a633320f08b8c9b ("arm64: dts: renesas: r8a779a0: Add Ethernet-AVB support") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/ce6ce3c4b1495e02e7c1803fca810a7178a84500.1707660323.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a779a0.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a779a0.dtsi b/arch/arm64/boot/dts/renesas/r8a779a0.dtsi +index 4e67a03564971..504ac8c93faf5 100644 +--- a/arch/arm64/boot/dts/renesas/r8a779a0.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a779a0.dtsi +@@ -658,7 +658,7 @@ channel7 { + avb0: ethernet@e6800000 { + compatible = "renesas,etheravb-r8a779a0", + "renesas,etheravb-rcar-gen4"; +- reg = <0 0xe6800000 0 0x800>; ++ reg = <0 0xe6800000 0 0x1000>; + interrupts = , + , + , +@@ -706,7 +706,7 @@ avb0: ethernet@e6800000 { + avb1: ethernet@e6810000 { + compatible = "renesas,etheravb-r8a779a0", + "renesas,etheravb-rcar-gen4"; +- reg = <0 0xe6810000 0 0x800>; ++ reg = <0 0xe6810000 0 0x1000>; + interrupts = , + , + , +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-renesas-r8a779g0-add-missing-scif_clk2.patch b/queue-6.7/arm64-dts-renesas-r8a779g0-add-missing-scif_clk2.patch new file mode 100644 index 00000000000..e857ec6019e --- /dev/null +++ b/queue-6.7/arm64-dts-renesas-r8a779g0-add-missing-scif_clk2.patch @@ -0,0 +1,67 @@ +From 2b17c3b6dadbe8fbc2077d8a5384ea8024e60c45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jan 2024 17:32:37 +0100 +Subject: arm64: dts: renesas: r8a779g0: Add missing SCIF_CLK2 + +From: Geert Uytterhoeven + +[ Upstream commit 08e799f6bce80dd63c174d8d0fc61d1a6149960b ] + +R-Car V4H actually has two SCIF_CLK pins. +The second pin provides the SCIF_CLK signal for HSCIF2 and SCIF4. + +Fixes: a4c31c56d2d35641 ("arm64: dts: renesas: r8a779g0: Add SCIF nodes") +Fixes: 39d9dfc6fbe1860e ("arm64: dts: renesas: r8a779g0: Add remaining HSCIF nodes") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/72f20c1bf32187bd30a963cafe27252907d661f9.1705589612.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a779g0.dtsi | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi +index 3be1159982b20..0c83940b3d8a1 100644 +--- a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi +@@ -185,13 +185,19 @@ psci { + method = "smc"; + }; + +- /* External SCIF clock - to be overridden by boards that provide it */ ++ /* External SCIF clocks - to be overridden by boards that provide them */ + scif_clk: scif { + compatible = "fixed-clock"; + #clock-cells = <0>; + clock-frequency = <0>; + }; + ++ scif_clk2: scif2 { ++ compatible = "fixed-clock"; ++ #clock-cells = <0>; ++ clock-frequency = <0>; ++ }; ++ + soc: soc { + compatible = "simple-bus"; + interrupt-parent = <&gic>; +@@ -681,7 +687,7 @@ hscif2: serial@e6560000 { + interrupts = ; + clocks = <&cpg CPG_MOD 516>, + <&cpg CPG_CORE R8A779G0_CLK_SASYNCPERD1>, +- <&scif_clk>; ++ <&scif_clk2>; + clock-names = "fck", "brg_int", "scif_clk"; + dmas = <&dmac0 0x35>, <&dmac0 0x34>, + <&dmac1 0x35>, <&dmac1 0x34>; +@@ -1057,7 +1063,7 @@ scif4: serial@e6c40000 { + interrupts = ; + clocks = <&cpg CPG_MOD 705>, + <&cpg CPG_CORE R8A779G0_CLK_SASYNCPERD1>, +- <&scif_clk>; ++ <&scif_clk2>; + clock-names = "fck", "brg_int", "scif_clk"; + dmas = <&dmac0 0x59>, <&dmac0 0x58>, + <&dmac1 0x59>, <&dmac1 0x58>; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-renesas-r8a779g0-correct-avb-01-reg-sizes.patch b/queue-6.7/arm64-dts-renesas-r8a779g0-correct-avb-01-reg-sizes.patch new file mode 100644 index 00000000000..f23fca3fa5c --- /dev/null +++ b/queue-6.7/arm64-dts-renesas-r8a779g0-correct-avb-01-reg-sizes.patch @@ -0,0 +1,48 @@ +From 55f36333d3f3c9beec9c72cabb5ae840c1f524fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Feb 2024 15:21:31 +0100 +Subject: arm64: dts: renesas: r8a779g0: Correct avb[01] reg sizes + +From: Geert Uytterhoeven + +[ Upstream commit 7edbb5880dc3317a5eaec2166de71ff394598e6b ] + +All Ethernet AVB instances on R-Car V4H have registers related to UDP/IP +support, but the declared register blocks for the first two instances +are too small to cover them. + +Fix this by extending the register block sizes. + +Fixes: 848c82db56923a8b ("arm64: dts: renesas: r8a779g0: Add RAVB nodes") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/83437778614a7c96f4d8f1be98dffeee29bb4a0b.1707660323.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a779g0.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi +index 0c83940b3d8a1..d7677595204dc 100644 +--- a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi +@@ -767,7 +767,7 @@ channel7 { + avb0: ethernet@e6800000 { + compatible = "renesas,etheravb-r8a779g0", + "renesas,etheravb-rcar-gen4"; +- reg = <0 0xe6800000 0 0x800>; ++ reg = <0 0xe6800000 0 0x1000>; + interrupts = , + , + , +@@ -814,7 +814,7 @@ avb0: ethernet@e6800000 { + avb1: ethernet@e6810000 { + compatible = "renesas,etheravb-r8a779g0", + "renesas,etheravb-rcar-gen4"; +- reg = <0 0xe6810000 0 0x800>; ++ reg = <0 0xe6810000 0 0x1000>; + interrupts = , + , + , +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-renesas-r8a779g0-restore-sort-order.patch b/queue-6.7/arm64-dts-renesas-r8a779g0-restore-sort-order.patch new file mode 100644 index 00000000000..d6ec35388d6 --- /dev/null +++ b/queue-6.7/arm64-dts-renesas-r8a779g0-restore-sort-order.patch @@ -0,0 +1,126 @@ +From 57fd6950b861ef034b6c9a434bd3d260b834b2b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jan 2024 14:33:18 +0100 +Subject: arm64: dts: renesas: r8a779g0: Restore sort order + +From: Geert Uytterhoeven + +[ Upstream commit 8b93657c976a61726d7ffbe8d019b84b4abfb673 ] + +Numerical by unit address, alphabetical by node name. + +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/f00ef274a73c8fd60f940a1649423a8927b9ae8a.1705324708.git.geert+renesas@glider.be +Stable-dep-of: 08e799f6bce8 ("arm64: dts: renesas: r8a779g0: Add missing SCIF_CLK2") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a779g0.dtsi | 72 +++++++++++------------ + 1 file changed, 36 insertions(+), 36 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi +index d3d25e077c5d5..3be1159982b20 100644 +--- a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi +@@ -161,11 +161,6 @@ L3_CA76_1: cache-controller-1 { + }; + }; + +- psci { +- compatible = "arm,psci-1.0", "arm,psci-0.2"; +- method = "smc"; +- }; +- + extal_clk: extal { + compatible = "fixed-clock"; + #clock-cells = <0>; +@@ -185,6 +180,11 @@ pmu_a76 { + interrupts-extended = <&gic GIC_PPI 7 IRQ_TYPE_LEVEL_LOW>; + }; + ++ psci { ++ compatible = "arm,psci-1.0", "arm,psci-0.2"; ++ method = "smc"; ++ }; ++ + /* External SCIF clock - to be overridden by boards that provide it */ + scif_clk: scif { + compatible = "fixed-clock"; +@@ -1777,6 +1777,37 @@ ssi0: ssi-0 { + }; + }; + ++ mmc0: mmc@ee140000 { ++ compatible = "renesas,sdhi-r8a779g0", ++ "renesas,rcar-gen4-sdhi"; ++ reg = <0 0xee140000 0 0x2000>; ++ interrupts = ; ++ clocks = <&cpg CPG_MOD 706>, ++ <&cpg CPG_CORE R8A779G0_CLK_SD0H>; ++ clock-names = "core", "clkh"; ++ power-domains = <&sysc R8A779G0_PD_ALWAYS_ON>; ++ resets = <&cpg 706>; ++ max-frequency = <200000000>; ++ iommus = <&ipmmu_ds0 32>; ++ status = "disabled"; ++ }; ++ ++ rpc: spi@ee200000 { ++ compatible = "renesas,r8a779g0-rpc-if", ++ "renesas,rcar-gen4-rpc-if"; ++ reg = <0 0xee200000 0 0x200>, ++ <0 0x08000000 0 0x04000000>, ++ <0 0xee208000 0 0x100>; ++ reg-names = "regs", "dirmap", "wbuf"; ++ interrupts = ; ++ clocks = <&cpg CPG_MOD 629>; ++ power-domains = <&sysc R8A779G0_PD_ALWAYS_ON>; ++ resets = <&cpg 629>; ++ #address-cells = <1>; ++ #size-cells = <0>; ++ status = "disabled"; ++ }; ++ + ipmmu_rt0: iommu@ee480000 { + compatible = "renesas,ipmmu-r8a779g0", + "renesas,rcar-gen4-ipmmu-vmsa"; +@@ -1886,37 +1917,6 @@ ipmmu_mm: iommu@eefc0000 { + #iommu-cells = <1>; + }; + +- mmc0: mmc@ee140000 { +- compatible = "renesas,sdhi-r8a779g0", +- "renesas,rcar-gen4-sdhi"; +- reg = <0 0xee140000 0 0x2000>; +- interrupts = ; +- clocks = <&cpg CPG_MOD 706>, +- <&cpg CPG_CORE R8A779G0_CLK_SD0H>; +- clock-names = "core", "clkh"; +- power-domains = <&sysc R8A779G0_PD_ALWAYS_ON>; +- resets = <&cpg 706>; +- max-frequency = <200000000>; +- iommus = <&ipmmu_ds0 32>; +- status = "disabled"; +- }; +- +- rpc: spi@ee200000 { +- compatible = "renesas,r8a779g0-rpc-if", +- "renesas,rcar-gen4-rpc-if"; +- reg = <0 0xee200000 0 0x200>, +- <0 0x08000000 0 0x04000000>, +- <0 0xee208000 0 0x100>; +- reg-names = "regs", "dirmap", "wbuf"; +- interrupts = ; +- clocks = <&cpg CPG_MOD 629>; +- power-domains = <&sysc R8A779G0_PD_ALWAYS_ON>; +- resets = <&cpg 629>; +- #address-cells = <1>; +- #size-cells = <0>; +- status = "disabled"; +- }; +- + gic: interrupt-controller@f1000000 { + compatible = "arm,gic-v3"; + #interrupt-cells = <3>; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-renesas-rzg2l-add-missing-interrupts-to-ir.patch b/queue-6.7/arm64-dts-renesas-rzg2l-add-missing-interrupts-to-ir.patch new file mode 100644 index 00000000000..cc83aa2d874 --- /dev/null +++ b/queue-6.7/arm64-dts-renesas-rzg2l-add-missing-interrupts-to-ir.patch @@ -0,0 +1,131 @@ +From 9f05db0c4d8d762de60094d111f2024928ac821b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Feb 2024 14:44:20 +0000 +Subject: arm64: dts: renesas: rzg2l: Add missing interrupts to IRQC nodes + +From: Lad Prabhakar + +[ Upstream commit 14fe225dd5fcd5928583b0bcc34398a581f51602 ] + +The IRQC IP block supports Bus error and ECCRAM interrupts on RZ/G2L and +alike SoC's (listed below). Update the IRQC nodes with the missing +interrupts, and additionally, include the 'interrupt-names' properties +in the IRQC nodes so that the driver can parse interrupts by name. + + - R9A07G043U - RZ/G2UL + - R9A07G044L/R9A07G044LC - RZ/{G2L,G2LC} + - R9A07G054 - RZ/V2L + +Fixes: 5edc51af5b30 ("arm64: dts: renesas: r9a07g044: Add IRQC node") +Fixes: 48ab6eddd8bb ("arm64: dts: renesas: r9a07g043u: Add IRQC node") +Fixes: 379478ab09e0 ("arm64: dts: renesas: r9a07g054: Add IRQC node") +Signed-off-by: Lad Prabhakar +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20240205144421.51195-3-prabhakar.mahadev-lad.rj@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r9a07g043u.dtsi | 12 +++++++++-- + arch/arm64/boot/dts/renesas/r9a07g044.dtsi | 22 ++++++++++++++++++++- + arch/arm64/boot/dts/renesas/r9a07g054.dtsi | 22 ++++++++++++++++++++- + 3 files changed, 52 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi b/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi +index 2ab231572d95f..b3f83d0ebcbb5 100644 +--- a/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi ++++ b/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi +@@ -109,7 +109,13 @@ irqc: interrupt-controller@110a0000 { + , + , + , +- ; ++ , ++ , ++ , ++ , ++ , ++ , ++ ; + interrupt-names = "nmi", + "irq0", "irq1", "irq2", "irq3", + "irq4", "irq5", "irq6", "irq7", +@@ -121,7 +127,9 @@ irqc: interrupt-controller@110a0000 { + "tint20", "tint21", "tint22", "tint23", + "tint24", "tint25", "tint26", "tint27", + "tint28", "tint29", "tint30", "tint31", +- "bus-err"; ++ "bus-err", "ec7tie1-0", "ec7tie2-0", ++ "ec7tiovf-0", "ec7tie1-1", "ec7tie2-1", ++ "ec7tiovf-1"; + clocks = <&cpg CPG_MOD R9A07G043_IA55_CLK>, + <&cpg CPG_MOD R9A07G043_IA55_PCLK>; + clock-names = "clk", "pclk"; +diff --git a/arch/arm64/boot/dts/renesas/r9a07g044.dtsi b/arch/arm64/boot/dts/renesas/r9a07g044.dtsi +index 66f68fc2b2411..081d8f49db879 100644 +--- a/arch/arm64/boot/dts/renesas/r9a07g044.dtsi ++++ b/arch/arm64/boot/dts/renesas/r9a07g044.dtsi +@@ -905,7 +905,27 @@ irqc: interrupt-controller@110a0000 { + , + , + , +- ; ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ ; ++ interrupt-names = "nmi", "irq0", "irq1", "irq2", "irq3", ++ "irq4", "irq5", "irq6", "irq7", ++ "tint0", "tint1", "tint2", "tint3", ++ "tint4", "tint5", "tint6", "tint7", ++ "tint8", "tint9", "tint10", "tint11", ++ "tint12", "tint13", "tint14", "tint15", ++ "tint16", "tint17", "tint18", "tint19", ++ "tint20", "tint21", "tint22", "tint23", ++ "tint24", "tint25", "tint26", "tint27", ++ "tint28", "tint29", "tint30", "tint31", ++ "bus-err", "ec7tie1-0", "ec7tie2-0", ++ "ec7tiovf-0", "ec7tie1-1", "ec7tie2-1", ++ "ec7tiovf-1"; + clocks = <&cpg CPG_MOD R9A07G044_IA55_CLK>, + <&cpg CPG_MOD R9A07G044_IA55_PCLK>; + clock-names = "clk", "pclk"; +diff --git a/arch/arm64/boot/dts/renesas/r9a07g054.dtsi b/arch/arm64/boot/dts/renesas/r9a07g054.dtsi +index 1f1d481dc7830..0d327464d2baf 100644 +--- a/arch/arm64/boot/dts/renesas/r9a07g054.dtsi ++++ b/arch/arm64/boot/dts/renesas/r9a07g054.dtsi +@@ -912,7 +912,27 @@ irqc: interrupt-controller@110a0000 { + , + , + , +- ; ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ ; ++ interrupt-names = "nmi", "irq0", "irq1", "irq2", "irq3", ++ "irq4", "irq5", "irq6", "irq7", ++ "tint0", "tint1", "tint2", "tint3", ++ "tint4", "tint5", "tint6", "tint7", ++ "tint8", "tint9", "tint10", "tint11", ++ "tint12", "tint13", "tint14", "tint15", ++ "tint16", "tint17", "tint18", "tint19", ++ "tint20", "tint21", "tint22", "tint23", ++ "tint24", "tint25", "tint26", "tint27", ++ "tint28", "tint29", "tint30", "tint31", ++ "bus-err", "ec7tie1-0", "ec7tie2-0", ++ "ec7tiovf-0", "ec7tie1-1", "ec7tie2-1", ++ "ec7tiovf-1"; + clocks = <&cpg CPG_MOD R9A07G054_IA55_CLK>, + <&cpg CPG_MOD R9A07G054_IA55_PCLK>; + clock-names = "clk", "pclk"; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-rockchip-add-missing-interrupt-names-for-r.patch b/queue-6.7/arm64-dts-rockchip-add-missing-interrupt-names-for-r.patch new file mode 100644 index 00000000000..97bcb071900 --- /dev/null +++ b/queue-6.7/arm64-dts-rockchip-add-missing-interrupt-names-for-r.patch @@ -0,0 +1,40 @@ +From 254d9b3f7ceeb95c1d0ea5a640fd4179f764ee7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Feb 2024 18:35:25 +0100 +Subject: arm64: dts: rockchip: add missing interrupt-names for rk356x vdpu +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Heiko Stuebner + +[ Upstream commit d1c44d9afa6f89aa0e10a191f30868eb12cd719f ] + +The video-codec@fdea0400 was missing the interrupt-names property that is +part of the binding. Add it. + +Fixes: 944be6fba401 ("arm64: dts: rockchip: Add VPU support for RK3568/RK3566") +Cc: Piotr Oniszczuk +Acked-by: Uwe Kleine-König +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20240227173526.710056-1-heiko@sntech.de +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk356x.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk356x.dtsi b/arch/arm64/boot/dts/rockchip/rk356x.dtsi +index c19c0f1b3778f..6a9bfb0550c04 100644 +--- a/arch/arm64/boot/dts/rockchip/rk356x.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk356x.dtsi +@@ -597,6 +597,7 @@ vpu: video-codec@fdea0400 { + compatible = "rockchip,rk3568-vpu"; + reg = <0x0 0xfdea0000 0x0 0x800>; + interrupts = ; ++ interrupt-names = "vdpu"; + clocks = <&cru ACLK_VPU>, <&cru HCLK_VPU>; + clock-names = "aclk", "hclk"; + iommus = <&vdpu_mmu>; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-rockchip-drop-rockchip-trcm-sync-tx-only-f.patch b/queue-6.7/arm64-dts-rockchip-drop-rockchip-trcm-sync-tx-only-f.patch new file mode 100644 index 00000000000..d0e470fcce4 --- /dev/null +++ b/queue-6.7/arm64-dts-rockchip-drop-rockchip-trcm-sync-tx-only-f.patch @@ -0,0 +1,55 @@ +From a7cfc96081b1846ed33a45517793e2965ebf4607 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Feb 2024 17:46:56 +0100 +Subject: arm64: dts: rockchip: drop rockchip,trcm-sync-tx-only from rk3588 i2s + +From: Heiko Stuebner + +[ Upstream commit a8037ceb89649659831e86a87a9329d1bb43c735 ] + +The rockchip,trcm-sync-tx-only property is at this time only documented +for the tdm variant of Rockchip i2s controllers. + +While there was a series [0] adding code and binding for the property, +it doesn't seem to have gone forward back in 2021. + +So for now fix the devicetree check by removing the property from rk3588 +i2s controllers until support for it gets merged. + +[0] https://patchwork.kernel.org/project/linux-rockchip/patch/1629796734-4243-5-git-send-email-sugar.zhang@rock-chips.com/ + +Fixes: 8ae112a5554f ("arm64: dts: rockchip: Add rk3588s I2S nodes") +Cc: Sugar Zhang +Cc: Cristian Ciocaltea +Signed-off-by: Heiko Stuebner +Reviewed-by: Quentin Schulz +Link: https://lore.kernel.org/r/20240227164659.705271-2-heiko@sntech.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3588s.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3588s.dtsi b/arch/arm64/boot/dts/rockchip/rk3588s.dtsi +index f9f9749848bd9..1d262cd54c990 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588s.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3588s.dtsi +@@ -1589,7 +1589,6 @@ i2s2_2ch: i2s@fe490000 { + dmas = <&dmac1 0>, <&dmac1 1>; + dma-names = "tx", "rx"; + power-domains = <&power RK3588_PD_AUDIO>; +- rockchip,trcm-sync-tx-only; + pinctrl-names = "default"; + pinctrl-0 = <&i2s2m1_lrck + &i2s2m1_sclk +@@ -1610,7 +1609,6 @@ i2s3_2ch: i2s@fe4a0000 { + dmas = <&dmac1 2>, <&dmac1 3>; + dma-names = "tx", "rx"; + power-domains = <&power RK3588_PD_AUDIO>; +- rockchip,trcm-sync-tx-only; + pinctrl-names = "default"; + pinctrl-0 = <&i2s3_lrck + &i2s3_sclk +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-rockchip-fix-reset-names-for-rk356x-i2s2-c.patch b/queue-6.7/arm64-dts-rockchip-fix-reset-names-for-rk356x-i2s2-c.patch new file mode 100644 index 00000000000..a030d81d1ab --- /dev/null +++ b/queue-6.7/arm64-dts-rockchip-fix-reset-names-for-rk356x-i2s2-c.patch @@ -0,0 +1,48 @@ +From b50ea57ca3591ff6a66431ae459c7b19b34e31f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Feb 2024 18:35:26 +0100 +Subject: arm64: dts: rockchip: fix reset-names for rk356x i2s2 controller +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Heiko Stuebner + +[ Upstream commit 0fc19ab75acde78558bd0f6fe3e5f63cf8ee88b0 ] + +The dtbscheck reports a warning for a wrong reset-names property for +the i2s2 controller on rk356x socs. + +The other controllers on the soc provide tx and rx directions and hence +two resets and separate clocks for each direction, while i2s2 only +provides one reset. This was so far named just "m" which isn't part of +the binding. + +The clock-names the controller uses all end in "tx", so use the matching +"tx-m" reset-name for the i2s controller. + +Fixes: 755f37010f3e ("arm64: dts: rockchip: RK356x: Add I2S2 device node") +Acked-by: Uwe Kleine-König +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20240227173526.710056-2-heiko@sntech.de +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk356x.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk356x.dtsi b/arch/arm64/boot/dts/rockchip/rk356x.dtsi +index 6a9bfb0550c04..92f96ec01385d 100644 +--- a/arch/arm64/boot/dts/rockchip/rk356x.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk356x.dtsi +@@ -1124,7 +1124,7 @@ i2s2_2ch: i2s@fe420000 { + dmas = <&dmac1 4>, <&dmac1 5>; + dma-names = "tx", "rx"; + resets = <&cru SRST_M_I2S2_2CH>; +- reset-names = "m"; ++ reset-names = "tx-m"; + rockchip,grf = <&grf>; + pinctrl-names = "default"; + pinctrl-0 = <&i2s2m0_sclktx +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-ti-add-common1-register-space-for-am62x-so.patch b/queue-6.7/arm64-dts-ti-add-common1-register-space-for-am62x-so.patch new file mode 100644 index 00000000000..77cc2234e17 --- /dev/null +++ b/queue-6.7/arm64-dts-ti-add-common1-register-space-for-am62x-so.patch @@ -0,0 +1,44 @@ +From eb1cdb718abf8c95e00b3d71345b885cb7c43b81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 11:54:25 +0530 +Subject: arm64: dts: ti: Add common1 register space for AM62x SoC + +From: Devarsh Thakkar + +[ Upstream commit 7d8ee2c3b8a2aabb9ce75795bad20773bfe1ba13 ] + +This adds common1 register space for AM62x SoC which is using TI's Keystone +display hardware and supporting it as described in +Documentation/devicetree/bindings/display/ti/ti,am65x-dss.yaml + +Fixes: 8ccc1073c7bb ("arm64: dts: ti: k3-am62-main: Add node for DSS") +Signed-off-by: Devarsh Thakkar +Reviewed-by: Tomi Valkeinen +Reviewed-by: Aradhya Bhatia +Link: https://lore.kernel.org/r/20240216062426.4170528-4-devarsht@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am62-main.dtsi | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi +index c1ace4a376d17..2f318c5287581 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi +@@ -757,9 +757,10 @@ dss: dss@30200000 { + <0x00 0x30207000 0x00 0x1000>, /* ovr1 */ + <0x00 0x30208000 0x00 0x1000>, /* ovr2 */ + <0x00 0x3020a000 0x00 0x1000>, /* vp1: Used for OLDI */ +- <0x00 0x3020b000 0x00 0x1000>; /* vp2: Used as DPI Out */ ++ <0x00 0x3020b000 0x00 0x1000>, /* vp2: Used as DPI Out */ ++ <0x00 0x30201000 0x00 0x1000>; /* common1 */ + reg-names = "common", "vidl1", "vid", +- "ovr1", "ovr2", "vp1", "vp2"; ++ "ovr1", "ovr2", "vp1", "vp2", "common1"; + power-domains = <&k3_pds 186 TI_SCI_PD_EXCLUSIVE>; + clocks = <&k3_clks 186 6>, + <&dss_vp1_clk>, +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-ti-add-common1-register-space-for-am65x-so.patch b/queue-6.7/arm64-dts-ti-add-common1-register-space-for-am65x-so.patch new file mode 100644 index 00000000000..582e1e37994 --- /dev/null +++ b/queue-6.7/arm64-dts-ti-add-common1-register-space-for-am65x-so.patch @@ -0,0 +1,44 @@ +From 6d9861f0567c3bef871a46fbf31aea3cbf9968b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 11:54:24 +0530 +Subject: arm64: dts: ti: Add common1 register space for AM65x SoC + +From: Devarsh Thakkar + +[ Upstream commit 1a5010eade10b409d353b770d97b548b0fbdf5d7 ] + +This adds common1 register space for AM65x SoC which is using TI's Keystone +display hardware and supporting it as described in +Documentation/devicetree/bindings/display/ti/ti,am65x-dss.yaml + +Fixes: fc539b90eda2 ("arm64: dts: ti: am654: Add DSS node") +Signed-off-by: Devarsh Thakkar +Reviewed-by: Tomi Valkeinen +Reviewed-by: Aradhya Bhatia +Link: https://lore.kernel.org/r/20240216062426.4170528-3-devarsht@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi +index 29048d6577cf6..fa2304a7cb1ec 100644 +--- a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi +@@ -1013,9 +1013,10 @@ dss: dss@4a00000 { + <0x0 0x04a07000 0x0 0x1000>, /* ovr1 */ + <0x0 0x04a08000 0x0 0x1000>, /* ovr2 */ + <0x0 0x04a0a000 0x0 0x1000>, /* vp1 */ +- <0x0 0x04a0b000 0x0 0x1000>; /* vp2 */ ++ <0x0 0x04a0b000 0x0 0x1000>, /* vp2 */ ++ <0x0 0x04a01000 0x0 0x1000>; /* common1 */ + reg-names = "common", "vidl1", "vid", +- "ovr1", "ovr2", "vp1", "vp2"; ++ "ovr1", "ovr2", "vp1", "vp2", "common1"; + + ti,am65x-oldi-io-ctrl = <&dss_oldi_io_ctrl>; + +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-ti-am65x-fix-dtbs_install-for-rocktech-old.patch b/queue-6.7/arm64-dts-ti-am65x-fix-dtbs_install-for-rocktech-old.patch new file mode 100644 index 00000000000..ec97bbd457f --- /dev/null +++ b/queue-6.7/arm64-dts-ti-am65x-fix-dtbs_install-for-rocktech-old.patch @@ -0,0 +1,37 @@ +From c948eac3eb6aa068379c0a5f4dced0210795e0c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Feb 2024 15:51:43 +0200 +Subject: arm64: dts: ti: am65x: Fix dtbs_install for Rocktech OLDI overlay + +From: Roger Quadros + +[ Upstream commit 8ada14cafc5e185c668198617cd1ab4f1d8d325a ] + +Add the overlay dtbo file to a Makefile target so it can be +picked by the dtbs_install command. + +Fixes: b8690ed3d1d1 ("arm64: dts: ti: am65x: Add Rocktech OLDI panel DT overlay") +Signed-off-by: Roger Quadros +Reviewed-by: Aradhya Bhatia +Link: https://lore.kernel.org/r/20240208-for-v6-9-am65-overlays-2-0-v2-1-70bae3e91597@kernel.org +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/ti/Makefile b/arch/arm64/boot/dts/ti/Makefile +index 77a347f9f47d5..c1513f0fa47fd 100644 +--- a/arch/arm64/boot/dts/ti/Makefile ++++ b/arch/arm64/boot/dts/ti/Makefile +@@ -57,6 +57,7 @@ dtb-$(CONFIG_ARCH_K3) += k3-am654-base-board.dtb + dtb-$(CONFIG_ARCH_K3) += k3-am654-gp-evm.dtb + dtb-$(CONFIG_ARCH_K3) += k3-am654-evm.dtb + dtb-$(CONFIG_ARCH_K3) += k3-am654-idk.dtb ++dtb-$(CONFIG_ARCH_K3) += k3-am654-base-board-rocktech-rk101-panel.dtbo + + # Boards with J7200 SoC + k3-j7200-evm-dtbs := k3-j7200-common-proc-board.dtb k3-j7200-evm-quad-port-eth-exp.dtbo +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-ti-k3-am62-main-disable-usb-lpm.patch b/queue-6.7/arm64-dts-ti-k3-am62-main-disable-usb-lpm.patch new file mode 100644 index 00000000000..fb85e9ac1bb --- /dev/null +++ b/queue-6.7/arm64-dts-ti-k3-am62-main-disable-usb-lpm.patch @@ -0,0 +1,65 @@ +From 550c5d93857869cda1f6b044306d849f5025d097 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Feb 2024 14:02:12 +0100 +Subject: arm64: dts: ti: k3-am62-main: disable usb lpm + +From: Andrejs Cainikovs + +[ Upstream commit 9c99b337a8755a09df7735d4324ae26a6eca6261 ] + +AM62 USB works with some devices, while failing to operate with others. + +[ 560.189822] xhci-hcd xhci-hcd.4.auto: xHCI Host Controller +[ 560.195631] xhci-hcd xhci-hcd.4.auto: new USB bus registered, assigned bus number 2 +[ 574.388509] xhci-hcd xhci-hcd.4.auto: can't setup: -110 +[ 574.393814] xhci-hcd xhci-hcd.4.auto: USB bus 2 deregistered +[ 574.399544] xhci-hcd: probe of xhci-hcd.4.auto failed with error -110 + +This seems to be related to LPM (Link Power Management), and disabling it +turns USB into reliable working state. + +As per AM62 reference manual: + +> 4.8.2.1 USB2SS Unsupported Features +> +> The following features are not supported on this family of devices: +> ... +> - USB 2.0 ECN: Link Power Management (LPM) +> ... + +Fixes: 2240f96cf3cd ("arm64: dts: ti: k3-am62-main: Add support for USB") +Signed-off-by: Andrejs Cainikovs +Reviewed-by: Francesco Dolcini +Reviewed-by: Roger Quadros +Link: https://lore.kernel.org/r/20240209130213.38908-1-andrejs.cainikovs@gmail.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am62-main.dtsi | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi +index e5c64c86d1d5a..c1ace4a376d17 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi +@@ -623,6 +623,8 @@ usb0: usb@31000000 { + interrupt-names = "host", "peripheral"; + maximum-speed = "high-speed"; + dr_mode = "otg"; ++ snps,usb2-gadget-lpm-disable; ++ snps,usb2-lpm-disable; + }; + }; + +@@ -646,6 +648,8 @@ usb1: usb@31100000 { + interrupt-names = "host", "peripheral"; + maximum-speed = "high-speed"; + dr_mode = "otg"; ++ snps,usb2-gadget-lpm-disable; ++ snps,usb2-lpm-disable; + }; + }; + +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-ti-k3-am62p-fix-memory-ranges-for-dmss.patch b/queue-6.7/arm64-dts-ti-k3-am62p-fix-memory-ranges-for-dmss.patch new file mode 100644 index 00000000000..beb989ca000 --- /dev/null +++ b/queue-6.7/arm64-dts-ti-k3-am62p-fix-memory-ranges-for-dmss.patch @@ -0,0 +1,39 @@ +From 46226d422da646c13896f5515d43d2664e893c93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Feb 2024 11:48:02 +0530 +Subject: arm64: dts: ti: k3-am62p: Fix memory ranges for DMSS + +From: Jai Luthra + +[ Upstream commit 90a67583171f213711de662fab9f8d24a2d291a9 ] + +The INTR module for DMASS1 (CSI specific DMASS) is outside the currently +available ranges, as it starts at 0x4e400000. So fix the ranges property +to enable programming the interrupts correctly. + +Fixes: 29075cc09f43 ("arm64: dts: ti: Introduce AM62P5 family of SoCs") +Reviewed-by: Vaishnav Achath +Signed-off-by: Jai Luthra +Link: https://lore.kernel.org/r/20240220-am62p_csi-v2-1-3e71d9945571@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am62p.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am62p.dtsi b/arch/arm64/boot/dts/ti/k3-am62p.dtsi +index 84ffe7b9dcaf3..4f22b5d9fb9f0 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62p.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am62p.dtsi +@@ -71,7 +71,7 @@ cbass_main: bus@f0000 { + <0x00 0x43600000 0x00 0x43600000 0x00 0x00010000>, /* SA3 sproxy data */ + <0x00 0x44043000 0x00 0x44043000 0x00 0x00000fe0>, /* TI SCI DEBUG */ + <0x00 0x44860000 0x00 0x44860000 0x00 0x00040000>, /* SA3 sproxy config */ +- <0x00 0x48000000 0x00 0x48000000 0x00 0x06400000>, /* DMSS */ ++ <0x00 0x48000000 0x00 0x48000000 0x00 0x06408000>, /* DMSS */ + <0x00 0x60000000 0x00 0x60000000 0x00 0x08000000>, /* FSS0 DAT1 */ + <0x00 0x70000000 0x00 0x70000000 0x00 0x00010000>, /* OCSRAM */ + <0x01 0x00000000 0x01 0x00000000 0x00 0x00310000>, /* A53 PERIPHBASE */ +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-ti-k3-am62p-mcu-wakeup-disable-mcu-and-wak.patch b/queue-6.7/arm64-dts-ti-k3-am62p-mcu-wakeup-disable-mcu-and-wak.patch new file mode 100644 index 00000000000..d93e0e98892 --- /dev/null +++ b/queue-6.7/arm64-dts-ti-k3-am62p-mcu-wakeup-disable-mcu-and-wak.patch @@ -0,0 +1,62 @@ +From 74f6d99fa6dce2ccf1889d2b44dd79dc6f46245e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Jan 2024 19:10:17 +0530 +Subject: arm64: dts: ti: k3-am62p-mcu/wakeup: Disable MCU and wakeup R5FSS + nodes + +From: Vaishnav Achath + +[ Upstream commit dfc90e5f1a0fe0f8124521bc1911e38aa6cd9118 ] + +K3 Remoteproc R5 driver requires reserved memory carveouts and +mailbox configuration to instantiate the cores successfully. +Since this is a board level dependency, keep the R5 subsytem +disabled at SoC dtsi, otherwise it results in probe errors like +below during AM62P SK boot: + +r5fss@79000000: reserved memory init failed, ret = -22 +r5fss@79000000: k3_r5_cluster_rproc_init failed, ret = -22 +r5fss@78000000: reserved memory init failed, ret = -22 +r5fss@78000000: k3_r5_cluster_rproc_init failed, ret = -22 + +Fixes: b5080c7c1f7e ("arm64: dts: ti: k3-am62p: Add nodes for more IPs") + +Signed-off-by: Vaishnav Achath +Reviewed-by: Jayesh Choudhary +Reviewed-by: Nishanth Menon +Link: https://lore.kernel.org/r/20240121134017.374992-1-vaishnav.a@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am62p-mcu.dtsi | 2 ++ + arch/arm64/boot/dts/ti/k3-am62p-wakeup.dtsi | 1 + + 2 files changed, 3 insertions(+) + +diff --git a/arch/arm64/boot/dts/ti/k3-am62p-mcu.dtsi b/arch/arm64/boot/dts/ti/k3-am62p-mcu.dtsi +index c4b0b91d70cf3..14eb9ba836d32 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62p-mcu.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am62p-mcu.dtsi +@@ -187,6 +187,8 @@ mcu_r5fss0: r5fss@79000000 { + ranges = <0x79000000 0x00 0x79000000 0x8000>, + <0x79020000 0x00 0x79020000 0x8000>; + power-domains = <&k3_pds 7 TI_SCI_PD_EXCLUSIVE>; ++ status = "disabled"; ++ + mcu_r5fss0_core0: r5f@79000000 { + compatible = "ti,am62-r5f"; + reg = <0x79000000 0x00008000>, +diff --git a/arch/arm64/boot/dts/ti/k3-am62p-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-am62p-wakeup.dtsi +index 19f42b39394ee..10a7059b2d9b5 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62p-wakeup.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am62p-wakeup.dtsi +@@ -78,6 +78,7 @@ wkup_r5fss0: r5fss@78000000 { + ranges = <0x78000000 0x00 0x78000000 0x8000>, + <0x78100000 0x00 0x78100000 0x8000>; + power-domains = <&k3_pds 119 TI_SCI_PD_EXCLUSIVE>; ++ status = "disabled"; + + wkup_r5fss0_core0: r5f@78000000 { + compatible = "ti,am62-r5f"; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-ti-k3-am62p5-sk-enable-cpsw-mdio-node.patch b/queue-6.7/arm64-dts-ti-k3-am62p5-sk-enable-cpsw-mdio-node.patch new file mode 100644 index 00000000000..3f6874c03f9 --- /dev/null +++ b/queue-6.7/arm64-dts-ti-k3-am62p5-sk-enable-cpsw-mdio-node.patch @@ -0,0 +1,44 @@ +From c0b1939bbea4fbb2ab58e69749a91e2e2cfdc4ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Feb 2024 18:13:53 +0530 +Subject: arm64: dts: ti: k3-am62p5-sk: Enable CPSW MDIO node + +From: Ravi Gunasekaran + +[ Upstream commit 8839a9af397e803e0447a6b3e69fad54ed22d26d ] + +Enable the CPSW MDIO node, and link the pinctrl information to enable +ethernet on SK-AM62P. + +Ethernet was unintentally broken on this board, even though these nodes +were already present, as enabling them was missed in the original +patch. + +Fixes: c00504ea42c0 ("arm64: dts: ti: k3-am62p5-sk: Updates for SK EVM") +Signed-off-by: Ravi Gunasekaran +Signed-off-by: Jai Luthra +Link: https://lore.kernel.org/r/20240201-am62p_cpsw_mdio-v1-1-05f758300f6e@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am62p5-sk.dts | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts b/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts +index f377eadef0c12..04e51934d24ca 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts ++++ b/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts +@@ -445,6 +445,10 @@ &cpsw_port2 { + }; + + &cpsw3g_mdio { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&main_mdio1_pins_default>; ++ status = "okay"; ++ + cpsw3g_phy0: ethernet-phy@0 { + reg = <0>; + ti,rx-internal-delay = ; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-ti-k3-am64-enable-sdhci-nodes-at-the-board.patch b/queue-6.7/arm64-dts-ti-k3-am64-enable-sdhci-nodes-at-the-board.patch new file mode 100644 index 00000000000..6793e2f6878 --- /dev/null +++ b/queue-6.7/arm64-dts-ti-k3-am64-enable-sdhci-nodes-at-the-board.patch @@ -0,0 +1,154 @@ +From 0166ae6b833a8846b1f95384ba2f5925885ff2c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 10:33:39 -0600 +Subject: arm64: dts: ti: k3-am64: Enable SDHCI nodes at the board level + +From: Andrew Davis + +[ Upstream commit 3b6345e3fcf4c93a79f396121cd0e6f98f04da13 ] + +SDHCI nodes defined in the top-level AM64 SoC dtsi files are incomplete +and will not be functional unless they are extended. + +As the attached SD/eMMC is only known about at the board integration level, +these nodes should only be enabled when provided with this information. + +Disable the SDHCI nodes in the dtsi files and only enable the ones that +are actually pinned out on a given board. + +Signed-off-by: Andrew Davis +Link: https://lore.kernel.org/r/20231117163339.89952-2-afd@ti.com +Signed-off-by: Nishanth Menon +Stable-dep-of: 379c7752bbd0 ("arm64: dts: ti: k3-am64-main: Fix ITAP/OTAP values for MMC") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am64-main.dtsi | 2 ++ + arch/arm64/boot/dts/ti/k3-am64-phycore-som.dtsi | 1 + + arch/arm64/boot/dts/ti/k3-am642-evm.dts | 6 ++++-- + arch/arm64/boot/dts/ti/k3-am642-phyboard-electra-rdk.dts | 1 + + arch/arm64/boot/dts/ti/k3-am642-sk.dts | 4 +++- + arch/arm64/boot/dts/ti/k3-am642-tqma64xxl-mbax4xxl.dts | 1 - + arch/arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi | 1 + + 7 files changed, 12 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am64-main.dtsi b/arch/arm64/boot/dts/ti/k3-am64-main.dtsi +index 0be642bc1b86d..c3300c36fdbcb 100644 +--- a/arch/arm64/boot/dts/ti/k3-am64-main.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am64-main.dtsi +@@ -623,6 +623,7 @@ sdhci0: mmc@fa10000 { + ti,otap-del-sel-mmc-hs = <0x0>; + ti,otap-del-sel-ddr52 = <0x6>; + ti,otap-del-sel-hs200 = <0x7>; ++ status = "disabled"; + }; + + sdhci1: mmc@fa00000 { +@@ -641,6 +642,7 @@ sdhci1: mmc@fa00000 { + ti,otap-del-sel-sdr104 = <0x6>; + ti,otap-del-sel-ddr50 = <0x9>; + ti,clkbuf-sel = <0x7>; ++ status = "disabled"; + }; + + cpsw3g: ethernet@8000000 { +diff --git a/arch/arm64/boot/dts/ti/k3-am64-phycore-som.dtsi b/arch/arm64/boot/dts/ti/k3-am64-phycore-som.dtsi +index f87f09d83c956..b8f844f667afc 100644 +--- a/arch/arm64/boot/dts/ti/k3-am64-phycore-som.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am64-phycore-som.dtsi +@@ -211,6 +211,7 @@ flash@0 { + }; + + &sdhci0 { ++ status = "okay"; + bus-width = <8>; + non-removable; + ti,driver-strength-ohm = <50>; +diff --git a/arch/arm64/boot/dts/ti/k3-am642-evm.dts b/arch/arm64/boot/dts/ti/k3-am642-evm.dts +index 4dba18941015d..256606be56fef 100644 +--- a/arch/arm64/boot/dts/ti/k3-am642-evm.dts ++++ b/arch/arm64/boot/dts/ti/k3-am642-evm.dts +@@ -487,17 +487,19 @@ eeprom@0 { + }; + }; + ++/* eMMC */ + &sdhci0 { +- /* emmc */ ++ status = "okay"; + bus-width = <8>; + non-removable; + ti,driver-strength-ohm = <50>; + disable-wp; + }; + ++/* SD/MMC */ + &sdhci1 { +- /* SD/MMC */ + bootph-all; ++ status = "okay"; + vmmc-supply = <&vdd_mmc1>; + pinctrl-names = "default"; + bus-width = <4>; +diff --git a/arch/arm64/boot/dts/ti/k3-am642-phyboard-electra-rdk.dts b/arch/arm64/boot/dts/ti/k3-am642-phyboard-electra-rdk.dts +index 9175e96842d82..53b64e55413f9 100644 +--- a/arch/arm64/boot/dts/ti/k3-am642-phyboard-electra-rdk.dts ++++ b/arch/arm64/boot/dts/ti/k3-am642-phyboard-electra-rdk.dts +@@ -264,6 +264,7 @@ &main_uart1 { + }; + + &sdhci1 { ++ status = "okay"; + vmmc-supply = <&vcc_3v3_mmc>; + pinctrl-names = "default"; + pinctrl-0 = <&main_mmc1_pins_default>; +diff --git a/arch/arm64/boot/dts/ti/k3-am642-sk.dts b/arch/arm64/boot/dts/ti/k3-am642-sk.dts +index f29c8a9b59ba7..bffbd234f715a 100644 +--- a/arch/arm64/boot/dts/ti/k3-am642-sk.dts ++++ b/arch/arm64/boot/dts/ti/k3-am642-sk.dts +@@ -439,6 +439,7 @@ &mcu_gpio0 { + }; + + &sdhci0 { ++ status = "okay"; + vmmc-supply = <&wlan_en>; + bus-width = <4>; + non-removable; +@@ -458,9 +459,10 @@ wlcore: wlcore@2 { + }; + }; + ++/* SD/MMC */ + &sdhci1 { +- /* SD/MMC */ + bootph-all; ++ status = "okay"; + vmmc-supply = <&vdd_mmc1>; + pinctrl-names = "default"; + bus-width = <4>; +diff --git a/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl-mbax4xxl.dts b/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl-mbax4xxl.dts +index d95d80076a427..55102d35cecc1 100644 +--- a/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl-mbax4xxl.dts ++++ b/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl-mbax4xxl.dts +@@ -425,7 +425,6 @@ &sdhci1 { + ti,driver-strength-ohm = <50>; + ti,fails-without-test-cd; + /* Enabled by overlay */ +- status = "disabled"; + }; + + &tscadc0 { +diff --git a/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi b/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi +index d82d4a98306a7..6c785eff7d2ff 100644 +--- a/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi +@@ -219,6 +219,7 @@ partitions { + }; + + &sdhci0 { ++ status = "okay"; + non-removable; + disable-wp; + no-sdio; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-ti-k3-am64-main-fix-itap-otap-values-for-m.patch b/queue-6.7/arm64-dts-ti-k3-am64-main-fix-itap-otap-values-for-m.patch new file mode 100644 index 00000000000..9b0bf83f9c4 --- /dev/null +++ b/queue-6.7/arm64-dts-ti-k3-am64-main-fix-itap-otap-values-for-m.patch @@ -0,0 +1,59 @@ +From fdf0d49b8cd7e8d35dd47f8a7e855f3f78137c44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 17:56:56 -0600 +Subject: arm64: dts: ti: k3-am64-main: Fix ITAP/OTAP values for MMC + +From: Judith Mendez + +[ Upstream commit 379c7752bbd0e81654544a896dd19c19ebb6faba ] + +Update MMC0/MMC1 OTAP/ITAP values according to the datasheet +[0], refer to Table 7-68 for MMC0 and Table 7-77 for MMC1. + +[0] https://www.ti.com/lit/ds/symlink/am6442.pdf + +Fixes: 8abae9389bdb ("arm64: dts: ti: Add support for AM642 SoC") +Signed-off-by: Judith Mendez +Tested-by: Wadim Egorov +Link: https://lore.kernel.org/r/20240213235701.2438513-5-jm@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am64-main.dtsi | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am64-main.dtsi b/arch/arm64/boot/dts/ti/k3-am64-main.dtsi +index c3300c36fdbcb..45042216e5b89 100644 +--- a/arch/arm64/boot/dts/ti/k3-am64-main.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am64-main.dtsi +@@ -623,6 +623,9 @@ sdhci0: mmc@fa10000 { + ti,otap-del-sel-mmc-hs = <0x0>; + ti,otap-del-sel-ddr52 = <0x6>; + ti,otap-del-sel-hs200 = <0x7>; ++ ti,itap-del-sel-legacy = <0x10>; ++ ti,itap-del-sel-mmc-hs = <0xa>; ++ ti,itap-del-sel-ddr52 = <0x3>; + status = "disabled"; + }; + +@@ -635,12 +638,16 @@ sdhci1: mmc@fa00000 { + clock-names = "clk_ahb", "clk_xin"; + ti,trm-icp = <0x2>; + ti,otap-del-sel-legacy = <0x0>; +- ti,otap-del-sel-sd-hs = <0xf>; ++ ti,otap-del-sel-sd-hs = <0x0>; + ti,otap-del-sel-sdr12 = <0xf>; + ti,otap-del-sel-sdr25 = <0xf>; + ti,otap-del-sel-sdr50 = <0xc>; + ti,otap-del-sel-sdr104 = <0x6>; + ti,otap-del-sel-ddr50 = <0x9>; ++ ti,itap-del-sel-legacy = <0x0>; ++ ti,itap-del-sel-sd-hs = <0x0>; ++ ti,itap-del-sel-sdr12 = <0x0>; ++ ti,itap-del-sel-sdr25 = <0x0>; + ti,clkbuf-sel = <0x7>; + status = "disabled"; + }; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-ti-k3-am69-sk-remove-assigned-clock-parent.patch b/queue-6.7/arm64-dts-ti-k3-am69-sk-remove-assigned-clock-parent.patch new file mode 100644 index 00000000000..d132d79b50f --- /dev/null +++ b/queue-6.7/arm64-dts-ti-k3-am69-sk-remove-assigned-clock-parent.patch @@ -0,0 +1,55 @@ +From 30d6018cf5e29a1f5c9a064a24144e01569afb58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Feb 2024 19:53:08 +0530 +Subject: arm64: dts: ti: k3-am69-sk: remove assigned-clock-parents for unused + VP + +From: Jayesh Choudhary + +[ Upstream commit cfdb4f7ffdb855c1a3d274dc7757e780dcbf2d55 ] + +VP2 and VP3 are unused video ports and VP3 share the same parent +clock as VP1 causing issue with pixel clock setting for HDMI (VP1). +The current DM firmware does not support changing parent clock if it +is shared by another component. It returns 0 for the determine_rate +query before causing set_rate to set the clock at default maximum of +1.8GHz which is a lot more than the maximum frequency videoports can +support (600MHz) causing SYNC LOST issues. +So remove the parent clocks for unused VPs to avoid conflict. + +Fixes: 6f8605fd7d11 ("arm64: dts: ti: k3-am69-sk: Add DP and HDMI support") +Reported-by: Nishanth Menon +Signed-off-by: Jayesh Choudhary +Reviewed-by: Tomi Valkeinen +Reviewed-by: Aradhya Bhatia +Tested-by: Enric Balletbo i Serra +Link: https://lore.kernel.org/r/20240201142308.4954-1-j-choudhary@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am69-sk.dts | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am69-sk.dts b/arch/arm64/boot/dts/ti/k3-am69-sk.dts +index 9868c7049bfb9..fafa09d6dcc64 100644 +--- a/arch/arm64/boot/dts/ti/k3-am69-sk.dts ++++ b/arch/arm64/boot/dts/ti/k3-am69-sk.dts +@@ -824,13 +824,9 @@ &dss { + pinctrl-names = "default"; + pinctrl-0 = <&dss_vout0_pins_default>; + assigned-clocks = <&k3_clks 218 2>, +- <&k3_clks 218 5>, +- <&k3_clks 218 14>, +- <&k3_clks 218 18>; ++ <&k3_clks 218 5>; + assigned-clock-parents = <&k3_clks 218 3>, +- <&k3_clks 218 7>, +- <&k3_clks 218 16>, +- <&k3_clks 218 22>; ++ <&k3_clks 218 7>; + }; + + &serdes_wiz4 { +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-ti-k3-j7200-common-proc-board-modify-pinmu.patch b/queue-6.7/arm64-dts-ti-k3-j7200-common-proc-board-modify-pinmu.patch new file mode 100644 index 00000000000..6aa7650e180 --- /dev/null +++ b/queue-6.7/arm64-dts-ti-k3-j7200-common-proc-board-modify-pinmu.patch @@ -0,0 +1,64 @@ +From 82ad96b6a430403601b7b873f197315c3ae9e024 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 16:28:43 +0530 +Subject: arm64: dts: ti: k3-j7200-common-proc-board: Modify Pinmux for + wkup_uart0 and mcu_uart0 + +From: Bhavya Kapoor + +[ Upstream commit 566feddd2ba5e29d9ccab36d6508592ae563f275 ] + +WKUP_PADCONFIG registers for wkup_uart0 and mcu_uart0 lies +under wkup_pmx2 for J7200. Thus, modify pinmux for both +of them. + +Fixes: 3709ea7f960e ("arm64: dts: ti: k3-j7200-common-proc-board: Add uart pinmux") +Signed-off-by: Bhavya Kapoor +Link: https://lore.kernel.org/r/20240214105846.1096733-2-b-kapoor@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + .../boot/dts/ti/k3-j7200-common-proc-board.dts | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts +index cee2b4b0eb87d..53594c5fb8e8f 100644 +--- a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts ++++ b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts +@@ -91,24 +91,25 @@ vdd_sd_dv: gpio-regulator-TLV71033 { + }; + + &wkup_pmx0 { ++}; ++ ++&wkup_pmx2 { + mcu_uart0_pins_default: mcu-uart0-default-pins { + pinctrl-single,pins = < +- J721E_WKUP_IOPAD(0xf4, PIN_INPUT, 0) /* (D20) MCU_UART0_RXD */ +- J721E_WKUP_IOPAD(0xf0, PIN_OUTPUT, 0) /* (D19) MCU_UART0_TXD */ +- J721E_WKUP_IOPAD(0xf8, PIN_INPUT, 0) /* (E20) MCU_UART0_CTSn */ +- J721E_WKUP_IOPAD(0xfc, PIN_OUTPUT, 0) /* (E21) MCU_UART0_RTSn */ ++ J721E_WKUP_IOPAD(0x90, PIN_INPUT, 0) /* (E20) MCU_UART0_CTSn */ ++ J721E_WKUP_IOPAD(0x94, PIN_OUTPUT, 0) /* (E21) MCU_UART0_RTSn */ ++ J721E_WKUP_IOPAD(0x8c, PIN_INPUT, 0) /* (D20) MCU_UART0_RXD */ ++ J721E_WKUP_IOPAD(0x88, PIN_OUTPUT, 0) /* (D19) MCU_UART0_TXD */ + >; + }; + + wkup_uart0_pins_default: wkup-uart0-default-pins { + pinctrl-single,pins = < +- J721E_WKUP_IOPAD(0xb0, PIN_INPUT, 0) /* (B14) WKUP_UART0_RXD */ +- J721E_WKUP_IOPAD(0xb4, PIN_OUTPUT, 0) /* (A14) WKUP_UART0_TXD */ ++ J721E_WKUP_IOPAD(0x48, PIN_INPUT, 0) /* (B14) WKUP_UART0_RXD */ ++ J721E_WKUP_IOPAD(0x4c, PIN_OUTPUT, 0) /* (A14) WKUP_UART0_TXD */ + >; + }; +-}; + +-&wkup_pmx2 { + mcu_cpsw_pins_default: mcu-cpsw-default-pins { + pinctrl-single,pins = < + J721E_WKUP_IOPAD(0x0000, PIN_OUTPUT, 0) /* MCU_RGMII1_TX_CTL */ +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-ti-k3-j7200-common-proc-board-remove-clock.patch b/queue-6.7/arm64-dts-ti-k3-j7200-common-proc-board-remove-clock.patch new file mode 100644 index 00000000000..d2927f6c155 --- /dev/null +++ b/queue-6.7/arm64-dts-ti-k3-j7200-common-proc-board-remove-clock.patch @@ -0,0 +1,38 @@ +From ee9d18630269f51cd2a4bd03fac535157034f9e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 16:28:44 +0530 +Subject: arm64: dts: ti: k3-j7200-common-proc-board: Remove clock-frequency + from mcu_uart0 + +From: Bhavya Kapoor + +[ Upstream commit 0fa8b0e2083d333e4854b9767fb893f924e70ae5 ] + +Clock-frequency property is already present in mcu_uart0 node of the +k3-j7200-mcu-wakeup.dtsi file. Thus, remove redundant clock-frequency +property from mcu_uart0 node. + +Fixes: 3709ea7f960e ("arm64: dts: ti: k3-j7200-common-proc-board: Add uart pinmux") +Signed-off-by: Bhavya Kapoor +Link: https://lore.kernel.org/r/20240214105846.1096733-3-b-kapoor@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts +index 53594c5fb8e8f..7a0c599f2b1c3 100644 +--- a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts ++++ b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts +@@ -211,7 +211,6 @@ &mcu_uart0 { + status = "okay"; + pinctrl-names = "default"; + pinctrl-0 = <&mcu_uart0_pins_default>; +- clock-frequency = <96000000>; + }; + + &main_uart0 { +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-ti-k3-j721s2-common-proc-board-remove-pinm.patch b/queue-6.7/arm64-dts-ti-k3-j721s2-common-proc-board-remove-pinm.patch new file mode 100644 index 00000000000..c503a88fe84 --- /dev/null +++ b/queue-6.7/arm64-dts-ti-k3-j721s2-common-proc-board-remove-pinm.patch @@ -0,0 +1,40 @@ +From 2bad71345ecc5f3126287ed23e92be9636cc965f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 16:28:45 +0530 +Subject: arm64: dts: ti: k3-j721s2-common-proc-board: Remove Pinmux for CTS + and RTS in wkup_uart0 + +From: Bhavya Kapoor + +[ Upstream commit 28e5b74d524050008edf415f20a3e38907b8f176 ] + +Only Tx and Rx Signal lines for wkup_uart0 are brought out on +the Common Proc Board through SoM, but CTS and RTS signal lines +are not brought on the board. Thus, remove pinmux for CTS and RTS +signal lines for wkup_uart0 in J721S2. + +Fixes: f5e9ee0b354a ("arm64: dts: ti: k3-j721s2-common-proc-board: Add uart pinmux") +Signed-off-by: Bhavya Kapoor +Link: https://lore.kernel.org/r/20240214105846.1096733-4-b-kapoor@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-j721s2-common-proc-board.dts | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-j721s2-common-proc-board.dts b/arch/arm64/boot/dts/ti/k3-j721s2-common-proc-board.dts +index c6b85bbf9a179..1ba1f53c72d03 100644 +--- a/arch/arm64/boot/dts/ti/k3-j721s2-common-proc-board.dts ++++ b/arch/arm64/boot/dts/ti/k3-j721s2-common-proc-board.dts +@@ -190,8 +190,6 @@ J721S2_IOPAD(0x038, PIN_OUTPUT, 0) /* (AB28) MCASP0_ACLKX.MCAN5_TX */ + &wkup_pmx2 { + wkup_uart0_pins_default: wkup-uart0-default-pins { + pinctrl-single,pins = < +- J721S2_WKUP_IOPAD(0x070, PIN_INPUT, 0) /* (E25) WKUP_GPIO0_6.WKUP_UART0_CTSn */ +- J721S2_WKUP_IOPAD(0x074, PIN_OUTPUT, 0) /* (F28) WKUP_GPIO0_7.WKUP_UART0_RTSn */ + J721S2_WKUP_IOPAD(0x048, PIN_INPUT, 0) /* (D28) WKUP_UART0_RXD */ + J721S2_WKUP_IOPAD(0x04c, PIN_OUTPUT, 0) /* (D27) WKUP_UART0_TXD */ + >; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-ti-k3-j721s2-fix-power-domain-for-vtm-node.patch b/queue-6.7/arm64-dts-ti-k3-j721s2-fix-power-domain-for-vtm-node.patch new file mode 100644 index 00000000000..04e33393b41 --- /dev/null +++ b/queue-6.7/arm64-dts-ti-k3-j721s2-fix-power-domain-for-vtm-node.patch @@ -0,0 +1,38 @@ +From 05592b2d8615a8a03fe5e21038c74f84c3922eae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Feb 2024 13:37:26 +0530 +Subject: arm64: dts: ti: k3-j721s2: Fix power domain for VTM node + +From: Manorit Chawdhry + +[ Upstream commit 5ef196ed912e80a1e64936119ced8d7eb5635f0f ] + +Fix the power domain device ID for wkup_vtm0 node. + +Link: https://software-dl.ti.com/tisci/esd/latest/5_soc_doc/j721s2/devices.html +Fixes: d148e3fe52c8 ("arm64: dts: ti: j721s2: Add VTM node") +Signed-off-by: Manorit Chawdhry +Reviewed-by: Andrew Davis +Link: https://lore.kernel.org/r/20240201-b4-upstream-j721s2-fix-vtm-devid-v2-1-85fd568b77e3@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-j721s2-mcu-wakeup.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-j721s2-mcu-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-j721s2-mcu-wakeup.dtsi +index 7254f3bd3634d..c9cf1dc04f7d9 100644 +--- a/arch/arm64/boot/dts/ti/k3-j721s2-mcu-wakeup.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-j721s2-mcu-wakeup.dtsi +@@ -652,7 +652,7 @@ wkup_vtm0: temperature-sensor@42040000 { + compatible = "ti,j7200-vtm"; + reg = <0x00 0x42040000 0x0 0x350>, + <0x00 0x42050000 0x0 0x350>; +- power-domains = <&k3_pds 154 TI_SCI_PD_SHARED>; ++ power-domains = <&k3_pds 180 TI_SCI_PD_SHARED>; + #thermal-sensor-cells = <1>; + }; + +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-ti-k3-j784s4-evm-remove-pinmux-for-cts-and.patch b/queue-6.7/arm64-dts-ti-k3-j784s4-evm-remove-pinmux-for-cts-and.patch new file mode 100644 index 00000000000..f4656a2e678 --- /dev/null +++ b/queue-6.7/arm64-dts-ti-k3-j784s4-evm-remove-pinmux-for-cts-and.patch @@ -0,0 +1,40 @@ +From 7ddb44bfb85a746cad926d9a5dd52b6bb9fb7e9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 16:28:46 +0530 +Subject: arm64: dts: ti: k3-j784s4-evm: Remove Pinmux for CTS and RTS in + wkup_uart0 + +From: Bhavya Kapoor + +[ Upstream commit d29a6cf980572d8cf7b63935716fca663e2610f0 ] + +Only Tx and Rx Signal lines for wkup_uart0 are brought out on +the J784S4 EVM from SoC, but CTS and RTS signal lines are not +brought on the EVM. Thus, remove pinmux for CTS and RTS signal +lines for wkup_uart0 in J784S4. + +Fixes: 6fa5d37a2f34 ("arm64: dts: ti: k3-j784s4-evm: Add mcu and wakeup uarts") +Signed-off-by: Bhavya Kapoor +Link: https://lore.kernel.org/r/20240214105846.1096733-5-b-kapoor@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-j784s4-evm.dts | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts b/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts +index f1f4c8634ab69..50210700fdc8e 100644 +--- a/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts ++++ b/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts +@@ -331,8 +331,6 @@ &wkup_pmx2 { + wkup_uart0_pins_default: wkup-uart0-default-pins { + bootph-all; + pinctrl-single,pins = < +- J721S2_WKUP_IOPAD(0x070, PIN_INPUT, 0) /* (L37) WKUP_GPIO0_6.WKUP_UART0_CTSn */ +- J721S2_WKUP_IOPAD(0x074, PIN_INPUT, 0) /* (L36) WKUP_GPIO0_7.WKUP_UART0_RTSn */ + J721S2_WKUP_IOPAD(0x048, PIN_INPUT, 0) /* (K35) WKUP_UART0_RXD */ + J721S2_WKUP_IOPAD(0x04c, PIN_INPUT, 0) /* (K34) WKUP_UART0_TXD */ + >; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-ti-k3-j784s4-fix-power-domain-for-vtm-node.patch b/queue-6.7/arm64-dts-ti-k3-j784s4-fix-power-domain-for-vtm-node.patch new file mode 100644 index 00000000000..3a6b77ca2b7 --- /dev/null +++ b/queue-6.7/arm64-dts-ti-k3-j784s4-fix-power-domain-for-vtm-node.patch @@ -0,0 +1,38 @@ +From 3b06d077dad6ea0069785ce3fa2c9d98ed9d381b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Feb 2024 13:37:27 +0530 +Subject: arm64: dts: ti: k3-j784s4: Fix power domain for VTM node + +From: Manorit Chawdhry + +[ Upstream commit e4d252e6d29208aea56d4c04270523e306b1e3c2 ] + +Fix the power domain device ID for wkup_vtm0 node. + +Link: https://software-dl.ti.com/tisci/esd/latest/5_soc_doc/j784s4/devices.html +Fixes: 64821fbf6738 ("arm64: dts: ti: j784s4: Add VTM node") +Signed-off-by: Manorit Chawdhry +Reviewed-by: Andrew Davis +Link: https://lore.kernel.org/r/20240201-b4-upstream-j721s2-fix-vtm-devid-v2-2-85fd568b77e3@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-j784s4-mcu-wakeup.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-j784s4-mcu-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-j784s4-mcu-wakeup.dtsi +index adb5ea6b97321..37fc48aae6945 100644 +--- a/arch/arm64/boot/dts/ti/k3-j784s4-mcu-wakeup.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-j784s4-mcu-wakeup.dtsi +@@ -616,7 +616,7 @@ wkup_vtm0: temperature-sensor@42040000 { + compatible = "ti,j7200-vtm"; + reg = <0x00 0x42040000 0x00 0x350>, + <0x00 0x42050000 0x00 0x350>; +- power-domains = <&k3_pds 154 TI_SCI_PD_SHARED>; ++ power-domains = <&k3_pds 243 TI_SCI_PD_SHARED>; + #thermal-sensor-cells = <1>; + }; + +-- +2.43.0 + diff --git a/queue-6.7/arm64-ftrace-don-t-forbid-call_ops-cc_optimize_for_s.patch b/queue-6.7/arm64-ftrace-don-t-forbid-call_ops-cc_optimize_for_s.patch new file mode 100644 index 00000000000..c8816fad51f --- /dev/null +++ b/queue-6.7/arm64-ftrace-don-t-forbid-call_ops-cc_optimize_for_s.patch @@ -0,0 +1,52 @@ +From c330a1f22774b2bc43ae087242e49537914fbda4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 22:40:29 -0800 +Subject: arm64: ftrace: Don't forbid CALL_OPS+CC_OPTIMIZE_FOR_SIZE with Clang + +From: Stephen Boyd + +[ Upstream commit a743f26d03a96593c0f3d05dc26b388f45de67c9 ] + +Per commit b3f11af9b2ce ("arm64: ftrace: forbid CALL_OPS with +CC_OPTIMIZE_FOR_SIZE"), GCC is silently ignoring `-falign-functions=N` +when passed `-Os`, causing functions to be improperly aligned. This +doesn't seem to be a problem with Clang though, where enabling CALL_OPS +with CC_OPTIMIZE_FOR_SIZE doesn't spit out any warnings at boot about +misaligned patch-sites. Only forbid CALL_OPS if GCC is used and we're +optimizing for size so that CALL_OPS can be used with clang optimizing +for size. + +Cc: Jason Ling +Cc: Florian Fainelli +Cc: Mark Rutland +Cc: Nathan Chancellor +Cc: Nick Desaulniers +Cc: Bill Wendling +Cc: Justin Stitt +Cc: llvm@lists.linux.dev +Fixes: b3f11af9b2ce ("arm64: ftrace: forbid CALL_OPS with CC_OPTIMIZE_FOR_SIZE") +Signed-off-by: Stephen Boyd +Reviewed-by: Nathan Chancellor +Link: https://lore.kernel.org/r/20240223064032.3463229-1-swboyd@chromium.org +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index 456e8680e16ea..77dfbc8ab2d3b 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -196,7 +196,7 @@ config ARM64 + if DYNAMIC_FTRACE_WITH_ARGS && DYNAMIC_FTRACE_WITH_CALL_OPS + select HAVE_DYNAMIC_FTRACE_WITH_CALL_OPS \ + if (DYNAMIC_FTRACE_WITH_ARGS && !CFI_CLANG && \ +- !CC_OPTIMIZE_FOR_SIZE) ++ (CC_IS_CLANG || !CC_OPTIMIZE_FOR_SIZE)) + select FTRACE_MCOUNT_USE_PATCHABLE_FUNCTION_ENTRY \ + if DYNAMIC_FTRACE_WITH_ARGS + select HAVE_SAMPLE_FTRACE_DIRECT +-- +2.43.0 + diff --git a/queue-6.7/asoc-amd-acp-add-missing-error-handling-in-sof-mach.patch b/queue-6.7/asoc-amd-acp-add-missing-error-handling-in-sof-mach.patch new file mode 100644 index 00000000000..98a9bbb3765 --- /dev/null +++ b/queue-6.7/asoc-amd-acp-add-missing-error-handling-in-sof-mach.patch @@ -0,0 +1,54 @@ +From ff269d19841758ab4334676c4bbf533b26e19df8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 05:07:21 +0200 +Subject: ASoC: amd: acp: Add missing error handling in sof-mach + +From: Cristian Ciocaltea + +[ Upstream commit d0ada20279db2649a7549a2b8a4a3379c59f238d ] + +Handle potential acp_sofdsp_dai_links_create() errors in ACP SOF machine +driver's probe function. Note there is no need for an undo. + +While at it, switch to dev_err_probe(). + +Fixes: 9f84940f5004 ("ASoC: amd: acp: Add SOF audio support on Chrome board") +Signed-off-by: Cristian Ciocaltea +Reviewed-by: Emil Velikov +Link: https://msgid.link/r/20231219030728.2431640-4-cristian.ciocaltea@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/acp/acp-sof-mach.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/sound/soc/amd/acp/acp-sof-mach.c b/sound/soc/amd/acp/acp-sof-mach.c +index 5223033a122f8..354d0fc55299b 100644 +--- a/sound/soc/amd/acp/acp-sof-mach.c ++++ b/sound/soc/amd/acp/acp-sof-mach.c +@@ -120,16 +120,14 @@ static int acp_sof_probe(struct platform_device *pdev) + if (dmi_id && dmi_id->driver_data) + acp_card_drvdata->tdm_mode = dmi_id->driver_data; + +- acp_sofdsp_dai_links_create(card); ++ ret = acp_sofdsp_dai_links_create(card); ++ if (ret) ++ return dev_err_probe(&pdev->dev, ret, "Failed to create DAI links\n"); + + ret = devm_snd_soc_register_card(&pdev->dev, card); +- if (ret) { +- dev_err(&pdev->dev, +- "devm_snd_soc_register_card(%s) failed: %d\n", +- card->name, ret); +- return ret; +- } +- ++ if (ret) ++ return dev_err_probe(&pdev->dev, ret, ++ "Failed to register card(%s)\n", card->name); + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.7/asoc-meson-aiu-fix-function-pointer-type-mismatch.patch b/queue-6.7/asoc-meson-aiu-fix-function-pointer-type-mismatch.patch new file mode 100644 index 00000000000..9cce5cea87e --- /dev/null +++ b/queue-6.7/asoc-meson-aiu-fix-function-pointer-type-mismatch.patch @@ -0,0 +1,85 @@ +From 448ad4cfd01c97d8e7beab1b1ebe26369fc0b79b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 22:58:03 +0100 +Subject: ASoC: meson: aiu: fix function pointer type mismatch + +From: Jerome Brunet + +[ Upstream commit 98ac85a00f31d2e9d5452b825a9ed0153d934043 ] + +clang-16 warns about casting functions to incompatible types, as is done +here to call clk_disable_unprepare: + +sound/soc/meson/aiu.c:243:12: error: cast from 'void (*)(struct clk *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict] + 243 | (void(*)(void *))clk_disable_unprepare, + +The pattern of getting, enabling and setting a disable callback for a +clock can be replaced with devm_clk_get_enabled(), which also fixes +this warning. + +Fixes: 6ae9ca9ce986 ("ASoC: meson: aiu: add i2s and spdif support") +Reported-by: Arnd Bergmann +Signed-off-by: Jerome Brunet +Reviewed-by: Justin Stitt +Link: https://msgid.link/r/20240213215807.3326688-2-jbrunet@baylibre.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/meson/aiu.c | 19 ++++--------------- + sound/soc/meson/aiu.h | 1 - + 2 files changed, 4 insertions(+), 16 deletions(-) + +diff --git a/sound/soc/meson/aiu.c b/sound/soc/meson/aiu.c +index 7109b81cc3d0a..5d1419ed7a62d 100644 +--- a/sound/soc/meson/aiu.c ++++ b/sound/soc/meson/aiu.c +@@ -212,11 +212,12 @@ static const char * const aiu_spdif_ids[] = { + static int aiu_clk_get(struct device *dev) + { + struct aiu *aiu = dev_get_drvdata(dev); ++ struct clk *pclk; + int ret; + +- aiu->pclk = devm_clk_get(dev, "pclk"); +- if (IS_ERR(aiu->pclk)) +- return dev_err_probe(dev, PTR_ERR(aiu->pclk), "Can't get the aiu pclk\n"); ++ pclk = devm_clk_get_enabled(dev, "pclk"); ++ if (IS_ERR(pclk)) ++ return dev_err_probe(dev, PTR_ERR(pclk), "Can't get the aiu pclk\n"); + + aiu->spdif_mclk = devm_clk_get(dev, "spdif_mclk"); + if (IS_ERR(aiu->spdif_mclk)) +@@ -233,18 +234,6 @@ static int aiu_clk_get(struct device *dev) + if (ret) + return dev_err_probe(dev, ret, "Can't get the spdif clocks\n"); + +- ret = clk_prepare_enable(aiu->pclk); +- if (ret) { +- dev_err(dev, "peripheral clock enable failed\n"); +- return ret; +- } +- +- ret = devm_add_action_or_reset(dev, +- (void(*)(void *))clk_disable_unprepare, +- aiu->pclk); +- if (ret) +- dev_err(dev, "failed to add reset action on pclk"); +- + return ret; + } + +diff --git a/sound/soc/meson/aiu.h b/sound/soc/meson/aiu.h +index 393b6c2307e49..0f94c8bf60818 100644 +--- a/sound/soc/meson/aiu.h ++++ b/sound/soc/meson/aiu.h +@@ -33,7 +33,6 @@ struct aiu_platform_data { + }; + + struct aiu { +- struct clk *pclk; + struct clk *spdif_mclk; + struct aiu_interface i2s; + struct aiu_interface spdif; +-- +2.43.0 + diff --git a/queue-6.7/asoc-meson-axg-tdm-interface-add-frame-rate-constrai.patch b/queue-6.7/asoc-meson-axg-tdm-interface-add-frame-rate-constrai.patch new file mode 100644 index 00000000000..9375d320518 --- /dev/null +++ b/queue-6.7/asoc-meson-axg-tdm-interface-add-frame-rate-constrai.patch @@ -0,0 +1,86 @@ +From 3b75e4fb153b7ee6c392fe5b4cdc2a076c807cc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 18:51:08 +0100 +Subject: ASoC: meson: axg-tdm-interface: add frame rate constraint + +From: Jerome Brunet + +[ Upstream commit 59c6a3a43b221cc2a211181b1298e43b2c2df782 ] + +According to Amlogic datasheets for the SoCs supported by this driver, the +maximum bit clock rate is 100MHz. + +The tdm interface allows the rates listed by the DAI driver, regardless of +the number slots or their width. However, these will impact the bit clock +rate. + +Hitting the 100MHz limit is very unlikely for most use cases but it is +possible. + +For example with 32 slots / 32 bits wide, the maximum rate is no longer +384kHz but ~96kHz. + +Add the constraint accordingly if the component is not already active. +If it is active, the rate is already constrained by the first stream rate. + +Fixes: d60e4f1e4be5 ("ASoC: meson: add tdm interface driver") +Signed-off-by: Jerome Brunet +Link: https://msgid.link/r/20240223175116.2005407-3-jbrunet@baylibre.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/meson/axg-tdm-interface.c | 25 ++++++++++++++++++------- + 1 file changed, 18 insertions(+), 7 deletions(-) + +diff --git a/sound/soc/meson/axg-tdm-interface.c b/sound/soc/meson/axg-tdm-interface.c +index cd5168e826df4..2cedbce738373 100644 +--- a/sound/soc/meson/axg-tdm-interface.c ++++ b/sound/soc/meson/axg-tdm-interface.c +@@ -12,6 +12,9 @@ + + #include "axg-tdm.h" + ++/* Maximum bit clock frequency according the datasheets */ ++#define MAX_SCLK 100000000 /* Hz */ ++ + enum { + TDM_IFACE_PAD, + TDM_IFACE_LOOPBACK, +@@ -153,19 +156,27 @@ static int axg_tdm_iface_startup(struct snd_pcm_substream *substream, + return -EINVAL; + } + +- /* Apply component wide rate symmetry */ + if (snd_soc_component_active(dai->component)) { ++ /* Apply component wide rate symmetry */ + ret = snd_pcm_hw_constraint_single(substream->runtime, + SNDRV_PCM_HW_PARAM_RATE, + iface->rate); +- if (ret < 0) { +- dev_err(dai->dev, +- "can't set iface rate constraint\n"); +- return ret; +- } ++ ++ } else { ++ /* Limit rate according to the slot number and width */ ++ unsigned int max_rate = ++ MAX_SCLK / (iface->slots * iface->slot_width); ++ ret = snd_pcm_hw_constraint_minmax(substream->runtime, ++ SNDRV_PCM_HW_PARAM_RATE, ++ 0, max_rate); + } + +- return 0; ++ if (ret < 0) ++ dev_err(dai->dev, "can't set iface rate constraint\n"); ++ else ++ ret = 0; ++ ++ return ret; + } + + static int axg_tdm_iface_set_stream(struct snd_pcm_substream *substream, +-- +2.43.0 + diff --git a/queue-6.7/asoc-meson-axg-tdm-interface-fix-mclk-setup-without-.patch b/queue-6.7/asoc-meson-axg-tdm-interface-fix-mclk-setup-without-.patch new file mode 100644 index 00000000000..176a9a115c5 --- /dev/null +++ b/queue-6.7/asoc-meson-axg-tdm-interface-fix-mclk-setup-without-.patch @@ -0,0 +1,49 @@ +From 676faabd0cab3d18f726f3f8e395403e5bfef33d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 18:51:07 +0100 +Subject: ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs + +From: Jerome Brunet + +[ Upstream commit e3741a8d28a1137f8b19ae6f3d6e3be69a454a0a ] + +By default, when mclk-fs is not provided, the tdm-interface driver +requests an MCLK that is 4x the bit clock, SCLK. + +However there is no justification for this: + +* If the codec needs MCLK for its operation, mclk-fs is expected to be set + according to the codec requirements. +* If the codec does not need MCLK the minimum is 2 * SCLK, because this is + minimum the divider between SCLK and MCLK can do. + +Multiplying by 4 may cause problems because the PLL limit may be reached +sooner than it should, so use 2x instead. + +Fixes: d60e4f1e4be5 ("ASoC: meson: add tdm interface driver") +Signed-off-by: Jerome Brunet +Link: https://msgid.link/r/20240223175116.2005407-2-jbrunet@baylibre.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/meson/axg-tdm-interface.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/meson/axg-tdm-interface.c b/sound/soc/meson/axg-tdm-interface.c +index 1c3d433cefd23..cd5168e826df4 100644 +--- a/sound/soc/meson/axg-tdm-interface.c ++++ b/sound/soc/meson/axg-tdm-interface.c +@@ -264,8 +264,8 @@ static int axg_tdm_iface_set_sclk(struct snd_soc_dai *dai, + srate = iface->slots * iface->slot_width * params_rate(params); + + if (!iface->mclk_rate) { +- /* If no specific mclk is requested, default to bit clock * 4 */ +- clk_set_rate(iface->mclk, 4 * srate); ++ /* If no specific mclk is requested, default to bit clock * 2 */ ++ clk_set_rate(iface->mclk, 2 * srate); + } else { + /* Check if we can actually get the bit clock from mclk */ + if (iface->mclk_rate % srate) { +-- +2.43.0 + diff --git a/queue-6.7/asoc-meson-t9015-fix-function-pointer-type-mismatch.patch b/queue-6.7/asoc-meson-t9015-fix-function-pointer-type-mismatch.patch new file mode 100644 index 00000000000..cc6bd03d80e --- /dev/null +++ b/queue-6.7/asoc-meson-t9015-fix-function-pointer-type-mismatch.patch @@ -0,0 +1,83 @@ +From b16be65c2321c52717c4e8d51f3dfbe9f3871190 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 22:58:04 +0100 +Subject: ASoC: meson: t9015: fix function pointer type mismatch + +From: Jerome Brunet + +[ Upstream commit 5ad992c71b6a8e8a547954addc7af9fbde6ca10a ] + +clang-16 warns about casting functions to incompatible types, as is done +here to call clk_disable_unprepare: + +sound/soc/meson/t9015.c:274:4: error: cast from 'void (*)(struct clk *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict] + 274 | (void(*)(void *))clk_disable_unprepare, + +The pattern of getting, enabling and setting a disable callback for a +clock can be replaced with devm_clk_get_enabled(), which also fixes +this warning. + +Fixes: 33901f5b9b16 ("ASoC: meson: add t9015 internal DAC driver") +Reported-by: Arnd Bergmann +Signed-off-by: Jerome Brunet +Reviewed-by: Justin Stitt +Link: https://msgid.link/r/20240213215807.3326688-3-jbrunet@baylibre.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/meson/t9015.c | 20 ++++---------------- + 1 file changed, 4 insertions(+), 16 deletions(-) + +diff --git a/sound/soc/meson/t9015.c b/sound/soc/meson/t9015.c +index 9c6b4dac68932..571f65788c592 100644 +--- a/sound/soc/meson/t9015.c ++++ b/sound/soc/meson/t9015.c +@@ -48,7 +48,6 @@ + #define POWER_CFG 0x10 + + struct t9015 { +- struct clk *pclk; + struct regulator *avdd; + }; + +@@ -249,6 +248,7 @@ static int t9015_probe(struct platform_device *pdev) + struct t9015 *priv; + void __iomem *regs; + struct regmap *regmap; ++ struct clk *pclk; + int ret; + + priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL); +@@ -256,26 +256,14 @@ static int t9015_probe(struct platform_device *pdev) + return -ENOMEM; + platform_set_drvdata(pdev, priv); + +- priv->pclk = devm_clk_get(dev, "pclk"); +- if (IS_ERR(priv->pclk)) +- return dev_err_probe(dev, PTR_ERR(priv->pclk), "failed to get core clock\n"); ++ pclk = devm_clk_get_enabled(dev, "pclk"); ++ if (IS_ERR(pclk)) ++ return dev_err_probe(dev, PTR_ERR(pclk), "failed to get core clock\n"); + + priv->avdd = devm_regulator_get(dev, "AVDD"); + if (IS_ERR(priv->avdd)) + return dev_err_probe(dev, PTR_ERR(priv->avdd), "failed to AVDD\n"); + +- ret = clk_prepare_enable(priv->pclk); +- if (ret) { +- dev_err(dev, "core clock enable failed\n"); +- return ret; +- } +- +- ret = devm_add_action_or_reset(dev, +- (void(*)(void *))clk_disable_unprepare, +- priv->pclk); +- if (ret) +- return ret; +- + ret = device_reset(dev); + if (ret) { + dev_err(dev, "reset failed\n"); +-- +2.43.0 + diff --git a/queue-6.7/asoc-sh-rz-ssi-fix-error-message-print.patch b/queue-6.7/asoc-sh-rz-ssi-fix-error-message-print.patch new file mode 100644 index 00000000000..18ca84843af --- /dev/null +++ b/queue-6.7/asoc-sh-rz-ssi-fix-error-message-print.patch @@ -0,0 +1,39 @@ +From 973aaf08e4e244f3cbf33a472c775d7370305787 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Jan 2024 15:08:22 +0000 +Subject: ASoC: sh: rz-ssi: Fix error message print + +From: Lad Prabhakar + +[ Upstream commit 9a6d7c4fb2801b675a9c31a7ceb78c84b8c439bc ] + +The devm_request_irq() call is done for "dma_rt" interrupt but the error +message printed "dma_tx" interrupt on failure, fix this by updating +dma_tx -> dma_rt in dev_err_probe() message. While at it aligned the code. + +Signed-off-by: Lad Prabhakar +Fixes: 38c042b59af0248a ("ASoC: sh: rz-ssi: Update interrupt handling for half duplex channels") +Reviewed-by: Geert Uytterhoeven +Link: https://msgid.link/r/20240130150822.327434-1-prabhakar.mahadev-lad.rj@bp.renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rz-ssi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/sh/rz-ssi.c b/sound/soc/sh/rz-ssi.c +index 14cf1a41fb0d1..9d103646973ad 100644 +--- a/sound/soc/sh/rz-ssi.c ++++ b/sound/soc/sh/rz-ssi.c +@@ -1015,7 +1015,7 @@ static int rz_ssi_probe(struct platform_device *pdev) + dev_name(&pdev->dev), ssi); + if (ret < 0) + return dev_err_probe(&pdev->dev, ret, +- "irq request error (dma_tx)\n"); ++ "irq request error (dma_rt)\n"); + } else { + if (ssi->irq_tx < 0) + return ssi->irq_tx; +-- +2.43.0 + diff --git a/queue-6.7/asoc-sof-add-some-bounds-checking-to-firmware-data.patch b/queue-6.7/asoc-sof-add-some-bounds-checking-to-firmware-data.patch new file mode 100644 index 00000000000..62a2b7e708b --- /dev/null +++ b/queue-6.7/asoc-sof-add-some-bounds-checking-to-firmware-data.patch @@ -0,0 +1,39 @@ +From a6ada617b15ef531a123012975820961c32aa7a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Feb 2024 16:02:16 +0300 +Subject: ASoC: SOF: Add some bounds checking to firmware data + +From: Dan Carpenter + +[ Upstream commit 98f681b0f84cfc3a1d83287b77697679e0398306 ] + +Smatch complains about "head->full_size - head->header_size" can +underflow. To some extent, we're always going to have to trust the +firmware a bit. However, it's easy enough to add a check for negatives, +and let's add a upper bounds check as well. + +Fixes: d2458baa799f ("ASoC: SOF: ipc3-loader: Implement firmware parsing and loading") +Signed-off-by: Dan Carpenter +Link: https://msgid.link/r/5593d147-058c-4de3-a6f5-540ecb96f6f8@moroto.mountain +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/ipc3-loader.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/sof/ipc3-loader.c b/sound/soc/sof/ipc3-loader.c +index 28218766d2114..6e3ef06721106 100644 +--- a/sound/soc/sof/ipc3-loader.c ++++ b/sound/soc/sof/ipc3-loader.c +@@ -148,6 +148,8 @@ static size_t sof_ipc3_fw_parse_ext_man(struct snd_sof_dev *sdev) + + head = (struct sof_ext_man_header *)fw->data; + remaining = head->full_size - head->header_size; ++ if (remaining < 0 || remaining > sdev->basefw.fw->size) ++ return -EINVAL; + ext_man_size = ipc3_fw_ext_man_size(sdev, fw); + + /* Assert firmware starts with extended manifest */ +-- +2.43.0 + diff --git a/queue-6.7/asoc-sof-amd-fix-memory-leak-in-amd_sof_acp_probe.patch b/queue-6.7/asoc-sof-amd-fix-memory-leak-in-amd_sof_acp_probe.patch new file mode 100644 index 00000000000..a45b72438dd --- /dev/null +++ b/queue-6.7/asoc-sof-amd-fix-memory-leak-in-amd_sof_acp_probe.patch @@ -0,0 +1,70 @@ +From aefe527c04b5adf059b5b24e0f772bf221d62a55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 05:07:23 +0200 +Subject: ASoC: SOF: amd: Fix memory leak in amd_sof_acp_probe() + +From: Cristian Ciocaltea + +[ Upstream commit 222be59e5eed1554119294edc743ee548c2371d0 ] + +Driver uses kasprintf() to initialize fw_{code,data}_bin members of +struct acp_dev_data, but kfree() is never called to deallocate the +memory, which results in a memory leak. + +Fix the issue by switching to devm_kasprintf(). Additionally, ensure the +allocation was successful by checking the pointer validity. + +Fixes: f7da88003c53 ("ASoC: SOF: amd: Enable signed firmware image loading for Vangogh platform") +Signed-off-by: Cristian Ciocaltea +Reviewed-by: Emil Velikov +Link: https://msgid.link/r/20231219030728.2431640-6-cristian.ciocaltea@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/amd/acp.c | 28 +++++++++++++++++++--------- + 1 file changed, 19 insertions(+), 9 deletions(-) + +diff --git a/sound/soc/sof/amd/acp.c b/sound/soc/sof/amd/acp.c +index 603ea5fc0d0d4..c6f637f298476 100644 +--- a/sound/soc/sof/amd/acp.c ++++ b/sound/soc/sof/amd/acp.c +@@ -547,17 +547,27 @@ int amd_sof_acp_probe(struct snd_sof_dev *sdev) + adata->signed_fw_image = false; + dmi_id = dmi_first_match(acp_sof_quirk_table); + if (dmi_id && dmi_id->driver_data) { +- adata->fw_code_bin = kasprintf(GFP_KERNEL, "%s/sof-%s-code.bin", +- plat_data->fw_filename_prefix, +- chip->name); +- adata->fw_data_bin = kasprintf(GFP_KERNEL, "%s/sof-%s-data.bin", +- plat_data->fw_filename_prefix, +- chip->name); +- adata->signed_fw_image = dmi_id->driver_data; ++ adata->fw_code_bin = devm_kasprintf(sdev->dev, GFP_KERNEL, ++ "%s/sof-%s-code.bin", ++ plat_data->fw_filename_prefix, ++ chip->name); ++ if (!adata->fw_code_bin) { ++ ret = -ENOMEM; ++ goto free_ipc_irq; ++ } ++ ++ adata->fw_data_bin = devm_kasprintf(sdev->dev, GFP_KERNEL, ++ "%s/sof-%s-data.bin", ++ plat_data->fw_filename_prefix, ++ chip->name); ++ if (!adata->fw_data_bin) { ++ ret = -ENOMEM; ++ goto free_ipc_irq; ++ } + +- dev_dbg(sdev->dev, "fw_code_bin:%s, fw_data_bin:%s\n", adata->fw_code_bin, +- adata->fw_data_bin); ++ adata->signed_fw_image = dmi_id->driver_data; + } ++ + adata->enable_fw_debug = enable_fw_debug; + acp_memory_init(sdev); + +-- +2.43.0 + diff --git a/queue-6.7/backlight-da9052-fully-initialize-backlight_properti.patch b/queue-6.7/backlight-da9052-fully-initialize-backlight_properti.patch new file mode 100644 index 00000000000..c2a4a1e76bf --- /dev/null +++ b/queue-6.7/backlight-da9052-fully-initialize-backlight_properti.patch @@ -0,0 +1,37 @@ +From e71a8b5b10b4ddaf64a42ed6a3a135a4a0b35685 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Feb 2024 15:35:24 +0000 +Subject: backlight: da9052: Fully initialize backlight_properties during probe + +From: Daniel Thompson + +[ Upstream commit 0285e9efaee8276305db5c52a59baf84e9731556 ] + +props is stack allocated and the fields that are not explcitly set +by the probe function need to be zeroed or we'll get undefined behaviour +(especially so power/blank states)! + +Fixes: 6ede3d832aaa ("backlight: add driver for DA9052/53 PMIC v1") +Signed-off-by: Daniel Thompson +Link: https://lore.kernel.org/r/20240220153532.76613-2-daniel.thompson@linaro.org +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/video/backlight/da9052_bl.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/video/backlight/da9052_bl.c b/drivers/video/backlight/da9052_bl.c +index 1cdc8543310b4..b8ff7046510eb 100644 +--- a/drivers/video/backlight/da9052_bl.c ++++ b/drivers/video/backlight/da9052_bl.c +@@ -117,6 +117,7 @@ static int da9052_backlight_probe(struct platform_device *pdev) + wleds->led_reg = platform_get_device_id(pdev)->driver_data; + wleds->state = DA9052_WLEDS_OFF; + ++ memset(&props, 0, sizeof(struct backlight_properties)); + props.type = BACKLIGHT_RAW; + props.max_brightness = DA9052_MAX_BRIGHTNESS; + +-- +2.43.0 + diff --git a/queue-6.7/backlight-ktz8866-correct-the-check-for-of_property_.patch b/queue-6.7/backlight-ktz8866-correct-the-check-for-of_property_.patch new file mode 100644 index 00000000000..14ef6ed153e --- /dev/null +++ b/queue-6.7/backlight-ktz8866-correct-the-check-for-of_property_.patch @@ -0,0 +1,53 @@ +From 04ca2f510cc48778d384b992b4a89e76ca662bae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jan 2024 20:28:29 +0800 +Subject: backlight: ktz8866: Correct the check for of_property_read_u32 + +From: Jianhua Lu + +[ Upstream commit f1ac3c9825f99c93a9833beee6b78aa386e55b0b ] + +of_property_read_u32 returns 0 when success, so reverse the +return value to get the true value. + +Fixes: f8449c8f7355 ("backlight: ktz8866: Add support for Kinetic KTZ8866 backlight") +Signed-off-by: Jianhua Lu +Reviewed-by: Daniel Thompson +Link: https://lore.kernel.org/r/20240129122829.16248-1-lujianhua000@gmail.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/video/backlight/ktz8866.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/video/backlight/ktz8866.c b/drivers/video/backlight/ktz8866.c +index 9c980f2571ee3..014877b5a9848 100644 +--- a/drivers/video/backlight/ktz8866.c ++++ b/drivers/video/backlight/ktz8866.c +@@ -97,20 +97,20 @@ static void ktz8866_init(struct ktz8866 *ktz) + { + unsigned int val = 0; + +- if (of_property_read_u32(ktz->client->dev.of_node, "current-num-sinks", &val)) ++ if (!of_property_read_u32(ktz->client->dev.of_node, "current-num-sinks", &val)) + ktz8866_write(ktz, BL_EN, BIT(val) - 1); + else + /* Enable all 6 current sinks if the number of current sinks isn't specified. */ + ktz8866_write(ktz, BL_EN, BIT(6) - 1); + +- if (of_property_read_u32(ktz->client->dev.of_node, "kinetic,current-ramp-delay-ms", &val)) { ++ if (!of_property_read_u32(ktz->client->dev.of_node, "kinetic,current-ramp-delay-ms", &val)) { + if (val <= 128) + ktz8866_write(ktz, BL_CFG2, BIT(7) | (ilog2(val) << 3) | PWM_HYST); + else + ktz8866_write(ktz, BL_CFG2, BIT(7) | ((5 + val / 64) << 3) | PWM_HYST); + } + +- if (of_property_read_u32(ktz->client->dev.of_node, "kinetic,led-enable-ramp-delay-ms", &val)) { ++ if (!of_property_read_u32(ktz->client->dev.of_node, "kinetic,led-enable-ramp-delay-ms", &val)) { + if (val == 0) + ktz8866_write(ktz, BL_DIMMING, 0); + else { +-- +2.43.0 + diff --git a/queue-6.7/backlight-lm3630a-don-t-set-bl-props.brightness-in-g.patch b/queue-6.7/backlight-lm3630a-don-t-set-bl-props.brightness-in-g.patch new file mode 100644 index 00000000000..012f5867e1c --- /dev/null +++ b/queue-6.7/backlight-lm3630a-don-t-set-bl-props.brightness-in-g.patch @@ -0,0 +1,77 @@ +From 775a8d009e3987ed297017e53ea12b27f08a5d22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Feb 2024 00:11:20 +0100 +Subject: backlight: lm3630a: Don't set bl->props.brightness in get_brightness + +From: Luca Weiss + +[ Upstream commit 4bf7ddd2d2f0f8826f25f74c7eba4e2c323a1446 ] + +There's no need to set bl->props.brightness, the get_brightness function +is just supposed to return the current brightness and not touch the +struct. + +With that done we can also remove the 'goto out' and just return the +value. + +Fixes: 0c2a665a648e ("backlight: add Backlight driver for lm3630 chip") +Signed-off-by: Luca Weiss +Reviewed-by: Daniel Thompson +Link: https://lore.kernel.org/r/20240220-lm3630a-fixups-v1-2-9ca62f7e4a33@z3ntu.xyz +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/video/backlight/lm3630a_bl.c | 14 ++++---------- + 1 file changed, 4 insertions(+), 10 deletions(-) + +diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c +index 2e2240b278482..7115d7bb2a141 100644 +--- a/drivers/video/backlight/lm3630a_bl.c ++++ b/drivers/video/backlight/lm3630a_bl.c +@@ -233,7 +233,7 @@ static int lm3630a_bank_a_get_brightness(struct backlight_device *bl) + if (rval < 0) + goto out_i2c_err; + brightness |= rval; +- goto out; ++ return brightness; + } + + /* disable sleep */ +@@ -244,11 +244,8 @@ static int lm3630a_bank_a_get_brightness(struct backlight_device *bl) + rval = lm3630a_read(pchip, REG_BRT_A); + if (rval < 0) + goto out_i2c_err; +- brightness = rval; ++ return rval; + +-out: +- bl->props.brightness = brightness; +- return bl->props.brightness; + out_i2c_err: + dev_err(pchip->dev, "i2c failed to access register\n"); + return 0; +@@ -310,7 +307,7 @@ static int lm3630a_bank_b_get_brightness(struct backlight_device *bl) + if (rval < 0) + goto out_i2c_err; + brightness |= rval; +- goto out; ++ return brightness; + } + + /* disable sleep */ +@@ -321,11 +318,8 @@ static int lm3630a_bank_b_get_brightness(struct backlight_device *bl) + rval = lm3630a_read(pchip, REG_BRT_B); + if (rval < 0) + goto out_i2c_err; +- brightness = rval; ++ return rval; + +-out: +- bl->props.brightness = brightness; +- return bl->props.brightness; + out_i2c_err: + dev_err(pchip->dev, "i2c failed to access register\n"); + return 0; +-- +2.43.0 + diff --git a/queue-6.7/backlight-lm3630a-initialize-backlight_properties-on.patch b/queue-6.7/backlight-lm3630a-initialize-backlight_properties-on.patch new file mode 100644 index 00000000000..a6ca23211fa --- /dev/null +++ b/queue-6.7/backlight-lm3630a-initialize-backlight_properties-on.patch @@ -0,0 +1,37 @@ +From 2c6f4661ae2dbee63adb1a7c69ea739f86a71df2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Feb 2024 00:11:19 +0100 +Subject: backlight: lm3630a: Initialize backlight_properties on init + +From: Luca Weiss + +[ Upstream commit ad9aeb0e3aa90ebdad5fabf9c21783740eb95907 ] + +The backlight_properties struct should be initialized to zero before +using, otherwise there will be some random values in the struct. + +Fixes: 0c2a665a648e ("backlight: add Backlight driver for lm3630 chip") +Signed-off-by: Luca Weiss +Reviewed-by: Daniel Thompson +Link: https://lore.kernel.org/r/20240220-lm3630a-fixups-v1-1-9ca62f7e4a33@z3ntu.xyz +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/video/backlight/lm3630a_bl.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c +index 8fcb62be597b8..2e2240b278482 100644 +--- a/drivers/video/backlight/lm3630a_bl.c ++++ b/drivers/video/backlight/lm3630a_bl.c +@@ -343,6 +343,7 @@ static int lm3630a_backlight_register(struct lm3630a_chip *pchip) + struct backlight_properties props; + const char *label; + ++ memset(&props, 0, sizeof(struct backlight_properties)); + props.type = BACKLIGHT_RAW; + if (pdata->leda_ctrl != LM3630A_LEDA_DISABLE) { + props.brightness = pdata->leda_init_brt; +-- +2.43.0 + diff --git a/queue-6.7/backlight-lm3639-fully-initialize-backlight_properti.patch b/queue-6.7/backlight-lm3639-fully-initialize-backlight_properti.patch new file mode 100644 index 00000000000..2f5dab922a0 --- /dev/null +++ b/queue-6.7/backlight-lm3639-fully-initialize-backlight_properti.patch @@ -0,0 +1,37 @@ +From bb0215e8b3047f5165b372ce945d12fc473b026c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Feb 2024 15:35:25 +0000 +Subject: backlight: lm3639: Fully initialize backlight_properties during probe + +From: Daniel Thompson + +[ Upstream commit abb5a5d951fbea3feb5c4ba179b89bb96a1d3462 ] + +props is stack allocated and the fields that are not explcitly set +by the probe function need to be zeroed or we'll get undefined behaviour +(especially so power/blank states)! + +Fixes: 0f59858d5119 ("backlight: add new lm3639 backlight driver") +Signed-off-by: Daniel Thompson +Link: https://lore.kernel.org/r/20240220153532.76613-3-daniel.thompson@linaro.org +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/video/backlight/lm3639_bl.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/video/backlight/lm3639_bl.c b/drivers/video/backlight/lm3639_bl.c +index 5246c171497d6..564f62acd7211 100644 +--- a/drivers/video/backlight/lm3639_bl.c ++++ b/drivers/video/backlight/lm3639_bl.c +@@ -338,6 +338,7 @@ static int lm3639_probe(struct i2c_client *client) + } + + /* backlight */ ++ memset(&props, 0, sizeof(struct backlight_properties)); + props.type = BACKLIGHT_RAW; + props.brightness = pdata->init_brt_led; + props.max_brightness = pdata->max_brt_led; +-- +2.43.0 + diff --git a/queue-6.7/backlight-lp8788-fully-initialize-backlight_properti.patch b/queue-6.7/backlight-lp8788-fully-initialize-backlight_properti.patch new file mode 100644 index 00000000000..46511c4ec07 --- /dev/null +++ b/queue-6.7/backlight-lp8788-fully-initialize-backlight_properti.patch @@ -0,0 +1,37 @@ +From 83d17eba51882c3560d1cc78eef8d0512e30fa74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Feb 2024 15:35:26 +0000 +Subject: backlight: lp8788: Fully initialize backlight_properties during probe + +From: Daniel Thompson + +[ Upstream commit 392346827fbe8a7fd573dfb145170d7949f639a6 ] + +props is stack allocated and the fields that are not explcitly set +by the probe function need to be zeroed or we'll get undefined behaviour +(especially so power/blank states)! + +Fixes: c5a51053cf3b ("backlight: add new lp8788 backlight driver") +Signed-off-by: Daniel Thompson +Link: https://lore.kernel.org/r/20240220153532.76613-4-daniel.thompson@linaro.org +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/video/backlight/lp8788_bl.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/video/backlight/lp8788_bl.c b/drivers/video/backlight/lp8788_bl.c +index d1a14b0db265b..31f97230ee506 100644 +--- a/drivers/video/backlight/lp8788_bl.c ++++ b/drivers/video/backlight/lp8788_bl.c +@@ -191,6 +191,7 @@ static int lp8788_backlight_register(struct lp8788_bl *bl) + int init_brt; + char *name; + ++ memset(&props, 0, sizeof(struct backlight_properties)); + props.type = BACKLIGHT_PLATFORM; + props.max_brightness = MAX_BRIGHTNESS; + +-- +2.43.0 + diff --git a/queue-6.7/block-fix-deadlock-between-bd_link_disk_holder-and-p.patch b/queue-6.7/block-fix-deadlock-between-bd_link_disk_holder-and-p.patch new file mode 100644 index 00000000000..c64dc617403 --- /dev/null +++ b/queue-6.7/block-fix-deadlock-between-bd_link_disk_holder-and-p.patch @@ -0,0 +1,113 @@ +From 3dc8eaa9d805e2d85127e13a48fc3f1543b310e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Feb 2024 17:01:22 +0800 +Subject: block: fix deadlock between bd_link_disk_holder and partition scan + +From: Li Nan + +[ Upstream commit 03f12122b20b6e6028e9ed69030a49f9cffcbb75 ] + +'open_mutex' of gendisk is used to protect open/close block devices. But +in bd_link_disk_holder(), it is used to protect the creation of symlink +between holding disk and slave bdev, which introduces some issues. + +When bd_link_disk_holder() is called, the driver is usually in the process +of initialization/modification and may suspend submitting io. At this +time, any io hold 'open_mutex', such as scanning partitions, can cause +deadlocks. For example, in raid: + +T1 T2 +bdev_open_by_dev + lock open_mutex [1] + ... + efi_partition + ... + md_submit_bio + md_ioctl mddev_syspend + -> suspend all io + md_add_new_disk + bind_rdev_to_array + bd_link_disk_holder + try lock open_mutex [2] + md_handle_request + -> wait mddev_resume + +T1 scan partition, T2 add a new device to raid. T1 waits for T2 to resume +mddev, but T2 waits for open_mutex held by T1. Deadlock occurs. + +Fix it by introducing a local mutex 'blk_holder_mutex' to replace +'open_mutex'. + +Fixes: 1b0a2d950ee2 ("md: use new apis to suspend array for ioctls involed array reconfiguration") +Reported-by: mgperkow@gmail.com +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218459 +Signed-off-by: Li Nan +Reviewed-by: Christoph Hellwig +Reviewed-by: Yu Kuai +Link: https://lore.kernel.org/r/20240221090122.1281868-1-linan666@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/holder.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/block/holder.c b/block/holder.c +index 37d18c13d9581..791091a7eac23 100644 +--- a/block/holder.c ++++ b/block/holder.c +@@ -8,6 +8,8 @@ struct bd_holder_disk { + int refcnt; + }; + ++static DEFINE_MUTEX(blk_holder_mutex); ++ + static struct bd_holder_disk *bd_find_holder_disk(struct block_device *bdev, + struct gendisk *disk) + { +@@ -80,7 +82,7 @@ int bd_link_disk_holder(struct block_device *bdev, struct gendisk *disk) + kobject_get(bdev->bd_holder_dir); + mutex_unlock(&bdev->bd_disk->open_mutex); + +- mutex_lock(&disk->open_mutex); ++ mutex_lock(&blk_holder_mutex); + WARN_ON_ONCE(!bdev->bd_holder); + + holder = bd_find_holder_disk(bdev, disk); +@@ -108,7 +110,7 @@ int bd_link_disk_holder(struct block_device *bdev, struct gendisk *disk) + goto out_del_symlink; + list_add(&holder->list, &disk->slave_bdevs); + +- mutex_unlock(&disk->open_mutex); ++ mutex_unlock(&blk_holder_mutex); + return 0; + + out_del_symlink: +@@ -116,7 +118,7 @@ int bd_link_disk_holder(struct block_device *bdev, struct gendisk *disk) + out_free_holder: + kfree(holder); + out_unlock: +- mutex_unlock(&disk->open_mutex); ++ mutex_unlock(&blk_holder_mutex); + if (ret) + kobject_put(bdev->bd_holder_dir); + return ret; +@@ -140,7 +142,7 @@ void bd_unlink_disk_holder(struct block_device *bdev, struct gendisk *disk) + if (WARN_ON_ONCE(!disk->slave_dir)) + return; + +- mutex_lock(&disk->open_mutex); ++ mutex_lock(&blk_holder_mutex); + holder = bd_find_holder_disk(bdev, disk); + if (!WARN_ON_ONCE(holder == NULL) && !--holder->refcnt) { + del_symlink(disk->slave_dir, bdev_kobj(bdev)); +@@ -149,6 +151,6 @@ void bd_unlink_disk_holder(struct block_device *bdev, struct gendisk *disk) + list_del_init(&holder->list); + kfree(holder); + } +- mutex_unlock(&disk->open_mutex); ++ mutex_unlock(&blk_holder_mutex); + } + EXPORT_SYMBOL_GPL(bd_unlink_disk_holder); +-- +2.43.0 + diff --git a/queue-6.7/bluetooth-af_bluetooth-fix-deadlock.patch b/queue-6.7/bluetooth-af_bluetooth-fix-deadlock.patch new file mode 100644 index 00000000000..d60ffbef49d --- /dev/null +++ b/queue-6.7/bluetooth-af_bluetooth-fix-deadlock.patch @@ -0,0 +1,90 @@ +From 731973f1d434d9a9b54a7983dbcd148dee01329b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 12:58:11 -0500 +Subject: Bluetooth: af_bluetooth: Fix deadlock + +From: Luiz Augusto von Dentz + +[ Upstream commit f7b94bdc1ec107c92262716b073b3e816d4784fb ] + +Attemting to do sock_lock on .recvmsg may cause a deadlock as shown +bellow, so instead of using sock_sock this uses sk_receive_queue.lock +on bt_sock_ioctl to avoid the UAF: + +INFO: task kworker/u9:1:121 blocked for more than 30 seconds. + Not tainted 6.7.6-lemon #183 +Workqueue: hci0 hci_rx_work +Call Trace: + + __schedule+0x37d/0xa00 + schedule+0x32/0xe0 + __lock_sock+0x68/0xa0 + ? __pfx_autoremove_wake_function+0x10/0x10 + lock_sock_nested+0x43/0x50 + l2cap_sock_recv_cb+0x21/0xa0 + l2cap_recv_frame+0x55b/0x30a0 + ? psi_task_switch+0xeb/0x270 + ? finish_task_switch.isra.0+0x93/0x2a0 + hci_rx_work+0x33a/0x3f0 + process_one_work+0x13a/0x2f0 + worker_thread+0x2f0/0x410 + ? __pfx_worker_thread+0x10/0x10 + kthread+0xe0/0x110 + ? __pfx_kthread+0x10/0x10 + ret_from_fork+0x2c/0x50 + ? __pfx_kthread+0x10/0x10 + ret_from_fork_asm+0x1b/0x30 + + +Fixes: 2e07e8348ea4 ("Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/af_bluetooth.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c +index b93464ac3517f..67604ccec2f42 100644 +--- a/net/bluetooth/af_bluetooth.c ++++ b/net/bluetooth/af_bluetooth.c +@@ -309,14 +309,11 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + if (flags & MSG_OOB) + return -EOPNOTSUPP; + +- lock_sock(sk); +- + skb = skb_recv_datagram(sk, flags, &err); + if (!skb) { + if (sk->sk_shutdown & RCV_SHUTDOWN) + err = 0; + +- release_sock(sk); + return err; + } + +@@ -346,8 +343,6 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + + skb_free_datagram(sk, skb); + +- release_sock(sk); +- + if (flags & MSG_TRUNC) + copied = skblen; + +@@ -570,10 +565,11 @@ int bt_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) + if (sk->sk_state == BT_LISTEN) + return -EINVAL; + +- lock_sock(sk); ++ spin_lock(&sk->sk_receive_queue.lock); + skb = skb_peek(&sk->sk_receive_queue); + amount = skb ? skb->len : 0; +- release_sock(sk); ++ spin_unlock(&sk->sk_receive_queue.lock); ++ + err = put_user(amount, (int __user *)arg); + break; + +-- +2.43.0 + diff --git a/queue-6.7/bluetooth-btrtl-fix-out-of-bounds-memory-access.patch b/queue-6.7/bluetooth-btrtl-fix-out-of-bounds-memory-access.patch new file mode 100644 index 00000000000..f3b59b324cb --- /dev/null +++ b/queue-6.7/bluetooth-btrtl-fix-out-of-bounds-memory-access.patch @@ -0,0 +1,125 @@ +From 0f22572895fec677b34f25a2ba0800425400155d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Feb 2024 00:37:04 +0300 +Subject: Bluetooth: btrtl: fix out of bounds memory access + +From: Andrey Skvortsov + +[ Upstream commit de4e88ec58c4202efd1f02eebb4939bbf6945358 ] + +The problem is detected by KASAN. +btrtl driver uses private hci data to store 'struct btrealtek_data'. +If btrtl driver is used with btusb, then memory for private hci data +is allocated in btusb. But no private data is allocated after hci_dev, +when btrtl is used with hci_h5. + +This commit adds memory allocation for hci_h5 case. + + ================================================================== + BUG: KASAN: slab-out-of-bounds in btrtl_initialize+0x6cc/0x958 [btrtl] + Write of size 8 at addr ffff00000f5a5748 by task kworker/u9:0/76 + + Hardware name: Pine64 PinePhone (1.2) (DT) + Workqueue: hci0 hci_power_on [bluetooth] + Call trace: + dump_backtrace+0x9c/0x128 + show_stack+0x20/0x38 + dump_stack_lvl+0x48/0x60 + print_report+0xf8/0x5d8 + kasan_report+0x90/0xd0 + __asan_store8+0x9c/0xc0 + [btrtl] + h5_btrtl_setup+0xd0/0x2f8 [hci_uart] + h5_setup+0x50/0x80 [hci_uart] + hci_uart_setup+0xd4/0x260 [hci_uart] + hci_dev_open_sync+0x1cc/0xf68 [bluetooth] + hci_dev_do_open+0x34/0x90 [bluetooth] + hci_power_on+0xc4/0x3c8 [bluetooth] + process_one_work+0x328/0x6f0 + worker_thread+0x410/0x778 + kthread+0x168/0x178 + ret_from_fork+0x10/0x20 + + Allocated by task 53: + kasan_save_stack+0x3c/0x68 + kasan_save_track+0x20/0x40 + kasan_save_alloc_info+0x68/0x78 + __kasan_kmalloc+0xd4/0xd8 + __kmalloc+0x1b4/0x3b0 + hci_alloc_dev_priv+0x28/0xa58 [bluetooth] + hci_uart_register_device+0x118/0x4f8 [hci_uart] + h5_serdev_probe+0xf4/0x178 [hci_uart] + serdev_drv_probe+0x54/0xa0 + really_probe+0x254/0x588 + __driver_probe_device+0xc4/0x210 + driver_probe_device+0x64/0x160 + __driver_attach_async_helper+0x88/0x158 + async_run_entry_fn+0xd0/0x388 + process_one_work+0x328/0x6f0 + worker_thread+0x410/0x778 + kthread+0x168/0x178 + ret_from_fork+0x10/0x20 + + Last potentially related work creation: + kasan_save_stack+0x3c/0x68 + __kasan_record_aux_stack+0xb0/0x150 + kasan_record_aux_stack_noalloc+0x14/0x20 + __queue_work+0x33c/0x960 + queue_work_on+0x98/0xc0 + hci_recv_frame+0xc8/0x1e8 [bluetooth] + h5_complete_rx_pkt+0x2c8/0x800 [hci_uart] + h5_rx_payload+0x98/0xb8 [hci_uart] + h5_recv+0x158/0x3d8 [hci_uart] + hci_uart_receive_buf+0xa0/0xe8 [hci_uart] + ttyport_receive_buf+0xac/0x178 + flush_to_ldisc+0x130/0x2c8 + process_one_work+0x328/0x6f0 + worker_thread+0x410/0x778 + kthread+0x168/0x178 + ret_from_fork+0x10/0x20 + + Second to last potentially related work creation: + kasan_save_stack+0x3c/0x68 + __kasan_record_aux_stack+0xb0/0x150 + kasan_record_aux_stack_noalloc+0x14/0x20 + __queue_work+0x788/0x960 + queue_work_on+0x98/0xc0 + __hci_cmd_sync_sk+0x23c/0x7a0 [bluetooth] + __hci_cmd_sync+0x24/0x38 [bluetooth] + btrtl_initialize+0x760/0x958 [btrtl] + h5_btrtl_setup+0xd0/0x2f8 [hci_uart] + h5_setup+0x50/0x80 [hci_uart] + hci_uart_setup+0xd4/0x260 [hci_uart] + hci_dev_open_sync+0x1cc/0xf68 [bluetooth] + hci_dev_do_open+0x34/0x90 [bluetooth] + hci_power_on+0xc4/0x3c8 [bluetooth] + process_one_work+0x328/0x6f0 + worker_thread+0x410/0x778 + kthread+0x168/0x178 + ret_from_fork+0x10/0x20 + ================================================================== + +Fixes: 5b355944b190 ("Bluetooth: btrtl: Add btrealtek data struct") +Fixes: 044014ce85a1 ("Bluetooth: btrtl: Add Realtek devcoredump support") +Signed-off-by: Andrey Skvortsov +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/hci_h5.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c +index b66136348bd64..c0436881a533c 100644 +--- a/drivers/bluetooth/hci_h5.c ++++ b/drivers/bluetooth/hci_h5.c +@@ -1072,6 +1072,7 @@ static struct h5_vnd rtl_vnd = { + .suspend = h5_btrtl_suspend, + .resume = h5_btrtl_resume, + .acpi_gpio_map = acpi_btrtl_gpios, ++ .sizeof_priv = sizeof(struct btrealtek_data), + }; + + static const struct h5_device_data h5_data_rtl8822cs = { +-- +2.43.0 + diff --git a/queue-6.7/bluetooth-btusb-fix-memory-leak.patch b/queue-6.7/bluetooth-btusb-fix-memory-leak.patch new file mode 100644 index 00000000000..5ad22108448 --- /dev/null +++ b/queue-6.7/bluetooth-btusb-fix-memory-leak.patch @@ -0,0 +1,68 @@ +From 4f28618dcbfee38cbfe8acc00a5cd0b64793736a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 11:17:24 -0500 +Subject: Bluetooth: btusb: Fix memory leak + +From: Luiz Augusto von Dentz + +[ Upstream commit 79f4127a502c5905f04da1f20a7bbe07103fb77c ] + +This checks if CONFIG_DEV_COREDUMP is enabled before attempting to clone +the skb and also make sure btmtk_process_coredump frees the skb passed +following the same logic. + +Fixes: 0b7015132878 ("Bluetooth: btusb: mediatek: add MediaTek devcoredump support") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btmtk.c | 4 +++- + drivers/bluetooth/btusb.c | 10 ++++++---- + 2 files changed, 9 insertions(+), 5 deletions(-) + +diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c +index aaabb732082cd..285418dbb43f5 100644 +--- a/drivers/bluetooth/btmtk.c ++++ b/drivers/bluetooth/btmtk.c +@@ -372,8 +372,10 @@ int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb) + struct btmediatek_data *data = hci_get_priv(hdev); + int err; + +- if (!IS_ENABLED(CONFIG_DEV_COREDUMP)) ++ if (!IS_ENABLED(CONFIG_DEV_COREDUMP)) { ++ kfree_skb(skb); + return 0; ++ } + + switch (data->cd_info.state) { + case HCI_DEVCOREDUMP_IDLE: +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index b8e9de887b5de..81ccb88c904a3 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -3271,7 +3271,6 @@ static int btusb_recv_acl_mtk(struct hci_dev *hdev, struct sk_buff *skb) + { + struct btusb_data *data = hci_get_drvdata(hdev); + u16 handle = le16_to_cpu(hci_acl_hdr(skb)->handle); +- struct sk_buff *skb_cd; + + switch (handle) { + case 0xfc6f: /* Firmware dump from device */ +@@ -3284,9 +3283,12 @@ static int btusb_recv_acl_mtk(struct hci_dev *hdev, struct sk_buff *skb) + * for backward compatibility, so we have to clone the packet + * extraly for the in-kernel coredump support. + */ +- skb_cd = skb_clone(skb, GFP_ATOMIC); +- if (skb_cd) +- btmtk_process_coredump(hdev, skb_cd); ++ if (IS_ENABLED(CONFIG_DEV_COREDUMP)) { ++ struct sk_buff *skb_cd = skb_clone(skb, GFP_ATOMIC); ++ ++ if (skb_cd) ++ btmtk_process_coredump(hdev, skb_cd); ++ } + + fallthrough; + case 0x05ff: /* Firmware debug logging 1 */ +-- +2.43.0 + diff --git a/queue-6.7/bluetooth-fix-eir-name-length.patch b/queue-6.7/bluetooth-fix-eir-name-length.patch new file mode 100644 index 00000000000..e735c829e55 --- /dev/null +++ b/queue-6.7/bluetooth-fix-eir-name-length.patch @@ -0,0 +1,106 @@ +From 7dfba353f8d12363009b6b7df7890c2f6f8ac64e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 17:42:05 +0100 +Subject: Bluetooth: Fix eir name length +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Frédéric Danis + +[ Upstream commit 2ab3e8d67fc1d4a7638b769cf83023ec209fc0a9 ] + +According to Section 1.2 of Core Specification Supplement Part A the +complete or short name strings are defined as utf8s, which should not +include the trailing NULL for variable length array as defined in Core +Specification Vol1 Part E Section 2.9.3. + +Removing the trailing NULL allows PTS to retrieve the random address based +on device name, e.g. for SM/PER/KDU/BV-02-C, SM/PER/KDU/BV-08-C or +GAP/BROB/BCST/BV-03-C. + +Fixes: f61851f64b17 ("Bluetooth: Fix append max 11 bytes of name to scan rsp data") +Signed-off-by: Frédéric Danis +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/eir.c | 29 +++++++---------------------- + net/bluetooth/mgmt.c | 2 +- + 2 files changed, 8 insertions(+), 23 deletions(-) + +diff --git a/net/bluetooth/eir.c b/net/bluetooth/eir.c +index 9214189279e80..1bc51e2b05a34 100644 +--- a/net/bluetooth/eir.c ++++ b/net/bluetooth/eir.c +@@ -13,48 +13,33 @@ + + #define PNP_INFO_SVCLASS_ID 0x1200 + +-static u8 eir_append_name(u8 *eir, u16 eir_len, u8 type, u8 *data, u8 data_len) +-{ +- u8 name[HCI_MAX_SHORT_NAME_LENGTH + 1]; +- +- /* If data is already NULL terminated just pass it directly */ +- if (data[data_len - 1] == '\0') +- return eir_append_data(eir, eir_len, type, data, data_len); +- +- memcpy(name, data, HCI_MAX_SHORT_NAME_LENGTH); +- name[HCI_MAX_SHORT_NAME_LENGTH] = '\0'; +- +- return eir_append_data(eir, eir_len, type, name, sizeof(name)); +-} +- + u8 eir_append_local_name(struct hci_dev *hdev, u8 *ptr, u8 ad_len) + { + size_t short_len; + size_t complete_len; + +- /* no space left for name (+ NULL + type + len) */ +- if ((max_adv_len(hdev) - ad_len) < HCI_MAX_SHORT_NAME_LENGTH + 3) ++ /* no space left for name (+ type + len) */ ++ if ((max_adv_len(hdev) - ad_len) < HCI_MAX_SHORT_NAME_LENGTH + 2) + return ad_len; + + /* use complete name if present and fits */ + complete_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name)); + if (complete_len && complete_len <= HCI_MAX_SHORT_NAME_LENGTH) +- return eir_append_name(ptr, ad_len, EIR_NAME_COMPLETE, +- hdev->dev_name, complete_len + 1); ++ return eir_append_data(ptr, ad_len, EIR_NAME_COMPLETE, ++ hdev->dev_name, complete_len); + + /* use short name if present */ + short_len = strnlen(hdev->short_name, sizeof(hdev->short_name)); + if (short_len) +- return eir_append_name(ptr, ad_len, EIR_NAME_SHORT, ++ return eir_append_data(ptr, ad_len, EIR_NAME_SHORT, + hdev->short_name, +- short_len == HCI_MAX_SHORT_NAME_LENGTH ? +- short_len : short_len + 1); ++ short_len); + + /* use shortened full name if present, we already know that name + * is longer then HCI_MAX_SHORT_NAME_LENGTH + */ + if (complete_len) +- return eir_append_name(ptr, ad_len, EIR_NAME_SHORT, ++ return eir_append_data(ptr, ad_len, EIR_NAME_SHORT, + hdev->dev_name, + HCI_MAX_SHORT_NAME_LENGTH); + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 2ffda2ffdbda8..92fd3786bbdff 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -8400,7 +8400,7 @@ static int read_adv_features(struct sock *sk, struct hci_dev *hdev, + + static u8 calculate_name_len(struct hci_dev *hdev) + { +- u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3]; ++ u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 2]; /* len + type + name */ + + return eir_append_local_name(hdev, buf, 0); + } +-- +2.43.0 + diff --git a/queue-6.7/bluetooth-fix-use-after-free-in-accessing-skb-after-.patch b/queue-6.7/bluetooth-fix-use-after-free-in-accessing-skb-after-.patch new file mode 100644 index 00000000000..ec10dfcacc9 --- /dev/null +++ b/queue-6.7/bluetooth-fix-use-after-free-in-accessing-skb-after-.patch @@ -0,0 +1,61 @@ +From f6937cf2bd9c64bd6e2734ae918d6777be404043 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Mar 2024 19:06:23 +0200 +Subject: Bluetooth: fix use-after-free in accessing skb after sending it + +From: Pauli Virtanen + +[ Upstream commit 947ec0d002dce8577b655793dcc6fc78d67b7cb6 ] + +hci_send_cmd_sync first sends skb and then tries to clone it. However, +the driver may have already freed the skb at that point. + +Fix by cloning the sent_cmd cloned just above, instead of the original. + +Log: +================================================================ +BUG: KASAN: slab-use-after-free in __copy_skb_header+0x1a/0x240 +... +Call Trace: .. + __skb_clone+0x59/0x2c0 + hci_cmd_work+0x3b3/0x3d0 [bluetooth] + process_one_work+0x459/0x900 +... +Allocated by task 129: ... + __alloc_skb+0x1ae/0x220 + __hci_cmd_sync_sk+0x44c/0x7a0 [bluetooth] + __hci_cmd_sync_status+0x24/0xb0 [bluetooth] + set_cig_params_sync+0x778/0x7d0 [bluetooth] +... +Freed by task 0: ... + kmem_cache_free+0x157/0x3c0 + __usb_hcd_giveback_urb+0x11e/0x1e0 + usb_giveback_urb_bh+0x1ad/0x2a0 + tasklet_action_common.isra.0+0x259/0x4a0 + __do_softirq+0x15b/0x5a7 +================================================================ + +Fixes: 2615fd9a7c25 ("Bluetooth: hci_sync: Fix overwriting request callback") +Signed-off-by: Pauli Virtanen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 85a91c438d721..7d5334b529834 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -4185,7 +4185,7 @@ static void hci_send_cmd_sync(struct hci_dev *hdev, struct sk_buff *skb) + if (hci_req_status_pend(hdev) && + !hci_dev_test_and_set_flag(hdev, HCI_CMD_PENDING)) { + kfree_skb(hdev->req_skb); +- hdev->req_skb = skb_clone(skb, GFP_KERNEL); ++ hdev->req_skb = skb_clone(hdev->sent_cmd, GFP_KERNEL); + } + + atomic_dec(&hdev->cmd_cnt); +-- +2.43.0 + diff --git a/queue-6.7/bluetooth-hci_core-cancel-request-on-command-timeout.patch b/queue-6.7/bluetooth-hci_core-cancel-request-on-command-timeout.patch new file mode 100644 index 00000000000..16fdce4f117 --- /dev/null +++ b/queue-6.7/bluetooth-hci_core-cancel-request-on-command-timeout.patch @@ -0,0 +1,245 @@ +From edc8c680adc956f1a09840aab487d34f736fa00d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jan 2024 13:45:40 -0500 +Subject: Bluetooth: hci_core: Cancel request on command timeout + +From: Luiz Augusto von Dentz + +[ Upstream commit 63298d6e752fc0ec7f5093860af8bc9f047b30c8 ] + +If command has timed out call __hci_cmd_sync_cancel to notify the +hci_req since it will inevitably cause a timeout. + +This also rework the code around __hci_cmd_sync_cancel since it was +wrongly assuming it needs to cancel timer as well, but sometimes the +timers have not been started or in fact they already had timed out in +which case they don't need to be cancel yet again. + +Signed-off-by: Luiz Augusto von Dentz +Stable-dep-of: 2615fd9a7c25 ("Bluetooth: hci_sync: Fix overwriting request callback") +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci_sync.h | 2 +- + net/bluetooth/hci_core.c | 84 ++++++++++++++++++++++---------- + net/bluetooth/hci_request.c | 2 +- + net/bluetooth/hci_sync.c | 20 ++++---- + net/bluetooth/mgmt.c | 2 +- + 5 files changed, 71 insertions(+), 39 deletions(-) + +diff --git a/include/net/bluetooth/hci_sync.h b/include/net/bluetooth/hci_sync.h +index 6efbc2152146b..e2582c2425449 100644 +--- a/include/net/bluetooth/hci_sync.h ++++ b/include/net/bluetooth/hci_sync.h +@@ -42,7 +42,7 @@ int __hci_cmd_sync_status_sk(struct hci_dev *hdev, u16 opcode, u32 plen, + void hci_cmd_sync_init(struct hci_dev *hdev); + void hci_cmd_sync_clear(struct hci_dev *hdev); + void hci_cmd_sync_cancel(struct hci_dev *hdev, int err); +-void __hci_cmd_sync_cancel(struct hci_dev *hdev, int err); ++void hci_cmd_sync_cancel_sync(struct hci_dev *hdev, int err); + + int hci_cmd_sync_submit(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, + void *data, hci_cmd_sync_work_destroy_t destroy); +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 2821a42cefdc6..539305b9a0e27 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -1492,10 +1492,11 @@ static void hci_cmd_timeout(struct work_struct *work) + cmd_timer.work); + + if (hdev->sent_cmd) { +- struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data; +- u16 opcode = __le16_to_cpu(sent->opcode); ++ u16 opcode = hci_skb_opcode(hdev->sent_cmd); + + bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode); ++ ++ hci_cmd_sync_cancel_sync(hdev, ETIMEDOUT); + } else { + bt_dev_err(hdev, "command tx timeout"); + } +@@ -2826,6 +2827,23 @@ int hci_unregister_suspend_notifier(struct hci_dev *hdev) + return ret; + } + ++/* Cancel ongoing command synchronously: ++ * ++ * - Cancel command timer ++ * - Reset command counter ++ * - Cancel command request ++ */ ++static void hci_cancel_cmd_sync(struct hci_dev *hdev, int err) ++{ ++ bt_dev_dbg(hdev, "err 0x%2.2x", err); ++ ++ cancel_delayed_work_sync(&hdev->cmd_timer); ++ cancel_delayed_work_sync(&hdev->ncmd_timer); ++ atomic_set(&hdev->cmd_cnt, 1); ++ ++ hci_cmd_sync_cancel_sync(hdev, -err); ++} ++ + /* Suspend HCI device */ + int hci_suspend_dev(struct hci_dev *hdev) + { +@@ -2843,7 +2861,7 @@ int hci_suspend_dev(struct hci_dev *hdev) + return 0; + + /* Cancel potentially blocking sync operation before suspend */ +- __hci_cmd_sync_cancel(hdev, -EHOSTDOWN); ++ hci_cancel_cmd_sync(hdev, -EHOSTDOWN); + + hci_req_sync_lock(hdev); + ret = hci_suspend_sync(hdev); +@@ -4128,6 +4146,33 @@ static void hci_rx_work(struct work_struct *work) + } + } + ++static void hci_send_cmd_sync(struct hci_dev *hdev, struct sk_buff *skb) ++{ ++ int err; ++ ++ bt_dev_dbg(hdev, "skb %p", skb); ++ ++ kfree_skb(hdev->sent_cmd); ++ ++ hdev->sent_cmd = skb_clone(skb, GFP_KERNEL); ++ if (!hdev->sent_cmd) { ++ skb_queue_head(&hdev->cmd_q, skb); ++ queue_work(hdev->workqueue, &hdev->cmd_work); ++ return; ++ } ++ ++ err = hci_send_frame(hdev, skb); ++ if (err < 0) { ++ hci_cmd_sync_cancel_sync(hdev, err); ++ return; ++ } ++ ++ if (hci_req_status_pend(hdev)) ++ hci_dev_set_flag(hdev, HCI_CMD_PENDING); ++ ++ atomic_dec(&hdev->cmd_cnt); ++} ++ + static void hci_cmd_work(struct work_struct *work) + { + struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work); +@@ -4142,30 +4187,15 @@ static void hci_cmd_work(struct work_struct *work) + if (!skb) + return; + +- kfree_skb(hdev->sent_cmd); +- +- hdev->sent_cmd = skb_clone(skb, GFP_KERNEL); +- if (hdev->sent_cmd) { +- int res; +- if (hci_req_status_pend(hdev)) +- hci_dev_set_flag(hdev, HCI_CMD_PENDING); +- atomic_dec(&hdev->cmd_cnt); ++ hci_send_cmd_sync(hdev, skb); + +- res = hci_send_frame(hdev, skb); +- if (res < 0) +- __hci_cmd_sync_cancel(hdev, -res); +- +- rcu_read_lock(); +- if (test_bit(HCI_RESET, &hdev->flags) || +- hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE)) +- cancel_delayed_work(&hdev->cmd_timer); +- else +- queue_delayed_work(hdev->workqueue, &hdev->cmd_timer, +- HCI_CMD_TIMEOUT); +- rcu_read_unlock(); +- } else { +- skb_queue_head(&hdev->cmd_q, skb); +- queue_work(hdev->workqueue, &hdev->cmd_work); +- } ++ rcu_read_lock(); ++ if (test_bit(HCI_RESET, &hdev->flags) || ++ hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE)) ++ cancel_delayed_work(&hdev->cmd_timer); ++ else ++ queue_delayed_work(hdev->workqueue, &hdev->cmd_timer, ++ HCI_CMD_TIMEOUT); ++ rcu_read_unlock(); + } + } +diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c +index 6e023b0104b03..00e02138003ec 100644 +--- a/net/bluetooth/hci_request.c ++++ b/net/bluetooth/hci_request.c +@@ -895,7 +895,7 @@ void hci_request_setup(struct hci_dev *hdev) + + void hci_request_cancel_all(struct hci_dev *hdev) + { +- __hci_cmd_sync_cancel(hdev, ENODEV); ++ hci_cmd_sync_cancel_sync(hdev, ENODEV); + + cancel_interleave_scan(hdev); + } +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index b90ee68bba1d6..f4c53c428305b 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -652,7 +652,7 @@ void hci_cmd_sync_clear(struct hci_dev *hdev) + mutex_unlock(&hdev->cmd_sync_work_lock); + } + +-void __hci_cmd_sync_cancel(struct hci_dev *hdev, int err) ++void hci_cmd_sync_cancel(struct hci_dev *hdev, int err) + { + bt_dev_dbg(hdev, "err 0x%2.2x", err); + +@@ -660,15 +660,17 @@ void __hci_cmd_sync_cancel(struct hci_dev *hdev, int err) + hdev->req_result = err; + hdev->req_status = HCI_REQ_CANCELED; + +- cancel_delayed_work_sync(&hdev->cmd_timer); +- cancel_delayed_work_sync(&hdev->ncmd_timer); +- atomic_set(&hdev->cmd_cnt, 1); +- +- wake_up_interruptible(&hdev->req_wait_q); ++ queue_work(hdev->workqueue, &hdev->cmd_sync_cancel_work); + } + } ++EXPORT_SYMBOL(hci_cmd_sync_cancel); + +-void hci_cmd_sync_cancel(struct hci_dev *hdev, int err) ++/* Cancel ongoing command request synchronously: ++ * ++ * - Set result and mark status to HCI_REQ_CANCELED ++ * - Wakeup command sync thread ++ */ ++void hci_cmd_sync_cancel_sync(struct hci_dev *hdev, int err) + { + bt_dev_dbg(hdev, "err 0x%2.2x", err); + +@@ -676,10 +678,10 @@ void hci_cmd_sync_cancel(struct hci_dev *hdev, int err) + hdev->req_result = err; + hdev->req_status = HCI_REQ_CANCELED; + +- queue_work(hdev->workqueue, &hdev->cmd_sync_cancel_work); ++ wake_up_interruptible(&hdev->req_wait_q); + } + } +-EXPORT_SYMBOL(hci_cmd_sync_cancel); ++EXPORT_SYMBOL(hci_cmd_sync_cancel_sync); + + /* Submit HCI command to be run in as cmd_sync_work: + * +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index b21b981f15a38..2ffda2ffdbda8 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -1404,7 +1404,7 @@ static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, + + /* Cancel potentially blocking sync operation before power off */ + if (cp->val == 0x00) { +- __hci_cmd_sync_cancel(hdev, -EHOSTDOWN); ++ hci_cmd_sync_cancel_sync(hdev, -EHOSTDOWN); + err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd, + mgmt_set_powered_complete); + } else { +-- +2.43.0 + diff --git a/queue-6.7/bluetooth-hci_core-fix-possible-buffer-overflow.patch b/queue-6.7/bluetooth-hci_core-fix-possible-buffer-overflow.patch new file mode 100644 index 00000000000..aa5fbd7ec5d --- /dev/null +++ b/queue-6.7/bluetooth-hci_core-fix-possible-buffer-overflow.patch @@ -0,0 +1,36 @@ +From b582c8c81d03bec90b76711152615c30e1610b75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 10:49:26 -0500 +Subject: Bluetooth: hci_core: Fix possible buffer overflow + +From: Luiz Augusto von Dentz + +[ Upstream commit 81137162bfaa7278785b24c1fd2e9e74f082e8e4 ] + +struct hci_dev_info has a fixed size name[8] field so in the event that +hdev->name is bigger than that strcpy would attempt to write past its +size, so this fixes this problem by switching to use strscpy. + +Fixes: dcda165706b9 ("Bluetooth: hci_core: Fix build warnings") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 96707deef296b..85a91c438d721 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -908,7 +908,7 @@ int hci_get_dev_info(void __user *arg) + else + flags = hdev->flags; + +- strcpy(di.name, hdev->name); ++ strscpy(di.name, hdev->name, sizeof(di.name)); + di.bdaddr = hdev->bdaddr; + di.type = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4); + di.flags = flags; +-- +2.43.0 + diff --git a/queue-6.7/bluetooth-hci_event-fix-not-indicating-new-connectio.patch b/queue-6.7/bluetooth-hci_event-fix-not-indicating-new-connectio.patch new file mode 100644 index 00000000000..6256249dfee --- /dev/null +++ b/queue-6.7/bluetooth-hci_event-fix-not-indicating-new-connectio.patch @@ -0,0 +1,115 @@ +From 125b2e04a6235e34d6c7d0115eb4d8c6489ee084 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 11:24:19 -0500 +Subject: Bluetooth: hci_event: Fix not indicating new connection for BIG Sync + +From: Luiz Augusto von Dentz + +[ Upstream commit eeda1bf97bb500a901f7a9ee5615bad2160f2378 ] + +BIG Sync (aka. Broadcast sink) requires to inform that the device is +connected when a data path is active otherwise userspace could attempt +to free resources allocated to the device object while scanning. + +Fixes: 1d11d70d1f6b ("Bluetooth: ISO: Pass BIG encryption info through QoS") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_event.c | 21 ++++++++++++++------- + net/bluetooth/mgmt.c | 4 ++++ + 2 files changed, 18 insertions(+), 7 deletions(-) + +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 55daada8dc15d..9ee66b393981b 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -2524,9 +2524,7 @@ static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn, + * Only those in BT_CONFIG or BT_CONNECTED states can be + * considered connected. + */ +- if (conn && +- (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) && +- !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) ++ if (conn && (conn->state == BT_CONFIG || conn->state == BT_CONNECTED)) + mgmt_device_connected(hdev, conn, name, name_len); + + if (discov->state == DISCOVERY_STOPPED) +@@ -3758,8 +3756,9 @@ static void hci_remote_features_evt(struct hci_dev *hdev, void *data, + bacpy(&cp.bdaddr, &conn->dst); + cp.pscan_rep_mode = 0x02; + hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp); +- } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) ++ } else { + mgmt_device_connected(hdev, conn, NULL, 0); ++ } + + if (!hci_outgoing_auth_needed(hdev, conn)) { + conn->state = BT_CONNECTED; +@@ -3932,6 +3931,11 @@ static u8 hci_cc_le_setup_iso_path(struct hci_dev *hdev, void *data, + * last. + */ + hci_connect_cfm(conn, rp->status); ++ ++ /* Notify device connected in case it is a BIG Sync */ ++ if (!rp->status && test_bit(HCI_CONN_BIG_SYNC, &conn->flags)) ++ mgmt_device_connected(hdev, conn, NULL, 0); ++ + break; + } + +@@ -5006,8 +5010,9 @@ static void hci_remote_ext_features_evt(struct hci_dev *hdev, void *data, + bacpy(&cp.bdaddr, &conn->dst); + cp.pscan_rep_mode = 0x02; + hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp); +- } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) ++ } else { + mgmt_device_connected(hdev, conn, NULL, 0); ++ } + + if (!hci_outgoing_auth_needed(hdev, conn)) { + conn->state = BT_CONNECTED; +@@ -5980,8 +5985,7 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, + goto unlock; + } + +- if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) +- mgmt_device_connected(hdev, conn, NULL, 0); ++ mgmt_device_connected(hdev, conn, NULL, 0); + + conn->sec_level = BT_SECURITY_LOW; + conn->state = BT_CONFIG; +@@ -7210,6 +7214,9 @@ static void hci_le_big_info_adv_report_evt(struct hci_dev *hdev, void *data, + /* Notify iso layer */ + hci_connect_cfm(pa_sync, 0x00); + ++ /* Notify MGMT layer */ ++ mgmt_device_connected(hdev, pa_sync, NULL, 0); ++ + unlock: + hci_dev_unlock(hdev); + } +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 2186ac57981e5..b21b981f15a38 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -3118,6 +3118,7 @@ static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, + static u8 link_to_bdaddr(u8 link_type, u8 addr_type) + { + switch (link_type) { ++ case ISO_LINK: + case LE_LINK: + switch (addr_type) { + case ADDR_LE_DEV_PUBLIC: +@@ -9610,6 +9611,9 @@ void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, + u16 eir_len = 0; + u32 flags = 0; + ++ if (test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) ++ return; ++ + /* allocate buff for LE or BR/EDR adv */ + if (conn->le_adv_data_len > 0) + skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, +-- +2.43.0 + diff --git a/queue-6.7/bluetooth-hci_h5-add-ability-to-allocate-memory-for-.patch b/queue-6.7/bluetooth-hci_h5-add-ability-to-allocate-memory-for-.patch new file mode 100644 index 00000000000..109edf90780 --- /dev/null +++ b/queue-6.7/bluetooth-hci_h5-add-ability-to-allocate-memory-for-.patch @@ -0,0 +1,104 @@ +From 9038f24c06099e5e252b954a23828e940cfbd0be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Feb 2024 00:37:03 +0300 +Subject: Bluetooth: hci_h5: Add ability to allocate memory for private data + +From: Andrey Skvortsov + +[ Upstream commit 7a6d793e9ca8bc0c1d2f0aa0a02ec380d1124c74 ] + +In some cases uart-base drivers may need to use priv data. For +example, to store information needed for devcoredump. + +Fixes: 044014ce85a1 ("Bluetooth: btrtl: Add Realtek devcoredump support") +Signed-off-by: Andrey Skvortsov +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/hci_h5.c | 4 +++- + drivers/bluetooth/hci_serdev.c | 9 +++++---- + drivers/bluetooth/hci_uart.h | 12 +++++++++++- + 3 files changed, 19 insertions(+), 6 deletions(-) + +diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c +index 71e748a9477e4..b66136348bd64 100644 +--- a/drivers/bluetooth/hci_h5.c ++++ b/drivers/bluetooth/hci_h5.c +@@ -113,6 +113,7 @@ struct h5_vnd { + int (*suspend)(struct h5 *h5); + int (*resume)(struct h5 *h5); + const struct acpi_gpio_mapping *acpi_gpio_map; ++ int sizeof_priv; + }; + + struct h5_device_data { +@@ -863,7 +864,8 @@ static int h5_serdev_probe(struct serdev_device *serdev) + if (IS_ERR(h5->device_wake_gpio)) + return PTR_ERR(h5->device_wake_gpio); + +- return hci_uart_register_device(&h5->serdev_hu, &h5p); ++ return hci_uart_register_device_priv(&h5->serdev_hu, &h5p, ++ h5->vnd->sizeof_priv); + } + + static void h5_serdev_remove(struct serdev_device *serdev) +diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c +index f16fd79bc02b8..611a11fbb2f3a 100644 +--- a/drivers/bluetooth/hci_serdev.c ++++ b/drivers/bluetooth/hci_serdev.c +@@ -300,8 +300,9 @@ static const struct serdev_device_ops hci_serdev_client_ops = { + .write_wakeup = hci_uart_write_wakeup, + }; + +-int hci_uart_register_device(struct hci_uart *hu, +- const struct hci_uart_proto *p) ++int hci_uart_register_device_priv(struct hci_uart *hu, ++ const struct hci_uart_proto *p, ++ int sizeof_priv) + { + int err; + struct hci_dev *hdev; +@@ -325,7 +326,7 @@ int hci_uart_register_device(struct hci_uart *hu, + set_bit(HCI_UART_PROTO_READY, &hu->flags); + + /* Initialize and register HCI device */ +- hdev = hci_alloc_dev(); ++ hdev = hci_alloc_dev_priv(sizeof_priv); + if (!hdev) { + BT_ERR("Can't allocate HCI device"); + err = -ENOMEM; +@@ -394,7 +395,7 @@ int hci_uart_register_device(struct hci_uart *hu, + percpu_free_rwsem(&hu->proto_lock); + return err; + } +-EXPORT_SYMBOL_GPL(hci_uart_register_device); ++EXPORT_SYMBOL_GPL(hci_uart_register_device_priv); + + void hci_uart_unregister_device(struct hci_uart *hu) + { +diff --git a/drivers/bluetooth/hci_uart.h b/drivers/bluetooth/hci_uart.h +index fb4a2d0d8cc80..68c8c7e95d64d 100644 +--- a/drivers/bluetooth/hci_uart.h ++++ b/drivers/bluetooth/hci_uart.h +@@ -97,7 +97,17 @@ struct hci_uart { + + int hci_uart_register_proto(const struct hci_uart_proto *p); + int hci_uart_unregister_proto(const struct hci_uart_proto *p); +-int hci_uart_register_device(struct hci_uart *hu, const struct hci_uart_proto *p); ++ ++int hci_uart_register_device_priv(struct hci_uart *hu, ++ const struct hci_uart_proto *p, ++ int sizeof_priv); ++ ++static inline int hci_uart_register_device(struct hci_uart *hu, ++ const struct hci_uart_proto *p) ++{ ++ return hci_uart_register_device_priv(hu, p, 0); ++} ++ + void hci_uart_unregister_device(struct hci_uart *hu); + + int hci_uart_tx_wakeup(struct hci_uart *hu); +-- +2.43.0 + diff --git a/queue-6.7/bluetooth-hci_qca-don-t-use-is_err_or_null-with-gpio.patch b/queue-6.7/bluetooth-hci_qca-don-t-use-is_err_or_null-with-gpio.patch new file mode 100644 index 00000000000..14a0d683e74 --- /dev/null +++ b/queue-6.7/bluetooth-hci_qca-don-t-use-is_err_or_null-with-gpio.patch @@ -0,0 +1,59 @@ +From a7ffefbd6c047f352ebc82f2270499e5eb27fbc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Feb 2024 17:40:17 +0100 +Subject: Bluetooth: hci_qca: don't use IS_ERR_OR_NULL() with + gpiod_get_optional() + +From: Bartosz Golaszewski + +[ Upstream commit 56d074d26c5828773b00b2185dd7e1d08273b8e8 ] + +The optional variants for the gpiod_get() family of functions return NULL +if the GPIO in question is not associated with this device. They return +ERR_PTR() on any other error. NULL descriptors are graciously handled by +GPIOLIB and can be safely passed to any of the GPIO consumer interfaces +as they will return 0 and act as if the function succeeded. If one is +using the optional variant, then there's no point in checking for NULL. + +Fixes: 6845667146a2 ("Bluetooth: hci_qca: Fix NULL vs IS_ERR_OR_NULL check in qca_serdev_probe") +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/hci_qca.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c +index a65de7309da4c..bb69b7ea8119d 100644 +--- a/drivers/bluetooth/hci_qca.c ++++ b/drivers/bluetooth/hci_qca.c +@@ -2304,7 +2304,7 @@ static int qca_serdev_probe(struct serdev_device *serdev) + + qcadev->bt_en = devm_gpiod_get_optional(&serdev->dev, "enable", + GPIOD_OUT_LOW); +- if (IS_ERR_OR_NULL(qcadev->bt_en) && ++ if (IS_ERR(qcadev->bt_en) && + (data->soc_type == QCA_WCN6750 || + data->soc_type == QCA_WCN6855)) { + dev_err(&serdev->dev, "failed to acquire BT_EN gpio\n"); +@@ -2313,7 +2313,7 @@ static int qca_serdev_probe(struct serdev_device *serdev) + + qcadev->sw_ctrl = devm_gpiod_get_optional(&serdev->dev, "swctrl", + GPIOD_IN); +- if (IS_ERR_OR_NULL(qcadev->sw_ctrl) && ++ if (IS_ERR(qcadev->sw_ctrl) && + (data->soc_type == QCA_WCN6750 || + data->soc_type == QCA_WCN6855 || + data->soc_type == QCA_WCN7850)) +@@ -2335,7 +2335,7 @@ static int qca_serdev_probe(struct serdev_device *serdev) + default: + qcadev->bt_en = devm_gpiod_get_optional(&serdev->dev, "enable", + GPIOD_OUT_LOW); +- if (IS_ERR_OR_NULL(qcadev->bt_en)) { ++ if (IS_ERR(qcadev->bt_en)) { + dev_warn(&serdev->dev, "failed to acquire enable gpio\n"); + power_ctrl_enabled = false; + } +-- +2.43.0 + diff --git a/queue-6.7/bluetooth-hci_sync-fix-overwriting-request-callback.patch b/queue-6.7/bluetooth-hci_sync-fix-overwriting-request-callback.patch new file mode 100644 index 00000000000..afe117540b7 --- /dev/null +++ b/queue-6.7/bluetooth-hci_sync-fix-overwriting-request-callback.patch @@ -0,0 +1,257 @@ +From 984fe63376dbda0c0421c988c5961b99388c3f38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 16:20:11 -0500 +Subject: Bluetooth: hci_sync: Fix overwriting request callback + +From: Luiz Augusto von Dentz + +[ Upstream commit 2615fd9a7c2507eb3be3fbe49dcec88a2f56454a ] + +In a few cases the stack may generate commands as responses to events +which would happen to overwrite the sent_cmd, so this attempts to store +the request in req_skb so even if sent_cmd is replaced with a new +command the pending request will remain in stored in req_skb. + +Fixes: 6a98e3836fa2 ("Bluetooth: Add helper for serialized HCI command execution") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci_core.h | 1 + + net/bluetooth/hci_conn.c | 2 +- + net/bluetooth/hci_core.c | 46 ++++++++++++++++++++++---------- + net/bluetooth/hci_event.c | 18 ++++++------- + net/bluetooth/hci_sync.c | 21 ++++++++++++--- + 5 files changed, 61 insertions(+), 27 deletions(-) + +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index 65dd286693527..24446038d8a6d 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -553,6 +553,7 @@ struct hci_dev { + __u32 req_status; + __u32 req_result; + struct sk_buff *req_skb; ++ struct sk_buff *req_rsp; + + void *smp_data; + void *smp_bredr_data; +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 029bf74ec5e78..50c55d7335692 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -2977,7 +2977,7 @@ int hci_abort_conn(struct hci_conn *conn, u8 reason) + case HCI_EV_LE_CONN_COMPLETE: + case HCI_EV_LE_ENHANCED_CONN_COMPLETE: + case HCI_EVT_LE_CIS_ESTABLISHED: +- hci_cmd_sync_cancel(hdev, -ECANCELED); ++ hci_cmd_sync_cancel(hdev, ECANCELED); + break; + } + } +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 539305b9a0e27..96707deef296b 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -1491,8 +1491,8 @@ static void hci_cmd_timeout(struct work_struct *work) + struct hci_dev *hdev = container_of(work, struct hci_dev, + cmd_timer.work); + +- if (hdev->sent_cmd) { +- u16 opcode = hci_skb_opcode(hdev->sent_cmd); ++ if (hdev->req_skb) { ++ u16 opcode = hci_skb_opcode(hdev->req_skb); + + bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode); + +@@ -2796,6 +2796,7 @@ void hci_release_dev(struct hci_dev *hdev) + ida_destroy(&hdev->unset_handle_ida); + ida_simple_remove(&hci_index_ida, hdev->id); + kfree_skb(hdev->sent_cmd); ++ kfree_skb(hdev->req_skb); + kfree_skb(hdev->recv_event); + kfree(hdev); + } +@@ -3125,21 +3126,33 @@ int __hci_cmd_send(struct hci_dev *hdev, u16 opcode, u32 plen, + EXPORT_SYMBOL(__hci_cmd_send); + + /* Get data from the previously sent command */ +-void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode) ++static void *hci_cmd_data(struct sk_buff *skb, __u16 opcode) + { + struct hci_command_hdr *hdr; + +- if (!hdev->sent_cmd) ++ if (!skb || skb->len < HCI_COMMAND_HDR_SIZE) + return NULL; + +- hdr = (void *) hdev->sent_cmd->data; ++ hdr = (void *)skb->data; + + if (hdr->opcode != cpu_to_le16(opcode)) + return NULL; + +- BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode); ++ return skb->data + HCI_COMMAND_HDR_SIZE; ++} + +- return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE; ++/* Get data from the previously sent command */ ++void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode) ++{ ++ void *data; ++ ++ /* Check if opcode matches last sent command */ ++ data = hci_cmd_data(hdev->sent_cmd, opcode); ++ if (!data) ++ /* Check if opcode matches last request */ ++ data = hci_cmd_data(hdev->req_skb, opcode); ++ ++ return data; + } + + /* Get data from last received event */ +@@ -4040,17 +4053,19 @@ void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status, + if (!status && !hci_req_is_complete(hdev)) + return; + ++ skb = hdev->req_skb; ++ + /* If this was the last command in a request the complete +- * callback would be found in hdev->sent_cmd instead of the ++ * callback would be found in hdev->req_skb instead of the + * command queue (hdev->cmd_q). + */ +- if (bt_cb(hdev->sent_cmd)->hci.req_flags & HCI_REQ_SKB) { +- *req_complete_skb = bt_cb(hdev->sent_cmd)->hci.req_complete_skb; ++ if (skb && bt_cb(skb)->hci.req_flags & HCI_REQ_SKB) { ++ *req_complete_skb = bt_cb(skb)->hci.req_complete_skb; + return; + } + +- if (bt_cb(hdev->sent_cmd)->hci.req_complete) { +- *req_complete = bt_cb(hdev->sent_cmd)->hci.req_complete; ++ if (skb && bt_cb(skb)->hci.req_complete) { ++ *req_complete = bt_cb(skb)->hci.req_complete; + return; + } + +@@ -4167,8 +4182,11 @@ static void hci_send_cmd_sync(struct hci_dev *hdev, struct sk_buff *skb) + return; + } + +- if (hci_req_status_pend(hdev)) +- hci_dev_set_flag(hdev, HCI_CMD_PENDING); ++ if (hci_req_status_pend(hdev) && ++ !hci_dev_test_and_set_flag(hdev, HCI_CMD_PENDING)) { ++ kfree_skb(hdev->req_skb); ++ hdev->req_skb = skb_clone(skb, GFP_KERNEL); ++ } + + atomic_dec(&hdev->cmd_cnt); + } +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 9ee66b393981b..6275b14b56927 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -4381,7 +4381,7 @@ static void hci_cmd_status_evt(struct hci_dev *hdev, void *data, + * (since for this kind of commands there will not be a command + * complete event). + */ +- if (ev->status || (hdev->sent_cmd && !hci_skb_event(hdev->sent_cmd))) { ++ if (ev->status || (hdev->req_skb && !hci_skb_event(hdev->req_skb))) { + hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete, + req_complete_skb); + if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) { +@@ -7327,10 +7327,10 @@ static void hci_le_meta_evt(struct hci_dev *hdev, void *data, + bt_dev_dbg(hdev, "subevent 0x%2.2x", ev->subevent); + + /* Only match event if command OGF is for LE */ +- if (hdev->sent_cmd && +- hci_opcode_ogf(hci_skb_opcode(hdev->sent_cmd)) == 0x08 && +- hci_skb_event(hdev->sent_cmd) == ev->subevent) { +- *opcode = hci_skb_opcode(hdev->sent_cmd); ++ if (hdev->req_skb && ++ hci_opcode_ogf(hci_skb_opcode(hdev->req_skb)) == 0x08 && ++ hci_skb_event(hdev->req_skb) == ev->subevent) { ++ *opcode = hci_skb_opcode(hdev->req_skb); + hci_req_cmd_complete(hdev, *opcode, 0x00, req_complete, + req_complete_skb); + } +@@ -7717,10 +7717,10 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb) + } + + /* Only match event if command OGF is not for LE */ +- if (hdev->sent_cmd && +- hci_opcode_ogf(hci_skb_opcode(hdev->sent_cmd)) != 0x08 && +- hci_skb_event(hdev->sent_cmd) == event) { +- hci_req_cmd_complete(hdev, hci_skb_opcode(hdev->sent_cmd), ++ if (hdev->req_skb && ++ hci_opcode_ogf(hci_skb_opcode(hdev->req_skb)) != 0x08 && ++ hci_skb_event(hdev->req_skb) == event) { ++ hci_req_cmd_complete(hdev, hci_skb_opcode(hdev->req_skb), + status, &req_complete, &req_complete_skb); + req_evt = event; + } +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index f4c53c428305b..183501f921814 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -32,6 +32,10 @@ static void hci_cmd_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode, + hdev->req_result = result; + hdev->req_status = HCI_REQ_DONE; + ++ /* Free the request command so it is not used as response */ ++ kfree_skb(hdev->req_skb); ++ hdev->req_skb = NULL; ++ + if (skb) { + struct sock *sk = hci_skb_sk(skb); + +@@ -39,7 +43,7 @@ static void hci_cmd_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode, + if (sk) + sock_put(sk); + +- hdev->req_skb = skb_get(skb); ++ hdev->req_rsp = skb_get(skb); + } + + wake_up_interruptible(&hdev->req_wait_q); +@@ -187,8 +191,8 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, + + hdev->req_status = 0; + hdev->req_result = 0; +- skb = hdev->req_skb; +- hdev->req_skb = NULL; ++ skb = hdev->req_rsp; ++ hdev->req_rsp = NULL; + + bt_dev_dbg(hdev, "end: err %d", err); + +@@ -4904,6 +4908,11 @@ int hci_dev_open_sync(struct hci_dev *hdev) + hdev->sent_cmd = NULL; + } + ++ if (hdev->req_skb) { ++ kfree_skb(hdev->req_skb); ++ hdev->req_skb = NULL; ++ } ++ + clear_bit(HCI_RUNNING, &hdev->flags); + hci_sock_dev_event(hdev, HCI_DEV_CLOSE); + +@@ -5065,6 +5074,12 @@ int hci_dev_close_sync(struct hci_dev *hdev) + hdev->sent_cmd = NULL; + } + ++ /* Drop last request */ ++ if (hdev->req_skb) { ++ kfree_skb(hdev->req_skb); ++ hdev->req_skb = NULL; ++ } ++ + clear_bit(HCI_RUNNING, &hdev->flags); + hci_sock_dev_event(hdev, HCI_DEV_CLOSE); + +-- +2.43.0 + diff --git a/queue-6.7/bluetooth-mgmt-remove-leftover-queuing-of-power_off-.patch b/queue-6.7/bluetooth-mgmt-remove-leftover-queuing-of-power_off-.patch new file mode 100644 index 00000000000..f0f8a5fc6b8 --- /dev/null +++ b/queue-6.7/bluetooth-mgmt-remove-leftover-queuing-of-power_off-.patch @@ -0,0 +1,78 @@ +From ed9bc1bf784ee927dbeaf7e0ed8e1d8172b7af22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Jan 2024 19:02:48 +0100 +Subject: Bluetooth: mgmt: Remove leftover queuing of power_off work +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonas Dreßler + +[ Upstream commit fee054b7579fe252f8b9e6c17b9c5bfdaa84dd7e ] + +Queuing of power_off work was introduced in these functions with commits +8b064a3ad377 ("Bluetooth: Clean up HCI state when doing power off") and +c9910d0fb4fc ("Bluetooth: Fix disconnecting connections in non-connected +states") in an effort to clean up state and do things like disconnecting +devices before actually powering off the device. + +After that, commit a3172b7eb4a2 ("Bluetooth: Add timer to force power off") +introduced a timeout to ensure that the device actually got powered off, +even if some of the cleanup work would never complete. + +This code later got refactored with commit cf75ad8b41d2 ("Bluetooth: +hci_sync: Convert MGMT_SET_POWERED"), which made powering off the device +synchronous and removed the need for initiating the power_off work from +other places. The timeout mentioned above got removed too, because we now +also made use of the command timeout during power on/off. + +These days the power_off work still exists, but it only seems to only be +used for HCI_AUTO_OFF functionality, which is why we never noticed +those two leftover places where we queue power_off work. So let's remove +that code. + +Fixes: cf75ad8b41d2 ("Bluetooth: hci_sync: Convert MGMT_SET_POWERED") +Signed-off-by: Jonas Dreßler +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/mgmt.c | 16 ---------------- + 1 file changed, 16 deletions(-) + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 2448a154a4069..324f06e2e9ddb 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -9766,14 +9766,6 @@ void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, + struct mgmt_ev_device_disconnected ev; + struct sock *sk = NULL; + +- /* The connection is still in hci_conn_hash so test for 1 +- * instead of 0 to know if this is the last one. +- */ +- if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { +- cancel_delayed_work(&hdev->power_off); +- queue_work(hdev->req_workqueue, &hdev->power_off.work); +- } +- + if (!mgmt_connected) + return; + +@@ -9830,14 +9822,6 @@ void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, + { + struct mgmt_ev_connect_failed ev; + +- /* The connection is still in hci_conn_hash so test for 1 +- * instead of 0 to know if this is the last one. +- */ +- if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { +- cancel_delayed_work(&hdev->power_off); +- queue_work(hdev->req_workqueue, &hdev->power_off.work); +- } +- + bacpy(&ev.addr.bdaddr, bdaddr); + ev.addr.type = link_to_bdaddr(link_type, addr_type); + ev.status = mgmt_status(status); +-- +2.43.0 + diff --git a/queue-6.7/bluetooth-msft-fix-memory-leak.patch b/queue-6.7/bluetooth-msft-fix-memory-leak.patch new file mode 100644 index 00000000000..a0a63220412 --- /dev/null +++ b/queue-6.7/bluetooth-msft-fix-memory-leak.patch @@ -0,0 +1,42 @@ +From ced8cfc9484666624d52c5cf8241e750eabcf571 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 10:56:49 -0500 +Subject: Bluetooth: msft: Fix memory leak + +From: Luiz Augusto von Dentz + +[ Upstream commit a6e06258f4c31eba0fcd503e19828b5f8fe7b08b ] + +Fix leaking buffer allocated to send MSFT_OP_LE_MONITOR_ADVERTISEMENT. + +Fixes: 9e14606d8f38 ("Bluetooth: msft: Extended monitor tracking by address filter") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/msft.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/bluetooth/msft.c b/net/bluetooth/msft.c +index 630e3023273b2..9612c5d1b13f6 100644 +--- a/net/bluetooth/msft.c ++++ b/net/bluetooth/msft.c +@@ -875,6 +875,7 @@ static int msft_add_address_filter_sync(struct hci_dev *hdev, void *data) + remove = true; + goto done; + } ++ + cp->sub_opcode = MSFT_OP_LE_MONITOR_ADVERTISEMENT; + cp->rssi_high = address_filter->rssi_high; + cp->rssi_low = address_filter->rssi_low; +@@ -887,6 +888,8 @@ static int msft_add_address_filter_sync(struct hci_dev *hdev, void *data) + + skb = __hci_cmd_sync(hdev, hdev->msft_opcode, size, cp, + HCI_CMD_TIMEOUT); ++ kfree(cp); ++ + if (IS_ERR(skb)) { + bt_dev_err(hdev, "Failed to enable address %pMR filter", + &address_filter->bdaddr); +-- +2.43.0 + diff --git a/queue-6.7/bluetooth-remove-bt_hs.patch b/queue-6.7/bluetooth-remove-bt_hs.patch new file mode 100644 index 00000000000..ecac91a6644 --- /dev/null +++ b/queue-6.7/bluetooth-remove-bt_hs.patch @@ -0,0 +1,3573 @@ +From 51be85f8d665d6ce007674c9a60ead3d97ac5968 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Feb 2024 11:18:58 -0500 +Subject: Bluetooth: Remove BT_HS + +From: Luiz Augusto von Dentz + +[ Upstream commit e7b02296fb400ee64822fbdd81a0718449066333 ] + +High Speed, Alternate MAC and PHY (AMP) extension, has been removed from +Bluetooth Core specification on 5.3: + +https://www.bluetooth.com/blog/new-core-specification-v5-3-feature-enhancements/ + +Fixes: 244bc377591c ("Bluetooth: Add BT_HS config option") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci.h | 1 - + include/net/bluetooth/l2cap.h | 42 -- + net/bluetooth/Kconfig | 8 - + net/bluetooth/Makefile | 1 - + net/bluetooth/a2mp.c | 1054 -------------------------------- + net/bluetooth/a2mp.h | 154 ----- + net/bluetooth/amp.c | 590 ------------------ + net/bluetooth/amp.h | 60 -- + net/bluetooth/hci_conn.c | 4 - + net/bluetooth/hci_event.c | 2 - + net/bluetooth/l2cap_core.c | 1069 +-------------------------------- + net/bluetooth/l2cap_sock.c | 18 +- + net/bluetooth/mgmt.c | 73 +-- + 13 files changed, 20 insertions(+), 3056 deletions(-) + delete mode 100644 net/bluetooth/a2mp.c + delete mode 100644 net/bluetooth/a2mp.h + delete mode 100644 net/bluetooth/amp.c + delete mode 100644 net/bluetooth/amp.h + +diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h +index f7918c7551834..0d231024570a3 100644 +--- a/include/net/bluetooth/hci.h ++++ b/include/net/bluetooth/hci.h +@@ -393,7 +393,6 @@ enum { + HCI_LIMITED_PRIVACY, + HCI_RPA_EXPIRED, + HCI_RPA_RESOLVING, +- HCI_HS_ENABLED, + HCI_LE_ENABLED, + HCI_ADVERTISING, + HCI_ADVERTISING_CONNECTABLE, +diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h +index cf393e72d6ed6..92d7197f9a563 100644 +--- a/include/net/bluetooth/l2cap.h ++++ b/include/net/bluetooth/l2cap.h +@@ -59,8 +59,6 @@ + #define L2CAP_WAIT_ACK_POLL_PERIOD msecs_to_jiffies(200) + #define L2CAP_WAIT_ACK_TIMEOUT msecs_to_jiffies(10000) + +-#define L2CAP_A2MP_DEFAULT_MTU 670 +- + /* L2CAP socket address */ + struct sockaddr_l2 { + sa_family_t l2_family; +@@ -109,12 +107,6 @@ struct l2cap_conninfo { + #define L2CAP_ECHO_RSP 0x09 + #define L2CAP_INFO_REQ 0x0a + #define L2CAP_INFO_RSP 0x0b +-#define L2CAP_CREATE_CHAN_REQ 0x0c +-#define L2CAP_CREATE_CHAN_RSP 0x0d +-#define L2CAP_MOVE_CHAN_REQ 0x0e +-#define L2CAP_MOVE_CHAN_RSP 0x0f +-#define L2CAP_MOVE_CHAN_CFM 0x10 +-#define L2CAP_MOVE_CHAN_CFM_RSP 0x11 + #define L2CAP_CONN_PARAM_UPDATE_REQ 0x12 + #define L2CAP_CONN_PARAM_UPDATE_RSP 0x13 + #define L2CAP_LE_CONN_REQ 0x14 +@@ -144,7 +136,6 @@ struct l2cap_conninfo { + /* L2CAP fixed channels */ + #define L2CAP_FC_SIG_BREDR 0x02 + #define L2CAP_FC_CONNLESS 0x04 +-#define L2CAP_FC_A2MP 0x08 + #define L2CAP_FC_ATT 0x10 + #define L2CAP_FC_SIG_LE 0x20 + #define L2CAP_FC_SMP_LE 0x40 +@@ -267,7 +258,6 @@ struct l2cap_conn_rsp { + /* channel identifier */ + #define L2CAP_CID_SIGNALING 0x0001 + #define L2CAP_CID_CONN_LESS 0x0002 +-#define L2CAP_CID_A2MP 0x0003 + #define L2CAP_CID_ATT 0x0004 + #define L2CAP_CID_LE_SIGNALING 0x0005 + #define L2CAP_CID_SMP 0x0006 +@@ -282,7 +272,6 @@ struct l2cap_conn_rsp { + #define L2CAP_CR_BAD_PSM 0x0002 + #define L2CAP_CR_SEC_BLOCK 0x0003 + #define L2CAP_CR_NO_MEM 0x0004 +-#define L2CAP_CR_BAD_AMP 0x0005 + #define L2CAP_CR_INVALID_SCID 0x0006 + #define L2CAP_CR_SCID_IN_USE 0x0007 + +@@ -404,29 +393,6 @@ struct l2cap_info_rsp { + __u8 data[]; + } __packed; + +-struct l2cap_create_chan_req { +- __le16 psm; +- __le16 scid; +- __u8 amp_id; +-} __packed; +- +-struct l2cap_create_chan_rsp { +- __le16 dcid; +- __le16 scid; +- __le16 result; +- __le16 status; +-} __packed; +- +-struct l2cap_move_chan_req { +- __le16 icid; +- __u8 dest_amp_id; +-} __packed; +- +-struct l2cap_move_chan_rsp { +- __le16 icid; +- __le16 result; +-} __packed; +- + #define L2CAP_MR_SUCCESS 0x0000 + #define L2CAP_MR_PEND 0x0001 + #define L2CAP_MR_BAD_ID 0x0002 +@@ -539,8 +505,6 @@ struct l2cap_seq_list { + + struct l2cap_chan { + struct l2cap_conn *conn; +- struct hci_conn *hs_hcon; +- struct hci_chan *hs_hchan; + struct kref kref; + atomic_t nesting; + +@@ -591,12 +555,6 @@ struct l2cap_chan { + unsigned long conn_state; + unsigned long flags; + +- __u8 remote_amp_id; +- __u8 local_amp_id; +- __u8 move_id; +- __u8 move_state; +- __u8 move_role; +- + __u16 next_tx_seq; + __u16 expected_ack_seq; + __u16 expected_tx_seq; +diff --git a/net/bluetooth/Kconfig b/net/bluetooth/Kconfig +index da7cac0a1b716..6b2b65a667008 100644 +--- a/net/bluetooth/Kconfig ++++ b/net/bluetooth/Kconfig +@@ -62,14 +62,6 @@ source "net/bluetooth/cmtp/Kconfig" + + source "net/bluetooth/hidp/Kconfig" + +-config BT_HS +- bool "Bluetooth High Speed (HS) features" +- depends on BT_BREDR +- help +- Bluetooth High Speed includes support for off-loading +- Bluetooth connections via 802.11 (wifi) physical layer +- available with Bluetooth version 3.0 or later. +- + config BT_LE + bool "Bluetooth Low Energy (LE) features" + depends on BT +diff --git a/net/bluetooth/Makefile b/net/bluetooth/Makefile +index 141ac1fda0bfa..628d448d78be3 100644 +--- a/net/bluetooth/Makefile ++++ b/net/bluetooth/Makefile +@@ -21,7 +21,6 @@ bluetooth-$(CONFIG_DEV_COREDUMP) += coredump.o + + bluetooth-$(CONFIG_BT_BREDR) += sco.o + bluetooth-$(CONFIG_BT_LE) += iso.o +-bluetooth-$(CONFIG_BT_HS) += a2mp.o amp.o + bluetooth-$(CONFIG_BT_LEDS) += leds.o + bluetooth-$(CONFIG_BT_MSFTEXT) += msft.o + bluetooth-$(CONFIG_BT_AOSPEXT) += aosp.o +diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c +deleted file mode 100644 +index e7adb8a98cf90..0000000000000 +--- a/net/bluetooth/a2mp.c ++++ /dev/null +@@ -1,1054 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0-only +-/* +- Copyright (c) 2010,2011 Code Aurora Forum. All rights reserved. +- Copyright (c) 2011,2012 Intel Corp. +- +-*/ +- +-#include +-#include +-#include +- +-#include "hci_request.h" +-#include "a2mp.h" +-#include "amp.h" +- +-#define A2MP_FEAT_EXT 0x8000 +- +-/* Global AMP Manager list */ +-static LIST_HEAD(amp_mgr_list); +-static DEFINE_MUTEX(amp_mgr_list_lock); +- +-/* A2MP build & send command helper functions */ +-static struct a2mp_cmd *__a2mp_build(u8 code, u8 ident, u16 len, void *data) +-{ +- struct a2mp_cmd *cmd; +- int plen; +- +- plen = sizeof(*cmd) + len; +- cmd = kzalloc(plen, GFP_KERNEL); +- if (!cmd) +- return NULL; +- +- cmd->code = code; +- cmd->ident = ident; +- cmd->len = cpu_to_le16(len); +- +- memcpy(cmd->data, data, len); +- +- return cmd; +-} +- +-static void a2mp_send(struct amp_mgr *mgr, u8 code, u8 ident, u16 len, void *data) +-{ +- struct l2cap_chan *chan = mgr->a2mp_chan; +- struct a2mp_cmd *cmd; +- u16 total_len = len + sizeof(*cmd); +- struct kvec iv; +- struct msghdr msg; +- +- cmd = __a2mp_build(code, ident, len, data); +- if (!cmd) +- return; +- +- iv.iov_base = cmd; +- iv.iov_len = total_len; +- +- memset(&msg, 0, sizeof(msg)); +- +- iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, &iv, 1, total_len); +- +- l2cap_chan_send(chan, &msg, total_len); +- +- kfree(cmd); +-} +- +-static u8 __next_ident(struct amp_mgr *mgr) +-{ +- if (++mgr->ident == 0) +- mgr->ident = 1; +- +- return mgr->ident; +-} +- +-static struct amp_mgr *amp_mgr_lookup_by_state(u8 state) +-{ +- struct amp_mgr *mgr; +- +- mutex_lock(&_mgr_list_lock); +- list_for_each_entry(mgr, &_mgr_list, list) { +- if (test_and_clear_bit(state, &mgr->state)) { +- amp_mgr_get(mgr); +- mutex_unlock(&_mgr_list_lock); +- return mgr; +- } +- } +- mutex_unlock(&_mgr_list_lock); +- +- return NULL; +-} +- +-/* hci_dev_list shall be locked */ +-static void __a2mp_add_cl(struct amp_mgr *mgr, struct a2mp_cl *cl) +-{ +- struct hci_dev *hdev; +- int i = 1; +- +- cl[0].id = AMP_ID_BREDR; +- cl[0].type = AMP_TYPE_BREDR; +- cl[0].status = AMP_STATUS_BLUETOOTH_ONLY; +- +- list_for_each_entry(hdev, &hci_dev_list, list) { +- if (hdev->dev_type == HCI_AMP) { +- cl[i].id = hdev->id; +- cl[i].type = hdev->amp_type; +- if (test_bit(HCI_UP, &hdev->flags)) +- cl[i].status = hdev->amp_status; +- else +- cl[i].status = AMP_STATUS_POWERED_DOWN; +- i++; +- } +- } +-} +- +-/* Processing A2MP messages */ +-static int a2mp_command_rej(struct amp_mgr *mgr, struct sk_buff *skb, +- struct a2mp_cmd *hdr) +-{ +- struct a2mp_cmd_rej *rej = (void *) skb->data; +- +- if (le16_to_cpu(hdr->len) < sizeof(*rej)) +- return -EINVAL; +- +- BT_DBG("ident %u reason %d", hdr->ident, le16_to_cpu(rej->reason)); +- +- skb_pull(skb, sizeof(*rej)); +- +- return 0; +-} +- +-static int a2mp_discover_req(struct amp_mgr *mgr, struct sk_buff *skb, +- struct a2mp_cmd *hdr) +-{ +- struct a2mp_discov_req *req = (void *) skb->data; +- u16 len = le16_to_cpu(hdr->len); +- struct a2mp_discov_rsp *rsp; +- u16 ext_feat; +- u8 num_ctrl; +- struct hci_dev *hdev; +- +- if (len < sizeof(*req)) +- return -EINVAL; +- +- skb_pull(skb, sizeof(*req)); +- +- ext_feat = le16_to_cpu(req->ext_feat); +- +- BT_DBG("mtu %d efm 0x%4.4x", le16_to_cpu(req->mtu), ext_feat); +- +- /* check that packet is not broken for now */ +- while (ext_feat & A2MP_FEAT_EXT) { +- if (len < sizeof(ext_feat)) +- return -EINVAL; +- +- ext_feat = get_unaligned_le16(skb->data); +- BT_DBG("efm 0x%4.4x", ext_feat); +- len -= sizeof(ext_feat); +- skb_pull(skb, sizeof(ext_feat)); +- } +- +- read_lock(&hci_dev_list_lock); +- +- /* at minimum the BR/EDR needs to be listed */ +- num_ctrl = 1; +- +- list_for_each_entry(hdev, &hci_dev_list, list) { +- if (hdev->dev_type == HCI_AMP) +- num_ctrl++; +- } +- +- len = struct_size(rsp, cl, num_ctrl); +- rsp = kmalloc(len, GFP_ATOMIC); +- if (!rsp) { +- read_unlock(&hci_dev_list_lock); +- return -ENOMEM; +- } +- +- rsp->mtu = cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU); +- rsp->ext_feat = 0; +- +- __a2mp_add_cl(mgr, rsp->cl); +- +- read_unlock(&hci_dev_list_lock); +- +- a2mp_send(mgr, A2MP_DISCOVER_RSP, hdr->ident, len, rsp); +- +- kfree(rsp); +- return 0; +-} +- +-static int a2mp_discover_rsp(struct amp_mgr *mgr, struct sk_buff *skb, +- struct a2mp_cmd *hdr) +-{ +- struct a2mp_discov_rsp *rsp = (void *) skb->data; +- u16 len = le16_to_cpu(hdr->len); +- struct a2mp_cl *cl; +- u16 ext_feat; +- bool found = false; +- +- if (len < sizeof(*rsp)) +- return -EINVAL; +- +- len -= sizeof(*rsp); +- skb_pull(skb, sizeof(*rsp)); +- +- ext_feat = le16_to_cpu(rsp->ext_feat); +- +- BT_DBG("mtu %d efm 0x%4.4x", le16_to_cpu(rsp->mtu), ext_feat); +- +- /* check that packet is not broken for now */ +- while (ext_feat & A2MP_FEAT_EXT) { +- if (len < sizeof(ext_feat)) +- return -EINVAL; +- +- ext_feat = get_unaligned_le16(skb->data); +- BT_DBG("efm 0x%4.4x", ext_feat); +- len -= sizeof(ext_feat); +- skb_pull(skb, sizeof(ext_feat)); +- } +- +- cl = (void *) skb->data; +- while (len >= sizeof(*cl)) { +- BT_DBG("Remote AMP id %u type %u status %u", cl->id, cl->type, +- cl->status); +- +- if (cl->id != AMP_ID_BREDR && cl->type != AMP_TYPE_BREDR) { +- struct a2mp_info_req req; +- +- found = true; +- +- memset(&req, 0, sizeof(req)); +- +- req.id = cl->id; +- a2mp_send(mgr, A2MP_GETINFO_REQ, __next_ident(mgr), +- sizeof(req), &req); +- } +- +- len -= sizeof(*cl); +- cl = skb_pull(skb, sizeof(*cl)); +- } +- +- /* Fall back to L2CAP init sequence */ +- if (!found) { +- struct l2cap_conn *conn = mgr->l2cap_conn; +- struct l2cap_chan *chan; +- +- mutex_lock(&conn->chan_lock); +- +- list_for_each_entry(chan, &conn->chan_l, list) { +- +- BT_DBG("chan %p state %s", chan, +- state_to_string(chan->state)); +- +- if (chan->scid == L2CAP_CID_A2MP) +- continue; +- +- l2cap_chan_lock(chan); +- +- if (chan->state == BT_CONNECT) +- l2cap_send_conn_req(chan); +- +- l2cap_chan_unlock(chan); +- } +- +- mutex_unlock(&conn->chan_lock); +- } +- +- return 0; +-} +- +-static int a2mp_change_notify(struct amp_mgr *mgr, struct sk_buff *skb, +- struct a2mp_cmd *hdr) +-{ +- struct a2mp_cl *cl = (void *) skb->data; +- +- while (skb->len >= sizeof(*cl)) { +- BT_DBG("Controller id %u type %u status %u", cl->id, cl->type, +- cl->status); +- cl = skb_pull(skb, sizeof(*cl)); +- } +- +- /* TODO send A2MP_CHANGE_RSP */ +- +- return 0; +-} +- +-static void read_local_amp_info_complete(struct hci_dev *hdev, u8 status, +- u16 opcode) +-{ +- BT_DBG("%s status 0x%2.2x", hdev->name, status); +- +- a2mp_send_getinfo_rsp(hdev); +-} +- +-static int a2mp_getinfo_req(struct amp_mgr *mgr, struct sk_buff *skb, +- struct a2mp_cmd *hdr) +-{ +- struct a2mp_info_req *req = (void *) skb->data; +- struct hci_dev *hdev; +- struct hci_request hreq; +- int err = 0; +- +- if (le16_to_cpu(hdr->len) < sizeof(*req)) +- return -EINVAL; +- +- BT_DBG("id %u", req->id); +- +- hdev = hci_dev_get(req->id); +- if (!hdev || hdev->dev_type != HCI_AMP) { +- struct a2mp_info_rsp rsp; +- +- memset(&rsp, 0, sizeof(rsp)); +- +- rsp.id = req->id; +- rsp.status = A2MP_STATUS_INVALID_CTRL_ID; +- +- a2mp_send(mgr, A2MP_GETINFO_RSP, hdr->ident, sizeof(rsp), +- &rsp); +- +- goto done; +- } +- +- set_bit(READ_LOC_AMP_INFO, &mgr->state); +- hci_req_init(&hreq, hdev); +- hci_req_add(&hreq, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL); +- err = hci_req_run(&hreq, read_local_amp_info_complete); +- if (err < 0) +- a2mp_send_getinfo_rsp(hdev); +- +-done: +- if (hdev) +- hci_dev_put(hdev); +- +- skb_pull(skb, sizeof(*req)); +- return 0; +-} +- +-static int a2mp_getinfo_rsp(struct amp_mgr *mgr, struct sk_buff *skb, +- struct a2mp_cmd *hdr) +-{ +- struct a2mp_info_rsp *rsp = (struct a2mp_info_rsp *) skb->data; +- struct a2mp_amp_assoc_req req; +- struct amp_ctrl *ctrl; +- +- if (le16_to_cpu(hdr->len) < sizeof(*rsp)) +- return -EINVAL; +- +- BT_DBG("id %u status 0x%2.2x", rsp->id, rsp->status); +- +- if (rsp->status) +- return -EINVAL; +- +- ctrl = amp_ctrl_add(mgr, rsp->id); +- if (!ctrl) +- return -ENOMEM; +- +- memset(&req, 0, sizeof(req)); +- +- req.id = rsp->id; +- a2mp_send(mgr, A2MP_GETAMPASSOC_REQ, __next_ident(mgr), sizeof(req), +- &req); +- +- skb_pull(skb, sizeof(*rsp)); +- return 0; +-} +- +-static int a2mp_getampassoc_req(struct amp_mgr *mgr, struct sk_buff *skb, +- struct a2mp_cmd *hdr) +-{ +- struct a2mp_amp_assoc_req *req = (void *) skb->data; +- struct hci_dev *hdev; +- struct amp_mgr *tmp; +- +- if (le16_to_cpu(hdr->len) < sizeof(*req)) +- return -EINVAL; +- +- BT_DBG("id %u", req->id); +- +- /* Make sure that other request is not processed */ +- tmp = amp_mgr_lookup_by_state(READ_LOC_AMP_ASSOC); +- +- hdev = hci_dev_get(req->id); +- if (!hdev || hdev->amp_type == AMP_TYPE_BREDR || tmp) { +- struct a2mp_amp_assoc_rsp rsp; +- +- memset(&rsp, 0, sizeof(rsp)); +- rsp.id = req->id; +- +- if (tmp) { +- rsp.status = A2MP_STATUS_COLLISION_OCCURED; +- amp_mgr_put(tmp); +- } else { +- rsp.status = A2MP_STATUS_INVALID_CTRL_ID; +- } +- +- a2mp_send(mgr, A2MP_GETAMPASSOC_RSP, hdr->ident, sizeof(rsp), +- &rsp); +- +- goto done; +- } +- +- amp_read_loc_assoc(hdev, mgr); +- +-done: +- if (hdev) +- hci_dev_put(hdev); +- +- skb_pull(skb, sizeof(*req)); +- return 0; +-} +- +-static int a2mp_getampassoc_rsp(struct amp_mgr *mgr, struct sk_buff *skb, +- struct a2mp_cmd *hdr) +-{ +- struct a2mp_amp_assoc_rsp *rsp = (void *) skb->data; +- u16 len = le16_to_cpu(hdr->len); +- struct hci_dev *hdev; +- struct amp_ctrl *ctrl; +- struct hci_conn *hcon; +- size_t assoc_len; +- +- if (len < sizeof(*rsp)) +- return -EINVAL; +- +- assoc_len = len - sizeof(*rsp); +- +- BT_DBG("id %u status 0x%2.2x assoc len %zu", rsp->id, rsp->status, +- assoc_len); +- +- if (rsp->status) +- return -EINVAL; +- +- /* Save remote ASSOC data */ +- ctrl = amp_ctrl_lookup(mgr, rsp->id); +- if (ctrl) { +- u8 *assoc; +- +- assoc = kmemdup(rsp->amp_assoc, assoc_len, GFP_KERNEL); +- if (!assoc) { +- amp_ctrl_put(ctrl); +- return -ENOMEM; +- } +- +- ctrl->assoc = assoc; +- ctrl->assoc_len = assoc_len; +- ctrl->assoc_rem_len = assoc_len; +- ctrl->assoc_len_so_far = 0; +- +- amp_ctrl_put(ctrl); +- } +- +- /* Create Phys Link */ +- hdev = hci_dev_get(rsp->id); +- if (!hdev) +- return -EINVAL; +- +- hcon = phylink_add(hdev, mgr, rsp->id, true); +- if (!hcon) +- goto done; +- +- BT_DBG("Created hcon %p: loc:%u -> rem:%u", hcon, hdev->id, rsp->id); +- +- mgr->bredr_chan->remote_amp_id = rsp->id; +- +- amp_create_phylink(hdev, mgr, hcon); +- +-done: +- hci_dev_put(hdev); +- skb_pull(skb, len); +- return 0; +-} +- +-static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb, +- struct a2mp_cmd *hdr) +-{ +- struct a2mp_physlink_req *req = (void *) skb->data; +- struct a2mp_physlink_rsp rsp; +- struct hci_dev *hdev; +- struct hci_conn *hcon; +- struct amp_ctrl *ctrl; +- +- if (le16_to_cpu(hdr->len) < sizeof(*req)) +- return -EINVAL; +- +- BT_DBG("local_id %u, remote_id %u", req->local_id, req->remote_id); +- +- memset(&rsp, 0, sizeof(rsp)); +- +- rsp.local_id = req->remote_id; +- rsp.remote_id = req->local_id; +- +- hdev = hci_dev_get(req->remote_id); +- if (!hdev || hdev->amp_type == AMP_TYPE_BREDR) { +- rsp.status = A2MP_STATUS_INVALID_CTRL_ID; +- goto send_rsp; +- } +- +- ctrl = amp_ctrl_lookup(mgr, rsp.remote_id); +- if (!ctrl) { +- ctrl = amp_ctrl_add(mgr, rsp.remote_id); +- if (ctrl) { +- amp_ctrl_get(ctrl); +- } else { +- rsp.status = A2MP_STATUS_UNABLE_START_LINK_CREATION; +- goto send_rsp; +- } +- } +- +- if (ctrl) { +- size_t assoc_len = le16_to_cpu(hdr->len) - sizeof(*req); +- u8 *assoc; +- +- assoc = kmemdup(req->amp_assoc, assoc_len, GFP_KERNEL); +- if (!assoc) { +- amp_ctrl_put(ctrl); +- hci_dev_put(hdev); +- return -ENOMEM; +- } +- +- ctrl->assoc = assoc; +- ctrl->assoc_len = assoc_len; +- ctrl->assoc_rem_len = assoc_len; +- ctrl->assoc_len_so_far = 0; +- +- amp_ctrl_put(ctrl); +- } +- +- hcon = phylink_add(hdev, mgr, req->local_id, false); +- if (hcon) { +- amp_accept_phylink(hdev, mgr, hcon); +- rsp.status = A2MP_STATUS_SUCCESS; +- } else { +- rsp.status = A2MP_STATUS_UNABLE_START_LINK_CREATION; +- } +- +-send_rsp: +- if (hdev) +- hci_dev_put(hdev); +- +- /* Reply error now and success after HCI Write Remote AMP Assoc +- command complete with success status +- */ +- if (rsp.status != A2MP_STATUS_SUCCESS) { +- a2mp_send(mgr, A2MP_CREATEPHYSLINK_RSP, hdr->ident, +- sizeof(rsp), &rsp); +- } else { +- set_bit(WRITE_REMOTE_AMP_ASSOC, &mgr->state); +- mgr->ident = hdr->ident; +- } +- +- skb_pull(skb, le16_to_cpu(hdr->len)); +- return 0; +-} +- +-static int a2mp_discphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb, +- struct a2mp_cmd *hdr) +-{ +- struct a2mp_physlink_req *req = (void *) skb->data; +- struct a2mp_physlink_rsp rsp; +- struct hci_dev *hdev; +- struct hci_conn *hcon; +- +- if (le16_to_cpu(hdr->len) < sizeof(*req)) +- return -EINVAL; +- +- BT_DBG("local_id %u remote_id %u", req->local_id, req->remote_id); +- +- memset(&rsp, 0, sizeof(rsp)); +- +- rsp.local_id = req->remote_id; +- rsp.remote_id = req->local_id; +- rsp.status = A2MP_STATUS_SUCCESS; +- +- hdev = hci_dev_get(req->remote_id); +- if (!hdev) { +- rsp.status = A2MP_STATUS_INVALID_CTRL_ID; +- goto send_rsp; +- } +- +- hcon = hci_conn_hash_lookup_ba(hdev, AMP_LINK, +- &mgr->l2cap_conn->hcon->dst); +- if (!hcon) { +- bt_dev_err(hdev, "no phys link exist"); +- rsp.status = A2MP_STATUS_NO_PHYSICAL_LINK_EXISTS; +- goto clean; +- } +- +- /* TODO Disconnect Phys Link here */ +- +-clean: +- hci_dev_put(hdev); +- +-send_rsp: +- a2mp_send(mgr, A2MP_DISCONNPHYSLINK_RSP, hdr->ident, sizeof(rsp), &rsp); +- +- skb_pull(skb, sizeof(*req)); +- return 0; +-} +- +-static inline int a2mp_cmd_rsp(struct amp_mgr *mgr, struct sk_buff *skb, +- struct a2mp_cmd *hdr) +-{ +- BT_DBG("ident %u code 0x%2.2x", hdr->ident, hdr->code); +- +- skb_pull(skb, le16_to_cpu(hdr->len)); +- return 0; +-} +- +-/* Handle A2MP signalling */ +-static int a2mp_chan_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb) +-{ +- struct a2mp_cmd *hdr; +- struct amp_mgr *mgr = chan->data; +- int err = 0; +- +- amp_mgr_get(mgr); +- +- while (skb->len >= sizeof(*hdr)) { +- u16 len; +- +- hdr = (void *) skb->data; +- len = le16_to_cpu(hdr->len); +- +- BT_DBG("code 0x%2.2x id %u len %u", hdr->code, hdr->ident, len); +- +- skb_pull(skb, sizeof(*hdr)); +- +- if (len > skb->len || !hdr->ident) { +- err = -EINVAL; +- break; +- } +- +- mgr->ident = hdr->ident; +- +- switch (hdr->code) { +- case A2MP_COMMAND_REJ: +- a2mp_command_rej(mgr, skb, hdr); +- break; +- +- case A2MP_DISCOVER_REQ: +- err = a2mp_discover_req(mgr, skb, hdr); +- break; +- +- case A2MP_CHANGE_NOTIFY: +- err = a2mp_change_notify(mgr, skb, hdr); +- break; +- +- case A2MP_GETINFO_REQ: +- err = a2mp_getinfo_req(mgr, skb, hdr); +- break; +- +- case A2MP_GETAMPASSOC_REQ: +- err = a2mp_getampassoc_req(mgr, skb, hdr); +- break; +- +- case A2MP_CREATEPHYSLINK_REQ: +- err = a2mp_createphyslink_req(mgr, skb, hdr); +- break; +- +- case A2MP_DISCONNPHYSLINK_REQ: +- err = a2mp_discphyslink_req(mgr, skb, hdr); +- break; +- +- case A2MP_DISCOVER_RSP: +- err = a2mp_discover_rsp(mgr, skb, hdr); +- break; +- +- case A2MP_GETINFO_RSP: +- err = a2mp_getinfo_rsp(mgr, skb, hdr); +- break; +- +- case A2MP_GETAMPASSOC_RSP: +- err = a2mp_getampassoc_rsp(mgr, skb, hdr); +- break; +- +- case A2MP_CHANGE_RSP: +- case A2MP_CREATEPHYSLINK_RSP: +- case A2MP_DISCONNPHYSLINK_RSP: +- err = a2mp_cmd_rsp(mgr, skb, hdr); +- break; +- +- default: +- BT_ERR("Unknown A2MP sig cmd 0x%2.2x", hdr->code); +- err = -EINVAL; +- break; +- } +- } +- +- if (err) { +- struct a2mp_cmd_rej rej; +- +- memset(&rej, 0, sizeof(rej)); +- +- rej.reason = cpu_to_le16(0); +- hdr = (void *) skb->data; +- +- BT_DBG("Send A2MP Rej: cmd 0x%2.2x err %d", hdr->code, err); +- +- a2mp_send(mgr, A2MP_COMMAND_REJ, hdr->ident, sizeof(rej), +- &rej); +- } +- +- /* Always free skb and return success error code to prevent +- from sending L2CAP Disconnect over A2MP channel */ +- kfree_skb(skb); +- +- amp_mgr_put(mgr); +- +- return 0; +-} +- +-static void a2mp_chan_close_cb(struct l2cap_chan *chan) +-{ +- l2cap_chan_put(chan); +-} +- +-static void a2mp_chan_state_change_cb(struct l2cap_chan *chan, int state, +- int err) +-{ +- struct amp_mgr *mgr = chan->data; +- +- if (!mgr) +- return; +- +- BT_DBG("chan %p state %s", chan, state_to_string(state)); +- +- chan->state = state; +- +- switch (state) { +- case BT_CLOSED: +- if (mgr) +- amp_mgr_put(mgr); +- break; +- } +-} +- +-static struct sk_buff *a2mp_chan_alloc_skb_cb(struct l2cap_chan *chan, +- unsigned long hdr_len, +- unsigned long len, int nb) +-{ +- struct sk_buff *skb; +- +- skb = bt_skb_alloc(hdr_len + len, GFP_KERNEL); +- if (!skb) +- return ERR_PTR(-ENOMEM); +- +- return skb; +-} +- +-static const struct l2cap_ops a2mp_chan_ops = { +- .name = "L2CAP A2MP channel", +- .recv = a2mp_chan_recv_cb, +- .close = a2mp_chan_close_cb, +- .state_change = a2mp_chan_state_change_cb, +- .alloc_skb = a2mp_chan_alloc_skb_cb, +- +- /* Not implemented for A2MP */ +- .new_connection = l2cap_chan_no_new_connection, +- .teardown = l2cap_chan_no_teardown, +- .ready = l2cap_chan_no_ready, +- .defer = l2cap_chan_no_defer, +- .resume = l2cap_chan_no_resume, +- .set_shutdown = l2cap_chan_no_set_shutdown, +- .get_sndtimeo = l2cap_chan_no_get_sndtimeo, +-}; +- +-static struct l2cap_chan *a2mp_chan_open(struct l2cap_conn *conn, bool locked) +-{ +- struct l2cap_chan *chan; +- int err; +- +- chan = l2cap_chan_create(); +- if (!chan) +- return NULL; +- +- BT_DBG("chan %p", chan); +- +- chan->chan_type = L2CAP_CHAN_FIXED; +- chan->scid = L2CAP_CID_A2MP; +- chan->dcid = L2CAP_CID_A2MP; +- chan->omtu = L2CAP_A2MP_DEFAULT_MTU; +- chan->imtu = L2CAP_A2MP_DEFAULT_MTU; +- chan->flush_to = L2CAP_DEFAULT_FLUSH_TO; +- +- chan->ops = &a2mp_chan_ops; +- +- l2cap_chan_set_defaults(chan); +- chan->remote_max_tx = chan->max_tx; +- chan->remote_tx_win = chan->tx_win; +- +- chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO; +- chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO; +- +- skb_queue_head_init(&chan->tx_q); +- +- chan->mode = L2CAP_MODE_ERTM; +- +- err = l2cap_ertm_init(chan); +- if (err < 0) { +- l2cap_chan_del(chan, 0); +- return NULL; +- } +- +- chan->conf_state = 0; +- +- if (locked) +- __l2cap_chan_add(conn, chan); +- else +- l2cap_chan_add(conn, chan); +- +- chan->remote_mps = chan->omtu; +- chan->mps = chan->omtu; +- +- chan->state = BT_CONNECTED; +- +- return chan; +-} +- +-/* AMP Manager functions */ +-struct amp_mgr *amp_mgr_get(struct amp_mgr *mgr) +-{ +- BT_DBG("mgr %p orig refcnt %d", mgr, kref_read(&mgr->kref)); +- +- kref_get(&mgr->kref); +- +- return mgr; +-} +- +-static void amp_mgr_destroy(struct kref *kref) +-{ +- struct amp_mgr *mgr = container_of(kref, struct amp_mgr, kref); +- +- BT_DBG("mgr %p", mgr); +- +- mutex_lock(&_mgr_list_lock); +- list_del(&mgr->list); +- mutex_unlock(&_mgr_list_lock); +- +- amp_ctrl_list_flush(mgr); +- kfree(mgr); +-} +- +-int amp_mgr_put(struct amp_mgr *mgr) +-{ +- BT_DBG("mgr %p orig refcnt %d", mgr, kref_read(&mgr->kref)); +- +- return kref_put(&mgr->kref, &_mgr_destroy); +-} +- +-static struct amp_mgr *amp_mgr_create(struct l2cap_conn *conn, bool locked) +-{ +- struct amp_mgr *mgr; +- struct l2cap_chan *chan; +- +- mgr = kzalloc(sizeof(*mgr), GFP_KERNEL); +- if (!mgr) +- return NULL; +- +- BT_DBG("conn %p mgr %p", conn, mgr); +- +- mgr->l2cap_conn = conn; +- +- chan = a2mp_chan_open(conn, locked); +- if (!chan) { +- kfree(mgr); +- return NULL; +- } +- +- mgr->a2mp_chan = chan; +- chan->data = mgr; +- +- conn->hcon->amp_mgr = mgr; +- +- kref_init(&mgr->kref); +- +- /* Remote AMP ctrl list initialization */ +- INIT_LIST_HEAD(&mgr->amp_ctrls); +- mutex_init(&mgr->amp_ctrls_lock); +- +- mutex_lock(&_mgr_list_lock); +- list_add(&mgr->list, &_mgr_list); +- mutex_unlock(&_mgr_list_lock); +- +- return mgr; +-} +- +-struct l2cap_chan *a2mp_channel_create(struct l2cap_conn *conn, +- struct sk_buff *skb) +-{ +- struct amp_mgr *mgr; +- +- if (conn->hcon->type != ACL_LINK) +- return NULL; +- +- mgr = amp_mgr_create(conn, false); +- if (!mgr) { +- BT_ERR("Could not create AMP manager"); +- return NULL; +- } +- +- BT_DBG("mgr: %p chan %p", mgr, mgr->a2mp_chan); +- +- return mgr->a2mp_chan; +-} +- +-void a2mp_send_getinfo_rsp(struct hci_dev *hdev) +-{ +- struct amp_mgr *mgr; +- struct a2mp_info_rsp rsp; +- +- mgr = amp_mgr_lookup_by_state(READ_LOC_AMP_INFO); +- if (!mgr) +- return; +- +- BT_DBG("%s mgr %p", hdev->name, mgr); +- +- memset(&rsp, 0, sizeof(rsp)); +- +- rsp.id = hdev->id; +- rsp.status = A2MP_STATUS_INVALID_CTRL_ID; +- +- if (hdev->amp_type != AMP_TYPE_BREDR) { +- rsp.status = 0; +- rsp.total_bw = cpu_to_le32(hdev->amp_total_bw); +- rsp.max_bw = cpu_to_le32(hdev->amp_max_bw); +- rsp.min_latency = cpu_to_le32(hdev->amp_min_latency); +- rsp.pal_cap = cpu_to_le16(hdev->amp_pal_cap); +- rsp.assoc_size = cpu_to_le16(hdev->amp_assoc_size); +- } +- +- a2mp_send(mgr, A2MP_GETINFO_RSP, mgr->ident, sizeof(rsp), &rsp); +- amp_mgr_put(mgr); +-} +- +-void a2mp_send_getampassoc_rsp(struct hci_dev *hdev, u8 status) +-{ +- struct amp_mgr *mgr; +- struct amp_assoc *loc_assoc = &hdev->loc_assoc; +- struct a2mp_amp_assoc_rsp *rsp; +- size_t len; +- +- mgr = amp_mgr_lookup_by_state(READ_LOC_AMP_ASSOC); +- if (!mgr) +- return; +- +- BT_DBG("%s mgr %p", hdev->name, mgr); +- +- len = sizeof(struct a2mp_amp_assoc_rsp) + loc_assoc->len; +- rsp = kzalloc(len, GFP_KERNEL); +- if (!rsp) { +- amp_mgr_put(mgr); +- return; +- } +- +- rsp->id = hdev->id; +- +- if (status) { +- rsp->status = A2MP_STATUS_INVALID_CTRL_ID; +- } else { +- rsp->status = A2MP_STATUS_SUCCESS; +- memcpy(rsp->amp_assoc, loc_assoc->data, loc_assoc->len); +- } +- +- a2mp_send(mgr, A2MP_GETAMPASSOC_RSP, mgr->ident, len, rsp); +- amp_mgr_put(mgr); +- kfree(rsp); +-} +- +-void a2mp_send_create_phy_link_req(struct hci_dev *hdev, u8 status) +-{ +- struct amp_mgr *mgr; +- struct amp_assoc *loc_assoc = &hdev->loc_assoc; +- struct a2mp_physlink_req *req; +- struct l2cap_chan *bredr_chan; +- size_t len; +- +- mgr = amp_mgr_lookup_by_state(READ_LOC_AMP_ASSOC_FINAL); +- if (!mgr) +- return; +- +- len = sizeof(*req) + loc_assoc->len; +- +- BT_DBG("%s mgr %p assoc_len %zu", hdev->name, mgr, len); +- +- req = kzalloc(len, GFP_KERNEL); +- if (!req) { +- amp_mgr_put(mgr); +- return; +- } +- +- bredr_chan = mgr->bredr_chan; +- if (!bredr_chan) +- goto clean; +- +- req->local_id = hdev->id; +- req->remote_id = bredr_chan->remote_amp_id; +- memcpy(req->amp_assoc, loc_assoc->data, loc_assoc->len); +- +- a2mp_send(mgr, A2MP_CREATEPHYSLINK_REQ, __next_ident(mgr), len, req); +- +-clean: +- amp_mgr_put(mgr); +- kfree(req); +-} +- +-void a2mp_send_create_phy_link_rsp(struct hci_dev *hdev, u8 status) +-{ +- struct amp_mgr *mgr; +- struct a2mp_physlink_rsp rsp; +- struct hci_conn *hs_hcon; +- +- mgr = amp_mgr_lookup_by_state(WRITE_REMOTE_AMP_ASSOC); +- if (!mgr) +- return; +- +- memset(&rsp, 0, sizeof(rsp)); +- +- hs_hcon = hci_conn_hash_lookup_state(hdev, AMP_LINK, BT_CONNECT); +- if (!hs_hcon) { +- rsp.status = A2MP_STATUS_UNABLE_START_LINK_CREATION; +- } else { +- rsp.remote_id = hs_hcon->remote_id; +- rsp.status = A2MP_STATUS_SUCCESS; +- } +- +- BT_DBG("%s mgr %p hs_hcon %p status %u", hdev->name, mgr, hs_hcon, +- status); +- +- rsp.local_id = hdev->id; +- a2mp_send(mgr, A2MP_CREATEPHYSLINK_RSP, mgr->ident, sizeof(rsp), &rsp); +- amp_mgr_put(mgr); +-} +- +-void a2mp_discover_amp(struct l2cap_chan *chan) +-{ +- struct l2cap_conn *conn = chan->conn; +- struct amp_mgr *mgr = conn->hcon->amp_mgr; +- struct a2mp_discov_req req; +- +- BT_DBG("chan %p conn %p mgr %p", chan, conn, mgr); +- +- if (!mgr) { +- mgr = amp_mgr_create(conn, true); +- if (!mgr) +- return; +- } +- +- mgr->bredr_chan = chan; +- +- memset(&req, 0, sizeof(req)); +- +- req.mtu = cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU); +- req.ext_feat = 0; +- a2mp_send(mgr, A2MP_DISCOVER_REQ, 1, sizeof(req), &req); +-} +diff --git a/net/bluetooth/a2mp.h b/net/bluetooth/a2mp.h +deleted file mode 100644 +index 2fd253a61a2a1..0000000000000 +--- a/net/bluetooth/a2mp.h ++++ /dev/null +@@ -1,154 +0,0 @@ +-/* SPDX-License-Identifier: GPL-2.0-only */ +-/* +- Copyright (c) 2010,2011 Code Aurora Forum. All rights reserved. +- Copyright (c) 2011,2012 Intel Corp. +- +-*/ +- +-#ifndef __A2MP_H +-#define __A2MP_H +- +-#include +- +-enum amp_mgr_state { +- READ_LOC_AMP_INFO, +- READ_LOC_AMP_ASSOC, +- READ_LOC_AMP_ASSOC_FINAL, +- WRITE_REMOTE_AMP_ASSOC, +-}; +- +-struct amp_mgr { +- struct list_head list; +- struct l2cap_conn *l2cap_conn; +- struct l2cap_chan *a2mp_chan; +- struct l2cap_chan *bredr_chan; +- struct kref kref; +- __u8 ident; +- __u8 handle; +- unsigned long state; +- unsigned long flags; +- +- struct list_head amp_ctrls; +- struct mutex amp_ctrls_lock; +-}; +- +-struct a2mp_cmd { +- __u8 code; +- __u8 ident; +- __le16 len; +- __u8 data[]; +-} __packed; +- +-/* A2MP command codes */ +-#define A2MP_COMMAND_REJ 0x01 +-struct a2mp_cmd_rej { +- __le16 reason; +- __u8 data[]; +-} __packed; +- +-#define A2MP_DISCOVER_REQ 0x02 +-struct a2mp_discov_req { +- __le16 mtu; +- __le16 ext_feat; +-} __packed; +- +-struct a2mp_cl { +- __u8 id; +- __u8 type; +- __u8 status; +-} __packed; +- +-#define A2MP_DISCOVER_RSP 0x03 +-struct a2mp_discov_rsp { +- __le16 mtu; +- __le16 ext_feat; +- struct a2mp_cl cl[]; +-} __packed; +- +-#define A2MP_CHANGE_NOTIFY 0x04 +-#define A2MP_CHANGE_RSP 0x05 +- +-#define A2MP_GETINFO_REQ 0x06 +-struct a2mp_info_req { +- __u8 id; +-} __packed; +- +-#define A2MP_GETINFO_RSP 0x07 +-struct a2mp_info_rsp { +- __u8 id; +- __u8 status; +- __le32 total_bw; +- __le32 max_bw; +- __le32 min_latency; +- __le16 pal_cap; +- __le16 assoc_size; +-} __packed; +- +-#define A2MP_GETAMPASSOC_REQ 0x08 +-struct a2mp_amp_assoc_req { +- __u8 id; +-} __packed; +- +-#define A2MP_GETAMPASSOC_RSP 0x09 +-struct a2mp_amp_assoc_rsp { +- __u8 id; +- __u8 status; +- __u8 amp_assoc[]; +-} __packed; +- +-#define A2MP_CREATEPHYSLINK_REQ 0x0A +-#define A2MP_DISCONNPHYSLINK_REQ 0x0C +-struct a2mp_physlink_req { +- __u8 local_id; +- __u8 remote_id; +- __u8 amp_assoc[]; +-} __packed; +- +-#define A2MP_CREATEPHYSLINK_RSP 0x0B +-#define A2MP_DISCONNPHYSLINK_RSP 0x0D +-struct a2mp_physlink_rsp { +- __u8 local_id; +- __u8 remote_id; +- __u8 status; +-} __packed; +- +-/* A2MP response status */ +-#define A2MP_STATUS_SUCCESS 0x00 +-#define A2MP_STATUS_INVALID_CTRL_ID 0x01 +-#define A2MP_STATUS_UNABLE_START_LINK_CREATION 0x02 +-#define A2MP_STATUS_NO_PHYSICAL_LINK_EXISTS 0x02 +-#define A2MP_STATUS_COLLISION_OCCURED 0x03 +-#define A2MP_STATUS_DISCONN_REQ_RECVD 0x04 +-#define A2MP_STATUS_PHYS_LINK_EXISTS 0x05 +-#define A2MP_STATUS_SECURITY_VIOLATION 0x06 +- +-struct amp_mgr *amp_mgr_get(struct amp_mgr *mgr); +- +-#if IS_ENABLED(CONFIG_BT_HS) +-int amp_mgr_put(struct amp_mgr *mgr); +-struct l2cap_chan *a2mp_channel_create(struct l2cap_conn *conn, +- struct sk_buff *skb); +-void a2mp_discover_amp(struct l2cap_chan *chan); +-#else +-static inline int amp_mgr_put(struct amp_mgr *mgr) +-{ +- return 0; +-} +- +-static inline struct l2cap_chan *a2mp_channel_create(struct l2cap_conn *conn, +- struct sk_buff *skb) +-{ +- return NULL; +-} +- +-static inline void a2mp_discover_amp(struct l2cap_chan *chan) +-{ +-} +-#endif +- +-void a2mp_send_getinfo_rsp(struct hci_dev *hdev); +-void a2mp_send_getampassoc_rsp(struct hci_dev *hdev, u8 status); +-void a2mp_send_create_phy_link_req(struct hci_dev *hdev, u8 status); +-void a2mp_send_create_phy_link_rsp(struct hci_dev *hdev, u8 status); +- +-#endif /* __A2MP_H */ +diff --git a/net/bluetooth/amp.c b/net/bluetooth/amp.c +deleted file mode 100644 +index 5d698f19868c5..0000000000000 +--- a/net/bluetooth/amp.c ++++ /dev/null +@@ -1,590 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0-only +-/* +- Copyright (c) 2011,2012 Intel Corp. +- +-*/ +- +-#include +-#include +-#include +-#include +- +-#include "hci_request.h" +-#include "a2mp.h" +-#include "amp.h" +- +-/* Remote AMP Controllers interface */ +-void amp_ctrl_get(struct amp_ctrl *ctrl) +-{ +- BT_DBG("ctrl %p orig refcnt %d", ctrl, +- kref_read(&ctrl->kref)); +- +- kref_get(&ctrl->kref); +-} +- +-static void amp_ctrl_destroy(struct kref *kref) +-{ +- struct amp_ctrl *ctrl = container_of(kref, struct amp_ctrl, kref); +- +- BT_DBG("ctrl %p", ctrl); +- +- kfree(ctrl->assoc); +- kfree(ctrl); +-} +- +-int amp_ctrl_put(struct amp_ctrl *ctrl) +-{ +- BT_DBG("ctrl %p orig refcnt %d", ctrl, +- kref_read(&ctrl->kref)); +- +- return kref_put(&ctrl->kref, &_ctrl_destroy); +-} +- +-struct amp_ctrl *amp_ctrl_add(struct amp_mgr *mgr, u8 id) +-{ +- struct amp_ctrl *ctrl; +- +- ctrl = kzalloc(sizeof(*ctrl), GFP_KERNEL); +- if (!ctrl) +- return NULL; +- +- kref_init(&ctrl->kref); +- ctrl->id = id; +- +- mutex_lock(&mgr->amp_ctrls_lock); +- list_add(&ctrl->list, &mgr->amp_ctrls); +- mutex_unlock(&mgr->amp_ctrls_lock); +- +- BT_DBG("mgr %p ctrl %p", mgr, ctrl); +- +- return ctrl; +-} +- +-void amp_ctrl_list_flush(struct amp_mgr *mgr) +-{ +- struct amp_ctrl *ctrl, *n; +- +- BT_DBG("mgr %p", mgr); +- +- mutex_lock(&mgr->amp_ctrls_lock); +- list_for_each_entry_safe(ctrl, n, &mgr->amp_ctrls, list) { +- list_del(&ctrl->list); +- amp_ctrl_put(ctrl); +- } +- mutex_unlock(&mgr->amp_ctrls_lock); +-} +- +-struct amp_ctrl *amp_ctrl_lookup(struct amp_mgr *mgr, u8 id) +-{ +- struct amp_ctrl *ctrl; +- +- BT_DBG("mgr %p id %u", mgr, id); +- +- mutex_lock(&mgr->amp_ctrls_lock); +- list_for_each_entry(ctrl, &mgr->amp_ctrls, list) { +- if (ctrl->id == id) { +- amp_ctrl_get(ctrl); +- mutex_unlock(&mgr->amp_ctrls_lock); +- return ctrl; +- } +- } +- mutex_unlock(&mgr->amp_ctrls_lock); +- +- return NULL; +-} +- +-/* Physical Link interface */ +-static u8 __next_handle(struct amp_mgr *mgr) +-{ +- if (++mgr->handle == 0) +- mgr->handle = 1; +- +- return mgr->handle; +-} +- +-struct hci_conn *phylink_add(struct hci_dev *hdev, struct amp_mgr *mgr, +- u8 remote_id, bool out) +-{ +- bdaddr_t *dst = &mgr->l2cap_conn->hcon->dst; +- struct hci_conn *hcon; +- u8 role = out ? HCI_ROLE_MASTER : HCI_ROLE_SLAVE; +- +- hcon = hci_conn_add(hdev, AMP_LINK, dst, role, __next_handle(mgr)); +- if (!hcon) +- return NULL; +- +- BT_DBG("hcon %p dst %pMR", hcon, dst); +- +- hcon->state = BT_CONNECT; +- hcon->attempt++; +- hcon->remote_id = remote_id; +- hcon->amp_mgr = amp_mgr_get(mgr); +- +- return hcon; +-} +- +-/* AMP crypto key generation interface */ +-static int hmac_sha256(u8 *key, u8 ksize, char *plaintext, u8 psize, u8 *output) +-{ +- struct crypto_shash *tfm; +- struct shash_desc *shash; +- int ret; +- +- if (!ksize) +- return -EINVAL; +- +- tfm = crypto_alloc_shash("hmac(sha256)", 0, 0); +- if (IS_ERR(tfm)) { +- BT_DBG("crypto_alloc_ahash failed: err %ld", PTR_ERR(tfm)); +- return PTR_ERR(tfm); +- } +- +- ret = crypto_shash_setkey(tfm, key, ksize); +- if (ret) { +- BT_DBG("crypto_ahash_setkey failed: err %d", ret); +- goto failed; +- } +- +- shash = kzalloc(sizeof(*shash) + crypto_shash_descsize(tfm), +- GFP_KERNEL); +- if (!shash) { +- ret = -ENOMEM; +- goto failed; +- } +- +- shash->tfm = tfm; +- +- ret = crypto_shash_digest(shash, plaintext, psize, output); +- +- kfree(shash); +- +-failed: +- crypto_free_shash(tfm); +- return ret; +-} +- +-int phylink_gen_key(struct hci_conn *conn, u8 *data, u8 *len, u8 *type) +-{ +- struct hci_dev *hdev = conn->hdev; +- struct link_key *key; +- u8 keybuf[HCI_AMP_LINK_KEY_SIZE]; +- u8 gamp_key[HCI_AMP_LINK_KEY_SIZE]; +- int err; +- +- if (!hci_conn_check_link_mode(conn)) +- return -EACCES; +- +- BT_DBG("conn %p key_type %d", conn, conn->key_type); +- +- /* Legacy key */ +- if (conn->key_type < 3) { +- bt_dev_err(hdev, "legacy key type %u", conn->key_type); +- return -EACCES; +- } +- +- *type = conn->key_type; +- *len = HCI_AMP_LINK_KEY_SIZE; +- +- key = hci_find_link_key(hdev, &conn->dst); +- if (!key) { +- BT_DBG("No Link key for conn %p dst %pMR", conn, &conn->dst); +- return -EACCES; +- } +- +- /* BR/EDR Link Key concatenated together with itself */ +- memcpy(&keybuf[0], key->val, HCI_LINK_KEY_SIZE); +- memcpy(&keybuf[HCI_LINK_KEY_SIZE], key->val, HCI_LINK_KEY_SIZE); +- +- /* Derive Generic AMP Link Key (gamp) */ +- err = hmac_sha256(keybuf, HCI_AMP_LINK_KEY_SIZE, "gamp", 4, gamp_key); +- if (err) { +- bt_dev_err(hdev, "could not derive Generic AMP Key: err %d", err); +- return err; +- } +- +- if (conn->key_type == HCI_LK_DEBUG_COMBINATION) { +- BT_DBG("Use Generic AMP Key (gamp)"); +- memcpy(data, gamp_key, HCI_AMP_LINK_KEY_SIZE); +- return err; +- } +- +- /* Derive Dedicated AMP Link Key: "802b" is 802.11 PAL keyID */ +- return hmac_sha256(gamp_key, HCI_AMP_LINK_KEY_SIZE, "802b", 4, data); +-} +- +-static void read_local_amp_assoc_complete(struct hci_dev *hdev, u8 status, +- u16 opcode, struct sk_buff *skb) +-{ +- struct hci_rp_read_local_amp_assoc *rp = (void *)skb->data; +- struct amp_assoc *assoc = &hdev->loc_assoc; +- size_t rem_len, frag_len; +- +- BT_DBG("%s status 0x%2.2x", hdev->name, rp->status); +- +- if (rp->status) +- goto send_rsp; +- +- frag_len = skb->len - sizeof(*rp); +- rem_len = __le16_to_cpu(rp->rem_len); +- +- if (rem_len > frag_len) { +- BT_DBG("frag_len %zu rem_len %zu", frag_len, rem_len); +- +- memcpy(assoc->data + assoc->offset, rp->frag, frag_len); +- assoc->offset += frag_len; +- +- /* Read other fragments */ +- amp_read_loc_assoc_frag(hdev, rp->phy_handle); +- +- return; +- } +- +- memcpy(assoc->data + assoc->offset, rp->frag, rem_len); +- assoc->len = assoc->offset + rem_len; +- assoc->offset = 0; +- +-send_rsp: +- /* Send A2MP Rsp when all fragments are received */ +- a2mp_send_getampassoc_rsp(hdev, rp->status); +- a2mp_send_create_phy_link_req(hdev, rp->status); +-} +- +-void amp_read_loc_assoc_frag(struct hci_dev *hdev, u8 phy_handle) +-{ +- struct hci_cp_read_local_amp_assoc cp; +- struct amp_assoc *loc_assoc = &hdev->loc_assoc; +- struct hci_request req; +- int err; +- +- BT_DBG("%s handle %u", hdev->name, phy_handle); +- +- cp.phy_handle = phy_handle; +- cp.max_len = cpu_to_le16(hdev->amp_assoc_size); +- cp.len_so_far = cpu_to_le16(loc_assoc->offset); +- +- hci_req_init(&req, hdev); +- hci_req_add(&req, HCI_OP_READ_LOCAL_AMP_ASSOC, sizeof(cp), &cp); +- err = hci_req_run_skb(&req, read_local_amp_assoc_complete); +- if (err < 0) +- a2mp_send_getampassoc_rsp(hdev, A2MP_STATUS_INVALID_CTRL_ID); +-} +- +-void amp_read_loc_assoc(struct hci_dev *hdev, struct amp_mgr *mgr) +-{ +- struct hci_cp_read_local_amp_assoc cp; +- struct hci_request req; +- int err; +- +- memset(&hdev->loc_assoc, 0, sizeof(struct amp_assoc)); +- memset(&cp, 0, sizeof(cp)); +- +- cp.max_len = cpu_to_le16(hdev->amp_assoc_size); +- +- set_bit(READ_LOC_AMP_ASSOC, &mgr->state); +- hci_req_init(&req, hdev); +- hci_req_add(&req, HCI_OP_READ_LOCAL_AMP_ASSOC, sizeof(cp), &cp); +- err = hci_req_run_skb(&req, read_local_amp_assoc_complete); +- if (err < 0) +- a2mp_send_getampassoc_rsp(hdev, A2MP_STATUS_INVALID_CTRL_ID); +-} +- +-void amp_read_loc_assoc_final_data(struct hci_dev *hdev, +- struct hci_conn *hcon) +-{ +- struct hci_cp_read_local_amp_assoc cp; +- struct amp_mgr *mgr = hcon->amp_mgr; +- struct hci_request req; +- int err; +- +- if (!mgr) +- return; +- +- cp.phy_handle = hcon->handle; +- cp.len_so_far = cpu_to_le16(0); +- cp.max_len = cpu_to_le16(hdev->amp_assoc_size); +- +- set_bit(READ_LOC_AMP_ASSOC_FINAL, &mgr->state); +- +- /* Read Local AMP Assoc final link information data */ +- hci_req_init(&req, hdev); +- hci_req_add(&req, HCI_OP_READ_LOCAL_AMP_ASSOC, sizeof(cp), &cp); +- err = hci_req_run_skb(&req, read_local_amp_assoc_complete); +- if (err < 0) +- a2mp_send_getampassoc_rsp(hdev, A2MP_STATUS_INVALID_CTRL_ID); +-} +- +-static void write_remote_amp_assoc_complete(struct hci_dev *hdev, u8 status, +- u16 opcode, struct sk_buff *skb) +-{ +- struct hci_rp_write_remote_amp_assoc *rp = (void *)skb->data; +- +- BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x", +- hdev->name, rp->status, rp->phy_handle); +- +- if (rp->status) +- return; +- +- amp_write_rem_assoc_continue(hdev, rp->phy_handle); +-} +- +-/* Write AMP Assoc data fragments, returns true with last fragment written*/ +-static bool amp_write_rem_assoc_frag(struct hci_dev *hdev, +- struct hci_conn *hcon) +-{ +- struct hci_cp_write_remote_amp_assoc *cp; +- struct amp_mgr *mgr = hcon->amp_mgr; +- struct amp_ctrl *ctrl; +- struct hci_request req; +- u16 frag_len, len; +- +- ctrl = amp_ctrl_lookup(mgr, hcon->remote_id); +- if (!ctrl) +- return false; +- +- if (!ctrl->assoc_rem_len) { +- BT_DBG("all fragments are written"); +- ctrl->assoc_rem_len = ctrl->assoc_len; +- ctrl->assoc_len_so_far = 0; +- +- amp_ctrl_put(ctrl); +- return true; +- } +- +- frag_len = min_t(u16, 248, ctrl->assoc_rem_len); +- len = frag_len + sizeof(*cp); +- +- cp = kzalloc(len, GFP_KERNEL); +- if (!cp) { +- amp_ctrl_put(ctrl); +- return false; +- } +- +- BT_DBG("hcon %p ctrl %p frag_len %u assoc_len %u rem_len %u", +- hcon, ctrl, frag_len, ctrl->assoc_len, ctrl->assoc_rem_len); +- +- cp->phy_handle = hcon->handle; +- cp->len_so_far = cpu_to_le16(ctrl->assoc_len_so_far); +- cp->rem_len = cpu_to_le16(ctrl->assoc_rem_len); +- memcpy(cp->frag, ctrl->assoc, frag_len); +- +- ctrl->assoc_len_so_far += frag_len; +- ctrl->assoc_rem_len -= frag_len; +- +- amp_ctrl_put(ctrl); +- +- hci_req_init(&req, hdev); +- hci_req_add(&req, HCI_OP_WRITE_REMOTE_AMP_ASSOC, len, cp); +- hci_req_run_skb(&req, write_remote_amp_assoc_complete); +- +- kfree(cp); +- +- return false; +-} +- +-void amp_write_rem_assoc_continue(struct hci_dev *hdev, u8 handle) +-{ +- struct hci_conn *hcon; +- +- BT_DBG("%s phy handle 0x%2.2x", hdev->name, handle); +- +- hcon = hci_conn_hash_lookup_handle(hdev, handle); +- if (!hcon) +- return; +- +- /* Send A2MP create phylink rsp when all fragments are written */ +- if (amp_write_rem_assoc_frag(hdev, hcon)) +- a2mp_send_create_phy_link_rsp(hdev, 0); +-} +- +-void amp_write_remote_assoc(struct hci_dev *hdev, u8 handle) +-{ +- struct hci_conn *hcon; +- +- BT_DBG("%s phy handle 0x%2.2x", hdev->name, handle); +- +- hcon = hci_conn_hash_lookup_handle(hdev, handle); +- if (!hcon) +- return; +- +- BT_DBG("%s phy handle 0x%2.2x hcon %p", hdev->name, handle, hcon); +- +- amp_write_rem_assoc_frag(hdev, hcon); +-} +- +-static void create_phylink_complete(struct hci_dev *hdev, u8 status, +- u16 opcode) +-{ +- struct hci_cp_create_phy_link *cp; +- +- BT_DBG("%s status 0x%2.2x", hdev->name, status); +- +- cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK); +- if (!cp) +- return; +- +- hci_dev_lock(hdev); +- +- if (status) { +- struct hci_conn *hcon; +- +- hcon = hci_conn_hash_lookup_handle(hdev, cp->phy_handle); +- if (hcon) +- hci_conn_del(hcon); +- } else { +- amp_write_remote_assoc(hdev, cp->phy_handle); +- } +- +- hci_dev_unlock(hdev); +-} +- +-void amp_create_phylink(struct hci_dev *hdev, struct amp_mgr *mgr, +- struct hci_conn *hcon) +-{ +- struct hci_cp_create_phy_link cp; +- struct hci_request req; +- +- cp.phy_handle = hcon->handle; +- +- BT_DBG("%s hcon %p phy handle 0x%2.2x", hdev->name, hcon, +- hcon->handle); +- +- if (phylink_gen_key(mgr->l2cap_conn->hcon, cp.key, &cp.key_len, +- &cp.key_type)) { +- BT_DBG("Cannot create link key"); +- return; +- } +- +- hci_req_init(&req, hdev); +- hci_req_add(&req, HCI_OP_CREATE_PHY_LINK, sizeof(cp), &cp); +- hci_req_run(&req, create_phylink_complete); +-} +- +-static void accept_phylink_complete(struct hci_dev *hdev, u8 status, +- u16 opcode) +-{ +- struct hci_cp_accept_phy_link *cp; +- +- BT_DBG("%s status 0x%2.2x", hdev->name, status); +- +- if (status) +- return; +- +- cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK); +- if (!cp) +- return; +- +- amp_write_remote_assoc(hdev, cp->phy_handle); +-} +- +-void amp_accept_phylink(struct hci_dev *hdev, struct amp_mgr *mgr, +- struct hci_conn *hcon) +-{ +- struct hci_cp_accept_phy_link cp; +- struct hci_request req; +- +- cp.phy_handle = hcon->handle; +- +- BT_DBG("%s hcon %p phy handle 0x%2.2x", hdev->name, hcon, +- hcon->handle); +- +- if (phylink_gen_key(mgr->l2cap_conn->hcon, cp.key, &cp.key_len, +- &cp.key_type)) { +- BT_DBG("Cannot create link key"); +- return; +- } +- +- hci_req_init(&req, hdev); +- hci_req_add(&req, HCI_OP_ACCEPT_PHY_LINK, sizeof(cp), &cp); +- hci_req_run(&req, accept_phylink_complete); +-} +- +-void amp_physical_cfm(struct hci_conn *bredr_hcon, struct hci_conn *hs_hcon) +-{ +- struct hci_dev *bredr_hdev = hci_dev_hold(bredr_hcon->hdev); +- struct amp_mgr *mgr = hs_hcon->amp_mgr; +- struct l2cap_chan *bredr_chan; +- +- BT_DBG("bredr_hcon %p hs_hcon %p mgr %p", bredr_hcon, hs_hcon, mgr); +- +- if (!bredr_hdev || !mgr || !mgr->bredr_chan) +- return; +- +- bredr_chan = mgr->bredr_chan; +- +- l2cap_chan_lock(bredr_chan); +- +- set_bit(FLAG_EFS_ENABLE, &bredr_chan->flags); +- bredr_chan->remote_amp_id = hs_hcon->remote_id; +- bredr_chan->local_amp_id = hs_hcon->hdev->id; +- bredr_chan->hs_hcon = hs_hcon; +- bredr_chan->conn->mtu = hs_hcon->hdev->block_mtu; +- +- __l2cap_physical_cfm(bredr_chan, 0); +- +- l2cap_chan_unlock(bredr_chan); +- +- hci_dev_put(bredr_hdev); +-} +- +-void amp_create_logical_link(struct l2cap_chan *chan) +-{ +- struct hci_conn *hs_hcon = chan->hs_hcon; +- struct hci_cp_create_accept_logical_link cp; +- struct hci_dev *hdev; +- +- BT_DBG("chan %p hs_hcon %p dst %pMR", chan, hs_hcon, +- &chan->conn->hcon->dst); +- +- if (!hs_hcon) +- return; +- +- hdev = hci_dev_hold(chan->hs_hcon->hdev); +- if (!hdev) +- return; +- +- cp.phy_handle = hs_hcon->handle; +- +- cp.tx_flow_spec.id = chan->local_id; +- cp.tx_flow_spec.stype = chan->local_stype; +- cp.tx_flow_spec.msdu = cpu_to_le16(chan->local_msdu); +- cp.tx_flow_spec.sdu_itime = cpu_to_le32(chan->local_sdu_itime); +- cp.tx_flow_spec.acc_lat = cpu_to_le32(chan->local_acc_lat); +- cp.tx_flow_spec.flush_to = cpu_to_le32(chan->local_flush_to); +- +- cp.rx_flow_spec.id = chan->remote_id; +- cp.rx_flow_spec.stype = chan->remote_stype; +- cp.rx_flow_spec.msdu = cpu_to_le16(chan->remote_msdu); +- cp.rx_flow_spec.sdu_itime = cpu_to_le32(chan->remote_sdu_itime); +- cp.rx_flow_spec.acc_lat = cpu_to_le32(chan->remote_acc_lat); +- cp.rx_flow_spec.flush_to = cpu_to_le32(chan->remote_flush_to); +- +- if (hs_hcon->out) +- hci_send_cmd(hdev, HCI_OP_CREATE_LOGICAL_LINK, sizeof(cp), +- &cp); +- else +- hci_send_cmd(hdev, HCI_OP_ACCEPT_LOGICAL_LINK, sizeof(cp), +- &cp); +- +- hci_dev_put(hdev); +-} +- +-void amp_disconnect_logical_link(struct hci_chan *hchan) +-{ +- struct hci_conn *hcon = hchan->conn; +- struct hci_cp_disconn_logical_link cp; +- +- if (hcon->state != BT_CONNECTED) { +- BT_DBG("hchan %p not connected", hchan); +- return; +- } +- +- cp.log_handle = cpu_to_le16(hchan->handle); +- hci_send_cmd(hcon->hdev, HCI_OP_DISCONN_LOGICAL_LINK, sizeof(cp), &cp); +-} +- +-void amp_destroy_logical_link(struct hci_chan *hchan, u8 reason) +-{ +- BT_DBG("hchan %p", hchan); +- +- hci_chan_del(hchan); +-} +diff --git a/net/bluetooth/amp.h b/net/bluetooth/amp.h +deleted file mode 100644 +index 97c87abd129f6..0000000000000 +--- a/net/bluetooth/amp.h ++++ /dev/null +@@ -1,60 +0,0 @@ +-/* SPDX-License-Identifier: GPL-2.0-only */ +-/* +- Copyright (c) 2011,2012 Intel Corp. +- +-*/ +- +-#ifndef __AMP_H +-#define __AMP_H +- +-struct amp_ctrl { +- struct list_head list; +- struct kref kref; +- __u8 id; +- __u16 assoc_len_so_far; +- __u16 assoc_rem_len; +- __u16 assoc_len; +- __u8 *assoc; +-}; +- +-int amp_ctrl_put(struct amp_ctrl *ctrl); +-void amp_ctrl_get(struct amp_ctrl *ctrl); +-struct amp_ctrl *amp_ctrl_add(struct amp_mgr *mgr, u8 id); +-struct amp_ctrl *amp_ctrl_lookup(struct amp_mgr *mgr, u8 id); +-void amp_ctrl_list_flush(struct amp_mgr *mgr); +- +-struct hci_conn *phylink_add(struct hci_dev *hdev, struct amp_mgr *mgr, +- u8 remote_id, bool out); +- +-int phylink_gen_key(struct hci_conn *hcon, u8 *data, u8 *len, u8 *type); +- +-void amp_read_loc_assoc_frag(struct hci_dev *hdev, u8 phy_handle); +-void amp_read_loc_assoc(struct hci_dev *hdev, struct amp_mgr *mgr); +-void amp_read_loc_assoc_final_data(struct hci_dev *hdev, +- struct hci_conn *hcon); +-void amp_create_phylink(struct hci_dev *hdev, struct amp_mgr *mgr, +- struct hci_conn *hcon); +-void amp_accept_phylink(struct hci_dev *hdev, struct amp_mgr *mgr, +- struct hci_conn *hcon); +- +-#if IS_ENABLED(CONFIG_BT_HS) +-void amp_create_logical_link(struct l2cap_chan *chan); +-void amp_disconnect_logical_link(struct hci_chan *hchan); +-#else +-static inline void amp_create_logical_link(struct l2cap_chan *chan) +-{ +-} +- +-static inline void amp_disconnect_logical_link(struct hci_chan *hchan) +-{ +-} +-#endif +- +-void amp_write_remote_assoc(struct hci_dev *hdev, u8 handle); +-void amp_write_rem_assoc_continue(struct hci_dev *hdev, u8 handle); +-void amp_physical_cfm(struct hci_conn *bredr_hcon, struct hci_conn *hs_hcon); +-void amp_create_logical_link(struct l2cap_chan *chan); +-void amp_disconnect_logical_link(struct hci_chan *hchan); +-void amp_destroy_logical_link(struct hci_chan *hchan, u8 reason); +- +-#endif /* __AMP_H */ +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index d01db89fcb469..029bf74ec5e78 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -36,7 +36,6 @@ + + #include "hci_request.h" + #include "smp.h" +-#include "a2mp.h" + #include "eir.h" + + struct sco_param { +@@ -1169,9 +1168,6 @@ void hci_conn_del(struct hci_conn *conn) + } + } + +- if (conn->amp_mgr) +- amp_mgr_put(conn->amp_mgr); +- + skb_queue_purge(&conn->data_q); + + /* Remove the connection from the list and cleanup its remaining +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 1f63f77661dce..55daada8dc15d 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -36,8 +36,6 @@ + #include "hci_request.h" + #include "hci_debugfs.h" + #include "hci_codec.h" +-#include "a2mp.h" +-#include "amp.h" + #include "smp.h" + #include "msft.h" + #include "eir.h" +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index 656f49b299d20..ab5a9d42fae71 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -39,8 +39,6 @@ + #include + + #include "smp.h" +-#include "a2mp.h" +-#include "amp.h" + + #define LE_FLOWCTL_MAX_CREDITS 65535 + +@@ -167,24 +165,6 @@ static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn, + return NULL; + } + +-static struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn, +- u8 ident) +-{ +- struct l2cap_chan *c; +- +- mutex_lock(&conn->chan_lock); +- c = __l2cap_get_chan_by_ident(conn, ident); +- if (c) { +- /* Only lock if chan reference is not 0 */ +- c = l2cap_chan_hold_unless_zero(c); +- if (c) +- l2cap_chan_lock(c); +- } +- mutex_unlock(&conn->chan_lock); +- +- return c; +-} +- + static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src, + u8 src_type) + { +@@ -651,7 +631,6 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err) + chan->ops->teardown(chan, err); + + if (conn) { +- struct amp_mgr *mgr = conn->hcon->amp_mgr; + /* Delete from channel list */ + list_del(&chan->list); + +@@ -666,16 +645,6 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err) + if (chan->chan_type != L2CAP_CHAN_FIXED || + test_bit(FLAG_HOLD_HCI_CONN, &chan->flags)) + hci_conn_drop(conn->hcon); +- +- if (mgr && mgr->bredr_chan == chan) +- mgr->bredr_chan = NULL; +- } +- +- if (chan->hs_hchan) { +- struct hci_chan *hs_hchan = chan->hs_hchan; +- +- BT_DBG("chan %p disconnect hs_hchan %p", chan, hs_hchan); +- amp_disconnect_logical_link(hs_hchan); + } + + if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state)) +@@ -977,12 +946,6 @@ static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, + hci_send_acl(conn->hchan, skb, flags); + } + +-static bool __chan_is_moving(struct l2cap_chan *chan) +-{ +- return chan->move_state != L2CAP_MOVE_STABLE && +- chan->move_state != L2CAP_MOVE_WAIT_PREPARE; +-} +- + static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb) + { + struct hci_conn *hcon = chan->conn->hcon; +@@ -991,15 +954,6 @@ static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb) + BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len, + skb->priority); + +- if (chan->hs_hcon && !__chan_is_moving(chan)) { +- if (chan->hs_hchan) +- hci_send_acl(chan->hs_hchan, skb, ACL_COMPLETE); +- else +- kfree_skb(skb); +- +- return; +- } +- + /* Use NO_FLUSH for LE links (where this is the only option) or + * if the BR/EDR link supports it and flushing has not been + * explicitly requested (through FLAG_FLUSHABLE). +@@ -1180,9 +1134,6 @@ static void l2cap_send_sframe(struct l2cap_chan *chan, + if (!control->sframe) + return; + +- if (__chan_is_moving(chan)) +- return; +- + if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) && + !control->poll) + control->final = 1; +@@ -1237,40 +1188,6 @@ static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan) + return !test_bit(CONF_CONNECT_PEND, &chan->conf_state); + } + +-static bool __amp_capable(struct l2cap_chan *chan) +-{ +- struct l2cap_conn *conn = chan->conn; +- struct hci_dev *hdev; +- bool amp_available = false; +- +- if (!(conn->local_fixed_chan & L2CAP_FC_A2MP)) +- return false; +- +- if (!(conn->remote_fixed_chan & L2CAP_FC_A2MP)) +- return false; +- +- read_lock(&hci_dev_list_lock); +- list_for_each_entry(hdev, &hci_dev_list, list) { +- if (hdev->amp_type != AMP_TYPE_BREDR && +- test_bit(HCI_UP, &hdev->flags)) { +- amp_available = true; +- break; +- } +- } +- read_unlock(&hci_dev_list_lock); +- +- if (chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED) +- return amp_available; +- +- return false; +-} +- +-static bool l2cap_check_efs(struct l2cap_chan *chan) +-{ +- /* Check EFS parameters */ +- return true; +-} +- + void l2cap_send_conn_req(struct l2cap_chan *chan) + { + struct l2cap_conn *conn = chan->conn; +@@ -1286,76 +1203,6 @@ void l2cap_send_conn_req(struct l2cap_chan *chan) + l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req); + } + +-static void l2cap_send_create_chan_req(struct l2cap_chan *chan, u8 amp_id) +-{ +- struct l2cap_create_chan_req req; +- req.scid = cpu_to_le16(chan->scid); +- req.psm = chan->psm; +- req.amp_id = amp_id; +- +- chan->ident = l2cap_get_ident(chan->conn); +- +- l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_REQ, +- sizeof(req), &req); +-} +- +-static void l2cap_move_setup(struct l2cap_chan *chan) +-{ +- struct sk_buff *skb; +- +- BT_DBG("chan %p", chan); +- +- if (chan->mode != L2CAP_MODE_ERTM) +- return; +- +- __clear_retrans_timer(chan); +- __clear_monitor_timer(chan); +- __clear_ack_timer(chan); +- +- chan->retry_count = 0; +- skb_queue_walk(&chan->tx_q, skb) { +- if (bt_cb(skb)->l2cap.retries) +- bt_cb(skb)->l2cap.retries = 1; +- else +- break; +- } +- +- chan->expected_tx_seq = chan->buffer_seq; +- +- clear_bit(CONN_REJ_ACT, &chan->conn_state); +- clear_bit(CONN_SREJ_ACT, &chan->conn_state); +- l2cap_seq_list_clear(&chan->retrans_list); +- l2cap_seq_list_clear(&chan->srej_list); +- skb_queue_purge(&chan->srej_q); +- +- chan->tx_state = L2CAP_TX_STATE_XMIT; +- chan->rx_state = L2CAP_RX_STATE_MOVE; +- +- set_bit(CONN_REMOTE_BUSY, &chan->conn_state); +-} +- +-static void l2cap_move_done(struct l2cap_chan *chan) +-{ +- u8 move_role = chan->move_role; +- BT_DBG("chan %p", chan); +- +- chan->move_state = L2CAP_MOVE_STABLE; +- chan->move_role = L2CAP_MOVE_ROLE_NONE; +- +- if (chan->mode != L2CAP_MODE_ERTM) +- return; +- +- switch (move_role) { +- case L2CAP_MOVE_ROLE_INITIATOR: +- l2cap_tx(chan, NULL, NULL, L2CAP_EV_EXPLICIT_POLL); +- chan->rx_state = L2CAP_RX_STATE_WAIT_F; +- break; +- case L2CAP_MOVE_ROLE_RESPONDER: +- chan->rx_state = L2CAP_RX_STATE_WAIT_P; +- break; +- } +-} +- + static void l2cap_chan_ready(struct l2cap_chan *chan) + { + /* The channel may have already been flagged as connected in +@@ -1505,10 +1352,7 @@ static void l2cap_le_start(struct l2cap_chan *chan) + + static void l2cap_start_connection(struct l2cap_chan *chan) + { +- if (__amp_capable(chan)) { +- BT_DBG("chan %p AMP capable: discover AMPs", chan); +- a2mp_discover_amp(chan); +- } else if (chan->conn->hcon->type == LE_LINK) { ++ if (chan->conn->hcon->type == LE_LINK) { + l2cap_le_start(chan); + } else { + l2cap_send_conn_req(chan); +@@ -1611,11 +1455,6 @@ static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err) + __clear_ack_timer(chan); + } + +- if (chan->scid == L2CAP_CID_A2MP) { +- l2cap_state_change(chan, BT_DISCONN); +- return; +- } +- + req.dcid = cpu_to_le16(chan->dcid); + req.scid = cpu_to_le16(chan->scid); + l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ, +@@ -1754,11 +1593,6 @@ static void l2cap_conn_ready(struct l2cap_conn *conn) + + l2cap_chan_lock(chan); + +- if (chan->scid == L2CAP_CID_A2MP) { +- l2cap_chan_unlock(chan); +- continue; +- } +- + if (hcon->type == LE_LINK) { + l2cap_le_start(chan); + } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { +@@ -2067,9 +1901,6 @@ static void l2cap_streaming_send(struct l2cap_chan *chan, + + BT_DBG("chan %p, skbs %p", chan, skbs); + +- if (__chan_is_moving(chan)) +- return; +- + skb_queue_splice_tail_init(skbs, &chan->tx_q); + + while (!skb_queue_empty(&chan->tx_q)) { +@@ -2112,9 +1943,6 @@ static int l2cap_ertm_send(struct l2cap_chan *chan) + if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) + return 0; + +- if (__chan_is_moving(chan)) +- return 0; +- + while (chan->tx_send_head && + chan->unacked_frames < chan->remote_tx_win && + chan->tx_state == L2CAP_TX_STATE_XMIT) { +@@ -2180,9 +2008,6 @@ static void l2cap_ertm_resend(struct l2cap_chan *chan) + if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) + return; + +- if (__chan_is_moving(chan)) +- return; +- + while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) { + seq = l2cap_seq_list_pop(&chan->retrans_list); + +@@ -2522,8 +2347,7 @@ static int l2cap_segment_sdu(struct l2cap_chan *chan, + pdu_len = chan->conn->mtu; + + /* Constrain PDU size for BR/EDR connections */ +- if (!chan->hs_hcon) +- pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD); ++ pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD); + + /* Adjust for largest possible L2CAP overhead. */ + if (chan->fcs) +@@ -3287,11 +3111,6 @@ int l2cap_ertm_init(struct l2cap_chan *chan) + + skb_queue_head_init(&chan->tx_q); + +- chan->local_amp_id = AMP_ID_BREDR; +- chan->move_id = AMP_ID_BREDR; +- chan->move_state = L2CAP_MOVE_STABLE; +- chan->move_role = L2CAP_MOVE_ROLE_NONE; +- + if (chan->mode != L2CAP_MODE_ERTM) + return 0; + +@@ -3326,52 +3145,19 @@ static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask) + + static inline bool __l2cap_ews_supported(struct l2cap_conn *conn) + { +- return ((conn->local_fixed_chan & L2CAP_FC_A2MP) && +- (conn->feat_mask & L2CAP_FEAT_EXT_WINDOW)); ++ return (conn->feat_mask & L2CAP_FEAT_EXT_WINDOW); + } + + static inline bool __l2cap_efs_supported(struct l2cap_conn *conn) + { +- return ((conn->local_fixed_chan & L2CAP_FC_A2MP) && +- (conn->feat_mask & L2CAP_FEAT_EXT_FLOW)); ++ return (conn->feat_mask & L2CAP_FEAT_EXT_FLOW); + } + + static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan, + struct l2cap_conf_rfc *rfc) + { +- if (chan->local_amp_id != AMP_ID_BREDR && chan->hs_hcon) { +- u64 ertm_to = chan->hs_hcon->hdev->amp_be_flush_to; +- +- /* Class 1 devices have must have ERTM timeouts +- * exceeding the Link Supervision Timeout. The +- * default Link Supervision Timeout for AMP +- * controllers is 10 seconds. +- * +- * Class 1 devices use 0xffffffff for their +- * best-effort flush timeout, so the clamping logic +- * will result in a timeout that meets the above +- * requirement. ERTM timeouts are 16-bit values, so +- * the maximum timeout is 65.535 seconds. +- */ +- +- /* Convert timeout to milliseconds and round */ +- ertm_to = DIV_ROUND_UP_ULL(ertm_to, 1000); +- +- /* This is the recommended formula for class 2 devices +- * that start ERTM timers when packets are sent to the +- * controller. +- */ +- ertm_to = 3 * ertm_to + 500; +- +- if (ertm_to > 0xffff) +- ertm_to = 0xffff; +- +- rfc->retrans_timeout = cpu_to_le16((u16) ertm_to); +- rfc->monitor_timeout = rfc->retrans_timeout; +- } else { +- rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO); +- rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO); +- } ++ rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO); ++ rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO); + } + + static inline void l2cap_txwin_setup(struct l2cap_chan *chan) +@@ -3623,13 +3409,7 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data + case L2CAP_CONF_EWS: + if (olen != 2) + break; +- if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP)) +- return -ECONNREFUSED; +- set_bit(FLAG_EXT_CTRL, &chan->flags); +- set_bit(CONF_EWS_RECV, &chan->conf_state); +- chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW; +- chan->remote_tx_win = val; +- break; ++ return -ECONNREFUSED; + + default: + if (hint) +@@ -4027,11 +3807,7 @@ void __l2cap_connect_rsp_defer(struct l2cap_chan *chan) + rsp.dcid = cpu_to_le16(chan->scid); + rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS); + rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); +- +- if (chan->hs_hcon) +- rsp_code = L2CAP_CREATE_CHAN_RSP; +- else +- rsp_code = L2CAP_CONN_RSP; ++ rsp_code = L2CAP_CONN_RSP; + + BT_DBG("chan %p rsp_code %u", chan, rsp_code); + +@@ -4190,7 +3966,6 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn, + chan->dst_type = bdaddr_dst_type(conn->hcon); + chan->psm = psm; + chan->dcid = scid; +- chan->local_amp_id = amp_id; + + __l2cap_chan_add(conn, chan); + +@@ -4516,10 +4291,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, + /* check compatibility */ + + /* Send rsp for BR/EDR channel */ +- if (!chan->hs_hcon) +- l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags); +- else +- chan->ident = cmd->ident; ++ l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags); + } + + unlock: +@@ -4571,15 +4343,7 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, + goto done; + } + +- if (!chan->hs_hcon) { +- l2cap_send_efs_conf_rsp(chan, buf, cmd->ident, +- 0); +- } else { +- if (l2cap_check_efs(chan)) { +- amp_create_logical_link(chan); +- chan->ident = cmd->ident; +- } +- } ++ l2cap_send_efs_conf_rsp(chan, buf, cmd->ident, 0); + } + goto done; + +@@ -4750,9 +4514,6 @@ static inline int l2cap_information_req(struct l2cap_conn *conn, + if (!disable_ertm) + feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING + | L2CAP_FEAT_FCS; +- if (conn->local_fixed_chan & L2CAP_FC_A2MP) +- feat_mask |= L2CAP_FEAT_EXT_FLOW +- | L2CAP_FEAT_EXT_WINDOW; + + put_unaligned_le32(feat_mask, rsp->data); + l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf), +@@ -4841,751 +4602,6 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn, + return 0; + } + +-static int l2cap_create_channel_req(struct l2cap_conn *conn, +- struct l2cap_cmd_hdr *cmd, +- u16 cmd_len, void *data) +-{ +- struct l2cap_create_chan_req *req = data; +- struct l2cap_create_chan_rsp rsp; +- struct l2cap_chan *chan; +- struct hci_dev *hdev; +- u16 psm, scid; +- +- if (cmd_len != sizeof(*req)) +- return -EPROTO; +- +- if (!(conn->local_fixed_chan & L2CAP_FC_A2MP)) +- return -EINVAL; +- +- psm = le16_to_cpu(req->psm); +- scid = le16_to_cpu(req->scid); +- +- BT_DBG("psm 0x%2.2x, scid 0x%4.4x, amp_id %d", psm, scid, req->amp_id); +- +- /* For controller id 0 make BR/EDR connection */ +- if (req->amp_id == AMP_ID_BREDR) { +- l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP, +- req->amp_id); +- return 0; +- } +- +- /* Validate AMP controller id */ +- hdev = hci_dev_get(req->amp_id); +- if (!hdev) +- goto error; +- +- if (hdev->dev_type != HCI_AMP || !test_bit(HCI_UP, &hdev->flags)) { +- hci_dev_put(hdev); +- goto error; +- } +- +- chan = l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP, +- req->amp_id); +- if (chan) { +- struct amp_mgr *mgr = conn->hcon->amp_mgr; +- struct hci_conn *hs_hcon; +- +- hs_hcon = hci_conn_hash_lookup_ba(hdev, AMP_LINK, +- &conn->hcon->dst); +- if (!hs_hcon) { +- hci_dev_put(hdev); +- cmd_reject_invalid_cid(conn, cmd->ident, chan->scid, +- chan->dcid); +- return 0; +- } +- +- BT_DBG("mgr %p bredr_chan %p hs_hcon %p", mgr, chan, hs_hcon); +- +- mgr->bredr_chan = chan; +- chan->hs_hcon = hs_hcon; +- chan->fcs = L2CAP_FCS_NONE; +- conn->mtu = hdev->block_mtu; +- } +- +- hci_dev_put(hdev); +- +- return 0; +- +-error: +- rsp.dcid = 0; +- rsp.scid = cpu_to_le16(scid); +- rsp.result = cpu_to_le16(L2CAP_CR_BAD_AMP); +- rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); +- +- l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP, +- sizeof(rsp), &rsp); +- +- return 0; +-} +- +-static void l2cap_send_move_chan_req(struct l2cap_chan *chan, u8 dest_amp_id) +-{ +- struct l2cap_move_chan_req req; +- u8 ident; +- +- BT_DBG("chan %p, dest_amp_id %d", chan, dest_amp_id); +- +- ident = l2cap_get_ident(chan->conn); +- chan->ident = ident; +- +- req.icid = cpu_to_le16(chan->scid); +- req.dest_amp_id = dest_amp_id; +- +- l2cap_send_cmd(chan->conn, ident, L2CAP_MOVE_CHAN_REQ, sizeof(req), +- &req); +- +- __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT); +-} +- +-static void l2cap_send_move_chan_rsp(struct l2cap_chan *chan, u16 result) +-{ +- struct l2cap_move_chan_rsp rsp; +- +- BT_DBG("chan %p, result 0x%4.4x", chan, result); +- +- rsp.icid = cpu_to_le16(chan->dcid); +- rsp.result = cpu_to_le16(result); +- +- l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_RSP, +- sizeof(rsp), &rsp); +-} +- +-static void l2cap_send_move_chan_cfm(struct l2cap_chan *chan, u16 result) +-{ +- struct l2cap_move_chan_cfm cfm; +- +- BT_DBG("chan %p, result 0x%4.4x", chan, result); +- +- chan->ident = l2cap_get_ident(chan->conn); +- +- cfm.icid = cpu_to_le16(chan->scid); +- cfm.result = cpu_to_le16(result); +- +- l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_CFM, +- sizeof(cfm), &cfm); +- +- __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT); +-} +- +-static void l2cap_send_move_chan_cfm_icid(struct l2cap_conn *conn, u16 icid) +-{ +- struct l2cap_move_chan_cfm cfm; +- +- BT_DBG("conn %p, icid 0x%4.4x", conn, icid); +- +- cfm.icid = cpu_to_le16(icid); +- cfm.result = cpu_to_le16(L2CAP_MC_UNCONFIRMED); +- +- l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_MOVE_CHAN_CFM, +- sizeof(cfm), &cfm); +-} +- +-static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident, +- u16 icid) +-{ +- struct l2cap_move_chan_cfm_rsp rsp; +- +- BT_DBG("icid 0x%4.4x", icid); +- +- rsp.icid = cpu_to_le16(icid); +- l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp); +-} +- +-static void __release_logical_link(struct l2cap_chan *chan) +-{ +- chan->hs_hchan = NULL; +- chan->hs_hcon = NULL; +- +- /* Placeholder - release the logical link */ +-} +- +-static void l2cap_logical_fail(struct l2cap_chan *chan) +-{ +- /* Logical link setup failed */ +- if (chan->state != BT_CONNECTED) { +- /* Create channel failure, disconnect */ +- l2cap_send_disconn_req(chan, ECONNRESET); +- return; +- } +- +- switch (chan->move_role) { +- case L2CAP_MOVE_ROLE_RESPONDER: +- l2cap_move_done(chan); +- l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_SUPP); +- break; +- case L2CAP_MOVE_ROLE_INITIATOR: +- if (chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_COMP || +- chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_CFM) { +- /* Remote has only sent pending or +- * success responses, clean up +- */ +- l2cap_move_done(chan); +- } +- +- /* Other amp move states imply that the move +- * has already aborted +- */ +- l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED); +- break; +- } +-} +- +-static void l2cap_logical_finish_create(struct l2cap_chan *chan, +- struct hci_chan *hchan) +-{ +- struct l2cap_conf_rsp rsp; +- +- chan->hs_hchan = hchan; +- chan->hs_hcon->l2cap_data = chan->conn; +- +- l2cap_send_efs_conf_rsp(chan, &rsp, chan->ident, 0); +- +- if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) { +- int err; +- +- set_default_fcs(chan); +- +- err = l2cap_ertm_init(chan); +- if (err < 0) +- l2cap_send_disconn_req(chan, -err); +- else +- l2cap_chan_ready(chan); +- } +-} +- +-static void l2cap_logical_finish_move(struct l2cap_chan *chan, +- struct hci_chan *hchan) +-{ +- chan->hs_hcon = hchan->conn; +- chan->hs_hcon->l2cap_data = chan->conn; +- +- BT_DBG("move_state %d", chan->move_state); +- +- switch (chan->move_state) { +- case L2CAP_MOVE_WAIT_LOGICAL_COMP: +- /* Move confirm will be sent after a success +- * response is received +- */ +- chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS; +- break; +- case L2CAP_MOVE_WAIT_LOGICAL_CFM: +- if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { +- chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY; +- } else if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) { +- chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP; +- l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED); +- } else if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) { +- chan->move_state = L2CAP_MOVE_WAIT_CONFIRM; +- l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS); +- } +- break; +- default: +- /* Move was not in expected state, free the channel */ +- __release_logical_link(chan); +- +- chan->move_state = L2CAP_MOVE_STABLE; +- } +-} +- +-/* Call with chan locked */ +-void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan, +- u8 status) +-{ +- BT_DBG("chan %p, hchan %p, status %d", chan, hchan, status); +- +- if (status) { +- l2cap_logical_fail(chan); +- __release_logical_link(chan); +- return; +- } +- +- if (chan->state != BT_CONNECTED) { +- /* Ignore logical link if channel is on BR/EDR */ +- if (chan->local_amp_id != AMP_ID_BREDR) +- l2cap_logical_finish_create(chan, hchan); +- } else { +- l2cap_logical_finish_move(chan, hchan); +- } +-} +- +-void l2cap_move_start(struct l2cap_chan *chan) +-{ +- BT_DBG("chan %p", chan); +- +- if (chan->local_amp_id == AMP_ID_BREDR) { +- if (chan->chan_policy != BT_CHANNEL_POLICY_AMP_PREFERRED) +- return; +- chan->move_role = L2CAP_MOVE_ROLE_INITIATOR; +- chan->move_state = L2CAP_MOVE_WAIT_PREPARE; +- /* Placeholder - start physical link setup */ +- } else { +- chan->move_role = L2CAP_MOVE_ROLE_INITIATOR; +- chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS; +- chan->move_id = 0; +- l2cap_move_setup(chan); +- l2cap_send_move_chan_req(chan, 0); +- } +-} +- +-static void l2cap_do_create(struct l2cap_chan *chan, int result, +- u8 local_amp_id, u8 remote_amp_id) +-{ +- BT_DBG("chan %p state %s %u -> %u", chan, state_to_string(chan->state), +- local_amp_id, remote_amp_id); +- +- chan->fcs = L2CAP_FCS_NONE; +- +- /* Outgoing channel on AMP */ +- if (chan->state == BT_CONNECT) { +- if (result == L2CAP_CR_SUCCESS) { +- chan->local_amp_id = local_amp_id; +- l2cap_send_create_chan_req(chan, remote_amp_id); +- } else { +- /* Revert to BR/EDR connect */ +- l2cap_send_conn_req(chan); +- } +- +- return; +- } +- +- /* Incoming channel on AMP */ +- if (__l2cap_no_conn_pending(chan)) { +- struct l2cap_conn_rsp rsp; +- char buf[128]; +- rsp.scid = cpu_to_le16(chan->dcid); +- rsp.dcid = cpu_to_le16(chan->scid); +- +- if (result == L2CAP_CR_SUCCESS) { +- /* Send successful response */ +- rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS); +- rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); +- } else { +- /* Send negative response */ +- rsp.result = cpu_to_le16(L2CAP_CR_NO_MEM); +- rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); +- } +- +- l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP, +- sizeof(rsp), &rsp); +- +- if (result == L2CAP_CR_SUCCESS) { +- l2cap_state_change(chan, BT_CONFIG); +- set_bit(CONF_REQ_SENT, &chan->conf_state); +- l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn), +- L2CAP_CONF_REQ, +- l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); +- chan->num_conf_req++; +- } +- } +-} +- +-static void l2cap_do_move_initiate(struct l2cap_chan *chan, u8 local_amp_id, +- u8 remote_amp_id) +-{ +- l2cap_move_setup(chan); +- chan->move_id = local_amp_id; +- chan->move_state = L2CAP_MOVE_WAIT_RSP; +- +- l2cap_send_move_chan_req(chan, remote_amp_id); +-} +- +-static void l2cap_do_move_respond(struct l2cap_chan *chan, int result) +-{ +- struct hci_chan *hchan = NULL; +- +- /* Placeholder - get hci_chan for logical link */ +- +- if (hchan) { +- if (hchan->state == BT_CONNECTED) { +- /* Logical link is ready to go */ +- chan->hs_hcon = hchan->conn; +- chan->hs_hcon->l2cap_data = chan->conn; +- chan->move_state = L2CAP_MOVE_WAIT_CONFIRM; +- l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS); +- +- l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS); +- } else { +- /* Wait for logical link to be ready */ +- chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM; +- } +- } else { +- /* Logical link not available */ +- l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_ALLOWED); +- } +-} +- +-static void l2cap_do_move_cancel(struct l2cap_chan *chan, int result) +-{ +- if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) { +- u8 rsp_result; +- if (result == -EINVAL) +- rsp_result = L2CAP_MR_BAD_ID; +- else +- rsp_result = L2CAP_MR_NOT_ALLOWED; +- +- l2cap_send_move_chan_rsp(chan, rsp_result); +- } +- +- chan->move_role = L2CAP_MOVE_ROLE_NONE; +- chan->move_state = L2CAP_MOVE_STABLE; +- +- /* Restart data transmission */ +- l2cap_ertm_send(chan); +-} +- +-/* Invoke with locked chan */ +-void __l2cap_physical_cfm(struct l2cap_chan *chan, int result) +-{ +- u8 local_amp_id = chan->local_amp_id; +- u8 remote_amp_id = chan->remote_amp_id; +- +- BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d", +- chan, result, local_amp_id, remote_amp_id); +- +- if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) +- return; +- +- if (chan->state != BT_CONNECTED) { +- l2cap_do_create(chan, result, local_amp_id, remote_amp_id); +- } else if (result != L2CAP_MR_SUCCESS) { +- l2cap_do_move_cancel(chan, result); +- } else { +- switch (chan->move_role) { +- case L2CAP_MOVE_ROLE_INITIATOR: +- l2cap_do_move_initiate(chan, local_amp_id, +- remote_amp_id); +- break; +- case L2CAP_MOVE_ROLE_RESPONDER: +- l2cap_do_move_respond(chan, result); +- break; +- default: +- l2cap_do_move_cancel(chan, result); +- break; +- } +- } +-} +- +-static inline int l2cap_move_channel_req(struct l2cap_conn *conn, +- struct l2cap_cmd_hdr *cmd, +- u16 cmd_len, void *data) +-{ +- struct l2cap_move_chan_req *req = data; +- struct l2cap_move_chan_rsp rsp; +- struct l2cap_chan *chan; +- u16 icid = 0; +- u16 result = L2CAP_MR_NOT_ALLOWED; +- +- if (cmd_len != sizeof(*req)) +- return -EPROTO; +- +- icid = le16_to_cpu(req->icid); +- +- BT_DBG("icid 0x%4.4x, dest_amp_id %d", icid, req->dest_amp_id); +- +- if (!(conn->local_fixed_chan & L2CAP_FC_A2MP)) +- return -EINVAL; +- +- chan = l2cap_get_chan_by_dcid(conn, icid); +- if (!chan) { +- rsp.icid = cpu_to_le16(icid); +- rsp.result = cpu_to_le16(L2CAP_MR_NOT_ALLOWED); +- l2cap_send_cmd(conn, cmd->ident, L2CAP_MOVE_CHAN_RSP, +- sizeof(rsp), &rsp); +- return 0; +- } +- +- chan->ident = cmd->ident; +- +- if (chan->scid < L2CAP_CID_DYN_START || +- chan->chan_policy == BT_CHANNEL_POLICY_BREDR_ONLY || +- (chan->mode != L2CAP_MODE_ERTM && +- chan->mode != L2CAP_MODE_STREAMING)) { +- result = L2CAP_MR_NOT_ALLOWED; +- goto send_move_response; +- } +- +- if (chan->local_amp_id == req->dest_amp_id) { +- result = L2CAP_MR_SAME_ID; +- goto send_move_response; +- } +- +- if (req->dest_amp_id != AMP_ID_BREDR) { +- struct hci_dev *hdev; +- hdev = hci_dev_get(req->dest_amp_id); +- if (!hdev || hdev->dev_type != HCI_AMP || +- !test_bit(HCI_UP, &hdev->flags)) { +- if (hdev) +- hci_dev_put(hdev); +- +- result = L2CAP_MR_BAD_ID; +- goto send_move_response; +- } +- hci_dev_put(hdev); +- } +- +- /* Detect a move collision. Only send a collision response +- * if this side has "lost", otherwise proceed with the move. +- * The winner has the larger bd_addr. +- */ +- if ((__chan_is_moving(chan) || +- chan->move_role != L2CAP_MOVE_ROLE_NONE) && +- bacmp(&conn->hcon->src, &conn->hcon->dst) > 0) { +- result = L2CAP_MR_COLLISION; +- goto send_move_response; +- } +- +- chan->move_role = L2CAP_MOVE_ROLE_RESPONDER; +- l2cap_move_setup(chan); +- chan->move_id = req->dest_amp_id; +- +- if (req->dest_amp_id == AMP_ID_BREDR) { +- /* Moving to BR/EDR */ +- if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { +- chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY; +- result = L2CAP_MR_PEND; +- } else { +- chan->move_state = L2CAP_MOVE_WAIT_CONFIRM; +- result = L2CAP_MR_SUCCESS; +- } +- } else { +- chan->move_state = L2CAP_MOVE_WAIT_PREPARE; +- /* Placeholder - uncomment when amp functions are available */ +- /*amp_accept_physical(chan, req->dest_amp_id);*/ +- result = L2CAP_MR_PEND; +- } +- +-send_move_response: +- l2cap_send_move_chan_rsp(chan, result); +- +- l2cap_chan_unlock(chan); +- l2cap_chan_put(chan); +- +- return 0; +-} +- +-static void l2cap_move_continue(struct l2cap_conn *conn, u16 icid, u16 result) +-{ +- struct l2cap_chan *chan; +- struct hci_chan *hchan = NULL; +- +- chan = l2cap_get_chan_by_scid(conn, icid); +- if (!chan) { +- l2cap_send_move_chan_cfm_icid(conn, icid); +- return; +- } +- +- __clear_chan_timer(chan); +- if (result == L2CAP_MR_PEND) +- __set_chan_timer(chan, L2CAP_MOVE_ERTX_TIMEOUT); +- +- switch (chan->move_state) { +- case L2CAP_MOVE_WAIT_LOGICAL_COMP: +- /* Move confirm will be sent when logical link +- * is complete. +- */ +- chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM; +- break; +- case L2CAP_MOVE_WAIT_RSP_SUCCESS: +- if (result == L2CAP_MR_PEND) { +- break; +- } else if (test_bit(CONN_LOCAL_BUSY, +- &chan->conn_state)) { +- chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY; +- } else { +- /* Logical link is up or moving to BR/EDR, +- * proceed with move +- */ +- chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP; +- l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED); +- } +- break; +- case L2CAP_MOVE_WAIT_RSP: +- /* Moving to AMP */ +- if (result == L2CAP_MR_SUCCESS) { +- /* Remote is ready, send confirm immediately +- * after logical link is ready +- */ +- chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM; +- } else { +- /* Both logical link and move success +- * are required to confirm +- */ +- chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_COMP; +- } +- +- /* Placeholder - get hci_chan for logical link */ +- if (!hchan) { +- /* Logical link not available */ +- l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED); +- break; +- } +- +- /* If the logical link is not yet connected, do not +- * send confirmation. +- */ +- if (hchan->state != BT_CONNECTED) +- break; +- +- /* Logical link is already ready to go */ +- +- chan->hs_hcon = hchan->conn; +- chan->hs_hcon->l2cap_data = chan->conn; +- +- if (result == L2CAP_MR_SUCCESS) { +- /* Can confirm now */ +- l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED); +- } else { +- /* Now only need move success +- * to confirm +- */ +- chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS; +- } +- +- l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS); +- break; +- default: +- /* Any other amp move state means the move failed. */ +- chan->move_id = chan->local_amp_id; +- l2cap_move_done(chan); +- l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED); +- } +- +- l2cap_chan_unlock(chan); +- l2cap_chan_put(chan); +-} +- +-static void l2cap_move_fail(struct l2cap_conn *conn, u8 ident, u16 icid, +- u16 result) +-{ +- struct l2cap_chan *chan; +- +- chan = l2cap_get_chan_by_ident(conn, ident); +- if (!chan) { +- /* Could not locate channel, icid is best guess */ +- l2cap_send_move_chan_cfm_icid(conn, icid); +- return; +- } +- +- __clear_chan_timer(chan); +- +- if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) { +- if (result == L2CAP_MR_COLLISION) { +- chan->move_role = L2CAP_MOVE_ROLE_RESPONDER; +- } else { +- /* Cleanup - cancel move */ +- chan->move_id = chan->local_amp_id; +- l2cap_move_done(chan); +- } +- } +- +- l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED); +- +- l2cap_chan_unlock(chan); +- l2cap_chan_put(chan); +-} +- +-static int l2cap_move_channel_rsp(struct l2cap_conn *conn, +- struct l2cap_cmd_hdr *cmd, +- u16 cmd_len, void *data) +-{ +- struct l2cap_move_chan_rsp *rsp = data; +- u16 icid, result; +- +- if (cmd_len != sizeof(*rsp)) +- return -EPROTO; +- +- icid = le16_to_cpu(rsp->icid); +- result = le16_to_cpu(rsp->result); +- +- BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result); +- +- if (result == L2CAP_MR_SUCCESS || result == L2CAP_MR_PEND) +- l2cap_move_continue(conn, icid, result); +- else +- l2cap_move_fail(conn, cmd->ident, icid, result); +- +- return 0; +-} +- +-static int l2cap_move_channel_confirm(struct l2cap_conn *conn, +- struct l2cap_cmd_hdr *cmd, +- u16 cmd_len, void *data) +-{ +- struct l2cap_move_chan_cfm *cfm = data; +- struct l2cap_chan *chan; +- u16 icid, result; +- +- if (cmd_len != sizeof(*cfm)) +- return -EPROTO; +- +- icid = le16_to_cpu(cfm->icid); +- result = le16_to_cpu(cfm->result); +- +- BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result); +- +- chan = l2cap_get_chan_by_dcid(conn, icid); +- if (!chan) { +- /* Spec requires a response even if the icid was not found */ +- l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid); +- return 0; +- } +- +- if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM) { +- if (result == L2CAP_MC_CONFIRMED) { +- chan->local_amp_id = chan->move_id; +- if (chan->local_amp_id == AMP_ID_BREDR) +- __release_logical_link(chan); +- } else { +- chan->move_id = chan->local_amp_id; +- } +- +- l2cap_move_done(chan); +- } +- +- l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid); +- +- l2cap_chan_unlock(chan); +- l2cap_chan_put(chan); +- +- return 0; +-} +- +-static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn, +- struct l2cap_cmd_hdr *cmd, +- u16 cmd_len, void *data) +-{ +- struct l2cap_move_chan_cfm_rsp *rsp = data; +- struct l2cap_chan *chan; +- u16 icid; +- +- if (cmd_len != sizeof(*rsp)) +- return -EPROTO; +- +- icid = le16_to_cpu(rsp->icid); +- +- BT_DBG("icid 0x%4.4x", icid); +- +- chan = l2cap_get_chan_by_scid(conn, icid); +- if (!chan) +- return 0; +- +- __clear_chan_timer(chan); +- +- if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM_RSP) { +- chan->local_amp_id = chan->move_id; +- +- if (chan->local_amp_id == AMP_ID_BREDR && chan->hs_hchan) +- __release_logical_link(chan); +- +- l2cap_move_done(chan); +- } +- +- l2cap_chan_unlock(chan); +- l2cap_chan_put(chan); +- +- return 0; +-} +- + static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn, + struct l2cap_cmd_hdr *cmd, + u16 cmd_len, u8 *data) +@@ -5745,7 +4761,6 @@ static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn, + break; + + case L2CAP_CONN_RSP: +- case L2CAP_CREATE_CHAN_RSP: + l2cap_connect_create_rsp(conn, cmd, cmd_len, data); + break; + +@@ -5780,26 +4795,6 @@ static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn, + l2cap_information_rsp(conn, cmd, cmd_len, data); + break; + +- case L2CAP_CREATE_CHAN_REQ: +- err = l2cap_create_channel_req(conn, cmd, cmd_len, data); +- break; +- +- case L2CAP_MOVE_CHAN_REQ: +- err = l2cap_move_channel_req(conn, cmd, cmd_len, data); +- break; +- +- case L2CAP_MOVE_CHAN_RSP: +- l2cap_move_channel_rsp(conn, cmd, cmd_len, data); +- break; +- +- case L2CAP_MOVE_CHAN_CFM: +- err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data); +- break; +- +- case L2CAP_MOVE_CHAN_CFM_RSP: +- l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data); +- break; +- + default: + BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code); + err = -EINVAL; +@@ -7051,8 +6046,8 @@ static int l2cap_rx_state_recv(struct l2cap_chan *chan, + if (control->final) { + clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); + +- if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state) && +- !__chan_is_moving(chan)) { ++ if (!test_and_clear_bit(CONN_REJ_ACT, ++ &chan->conn_state)) { + control->final = 0; + l2cap_retransmit_all(chan, control); + } +@@ -7245,11 +6240,7 @@ static int l2cap_finish_move(struct l2cap_chan *chan) + BT_DBG("chan %p", chan); + + chan->rx_state = L2CAP_RX_STATE_RECV; +- +- if (chan->hs_hcon) +- chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; +- else +- chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; ++ chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; + + return l2cap_resegment(chan); + } +@@ -7316,11 +6307,7 @@ static int l2cap_rx_state_wait_f(struct l2cap_chan *chan, + */ + chan->next_tx_seq = control->reqseq; + chan->unacked_frames = 0; +- +- if (chan->hs_hcon) +- chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; +- else +- chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; ++ chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; + + err = l2cap_resegment(chan); + +@@ -7672,21 +6659,10 @@ static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid, + + chan = l2cap_get_chan_by_scid(conn, cid); + if (!chan) { +- if (cid == L2CAP_CID_A2MP) { +- chan = a2mp_channel_create(conn, skb); +- if (!chan) { +- kfree_skb(skb); +- return; +- } +- +- l2cap_chan_hold(chan); +- l2cap_chan_lock(chan); +- } else { +- BT_DBG("unknown cid 0x%4.4x", cid); +- /* Drop packet and return */ +- kfree_skb(skb); +- return; +- } ++ BT_DBG("unknown cid 0x%4.4x", cid); ++ /* Drop packet and return */ ++ kfree_skb(skb); ++ return; + } + + BT_DBG("chan %p, len %d", chan, skb->len); +@@ -7887,10 +6863,6 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon) + + conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS; + +- if (hcon->type == ACL_LINK && +- hci_dev_test_flag(hcon->hdev, HCI_HS_ENABLED)) +- conn->local_fixed_chan |= L2CAP_FC_A2MP; +- + if (hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED) && + (bredr_sc_enabled(hcon->hdev) || + hci_dev_test_flag(hcon->hdev, HCI_FORCE_BREDR_SMP))) +@@ -8355,11 +7327,6 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) + BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid, + state_to_string(chan->state)); + +- if (chan->scid == L2CAP_CID_A2MP) { +- l2cap_chan_unlock(chan); +- continue; +- } +- + if (!status && encrypt) + chan->sec_level = hcon->sec_level; + +diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c +index e50d3d102078e..ee7a41d6994fc 100644 +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -1027,23 +1027,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, + break; + } + +- if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) { +- err = -EINVAL; +- break; +- } +- +- if (chan->mode != L2CAP_MODE_ERTM && +- chan->mode != L2CAP_MODE_STREAMING) { +- err = -EOPNOTSUPP; +- break; +- } +- +- chan->chan_policy = (u8) opt; +- +- if (sk->sk_state == BT_CONNECTED && +- chan->move_role == L2CAP_MOVE_ROLE_NONE) +- l2cap_move_start(chan); +- ++ err = -EOPNOTSUPP; + break; + + case BT_SNDMTU: +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 324f06e2e9ddb..2186ac57981e5 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -835,8 +835,6 @@ static u32 get_supported_settings(struct hci_dev *hdev) + + if (lmp_ssp_capable(hdev)) { + settings |= MGMT_SETTING_SSP; +- if (IS_ENABLED(CONFIG_BT_HS)) +- settings |= MGMT_SETTING_HS; + } + + if (lmp_sc_capable(hdev)) +@@ -901,9 +899,6 @@ static u32 get_current_settings(struct hci_dev *hdev) + if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) + settings |= MGMT_SETTING_SSP; + +- if (hci_dev_test_flag(hdev, HCI_HS_ENABLED)) +- settings |= MGMT_SETTING_HS; +- + if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) + settings |= MGMT_SETTING_ADVERTISING; + +@@ -1930,7 +1925,6 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) + + if (enable && hci_dev_test_and_clear_flag(hdev, + HCI_SSP_ENABLED)) { +- hci_dev_clear_flag(hdev, HCI_HS_ENABLED); + new_settings(hdev, NULL); + } + +@@ -1943,12 +1937,6 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) + changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); + } else { + changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); +- +- if (!changed) +- changed = hci_dev_test_and_clear_flag(hdev, +- HCI_HS_ENABLED); +- else +- hci_dev_clear_flag(hdev, HCI_HS_ENABLED); + } + + mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match); +@@ -2012,11 +2000,6 @@ static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) + } else { + changed = hci_dev_test_and_clear_flag(hdev, + HCI_SSP_ENABLED); +- if (!changed) +- changed = hci_dev_test_and_clear_flag(hdev, +- HCI_HS_ENABLED); +- else +- hci_dev_clear_flag(hdev, HCI_HS_ENABLED); + } + + err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); +@@ -2062,63 +2045,10 @@ static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) + + static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) + { +- struct mgmt_mode *cp = data; +- bool changed; +- u8 status; +- int err; +- + bt_dev_dbg(hdev, "sock %p", sk); + +- if (!IS_ENABLED(CONFIG_BT_HS)) +- return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, ++ return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, + MGMT_STATUS_NOT_SUPPORTED); +- +- status = mgmt_bredr_support(hdev); +- if (status) +- return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status); +- +- if (!lmp_ssp_capable(hdev)) +- return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, +- MGMT_STATUS_NOT_SUPPORTED); +- +- if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) +- return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, +- MGMT_STATUS_REJECTED); +- +- if (cp->val != 0x00 && cp->val != 0x01) +- return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, +- MGMT_STATUS_INVALID_PARAMS); +- +- hci_dev_lock(hdev); +- +- if (pending_find(MGMT_OP_SET_SSP, hdev)) { +- err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, +- MGMT_STATUS_BUSY); +- goto unlock; +- } +- +- if (cp->val) { +- changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED); +- } else { +- if (hdev_is_powered(hdev)) { +- err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, +- MGMT_STATUS_REJECTED); +- goto unlock; +- } +- +- changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED); +- } +- +- err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev); +- if (err < 0) +- goto unlock; +- +- if (changed) +- err = new_settings(hdev, sk); +- +-unlock: +- hci_dev_unlock(hdev); +- return err; + } + + static void set_le_complete(struct hci_dev *hdev, void *data, int err) +@@ -6766,7 +6696,6 @@ static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) + hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); + hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); + hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); +- hci_dev_clear_flag(hdev, HCI_HS_ENABLED); + } + + hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); +-- +2.43.0 + diff --git a/queue-6.7/bluetooth-remove-hci_power_off_timeout.patch b/queue-6.7/bluetooth-remove-hci_power_off_timeout.patch new file mode 100644 index 00000000000..a24fc8e13d3 --- /dev/null +++ b/queue-6.7/bluetooth-remove-hci_power_off_timeout.patch @@ -0,0 +1,39 @@ +From 37ff6158ee8825076820ef95a11da0a1e48cde49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Jan 2024 19:02:47 +0100 +Subject: Bluetooth: Remove HCI_POWER_OFF_TIMEOUT +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonas Dreßler + +[ Upstream commit 968667f2e0345a67a6eea5a502f4659085666564 ] + +With commit cf75ad8b41d2 ("Bluetooth: hci_sync: Convert MGMT_SET_POWERED"), +the power off sequence got refactored so that this timeout was no longer +necessary, let's remove the leftover define from the header too. + +Fixes: cf75ad8b41d2 ("Bluetooth: hci_sync: Convert MGMT_SET_POWERED") +Signed-off-by: Jonas Dreßler +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci.h | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h +index bdee5d649cc61..f7918c7551834 100644 +--- a/include/net/bluetooth/hci.h ++++ b/include/net/bluetooth/hci.h +@@ -437,7 +437,6 @@ enum { + #define HCI_NCMD_TIMEOUT msecs_to_jiffies(4000) /* 4 seconds */ + #define HCI_ACL_TX_TIMEOUT msecs_to_jiffies(45000) /* 45 seconds */ + #define HCI_AUTO_OFF_TIMEOUT msecs_to_jiffies(2000) /* 2 seconds */ +-#define HCI_POWER_OFF_TIMEOUT msecs_to_jiffies(5000) /* 5 seconds */ + #define HCI_LE_CONN_TIMEOUT msecs_to_jiffies(20000) /* 20 seconds */ + #define HCI_LE_AUTOCONN_TIMEOUT msecs_to_jiffies(4000) /* 4 seconds */ + +-- +2.43.0 + diff --git a/queue-6.7/bluetooth-remove-superfluous-call-to-hci_conn_check_.patch b/queue-6.7/bluetooth-remove-superfluous-call-to-hci_conn_check_.patch new file mode 100644 index 00000000000..1e52a45a214 --- /dev/null +++ b/queue-6.7/bluetooth-remove-superfluous-call-to-hci_conn_check_.patch @@ -0,0 +1,62 @@ +From 9b5f5492c3f6fcb2952e0b27dc7b22692c4d2206 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jan 2024 23:46:06 +0100 +Subject: Bluetooth: Remove superfluous call to hci_conn_check_pending() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonas Dreßler + +[ Upstream commit 78e3639fc8031275010c3287ac548c0bc8de83b1 ] + +The "pending connections" feature was originally introduced with commit +4c67bc74f016 ("[Bluetooth] Support concurrent connect requests") and +6bd57416127e ("[Bluetooth] Handling pending connect attempts after +inquiry") to handle controllers supporting only a single connection request +at a time. Later things were extended to also cancel ongoing inquiries on +connect() with commit 89e65975fea5 ("Bluetooth: Cancel Inquiry before +Create Connection"). + +With commit a9de9248064b ("[Bluetooth] Switch from OGF+OCF to using only +opcodes"), hci_conn_check_pending() was introduced as a helper to +consolidate a few places where we check for pending connections (indicated +by the BT_CONNECT2 flag) and then try to connect. + +This refactoring commit also snuck in two more calls to +hci_conn_check_pending(): + +- One is in the failure callback of hci_cs_inquiry(), this one probably +makes sense: If we send an "HCI Inquiry" command and then immediately +after a "Create Connection" command, the "Create Connection" command might +fail before the "HCI Inquiry" command, and then we want to retry the +"Create Connection" on failure of the "HCI Inquiry". + +- The other added call to hci_conn_check_pending() is in the event handler +for the "Remote Name" event, this seems unrelated and is possibly a +copy-paste error, so remove that one. + +Fixes: a9de9248064b ("[Bluetooth] Switch from OGF+OCF to using only opcodes") +Signed-off-by: Jonas Dreßler +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_event.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 2a5f5a7d2412b..1f63f77661dce 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -3556,8 +3556,6 @@ static void hci_remote_name_evt(struct hci_dev *hdev, void *data, + + bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); + +- hci_conn_check_pending(hdev); +- + hci_dev_lock(hdev); + + conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr); +-- +2.43.0 + diff --git a/queue-6.7/bpf-don-t-infer-ptr_to_ctx-for-programs-with-unnamed.patch b/queue-6.7/bpf-don-t-infer-ptr_to_ctx-for-programs-with-unnamed.patch new file mode 100644 index 00000000000..f9c214b67dc --- /dev/null +++ b/queue-6.7/bpf-don-t-infer-ptr_to_ctx-for-programs-with-unnamed.patch @@ -0,0 +1,97 @@ +From 5013c2c5921beb2f41236cae43d5b62bd2a9c61d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Feb 2024 15:32:20 -0800 +Subject: bpf: don't infer PTR_TO_CTX for programs with unnamed context type + +From: Andrii Nakryiko + +[ Upstream commit 879bbe7aa4afa80acf72a1cad7f52416ea78c52d ] + +For program types that don't have named context type name (e.g., BPF +iterator programs or tracepoint programs), ctx_tname will be a non-NULL +empty string. For such programs it shouldn't be possible to have +PTR_TO_CTX argument for global subprogs based on type name alone. +arg:ctx tag is the only way to have PTR_TO_CTX passed into global +subprog for such program types. + +Fix this loophole, which currently would assume PTR_TO_CTX whenever +user uses a pointer to anonymous struct as an argument to their global +subprogs. This happens in practice with the following (quite common, in +practice) approach: + +typedef struct { /* anonymous */ + int x; +} my_type_t; + +int my_subprog(my_type_t *arg) { ... } + +User's intent is to have PTR_TO_MEM argument for `arg`, but verifier +will complain about expecting PTR_TO_CTX. + +This fix also closes unintended s390x-specific KPROBE handling of +PTR_TO_CTX case. Selftest change is necessary to accommodate this. + +Fixes: 91cc1a99740e ("bpf: Annotate context types") +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/r/20240212233221.2575350-4-andrii@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/btf.c | 3 +++ + .../bpf/progs/test_global_func_ctx_args.c | 19 +++++++++++++++++++ + 2 files changed, 22 insertions(+) + +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index 15d71d2986d3a..a17da40f65d31 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -5665,6 +5665,9 @@ btf_get_prog_ctx_type(struct bpf_verifier_log *log, const struct btf *btf, + bpf_log(log, "Please fix kernel include/linux/bpf_types.h\n"); + return NULL; + } ++ /* program types without named context types work only with arg:ctx tag */ ++ if (ctx_tname[0] == '\0') ++ return false; + /* only compare that prog's ctx type name is the same as + * kernel expects. No need to compare field by field. + * It's ok for bpf prog to do: +diff --git a/tools/testing/selftests/bpf/progs/test_global_func_ctx_args.c b/tools/testing/selftests/bpf/progs/test_global_func_ctx_args.c +index 7faa8eef0598b..144d30e654ad2 100644 +--- a/tools/testing/selftests/bpf/progs/test_global_func_ctx_args.c ++++ b/tools/testing/selftests/bpf/progs/test_global_func_ctx_args.c +@@ -26,6 +26,23 @@ int kprobe_typedef_ctx(void *ctx) + return kprobe_typedef_ctx_subprog(ctx); + } + ++/* s390x defines: ++ * ++ * typedef user_pt_regs bpf_user_pt_regs_t; ++ * typedef struct { ... } user_pt_regs; ++ * ++ * And so "canonical" underlying struct type is anonymous. ++ * So on s390x only valid ways to have PTR_TO_CTX argument in global subprogs ++ * are: ++ * - bpf_user_pt_regs_t *ctx (typedef); ++ * - struct bpf_user_pt_regs_t *ctx (backwards compatible struct hack); ++ * - void *ctx __arg_ctx (arg:ctx tag) ++ * ++ * Other architectures also allow using underlying struct types (e.g., ++ * `struct pt_regs *ctx` for x86-64) ++ */ ++#ifndef bpf_target_s390 ++ + #define pt_regs_struct_t typeof(*(__PT_REGS_CAST((struct pt_regs *)NULL))) + + __weak int kprobe_struct_ctx_subprog(pt_regs_struct_t *ctx) +@@ -40,6 +57,8 @@ int kprobe_resolved_ctx(void *ctx) + return kprobe_struct_ctx_subprog(ctx); + } + ++#endif ++ + /* this is current hack to make this work on old kernels */ + struct bpf_user_pt_regs_t {}; + +-- +2.43.0 + diff --git a/queue-6.7/bpf-fix-devmap_hash-overflow-check-on-32-bit-arches.patch b/queue-6.7/bpf-fix-devmap_hash-overflow-check-on-32-bit-arches.patch new file mode 100644 index 00000000000..ba08482bbf9 --- /dev/null +++ b/queue-6.7/bpf-fix-devmap_hash-overflow-check-on-32-bit-arches.patch @@ -0,0 +1,66 @@ +From 056398d83390982c95c79fcbe9ea0a058b08fccb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 13:03:35 +0100 +Subject: bpf: Fix DEVMAP_HASH overflow check on 32-bit arches +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +[ Upstream commit 281d464a34f540de166cee74b723e97ac2515ec3 ] + +The devmap code allocates a number hash buckets equal to the next power +of two of the max_entries value provided when creating the map. When +rounding up to the next power of two, the 32-bit variable storing the +number of buckets can overflow, and the code checks for overflow by +checking if the truncated 32-bit value is equal to 0. However, on 32-bit +arches the rounding up itself can overflow mid-way through, because it +ends up doing a left-shift of 32 bits on an unsigned long value. If the +size of an unsigned long is four bytes, this is undefined behaviour, so +there is no guarantee that we'll end up with a nice and tidy 0-value at +the end. + +Syzbot managed to turn this into a crash on arm32 by creating a +DEVMAP_HASH with max_entries > 0x80000000 and then trying to update it. +Fix this by moving the overflow check to before the rounding up +operation. + +Fixes: 6f9d451ab1a3 ("xdp: Add devmap_hash map type for looking up devices by hashed index") +Link: https://lore.kernel.org/r/000000000000ed666a0611af6818@google.com +Reported-and-tested-by: syzbot+8cd36f6b65f3cafd400a@syzkaller.appspotmail.com +Signed-off-by: Toke Høiland-Jørgensen +Message-ID: <20240307120340.99577-2-toke@redhat.com> +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/devmap.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c +index a936c704d4e77..4e2cdbb5629f2 100644 +--- a/kernel/bpf/devmap.c ++++ b/kernel/bpf/devmap.c +@@ -130,13 +130,14 @@ static int dev_map_init_map(struct bpf_dtab *dtab, union bpf_attr *attr) + bpf_map_init_from_attr(&dtab->map, attr); + + if (attr->map_type == BPF_MAP_TYPE_DEVMAP_HASH) { +- dtab->n_buckets = roundup_pow_of_two(dtab->map.max_entries); +- +- if (!dtab->n_buckets) /* Overflow check */ ++ /* hash table size must be power of 2; roundup_pow_of_two() can ++ * overflow into UB on 32-bit arches, so check that first ++ */ ++ if (dtab->map.max_entries > 1UL << 31) + return -EINVAL; +- } + +- if (attr->map_type == BPF_MAP_TYPE_DEVMAP_HASH) { ++ dtab->n_buckets = roundup_pow_of_two(dtab->map.max_entries); ++ + dtab->dev_index_head = dev_map_create_hash(dtab->n_buckets, + dtab->map.numa_node); + if (!dtab->dev_index_head) +-- +2.43.0 + diff --git a/queue-6.7/bpf-fix-hashtab-overflow-check-on-32-bit-arches.patch b/queue-6.7/bpf-fix-hashtab-overflow-check-on-32-bit-arches.patch new file mode 100644 index 00000000000..07266ac256b --- /dev/null +++ b/queue-6.7/bpf-fix-hashtab-overflow-check-on-32-bit-arches.patch @@ -0,0 +1,65 @@ +From 40eefcf7468c5bb7e3cb91c1609e63101fbfc59d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 13:03:36 +0100 +Subject: bpf: Fix hashtab overflow check on 32-bit arches +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +[ Upstream commit 6787d916c2cf9850c97a0a3f73e08c43e7d973b1 ] + +The hashtab code relies on roundup_pow_of_two() to compute the number of +hash buckets, and contains an overflow check by checking if the +resulting value is 0. However, on 32-bit arches, the roundup code itself +can overflow by doing a 32-bit left-shift of an unsigned long value, +which is undefined behaviour, so it is not guaranteed to truncate +neatly. This was triggered by syzbot on the DEVMAP_HASH type, which +contains the same check, copied from the hashtab code. So apply the same +fix to hashtab, by moving the overflow check to before the roundup. + +Fixes: daaf427c6ab3 ("bpf: fix arraymap NULL deref and missing overflow and zero size checks") +Signed-off-by: Toke Høiland-Jørgensen +Message-ID: <20240307120340.99577-3-toke@redhat.com> +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/hashtab.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c +index 5b9146fa825fd..85cd17ca38290 100644 +--- a/kernel/bpf/hashtab.c ++++ b/kernel/bpf/hashtab.c +@@ -498,7 +498,13 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr) + num_possible_cpus()); + } + +- /* hash table size must be power of 2 */ ++ /* hash table size must be power of 2; roundup_pow_of_two() can overflow ++ * into UB on 32-bit arches, so check that first ++ */ ++ err = -E2BIG; ++ if (htab->map.max_entries > 1UL << 31) ++ goto free_htab; ++ + htab->n_buckets = roundup_pow_of_two(htab->map.max_entries); + + htab->elem_size = sizeof(struct htab_elem) + +@@ -508,10 +514,8 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr) + else + htab->elem_size += round_up(htab->map.value_size, 8); + +- err = -E2BIG; +- /* prevent zero size kmalloc and check for u32 overflow */ +- if (htab->n_buckets == 0 || +- htab->n_buckets > U32_MAX / sizeof(struct bucket)) ++ /* check for u32 overflow */ ++ if (htab->n_buckets > U32_MAX / sizeof(struct bucket)) + goto free_htab; + + err = bpf_map_init_elem_count(&htab->map); +-- +2.43.0 + diff --git a/queue-6.7/bpf-fix-stackmap-overflow-check-on-32-bit-arches.patch b/queue-6.7/bpf-fix-stackmap-overflow-check-on-32-bit-arches.patch new file mode 100644 index 00000000000..8734f570438 --- /dev/null +++ b/queue-6.7/bpf-fix-stackmap-overflow-check-on-32-bit-arches.patch @@ -0,0 +1,61 @@ +From e29a4cb3abb263f6128b9d72607eea03dd101405 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 13:03:37 +0100 +Subject: bpf: Fix stackmap overflow check on 32-bit arches +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +[ Upstream commit 7a4b21250bf79eef26543d35bd390448646c536b ] + +The stackmap code relies on roundup_pow_of_two() to compute the number +of hash buckets, and contains an overflow check by checking if the +resulting value is 0. However, on 32-bit arches, the roundup code itself +can overflow by doing a 32-bit left-shift of an unsigned long value, +which is undefined behaviour, so it is not guaranteed to truncate +neatly. This was triggered by syzbot on the DEVMAP_HASH type, which +contains the same check, copied from the hashtab code. + +The commit in the fixes tag actually attempted to fix this, but the fix +did not account for the UB, so the fix only works on CPUs where an +overflow does result in a neat truncation to zero, which is not +guaranteed. Checking the value before rounding does not have this +problem. + +Fixes: 6183f4d3a0a2 ("bpf: Check for integer overflow when using roundup_pow_of_two()") +Signed-off-by: Toke Høiland-Jørgensen +Reviewed-by: Bui Quang Minh +Message-ID: <20240307120340.99577-4-toke@redhat.com> +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/stackmap.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c +index dff7ba5397015..c99f8e5234ac4 100644 +--- a/kernel/bpf/stackmap.c ++++ b/kernel/bpf/stackmap.c +@@ -91,11 +91,14 @@ static struct bpf_map *stack_map_alloc(union bpf_attr *attr) + } else if (value_size / 8 > sysctl_perf_event_max_stack) + return ERR_PTR(-EINVAL); + +- /* hash table size must be power of 2 */ +- n_buckets = roundup_pow_of_two(attr->max_entries); +- if (!n_buckets) ++ /* hash table size must be power of 2; roundup_pow_of_two() can overflow ++ * into UB on 32-bit arches, so check that first ++ */ ++ if (attr->max_entries > 1UL << 31) + return ERR_PTR(-E2BIG); + ++ n_buckets = roundup_pow_of_two(attr->max_entries); ++ + cost = n_buckets * sizeof(struct stack_map_bucket *) + sizeof(*smap); + smap = bpf_map_area_alloc(cost, bpf_map_attr_numa_node(attr)); + if (!smap) +-- +2.43.0 + diff --git a/queue-6.7/bpf-hardcode-bpf_prog_pack_size-to-2mb-num_possible_.patch b/queue-6.7/bpf-hardcode-bpf_prog_pack_size-to-2mb-num_possible_.patch new file mode 100644 index 00000000000..ecf76c1d0c6 --- /dev/null +++ b/queue-6.7/bpf-hardcode-bpf_prog_pack_size-to-2mb-num_possible_.patch @@ -0,0 +1,53 @@ +From 23b1f7cdfebb0b8c83acafb393533e5b8b795599 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Mar 2024 12:27:22 +0000 +Subject: bpf: hardcode BPF_PROG_PACK_SIZE to 2MB * num_possible_nodes() + +From: Puranjay Mohan + +[ Upstream commit d6170e4aaf86424c24ce06e355b4573daa891b17 ] + +On some architectures like ARM64, PMD_SIZE can be really large in some +configurations. Like with CONFIG_ARM64_64K_PAGES=y the PMD_SIZE is +512MB. + +Use 2MB * num_possible_nodes() as the size for allocations done through +the prog pack allocator. On most architectures, PMD_SIZE will be equal +to 2MB in case of 4KB pages and will be greater than 2MB for bigger page +sizes. + +Fixes: ea2babac63d4 ("bpf: Simplify bpf_prog_pack_[size|mask]") +Reported-by: "kernelci.org bot" +Closes: https://lore.kernel.org/all/7e216c88-77ee-47b8-becc-a0f780868d3c@sirena.org.uk/ +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202403092219.dhgcuz2G-lkp@intel.com/ +Suggested-by: Song Liu +Signed-off-by: Puranjay Mohan +Message-ID: <20240311122722.86232-1-puranjay12@gmail.com> +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/core.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index fe254ae035fe4..27fd41777176c 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -863,7 +863,12 @@ static LIST_HEAD(pack_list); + * CONFIG_MMU=n. Use PAGE_SIZE in these cases. + */ + #ifdef PMD_SIZE +-#define BPF_PROG_PACK_SIZE (PMD_SIZE * num_possible_nodes()) ++/* PMD_SIZE is really big for some archs. It doesn't make sense to ++ * reserve too much memory in one allocation. Hardcode BPF_PROG_PACK_SIZE to ++ * 2MiB * num_possible_nodes(). On most architectures PMD_SIZE will be ++ * greater than or equal to 2MB. ++ */ ++#define BPF_PROG_PACK_SIZE (SZ_2M * num_possible_nodes()) + #else + #define BPF_PROG_PACK_SIZE PAGE_SIZE + #endif +-- +2.43.0 + diff --git a/queue-6.7/bpf-mark-bpf_spin_-lock-unlock-helpers-with-notrace-.patch b/queue-6.7/bpf-mark-bpf_spin_-lock-unlock-helpers-with-notrace-.patch new file mode 100644 index 00000000000..cc8f34d801c --- /dev/null +++ b/queue-6.7/bpf-mark-bpf_spin_-lock-unlock-helpers-with-notrace-.patch @@ -0,0 +1,133 @@ +From 63b17ff7aa67be613337ed7f87f346c8e8c012f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Feb 2024 23:01:02 -0800 +Subject: bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly + +From: Yonghong Song + +[ Upstream commit 178c54666f9c4d2f49f2ea661d0c11b52f0ed190 ] + +Currently tracing is supposed not to allow for bpf_spin_{lock,unlock}() +helper calls. This is to prevent deadlock for the following cases: + - there is a prog (prog-A) calling bpf_spin_{lock,unlock}(). + - there is a tracing program (prog-B), e.g., fentry, attached + to bpf_spin_lock() and/or bpf_spin_unlock(). + - prog-B calls bpf_spin_{lock,unlock}(). +For such a case, when prog-A calls bpf_spin_{lock,unlock}(), +a deadlock will happen. + +The related source codes are below in kernel/bpf/helpers.c: + notrace BPF_CALL_1(bpf_spin_lock, struct bpf_spin_lock *, lock) + notrace BPF_CALL_1(bpf_spin_unlock, struct bpf_spin_lock *, lock) +notrace is supposed to prevent fentry prog from attaching to +bpf_spin_{lock,unlock}(). + +But actually this is not the case and fentry prog can successfully +attached to bpf_spin_lock(). Siddharth Chintamaneni reported +the issue in [1]. The following is the macro definition for +above BPF_CALL_1: + #define BPF_CALL_x(x, name, ...) \ + static __always_inline \ + u64 ____##name(__BPF_MAP(x, __BPF_DECL_ARGS, __BPF_V, __VA_ARGS__)); \ + typedef u64 (*btf_##name)(__BPF_MAP(x, __BPF_DECL_ARGS, __BPF_V, __VA_ARGS__)); \ + u64 name(__BPF_REG(x, __BPF_DECL_REGS, __BPF_N, __VA_ARGS__)); \ + u64 name(__BPF_REG(x, __BPF_DECL_REGS, __BPF_N, __VA_ARGS__)) \ + { \ + return ((btf_##name)____##name)(__BPF_MAP(x,__BPF_CAST,__BPF_N,__VA_ARGS__));\ + } \ + static __always_inline \ + u64 ____##name(__BPF_MAP(x, __BPF_DECL_ARGS, __BPF_V, __VA_ARGS__)) + + #define BPF_CALL_1(name, ...) BPF_CALL_x(1, name, __VA_ARGS__) + +The notrace attribute is actually applied to the static always_inline function +____bpf_spin_{lock,unlock}(). The actual callback function +bpf_spin_{lock,unlock}() is not marked with notrace, hence +allowing fentry prog to attach to two helpers, and this +may cause the above mentioned deadlock. Siddharth Chintamaneni +actually has a reproducer in [2]. + +To fix the issue, a new macro NOTRACE_BPF_CALL_1 is introduced which +will add notrace attribute to the original function instead of +the hidden always_inline function and this fixed the problem. + + [1] https://lore.kernel.org/bpf/CAE5sdEigPnoGrzN8WU7Tx-h-iFuMZgW06qp0KHWtpvoXxf1OAQ@mail.gmail.com/ + [2] https://lore.kernel.org/bpf/CAE5sdEg6yUc_Jz50AnUXEEUh6O73yQ1Z6NV2srJnef0ZrQkZew@mail.gmail.com/ + +Fixes: d83525ca62cf ("bpf: introduce bpf_spin_lock") +Signed-off-by: Yonghong Song +Signed-off-by: Andrii Nakryiko +Acked-by: Jiri Olsa +Link: https://lore.kernel.org/bpf/20240207070102.335167-1-yonghong.song@linux.dev +Signed-off-by: Sasha Levin +--- + include/linux/filter.h | 21 ++++++++++++--------- + kernel/bpf/helpers.c | 4 ++-- + 2 files changed, 14 insertions(+), 11 deletions(-) + +diff --git a/include/linux/filter.h b/include/linux/filter.h +index a4953fafc8cb8..02e043bd93b1a 100644 +--- a/include/linux/filter.h ++++ b/include/linux/filter.h +@@ -547,24 +547,27 @@ static inline bool insn_is_zext(const struct bpf_insn *insn) + __BPF_MAP(n, __BPF_DECL_ARGS, __BPF_N, u64, __ur_1, u64, __ur_2, \ + u64, __ur_3, u64, __ur_4, u64, __ur_5) + +-#define BPF_CALL_x(x, name, ...) \ ++#define BPF_CALL_x(x, attr, name, ...) \ + static __always_inline \ + u64 ____##name(__BPF_MAP(x, __BPF_DECL_ARGS, __BPF_V, __VA_ARGS__)); \ + typedef u64 (*btf_##name)(__BPF_MAP(x, __BPF_DECL_ARGS, __BPF_V, __VA_ARGS__)); \ +- u64 name(__BPF_REG(x, __BPF_DECL_REGS, __BPF_N, __VA_ARGS__)); \ +- u64 name(__BPF_REG(x, __BPF_DECL_REGS, __BPF_N, __VA_ARGS__)) \ ++ attr u64 name(__BPF_REG(x, __BPF_DECL_REGS, __BPF_N, __VA_ARGS__)); \ ++ attr u64 name(__BPF_REG(x, __BPF_DECL_REGS, __BPF_N, __VA_ARGS__)) \ + { \ + return ((btf_##name)____##name)(__BPF_MAP(x,__BPF_CAST,__BPF_N,__VA_ARGS__));\ + } \ + static __always_inline \ + u64 ____##name(__BPF_MAP(x, __BPF_DECL_ARGS, __BPF_V, __VA_ARGS__)) + +-#define BPF_CALL_0(name, ...) BPF_CALL_x(0, name, __VA_ARGS__) +-#define BPF_CALL_1(name, ...) BPF_CALL_x(1, name, __VA_ARGS__) +-#define BPF_CALL_2(name, ...) BPF_CALL_x(2, name, __VA_ARGS__) +-#define BPF_CALL_3(name, ...) BPF_CALL_x(3, name, __VA_ARGS__) +-#define BPF_CALL_4(name, ...) BPF_CALL_x(4, name, __VA_ARGS__) +-#define BPF_CALL_5(name, ...) BPF_CALL_x(5, name, __VA_ARGS__) ++#define __NOATTR ++#define BPF_CALL_0(name, ...) BPF_CALL_x(0, __NOATTR, name, __VA_ARGS__) ++#define BPF_CALL_1(name, ...) BPF_CALL_x(1, __NOATTR, name, __VA_ARGS__) ++#define BPF_CALL_2(name, ...) BPF_CALL_x(2, __NOATTR, name, __VA_ARGS__) ++#define BPF_CALL_3(name, ...) BPF_CALL_x(3, __NOATTR, name, __VA_ARGS__) ++#define BPF_CALL_4(name, ...) BPF_CALL_x(4, __NOATTR, name, __VA_ARGS__) ++#define BPF_CALL_5(name, ...) BPF_CALL_x(5, __NOATTR, name, __VA_ARGS__) ++ ++#define NOTRACE_BPF_CALL_1(name, ...) BPF_CALL_x(1, notrace, name, __VA_ARGS__) + + #define bpf_ctx_range(TYPE, MEMBER) \ + offsetof(TYPE, MEMBER) ... offsetofend(TYPE, MEMBER) - 1 +diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c +index ce4729ef1ad2d..b912d055a8470 100644 +--- a/kernel/bpf/helpers.c ++++ b/kernel/bpf/helpers.c +@@ -334,7 +334,7 @@ static inline void __bpf_spin_lock_irqsave(struct bpf_spin_lock *lock) + __this_cpu_write(irqsave_flags, flags); + } + +-notrace BPF_CALL_1(bpf_spin_lock, struct bpf_spin_lock *, lock) ++NOTRACE_BPF_CALL_1(bpf_spin_lock, struct bpf_spin_lock *, lock) + { + __bpf_spin_lock_irqsave(lock); + return 0; +@@ -357,7 +357,7 @@ static inline void __bpf_spin_unlock_irqrestore(struct bpf_spin_lock *lock) + local_irq_restore(flags); + } + +-notrace BPF_CALL_1(bpf_spin_unlock, struct bpf_spin_lock *, lock) ++NOTRACE_BPF_CALL_1(bpf_spin_unlock, struct bpf_spin_lock *, lock) + { + __bpf_spin_unlock_irqrestore(lock); + return 0; +-- +2.43.0 + diff --git a/queue-6.7/bpftool-silence-build-warning-about-calloc.patch b/queue-6.7/bpftool-silence-build-warning-about-calloc.patch new file mode 100644 index 00000000000..4ef430061c7 --- /dev/null +++ b/queue-6.7/bpftool-silence-build-warning-about-calloc.patch @@ -0,0 +1,54 @@ +From 8656111ac26c5223b02df20af6a0cd9734bdb78f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jan 2024 14:19:20 +0800 +Subject: bpftool: Silence build warning about calloc() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tiezhu Yang + +[ Upstream commit f5f30386c78105cba520e443a6a9ee945ec1d066 ] + +There exists the following warning when building bpftool: + + CC prog.o +prog.c: In function ‘profile_open_perf_events’: +prog.c:2301:24: warning: ‘calloc’ sizes specified with ‘sizeof’ in the earlier argument and not in the later argument [-Wcalloc-transposed-args] + 2301 | sizeof(int), obj->rodata->num_cpu * obj->rodata->num_metric); + | ^~~ +prog.c:2301:24: note: earlier argument should specify number of elements, later size of each element + +Tested with the latest upstream GCC which contains a new warning option +-Wcalloc-transposed-args. The first argument to calloc is documented to +be number of elements in array, while the second argument is size of each +element, just switch the first and second arguments of calloc() to silence +the build warning, compile tested only. + +Fixes: 47c09d6a9f67 ("bpftool: Introduce "prog profile" command") +Signed-off-by: Tiezhu Yang +Signed-off-by: Daniel Borkmann +Reviewed-by: Quentin Monnet +Link: https://lore.kernel.org/bpf/20240116061920.31172-1-yangtiezhu@loongson.cn +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/prog.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c +index 7ec4f5671e7a9..865bfa869a5b2 100644 +--- a/tools/bpf/bpftool/prog.c ++++ b/tools/bpf/bpftool/prog.c +@@ -2294,7 +2294,7 @@ static int profile_open_perf_events(struct profiler_bpf *obj) + int map_fd; + + profile_perf_events = calloc( +- sizeof(int), obj->rodata->num_cpu * obj->rodata->num_metric); ++ obj->rodata->num_cpu * obj->rodata->num_metric, sizeof(int)); + if (!profile_perf_events) { + p_err("failed to allocate memory for perf_event array: %s", + strerror(errno)); +-- +2.43.0 + diff --git a/queue-6.7/bus-tegra-aconnect-update-dependency-to-arch_tegra.patch b/queue-6.7/bus-tegra-aconnect-update-dependency-to-arch_tegra.patch new file mode 100644 index 00000000000..1490aebaf25 --- /dev/null +++ b/queue-6.7/bus-tegra-aconnect-update-dependency-to-arch_tegra.patch @@ -0,0 +1,47 @@ +From 312a8c8ff76b8d3b4f17e993617ff733cc007597 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 10:02:37 +0000 +Subject: bus: tegra-aconnect: Update dependency to ARCH_TEGRA + +From: Peter Robinson + +[ Upstream commit 4acd21a45c1446277e2abaece97d7fa7c2e692a9 ] + +Update the architecture dependency to be the generic Tegra +because the driver works on the four latest Tegra generations +not just Tegra210, if you build a kernel with a specific +ARCH_TEGRA_xxx_SOC option that excludes Tegra210 you don't get +this driver. + +Fixes: 46a88534afb59 ("bus: Add support for Tegra ACONNECT") +Signed-off-by: Peter Robinson +Cc: Jon Hunter +Cc: Thierry Reding +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/bus/Kconfig | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/bus/Kconfig b/drivers/bus/Kconfig +index e6742998f372c..d5e7fa9173a16 100644 +--- a/drivers/bus/Kconfig ++++ b/drivers/bus/Kconfig +@@ -186,11 +186,12 @@ config SUNXI_RSB + + config TEGRA_ACONNECT + tristate "Tegra ACONNECT Bus Driver" +- depends on ARCH_TEGRA_210_SOC ++ depends on ARCH_TEGRA + depends on OF && PM + help + Driver for the Tegra ACONNECT bus which is used to interface with +- the devices inside the Audio Processing Engine (APE) for Tegra210. ++ the devices inside the Audio Processing Engine (APE) for ++ Tegra210 and later. + + config TEGRA_GMI + tristate "Tegra Generic Memory Interface bus driver" +-- +2.43.0 + diff --git a/queue-6.7/can-m_can-start-cancel-polling-timer-together-with-i.patch b/queue-6.7/can-m_can-start-cancel-polling-timer-together-with-i.patch new file mode 100644 index 00000000000..7cfb88f83af --- /dev/null +++ b/queue-6.7/can-m_can-start-cancel-polling-timer-together-with-i.patch @@ -0,0 +1,82 @@ +From 83f9592cc6aa102eb631ba35f715c8a0119301af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Feb 2024 10:32:07 +0100 +Subject: can: m_can: Start/Cancel polling timer together with interrupts + +From: Markus Schneider-Pargmann + +[ Upstream commit a163c5761019b94258ca655b27b46e82657fd6f5 ] + +Interrupts are enabled/disabled in more places than just m_can_start() +and m_can_stop(). Couple the polling timer with enabling/disabling of +all interrupts to achieve equivalent behavior. + +Cc: Judith Mendez +Fixes: b382380c0d2d ("can: m_can: Add hrtimer to generate software interrupt") +Signed-off-by: Markus Schneider-Pargmann +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/all/20240207093220.2681425-2-msp@baylibre.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index 16ecc11c7f62a..2395b1225cc8a 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -418,6 +418,13 @@ static void m_can_config_endisable(struct m_can_classdev *cdev, bool enable) + + static inline void m_can_enable_all_interrupts(struct m_can_classdev *cdev) + { ++ if (!cdev->net->irq) { ++ dev_dbg(cdev->dev, "Start hrtimer\n"); ++ hrtimer_start(&cdev->hrtimer, ++ ms_to_ktime(HRTIMER_POLL_INTERVAL_MS), ++ HRTIMER_MODE_REL_PINNED); ++ } ++ + /* Only interrupt line 0 is used in this driver */ + m_can_write(cdev, M_CAN_ILE, ILE_EINT0); + } +@@ -425,6 +432,11 @@ static inline void m_can_enable_all_interrupts(struct m_can_classdev *cdev) + static inline void m_can_disable_all_interrupts(struct m_can_classdev *cdev) + { + m_can_write(cdev, M_CAN_ILE, 0x0); ++ ++ if (!cdev->net->irq) { ++ dev_dbg(cdev->dev, "Stop hrtimer\n"); ++ hrtimer_cancel(&cdev->hrtimer); ++ } + } + + /* Retrieve internal timestamp counter from TSCV.TSC, and shift it to 32-bit +@@ -1417,12 +1429,6 @@ static int m_can_start(struct net_device *dev) + + m_can_enable_all_interrupts(cdev); + +- if (!dev->irq) { +- dev_dbg(cdev->dev, "Start hrtimer\n"); +- hrtimer_start(&cdev->hrtimer, ms_to_ktime(HRTIMER_POLL_INTERVAL_MS), +- HRTIMER_MODE_REL_PINNED); +- } +- + return 0; + } + +@@ -1577,11 +1583,6 @@ static void m_can_stop(struct net_device *dev) + { + struct m_can_classdev *cdev = netdev_priv(dev); + +- if (!dev->irq) { +- dev_dbg(cdev->dev, "Stop hrtimer\n"); +- hrtimer_cancel(&cdev->hrtimer); +- } +- + /* disable all interrupts */ + m_can_disable_all_interrupts(cdev); + +-- +2.43.0 + diff --git a/queue-6.7/cifs-don-t-use-certain-unnecessary-folio_-functions.patch b/queue-6.7/cifs-don-t-use-certain-unnecessary-folio_-functions.patch new file mode 100644 index 00000000000..5a9c536d7d9 --- /dev/null +++ b/queue-6.7/cifs-don-t-use-certain-unnecessary-folio_-functions.patch @@ -0,0 +1,87 @@ +From 48ba8e3e5e8ba2a23b4f9d15bd95c4542e5a9a67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jan 2024 17:54:35 +0000 +Subject: cifs: Don't use certain unnecessary folio_*() functions + +From: David Howells + +[ Upstream commit c40497d82387188f14d9adc4caa58ee1cb1999e1 ] + +Filesystems should use folio->index and folio->mapping, instead of +folio_index(folio), folio_mapping() and folio_file_mapping() since +they know that it's in the pagecache. + +Change this automagically with: + +perl -p -i -e 's/folio_mapping[(]([^)]*)[)]/\1->mapping/g' fs/smb/client/*.c +perl -p -i -e 's/folio_file_mapping[(]([^)]*)[)]/\1->mapping/g' fs/smb/client/*.c +perl -p -i -e 's/folio_index[(]([^)]*)[)]/\1->index/g' fs/smb/client/*.c + +Reported-by: Matthew Wilcox +Signed-off-by: David Howells +cc: Jeff Layton +cc: Steve French +cc: Paulo Alcantara +cc: Ronnie Sahlberg +cc: Shyam Prasad N +cc: Tom Talpey +cc: linux-cifs@vger.kernel.org +cc: linux-fsdevel@vger.kernel.org +Stable-dep-of: f3dc1bdb6b0b ("cifs: Fix writeback data corruption") +Signed-off-by: Sasha Levin +--- + fs/smb/client/file.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/fs/smb/client/file.c b/fs/smb/client/file.c +index 043bee4020a91..7320272ef0074 100644 +--- a/fs/smb/client/file.c ++++ b/fs/smb/client/file.c +@@ -87,7 +87,7 @@ void cifs_pages_written_back(struct inode *inode, loff_t start, unsigned int len + continue; + if (!folio_test_writeback(folio)) { + WARN_ONCE(1, "bad %x @%llx page %lx %lx\n", +- len, start, folio_index(folio), end); ++ len, start, folio->index, end); + continue; + } + +@@ -120,7 +120,7 @@ void cifs_pages_write_failed(struct inode *inode, loff_t start, unsigned int len + continue; + if (!folio_test_writeback(folio)) { + WARN_ONCE(1, "bad %x @%llx page %lx %lx\n", +- len, start, folio_index(folio), end); ++ len, start, folio->index, end); + continue; + } + +@@ -151,7 +151,7 @@ void cifs_pages_write_redirty(struct inode *inode, loff_t start, unsigned int le + xas_for_each(&xas, folio, end) { + if (!folio_test_writeback(folio)) { + WARN_ONCE(1, "bad %x @%llx page %lx %lx\n", +- len, start, folio_index(folio), end); ++ len, start, folio->index, end); + continue; + } + +@@ -2652,7 +2652,7 @@ static void cifs_extend_writeback(struct address_space *mapping, + continue; + if (xa_is_value(folio)) + break; +- if (folio_index(folio) != index) ++ if (folio->index != index) + break; + if (!folio_try_get_rcu(folio)) { + xas_reset(&xas); +@@ -2900,7 +2900,7 @@ static int cifs_writepages_region(struct address_space *mapping, + goto skip_write; + } + +- if (folio_mapping(folio) != mapping || ++ if (folio->mapping != mapping || + !folio_test_dirty(folio)) { + start += folio_size(folio); + folio_unlock(folio); +-- +2.43.0 + diff --git a/queue-6.7/cifs-fix-writeback-data-corruption.patch b/queue-6.7/cifs-fix-writeback-data-corruption.patch new file mode 100644 index 00000000000..ed76c674165 --- /dev/null +++ b/queue-6.7/cifs-fix-writeback-data-corruption.patch @@ -0,0 +1,510 @@ +From ee92ea252904fed8c4b333250241d30dffbfff3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 11:20:26 +0000 +Subject: cifs: Fix writeback data corruption + +From: David Howells + +[ Upstream commit f3dc1bdb6b0b0693562c7c54a6c28bafa608ba3c ] + +cifs writeback doesn't correctly handle the case where +cifs_extend_writeback() hits a point where it is considering an additional +folio, but this would overrun the wsize - at which point it drops out of +the xarray scanning loop and calls xas_pause(). The problem is that +xas_pause() advances the loop counter - thereby skipping that page. + +What needs to happen is for xas_reset() to be called any time we decide we +don't want to process the page we're looking at, but rather send the +request we are building and start a new one. + +Fix this by copying and adapting the netfslib writepages code as a +temporary measure, with cifs writeback intending to be offloaded to +netfslib in the near future. + +This also fixes the issue with the use of filemap_get_folios_tag() causing +retry of a bunch of pages which the extender already dealt with. + +This can be tested by creating, say, a 64K file somewhere not on cifs +(otherwise copy-offload may get underfoot), mounting a cifs share with a +wsize of 64000, copying the file to it and then comparing the original file +and the copy: + + dd if=/dev/urandom of=/tmp/64K bs=64k count=1 + mount //192.168.6.1/test /mnt -o user=...,pass=...,wsize=64000 + cp /tmp/64K /mnt/64K + cmp /tmp/64K /mnt/64K + +Without the fix, the cmp fails at position 64000 (or shortly thereafter). + +Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") +Signed-off-by: David Howells +cc: Steve French +cc: Paulo Alcantara +cc: Ronnie Sahlberg +cc: Shyam Prasad N +cc: Tom Talpey +cc: Jeff Layton +cc: linux-cifs@vger.kernel.org +cc: samba-technical@lists.samba.org +cc: netfs@lists.linux.dev +cc: linux-fsdevel@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/file.c | 283 ++++++++++++++++++++++++------------------- + 1 file changed, 157 insertions(+), 126 deletions(-) + +diff --git a/fs/smb/client/file.c b/fs/smb/client/file.c +index 7320272ef0074..c156460eb5587 100644 +--- a/fs/smb/client/file.c ++++ b/fs/smb/client/file.c +@@ -2622,20 +2622,20 @@ static int cifs_partialpagewrite(struct page *page, unsigned from, unsigned to) + * dirty pages if possible, but don't sleep while doing so. + */ + static void cifs_extend_writeback(struct address_space *mapping, ++ struct xa_state *xas, + long *_count, + loff_t start, + int max_pages, +- size_t max_len, +- unsigned int *_len) ++ loff_t max_len, ++ size_t *_len) + { + struct folio_batch batch; + struct folio *folio; +- unsigned int psize, nr_pages; +- size_t len = *_len; +- pgoff_t index = (start + len) / PAGE_SIZE; ++ unsigned int nr_pages; ++ pgoff_t index = (start + *_len) / PAGE_SIZE; ++ size_t len; + bool stop = true; + unsigned int i; +- XA_STATE(xas, &mapping->i_pages, index); + + folio_batch_init(&batch); + +@@ -2646,54 +2646,64 @@ static void cifs_extend_writeback(struct address_space *mapping, + */ + rcu_read_lock(); + +- xas_for_each(&xas, folio, ULONG_MAX) { ++ xas_for_each(xas, folio, ULONG_MAX) { + stop = true; +- if (xas_retry(&xas, folio)) ++ if (xas_retry(xas, folio)) + continue; + if (xa_is_value(folio)) + break; +- if (folio->index != index) ++ if (folio->index != index) { ++ xas_reset(xas); + break; ++ } ++ + if (!folio_try_get_rcu(folio)) { +- xas_reset(&xas); ++ xas_reset(xas); + continue; + } + nr_pages = folio_nr_pages(folio); +- if (nr_pages > max_pages) ++ if (nr_pages > max_pages) { ++ xas_reset(xas); + break; ++ } + + /* Has the page moved or been split? */ +- if (unlikely(folio != xas_reload(&xas))) { ++ if (unlikely(folio != xas_reload(xas))) { + folio_put(folio); ++ xas_reset(xas); + break; + } + + if (!folio_trylock(folio)) { + folio_put(folio); ++ xas_reset(xas); + break; + } +- if (!folio_test_dirty(folio) || folio_test_writeback(folio)) { ++ if (!folio_test_dirty(folio) || ++ folio_test_writeback(folio)) { + folio_unlock(folio); + folio_put(folio); ++ xas_reset(xas); + break; + } + + max_pages -= nr_pages; +- psize = folio_size(folio); +- len += psize; ++ len = folio_size(folio); + stop = false; +- if (max_pages <= 0 || len >= max_len || *_count <= 0) +- stop = true; + + index += nr_pages; ++ *_count -= nr_pages; ++ *_len += len; ++ if (max_pages <= 0 || *_len >= max_len || *_count <= 0) ++ stop = true; ++ + if (!folio_batch_add(&batch, folio)) + break; + if (stop) + break; + } + +- if (!stop) +- xas_pause(&xas); ++ xas_pause(xas); + rcu_read_unlock(); + + /* Now, if we obtained any pages, we can shift them to being +@@ -2710,16 +2720,12 @@ static void cifs_extend_writeback(struct address_space *mapping, + if (!folio_clear_dirty_for_io(folio)) + WARN_ON(1); + folio_start_writeback(folio); +- +- *_count -= folio_nr_pages(folio); + folio_unlock(folio); + } + + folio_batch_release(&batch); + cond_resched(); + } while (!stop); +- +- *_len = len; + } + + /* +@@ -2727,8 +2733,10 @@ static void cifs_extend_writeback(struct address_space *mapping, + */ + static ssize_t cifs_write_back_from_locked_folio(struct address_space *mapping, + struct writeback_control *wbc, ++ struct xa_state *xas, + struct folio *folio, +- loff_t start, loff_t end) ++ unsigned long long start, ++ unsigned long long end) + { + struct inode *inode = mapping->host; + struct TCP_Server_Info *server; +@@ -2737,17 +2745,18 @@ static ssize_t cifs_write_back_from_locked_folio(struct address_space *mapping, + struct cifs_credits credits_on_stack; + struct cifs_credits *credits = &credits_on_stack; + struct cifsFileInfo *cfile = NULL; +- unsigned int xid, wsize, len; +- loff_t i_size = i_size_read(inode); +- size_t max_len; ++ unsigned long long i_size = i_size_read(inode), max_len; ++ unsigned int xid, wsize; ++ size_t len = folio_size(folio); + long count = wbc->nr_to_write; + int rc; + + /* The folio should be locked, dirty and not undergoing writeback. */ ++ if (!folio_clear_dirty_for_io(folio)) ++ WARN_ON_ONCE(1); + folio_start_writeback(folio); + + count -= folio_nr_pages(folio); +- len = folio_size(folio); + + xid = get_xid(); + server = cifs_pick_channel(cifs_sb_master_tcon(cifs_sb)->ses); +@@ -2777,9 +2786,10 @@ static ssize_t cifs_write_back_from_locked_folio(struct address_space *mapping, + wdata->server = server; + cfile = NULL; + +- /* Find all consecutive lockable dirty pages, stopping when we find a +- * page that is not immediately lockable, is not dirty or is missing, +- * or we reach the end of the range. ++ /* Find all consecutive lockable dirty pages that have contiguous ++ * written regions, stopping when we find a page that is not ++ * immediately lockable, is not dirty or is missing, or we reach the ++ * end of the range. + */ + if (start < i_size) { + /* Trim the write to the EOF; the extra data is ignored. Also +@@ -2799,19 +2809,18 @@ static ssize_t cifs_write_back_from_locked_folio(struct address_space *mapping, + max_pages -= folio_nr_pages(folio); + + if (max_pages > 0) +- cifs_extend_writeback(mapping, &count, start, ++ cifs_extend_writeback(mapping, xas, &count, start, + max_pages, max_len, &len); + } +- len = min_t(loff_t, len, max_len); + } +- +- wdata->bytes = len; ++ len = min_t(unsigned long long, len, i_size - start); + + /* We now have a contiguous set of dirty pages, each with writeback + * set; the first page is still locked at this point, but all the rest + * have been unlocked. + */ + folio_unlock(folio); ++ wdata->bytes = len; + + if (start < i_size) { + iov_iter_xarray(&wdata->iter, ITER_SOURCE, &mapping->i_pages, +@@ -2862,102 +2871,118 @@ static ssize_t cifs_write_back_from_locked_folio(struct address_space *mapping, + /* + * write a region of pages back to the server + */ +-static int cifs_writepages_region(struct address_space *mapping, +- struct writeback_control *wbc, +- loff_t start, loff_t end, loff_t *_next) ++static ssize_t cifs_writepages_begin(struct address_space *mapping, ++ struct writeback_control *wbc, ++ struct xa_state *xas, ++ unsigned long long *_start, ++ unsigned long long end) + { +- struct folio_batch fbatch; ++ struct folio *folio; ++ unsigned long long start = *_start; ++ ssize_t ret; + int skips = 0; + +- folio_batch_init(&fbatch); +- do { +- int nr; +- pgoff_t index = start / PAGE_SIZE; ++search_again: ++ /* Find the first dirty page. */ ++ rcu_read_lock(); + +- nr = filemap_get_folios_tag(mapping, &index, end / PAGE_SIZE, +- PAGECACHE_TAG_DIRTY, &fbatch); +- if (!nr) ++ for (;;) { ++ folio = xas_find_marked(xas, end / PAGE_SIZE, PAGECACHE_TAG_DIRTY); ++ if (xas_retry(xas, folio) || xa_is_value(folio)) ++ continue; ++ if (!folio) + break; + +- for (int i = 0; i < nr; i++) { +- ssize_t ret; +- struct folio *folio = fbatch.folios[i]; ++ if (!folio_try_get_rcu(folio)) { ++ xas_reset(xas); ++ continue; ++ } + +-redo_folio: +- start = folio_pos(folio); /* May regress with THPs */ ++ if (unlikely(folio != xas_reload(xas))) { ++ folio_put(folio); ++ xas_reset(xas); ++ continue; ++ } + +- /* At this point we hold neither the i_pages lock nor the +- * page lock: the page may be truncated or invalidated +- * (changing page->mapping to NULL), or even swizzled +- * back from swapper_space to tmpfs file mapping +- */ +- if (wbc->sync_mode != WB_SYNC_NONE) { +- ret = folio_lock_killable(folio); +- if (ret < 0) +- goto write_error; +- } else { +- if (!folio_trylock(folio)) +- goto skip_write; +- } ++ xas_pause(xas); ++ break; ++ } ++ rcu_read_unlock(); ++ if (!folio) ++ return 0; + +- if (folio->mapping != mapping || +- !folio_test_dirty(folio)) { +- start += folio_size(folio); +- folio_unlock(folio); +- continue; +- } ++ start = folio_pos(folio); /* May regress with THPs */ + +- if (folio_test_writeback(folio) || +- folio_test_fscache(folio)) { +- folio_unlock(folio); +- if (wbc->sync_mode == WB_SYNC_NONE) +- goto skip_write; ++ /* At this point we hold neither the i_pages lock nor the page lock: ++ * the page may be truncated or invalidated (changing page->mapping to ++ * NULL), or even swizzled back from swapper_space to tmpfs file ++ * mapping ++ */ ++lock_again: ++ if (wbc->sync_mode != WB_SYNC_NONE) { ++ ret = folio_lock_killable(folio); ++ if (ret < 0) ++ return ret; ++ } else { ++ if (!folio_trylock(folio)) ++ goto search_again; ++ } + +- folio_wait_writeback(folio); ++ if (folio->mapping != mapping || ++ !folio_test_dirty(folio)) { ++ start += folio_size(folio); ++ folio_unlock(folio); ++ goto search_again; ++ } ++ ++ if (folio_test_writeback(folio) || ++ folio_test_fscache(folio)) { ++ folio_unlock(folio); ++ if (wbc->sync_mode != WB_SYNC_NONE) { ++ folio_wait_writeback(folio); + #ifdef CONFIG_CIFS_FSCACHE +- folio_wait_fscache(folio); ++ folio_wait_fscache(folio); + #endif +- goto redo_folio; +- } +- +- if (!folio_clear_dirty_for_io(folio)) +- /* We hold the page lock - it should've been dirty. */ +- WARN_ON(1); +- +- ret = cifs_write_back_from_locked_folio(mapping, wbc, folio, start, end); +- if (ret < 0) +- goto write_error; +- +- start += ret; +- continue; +- +-write_error: +- folio_batch_release(&fbatch); +- *_next = start; +- return ret; ++ goto lock_again; ++ } + +-skip_write: +- /* +- * Too many skipped writes, or need to reschedule? +- * Treat it as a write error without an error code. +- */ ++ start += folio_size(folio); ++ if (wbc->sync_mode == WB_SYNC_NONE) { + if (skips >= 5 || need_resched()) { + ret = 0; +- goto write_error; ++ goto out; + } +- +- /* Otherwise, just skip that folio and go on to the next */ + skips++; +- start += folio_size(folio); +- continue; + } ++ goto search_again; ++ } + +- folio_batch_release(&fbatch); +- cond_resched(); +- } while (wbc->nr_to_write > 0); ++ ret = cifs_write_back_from_locked_folio(mapping, wbc, xas, folio, start, end); ++out: ++ if (ret > 0) ++ *_start = start + ret; ++ return ret; ++} + +- *_next = start; +- return 0; ++/* ++ * Write a region of pages back to the server ++ */ ++static int cifs_writepages_region(struct address_space *mapping, ++ struct writeback_control *wbc, ++ unsigned long long *_start, ++ unsigned long long end) ++{ ++ ssize_t ret; ++ ++ XA_STATE(xas, &mapping->i_pages, *_start / PAGE_SIZE); ++ ++ do { ++ ret = cifs_writepages_begin(mapping, wbc, &xas, _start, end); ++ if (ret > 0 && wbc->nr_to_write > 0) ++ cond_resched(); ++ } while (ret > 0 && wbc->nr_to_write > 0); ++ ++ return ret > 0 ? 0 : ret; + } + + /* +@@ -2966,7 +2991,7 @@ static int cifs_writepages_region(struct address_space *mapping, + static int cifs_writepages(struct address_space *mapping, + struct writeback_control *wbc) + { +- loff_t start, next; ++ loff_t start, end; + int ret; + + /* We have to be careful as we can end up racing with setattr() +@@ -2974,28 +2999,34 @@ static int cifs_writepages(struct address_space *mapping, + * to prevent it. + */ + +- if (wbc->range_cyclic) { ++ if (wbc->range_cyclic && mapping->writeback_index) { + start = mapping->writeback_index * PAGE_SIZE; +- ret = cifs_writepages_region(mapping, wbc, start, LLONG_MAX, &next); +- if (ret == 0) { +- mapping->writeback_index = next / PAGE_SIZE; +- if (start > 0 && wbc->nr_to_write > 0) { +- ret = cifs_writepages_region(mapping, wbc, 0, +- start, &next); +- if (ret == 0) +- mapping->writeback_index = +- next / PAGE_SIZE; +- } ++ ret = cifs_writepages_region(mapping, wbc, &start, LLONG_MAX); ++ if (ret < 0) ++ goto out; ++ ++ if (wbc->nr_to_write <= 0) { ++ mapping->writeback_index = start / PAGE_SIZE; ++ goto out; + } ++ ++ start = 0; ++ end = mapping->writeback_index * PAGE_SIZE; ++ mapping->writeback_index = 0; ++ ret = cifs_writepages_region(mapping, wbc, &start, end); ++ if (ret == 0) ++ mapping->writeback_index = start / PAGE_SIZE; + } else if (wbc->range_start == 0 && wbc->range_end == LLONG_MAX) { +- ret = cifs_writepages_region(mapping, wbc, 0, LLONG_MAX, &next); ++ start = 0; ++ ret = cifs_writepages_region(mapping, wbc, &start, LLONG_MAX); + if (wbc->nr_to_write > 0 && ret == 0) +- mapping->writeback_index = next / PAGE_SIZE; ++ mapping->writeback_index = start / PAGE_SIZE; + } else { +- ret = cifs_writepages_region(mapping, wbc, +- wbc->range_start, wbc->range_end, &next); ++ start = wbc->range_start; ++ ret = cifs_writepages_region(mapping, wbc, &start, wbc->range_end); + } + ++out: + return ret; + } + +-- +2.43.0 + diff --git a/queue-6.7/clk-fix-clk_core_get-null-dereference.patch b/queue-6.7/clk-fix-clk_core_get-null-dereference.patch new file mode 100644 index 00000000000..70b2efd1962 --- /dev/null +++ b/queue-6.7/clk-fix-clk_core_get-null-dereference.patch @@ -0,0 +1,56 @@ +From e335d719792eb6ef95a0542a9802c94d307047c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Mar 2024 00:52:14 +0000 +Subject: clk: Fix clk_core_get NULL dereference + +From: Bryan O'Donoghue + +[ Upstream commit e97fe4901e0f59a0bfd524578fe3768f8ca42428 ] + +It is possible for clk_core_get to dereference a NULL in the following +sequence: + +clk_core_get() + of_clk_get_hw_from_clkspec() + __of_clk_get_hw_from_provider() + __clk_get_hw() + +__clk_get_hw() can return NULL which is dereferenced by clk_core_get() at +hw->core. + +Prior to commit dde4eff47c82 ("clk: Look for parents with clkdev based +clk_lookups") the check IS_ERR_OR_NULL() was performed which would have +caught the NULL. + +Reading the description of this function it talks about returning NULL but +that cannot be so at the moment. + +Update the function to check for hw before dereferencing it and return NULL +if hw is NULL. + +Fixes: dde4eff47c82 ("clk: Look for parents with clkdev based clk_lookups") +Signed-off-by: Bryan O'Donoghue +Link: https://lore.kernel.org/r/20240302-linux-next-24-03-01-simple-clock-fixes-v1-1-25f348a5982b@linaro.org +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index 2253c154a8248..20c4b28fed061 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -418,6 +418,9 @@ static struct clk_core *clk_core_get(struct clk_core *core, u8 p_index) + if (IS_ERR(hw)) + return ERR_CAST(hw); + ++ if (!hw) ++ return NULL; ++ + return hw->core; + } + +-- +2.43.0 + diff --git a/queue-6.7/clk-hisilicon-hi3519-release-the-correct-number-of-g.patch b/queue-6.7/clk-hisilicon-hi3519-release-the-correct-number-of-g.patch new file mode 100644 index 00000000000..348cae3f8aa --- /dev/null +++ b/queue-6.7/clk-hisilicon-hi3519-release-the-correct-number-of-g.patch @@ -0,0 +1,39 @@ +From a2deda80aef2a76398e5343718978ad9f5230cdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jan 2024 19:58:21 +0100 +Subject: clk: hisilicon: hi3519: Release the correct number of gates in + hi3519_clk_unregister() + +From: Christophe JAILLET + +[ Upstream commit 74e39f526d95c0c119ada1874871ee328c59fbee ] + +The gates are stored in 'hi3519_gate_clks', not 'hi3519_mux_clks'. +This is also in line with how hisi_clk_register_gate() is called in the +probe. + +Fixes: 224b3b262c52 ("clk: hisilicon: hi3519: add driver remove path and fix some issues") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/c3f1877c9a0886fa35c949c8f0ef25547f284f18.1704912510.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/hisilicon/clk-hi3519.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/hisilicon/clk-hi3519.c b/drivers/clk/hisilicon/clk-hi3519.c +index b871872d9960d..141b727ff60d6 100644 +--- a/drivers/clk/hisilicon/clk-hi3519.c ++++ b/drivers/clk/hisilicon/clk-hi3519.c +@@ -130,7 +130,7 @@ static void hi3519_clk_unregister(struct platform_device *pdev) + of_clk_del_provider(pdev->dev.of_node); + + hisi_clk_unregister_gate(hi3519_gate_clks, +- ARRAY_SIZE(hi3519_mux_clks), ++ ARRAY_SIZE(hi3519_gate_clks), + crg->clk_data); + hisi_clk_unregister_mux(hi3519_mux_clks, + ARRAY_SIZE(hi3519_mux_clks), +-- +2.43.0 + diff --git a/queue-6.7/clk-hisilicon-hi3559a-fix-an-erroneous-devm_kfree.patch b/queue-6.7/clk-hisilicon-hi3559a-fix-an-erroneous-devm_kfree.patch new file mode 100644 index 00000000000..dd63cab3d8b --- /dev/null +++ b/queue-6.7/clk-hisilicon-hi3559a-fix-an-erroneous-devm_kfree.patch @@ -0,0 +1,42 @@ +From c2c8bfa2e941ce1f7611ed138b702c427ae3f8ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Jan 2024 16:16:24 +0100 +Subject: clk: hisilicon: hi3559a: Fix an erroneous devm_kfree() + +From: Christophe JAILLET + +[ Upstream commit 64c6a38136b74a2f18c42199830975edd9fbc379 ] + +'p_clk' is an array allocated just before the for loop for all clk that +need to be registered. +It is incremented at each loop iteration. + +If a clk_register() call fails, 'p_clk' may point to something different +from what should be freed. + +The best we can do, is to avoid this wrong release of memory. + +Fixes: 6c81966107dc ("clk: hisilicon: Add clock driver for hi3559A SoC") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/773fc8425c3b8f5b0ca7c1d89f15b65831a85ca9.1705850155.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/hisilicon/clk-hi3559a.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/clk/hisilicon/clk-hi3559a.c b/drivers/clk/hisilicon/clk-hi3559a.c +index ff4ca0edce06a..4623befafaec4 100644 +--- a/drivers/clk/hisilicon/clk-hi3559a.c ++++ b/drivers/clk/hisilicon/clk-hi3559a.c +@@ -491,7 +491,6 @@ static void hisi_clk_register_pll(struct hi3559av100_pll_clock *clks, + + clk = clk_register(NULL, &p_clk->hw); + if (IS_ERR(clk)) { +- devm_kfree(dev, p_clk); + dev_err(dev, "%s: failed to register clock %s\n", + __func__, clks[i].name); + continue; +-- +2.43.0 + diff --git a/queue-6.7/clk-imx-imx8mp-fix-sai_mclk_sel-definition.patch b/queue-6.7/clk-imx-imx8mp-fix-sai_mclk_sel-definition.patch new file mode 100644 index 00000000000..3ee6b16ecca --- /dev/null +++ b/queue-6.7/clk-imx-imx8mp-fix-sai_mclk_sel-definition.patch @@ -0,0 +1,62 @@ +From a9317d705aa67825e75d8af29f275939c3ed03d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 18:15:51 +0800 +Subject: clk: imx: imx8mp: Fix SAI_MCLK_SEL definition + +From: Shengjiu Wang + +[ Upstream commit 13269dc6c70444528f0093585e3559cd2f38850a ] + +There is SAI1, SAI2, SAI3, SAI5, SAI6, SAI7 existing in this block +control, the order is discontinuous. The definition of SAI_MCLK_SEL(n) +is not match with the usage of CLK_SAIn(n). + +So define SAI##n##_MCLK_SEL separately to fix the issue. + +Fixes: 6cd95f7b151c ("clk: imx: imx8mp: Add audiomix block control") +Signed-off-by: Shengjiu Wang +Reviewed-by: Abel Vesa +Link: https://lore.kernel.org/r/1708683351-8504-1-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx8mp-audiomix.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/clk/imx/clk-imx8mp-audiomix.c b/drivers/clk/imx/clk-imx8mp-audiomix.c +index e4300df88f1ac..55ed211a5e0b1 100644 +--- a/drivers/clk/imx/clk-imx8mp-audiomix.c ++++ b/drivers/clk/imx/clk-imx8mp-audiomix.c +@@ -18,7 +18,12 @@ + + #define CLKEN0 0x000 + #define CLKEN1 0x004 +-#define SAI_MCLK_SEL(n) (0x300 + 4 * (n)) /* n in 0..5 */ ++#define SAI1_MCLK_SEL 0x300 ++#define SAI2_MCLK_SEL 0x304 ++#define SAI3_MCLK_SEL 0x308 ++#define SAI5_MCLK_SEL 0x30C ++#define SAI6_MCLK_SEL 0x310 ++#define SAI7_MCLK_SEL 0x314 + #define PDM_SEL 0x318 + #define SAI_PLL_GNRL_CTL 0x400 + +@@ -95,13 +100,13 @@ static const struct clk_parent_data clk_imx8mp_audiomix_pll_bypass_sels[] = { + IMX8MP_CLK_AUDIOMIX_SAI##n##_MCLK1_SEL, {}, \ + clk_imx8mp_audiomix_sai##n##_mclk1_parents, \ + ARRAY_SIZE(clk_imx8mp_audiomix_sai##n##_mclk1_parents), \ +- SAI_MCLK_SEL(n), 1, 0 \ ++ SAI##n##_MCLK_SEL, 1, 0 \ + }, { \ + "sai"__stringify(n)"_mclk2_sel", \ + IMX8MP_CLK_AUDIOMIX_SAI##n##_MCLK2_SEL, {}, \ + clk_imx8mp_audiomix_sai_mclk2_parents, \ + ARRAY_SIZE(clk_imx8mp_audiomix_sai_mclk2_parents), \ +- SAI_MCLK_SEL(n), 4, 1 \ ++ SAI##n##_MCLK_SEL, 4, 1 \ + }, { \ + "sai"__stringify(n)"_ipg_cg", \ + IMX8MP_CLK_AUDIOMIX_SAI##n##_IPG, \ +-- +2.43.0 + diff --git a/queue-6.7/clk-mediatek-mt7622-apmixedsys-fix-an-error-handling.patch b/queue-6.7/clk-mediatek-mt7622-apmixedsys-fix-an-error-handling.patch new file mode 100644 index 00000000000..31e103c7e14 --- /dev/null +++ b/queue-6.7/clk-mediatek-mt7622-apmixedsys-fix-an-error-handling.patch @@ -0,0 +1,41 @@ +From 8bb3110c9488a70cd9438d3f0aa95bc01fca4fe2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Jan 2024 09:29:28 +0100 +Subject: clk: mediatek: mt7622-apmixedsys: Fix an error handling path in + clk_mt8135_apmixed_probe() + +From: Christophe JAILLET + +[ Upstream commit a32e88f2b20259f5fe4f8eed598bbc85dc4879ed ] + +'clk_data' is allocated with mtk_devm_alloc_clk_data(). So calling +mtk_free_clk_data() explicitly in the remove function would lead to a +double-free. + +Remove the redundant call. + +Fixes: c50e2ea6507b ("clk: mediatek: mt7622-apmixedsys: Add .remove() callback for module build") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/2c553c2a5077757e4f7af0bb895acc43881cf62c.1704616152.git.christophe.jaillet@wanadoo.fr +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mt7622-apmixedsys.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/clk/mediatek/clk-mt7622-apmixedsys.c b/drivers/clk/mediatek/clk-mt7622-apmixedsys.c +index 9cffd278e9a43..1b8f859b6b6cc 100644 +--- a/drivers/clk/mediatek/clk-mt7622-apmixedsys.c ++++ b/drivers/clk/mediatek/clk-mt7622-apmixedsys.c +@@ -127,7 +127,6 @@ static void clk_mt7622_apmixed_remove(struct platform_device *pdev) + of_clk_del_provider(node); + mtk_clk_unregister_gates(apmixed_clks, ARRAY_SIZE(apmixed_clks), clk_data); + mtk_clk_unregister_plls(plls, ARRAY_SIZE(plls), clk_data); +- mtk_free_clk_data(clk_data); + } + + static const struct of_device_id of_match_clk_mt7622_apmixed[] = { +-- +2.43.0 + diff --git a/queue-6.7/clk-mediatek-mt7981-topckgen-flag-sgm_reg_sel-as-cri.patch b/queue-6.7/clk-mediatek-mt7981-topckgen-flag-sgm_reg_sel-as-cri.patch new file mode 100644 index 00000000000..1a3f7a606eb --- /dev/null +++ b/queue-6.7/clk-mediatek-mt7981-topckgen-flag-sgm_reg_sel-as-cri.patch @@ -0,0 +1,44 @@ +From 26568b31712894bb407346335245b3bfa9ebf573 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Feb 2024 03:11:15 +0000 +Subject: clk: mediatek: mt7981-topckgen: flag SGM_REG_SEL as critical + +From: Daniel Golle + +[ Upstream commit aa690050c00a251ab69e3c5204d582833d0b958c ] + +Without the SGM_REG_SEL clock enabled the cpu freezes if trying to +access registers used by MT7981 clock drivers itself. +Mark SGM_REG_SEL as critical to make sure it is always enabled to +prevent freezes on boot even if the Ethernet driver which prepares +and enables the clock is not loaded or probed at a later point. + +Fixes: 813c3b53b55b ("clk: mediatek: add MT7981 clock support") +Signed-off-by: Daniel Golle +Link: https://lore.kernel.org/r/fc157139e6b7f8dfb6430ac7191ba754027705e8.1708221995.git.daniel@makrotopia.org +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mt7981-topckgen.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/mediatek/clk-mt7981-topckgen.c b/drivers/clk/mediatek/clk-mt7981-topckgen.c +index 682f4ca9e89ad..493aa11d3a175 100644 +--- a/drivers/clk/mediatek/clk-mt7981-topckgen.c ++++ b/drivers/clk/mediatek/clk-mt7981-topckgen.c +@@ -357,8 +357,9 @@ static const struct mtk_mux top_muxes[] = { + MUX_GATE_CLR_SET_UPD(CLK_TOP_SGM_325M_SEL, "sgm_325m_sel", + sgm_325m_parents, 0x050, 0x054, 0x058, 8, 1, 15, + 0x1C0, 21), +- MUX_GATE_CLR_SET_UPD(CLK_TOP_SGM_REG_SEL, "sgm_reg_sel", sgm_reg_parents, +- 0x050, 0x054, 0x058, 16, 1, 23, 0x1C0, 22), ++ MUX_GATE_CLR_SET_UPD_FLAGS(CLK_TOP_SGM_REG_SEL, "sgm_reg_sel", sgm_reg_parents, ++ 0x050, 0x054, 0x058, 16, 1, 23, 0x1C0, 22, ++ CLK_IS_CRITICAL | CLK_SET_RATE_PARENT), + MUX_GATE_CLR_SET_UPD(CLK_TOP_EIP97B_SEL, "eip97b_sel", eip97b_parents, + 0x050, 0x054, 0x058, 24, 3, 31, 0x1C0, 23), + /* CLK_CFG_6 */ +-- +2.43.0 + diff --git a/queue-6.7/clk-mediatek-mt8135-fix-an-error-handling-path-in-cl.patch b/queue-6.7/clk-mediatek-mt8135-fix-an-error-handling-path-in-cl.patch new file mode 100644 index 00000000000..7f569a8363e --- /dev/null +++ b/queue-6.7/clk-mediatek-mt8135-fix-an-error-handling-path-in-cl.patch @@ -0,0 +1,48 @@ +From 7c22862fb0dba4ddaefce162a9272ad8dda1b09d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Jan 2024 09:12:17 +0100 +Subject: clk: mediatek: mt8135: Fix an error handling path in + clk_mt8135_apmixed_probe() + +From: Christophe JAILLET + +[ Upstream commit 03c1c51eba6be49b42816af9db114553131af6c8 ] + +If an error occurs after mtk_alloc_clk_data(), mtk_free_clk_data() should +be called, as already done in the remove function. + +Fixes: 54b7026f011e ("clk: mediatek: mt8135-apmixedsys: Convert to platform_driver and module") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/6cd6af61e5a91598068227f1f68cfcfde1507453.1704615011.git.christophe.jaillet@wanadoo.fr +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mt8135-apmixedsys.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/mediatek/clk-mt8135-apmixedsys.c b/drivers/clk/mediatek/clk-mt8135-apmixedsys.c +index d1239b4b3db74..41bb2d2e2ea74 100644 +--- a/drivers/clk/mediatek/clk-mt8135-apmixedsys.c ++++ b/drivers/clk/mediatek/clk-mt8135-apmixedsys.c +@@ -59,7 +59,7 @@ static int clk_mt8135_apmixed_probe(struct platform_device *pdev) + + ret = mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data); + if (ret) +- return ret; ++ goto free_clk_data; + + ret = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (ret) +@@ -69,6 +69,8 @@ static int clk_mt8135_apmixed_probe(struct platform_device *pdev) + + unregister_plls: + mtk_clk_unregister_plls(plls, ARRAY_SIZE(plls), clk_data); ++free_clk_data: ++ mtk_free_clk_data(clk_data); + + return ret; + } +-- +2.43.0 + diff --git a/queue-6.7/clk-mediatek-mt8183-correct-parent-of-clk_infra_sspm.patch b/queue-6.7/clk-mediatek-mt8183-correct-parent-of-clk_infra_sspm.patch new file mode 100644 index 00000000000..4f37ffb4ecb --- /dev/null +++ b/queue-6.7/clk-mediatek-mt8183-correct-parent-of-clk_infra_sspm.patch @@ -0,0 +1,42 @@ +From 7943492e59dcba33173d0e822f99469a4a61fb6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 18:51:24 +0800 +Subject: clk: mediatek: mt8183: Correct parent of CLK_INFRA_SSPM_32K_SELF + +From: Chen-Yu Tsai + +[ Upstream commit a65083fa663a335008e34f65e184041174a9dc7e ] + +CLK_INFRA_SSPM_32K_SELF has the "f_f26m_ck" clock assigned as its parent. +This is inconsistent as the clock is part of a group that are all gates +without dividers, and this makes the kernel think it runs at 26 MHz. + +After clarification from MediaTek engineers, the correct parent is +actually the system 32 KHz clock. + +Fixes: 1eb8d61ac5c9 ("clk: mediatek: mt8183: Add back SSPM related clocks") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20240219105125.956278-1-wenst@chromium.org +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mt8183.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/mediatek/clk-mt8183.c b/drivers/clk/mediatek/clk-mt8183.c +index 6e23461a04559..934d5a15acfc5 100644 +--- a/drivers/clk/mediatek/clk-mt8183.c ++++ b/drivers/clk/mediatek/clk-mt8183.c +@@ -790,7 +790,7 @@ static const struct mtk_gate infra_clks[] = { + /* infra_sspm_26m_self is main clock in co-processor, should not be closed in Linux. */ + GATE_INFRA3_FLAGS(CLK_INFRA_SSPM_26M_SELF, "infra_sspm_26m_self", "f_f26m_ck", 3, CLK_IS_CRITICAL), + /* infra_sspm_32k_self is main clock in co-processor, should not be closed in Linux. */ +- GATE_INFRA3_FLAGS(CLK_INFRA_SSPM_32K_SELF, "infra_sspm_32k_self", "f_f26m_ck", 4, CLK_IS_CRITICAL), ++ GATE_INFRA3_FLAGS(CLK_INFRA_SSPM_32K_SELF, "infra_sspm_32k_self", "clk32k", 4, CLK_IS_CRITICAL), + GATE_INFRA3(CLK_INFRA_UFS_AXI, "infra_ufs_axi", "axi_sel", 5), + GATE_INFRA3(CLK_INFRA_I2C6, "infra_i2c6", "i2c_sel", 6), + GATE_INFRA3(CLK_INFRA_AP_MSDC0, "infra_ap_msdc0", "msdc50_hclk_sel", 7), +-- +2.43.0 + diff --git a/queue-6.7/clk-meson-add-missing-clocks-to-axg_clk_regmaps.patch b/queue-6.7/clk-meson-add-missing-clocks-to-axg_clk_regmaps.patch new file mode 100644 index 00000000000..1b682b6492f --- /dev/null +++ b/queue-6.7/clk-meson-add-missing-clocks-to-axg_clk_regmaps.patch @@ -0,0 +1,83 @@ +From bd276cb6c98f91527d8464952789b59e8cda564e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 17:25:48 +0300 +Subject: clk: meson: Add missing clocks to axg_clk_regmaps + +From: Igor Prusov + +[ Upstream commit ba535bce57e71463a86f8b33a0ea88c26e3a6418 ] + +Some clocks were missing from axg_clk_regmaps, which caused kernel panic +during cat /sys/kernel/debug/clk/clk_summary + +[ 57.349402] Unable to handle kernel NULL pointer dereference at virtual address 00000000000001fc +... +[ 57.430002] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 57.436900] pc : regmap_read+0x1c/0x88 +[ 57.440608] lr : clk_regmap_gate_is_enabled+0x3c/0xb0 +[ 57.445611] sp : ffff800082f1b690 +[ 57.448888] x29: ffff800082f1b690 x28: 0000000000000000 x27: ffff800080eb9a70 +[ 57.455961] x26: 0000000000000007 x25: 0000000000000016 x24: 0000000000000000 +[ 57.463033] x23: ffff800080e8b488 x22: 0000000000000015 x21: ffff00000e7e7000 +[ 57.470106] x20: ffff00000400ec00 x19: 0000000000000000 x18: ffffffffffffffff +[ 57.477178] x17: 0000000000000000 x16: 0000000000000000 x15: ffff0000042a3000 +[ 57.484251] x14: 0000000000000000 x13: ffff0000042a2fec x12: 0000000005f5e100 +[ 57.491323] x11: abcc77118461cefd x10: 0000000000000020 x9 : ffff8000805e4b24 +[ 57.498396] x8 : ffff0000028063c0 x7 : ffff800082f1b710 x6 : ffff800082f1b710 +[ 57.505468] x5 : 00000000ffffffd0 x4 : ffff800082f1b6e0 x3 : 0000000000001000 +[ 57.512541] x2 : ffff800082f1b6e4 x1 : 000000000000012c x0 : 0000000000000000 +[ 57.519615] Call trace: +[ 57.522030] regmap_read+0x1c/0x88 +[ 57.525393] clk_regmap_gate_is_enabled+0x3c/0xb0 +[ 57.530050] clk_core_is_enabled+0x44/0x120 +[ 57.534190] clk_summary_show_subtree+0x154/0x2f0 +[ 57.538847] clk_summary_show_subtree+0x220/0x2f0 +[ 57.543505] clk_summary_show_subtree+0x220/0x2f0 +[ 57.548162] clk_summary_show_subtree+0x220/0x2f0 +[ 57.552820] clk_summary_show_subtree+0x220/0x2f0 +[ 57.557477] clk_summary_show_subtree+0x220/0x2f0 +[ 57.562135] clk_summary_show_subtree+0x220/0x2f0 +[ 57.566792] clk_summary_show_subtree+0x220/0x2f0 +[ 57.571450] clk_summary_show+0x84/0xb8 +[ 57.575245] seq_read_iter+0x1bc/0x4b8 +[ 57.578954] seq_read+0x8c/0xd0 +[ 57.582059] full_proxy_read+0x68/0xc8 +[ 57.585767] vfs_read+0xb0/0x268 +[ 57.588959] ksys_read+0x70/0x108 +[ 57.592236] __arm64_sys_read+0x24/0x38 +[ 57.596031] invoke_syscall+0x50/0x128 +[ 57.599740] el0_svc_common.constprop.0+0x48/0xf8 +[ 57.604397] do_el0_svc+0x28/0x40 +[ 57.607675] el0_svc+0x34/0xb8 +[ 57.610694] el0t_64_sync_handler+0x13c/0x158 +[ 57.615006] el0t_64_sync+0x190/0x198 +[ 57.618635] Code: a9bd7bfd 910003fd a90153f3 aa0003f3 (b941fc00) +[ 57.624668] ---[ end trace 0000000000000000 ]--- + +[jbrunet: add missing Fixes tag] +Signed-off-by: Igor Prusov +Link: https://lore.kernel.org/r/20240202172537.1.I64656c75d84284bc91e6126b50b33c502be7c42a@changeid +Fixes: 14ebb3154b8f ("clk: meson: axg: add Video Clocks") +Signed-off-by: Jerome Brunet +Signed-off-by: Sasha Levin +--- + drivers/clk/meson/axg.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/meson/axg.c b/drivers/clk/meson/axg.c +index c12f81dfa6745..5f60f2bcca592 100644 +--- a/drivers/clk/meson/axg.c ++++ b/drivers/clk/meson/axg.c +@@ -2142,7 +2142,9 @@ static struct clk_regmap *const axg_clk_regmaps[] = { + &axg_vclk_input, + &axg_vclk2_input, + &axg_vclk_div, ++ &axg_vclk_div1, + &axg_vclk2_div, ++ &axg_vclk2_div1, + &axg_vclk_div2_en, + &axg_vclk_div4_en, + &axg_vclk_div6_en, +-- +2.43.0 + diff --git a/queue-6.7/clk-qcom-dispcc-sdm845-adjust-internal-gdsc-wait-tim.patch b/queue-6.7/clk-qcom-dispcc-sdm845-adjust-internal-gdsc-wait-tim.patch new file mode 100644 index 00000000000..c9437e78eb3 --- /dev/null +++ b/queue-6.7/clk-qcom-dispcc-sdm845-adjust-internal-gdsc-wait-tim.patch @@ -0,0 +1,38 @@ +From 95c6ea8aab92d76a31c54add6d835205112eb8a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jan 2024 21:20:18 +0100 +Subject: clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times + +From: Konrad Dybcio + +[ Upstream commit 117e7dc697c2739d754db8fe0c1e2d4f1f5d5f82 ] + +SDM845 downstream uses non-default values for GDSC internal waits. +Program them accordingly to avoid surprises. + +Fixes: 81351776c9fb ("clk: qcom: Add display clock controller driver for SDM845") +Signed-off-by: Konrad Dybcio +Tested-by: Caleb Connolly # OnePlus 6 +Link: https://lore.kernel.org/r/20240103-topic-845gdsc-v1-1-368efbe1a61d@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/dispcc-sdm845.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/qcom/dispcc-sdm845.c b/drivers/clk/qcom/dispcc-sdm845.c +index 735adfefc3798..e792e0b130d33 100644 +--- a/drivers/clk/qcom/dispcc-sdm845.c ++++ b/drivers/clk/qcom/dispcc-sdm845.c +@@ -759,6 +759,8 @@ static struct clk_branch disp_cc_mdss_vsync_clk = { + + static struct gdsc mdss_gdsc = { + .gdscr = 0x3000, ++ .en_few_wait_val = 0x6, ++ .en_rest_wait_val = 0x5, + .pd = { + .name = "mdss_gdsc", + }, +-- +2.43.0 + diff --git a/queue-6.7/clk-qcom-gcc-ipq5018-fix-enable_reg-offset-of-gcc_gm.patch b/queue-6.7/clk-qcom-gcc-ipq5018-fix-enable_reg-offset-of-gcc_gm.patch new file mode 100644 index 00000000000..6504115d766 --- /dev/null +++ b/queue-6.7/clk-qcom-gcc-ipq5018-fix-enable_reg-offset-of-gcc_gm.patch @@ -0,0 +1,56 @@ +From 515267d5bdc03a88babe71379ecd67ca86cad445 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Feb 2024 18:32:54 +0100 +Subject: clk: qcom: gcc-ipq5018: fix 'enable_reg' offset of + 'gcc_gmac0_sys_clk' + +From: Gabor Juhos + +[ Upstream commit f982adcc1b1c02a3114f68ac73c811cbfabe90fa ] + +The value of the 'enable_reg' field in the 'gcc_gmac0_sys_clk' +clock definition seems wrong as it is greater than the +'max_register' value defined in the regmap configuration. +Additionally, all other gmac specific branch clock definitions +within the driver uses the same value both for the 'enable_reg' +and for the 'halt_reg' fields. + +Due to the lack of documentation the correct value is not known. +Looking into the downstream driver does not help either, as that +uses the same (presumably wrong) value [1]. + +Nevertheless, change the 'enable_reg' field of 'gcc_gmac0_sys_clk' +to use the value from the 'halt_reg' field so it follows the pattern +used in other gmac clock definitions. The change is based on the +assumption that the register layout of this clock is the same +as the other gmac clocks. + +1. https://git.codelinaro.org/clo/qsdk/oss/kernel/linux-ipq-5.4/-/blob/NHSS.QSDK.12.4.r4/drivers/clk/qcom/gcc-ipq5018.c?ref_type=heads#L1889 + +Fixes: e3fdbef1bab8 ("clk: qcom: Add Global Clock controller (GCC) driver for IPQ5018") +Signed-off-by: Gabor Juhos +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Kathiravan Thirumoorthy +Link: https://lore.kernel.org/r/20240225-gcc-ipq5018-register-fixes-v1-1-3c191404d9f0@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq5018.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/gcc-ipq5018.c b/drivers/clk/qcom/gcc-ipq5018.c +index 4aba47e8700d2..cef9a1e7c9fdb 100644 +--- a/drivers/clk/qcom/gcc-ipq5018.c ++++ b/drivers/clk/qcom/gcc-ipq5018.c +@@ -1754,7 +1754,7 @@ static struct clk_branch gcc_gmac0_sys_clk = { + .halt_check = BRANCH_HALT_DELAY, + .halt_bit = 31, + .clkr = { +- .enable_reg = 0x683190, ++ .enable_reg = 0x68190, + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data) { + .name = "gcc_gmac0_sys_clk", +-- +2.43.0 + diff --git a/queue-6.7/clk-qcom-gcc-ipq5018-fix-halt_reg-offset-of-gcc_pcie.patch b/queue-6.7/clk-qcom-gcc-ipq5018-fix-halt_reg-offset-of-gcc_pcie.patch new file mode 100644 index 00000000000..38bdd9ee2b1 --- /dev/null +++ b/queue-6.7/clk-qcom-gcc-ipq5018-fix-halt_reg-offset-of-gcc_pcie.patch @@ -0,0 +1,70 @@ +From ce658745179fff6cea35d780ade68475cfbed59a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Feb 2024 18:32:55 +0100 +Subject: clk: qcom: gcc-ipq5018: fix 'halt_reg' offset of 'gcc_pcie1_pipe_clk' + +From: Gabor Juhos + +[ Upstream commit 11b752ac5a07cbfd95592fac5237a02f45662926 ] + +The following table shows the values of the 'halt_reg' and the +'enable_reg' fields from the pcie clocks defined in the current +driver: + + clock halt_reg enable_reg + + gcc_pcie0_ahb_clk 0x75010 0x75010 + gcc_pcie0_aux_clk 0x75014 0x75014 + gcc_pcie0_axi_m_clk 0x75008 0x75008 + gcc_pcie0_axi_s_bridge_clk 0x75048 0x75048 + gcc_pcie0_axi_s_clk 0x7500c 0x7500c + gcc_pcie0_pipe_clk 0x75018 0x75018 + + gcc_pcie1_ahb_clk 0x76010 0x76010 + gcc_pcie1_aux_clk 0x76014 0x76014 + gcc_pcie1_axi_m_clk 0x76008 0x76008 + gcc_pcie1_axi_s_bridge_clk 0x76048 0x76048 + gcc_pcie1_axi_s_clk 0x7600c 0x7600c + gcc_pcie1_pipe_clk 8* 0x76018 + +Based on the table, it is quite likely that the pcie0 and the pci1 +clocks are using the same register layout, however it seems that +the value of the 'halt_reg' field in the 'gcc_pcie1_pipe_clk' clock +is wrong. + +In the downstream driver [1], the same '0x76018' value is used for +both the 'halt_reg' and for the 'enable_reg' fields of the +'gcc_pcie1_pipe_clk' clock. + +Update the current driver to use the same value used downstream as +probably that is the correct value. + +1. https://git.codelinaro.org/clo/qsdk/oss/kernel/linux-ipq-5.4/-/blob/NHSS.QSDK.12.4.r4/drivers/clk/qcom/gcc-ipq5018.c?ref_type=heads#L2316 + +Fixes: e3fdbef1bab8 ("clk: qcom: Add Global Clock controller (GCC) driver for IPQ5018") +Signed-off-by: Gabor Juhos +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Kathiravan Thirumoorthy +Link: https://lore.kernel.org/r/20240225-gcc-ipq5018-register-fixes-v1-2-3c191404d9f0@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq5018.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/gcc-ipq5018.c b/drivers/clk/qcom/gcc-ipq5018.c +index cef9a1e7c9fdb..5e81cfa77293a 100644 +--- a/drivers/clk/qcom/gcc-ipq5018.c ++++ b/drivers/clk/qcom/gcc-ipq5018.c +@@ -2180,7 +2180,7 @@ static struct clk_branch gcc_pcie1_axi_s_clk = { + }; + + static struct clk_branch gcc_pcie1_pipe_clk = { +- .halt_reg = 8, ++ .halt_reg = 0x76018, + .halt_check = BRANCH_HALT_DELAY, + .halt_bit = 31, + .clkr = { +-- +2.43.0 + diff --git a/queue-6.7/clk-qcom-gcc-ipq5018-fix-register-offset-for-gcc_ubi.patch b/queue-6.7/clk-qcom-gcc-ipq5018-fix-register-offset-for-gcc_ubi.patch new file mode 100644 index 00000000000..78af347fb11 --- /dev/null +++ b/queue-6.7/clk-qcom-gcc-ipq5018-fix-register-offset-for-gcc_ubi.patch @@ -0,0 +1,47 @@ +From 41318dd39918d25d01e36d72689526c2c2dab63d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Feb 2024 18:32:56 +0100 +Subject: clk: qcom: gcc-ipq5018: fix register offset for GCC_UBI0_AXI_ARES + reset + +From: Gabor Juhos + +[ Upstream commit 7d474b43087aa356d714d39870c90d77fc6f1186 ] + +The current register offset used for the GCC_UBI0_AXI_ARES reset +seems wrong. Or at least, the downstream driver uses [1] the same +offset which is used for other the GCC_UBI0_*_ARES resets. + +Change the code to use the same offset used in the downstream +driver and also specify the reset bit explicitly to use the +same format as the followup entries. + +1. https://git.codelinaro.org/clo/qsdk/oss/kernel/linux-ipq-5.4/-/blob/NHSS.QSDK.12.4.r4/drivers/clk/qcom/gcc-ipq5018.c?ref_type=heads#L3773 + +Fixes: e3fdbef1bab8 ("clk: qcom: Add Global Clock controller (GCC) driver for IPQ5018") +Signed-off-by: Gabor Juhos +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Kathiravan Thirumoorthy +Link: https://lore.kernel.org/r/20240225-gcc-ipq5018-register-fixes-v1-3-3c191404d9f0@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq5018.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/gcc-ipq5018.c b/drivers/clk/qcom/gcc-ipq5018.c +index 5e81cfa77293a..e2bd54826a4ce 100644 +--- a/drivers/clk/qcom/gcc-ipq5018.c ++++ b/drivers/clk/qcom/gcc-ipq5018.c +@@ -3632,7 +3632,7 @@ static const struct qcom_reset_map gcc_ipq5018_resets[] = { + [GCC_SYSTEM_NOC_BCR] = { 0x26000, 0 }, + [GCC_TCSR_BCR] = { 0x28000, 0 }, + [GCC_TLMM_BCR] = { 0x34000, 0 }, +- [GCC_UBI0_AXI_ARES] = { 0x680}, ++ [GCC_UBI0_AXI_ARES] = { 0x68010, 0 }, + [GCC_UBI0_AHB_ARES] = { 0x68010, 1 }, + [GCC_UBI0_NC_AXI_ARES] = { 0x68010, 2 }, + [GCC_UBI0_DBG_ARES] = { 0x68010, 3 }, +-- +2.43.0 + diff --git a/queue-6.7/clk-qcom-gcc-sc8180x-add-missing-ufs-qref-clocks.patch b/queue-6.7/clk-qcom-gcc-sc8180x-add-missing-ufs-qref-clocks.patch new file mode 100644 index 00000000000..834ec8b59b2 --- /dev/null +++ b/queue-6.7/clk-qcom-gcc-sc8180x-add-missing-ufs-qref-clocks.patch @@ -0,0 +1,84 @@ +From ecbaf6397de4dd0dfdc834621a407cf0d8d990b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 12:37:27 +0530 +Subject: clk: qcom: gcc-sc8180x: Add missing UFS QREF clocks + +From: Manivannan Sadhasivam + +[ Upstream commit bb5c0229285fb12a5f433b2b8c5fd0ec2e4795e2 ] + +Add missing QREF clocks for UFS MEM and UFS CARD controllers. + +Fixes: 4433594bbe5d ("clk: qcom: gcc: Add global clock controller driver for SC8180x") +Acked-by: Konrad Dybcio +Signed-off-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-4-58a49d2f4605@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sc8180x.c | 28 ++++++++++++++++++++++++++++ + 1 file changed, 28 insertions(+) + +diff --git a/drivers/clk/qcom/gcc-sc8180x.c b/drivers/clk/qcom/gcc-sc8180x.c +index ae21473815596..544567db45f1f 100644 +--- a/drivers/clk/qcom/gcc-sc8180x.c ++++ b/drivers/clk/qcom/gcc-sc8180x.c +@@ -3347,6 +3347,19 @@ static struct clk_branch gcc_ufs_card_2_unipro_core_clk = { + }, + }; + ++static struct clk_branch gcc_ufs_card_clkref_en = { ++ .halt_reg = 0x8c004, ++ .halt_check = BRANCH_HALT, ++ .clkr = { ++ .enable_reg = 0x8c004, ++ .enable_mask = BIT(0), ++ .hw.init = &(const struct clk_init_data) { ++ .name = "gcc_ufs_card_clkref_en", ++ .ops = &clk_branch2_ops, ++ }, ++ }, ++}; ++ + static struct clk_branch gcc_ufs_card_ahb_clk = { + .halt_reg = 0x75014, + .halt_check = BRANCH_HALT, +@@ -3561,6 +3574,19 @@ static struct clk_branch gcc_ufs_card_unipro_core_hw_ctl_clk = { + }, + }; + ++static struct clk_branch gcc_ufs_mem_clkref_en = { ++ .halt_reg = 0x8c000, ++ .halt_check = BRANCH_HALT, ++ .clkr = { ++ .enable_reg = 0x8c000, ++ .enable_mask = BIT(0), ++ .hw.init = &(const struct clk_init_data) { ++ .name = "gcc_ufs_mem_clkref_en", ++ .ops = &clk_branch2_ops, ++ }, ++ }, ++}; ++ + static struct clk_branch gcc_ufs_phy_ahb_clk = { + .halt_reg = 0x77014, + .halt_check = BRANCH_HALT, +@@ -4413,6 +4439,7 @@ static struct clk_regmap *gcc_sc8180x_clocks[] = { + [GCC_UFS_CARD_2_TX_SYMBOL_0_CLK] = &gcc_ufs_card_2_tx_symbol_0_clk.clkr, + [GCC_UFS_CARD_2_UNIPRO_CORE_CLK] = &gcc_ufs_card_2_unipro_core_clk.clkr, + [GCC_UFS_CARD_2_UNIPRO_CORE_CLK_SRC] = &gcc_ufs_card_2_unipro_core_clk_src.clkr, ++ [GCC_UFS_CARD_CLKREF_EN] = &gcc_ufs_card_clkref_en.clkr, + [GCC_UFS_CARD_AHB_CLK] = &gcc_ufs_card_ahb_clk.clkr, + [GCC_UFS_CARD_AXI_CLK] = &gcc_ufs_card_axi_clk.clkr, + [GCC_UFS_CARD_AXI_CLK_SRC] = &gcc_ufs_card_axi_clk_src.clkr, +@@ -4429,6 +4456,7 @@ static struct clk_regmap *gcc_sc8180x_clocks[] = { + [GCC_UFS_CARD_UNIPRO_CORE_CLK] = &gcc_ufs_card_unipro_core_clk.clkr, + [GCC_UFS_CARD_UNIPRO_CORE_CLK_SRC] = &gcc_ufs_card_unipro_core_clk_src.clkr, + [GCC_UFS_CARD_UNIPRO_CORE_HW_CTL_CLK] = &gcc_ufs_card_unipro_core_hw_ctl_clk.clkr, ++ [GCC_UFS_MEM_CLKREF_EN] = &gcc_ufs_mem_clkref_en.clkr, + [GCC_UFS_PHY_AHB_CLK] = &gcc_ufs_phy_ahb_clk.clkr, + [GCC_UFS_PHY_AXI_CLK] = &gcc_ufs_phy_axi_clk.clkr, + [GCC_UFS_PHY_AXI_CLK_SRC] = &gcc_ufs_phy_axi_clk_src.clkr, +-- +2.43.0 + diff --git a/queue-6.7/clk-qcom-reset-commonize-the-de-assert-functions.patch b/queue-6.7/clk-qcom-reset-commonize-the-de-assert-functions.patch new file mode 100644 index 00000000000..e8c1343043d --- /dev/null +++ b/queue-6.7/clk-qcom-reset-commonize-the-de-assert-functions.patch @@ -0,0 +1,69 @@ +From 0af1cdcf9eae48abf0bbf9ddcc5083abfbcd7e79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Feb 2024 19:43:35 +0100 +Subject: clk: qcom: reset: Commonize the de/assert functions + +From: Konrad Dybcio + +[ Upstream commit eda40d9c583e95e0b6ac69d2950eec10f802e0e8 ] + +They do the same thing, except the last argument of the last function +call differs. Commonize them. + +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240105-topic-venus_reset-v2-2-c37eba13b5ce@linaro.org +Signed-off-by: Bjorn Andersson +Stable-dep-of: 2f8cf2c3f3e3 ("clk: qcom: reset: Ensure write completion on reset de/assertion") +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/reset.c | 22 +++++++++------------- + 1 file changed, 9 insertions(+), 13 deletions(-) + +diff --git a/drivers/clk/qcom/reset.c b/drivers/clk/qcom/reset.c +index e45e32804d2c7..20d1d35aaf229 100644 +--- a/drivers/clk/qcom/reset.c ++++ b/drivers/clk/qcom/reset.c +@@ -22,8 +22,8 @@ static int qcom_reset(struct reset_controller_dev *rcdev, unsigned long id) + return 0; + } + +-static int +-qcom_reset_assert(struct reset_controller_dev *rcdev, unsigned long id) ++static int qcom_reset_set_assert(struct reset_controller_dev *rcdev, ++ unsigned long id, bool assert) + { + struct qcom_reset_controller *rst; + const struct qcom_reset_map *map; +@@ -33,21 +33,17 @@ qcom_reset_assert(struct reset_controller_dev *rcdev, unsigned long id) + map = &rst->reset_map[id]; + mask = map->bitmask ? map->bitmask : BIT(map->bit); + +- return regmap_update_bits(rst->regmap, map->reg, mask, mask); ++ return regmap_update_bits(rst->regmap, map->reg, mask, assert ? mask : 0); + } + +-static int +-qcom_reset_deassert(struct reset_controller_dev *rcdev, unsigned long id) ++static int qcom_reset_assert(struct reset_controller_dev *rcdev, unsigned long id) + { +- struct qcom_reset_controller *rst; +- const struct qcom_reset_map *map; +- u32 mask; +- +- rst = to_qcom_reset_controller(rcdev); +- map = &rst->reset_map[id]; +- mask = map->bitmask ? map->bitmask : BIT(map->bit); ++ return qcom_reset_set_assert(rcdev, id, true); ++} + +- return regmap_update_bits(rst->regmap, map->reg, mask, 0); ++static int qcom_reset_deassert(struct reset_controller_dev *rcdev, unsigned long id) ++{ ++ return qcom_reset_set_assert(rcdev, id, false); + } + + const struct reset_control_ops qcom_reset_ops = { +-- +2.43.0 + diff --git a/queue-6.7/clk-qcom-reset-ensure-write-completion-on-reset-de-a.patch b/queue-6.7/clk-qcom-reset-ensure-write-completion-on-reset-de-a.patch new file mode 100644 index 00000000000..2cea11272fc --- /dev/null +++ b/queue-6.7/clk-qcom-reset-ensure-write-completion-on-reset-de-a.patch @@ -0,0 +1,45 @@ +From 51dbb64e74297f1c879866bad316ad989321b56d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Feb 2024 19:43:36 +0100 +Subject: clk: qcom: reset: Ensure write completion on reset de/assertion + +From: Konrad Dybcio + +[ Upstream commit 2f8cf2c3f3e3f7ef61bd19abb4b0bb797ad50aaf ] + +Trying to toggle the resets in a rapid fashion can lead to the changes +not actually arriving at the clock controller block when we expect them +to. This was observed at least on SM8250. + +Read back the value after regmap_update_bits to ensure write completion. + +Fixes: b36ba30c8ac6 ("clk: qcom: Add reset controller support") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240105-topic-venus_reset-v2-3-c37eba13b5ce@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/reset.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/reset.c b/drivers/clk/qcom/reset.c +index 20d1d35aaf229..d96c96a9089f4 100644 +--- a/drivers/clk/qcom/reset.c ++++ b/drivers/clk/qcom/reset.c +@@ -33,7 +33,12 @@ static int qcom_reset_set_assert(struct reset_controller_dev *rcdev, + map = &rst->reset_map[id]; + mask = map->bitmask ? map->bitmask : BIT(map->bit); + +- return regmap_update_bits(rst->regmap, map->reg, mask, assert ? mask : 0); ++ regmap_update_bits(rst->regmap, map->reg, mask, assert ? mask : 0); ++ ++ /* Read back the register to ensure write completion, ignore the value */ ++ regmap_read(rst->regmap, map->reg, &mask); ++ ++ return 0; + } + + static int qcom_reset_assert(struct reset_controller_dev *rcdev, unsigned long id) +-- +2.43.0 + diff --git a/queue-6.7/clk-renesas-r8a779f0-correct-pfc-gpio-parent-clock.patch b/queue-6.7/clk-renesas-r8a779f0-correct-pfc-gpio-parent-clock.patch new file mode 100644 index 00000000000..c415dfd96a6 --- /dev/null +++ b/queue-6.7/clk-renesas-r8a779f0-correct-pfc-gpio-parent-clock.patch @@ -0,0 +1,43 @@ +From 0b8cb2fe39e638ee265a113a64c4e2c42e40ee31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jan 2024 16:45:13 +0100 +Subject: clk: renesas: r8a779f0: Correct PFC/GPIO parent clock +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit d1b32a83a02d9433dbd8c5f4d6fc44aa597755bd ] + +According to the R-Car S4 Series Hardware User’s Manual Rev.0.81, the +parent clock of the Pin Function (PFC/GPIO) module clock is the CP +clock. + +As this clock is not documented to exist on R-Car S4, use the CPEX clock +instead. + +Fixes: 73421f2a48e6bd1d ("clk: renesas: r8a779f0: Add PFC clock") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/f88ec4aede0eaf0107c8bb7b28ba719ac6cd418f.1706197415.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/clk/renesas/r8a779f0-cpg-mssr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/renesas/r8a779f0-cpg-mssr.c b/drivers/clk/renesas/r8a779f0-cpg-mssr.c +index f721835c7e212..cc06127406ab5 100644 +--- a/drivers/clk/renesas/r8a779f0-cpg-mssr.c ++++ b/drivers/clk/renesas/r8a779f0-cpg-mssr.c +@@ -161,7 +161,7 @@ static const struct mssr_mod_clk r8a779f0_mod_clks[] __initconst = { + DEF_MOD("cmt1", 911, R8A779F0_CLK_R), + DEF_MOD("cmt2", 912, R8A779F0_CLK_R), + DEF_MOD("cmt3", 913, R8A779F0_CLK_R), +- DEF_MOD("pfc0", 915, R8A779F0_CLK_CL16M), ++ DEF_MOD("pfc0", 915, R8A779F0_CLK_CPEX), + DEF_MOD("tsc", 919, R8A779F0_CLK_CL16M), + DEF_MOD("rswitch2", 1505, R8A779F0_CLK_RSW2), + DEF_MOD("ether-serdes", 1506, R8A779F0_CLK_S0D2_HSC), +-- +2.43.0 + diff --git a/queue-6.7/clk-renesas-r8a779g0-correct-pfc-gpio-parent-clocks.patch b/queue-6.7/clk-renesas-r8a779g0-correct-pfc-gpio-parent-clocks.patch new file mode 100644 index 00000000000..1548fd23f71 --- /dev/null +++ b/queue-6.7/clk-renesas-r8a779g0-correct-pfc-gpio-parent-clocks.patch @@ -0,0 +1,78 @@ +From a8e38dee84df61375ecd7be33d78c32ce3de059b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jan 2024 16:43:26 +0100 +Subject: clk: renesas: r8a779g0: Correct PFC/GPIO parent clocks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit abb3fa662b8f8eaed1590b0e7a4e19eda467cdd3 ] + +According to the R-Car V4H Series Hardware User’s Manual Rev.1.00, the +parent clock of the Pin Function (PFC/GPIO) module clocks is the CP +clock. + +Fix this by adding the missing CP clock, and correcting the PFC parents. + +Fixes: f2afa78d5a0c0b0b ("dt-bindings: clock: Add r8a779g0 CPG Core Clock Definitions") +Fixes: 36ff366033f0dde1 ("clk: renesas: r8a779g0: Add PFC/GPIO clocks") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/5401fccd204dc90b44f0013e7f53b9eff8df8214.1706197297.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/clk/renesas/r8a779g0-cpg-mssr.c | 11 ++++++----- + include/dt-bindings/clock/r8a779g0-cpg-mssr.h | 1 + + 2 files changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/clk/renesas/r8a779g0-cpg-mssr.c b/drivers/clk/renesas/r8a779g0-cpg-mssr.c +index 7cc580d673626..7999faa9a921b 100644 +--- a/drivers/clk/renesas/r8a779g0-cpg-mssr.c ++++ b/drivers/clk/renesas/r8a779g0-cpg-mssr.c +@@ -22,7 +22,7 @@ + + enum clk_ids { + /* Core Clock Outputs exported to DT */ +- LAST_DT_CORE_CLK = R8A779G0_CLK_R, ++ LAST_DT_CORE_CLK = R8A779G0_CLK_CP, + + /* External Input Clocks */ + CLK_EXTAL, +@@ -141,6 +141,7 @@ static const struct cpg_core_clk r8a779g0_core_clks[] __initconst = { + DEF_FIXED("svd2_vip", R8A779G0_CLK_SVD2_VIP, CLK_SV_VIP, 2, 1), + DEF_FIXED("cbfusa", R8A779G0_CLK_CBFUSA, CLK_EXTAL, 2, 1), + DEF_FIXED("cpex", R8A779G0_CLK_CPEX, CLK_EXTAL, 2, 1), ++ DEF_FIXED("cp", R8A779G0_CLK_CP, CLK_EXTAL, 2, 1), + DEF_FIXED("viobus", R8A779G0_CLK_VIOBUS, CLK_VIO, 1, 1), + DEF_FIXED("viobusd2", R8A779G0_CLK_VIOBUSD2, CLK_VIO, 2, 1), + DEF_FIXED("vcbus", R8A779G0_CLK_VCBUS, CLK_VC, 1, 1), +@@ -230,10 +231,10 @@ static const struct mssr_mod_clk r8a779g0_mod_clks[] __initconst = { + DEF_MOD("cmt1", 911, R8A779G0_CLK_R), + DEF_MOD("cmt2", 912, R8A779G0_CLK_R), + DEF_MOD("cmt3", 913, R8A779G0_CLK_R), +- DEF_MOD("pfc0", 915, R8A779G0_CLK_CL16M), +- DEF_MOD("pfc1", 916, R8A779G0_CLK_CL16M), +- DEF_MOD("pfc2", 917, R8A779G0_CLK_CL16M), +- DEF_MOD("pfc3", 918, R8A779G0_CLK_CL16M), ++ DEF_MOD("pfc0", 915, R8A779G0_CLK_CP), ++ DEF_MOD("pfc1", 916, R8A779G0_CLK_CP), ++ DEF_MOD("pfc2", 917, R8A779G0_CLK_CP), ++ DEF_MOD("pfc3", 918, R8A779G0_CLK_CP), + DEF_MOD("tsc", 919, R8A779G0_CLK_CL16M), + DEF_MOD("ssiu", 2926, R8A779G0_CLK_S0D6_PER), + DEF_MOD("ssi", 2927, R8A779G0_CLK_S0D6_PER), +diff --git a/include/dt-bindings/clock/r8a779g0-cpg-mssr.h b/include/dt-bindings/clock/r8a779g0-cpg-mssr.h +index 754c54a6eb06a..7850cdc62e285 100644 +--- a/include/dt-bindings/clock/r8a779g0-cpg-mssr.h ++++ b/include/dt-bindings/clock/r8a779g0-cpg-mssr.h +@@ -86,5 +86,6 @@ + #define R8A779G0_CLK_CPEX 74 + #define R8A779G0_CLK_CBFUSA 75 + #define R8A779G0_CLK_R 76 ++#define R8A779G0_CLK_CP 77 + + #endif /* __DT_BINDINGS_CLOCK_R8A779G0_CPG_MSSR_H__ */ +-- +2.43.0 + diff --git a/queue-6.7/clk-renesas-r9a07g04-34-use-sel_sdhi1_sts-status-con.patch b/queue-6.7/clk-renesas-r9a07g04-34-use-sel_sdhi1_sts-status-con.patch new file mode 100644 index 00000000000..1cc0bfe1232 --- /dev/null +++ b/queue-6.7/clk-renesas-r9a07g04-34-use-sel_sdhi1_sts-status-con.patch @@ -0,0 +1,53 @@ +From c6bfd5b34758d794637799c140889bb24f14ac2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 12:29:29 +0200 +Subject: clk: renesas: r9a07g04[34]: Use SEL_SDHI1_STS status configuration + for SD1 mux + +From: Claudiu Beznea + +[ Upstream commit 9b2a11c83859c06233049b134bd8ee974b284559 ] + +The status configuration for SD1 mux clock is SEL_SDHI1_STS. Fix it. + +Fixes: 16b86e5c03c5 ("clk: renesas: rzg2l: Refactor SD mux driver") +Reported-by: Hien Huynh +Signed-off-by: Claudiu Beznea +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20240131102930.1841901-2-claudiu.beznea.uj@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/clk/renesas/r9a07g043-cpg.c | 2 +- + drivers/clk/renesas/r9a07g044-cpg.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/renesas/r9a07g043-cpg.c b/drivers/clk/renesas/r9a07g043-cpg.c +index b70bb378ab469..075ade0925d45 100644 +--- a/drivers/clk/renesas/r9a07g043-cpg.c ++++ b/drivers/clk/renesas/r9a07g043-cpg.c +@@ -138,7 +138,7 @@ static const struct cpg_core_clk r9a07g043_core_clks[] __initconst = { + DEF_FIXED("SPI1", R9A07G043_CLK_SPI1, CLK_DIV_PLL3_C, 1, 4), + DEF_SD_MUX("SD0", R9A07G043_CLK_SD0, SEL_SDHI0, SEL_SDHI0_STS, sel_shdi, + mtable_sdhi, 0, rzg2l_cpg_sd_clk_mux_notifier), +- DEF_SD_MUX("SD1", R9A07G043_CLK_SD1, SEL_SDHI1, SEL_SDHI0_STS, sel_shdi, ++ DEF_SD_MUX("SD1", R9A07G043_CLK_SD1, SEL_SDHI1, SEL_SDHI1_STS, sel_shdi, + mtable_sdhi, 0, rzg2l_cpg_sd_clk_mux_notifier), + DEF_FIXED("SD0_DIV4", CLK_SD0_DIV4, R9A07G043_CLK_SD0, 1, 4), + DEF_FIXED("SD1_DIV4", CLK_SD1_DIV4, R9A07G043_CLK_SD1, 1, 4), +diff --git a/drivers/clk/renesas/r9a07g044-cpg.c b/drivers/clk/renesas/r9a07g044-cpg.c +index 1047278c9079a..bc822b9fd7ce6 100644 +--- a/drivers/clk/renesas/r9a07g044-cpg.c ++++ b/drivers/clk/renesas/r9a07g044-cpg.c +@@ -178,7 +178,7 @@ static const struct { + DEF_FIXED("SPI1", R9A07G044_CLK_SPI1, CLK_DIV_PLL3_C, 1, 4), + DEF_SD_MUX("SD0", R9A07G044_CLK_SD0, SEL_SDHI0, SEL_SDHI0_STS, sel_shdi, + mtable_sdhi, 0, rzg2l_cpg_sd_clk_mux_notifier), +- DEF_SD_MUX("SD1", R9A07G044_CLK_SD1, SEL_SDHI1, SEL_SDHI0_STS, sel_shdi, ++ DEF_SD_MUX("SD1", R9A07G044_CLK_SD1, SEL_SDHI1, SEL_SDHI1_STS, sel_shdi, + mtable_sdhi, 0, rzg2l_cpg_sd_clk_mux_notifier), + DEF_FIXED("SD0_DIV4", CLK_SD0_DIV4, R9A07G044_CLK_SD0, 1, 4), + DEF_FIXED("SD1_DIV4", CLK_SD1_DIV4, R9A07G044_CLK_SD1, 1, 4), +-- +2.43.0 + diff --git a/queue-6.7/clk-samsung-exynos850-propagate-spi-ipclk-rate-chang.patch b/queue-6.7/clk-samsung-exynos850-propagate-spi-ipclk-rate-chang.patch new file mode 100644 index 00000000000..42786024742 --- /dev/null +++ b/queue-6.7/clk-samsung-exynos850-propagate-spi-ipclk-rate-chang.patch @@ -0,0 +1,173 @@ +From f2629c94d65df66a438a54879ac0cc64da3710f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jan 2024 19:38:56 -0600 +Subject: clk: samsung: exynos850: Propagate SPI IPCLK rate change + +From: Sam Protsenko + +[ Upstream commit 67c15187d4910ee353374676d4dddf09d8cb227e ] + +When SPI transfer is being prepared, the spi-s3c64xx driver will call +clk_set_rate() to change the rate of SPI source clock (IPCLK). But IPCLK +is a gate (leaf) clock, so it must propagate the rate change up the +clock tree, so that corresponding DIV clocks can actually change their +divider values. Add CLK_SET_RATE_PARENT flag to corresponding clocks for +all SPI instances in Exynos850 (spi_0, spi_1 and spi_2) to make it +possible. This change involves next clocks: + +usi_spi_0: + + Clock Block Div range + -------------------------------------------- + gout_spi0_ipclk CMU_PERI - + dout_peri_spi0 CMU_PERI /1..32 + mout_peri_spi_user CMU_PERI - + dout_peri_ip CMU_TOP /1..16 + +usi_cmgp0: + + Clock Block Div range + -------------------------------------------- + gout_cmgp_usi0_ipclk CMU_CMGP - + dout_cmgp_usi0 CMU_CMGP /1..32 + mout_cmgp_usi0 CMU_CMGP - + gout_clkcmu_cmgp_bus CMU_APM - + dout_apm_bus CMU_APM /1..8 + +usi_cmgp1: + + Clock Block Div range + -------------------------------------------- + gout_cmgp_usi1_ipclk CMU_CMGP - + dout_cmgp_usi1 CMU_CMGP /1..32 + mout_cmgp_usi1 CMU_CMGP - + gout_clkcmu_cmgp_bus CMU_APM - + dout_apm_bus CMU_APM /1..8 + +With input clock of 400 MHz, this scheme provides next IPCLK rate range, +for each SPI block: + + SPI0: 781 kHz ... 400 MHz + SPI1/2: 1.6 MHz ... 400 MHz + +Accounting for internal /4 divider in SPI blocks, and because the max +SPI frequency is limited at 50 MHz, it gives us next SPI SCK rates: + + SPI0: 200 kHz ... 49.9 MHz + SPI1/2: 400 kHz ... 49.9 MHz + +Which should cover all possible applications of SPI bus. Of course, +setting SPI frequency to values as low as 500 kHz will also affect the +common bus dividers (dout_apm_bus or dout_peri_ip), which in turn +effectively lowers the rates for all leaf bus clocks derived from those +dividers, like HSI2C and I3C clocks. But at least it gives the board +designer a choice, whether to keep all clocks (SPI/HSI2C/I3C) at high +frequencies, or make all those clocks have lower frequencies. Not +propagating the rate change to those common dividers would limit this +choice to "only high frequencies are allowed for SPI/HSI2C/I3C" option, +making the common dividers useless. This decision follows the "Worse is +better" approach, relying on the users/engineers to know the system +internals when working with such low-level features, instead of trying +to account for all possible use-cases. + +Fixes: 7dd05578198b ("clk: samsung: Introduce Exynos850 clock driver") +Signed-off-by: Sam Protsenko +Reviewed-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20240125013858.3986-2-semen.protsenko@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/clk/samsung/clk-exynos850.c | 33 +++++++++++++++-------------- + 1 file changed, 17 insertions(+), 16 deletions(-) + +diff --git a/drivers/clk/samsung/clk-exynos850.c b/drivers/clk/samsung/clk-exynos850.c +index bdc1eef7d6e54..c7b0b9751307b 100644 +--- a/drivers/clk/samsung/clk-exynos850.c ++++ b/drivers/clk/samsung/clk-exynos850.c +@@ -605,7 +605,7 @@ static const struct samsung_div_clock apm_div_clks[] __initconst = { + + static const struct samsung_gate_clock apm_gate_clks[] __initconst = { + GATE(CLK_GOUT_CLKCMU_CMGP_BUS, "gout_clkcmu_cmgp_bus", "dout_apm_bus", +- CLK_CON_GAT_CLKCMU_CMGP_BUS, 21, 0, 0), ++ CLK_CON_GAT_CLKCMU_CMGP_BUS, 21, CLK_SET_RATE_PARENT, 0), + GATE(CLK_GOUT_CLKCMU_CHUB_BUS, "gout_clkcmu_chub_bus", + "mout_clkcmu_chub_bus", + CLK_CON_GAT_GATE_CLKCMU_CHUB_BUS, 21, 0, 0), +@@ -974,19 +974,19 @@ static const struct samsung_fixed_rate_clock cmgp_fixed_clks[] __initconst = { + static const struct samsung_mux_clock cmgp_mux_clks[] __initconst = { + MUX(CLK_MOUT_CMGP_ADC, "mout_cmgp_adc", mout_cmgp_adc_p, + CLK_CON_MUX_CLK_CMGP_ADC, 0, 1), +- MUX(CLK_MOUT_CMGP_USI0, "mout_cmgp_usi0", mout_cmgp_usi0_p, +- CLK_CON_MUX_MUX_CLK_CMGP_USI_CMGP0, 0, 1), +- MUX(CLK_MOUT_CMGP_USI1, "mout_cmgp_usi1", mout_cmgp_usi1_p, +- CLK_CON_MUX_MUX_CLK_CMGP_USI_CMGP1, 0, 1), ++ MUX_F(CLK_MOUT_CMGP_USI0, "mout_cmgp_usi0", mout_cmgp_usi0_p, ++ CLK_CON_MUX_MUX_CLK_CMGP_USI_CMGP0, 0, 1, CLK_SET_RATE_PARENT, 0), ++ MUX_F(CLK_MOUT_CMGP_USI1, "mout_cmgp_usi1", mout_cmgp_usi1_p, ++ CLK_CON_MUX_MUX_CLK_CMGP_USI_CMGP1, 0, 1, CLK_SET_RATE_PARENT, 0), + }; + + static const struct samsung_div_clock cmgp_div_clks[] __initconst = { + DIV(CLK_DOUT_CMGP_ADC, "dout_cmgp_adc", "gout_clkcmu_cmgp_bus", + CLK_CON_DIV_DIV_CLK_CMGP_ADC, 0, 4), +- DIV(CLK_DOUT_CMGP_USI0, "dout_cmgp_usi0", "mout_cmgp_usi0", +- CLK_CON_DIV_DIV_CLK_CMGP_USI_CMGP0, 0, 5), +- DIV(CLK_DOUT_CMGP_USI1, "dout_cmgp_usi1", "mout_cmgp_usi1", +- CLK_CON_DIV_DIV_CLK_CMGP_USI_CMGP1, 0, 5), ++ DIV_F(CLK_DOUT_CMGP_USI0, "dout_cmgp_usi0", "mout_cmgp_usi0", ++ CLK_CON_DIV_DIV_CLK_CMGP_USI_CMGP0, 0, 5, CLK_SET_RATE_PARENT, 0), ++ DIV_F(CLK_DOUT_CMGP_USI1, "dout_cmgp_usi1", "mout_cmgp_usi1", ++ CLK_CON_DIV_DIV_CLK_CMGP_USI_CMGP1, 0, 5, CLK_SET_RATE_PARENT, 0), + }; + + static const struct samsung_gate_clock cmgp_gate_clks[] __initconst = { +@@ -1001,12 +1001,12 @@ static const struct samsung_gate_clock cmgp_gate_clks[] __initconst = { + "gout_clkcmu_cmgp_bus", + CLK_CON_GAT_GOUT_CMGP_GPIO_PCLK, 21, CLK_IGNORE_UNUSED, 0), + GATE(CLK_GOUT_CMGP_USI0_IPCLK, "gout_cmgp_usi0_ipclk", "dout_cmgp_usi0", +- CLK_CON_GAT_GOUT_CMGP_USI_CMGP0_IPCLK, 21, 0, 0), ++ CLK_CON_GAT_GOUT_CMGP_USI_CMGP0_IPCLK, 21, CLK_SET_RATE_PARENT, 0), + GATE(CLK_GOUT_CMGP_USI0_PCLK, "gout_cmgp_usi0_pclk", + "gout_clkcmu_cmgp_bus", + CLK_CON_GAT_GOUT_CMGP_USI_CMGP0_PCLK, 21, 0, 0), + GATE(CLK_GOUT_CMGP_USI1_IPCLK, "gout_cmgp_usi1_ipclk", "dout_cmgp_usi1", +- CLK_CON_GAT_GOUT_CMGP_USI_CMGP1_IPCLK, 21, 0, 0), ++ CLK_CON_GAT_GOUT_CMGP_USI_CMGP1_IPCLK, 21, CLK_SET_RATE_PARENT, 0), + GATE(CLK_GOUT_CMGP_USI1_PCLK, "gout_cmgp_usi1_pclk", + "gout_clkcmu_cmgp_bus", + CLK_CON_GAT_GOUT_CMGP_USI_CMGP1_PCLK, 21, 0, 0), +@@ -1557,8 +1557,9 @@ static const struct samsung_mux_clock peri_mux_clks[] __initconst = { + mout_peri_uart_user_p, PLL_CON0_MUX_CLKCMU_PERI_UART_USER, 4, 1), + MUX(CLK_MOUT_PERI_HSI2C_USER, "mout_peri_hsi2c_user", + mout_peri_hsi2c_user_p, PLL_CON0_MUX_CLKCMU_PERI_HSI2C_USER, 4, 1), +- MUX(CLK_MOUT_PERI_SPI_USER, "mout_peri_spi_user", mout_peri_spi_user_p, +- PLL_CON0_MUX_CLKCMU_PERI_SPI_USER, 4, 1), ++ MUX_F(CLK_MOUT_PERI_SPI_USER, "mout_peri_spi_user", ++ mout_peri_spi_user_p, PLL_CON0_MUX_CLKCMU_PERI_SPI_USER, 4, 1, ++ CLK_SET_RATE_PARENT, 0), + }; + + static const struct samsung_div_clock peri_div_clks[] __initconst = { +@@ -1568,8 +1569,8 @@ static const struct samsung_div_clock peri_div_clks[] __initconst = { + CLK_CON_DIV_DIV_CLK_PERI_HSI2C_1, 0, 5), + DIV(CLK_DOUT_PERI_HSI2C2, "dout_peri_hsi2c2", "gout_peri_hsi2c2", + CLK_CON_DIV_DIV_CLK_PERI_HSI2C_2, 0, 5), +- DIV(CLK_DOUT_PERI_SPI0, "dout_peri_spi0", "mout_peri_spi_user", +- CLK_CON_DIV_DIV_CLK_PERI_SPI_0, 0, 5), ++ DIV_F(CLK_DOUT_PERI_SPI0, "dout_peri_spi0", "mout_peri_spi_user", ++ CLK_CON_DIV_DIV_CLK_PERI_SPI_0, 0, 5, CLK_SET_RATE_PARENT, 0), + }; + + static const struct samsung_gate_clock peri_gate_clks[] __initconst = { +@@ -1611,7 +1612,7 @@ static const struct samsung_gate_clock peri_gate_clks[] __initconst = { + "mout_peri_bus_user", + CLK_CON_GAT_GOUT_PERI_PWM_MOTOR_PCLK, 21, 0, 0), + GATE(CLK_GOUT_SPI0_IPCLK, "gout_spi0_ipclk", "dout_peri_spi0", +- CLK_CON_GAT_GOUT_PERI_SPI_0_IPCLK, 21, 0, 0), ++ CLK_CON_GAT_GOUT_PERI_SPI_0_IPCLK, 21, CLK_SET_RATE_PARENT, 0), + GATE(CLK_GOUT_SPI0_PCLK, "gout_spi0_pclk", "mout_peri_bus_user", + CLK_CON_GAT_GOUT_PERI_SPI_0_PCLK, 21, 0, 0), + GATE(CLK_GOUT_SYSREG_PERI_PCLK, "gout_sysreg_peri_pclk", +-- +2.43.0 + diff --git a/queue-6.7/clk-zynq-prevent-null-pointer-dereference-caused-by-.patch b/queue-6.7/clk-zynq-prevent-null-pointer-dereference-caused-by-.patch new file mode 100644 index 00000000000..bf7f4ed9bb7 --- /dev/null +++ b/queue-6.7/clk-zynq-prevent-null-pointer-dereference-caused-by-.patch @@ -0,0 +1,74 @@ +From 6e45febb1fbb5042710702975ad9049aa0f6d8b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 16:44:37 +0800 +Subject: clk: zynq: Prevent null pointer dereference caused by kmalloc failure + +From: Duoming Zhou + +[ Upstream commit 7938e9ce39d6779d2f85d822cc930f73420e54a6 ] + +The kmalloc() in zynq_clk_setup() will return null if the +physical memory has run out. As a result, if we use snprintf() +to write data to the null address, the null pointer dereference +bug will happen. + +This patch uses a stack variable to replace the kmalloc(). + +Fixes: 0ee52b157b8e ("clk: zynq: Add clock controller driver") +Suggested-by: Michal Simek +Suggested-by: Stephen Boyd +Signed-off-by: Duoming Zhou +Link: https://lore.kernel.org/r/20240301084437.16084-1-duoming@zju.edu.cn +Acked-by: Michal Simek +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/zynq/clkc.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/clk/zynq/clkc.c b/drivers/clk/zynq/clkc.c +index 7bdeaff2bfd68..c28d3dacf0fb2 100644 +--- a/drivers/clk/zynq/clkc.c ++++ b/drivers/clk/zynq/clkc.c +@@ -42,6 +42,7 @@ static void __iomem *zynq_clkc_base; + #define SLCR_SWDT_CLK_SEL (zynq_clkc_base + 0x204) + + #define NUM_MIO_PINS 54 ++#define CLK_NAME_LEN 16 + + #define DBG_CLK_CTRL_CLKACT_TRC BIT(0) + #define DBG_CLK_CTRL_CPU_1XCLKACT BIT(1) +@@ -215,7 +216,7 @@ static void __init zynq_clk_setup(struct device_node *np) + int i; + u32 tmp; + int ret; +- char *clk_name; ++ char clk_name[CLK_NAME_LEN]; + unsigned int fclk_enable = 0; + const char *clk_output_name[clk_max]; + const char *cpu_parents[4]; +@@ -426,12 +427,10 @@ static void __init zynq_clk_setup(struct device_node *np) + "gem1_emio_mux", CLK_SET_RATE_PARENT, + SLCR_GEM1_CLK_CTRL, 0, 0, &gem1clk_lock); + +- tmp = strlen("mio_clk_00x"); +- clk_name = kmalloc(tmp, GFP_KERNEL); + for (i = 0; i < NUM_MIO_PINS; i++) { + int idx; + +- snprintf(clk_name, tmp, "mio_clk_%2.2d", i); ++ snprintf(clk_name, CLK_NAME_LEN, "mio_clk_%2.2d", i); + idx = of_property_match_string(np, "clock-names", clk_name); + if (idx >= 0) + can_mio_mux_parents[i] = of_clk_get_parent_name(np, +@@ -439,7 +438,6 @@ static void __init zynq_clk_setup(struct device_node *np) + else + can_mio_mux_parents[i] = dummy_nm; + } +- kfree(clk_name); + clk_register_mux(NULL, "can_mux", periph_parents, 4, + CLK_SET_RATE_NO_REPARENT, SLCR_CAN_CLK_CTRL, 4, 2, 0, + &canclk_lock); +-- +2.43.0 + diff --git a/queue-6.7/cpufreq-brcmstb-avs-cpufreq-add-check-for-cpufreq_cp.patch b/queue-6.7/cpufreq-brcmstb-avs-cpufreq-add-check-for-cpufreq_cp.patch new file mode 100644 index 00000000000..1a533c82927 --- /dev/null +++ b/queue-6.7/cpufreq-brcmstb-avs-cpufreq-add-check-for-cpufreq_cp.patch @@ -0,0 +1,39 @@ +From bada55c6de3a8bb3f753dc258da7bf2058df7847 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jan 2024 10:12:20 +0300 +Subject: cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return + value + +From: Anastasia Belova + +[ Upstream commit f661017e6d326ee187db24194cabb013d81bc2a6 ] + +cpufreq_cpu_get may return NULL. To avoid NULL-dereference check it +and return 0 in case of error. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs") +Signed-off-by: Anastasia Belova +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/brcmstb-avs-cpufreq.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c +index 35fb3a559ea97..1a1857b0a6f48 100644 +--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c ++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c +@@ -481,6 +481,8 @@ static bool brcm_avs_is_firmware_loaded(struct private_data *priv) + static unsigned int brcm_avs_cpufreq_get(unsigned int cpu) + { + struct cpufreq_policy *policy = cpufreq_cpu_get(cpu); ++ if (!policy) ++ return 0; + struct private_data *priv = policy->driver_data; + + cpufreq_cpu_put(policy); +-- +2.43.0 + diff --git a/queue-6.7/cpufreq-mediatek-hw-don-t-error-out-if-supply-is-not.patch b/queue-6.7/cpufreq-mediatek-hw-don-t-error-out-if-supply-is-not.patch new file mode 100644 index 00000000000..0bfc21a5031 --- /dev/null +++ b/queue-6.7/cpufreq-mediatek-hw-don-t-error-out-if-supply-is-not.patch @@ -0,0 +1,48 @@ +From a7e1aa3da3ff75c240171b54f6fb9171a335dd85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jan 2024 17:31:43 -0300 +Subject: cpufreq: mediatek-hw: Don't error out if supply is not found +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit eaffb10b51bf74415c9252fd8fb4dd77122501ee ] + +devm_regulator_get_optional() returns -ENODEV if no supply can be found. +By introducing its usage, commit 788715b5f21c ("cpufreq: mediatek-hw: +Wait for CPU supplies before probing") caused the driver to fail probe +if no supply was present in any of the CPU DT nodes. + +Use devm_regulator_get() instead since the CPUs do require supplies +even if not described in the DT. It will gracefully return a dummy +regulator if none is found in the DT node, allowing probe to succeed. + +Fixes: 788715b5f21c ("cpufreq: mediatek-hw: Wait for CPU supplies before probing") +Reported-by: kernelci.org bot +Closes: https://linux.kernelci.org/test/case/id/65b0b169710edea22852a3fa/ +Signed-off-by: Nícolas F. R. A. Prado +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/mediatek-cpufreq-hw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/mediatek-cpufreq-hw.c b/drivers/cpufreq/mediatek-cpufreq-hw.c +index a1aa9385980ae..8d097dcddda47 100644 +--- a/drivers/cpufreq/mediatek-cpufreq-hw.c ++++ b/drivers/cpufreq/mediatek-cpufreq-hw.c +@@ -312,7 +312,7 @@ static int mtk_cpufreq_hw_driver_probe(struct platform_device *pdev) + return dev_err_probe(&pdev->dev, -EPROBE_DEFER, + "Failed to get cpu%d device\n", cpu); + +- cpu_reg = devm_regulator_get_optional(cpu_dev, "cpu"); ++ cpu_reg = devm_regulator_get(cpu_dev, "cpu"); + if (IS_ERR(cpu_reg)) + return dev_err_probe(&pdev->dev, PTR_ERR(cpu_reg), + "CPU%d regulator get failed\n", cpu); +-- +2.43.0 + diff --git a/queue-6.7/cpufreq-mediatek-hw-wait-for-cpu-supplies-before-pro.patch b/queue-6.7/cpufreq-mediatek-hw-wait-for-cpu-supplies-before-pro.patch new file mode 100644 index 00000000000..27383f17fd3 --- /dev/null +++ b/queue-6.7/cpufreq-mediatek-hw-wait-for-cpu-supplies-before-pro.patch @@ -0,0 +1,72 @@ +From 6ffb7c569388ce2174af78d7b9538b27dd9c7fb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jan 2024 11:23:02 -0300 +Subject: cpufreq: mediatek-hw: Wait for CPU supplies before probing +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 788715b5f21c6455264fe00a1779e61bec407fe2 ] + +Before proceeding with the probe and enabling frequency scaling for the +CPUs, make sure that all supplies feeding the CPUs have probed. + +This fixes an issue observed on MT8195-Tomato where if the +mediatek-cpufreq-hw driver enabled the hardware (by writing to +REG_FREQ_ENABLE) before the SPMI controller driver (spmi-mtk-pmif), +behind which lies the big CPU supply, probed the platform would hang +shortly after with "rcu: INFO: rcu_preempt detected stalls on +CPUs/tasks" being printed in the log. + +Fixes: 4855e26bcf4d ("cpufreq: mediatek-hw: Add support for CPUFREQ HW") +Signed-off-by: Nícolas F. R. A. Prado +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Matthias Brugger +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/mediatek-cpufreq-hw.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/mediatek-cpufreq-hw.c b/drivers/cpufreq/mediatek-cpufreq-hw.c +index d46afb3c00923..a1aa9385980ae 100644 +--- a/drivers/cpufreq/mediatek-cpufreq-hw.c ++++ b/drivers/cpufreq/mediatek-cpufreq-hw.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + #include + + #define LUT_MAX_ENTRIES 32U +@@ -300,7 +301,23 @@ static struct cpufreq_driver cpufreq_mtk_hw_driver = { + static int mtk_cpufreq_hw_driver_probe(struct platform_device *pdev) + { + const void *data; +- int ret; ++ int ret, cpu; ++ struct device *cpu_dev; ++ struct regulator *cpu_reg; ++ ++ /* Make sure that all CPU supplies are available before proceeding. */ ++ for_each_possible_cpu(cpu) { ++ cpu_dev = get_cpu_device(cpu); ++ if (!cpu_dev) ++ return dev_err_probe(&pdev->dev, -EPROBE_DEFER, ++ "Failed to get cpu%d device\n", cpu); ++ ++ cpu_reg = devm_regulator_get_optional(cpu_dev, "cpu"); ++ if (IS_ERR(cpu_reg)) ++ return dev_err_probe(&pdev->dev, PTR_ERR(cpu_reg), ++ "CPU%d regulator get failed\n", cpu); ++ } ++ + + data = of_device_get_match_data(&pdev->dev); + if (!data) +-- +2.43.0 + diff --git a/queue-6.7/cpufreq-qcom-hw-add-config_common_clk-dependency.patch b/queue-6.7/cpufreq-qcom-hw-add-config_common_clk-dependency.patch new file mode 100644 index 00000000000..d3cd2e15087 --- /dev/null +++ b/queue-6.7/cpufreq-qcom-hw-add-config_common_clk-dependency.patch @@ -0,0 +1,47 @@ +From d8d2c3bb50a98b8451f0e92b28d392b15ded5d8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Feb 2024 09:33:14 +0100 +Subject: cpufreq: qcom-hw: add CONFIG_COMMON_CLK dependency + +From: Arnd Bergmann + +[ Upstream commit 3093fa33539b54db77171d2919352ad4f044a1c5 ] + +It is still possible to compile-test a kernel without CONFIG_COMMON_CLK +for some ancient ARM boards or other architectures, but this causes a +link failure in the qcom-cpufreq-hw driver: + +ERROR: modpost: "devm_clk_hw_register" [drivers/cpufreq/qcom-cpufreq-hw.ko] undefined! +ERROR: modpost: "devm_of_clk_add_hw_provider" [drivers/cpufreq/qcom-cpufreq-hw.ko] undefined! +ERROR: modpost: "of_clk_hw_onecell_get" [drivers/cpufreq/qcom-cpufreq-hw.ko] undefined! + +Add a Kconfig dependency here to make sure this always work. Apparently +this bug has been in the kernel for a while without me running into it +on randconfig builds as COMMON_CLK is almost always enabled. + +I have cross-checked by building an allmodconfig kernel with COMMON_CLK +disabled, which showed no other driver having this problem. + +Fixes: 4370232c727b ("cpufreq: qcom-hw: Add CPU clock provider support") +Signed-off-by: Arnd Bergmann +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/Kconfig.arm | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm +index f911606897b8d..a0ebad77666e3 100644 +--- a/drivers/cpufreq/Kconfig.arm ++++ b/drivers/cpufreq/Kconfig.arm +@@ -173,6 +173,7 @@ config ARM_QCOM_CPUFREQ_NVMEM + config ARM_QCOM_CPUFREQ_HW + tristate "QCOM CPUFreq HW driver" + depends on ARCH_QCOM || COMPILE_TEST ++ depends on COMMON_CLK + help + Support for the CPUFreq HW driver. + Some QCOM chipsets have a HW engine to offload the steps +-- +2.43.0 + diff --git a/queue-6.7/crypto-arm-sha-fix-function-cast-warnings.patch b/queue-6.7/crypto-arm-sha-fix-function-cast-warnings.patch new file mode 100644 index 00000000000..abdbc1af379 --- /dev/null +++ b/queue-6.7/crypto-arm-sha-fix-function-cast-warnings.patch @@ -0,0 +1,115 @@ +From 6dfb08da6f762ea5b0148f878480b17136cd3c51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 14:49:46 +0100 +Subject: crypto: arm/sha - fix function cast warnings + +From: Arnd Bergmann + +[ Upstream commit 53cc9baeb9bc2a187eb9c9790d30995148852b12 ] + +clang-16 warns about casting between incompatible function types: + +arch/arm/crypto/sha256_glue.c:37:5: error: cast from 'void (*)(u32 *, const void *, unsigned int)' (aka 'void (*)(unsigned int *, const void *, unsigned int)') to 'sha256_block_fn *' (aka 'void (*)(struct sha256_state *, const unsigned char *, int)') converts to incompatible function type [-Werror,-Wcast-function-type-strict] + 37 | (sha256_block_fn *)sha256_block_data_order); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +arch/arm/crypto/sha512-glue.c:34:3: error: cast from 'void (*)(u64 *, const u8 *, int)' (aka 'void (*)(unsigned long long *, const unsigned char *, int)') to 'sha512_block_fn *' (aka 'void (*)(struct sha512_state *, const unsigned char *, int)') converts to incompatible function type [-Werror,-Wcast-function-type-strict] + 34 | (sha512_block_fn *)sha512_block_data_order); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Fix the prototypes for the assembler functions to match the typedef. +The code already relies on the digest being the first part of the +state structure, so there is no change in behavior. + +Fixes: c80ae7ca3726 ("crypto: arm/sha512 - accelerated SHA-512 using ARM generic ASM and NEON") +Fixes: b59e2ae3690c ("crypto: arm/sha256 - move SHA-224/256 ASM/NEON implementation to base layer") +Signed-off-by: Arnd Bergmann +Reviewed-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + arch/arm/crypto/sha256_glue.c | 13 +++++-------- + arch/arm/crypto/sha512-glue.c | 12 +++++------- + 2 files changed, 10 insertions(+), 15 deletions(-) + +diff --git a/arch/arm/crypto/sha256_glue.c b/arch/arm/crypto/sha256_glue.c +index 433ee4ddce6c8..f85933fdec75f 100644 +--- a/arch/arm/crypto/sha256_glue.c ++++ b/arch/arm/crypto/sha256_glue.c +@@ -24,8 +24,8 @@ + + #include "sha256_glue.h" + +-asmlinkage void sha256_block_data_order(u32 *digest, const void *data, +- unsigned int num_blks); ++asmlinkage void sha256_block_data_order(struct sha256_state *state, ++ const u8 *data, int num_blks); + + int crypto_sha256_arm_update(struct shash_desc *desc, const u8 *data, + unsigned int len) +@@ -33,23 +33,20 @@ int crypto_sha256_arm_update(struct shash_desc *desc, const u8 *data, + /* make sure casting to sha256_block_fn() is safe */ + BUILD_BUG_ON(offsetof(struct sha256_state, state) != 0); + +- return sha256_base_do_update(desc, data, len, +- (sha256_block_fn *)sha256_block_data_order); ++ return sha256_base_do_update(desc, data, len, sha256_block_data_order); + } + EXPORT_SYMBOL(crypto_sha256_arm_update); + + static int crypto_sha256_arm_final(struct shash_desc *desc, u8 *out) + { +- sha256_base_do_finalize(desc, +- (sha256_block_fn *)sha256_block_data_order); ++ sha256_base_do_finalize(desc, sha256_block_data_order); + return sha256_base_finish(desc, out); + } + + int crypto_sha256_arm_finup(struct shash_desc *desc, const u8 *data, + unsigned int len, u8 *out) + { +- sha256_base_do_update(desc, data, len, +- (sha256_block_fn *)sha256_block_data_order); ++ sha256_base_do_update(desc, data, len, sha256_block_data_order); + return crypto_sha256_arm_final(desc, out); + } + EXPORT_SYMBOL(crypto_sha256_arm_finup); +diff --git a/arch/arm/crypto/sha512-glue.c b/arch/arm/crypto/sha512-glue.c +index 0635a65aa488b..1be5bd498af36 100644 +--- a/arch/arm/crypto/sha512-glue.c ++++ b/arch/arm/crypto/sha512-glue.c +@@ -25,27 +25,25 @@ MODULE_ALIAS_CRYPTO("sha512"); + MODULE_ALIAS_CRYPTO("sha384-arm"); + MODULE_ALIAS_CRYPTO("sha512-arm"); + +-asmlinkage void sha512_block_data_order(u64 *state, u8 const *src, int blocks); ++asmlinkage void sha512_block_data_order(struct sha512_state *state, ++ u8 const *src, int blocks); + + int sha512_arm_update(struct shash_desc *desc, const u8 *data, + unsigned int len) + { +- return sha512_base_do_update(desc, data, len, +- (sha512_block_fn *)sha512_block_data_order); ++ return sha512_base_do_update(desc, data, len, sha512_block_data_order); + } + + static int sha512_arm_final(struct shash_desc *desc, u8 *out) + { +- sha512_base_do_finalize(desc, +- (sha512_block_fn *)sha512_block_data_order); ++ sha512_base_do_finalize(desc, sha512_block_data_order); + return sha512_base_finish(desc, out); + } + + int sha512_arm_finup(struct shash_desc *desc, const u8 *data, + unsigned int len, u8 *out) + { +- sha512_base_do_update(desc, data, len, +- (sha512_block_fn *)sha512_block_data_order); ++ sha512_base_do_update(desc, data, len, sha512_block_data_order); + return sha512_arm_final(desc, out); + } + +-- +2.43.0 + diff --git a/queue-6.7/crypto-ccp-avoid-discarding-errors-in-psp_send_platf.patch b/queue-6.7/crypto-ccp-avoid-discarding-errors-in-psp_send_platf.patch new file mode 100644 index 00000000000..bbfddf928b7 --- /dev/null +++ b/queue-6.7/crypto-ccp-avoid-discarding-errors-in-psp_send_platf.patch @@ -0,0 +1,56 @@ +From 31adfd8a3214cc89efa5108f211b3c018e6be909 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 11:34:28 -0600 +Subject: crypto: ccp - Avoid discarding errors in + psp_send_platform_access_msg() + +From: Mario Limonciello + +[ Upstream commit 0e8fca2f12ceb77c3a6b6f210135031f264aa612 ] + +Errors can potentially occur in the "processing" of PSP commands or +commands can be processed successfully but still return an error code in +the header. + +This second case was being discarded because PSP communication worked but +the command returned an error code in the payload header. + +Capture both cases and return them to the caller as -EIO for the caller +to investigate. The caller can detect the latter by looking at +`req->header->status`. + +Reported-and-tested-by: Tim Van Patten +Fixes: 7ccc4f4e2e50 ("crypto: ccp - Add support for an interface for platform features") +Signed-off-by: Mario Limonciello +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccp/platform-access.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/ccp/platform-access.c b/drivers/crypto/ccp/platform-access.c +index 94367bc49e35b..1b8ed33897332 100644 +--- a/drivers/crypto/ccp/platform-access.c ++++ b/drivers/crypto/ccp/platform-access.c +@@ -118,9 +118,16 @@ int psp_send_platform_access_msg(enum psp_platform_access_msg msg, + goto unlock; + } + +- /* Store the status in request header for caller to investigate */ ++ /* ++ * Read status from PSP. If status is non-zero, it indicates an error ++ * occurred during "processing" of the command. ++ * If status is zero, it indicates the command was "processed" ++ * successfully, but the result of the command is in the payload. ++ * Return both cases to the caller as -EIO to investigate. ++ */ + cmd_reg = ioread32(cmd); +- req->header.status = FIELD_GET(PSP_CMDRESP_STS, cmd_reg); ++ if (FIELD_GET(PSP_CMDRESP_STS, cmd_reg)) ++ req->header.status = FIELD_GET(PSP_CMDRESP_STS, cmd_reg); + if (req->header.status) { + ret = -EIO; + goto unlock; +-- +2.43.0 + diff --git a/queue-6.7/crypto-jitter-fix-crypto_jitterentropy-help-text.patch b/queue-6.7/crypto-jitter-fix-crypto_jitterentropy-help-text.patch new file mode 100644 index 00000000000..05b44a19499 --- /dev/null +++ b/queue-6.7/crypto-jitter-fix-crypto_jitterentropy-help-text.patch @@ -0,0 +1,51 @@ +From f8df2c0b76b45ce4690d92d61535086c8f04d7a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Feb 2024 08:55:13 -0800 +Subject: crypto: jitter - fix CRYPTO_JITTERENTROPY help text + +From: Randy Dunlap + +[ Upstream commit e63df1ec9a16dd9e13e9068243e64876de06f795 ] + +Correct various small problems in the help text: +a. change 2 spaces to ", " +b. finish an incomplete sentence +c. change non-working URL to working URL + +Fixes: a9a98d49da52 ("crypto: Kconfig - simplify compression/RNG entries") +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218458 +Signed-off-by: Randy Dunlap +Cc: Bagas Sanjaya +Cc: Robert Elliott +Cc: Christoph Biedl +Cc: Herbert Xu +Cc: "David S. Miller" +Cc: linux-crypto@vger.kernel.org +Acked-by: Bagas Sanjaya +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/Kconfig | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/crypto/Kconfig b/crypto/Kconfig +index 70661f58ee41c..dd5353c5eb24d 100644 +--- a/crypto/Kconfig ++++ b/crypto/Kconfig +@@ -1292,10 +1292,11 @@ config CRYPTO_JITTERENTROPY + + A non-physical non-deterministic ("true") RNG (e.g., an entropy source + compliant with NIST SP800-90B) intended to provide a seed to a +- deterministic RNG (e.g. per NIST SP800-90C). ++ deterministic RNG (e.g., per NIST SP800-90C). + This RNG does not perform any cryptographic whitening of the generated ++ random numbers. + +- See https://www.chronox.de/jent.html ++ See https://www.chronox.de/jent/ + + if CRYPTO_JITTERENTROPY + if CRYPTO_FIPS && EXPERT +-- +2.43.0 + diff --git a/queue-6.7/crypto-qat-avoid-division-by-zero.patch b/queue-6.7/crypto-qat-avoid-division-by-zero.patch new file mode 100644 index 00000000000..06e7615325e --- /dev/null +++ b/queue-6.7/crypto-qat-avoid-division-by-zero.patch @@ -0,0 +1,45 @@ +From db713dfd2d4941df1f394c245594fd1cebc7cb31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 15:19:57 +0000 +Subject: crypto: qat - avoid division by zero + +From: Adam Guerin + +[ Upstream commit f99fb7d660f7c818105803f1f1915396a14d18ad ] + +Check if delta_us is not zero and return -EINVAL if it is. +delta_us is unlikely to be zero as there is a sleep between the reads of +the two timestamps. + +This is to fix the following warning when compiling the QAT driver +using clang scan-build: + drivers/crypto/intel/qat/qat_common/adf_clock.c:87:9: warning: Division by zero [core.DivideZero] + 87 | temp = DIV_ROUND_CLOSEST_ULL(temp, delta_us); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Fixes: e2980ba57e79 ("crypto: qat - add measure clock frequency") +Signed-off-by: Adam Guerin +Reviewed-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/intel/qat/qat_common/adf_clock.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/crypto/intel/qat/qat_common/adf_clock.c b/drivers/crypto/intel/qat/qat_common/adf_clock.c +index 01e0a389e462b..cf89f57de2a70 100644 +--- a/drivers/crypto/intel/qat/qat_common/adf_clock.c ++++ b/drivers/crypto/intel/qat/qat_common/adf_clock.c +@@ -83,6 +83,9 @@ static int measure_clock(struct adf_accel_dev *accel_dev, u32 *frequency) + } + + delta_us = timespec_to_us(&ts3) - timespec_to_us(&ts1); ++ if (!delta_us) ++ return -EINVAL; ++ + temp = (timestamp2 - timestamp1) * ME_CLK_DIVIDER * 10; + temp = DIV_ROUND_CLOSEST_ULL(temp, delta_us); + /* +-- +2.43.0 + diff --git a/queue-6.7/crypto-qat-fix-ring-to-service-map-for-dcc-in-4xxx.patch b/queue-6.7/crypto-qat-fix-ring-to-service-map-for-dcc-in-4xxx.patch new file mode 100644 index 00000000000..c90a1475314 --- /dev/null +++ b/queue-6.7/crypto-qat-fix-ring-to-service-map-for-dcc-in-4xxx.patch @@ -0,0 +1,56 @@ +From 22b847772f600c51a442de8e0697f7f331d31ed4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 18:21:54 +0100 +Subject: crypto: qat - fix ring to service map for dcc in 4xxx + +From: Damian Muszynski + +[ Upstream commit df018f82002a8b4dc407bc9a6f416b9241d14415 ] + +If a device is configured for data compression chaining (dcc), half of the +engines are loaded with the symmetric crypto image and the rest are loaded +with the compression image. +However, in such configuration all rings can handle compression requests. + +Fix the ring to service mapping so that when a device is configured for +dcc, the ring to service mapping reports that all rings in a bank can +be used for compression. + +Fixes: a238487f7965 ("crypto: qat - fix ring to service map for QAT GEN4") +Signed-off-by: Damian Muszynski +Reviewed-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c b/drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c +index 9763402cd486b..b64aaecdd98ba 100644 +--- a/drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c ++++ b/drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c +@@ -437,6 +437,13 @@ static u16 get_ring_to_svc_map(struct adf_accel_dev *accel_dev) + if (!fw_config) + return 0; + ++ /* If dcc, all rings handle compression requests */ ++ if (adf_get_service_enabled(accel_dev) == SVC_DCC) { ++ for (i = 0; i < RP_GROUP_COUNT; i++) ++ rps[i] = COMP; ++ goto set_mask; ++ } ++ + for (i = 0; i < RP_GROUP_COUNT; i++) { + switch (fw_config[i].ae_mask) { + case ADF_AE_GROUP_0: +@@ -465,6 +472,7 @@ static u16 get_ring_to_svc_map(struct adf_accel_dev *accel_dev) + } + } + ++set_mask: + ring_to_svc_map = rps[RP_GROUP_0] << ADF_CFG_SERV_RING_PAIR_0_SHIFT | + rps[RP_GROUP_1] << ADF_CFG_SERV_RING_PAIR_1_SHIFT | + rps[RP_GROUP_0] << ADF_CFG_SERV_RING_PAIR_2_SHIFT | +-- +2.43.0 + diff --git a/queue-6.7/crypto-qat-relocate-and-rename-get_service_enabled.patch b/queue-6.7/crypto-qat-relocate-and-rename-get_service_enabled.patch new file mode 100644 index 00000000000..e74b1ee3e9a --- /dev/null +++ b/queue-6.7/crypto-qat-relocate-and-rename-get_service_enabled.patch @@ -0,0 +1,153 @@ +From 3ec0cb065a66ec20b7932b74ca21718ffbc1a4ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Dec 2023 05:01:44 -0500 +Subject: crypto: qat - relocate and rename get_service_enabled() + +From: Jie Wang + +[ Upstream commit 4db87a5f9e3026d72e03bbdf1dac1dc5303e37f7 ] + +Move the function get_service_enabled() from adf_4xxx_hw_data.c to +adf_cfg_services.c and rename it as adf_get_service_enabled(). +This function is not specific to the 4xxx and will be used by +other QAT drivers. + +This does not introduce any functional change. + +Signed-off-by: Jie Wang +Reviewed-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Stable-dep-of: df018f82002a ("crypto: qat - fix ring to service map for dcc in 4xxx") +Signed-off-by: Sasha Levin +--- + .../intel/qat/qat_4xxx/adf_4xxx_hw_data.c | 29 ++----------------- + .../intel/qat/qat_common/adf_cfg_services.c | 27 +++++++++++++++++ + .../intel/qat/qat_common/adf_cfg_services.h | 4 +++ + 3 files changed, 34 insertions(+), 26 deletions(-) + +diff --git a/drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c b/drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c +index 0faedb5b2eb5a..9763402cd486b 100644 +--- a/drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c ++++ b/drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c +@@ -120,29 +120,6 @@ static struct adf_hw_device_class adf_4xxx_class = { + .instances = 0, + }; + +-static int get_service_enabled(struct adf_accel_dev *accel_dev) +-{ +- char services[ADF_CFG_MAX_VAL_LEN_IN_BYTES] = {0}; +- int ret; +- +- ret = adf_cfg_get_param_value(accel_dev, ADF_GENERAL_SEC, +- ADF_SERVICES_ENABLED, services); +- if (ret) { +- dev_err(&GET_DEV(accel_dev), +- ADF_SERVICES_ENABLED " param not found\n"); +- return ret; +- } +- +- ret = match_string(adf_cfg_services, ARRAY_SIZE(adf_cfg_services), +- services); +- if (ret < 0) +- dev_err(&GET_DEV(accel_dev), +- "Invalid value of " ADF_SERVICES_ENABLED " param: %s\n", +- services); +- +- return ret; +-} +- + static u32 get_accel_mask(struct adf_hw_device_data *self) + { + return ADF_4XXX_ACCELERATORS_MASK; +@@ -275,7 +252,7 @@ static u32 get_accel_cap(struct adf_accel_dev *accel_dev) + capabilities_dc &= ~ICP_ACCEL_CAPABILITIES_CNV_INTEGRITY64; + } + +- switch (get_service_enabled(accel_dev)) { ++ switch (adf_get_service_enabled(accel_dev)) { + case SVC_CY: + case SVC_CY2: + return capabilities_sym | capabilities_asym; +@@ -311,7 +288,7 @@ static enum dev_sku_info get_sku(struct adf_hw_device_data *self) + + static const u32 *adf_get_arbiter_mapping(struct adf_accel_dev *accel_dev) + { +- switch (get_service_enabled(accel_dev)) { ++ switch (adf_get_service_enabled(accel_dev)) { + case SVC_DC: + return thrd_to_arb_map_dc; + case SVC_DCC: +@@ -420,7 +397,7 @@ static u32 uof_get_num_objs(void) + + static const struct adf_fw_config *get_fw_config(struct adf_accel_dev *accel_dev) + { +- switch (get_service_enabled(accel_dev)) { ++ switch (adf_get_service_enabled(accel_dev)) { + case SVC_CY: + case SVC_CY2: + return adf_fw_cy_config; +diff --git a/drivers/crypto/intel/qat/qat_common/adf_cfg_services.c b/drivers/crypto/intel/qat/qat_common/adf_cfg_services.c +index 8e13fe938959b..2680522944684 100644 +--- a/drivers/crypto/intel/qat/qat_common/adf_cfg_services.c ++++ b/drivers/crypto/intel/qat/qat_common/adf_cfg_services.c +@@ -2,6 +2,9 @@ + /* Copyright(c) 2023 Intel Corporation */ + + #include ++#include ++#include ++#include "adf_cfg.h" + #include "adf_cfg_services.h" + #include "adf_cfg_strings.h" + +@@ -18,3 +21,27 @@ const char *const adf_cfg_services[] = { + [SVC_SYM_DC] = ADF_CFG_SYM_DC, + }; + EXPORT_SYMBOL_GPL(adf_cfg_services); ++ ++int adf_get_service_enabled(struct adf_accel_dev *accel_dev) ++{ ++ char services[ADF_CFG_MAX_VAL_LEN_IN_BYTES] = {0}; ++ int ret; ++ ++ ret = adf_cfg_get_param_value(accel_dev, ADF_GENERAL_SEC, ++ ADF_SERVICES_ENABLED, services); ++ if (ret) { ++ dev_err(&GET_DEV(accel_dev), ++ ADF_SERVICES_ENABLED " param not found\n"); ++ return ret; ++ } ++ ++ ret = match_string(adf_cfg_services, ARRAY_SIZE(adf_cfg_services), ++ services); ++ if (ret < 0) ++ dev_err(&GET_DEV(accel_dev), ++ "Invalid value of " ADF_SERVICES_ENABLED " param: %s\n", ++ services); ++ ++ return ret; ++} ++EXPORT_SYMBOL_GPL(adf_get_service_enabled); +diff --git a/drivers/crypto/intel/qat/qat_common/adf_cfg_services.h b/drivers/crypto/intel/qat/qat_common/adf_cfg_services.h +index f78fd697b4bee..c6b0328b0f5b0 100644 +--- a/drivers/crypto/intel/qat/qat_common/adf_cfg_services.h ++++ b/drivers/crypto/intel/qat/qat_common/adf_cfg_services.h +@@ -5,6 +5,8 @@ + + #include "adf_cfg_strings.h" + ++struct adf_accel_dev; ++ + enum adf_services { + SVC_CY = 0, + SVC_CY2, +@@ -21,4 +23,6 @@ enum adf_services { + + extern const char *const adf_cfg_services[SVC_COUNT]; + ++int adf_get_service_enabled(struct adf_accel_dev *accel_dev); ++ + #endif +-- +2.43.0 + diff --git a/queue-6.7/crypto-qat-remove-double-initialization-of-value.patch b/queue-6.7/crypto-qat-remove-double-initialization-of-value.patch new file mode 100644 index 00000000000..fb8e13de169 --- /dev/null +++ b/queue-6.7/crypto-qat-remove-double-initialization-of-value.patch @@ -0,0 +1,56 @@ +From 2db8ac1db93baec9ecd41f3784c4f04e902e0f2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 15:19:58 +0000 +Subject: crypto: qat - remove double initialization of value + +From: Adam Guerin + +[ Upstream commit a66cf93ab33853f17b8cc33a99263dd0a383a1a1 ] + +Remove double initialization of the reg variable. + +This is to fix the following warning when compiling the QAT driver +using clang scan-build: + drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c:1010:6: warning: Value stored to 'reg' during its initialization is never read [deadcode.DeadStores] + 1010 | u32 reg = ADF_CSR_RD(csr, ADF_GEN4_SSMCPPERR); + | ^~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c:1109:6: warning: Value stored to 'reg' during its initialization is never read [deadcode.DeadStores] + 1109 | u32 reg = ADF_CSR_RD(csr, ADF_GEN4_SER_ERR_SSMSH); + | ^~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Fixes: 99b1c9826e48 ("crypto: qat - count QAT GEN4 errors") +Signed-off-by: Adam Guerin +Reviewed-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c b/drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c +index 048c246079390..2dd3772bf58a6 100644 +--- a/drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c ++++ b/drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c +@@ -1007,8 +1007,7 @@ static bool adf_handle_spppar_err(struct adf_accel_dev *accel_dev, + static bool adf_handle_ssmcpppar_err(struct adf_accel_dev *accel_dev, + void __iomem *csr, u32 iastatssm) + { +- u32 reg = ADF_CSR_RD(csr, ADF_GEN4_SSMCPPERR); +- u32 bits_num = BITS_PER_REG(reg); ++ u32 reg, bits_num = BITS_PER_REG(reg); + bool reset_required = false; + unsigned long errs_bits; + u32 bit_iterator; +@@ -1106,8 +1105,7 @@ static bool adf_handle_rf_parr_err(struct adf_accel_dev *accel_dev, + static bool adf_handle_ser_err_ssmsh(struct adf_accel_dev *accel_dev, + void __iomem *csr, u32 iastatssm) + { +- u32 reg = ADF_CSR_RD(csr, ADF_GEN4_SER_ERR_SSMSH); +- u32 bits_num = BITS_PER_REG(reg); ++ u32 reg, bits_num = BITS_PER_REG(reg); + bool reset_required = false; + unsigned long errs_bits; + u32 bit_iterator; +-- +2.43.0 + diff --git a/queue-6.7/crypto-qat-remove-unused-macros-in-qat_comp_alg.c.patch b/queue-6.7/crypto-qat-remove-unused-macros-in-qat_comp_alg.c.patch new file mode 100644 index 00000000000..0847ab2b2d0 --- /dev/null +++ b/queue-6.7/crypto-qat-remove-unused-macros-in-qat_comp_alg.c.patch @@ -0,0 +1,71 @@ +From 47fc1df7fed45957dfed6731a0def4cf5f39c871 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 15:19:55 +0000 +Subject: crypto: qat - remove unused macros in qat_comp_alg.c + +From: Adam Guerin + +[ Upstream commit dfff0e35fa5dd84ae75052ba129b0219d83e46dc ] + +As a result of the removal of qat_zlib_deflate, some defines where not +removed. Remove them. + +This is to fix the following warning when compiling the QAT driver +using the clang compiler with CC=clang W=2: + drivers/crypto/intel/qat/qat_common/qat_comp_algs.c:21:9: warning: macro is not used [-Wunused-macros] + 21 | #define QAT_RFC_1950_CM_OFFSET 4 + | ^ + drivers/crypto/intel/qat/qat_common/qat_comp_algs.c:16:9: warning: macro is not used [-Wunused-macros] + 16 | #define QAT_RFC_1950_HDR_SIZE 2 + | ^ + drivers/crypto/intel/qat/qat_common/qat_comp_algs.c:17:9: warning: macro is not used [-Wunused-macros] + 17 | #define QAT_RFC_1950_FOOTER_SIZE 4 + | ^ + drivers/crypto/intel/qat/qat_common/qat_comp_algs.c:22:9: warning: macro is not used [-Wunused-macros] + 22 | #define QAT_RFC_1950_DICT_MASK 0x20 + | ^ + drivers/crypto/intel/qat/qat_common/qat_comp_algs.c:18:9: warning: macro is not used [-Wunused-macros] + 18 | #define QAT_RFC_1950_CM_DEFLATE 8 + | ^ + drivers/crypto/intel/qat/qat_common/qat_comp_algs.c:20:9: warning: macro is not used [-Wunused-macros] + 20 | #define QAT_RFC_1950_CM_MASK 0x0f + | ^ + drivers/crypto/intel/qat/qat_common/qat_comp_algs.c:23:9: warning: macro is not used [-Wunused-macros] + 23 | #define QAT_RFC_1950_COMP_HDR 0x785e + | ^ + drivers/crypto/intel/qat/qat_common/qat_comp_algs.c:19:9: warning: macro is not used [-Wunused-macros] + 19 | #define QAT_RFC_1950_CM_DEFLATE_CINFO_32K 7 + | ^ + +Fixes: e9dd20e0e5f6 ("crypto: qat - Remove zlib-deflate") +Signed-off-by: Adam Guerin +Reviewed-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/intel/qat/qat_common/qat_comp_algs.c | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/drivers/crypto/intel/qat/qat_common/qat_comp_algs.c b/drivers/crypto/intel/qat/qat_common/qat_comp_algs.c +index bf8c0ee629175..2ba4aa22e0927 100644 +--- a/drivers/crypto/intel/qat/qat_common/qat_comp_algs.c ++++ b/drivers/crypto/intel/qat/qat_common/qat_comp_algs.c +@@ -13,15 +13,6 @@ + #include "qat_compression.h" + #include "qat_algs_send.h" + +-#define QAT_RFC_1950_HDR_SIZE 2 +-#define QAT_RFC_1950_FOOTER_SIZE 4 +-#define QAT_RFC_1950_CM_DEFLATE 8 +-#define QAT_RFC_1950_CM_DEFLATE_CINFO_32K 7 +-#define QAT_RFC_1950_CM_MASK 0x0f +-#define QAT_RFC_1950_CM_OFFSET 4 +-#define QAT_RFC_1950_DICT_MASK 0x20 +-#define QAT_RFC_1950_COMP_HDR 0x785e +- + static DEFINE_MUTEX(algs_lock); + static unsigned int active_devs; + +-- +2.43.0 + diff --git a/queue-6.7/crypto-qat-removed-unused-macro-in-adf_cnv_dbgfs.c.patch b/queue-6.7/crypto-qat-removed-unused-macro-in-adf_cnv_dbgfs.c.patch new file mode 100644 index 00000000000..1051fd4cbff --- /dev/null +++ b/queue-6.7/crypto-qat-removed-unused-macro-in-adf_cnv_dbgfs.c.patch @@ -0,0 +1,41 @@ +From 131c33aa187e3d79885583c6ad078c9df354e16d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 15:19:56 +0000 +Subject: crypto: qat - removed unused macro in adf_cnv_dbgfs.c + +From: Adam Guerin + +[ Upstream commit 9a5dcada14d5e027856a1bc38443e54111438da6 ] + +This macro was added but never used, remove it. + +This is to fix the following warning when compiling the QAT driver +using the clang compiler with CC=clang W=2: + drivers/crypto/intel/qat/qat_common/adf_cnv_dbgfs.c:19:9: warning: macro is not used [-Wunused-macros] + 19 | #define CNV_SLICE_ERR_MASK GENMASK(7, 0) + | ^ + +Fixes: d807f0240c71 ("crypto: qat - add cnv_errors debugfs file") +Signed-off-by: Adam Guerin +Reviewed-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/intel/qat/qat_common/adf_cnv_dbgfs.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/crypto/intel/qat/qat_common/adf_cnv_dbgfs.c b/drivers/crypto/intel/qat/qat_common/adf_cnv_dbgfs.c +index 07119c487da01..627953a72d478 100644 +--- a/drivers/crypto/intel/qat/qat_common/adf_cnv_dbgfs.c ++++ b/drivers/crypto/intel/qat/qat_common/adf_cnv_dbgfs.c +@@ -16,7 +16,6 @@ + + #define CNV_ERR_INFO_MASK GENMASK(11, 0) + #define CNV_ERR_TYPE_MASK GENMASK(15, 12) +-#define CNV_SLICE_ERR_MASK GENMASK(7, 0) + #define CNV_SLICE_ERR_SIGN_BIT_INDEX 7 + #define CNV_DELTA_ERR_SIGN_BIT_INDEX 11 + +-- +2.43.0 + diff --git a/queue-6.7/crypto-xilinx-call-finalize-with-bh-disabled.patch b/queue-6.7/crypto-xilinx-call-finalize-with-bh-disabled.patch new file mode 100644 index 00000000000..bab259b0f4b --- /dev/null +++ b/queue-6.7/crypto-xilinx-call-finalize-with-bh-disabled.patch @@ -0,0 +1,72 @@ +From 51083dc81c402e3106b1fc05c454cce2d391ed87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Jan 2024 12:29:06 +0800 +Subject: crypto: xilinx - call finalize with bh disabled + +From: Quanyang Wang + +[ Upstream commit a853450bf4c752e664abab0b2fad395b7ad7701c ] + +When calling crypto_finalize_request, BH should be disabled to avoid +triggering the following calltrace: + + ------------[ cut here ]------------ + WARNING: CPU: 2 PID: 74 at crypto/crypto_engine.c:58 crypto_finalize_request+0xa0/0x118 + Modules linked in: cryptodev(O) + CPU: 2 PID: 74 Comm: firmware:zynqmp Tainted: G O 6.8.0-rc1-yocto-standard #323 + Hardware name: ZynqMP ZCU102 Rev1.0 (DT) + pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : crypto_finalize_request+0xa0/0x118 + lr : crypto_finalize_request+0x104/0x118 + sp : ffffffc085353ce0 + x29: ffffffc085353ce0 x28: 0000000000000000 x27: ffffff8808ea8688 + x26: ffffffc081715038 x25: 0000000000000000 x24: ffffff880100db00 + x23: ffffff880100da80 x22: 0000000000000000 x21: 0000000000000000 + x20: ffffff8805b14000 x19: ffffff880100da80 x18: 0000000000010450 + x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 + x14: 0000000000000003 x13: 0000000000000000 x12: ffffff880100dad0 + x11: 0000000000000000 x10: ffffffc0832dcd08 x9 : ffffffc0812416d8 + x8 : 00000000000001f4 x7 : ffffffc0830d2830 x6 : 0000000000000001 + x5 : ffffffc082091000 x4 : ffffffc082091658 x3 : 0000000000000000 + x2 : ffffffc7f9653000 x1 : 0000000000000000 x0 : ffffff8802d20000 + Call trace: + crypto_finalize_request+0xa0/0x118 + crypto_finalize_aead_request+0x18/0x30 + zynqmp_handle_aes_req+0xcc/0x388 + crypto_pump_work+0x168/0x2d8 + kthread_worker_fn+0xfc/0x3a0 + kthread+0x118/0x138 + ret_from_fork+0x10/0x20 + irq event stamp: 40 + hardirqs last enabled at (39): [] _raw_spin_unlock_irqrestore+0x70/0xb0 + hardirqs last disabled at (40): [] el1_dbg+0x28/0x90 + softirqs last enabled at (36): [] kernel_neon_begin+0x8c/0xf0 + softirqs last disabled at (34): [] kernel_neon_begin+0x60/0xf0 + ---[ end trace 0000000000000000 ]--- + +Fixes: 4d96f7d48131 ("crypto: xilinx - Add Xilinx AES driver") +Signed-off-by: Quanyang Wang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/xilinx/zynqmp-aes-gcm.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/crypto/xilinx/zynqmp-aes-gcm.c b/drivers/crypto/xilinx/zynqmp-aes-gcm.c +index 3c205324b22b6..e614057188409 100644 +--- a/drivers/crypto/xilinx/zynqmp-aes-gcm.c ++++ b/drivers/crypto/xilinx/zynqmp-aes-gcm.c +@@ -231,7 +231,10 @@ static int zynqmp_handle_aes_req(struct crypto_engine *engine, + err = zynqmp_aes_aead_cipher(areq); + } + ++ local_bh_disable(); + crypto_finalize_aead_request(engine, areq, err); ++ local_bh_enable(); ++ + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.7/devlink-fix-length-of-eswitch-inline-mode.patch b/queue-6.7/devlink-fix-length-of-eswitch-inline-mode.patch new file mode 100644 index 00000000000..c54d5fae20b --- /dev/null +++ b/queue-6.7/devlink-fix-length-of-eswitch-inline-mode.patch @@ -0,0 +1,58 @@ +From 63987aacdebf7e773f956f7a09df0b0073ab3572 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Mar 2024 18:45:47 +0200 +Subject: devlink: Fix length of eswitch inline-mode + +From: William Tu + +[ Upstream commit 8f4cd89bf10607de08231d6d91a73dd63336808e ] + +Set eswitch inline-mode to be u8, not u16. Otherwise, errors below + +$ devlink dev eswitch set pci/0000:08:00.0 mode switchdev \ + inline-mode network + Error: Attribute failed policy validation. + kernel answers: Numerical result out of rang + netlink: 'devlink': attribute type 26 has an invalid length. + +Fixes: f2f9dd164db0 ("netlink: specs: devlink: add the remaining command to generate complete split_ops") +Signed-off-by: William Tu +Reviewed-by: Jiri Pirko +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20240310164547.35219-1-witu@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + Documentation/netlink/specs/devlink.yaml | 2 +- + net/devlink/netlink_gen.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/Documentation/netlink/specs/devlink.yaml b/Documentation/netlink/specs/devlink.yaml +index 572d83a414d0d..42a9d77803b2b 100644 +--- a/Documentation/netlink/specs/devlink.yaml ++++ b/Documentation/netlink/specs/devlink.yaml +@@ -244,7 +244,7 @@ attribute-sets: + + - + name: eswitch-inline-mode +- type: u16 ++ type: u8 + enum: eswitch-inline-mode + - + name: dpipe-tables +diff --git a/net/devlink/netlink_gen.c b/net/devlink/netlink_gen.c +index 788dfdc498a95..371f27f653317 100644 +--- a/net/devlink/netlink_gen.c ++++ b/net/devlink/netlink_gen.c +@@ -198,7 +198,7 @@ static const struct nla_policy devlink_eswitch_set_nl_policy[DEVLINK_ATTR_ESWITC + [DEVLINK_ATTR_BUS_NAME] = { .type = NLA_NUL_STRING, }, + [DEVLINK_ATTR_DEV_NAME] = { .type = NLA_NUL_STRING, }, + [DEVLINK_ATTR_ESWITCH_MODE] = NLA_POLICY_MAX(NLA_U16, 1), +- [DEVLINK_ATTR_ESWITCH_INLINE_MODE] = NLA_POLICY_MAX(NLA_U16, 3), ++ [DEVLINK_ATTR_ESWITCH_INLINE_MODE] = NLA_POLICY_MAX(NLA_U8, 3), + [DEVLINK_ATTR_ESWITCH_ENCAP_MODE] = NLA_POLICY_MAX(NLA_U8, 1), + }; + +-- +2.43.0 + diff --git a/queue-6.7/dm-call-the-resume-method-on-internal-suspend.patch b/queue-6.7/dm-call-the-resume-method-on-internal-suspend.patch new file mode 100644 index 00000000000..c5f45ece6d6 --- /dev/null +++ b/queue-6.7/dm-call-the-resume-method-on-internal-suspend.patch @@ -0,0 +1,123 @@ +From ee46f088bdd1daa9355a38fae647f3f5bdabcf9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Mar 2024 15:06:39 +0100 +Subject: dm: call the resume method on internal suspend + +From: Mikulas Patocka + +[ Upstream commit 65e8fbde64520001abf1c8d0e573561b4746ef38 ] + +There is this reported crash when experimenting with the lvm2 testsuite. +The list corruption is caused by the fact that the postsuspend and resume +methods were not paired correctly; there were two consecutive calls to the +origin_postsuspend function. The second call attempts to remove the +"hash_list" entry from a list, while it was already removed by the first +call. + +Fix __dm_internal_resume so that it calls the preresume and resume +methods of the table's targets. + +If a preresume method of some target fails, we are in a tricky situation. +We can't return an error because dm_internal_resume isn't supposed to +return errors. We can't return success, because then the "resume" and +"postsuspend" methods would not be paired correctly. So, we set the +DMF_SUSPENDED flag and we fake normal suspend - it may confuse userspace +tools, but it won't cause a kernel crash. + +------------[ cut here ]------------ +kernel BUG at lib/list_debug.c:56! +invalid opcode: 0000 [#1] PREEMPT SMP +CPU: 1 PID: 8343 Comm: dmsetup Not tainted 6.8.0-rc6 #4 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 +RIP: 0010:__list_del_entry_valid_or_report+0x77/0xc0 + +RSP: 0018:ffff8881b831bcc0 EFLAGS: 00010282 +RAX: 000000000000004e RBX: ffff888143b6eb80 RCX: 0000000000000000 +RDX: 0000000000000001 RSI: ffffffff819053d0 RDI: 00000000ffffffff +RBP: ffff8881b83a3400 R08: 00000000fffeffff R09: 0000000000000058 +R10: 0000000000000000 R11: ffffffff81a24080 R12: 0000000000000001 +R13: ffff88814538e000 R14: ffff888143bc6dc0 R15: ffffffffa02e4bb0 +FS: 00000000f7c0f780(0000) GS:ffff8893f0a40000(0000) knlGS:0000000000000000 +CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 +CR2: 0000000057fb5000 CR3: 0000000143474000 CR4: 00000000000006b0 +Call Trace: + + ? die+0x2d/0x80 + ? do_trap+0xeb/0xf0 + ? __list_del_entry_valid_or_report+0x77/0xc0 + ? do_error_trap+0x60/0x80 + ? __list_del_entry_valid_or_report+0x77/0xc0 + ? exc_invalid_op+0x49/0x60 + ? __list_del_entry_valid_or_report+0x77/0xc0 + ? asm_exc_invalid_op+0x16/0x20 + ? table_deps+0x1b0/0x1b0 [dm_mod] + ? __list_del_entry_valid_or_report+0x77/0xc0 + origin_postsuspend+0x1a/0x50 [dm_snapshot] + dm_table_postsuspend_targets+0x34/0x50 [dm_mod] + dm_suspend+0xd8/0xf0 [dm_mod] + dev_suspend+0x1f2/0x2f0 [dm_mod] + ? table_deps+0x1b0/0x1b0 [dm_mod] + ctl_ioctl+0x300/0x5f0 [dm_mod] + dm_compat_ctl_ioctl+0x7/0x10 [dm_mod] + __x64_compat_sys_ioctl+0x104/0x170 + do_syscall_64+0x184/0x1b0 + entry_SYSCALL_64_after_hwframe+0x46/0x4e +RIP: 0033:0xf7e6aead + +---[ end trace 0000000000000000 ]--- + +Fixes: ffcc39364160 ("dm: enhance internal suspend and resume interface") +Signed-off-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm.c | 26 ++++++++++++++++++++------ + 1 file changed, 20 insertions(+), 6 deletions(-) + +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index 23c32cd1f1d88..4ff9bebb81ad5 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -2945,6 +2945,9 @@ static void __dm_internal_suspend(struct mapped_device *md, unsigned int suspend + + static void __dm_internal_resume(struct mapped_device *md) + { ++ int r; ++ struct dm_table *map; ++ + BUG_ON(!md->internal_suspend_count); + + if (--md->internal_suspend_count) +@@ -2953,12 +2956,23 @@ static void __dm_internal_resume(struct mapped_device *md) + if (dm_suspended_md(md)) + goto done; /* resume from nested suspend */ + +- /* +- * NOTE: existing callers don't need to call dm_table_resume_targets +- * (which may fail -- so best to avoid it for now by passing NULL map) +- */ +- (void) __dm_resume(md, NULL); +- ++ map = rcu_dereference_protected(md->map, lockdep_is_held(&md->suspend_lock)); ++ r = __dm_resume(md, map); ++ if (r) { ++ /* ++ * If a preresume method of some target failed, we are in a ++ * tricky situation. We can't return an error to the caller. We ++ * can't fake success because then the "resume" and ++ * "postsuspend" methods would not be paired correctly, and it ++ * would break various targets, for example it would cause list ++ * corruption in the "origin" target. ++ * ++ * So, we fake normal suspend here, to make sure that the ++ * "resume" and "postsuspend" methods will be paired correctly. ++ */ ++ DMERR("Preresume method failed: %d", r); ++ set_bit(DMF_SUSPENDED, &md->flags); ++ } + done: + clear_bit(DMF_SUSPENDED_INTERNALLY, &md->flags); + smp_mb__after_atomic(); +-- +2.43.0 + diff --git a/queue-6.7/dm-raid-fix-false-positive-for-requeue-needed-during.patch b/queue-6.7/dm-raid-fix-false-positive-for-requeue-needed-during.patch new file mode 100644 index 00000000000..d50b4a39921 --- /dev/null +++ b/queue-6.7/dm-raid-fix-false-positive-for-requeue-needed-during.patch @@ -0,0 +1,46 @@ +From 23e25e3ffcdd59a5a002589ecbab43183c26a954 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Mar 2024 13:42:55 -0400 +Subject: dm raid: fix false positive for requeue needed during reshape + +From: Ming Lei + +[ Upstream commit b25b8f4b8ecef0f48c05f0c3572daeabefe16526 ] + +An empty flush doesn't have a payload, so it should never be looked at +when considering to possibly requeue a bio for the case when a reshape +is in progress. + +Fixes: 9dbd1aa3a81c ("dm raid: add reshaping support to the target") +Reported-by: Patrick Plenefisch +Signed-off-by: Ming Lei +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-raid.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c +index eb009d6bb03a1..13eb47b997f94 100644 +--- a/drivers/md/dm-raid.c ++++ b/drivers/md/dm-raid.c +@@ -3329,14 +3329,14 @@ static int raid_map(struct dm_target *ti, struct bio *bio) + struct mddev *mddev = &rs->md; + + /* +- * If we're reshaping to add disk(s)), ti->len and ++ * If we're reshaping to add disk(s), ti->len and + * mddev->array_sectors will differ during the process + * (ti->len > mddev->array_sectors), so we have to requeue + * bios with addresses > mddev->array_sectors here or + * there will occur accesses past EOD of the component + * data images thus erroring the raid set. + */ +- if (unlikely(bio_end_sector(bio) > mddev->array_sectors)) ++ if (unlikely(bio_has_data(bio) && bio_end_sector(bio) > mddev->array_sectors)) + return DM_MAPIO_REQUEUE; + + md_handle_request(mddev, bio); +-- +2.43.0 + diff --git a/queue-6.7/dmaengine-tegra210-adma-update-dependency-to-arch_te.patch b/queue-6.7/dmaengine-tegra210-adma-update-dependency-to-arch_te.patch new file mode 100644 index 00000000000..90302d9644e --- /dev/null +++ b/queue-6.7/dmaengine-tegra210-adma-update-dependency-to-arch_te.patch @@ -0,0 +1,60 @@ +From 33b1dcea5808d138156e7b4395fa07154ac04036 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jan 2024 09:32:56 +0000 +Subject: dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA + +From: Peter Robinson + +[ Upstream commit 33b7db45533af240fe44e809f9dc4d604cf82d07 ] + +Update the architecture dependency to be the generic Tegra +because the driver works on the four latest Tegra generations +not just T210, if you build a kernel with a specific +ARCH_TEGRA_xxx_SOC option that excludes 210 you don't get +this driver. + +Fixes: 433de642a76c9 ("dmaengine: tegra210-adma: add support for Tegra186/Tegra194") +Signed-off-by: Peter Robinson +Cc: Jon Hunter +Cc: Thierry Reding +Cc: Sameer Pujar +Cc: Laxman Dewangan +Reviewed-by: Jon Hunter +Link: https://lore.kernel.org/r/20240112093310.329642-2-pbrobinson@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/Kconfig | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig +index 70ba506dabab5..de6eb370d485d 100644 +--- a/drivers/dma/Kconfig ++++ b/drivers/dma/Kconfig +@@ -629,16 +629,16 @@ config TEGRA20_APB_DMA + + config TEGRA210_ADMA + tristate "NVIDIA Tegra210 ADMA support" +- depends on (ARCH_TEGRA_210_SOC || COMPILE_TEST) ++ depends on (ARCH_TEGRA || COMPILE_TEST) + select DMA_ENGINE + select DMA_VIRTUAL_CHANNELS + help +- Support for the NVIDIA Tegra210 ADMA controller driver. The +- DMA controller has multiple DMA channels and is used to service +- various audio clients in the Tegra210 audio processing engine +- (APE). This DMA controller transfers data from memory to +- peripheral and vice versa. It does not support memory to +- memory data transfer. ++ Support for the NVIDIA Tegra210/Tegra186/Tegra194/Tegra234 ADMA ++ controller driver. The DMA controller has multiple DMA channels ++ and is used to service various audio clients in the Tegra210 ++ audio processing engine (APE). This DMA controller transfers ++ data from memory to peripheral and vice versa. It does not ++ support memory to memory data transfer. + + config TIMB_DMA + tristate "Timberdale FPGA DMA support" +-- +2.43.0 + diff --git a/queue-6.7/do_sys_name_to_handle-use-kzalloc-to-fix-kernel-info.patch b/queue-6.7/do_sys_name_to_handle-use-kzalloc-to-fix-kernel-info.patch new file mode 100644 index 00000000000..38696aa5afd --- /dev/null +++ b/queue-6.7/do_sys_name_to_handle-use-kzalloc-to-fix-kernel-info.patch @@ -0,0 +1,72 @@ +From 08fe8ee7912a38e7f10521233a9556ed80bfac6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jan 2024 07:39:06 -0800 +Subject: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak + +From: Nikita Zhandarovich + +[ Upstream commit 3948abaa4e2be938ccdfc289385a27342fb13d43 ] + +syzbot identified a kernel information leak vulnerability in +do_sys_name_to_handle() and issued the following report [1]. + +[1] +"BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] +BUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x100 lib/usercopy.c:40 + instrument_copy_to_user include/linux/instrumented.h:114 [inline] + _copy_to_user+0xbc/0x100 lib/usercopy.c:40 + copy_to_user include/linux/uaccess.h:191 [inline] + do_sys_name_to_handle fs/fhandle.c:73 [inline] + __do_sys_name_to_handle_at fs/fhandle.c:112 [inline] + __se_sys_name_to_handle_at+0x949/0xb10 fs/fhandle.c:94 + __x64_sys_name_to_handle_at+0xe4/0x140 fs/fhandle.c:94 + ... + +Uninit was created at: + slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 + slab_alloc_node mm/slub.c:3478 [inline] + __kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517 + __do_kmalloc_node mm/slab_common.c:1006 [inline] + __kmalloc+0x121/0x3c0 mm/slab_common.c:1020 + kmalloc include/linux/slab.h:604 [inline] + do_sys_name_to_handle fs/fhandle.c:39 [inline] + __do_sys_name_to_handle_at fs/fhandle.c:112 [inline] + __se_sys_name_to_handle_at+0x441/0xb10 fs/fhandle.c:94 + __x64_sys_name_to_handle_at+0xe4/0x140 fs/fhandle.c:94 + ... + +Bytes 18-19 of 20 are uninitialized +Memory access of size 20 starts at ffff888128a46380 +Data copied to user address 0000000020000240" + +Per Chuck Lever's suggestion, use kzalloc() instead of kmalloc() to +solve the problem. + +Fixes: 990d6c2d7aee ("vfs: Add name to file handle conversion support") +Suggested-by: Chuck Lever III +Reported-and-tested-by: +Signed-off-by: Nikita Zhandarovich +Link: https://lore.kernel.org/r/20240119153906.4367-1-n.zhandarovich@fintech.ru +Reviewed-by: Jan Kara +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/fhandle.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/fhandle.c b/fs/fhandle.c +index 18b3ba8dc8ead..57a12614addfd 100644 +--- a/fs/fhandle.c ++++ b/fs/fhandle.c +@@ -36,7 +36,7 @@ static long do_sys_name_to_handle(const struct path *path, + if (f_handle.handle_bytes > MAX_HANDLE_SZ) + return -EINVAL; + +- handle = kmalloc(sizeof(struct file_handle) + f_handle.handle_bytes, ++ handle = kzalloc(sizeof(struct file_handle) + f_handle.handle_bytes, + GFP_KERNEL); + if (!handle) + return -ENOMEM; +-- +2.43.0 + diff --git a/queue-6.7/dpll-fix-dpll_xa_ref_-_del-for-multiple-registration.patch b/queue-6.7/dpll-fix-dpll_xa_ref_-_del-for-multiple-registration.patch new file mode 100644 index 00000000000..180cc3e9bf3 --- /dev/null +++ b/queue-6.7/dpll-fix-dpll_xa_ref_-_del-for-multiple-registration.patch @@ -0,0 +1,63 @@ +From f77f60737da8c4dcb73a8484615b19b8368ebd10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 16:12:40 +0100 +Subject: dpll: fix dpll_xa_ref_*_del() for multiple registrations + +From: Jiri Pirko + +[ Upstream commit b446631f355ece73b13c311dd712c47381a23172 ] + +Currently, if there are multiple registrations of the same pin on the +same dpll device, following warnings are observed: +WARNING: CPU: 5 PID: 2212 at drivers/dpll/dpll_core.c:143 dpll_xa_ref_pin_del.isra.0+0x21e/0x230 +WARNING: CPU: 5 PID: 2212 at drivers/dpll/dpll_core.c:223 __dpll_pin_unregister+0x2b3/0x2c0 + +The problem is, that in both dpll_xa_ref_dpll_del() and +dpll_xa_ref_pin_del() registration is only removed from list in case the +reference count drops to zero. That is wrong, the registration has to +be removed always. + +To fix this, remove the registration from the list and free +it unconditionally, instead of doing it only when the ref reference +counter reaches zero. + +Fixes: 9431063ad323 ("dpll: core: Add DPLL framework base functions") +Signed-off-by: Jiri Pirko +Reviewed-by: Rahul Rameshbabu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/dpll/dpll_core.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/dpll/dpll_core.c b/drivers/dpll/dpll_core.c +index f8fbf03942888..e72ebdf621509 100644 +--- a/drivers/dpll/dpll_core.c ++++ b/drivers/dpll/dpll_core.c +@@ -128,9 +128,9 @@ static int dpll_xa_ref_pin_del(struct xarray *xa_pins, struct dpll_pin *pin, + reg = dpll_pin_registration_find(ref, ops, priv); + if (WARN_ON(!reg)) + return -EINVAL; ++ list_del(®->list); ++ kfree(reg); + if (refcount_dec_and_test(&ref->refcount)) { +- list_del(®->list); +- kfree(reg); + xa_erase(xa_pins, i); + WARN_ON(!list_empty(&ref->registration_list)); + kfree(ref); +@@ -208,9 +208,9 @@ dpll_xa_ref_dpll_del(struct xarray *xa_dplls, struct dpll_device *dpll, + reg = dpll_pin_registration_find(ref, ops, priv); + if (WARN_ON(!reg)) + return; ++ list_del(®->list); ++ kfree(reg); + if (refcount_dec_and_test(&ref->refcount)) { +- list_del(®->list); +- kfree(reg); + xa_erase(xa_dplls, i); + WARN_ON(!list_empty(&ref->registration_list)); + kfree(ref); +-- +2.43.0 + diff --git a/queue-6.7/dpll-spec-use-proper-enum-for-pin-capabilities-attri.patch b/queue-6.7/dpll-spec-use-proper-enum-for-pin-capabilities-attri.patch new file mode 100644 index 00000000000..b37d674defc --- /dev/null +++ b/queue-6.7/dpll-spec-use-proper-enum-for-pin-capabilities-attri.patch @@ -0,0 +1,48 @@ +From df2a58f601889d2f3464ea2749d364f643f3a495 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 13:07:39 +0100 +Subject: dpll: spec: use proper enum for pin capabilities attribute + +From: Jiri Pirko + +[ Upstream commit 5c497a64820ef9f10962a9c37607df45d6395fa5 ] + +The enum is defined, however the pin capabilities attribute does +refer to it. Add this missing enum field. + +This fixes ynl cli output: + +Example current output: +$ sudo ./tools/net/ynl/cli.py --spec Documentation/netlink/specs/dpll.yaml --do pin-get --json '{"id": 0}' +{'capabilities': 4, + ... +Example new output: +$ sudo ./tools/net/ynl/cli.py --spec Documentation/netlink/specs/dpll.yaml --do pin-get --json '{"id": 0}' +{'capabilities': {'state-can-change'}, + ... + +Fixes: 3badff3a25d8 ("dpll: spec: Add Netlink spec in YAML") +Signed-off-by: Jiri Pirko +Reviewed-by: Jakub Kicinski +Link: https://lore.kernel.org/r/20240306120739.1447621-1-jiri@resnulli.us +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + Documentation/netlink/specs/dpll.yaml | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/Documentation/netlink/specs/dpll.yaml b/Documentation/netlink/specs/dpll.yaml +index 2b4c4bcd83615..5b25ad589e3d0 100644 +--- a/Documentation/netlink/specs/dpll.yaml ++++ b/Documentation/netlink/specs/dpll.yaml +@@ -274,6 +274,7 @@ attribute-sets: + - + name: capabilities + type: u32 ++ enum: pin-capabilities + - + name: parent-device + type: nest +-- +2.43.0 + diff --git a/queue-6.7/drivers-ps3-select-video-to-provide-cmdline-function.patch b/queue-6.7/drivers-ps3-select-video-to-provide-cmdline-function.patch new file mode 100644 index 00000000000..925ac46b65b --- /dev/null +++ b/queue-6.7/drivers-ps3-select-video-to-provide-cmdline-function.patch @@ -0,0 +1,52 @@ +From f40a024aac917811317ffa72fe5a9a5103905a05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Feb 2024 08:13:22 -0800 +Subject: drivers/ps3: select VIDEO to provide cmdline functions + +From: Randy Dunlap + +[ Upstream commit 7edd06233958d9086a9e3eb723a8768d3c5a9ce1 ] + +When VIDEO is not set, there is a build error. Fix that by selecting +VIDEO for PS3_PS3AV. + +ERROR: modpost: ".video_get_options" [drivers/ps3/ps3av_mod.ko] undefined! + +Fixes: dae7fbf43fd0 ("driver/ps3: Include