From: Sasha Levin Date: Mon, 7 Nov 2022 04:04:22 +0000 (-0500) Subject: Fixes for 6.0 X-Git-Tag: v4.9.333~80 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a890606c971c465faf77c3ebd7540054c53fe22f;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.0 Signed-off-by: Sasha Levin --- diff --git a/queue-6.0/acpi-apei-fix-integer-overflow-in-ghes_estatus_pool_.patch b/queue-6.0/acpi-apei-fix-integer-overflow-in-ghes_estatus_pool_.patch new file mode 100644 index 00000000000..479b8b9e850 --- /dev/null +++ b/queue-6.0/acpi-apei-fix-integer-overflow-in-ghes_estatus_pool_.patch @@ -0,0 +1,83 @@ +From f3f573e99605abd147c9c3266d51ed61650fb70e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Oct 2022 16:32:53 +0000 +Subject: ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init() + +From: Ashish Kalra + +[ Upstream commit 43d2748394c3feb86c0c771466f5847e274fc043 ] + +Change num_ghes from int to unsigned int, preventing an overflow +and causing subsequent vmalloc() to fail. + +The overflow happens in ghes_estatus_pool_init() when calculating +len during execution of the statement below as both multiplication +operands here are signed int: + +len += (num_ghes * GHES_ESOURCE_PREALLOC_MAX_SIZE); + +The following call trace is observed because of this bug: + +[ 9.317108] swapper/0: vmalloc error: size 18446744071562596352, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 +[ 9.317131] Call Trace: +[ 9.317134] +[ 9.317137] dump_stack_lvl+0x49/0x5f +[ 9.317145] dump_stack+0x10/0x12 +[ 9.317146] warn_alloc.cold+0x7b/0xdf +[ 9.317150] ? __device_attach+0x16a/0x1b0 +[ 9.317155] __vmalloc_node_range+0x702/0x740 +[ 9.317160] ? device_add+0x17f/0x920 +[ 9.317164] ? dev_set_name+0x53/0x70 +[ 9.317166] ? platform_device_add+0xf9/0x240 +[ 9.317168] __vmalloc_node+0x49/0x50 +[ 9.317170] ? ghes_estatus_pool_init+0x43/0xa0 +[ 9.317176] vmalloc+0x21/0x30 +[ 9.317177] ghes_estatus_pool_init+0x43/0xa0 +[ 9.317179] acpi_hest_init+0x129/0x19c +[ 9.317185] acpi_init+0x434/0x4a4 +[ 9.317188] ? acpi_sleep_proc_init+0x2a/0x2a +[ 9.317190] do_one_initcall+0x48/0x200 +[ 9.317195] kernel_init_freeable+0x221/0x284 +[ 9.317200] ? rest_init+0xe0/0xe0 +[ 9.317204] kernel_init+0x1a/0x130 +[ 9.317205] ret_from_fork+0x22/0x30 +[ 9.317208] + +Signed-off-by: Ashish Kalra +[ rjw: Subject and changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/apei/ghes.c | 2 +- + include/acpi/ghes.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c +index 80ad530583c9..9952f3a792ba 100644 +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -163,7 +163,7 @@ static void ghes_unmap(void __iomem *vaddr, enum fixed_addresses fixmap_idx) + clear_fixmap(fixmap_idx); + } + +-int ghes_estatus_pool_init(int num_ghes) ++int ghes_estatus_pool_init(unsigned int num_ghes) + { + unsigned long addr, len; + int rc; +diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h +index 34fb3431a8f3..292a5c40bd0c 100644 +--- a/include/acpi/ghes.h ++++ b/include/acpi/ghes.h +@@ -71,7 +71,7 @@ int ghes_register_vendor_record_notifier(struct notifier_block *nb); + void ghes_unregister_vendor_record_notifier(struct notifier_block *nb); + #endif + +-int ghes_estatus_pool_init(int num_ghes); ++int ghes_estatus_pool_init(unsigned int num_ghes); + + /* From drivers/edac/ghes_edac.c */ + +-- +2.35.1 + diff --git a/queue-6.0/arm-dts-imx6qdl-gw59-10-13-fix-user-pushbutton-gpio-.patch b/queue-6.0/arm-dts-imx6qdl-gw59-10-13-fix-user-pushbutton-gpio-.patch new file mode 100644 index 00000000000..8ba31d0cb27 --- /dev/null +++ b/queue-6.0/arm-dts-imx6qdl-gw59-10-13-fix-user-pushbutton-gpio-.patch @@ -0,0 +1,50 @@ +From 53021ab448cfa28e5de6790911dfc041461dcda9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Sep 2022 12:52:22 -0700 +Subject: ARM: dts: imx6qdl-gw59{10,13}: fix user pushbutton GPIO offset + +From: Tim Harvey + +[ Upstream commit bb5ad73941dc3f4e3c2241348f385da6501d50ea ] + +The GW5910 and GW5913 have a user pushbutton that is tied to the +Gateworks System Controller GPIO offset 2. Fix the invalid offset of 0. + +Fixes: 64bf0a0af18d ("ARM: dts: imx6qdl-gw: add Gateworks System Controller support") +Signed-off-by: Tim Harvey +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-gw5910.dtsi | 2 +- + arch/arm/boot/dts/imx6qdl-gw5913.dtsi | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-gw5910.dtsi b/arch/arm/boot/dts/imx6qdl-gw5910.dtsi +index 68e5ab2e27e2..6bb4855d13ce 100644 +--- a/arch/arm/boot/dts/imx6qdl-gw5910.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-gw5910.dtsi +@@ -29,7 +29,7 @@ gpio-keys { + + user-pb { + label = "user_pb"; +- gpios = <&gsc_gpio 0 GPIO_ACTIVE_LOW>; ++ gpios = <&gsc_gpio 2 GPIO_ACTIVE_LOW>; + linux,code = ; + }; + +diff --git a/arch/arm/boot/dts/imx6qdl-gw5913.dtsi b/arch/arm/boot/dts/imx6qdl-gw5913.dtsi +index 8e23cec7149e..696427b487f0 100644 +--- a/arch/arm/boot/dts/imx6qdl-gw5913.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-gw5913.dtsi +@@ -26,7 +26,7 @@ gpio-keys { + + user-pb { + label = "user_pb"; +- gpios = <&gsc_gpio 0 GPIO_ACTIVE_LOW>; ++ gpios = <&gsc_gpio 2 GPIO_ACTIVE_LOW>; + linux,code = ; + }; + +-- +2.35.1 + diff --git a/queue-6.0/arm-dts-ux500-add-trips-to-battery-thermal-zones.patch b/queue-6.0/arm-dts-ux500-add-trips-to-battery-thermal-zones.patch new file mode 100644 index 00000000000..b97da98dc8b --- /dev/null +++ b/queue-6.0/arm-dts-ux500-add-trips-to-battery-thermal-zones.patch @@ -0,0 +1,212 @@ +From 73df6622d89f9042b29cfacf26b4a92d32594878 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Oct 2022 22:08:54 +0100 +Subject: ARM: dts: ux500: Add trips to battery thermal zones + +From: Linus Walleij + +[ Upstream commit cd73adcdbad3d9e9923b045d3643409e9c148d17 ] + +Recent changes to the thermal framework has made the trip +points (trips) for thermal zones compulsory, which made +the Ux500 DTS files break validation and also stopped +probing because of similar changes to the code. + +Fix this by adding an "outer bounding box": battery thermal +zones should not get warmer than 70 degress, then we will +shut down. + +Fixes: 8c596324232d ("dt-bindings: thermal: Fix missing required property") +Fixes: 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree initialization") +Signed-off-by: Linus Walleij +Cc: Daniel Lezcano +Cc: linux-pm@vger.kernel.org +Link: https://lore.kernel.org/r/20221030210854.346662-1-linus.walleij@linaro.org' +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ste-href.dtsi | 8 ++++++++ + arch/arm/boot/dts/ste-snowball.dts | 8 ++++++++ + arch/arm/boot/dts/ste-ux500-samsung-codina-tmo.dts | 8 ++++++++ + arch/arm/boot/dts/ste-ux500-samsung-codina.dts | 8 ++++++++ + arch/arm/boot/dts/ste-ux500-samsung-gavini.dts | 8 ++++++++ + arch/arm/boot/dts/ste-ux500-samsung-golden.dts | 8 ++++++++ + arch/arm/boot/dts/ste-ux500-samsung-janice.dts | 8 ++++++++ + arch/arm/boot/dts/ste-ux500-samsung-kyle.dts | 8 ++++++++ + arch/arm/boot/dts/ste-ux500-samsung-skomer.dts | 8 ++++++++ + 9 files changed, 72 insertions(+) + +diff --git a/arch/arm/boot/dts/ste-href.dtsi b/arch/arm/boot/dts/ste-href.dtsi +index fbaa0ce46427..8f1bb78fc1e4 100644 +--- a/arch/arm/boot/dts/ste-href.dtsi ++++ b/arch/arm/boot/dts/ste-href.dtsi +@@ -24,6 +24,14 @@ battery-thermal { + polling-delay = <0>; + polling-delay-passive = <0>; + thermal-sensors = <&bat_therm>; ++ ++ trips { ++ battery-crit-hi { ++ temperature = <70000>; ++ hysteresis = <2000>; ++ type = "critical"; ++ }; ++ }; + }; + }; + +diff --git a/arch/arm/boot/dts/ste-snowball.dts b/arch/arm/boot/dts/ste-snowball.dts +index 1c9094f24893..e2f0cdacba7d 100644 +--- a/arch/arm/boot/dts/ste-snowball.dts ++++ b/arch/arm/boot/dts/ste-snowball.dts +@@ -28,6 +28,14 @@ battery-thermal { + polling-delay = <0>; + polling-delay-passive = <0>; + thermal-sensors = <&bat_therm>; ++ ++ trips { ++ battery-crit-hi { ++ temperature = <70000>; ++ hysteresis = <2000>; ++ type = "critical"; ++ }; ++ }; + }; + }; + +diff --git a/arch/arm/boot/dts/ste-ux500-samsung-codina-tmo.dts b/arch/arm/boot/dts/ste-ux500-samsung-codina-tmo.dts +index d6940e0afa86..27a3ab7e25e1 100644 +--- a/arch/arm/boot/dts/ste-ux500-samsung-codina-tmo.dts ++++ b/arch/arm/boot/dts/ste-ux500-samsung-codina-tmo.dts +@@ -44,6 +44,14 @@ battery-thermal { + polling-delay = <0>; + polling-delay-passive = <0>; + thermal-sensors = <&bat_therm>; ++ ++ trips { ++ battery-crit-hi { ++ temperature = <70000>; ++ hysteresis = <2000>; ++ type = "critical"; ++ }; ++ }; + }; + }; + +diff --git a/arch/arm/boot/dts/ste-ux500-samsung-codina.dts b/arch/arm/boot/dts/ste-ux500-samsung-codina.dts +index 5f41256d7f4b..b88f0c07873d 100644 +--- a/arch/arm/boot/dts/ste-ux500-samsung-codina.dts ++++ b/arch/arm/boot/dts/ste-ux500-samsung-codina.dts +@@ -57,6 +57,14 @@ battery-thermal { + polling-delay = <0>; + polling-delay-passive = <0>; + thermal-sensors = <&bat_therm>; ++ ++ trips { ++ battery-crit-hi { ++ temperature = <70000>; ++ hysteresis = <2000>; ++ type = "critical"; ++ }; ++ }; + }; + }; + +diff --git a/arch/arm/boot/dts/ste-ux500-samsung-gavini.dts b/arch/arm/boot/dts/ste-ux500-samsung-gavini.dts +index 806da3fc33cd..7231bc745200 100644 +--- a/arch/arm/boot/dts/ste-ux500-samsung-gavini.dts ++++ b/arch/arm/boot/dts/ste-ux500-samsung-gavini.dts +@@ -30,6 +30,14 @@ battery-thermal { + polling-delay = <0>; + polling-delay-passive = <0>; + thermal-sensors = <&bat_therm>; ++ ++ trips { ++ battery-crit-hi { ++ temperature = <70000>; ++ hysteresis = <2000>; ++ type = "critical"; ++ }; ++ }; + }; + }; + +diff --git a/arch/arm/boot/dts/ste-ux500-samsung-golden.dts b/arch/arm/boot/dts/ste-ux500-samsung-golden.dts +index b0dce91aff4b..9604695edf53 100644 +--- a/arch/arm/boot/dts/ste-ux500-samsung-golden.dts ++++ b/arch/arm/boot/dts/ste-ux500-samsung-golden.dts +@@ -35,6 +35,14 @@ battery-thermal { + polling-delay = <0>; + polling-delay-passive = <0>; + thermal-sensors = <&bat_therm>; ++ ++ trips { ++ battery-crit-hi { ++ temperature = <70000>; ++ hysteresis = <2000>; ++ type = "critical"; ++ }; ++ }; + }; + }; + +diff --git a/arch/arm/boot/dts/ste-ux500-samsung-janice.dts b/arch/arm/boot/dts/ste-ux500-samsung-janice.dts +index ed5c79c3d04b..69387e8754a9 100644 +--- a/arch/arm/boot/dts/ste-ux500-samsung-janice.dts ++++ b/arch/arm/boot/dts/ste-ux500-samsung-janice.dts +@@ -30,6 +30,14 @@ battery-thermal { + polling-delay = <0>; + polling-delay-passive = <0>; + thermal-sensors = <&bat_therm>; ++ ++ trips { ++ battery-crit-hi { ++ temperature = <70000>; ++ hysteresis = <2000>; ++ type = "critical"; ++ }; ++ }; + }; + }; + +diff --git a/arch/arm/boot/dts/ste-ux500-samsung-kyle.dts b/arch/arm/boot/dts/ste-ux500-samsung-kyle.dts +index c57676faf181..167846df3104 100644 +--- a/arch/arm/boot/dts/ste-ux500-samsung-kyle.dts ++++ b/arch/arm/boot/dts/ste-ux500-samsung-kyle.dts +@@ -34,6 +34,14 @@ battery-thermal { + polling-delay = <0>; + polling-delay-passive = <0>; + thermal-sensors = <&bat_therm>; ++ ++ trips { ++ battery-crit-hi { ++ temperature = <70000>; ++ hysteresis = <2000>; ++ type = "critical"; ++ }; ++ }; + }; + }; + +diff --git a/arch/arm/boot/dts/ste-ux500-samsung-skomer.dts b/arch/arm/boot/dts/ste-ux500-samsung-skomer.dts +index 81b341a5ae45..93e5f5ed888d 100644 +--- a/arch/arm/boot/dts/ste-ux500-samsung-skomer.dts ++++ b/arch/arm/boot/dts/ste-ux500-samsung-skomer.dts +@@ -30,6 +30,14 @@ battery-thermal { + polling-delay = <0>; + polling-delay-passive = <0>; + thermal-sensors = <&bat_therm>; ++ ++ trips { ++ battery-crit-hi { ++ temperature = <70000>; ++ hysteresis = <2000>; ++ type = "critical"; ++ }; ++ }; + }; + }; + +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-imx8-correct-clock-order.patch b/queue-6.0/arm64-dts-imx8-correct-clock-order.patch new file mode 100644 index 00000000000..b816f22f44f --- /dev/null +++ b/queue-6.0/arm64-dts-imx8-correct-clock-order.patch @@ -0,0 +1,68 @@ +From 4cfc0f9e7a1a955b0a45ae360db472a4b7d89cf6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Oct 2022 18:07:47 +0800 +Subject: arm64: dts: imx8: correct clock order + +From: Peng Fan + +[ Upstream commit 06acb824d7d00a30e9400f67eee481b218371b5a ] + +Per bindings/mmc/fsl-imx-esdhc.yaml, the clock order is ipg, ahb, per, +otherwise warning: " +mmc@5b020000: clock-names:1: 'ahb' was expected +mmc@5b020000: clock-names:2: 'per' was expected " + +Fixes: 16c4ea7501b1 ("arm64: dts: imx8: switch to new lpcg clock binding") +Signed-off-by: Peng Fan +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../arm64/boot/dts/freescale/imx8-ss-conn.dtsi | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8-ss-conn.dtsi b/arch/arm64/boot/dts/freescale/imx8-ss-conn.dtsi +index 82a1c4488378..10370d1a6c6d 100644 +--- a/arch/arm64/boot/dts/freescale/imx8-ss-conn.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8-ss-conn.dtsi +@@ -38,9 +38,9 @@ usdhc1: mmc@5b010000 { + interrupts = ; + reg = <0x5b010000 0x10000>; + clocks = <&sdhc0_lpcg IMX_LPCG_CLK_4>, +- <&sdhc0_lpcg IMX_LPCG_CLK_5>, +- <&sdhc0_lpcg IMX_LPCG_CLK_0>; +- clock-names = "ipg", "per", "ahb"; ++ <&sdhc0_lpcg IMX_LPCG_CLK_0>, ++ <&sdhc0_lpcg IMX_LPCG_CLK_5>; ++ clock-names = "ipg", "ahb", "per"; + power-domains = <&pd IMX_SC_R_SDHC_0>; + status = "disabled"; + }; +@@ -49,9 +49,9 @@ usdhc2: mmc@5b020000 { + interrupts = ; + reg = <0x5b020000 0x10000>; + clocks = <&sdhc1_lpcg IMX_LPCG_CLK_4>, +- <&sdhc1_lpcg IMX_LPCG_CLK_5>, +- <&sdhc1_lpcg IMX_LPCG_CLK_0>; +- clock-names = "ipg", "per", "ahb"; ++ <&sdhc1_lpcg IMX_LPCG_CLK_0>, ++ <&sdhc1_lpcg IMX_LPCG_CLK_5>; ++ clock-names = "ipg", "ahb", "per"; + power-domains = <&pd IMX_SC_R_SDHC_1>; + fsl,tuning-start-tap = <20>; + fsl,tuning-step = <2>; +@@ -62,9 +62,9 @@ usdhc3: mmc@5b030000 { + interrupts = ; + reg = <0x5b030000 0x10000>; + clocks = <&sdhc2_lpcg IMX_LPCG_CLK_4>, +- <&sdhc2_lpcg IMX_LPCG_CLK_5>, +- <&sdhc2_lpcg IMX_LPCG_CLK_0>; +- clock-names = "ipg", "per", "ahb"; ++ <&sdhc2_lpcg IMX_LPCG_CLK_0>, ++ <&sdhc2_lpcg IMX_LPCG_CLK_5>; ++ clock-names = "ipg", "ahb", "per"; + power-domains = <&pd IMX_SC_R_SDHC_2>; + status = "disabled"; + }; +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-imx8mm-correct-usb-power-domains.patch b/queue-6.0/arm64-dts-imx8mm-correct-usb-power-domains.patch new file mode 100644 index 00000000000..57a51ebe6dd --- /dev/null +++ b/queue-6.0/arm64-dts-imx8mm-correct-usb-power-domains.patch @@ -0,0 +1,63 @@ +From 041bb9f7bec1cec2c7fd849065111ea9296138f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Sep 2022 19:45:33 +0800 +Subject: arm64: dts: imx8mm: correct usb power domains + +From: Li Jun + +[ Upstream commit 4585c79ff477f9517b7f384a4fce351417e8fa36 ] + +pgc_otg1/2 is actual the power domain of usb PHY, usb controller +is in hsio power domain, and pgc_otg1/2 is required to be powered +up to detect usb remote wakeup, so move the pgc_otg1/2 power domain +to the usb phy node. + +Fixes: 01df28d80859 ("arm64: dts: imx8mm: put USB controllers into power-domains") +Signed-off-by: Li Jun +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm.dtsi | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi +index 41204b871f4f..dabd94dc30c4 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi +@@ -276,6 +276,7 @@ usbphynop1: usbphynop1 { + assigned-clocks = <&clk IMX8MM_CLK_USB_PHY_REF>; + assigned-clock-parents = <&clk IMX8MM_SYS_PLL1_100M>; + clock-names = "main_clk"; ++ power-domains = <&pgc_otg1>; + }; + + usbphynop2: usbphynop2 { +@@ -285,6 +286,7 @@ usbphynop2: usbphynop2 { + assigned-clocks = <&clk IMX8MM_CLK_USB_PHY_REF>; + assigned-clock-parents = <&clk IMX8MM_SYS_PLL1_100M>; + clock-names = "main_clk"; ++ power-domains = <&pgc_otg2>; + }; + + soc: soc@0 { +@@ -1184,7 +1186,7 @@ usbotg1: usb@32e40000 { + assigned-clock-parents = <&clk IMX8MM_SYS_PLL2_500M>; + phys = <&usbphynop1>; + fsl,usbmisc = <&usbmisc1 0>; +- power-domains = <&pgc_otg1>; ++ power-domains = <&pgc_hsiomix>; + status = "disabled"; + }; + +@@ -1204,7 +1206,7 @@ usbotg2: usb@32e50000 { + assigned-clock-parents = <&clk IMX8MM_SYS_PLL2_500M>; + phys = <&usbphynop2>; + fsl,usbmisc = <&usbmisc2 0>; +- power-domains = <&pgc_otg2>; ++ power-domains = <&pgc_hsiomix>; + status = "disabled"; + }; + +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-imx8mm-enable-cpld_dn-pull-down-resistor-o.patch b/queue-6.0/arm64-dts-imx8mm-enable-cpld_dn-pull-down-resistor-o.patch new file mode 100644 index 00000000000..7e8792a82f0 --- /dev/null +++ b/queue-6.0/arm64-dts-imx8mm-enable-cpld_dn-pull-down-resistor-o.patch @@ -0,0 +1,58 @@ +From aab4770b5ec7c756cc992f0a7278c3e4ceb9a29e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Sep 2022 03:10:08 +0200 +Subject: arm64: dts: imx8mm: Enable CPLD_Dn pull down resistor on MX8Menlo + +From: Marek Vasut + +[ Upstream commit f23f1a1e8437e38014fe34a2f12e37e861e5bcc7 ] + +Enable CPLD_Dn pull down resistor instead of pull up to avoid +intefering with CPLD power off functionality. + +Fixes: 510c527b4ff57 ("arm64: dts: imx8mm: Add i.MX8M Mini Toradex Verdin based Menlo board") +Signed-off-by: Marek Vasut +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../arm64/boot/dts/freescale/imx8mm-mx8menlo.dts | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-mx8menlo.dts b/arch/arm64/boot/dts/freescale/imx8mm-mx8menlo.dts +index 32f6f2f50c10..43e89859c044 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-mx8menlo.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mm-mx8menlo.dts +@@ -250,21 +250,21 @@ MX8MM_IOMUXC_SAI1_RXD1_GPIO4_IO3 0x1c4 + /* SODIMM 96 */ + MX8MM_IOMUXC_SAI1_RXD2_GPIO4_IO4 0x1c4 + /* CPLD_D[7] */ +- MX8MM_IOMUXC_SAI1_RXD3_GPIO4_IO5 0x1c4 ++ MX8MM_IOMUXC_SAI1_RXD3_GPIO4_IO5 0x184 + /* CPLD_D[6] */ +- MX8MM_IOMUXC_SAI1_RXFS_GPIO4_IO0 0x1c4 ++ MX8MM_IOMUXC_SAI1_RXFS_GPIO4_IO0 0x184 + /* CPLD_D[5] */ +- MX8MM_IOMUXC_SAI1_TXC_GPIO4_IO11 0x1c4 ++ MX8MM_IOMUXC_SAI1_TXC_GPIO4_IO11 0x184 + /* CPLD_D[4] */ +- MX8MM_IOMUXC_SAI1_TXD0_GPIO4_IO12 0x1c4 ++ MX8MM_IOMUXC_SAI1_TXD0_GPIO4_IO12 0x184 + /* CPLD_D[3] */ +- MX8MM_IOMUXC_SAI1_TXD1_GPIO4_IO13 0x1c4 ++ MX8MM_IOMUXC_SAI1_TXD1_GPIO4_IO13 0x184 + /* CPLD_D[2] */ +- MX8MM_IOMUXC_SAI1_TXD2_GPIO4_IO14 0x1c4 ++ MX8MM_IOMUXC_SAI1_TXD2_GPIO4_IO14 0x184 + /* CPLD_D[1] */ +- MX8MM_IOMUXC_SAI1_TXD3_GPIO4_IO15 0x1c4 ++ MX8MM_IOMUXC_SAI1_TXD3_GPIO4_IO15 0x184 + /* CPLD_D[0] */ +- MX8MM_IOMUXC_SAI1_TXD4_GPIO4_IO16 0x1c4 ++ MX8MM_IOMUXC_SAI1_TXD4_GPIO4_IO16 0x184 + /* KBD_intK */ + MX8MM_IOMUXC_SAI2_MCLK_GPIO4_IO27 0x1c4 + /* DISP_reset */ +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-imx8mm-remove-otg1-2-power-domain-dependen.patch b/queue-6.0/arm64-dts-imx8mm-remove-otg1-2-power-domain-dependen.patch new file mode 100644 index 00000000000..d2128406ff4 --- /dev/null +++ b/queue-6.0/arm64-dts-imx8mm-remove-otg1-2-power-domain-dependen.patch @@ -0,0 +1,41 @@ +From c1f618398a59dc4659196177c071e894cc2c79ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Sep 2022 19:45:32 +0800 +Subject: arm64: dts: imx8mm: remove otg1/2 power domain dependency on hsio + +From: Li Jun + +[ Upstream commit e1ec45b9a8127d9d31bb9fc1d802571a2ba8dd89 ] + +pgc_otg1/2 are independent power domain of hsio, they for usb phy, +so remove hsio power domain dependency from its node. + +Fixes: d39d4bb15310 ("arm64: dts: imx8mm: add GPC node") +Signed-off-by: Li Jun +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi +index afb90f59c83c..41204b871f4f 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi +@@ -674,13 +674,11 @@ pgc_pcie: power-domain@1 { + pgc_otg1: power-domain@2 { + #power-domain-cells = <0>; + reg = ; +- power-domains = <&pgc_hsiomix>; + }; + + pgc_otg2: power-domain@3 { + #power-domain-cells = <0>; + reg = ; +- power-domains = <&pgc_hsiomix>; + }; + + pgc_gpumix: power-domain@4 { +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-imx8mn-correct-the-usb-power-domain.patch b/queue-6.0/arm64-dts-imx8mn-correct-the-usb-power-domain.patch new file mode 100644 index 00000000000..91f47ffbe44 --- /dev/null +++ b/queue-6.0/arm64-dts-imx8mn-correct-the-usb-power-domain.patch @@ -0,0 +1,45 @@ +From dc9bcfa515c0cfe53c946c65a2587b61ebb10cf5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Sep 2022 19:45:35 +0800 +Subject: arm64: dts: imx8mn: Correct the usb power domain + +From: Li Jun + +[ Upstream commit ee895139a761bdb7869f9f5b9ccc19a064d0d740 ] + +pgc_otg1 is actual the power domain of usb PHY, usb controller +is in hsio power domain, and pgc_otg1 is required to be powered +up to detect usb remote wakeup, so move the pgc_otg1 power domain +to the usb phy node. + +Fixes: ea2b5af58ab2 ("arm64: dts: imx8mn: put USB controller into power-domains") +Signed-off-by: Li Jun +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mn.dtsi | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mn.dtsi b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +index 950f432627fe..ad0b99adf691 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +@@ -1075,7 +1075,7 @@ usbotg1: usb@32e40000 { + assigned-clock-parents = <&clk IMX8MN_SYS_PLL2_500M>; + phys = <&usbphynop1>; + fsl,usbmisc = <&usbmisc1 0>; +- power-domains = <&pgc_otg1>; ++ power-domains = <&pgc_hsiomix>; + status = "disabled"; + }; + +@@ -1174,5 +1174,6 @@ usbphynop1: usbphynop1 { + assigned-clocks = <&clk IMX8MN_CLK_USB_PHY_REF>; + assigned-clock-parents = <&clk IMX8MN_SYS_PLL1_100M>; + clock-names = "main_clk"; ++ power-domains = <&pgc_otg1>; + }; + }; +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-imx8mn-remove-otg1-power-domain-dependency.patch b/queue-6.0/arm64-dts-imx8mn-remove-otg1-power-domain-dependency.patch new file mode 100644 index 00000000000..6ae4014ffad --- /dev/null +++ b/queue-6.0/arm64-dts-imx8mn-remove-otg1-power-domain-dependency.patch @@ -0,0 +1,35 @@ +From 76f672149c068e0b9a24919f9dd5b58212b5bdf0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Sep 2022 19:45:34 +0800 +Subject: arm64: dts: imx8mn: remove otg1 power domain dependency on hsio + +From: Li Jun + +[ Upstream commit 9e0bbb7a5218d856f1ccf8f1bf38c8869572b464 ] + +pgc_otg1 is an independent power domain of hsio, it's for usb phy, +so remove hsio power domain from its node. + +Fixes: 8b8ebec67360 ("arm64: dts: imx8mn: add GPC node") +Signed-off-by: Li Jun +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mn.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mn.dtsi b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +index cb2836bfbd95..950f432627fe 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +@@ -662,7 +662,6 @@ pgc_hsiomix: power-domain@0 { + pgc_otg1: power-domain@1 { + #power-domain-cells = <0>; + reg = ; +- power-domains = <&pgc_hsiomix>; + }; + + pgc_gpumix: power-domain@2 { +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-imx93-add-gpio-clk.patch b/queue-6.0/arm64-dts-imx93-add-gpio-clk.patch new file mode 100644 index 00000000000..be86d2e602b --- /dev/null +++ b/queue-6.0/arm64-dts-imx93-add-gpio-clk.patch @@ -0,0 +1,68 @@ +From 1ce24b77d50b4ffae215a167a7b928927a986f19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Sep 2022 13:59:10 +0800 +Subject: arm64: dts: imx93: add gpio clk + +From: Peng Fan + +[ Upstream commit e41ba695713996444c224cdac869a2f36a8514c4 ] + +Add the GPIO clk, otherwise GPIO may not work if clk driver disable the +GPIO clk during kernel boot. + +Reviewed-by: Jacky Bai +Signed-off-by: Peng Fan +Signed-off-by: Shawn Guo +Stable-dep-of: d92a110130d4 ("arm64: dts: imx93: correct gpio-ranges") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx93.dtsi | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx93.dtsi b/arch/arm64/boot/dts/freescale/imx93.dtsi +index f83a07c7c9b1..b04735004fdf 100644 +--- a/arch/arm64/boot/dts/freescale/imx93.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx93.dtsi +@@ -295,6 +295,9 @@ gpio2: gpio@43810080 { + interrupts = ; + interrupt-controller; + #interrupt-cells = <2>; ++ clocks = <&clk IMX93_CLK_GPIO2_GATE>, ++ <&clk IMX93_CLK_GPIO2_GATE>; ++ clock-names = "gpio", "port"; + gpio-ranges = <&iomuxc 0 32 32>; + }; + +@@ -306,6 +309,9 @@ gpio3: gpio@43820080 { + interrupts = ; + interrupt-controller; + #interrupt-cells = <2>; ++ clocks = <&clk IMX93_CLK_GPIO3_GATE>, ++ <&clk IMX93_CLK_GPIO3_GATE>; ++ clock-names = "gpio", "port"; + gpio-ranges = <&iomuxc 0 64 32>; + }; + +@@ -317,6 +323,9 @@ gpio4: gpio@43830080 { + interrupts = ; + interrupt-controller; + #interrupt-cells = <2>; ++ clocks = <&clk IMX93_CLK_GPIO4_GATE>, ++ <&clk IMX93_CLK_GPIO4_GATE>; ++ clock-names = "gpio", "port"; + gpio-ranges = <&iomuxc 0 96 32>; + }; + +@@ -328,6 +337,9 @@ gpio1: gpio@47400080 { + interrupts = ; + interrupt-controller; + #interrupt-cells = <2>; ++ clocks = <&clk IMX93_CLK_GPIO1_GATE>, ++ <&clk IMX93_CLK_GPIO1_GATE>; ++ clock-names = "gpio", "port"; + gpio-ranges = <&iomuxc 0 0 32>; + }; + }; +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-imx93-correct-gpio-ranges.patch b/queue-6.0/arm64-dts-imx93-correct-gpio-ranges.patch new file mode 100644 index 00000000000..584fa040c97 --- /dev/null +++ b/queue-6.0/arm64-dts-imx93-correct-gpio-ranges.patch @@ -0,0 +1,66 @@ +From a3035a2a7a88349b7013d791ccfad9268e09357f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Oct 2022 18:16:57 +0800 +Subject: arm64: dts: imx93: correct gpio-ranges + +From: Peng Fan + +[ Upstream commit d92a110130d492bd5eab81827ce3730581dc933a ] + +Per imx93-pinfunc.h and pinctrl-imx93.c, correct gpio-ranges. + +Fixes: ec8b5b5058ea ("arm64: dts: freescale: Add i.MX93 dtsi support") +Reported-by: David Wolfe +Reviewed-by: Haibo Chen +Reviewed-by: Jacky Bai +Signed-off-by: Peng Fan +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx93.dtsi | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx93.dtsi b/arch/arm64/boot/dts/freescale/imx93.dtsi +index b04735004fdf..6981d3b0e274 100644 +--- a/arch/arm64/boot/dts/freescale/imx93.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx93.dtsi +@@ -298,7 +298,7 @@ gpio2: gpio@43810080 { + clocks = <&clk IMX93_CLK_GPIO2_GATE>, + <&clk IMX93_CLK_GPIO2_GATE>; + clock-names = "gpio", "port"; +- gpio-ranges = <&iomuxc 0 32 32>; ++ gpio-ranges = <&iomuxc 0 4 30>; + }; + + gpio3: gpio@43820080 { +@@ -312,7 +312,8 @@ gpio3: gpio@43820080 { + clocks = <&clk IMX93_CLK_GPIO3_GATE>, + <&clk IMX93_CLK_GPIO3_GATE>; + clock-names = "gpio", "port"; +- gpio-ranges = <&iomuxc 0 64 32>; ++ gpio-ranges = <&iomuxc 0 84 8>, <&iomuxc 8 66 18>, ++ <&iomuxc 26 34 2>, <&iomuxc 28 0 4>; + }; + + gpio4: gpio@43830080 { +@@ -326,7 +327,7 @@ gpio4: gpio@43830080 { + clocks = <&clk IMX93_CLK_GPIO4_GATE>, + <&clk IMX93_CLK_GPIO4_GATE>; + clock-names = "gpio", "port"; +- gpio-ranges = <&iomuxc 0 96 32>; ++ gpio-ranges = <&iomuxc 0 38 28>, <&iomuxc 28 36 2>; + }; + + gpio1: gpio@47400080 { +@@ -340,7 +341,7 @@ gpio1: gpio@47400080 { + clocks = <&clk IMX93_CLK_GPIO1_GATE>, + <&clk IMX93_CLK_GPIO1_GATE>; + clock-names = "gpio", "port"; +- gpio-ranges = <&iomuxc 0 0 32>; ++ gpio-ranges = <&iomuxc 0 92 16>; + }; + }; + }; +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-juno-add-thermal-critical-trip-points.patch b/queue-6.0/arm64-dts-juno-add-thermal-critical-trip-points.patch new file mode 100644 index 00000000000..1dc9dcc16db --- /dev/null +++ b/queue-6.0/arm64-dts-juno-add-thermal-critical-trip-points.patch @@ -0,0 +1,62 @@ +From 822b031726cdaa5148f3168e7961e6568534529f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Oct 2022 15:08:33 +0100 +Subject: arm64: dts: juno: Add thermal critical trip points + +From: Cristian Marussi + +[ Upstream commit c4a7b9b587ca1bb4678d48d8be7132492b23a81c ] + +When thermnal zones are defined, trip points definitions are mandatory. +Define a couple of critical trip points for monitoring of existing +PMIC and SOC thermal zones. + +This was lost between txt to yaml conversion and was re-enforced recently +via the commit 8c596324232d ("dt-bindings: thermal: Fix missing required property") + +Cc: Rob Herring +Cc: Krzysztof Kozlowski +Cc: devicetree@vger.kernel.org +Signed-off-by: Cristian Marussi +Fixes: f7b636a8d83c ("arm64: dts: juno: add thermal zones for scpi sensors") +Link: https://lore.kernel.org/r/20221028140833.280091-8-cristian.marussi@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/arm/juno-base.dtsi | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/arch/arm64/boot/dts/arm/juno-base.dtsi b/arch/arm64/boot/dts/arm/juno-base.dtsi +index 2f27619d8abd..8b4d280b1e7e 100644 +--- a/arch/arm64/boot/dts/arm/juno-base.dtsi ++++ b/arch/arm64/boot/dts/arm/juno-base.dtsi +@@ -751,12 +751,26 @@ pmic { + polling-delay = <1000>; + polling-delay-passive = <100>; + thermal-sensors = <&scpi_sensors0 0>; ++ trips { ++ pmic_crit0: trip0 { ++ temperature = <90000>; ++ hysteresis = <2000>; ++ type = "critical"; ++ }; ++ }; + }; + + soc { + polling-delay = <1000>; + polling-delay-passive = <100>; + thermal-sensors = <&scpi_sensors0 3>; ++ trips { ++ soc_crit0: trip0 { ++ temperature = <80000>; ++ hysteresis = <2000>; ++ type = "critical"; ++ }; ++ }; + }; + + big_cluster_thermal_zone: big-cluster { +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-ls1088a-specify-clock-frequencies-for-the-.patch b/queue-6.0/arm64-dts-ls1088a-specify-clock-frequencies-for-the-.patch new file mode 100644 index 00000000000..6099a11f556 --- /dev/null +++ b/queue-6.0/arm64-dts-ls1088a-specify-clock-frequencies-for-the-.patch @@ -0,0 +1,50 @@ +From d431f03b98f3001635ec023444f29dad9abd889d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Oct 2022 17:41:16 +0300 +Subject: arm64: dts: ls1088a: specify clock frequencies for the MDIO + controllers + +From: Ioana Ciornei + +[ Upstream commit d78a57426e64fc4c61e6189e450a0432d24536ca ] + +Up until now, the external MDIO controller frequency values relied +either on the default ones out of reset or on those setup by u-boot. +Let's just properly specify the MDC frequency in the DTS so that even +without u-boot's intervention Linux can drive the MDIO bus. + +Fixes: bbe75af7b092 ("arm64: dts: ls1088a: add external MDIO device nodes") +Signed-off-by: Ioana Ciornei +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi +index 421d879013d7..260d045dbd9a 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi +@@ -779,6 +779,9 @@ emdio1: mdio@8b96000 { + little-endian; + #address-cells = <1>; + #size-cells = <0>; ++ clock-frequency = <2500000>; ++ clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL ++ QORIQ_CLK_PLL_DIV(1)>; + status = "disabled"; + }; + +@@ -788,6 +791,9 @@ emdio2: mdio@8b97000 { + little-endian; + #address-cells = <1>; + #size-cells = <0>; ++ clock-frequency = <2500000>; ++ clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL ++ QORIQ_CLK_PLL_DIV(1)>; + status = "disabled"; + }; + +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-ls208xa-specify-clock-frequencies-for-the-.patch b/queue-6.0/arm64-dts-ls208xa-specify-clock-frequencies-for-the-.patch new file mode 100644 index 00000000000..2b7f8773756 --- /dev/null +++ b/queue-6.0/arm64-dts-ls208xa-specify-clock-frequencies-for-the-.patch @@ -0,0 +1,50 @@ +From 34d4950ea96ed22ef3dae0bcc9dd1e025b10603f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Oct 2022 17:41:17 +0300 +Subject: arm64: dts: ls208xa: specify clock frequencies for the MDIO + controllers + +From: Ioana Ciornei + +[ Upstream commit d5c921a53c80dfa942f6dff36253db5a50775a5f ] + +Up until now, the external MDIO controller frequency values relied +either on the default ones out of reset or on those setup by u-boot. +Let's just properly specify the MDC frequency in the DTS so that even +without u-boot's intervention Linux can drive the MDIO bus. + +Fixes: 0420dde30a90 ("arm64: dts: ls208xa: add the external MDIO nodes") +Signed-off-by: Ioana Ciornei +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi +index d76f1c42f3fa..7bb33933c2cb 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi +@@ -533,6 +533,9 @@ emdio1: mdio@8b96000 { + little-endian; + #address-cells = <1>; + #size-cells = <0>; ++ clock-frequency = <2500000>; ++ clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL ++ QORIQ_CLK_PLL_DIV(2)>; + status = "disabled"; + }; + +@@ -542,6 +545,9 @@ emdio2: mdio@8b97000 { + little-endian; + #address-cells = <1>; + #size-cells = <0>; ++ clock-frequency = <2500000>; ++ clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL ++ QORIQ_CLK_PLL_DIV(2)>; + status = "disabled"; + }; + +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-lx2160a-specify-clock-frequencies-for-the-.patch b/queue-6.0/arm64-dts-lx2160a-specify-clock-frequencies-for-the-.patch new file mode 100644 index 00000000000..81820dba2ed --- /dev/null +++ b/queue-6.0/arm64-dts-lx2160a-specify-clock-frequencies-for-the-.patch @@ -0,0 +1,51 @@ +From 8237740b0bed3742620454d7ba3f12e0b0771217 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Oct 2022 17:41:15 +0300 +Subject: arm64: dts: lx2160a: specify clock frequencies for the MDIO + controllers + +From: Ioana Ciornei + +[ Upstream commit c126a0abc5dadd7df236f20aae6d8c3d103f095c ] + +Up until now, the external MDIO controller frequency values relied +either on the default ones out of reset or on those setup by u-boot. +Let's just properly specify the MDC frequency in the DTS so that even +without u-boot's intervention Linux can drive the MDIO bus. + +Fixes: 6e1b8fae892d ("arm64: dts: lx2160a: add emdio1 node") +Fixes: 5705b9dcda57 ("arm64: dts: lx2160a: add emdio2 node") +Signed-off-by: Ioana Ciornei +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi b/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi +index 6680fb2a6dc9..8c76d86cb756 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi +@@ -1385,6 +1385,9 @@ emdio1: mdio@8b96000 { + #address-cells = <1>; + #size-cells = <0>; + little-endian; ++ clock-frequency = <2500000>; ++ clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL ++ QORIQ_CLK_PLL_DIV(2)>; + status = "disabled"; + }; + +@@ -1395,6 +1398,9 @@ emdio2: mdio@8b97000 { + little-endian; + #address-cells = <1>; + #size-cells = <0>; ++ clock-frequency = <2500000>; ++ clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL ++ QORIQ_CLK_PLL_DIV(2)>; + status = "disabled"; + }; + +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-verdin-imx8mp-fix-ctrl_sleep_moci.patch b/queue-6.0/arm64-dts-verdin-imx8mp-fix-ctrl_sleep_moci.patch new file mode 100644 index 00000000000..993dc338718 --- /dev/null +++ b/queue-6.0/arm64-dts-verdin-imx8mp-fix-ctrl_sleep_moci.patch @@ -0,0 +1,66 @@ +From eaf5a8ac4ea5342167c184085078ea80993e4712 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Sep 2022 18:29:18 +0200 +Subject: arm64: dts: verdin-imx8mp: fix ctrl_sleep_moci + +From: Max Krummenacher + +[ Upstream commit 2f321fd6d89ad1e9525f5aa1f2be9202c2f3e724 ] + +The GPIO signaling ctrl_sleep_moci is currently handled as a gpio hog. +But the gpio-hog node is made a child of the wrong gpio controller. +Move it to the node representing gpio4 so that it actually works. + +Without this carrier board components jumpered to use the signal are +unconditionally switched off. + +Fixes: a39ed23bdf6e ("arm64: dts: freescale: add initial support for verdin imx8m plus") +Signed-off-by: Max Krummenacher +Signed-off-by: Marcel Ziswiler +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../boot/dts/freescale/imx8mp-verdin.dtsi | 20 +++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi +index 1c74c6a19449..360be51a3527 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi +@@ -339,16 +339,6 @@ &gpio2 { + "SODIMM_82", + "SODIMM_70", + "SODIMM_72"; +- +- ctrl-sleep-moci-hog { +- gpio-hog; +- /* Verdin CTRL_SLEEP_MOCI# (SODIMM 256) */ +- gpios = <29 GPIO_ACTIVE_HIGH>; +- line-name = "CTRL_SLEEP_MOCI#"; +- output-high; +- pinctrl-names = "default"; +- pinctrl-0 = <&pinctrl_ctrl_sleep_moci>; +- }; + }; + + &gpio3 { +@@ -417,6 +407,16 @@ &gpio4 { + "SODIMM_256", + "SODIMM_48", + "SODIMM_44"; ++ ++ ctrl-sleep-moci-hog { ++ gpio-hog; ++ /* Verdin CTRL_SLEEP_MOCI# (SODIMM 256) */ ++ gpios = <29 GPIO_ACTIVE_HIGH>; ++ line-name = "CTRL_SLEEP_MOCI#"; ++ output-high; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&pinctrl_ctrl_sleep_moci>; ++ }; + }; + + /* On-module I2C */ +-- +2.35.1 + diff --git a/queue-6.0/bio-safeguard-req_alloc_cache-bio-put.patch b/queue-6.0/bio-safeguard-req_alloc_cache-bio-put.patch new file mode 100644 index 00000000000..749f2ec70ca --- /dev/null +++ b/queue-6.0/bio-safeguard-req_alloc_cache-bio-put.patch @@ -0,0 +1,39 @@ +From 54551ec986ba66ec3ea9d559309c076e0934936e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 20:50:55 +0100 +Subject: bio: safeguard REQ_ALLOC_CACHE bio put + +From: Pavel Begunkov + +[ Upstream commit d4347d50407daea6237872281ece64c4bdf1ec99 ] + +bio_put() with REQ_ALLOC_CACHE assumes that it's executed not from +an irq context. Let's add a warning if the invariant is not respected, +especially since there is a couple of places removing REQ_POLLED by hand +without also clearing REQ_ALLOC_CACHE. + +Signed-off-by: Pavel Begunkov +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/558d78313476c4e9c233902efa0092644c3d420a.1666122465.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/block/bio.c b/block/bio.c +index 77e3b764a078..fc2364cf1775 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -741,7 +741,7 @@ void bio_put(struct bio *bio) + return; + } + +- if (bio->bi_opf & REQ_ALLOC_CACHE) { ++ if ((bio->bi_opf & REQ_ALLOC_CACHE) && !WARN_ON_ONCE(in_interrupt())) { + struct bio_alloc_cache *cache; + + bio_uninit(bio); +-- +2.35.1 + diff --git a/queue-6.0/blk-mq-fix-kmemleak-in-blk_mq_init_allocated_queue.patch b/queue-6.0/blk-mq-fix-kmemleak-in-blk_mq_init_allocated_queue.patch new file mode 100644 index 00000000000..1d05bd637fd --- /dev/null +++ b/queue-6.0/blk-mq-fix-kmemleak-in-blk_mq_init_allocated_queue.patch @@ -0,0 +1,96 @@ +From 7129b8691e61717ba4b0c21d7e6db48328ae4906 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Oct 2022 03:12:42 +0000 +Subject: blk-mq: Fix kmemleak in blk_mq_init_allocated_queue + +From: Chen Jun + +[ Upstream commit 943f45b9399ed8b2b5190cbc797995edaa97f58f ] + +There is a kmemleak caused by modprobe null_blk.ko + +unreferenced object 0xffff8881acb1f000 (size 1024): + comm "modprobe", pid 836, jiffies 4294971190 (age 27.068s) + hex dump (first 32 bytes): + 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... + ff ff ff ff ff ff ff ff 00 53 99 9e ff ff ff ff .........S...... + backtrace: + [<000000004a10c249>] kmalloc_node_trace+0x22/0x60 + [<00000000648f7950>] blk_mq_alloc_and_init_hctx+0x289/0x350 + [<00000000af06de0e>] blk_mq_realloc_hw_ctxs+0x2fe/0x3d0 + [<00000000e00c1872>] blk_mq_init_allocated_queue+0x48c/0x1440 + [<00000000d16b4e68>] __blk_mq_alloc_disk+0xc8/0x1c0 + [<00000000d10c98c3>] 0xffffffffc450d69d + [<00000000b9299f48>] 0xffffffffc4538392 + [<0000000061c39ed6>] do_one_initcall+0xd0/0x4f0 + [<00000000b389383b>] do_init_module+0x1a4/0x680 + [<0000000087cf3542>] load_module+0x6249/0x7110 + [<00000000beba61b8>] __do_sys_finit_module+0x140/0x200 + [<00000000fdcfff51>] do_syscall_64+0x35/0x80 + [<000000003c0f1f71>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +That is because q->ma_ops is set to NULL before blk_release_queue is +called. + +blk_mq_init_queue_data + blk_mq_init_allocated_queue + blk_mq_realloc_hw_ctxs + for (i = 0; i < set->nr_hw_queues; i++) { + old_hctx = xa_load(&q->hctx_table, i); + if (!blk_mq_alloc_and_init_hctx(.., i, ..)) [1] + if (!old_hctx) + break; + + xa_for_each_start(&q->hctx_table, j, hctx, j) + blk_mq_exit_hctx(q, set, hctx, j); [2] + + if (!q->nr_hw_queues) [3] + goto err_hctxs; + + err_exit: + q->mq_ops = NULL; [4] + + blk_put_queue + blk_release_queue + if (queue_is_mq(q)) [5] + blk_mq_release(q); + +[1]: blk_mq_alloc_and_init_hctx failed at i != 0. +[2]: The hctxs allocated by [1] are moved to q->unused_hctx_list and +will be cleaned up in blk_mq_release. +[3]: q->nr_hw_queues is 0. +[4]: Set q->mq_ops to NULL. +[5]: queue_is_mq returns false due to [4]. And blk_mq_release +will not be called. The hctxs in q->unused_hctx_list are leaked. + +To fix it, call blk_release_queue in exception path. + +Fixes: 2f8f1336a48b ("blk-mq: always free hctx after request queue is freed") +Signed-off-by: Yuan Can +Signed-off-by: Chen Jun +Reviewed-by: Ming Lei +Link: https://lore.kernel.org/r/20221031031242.94107-1-chenjun102@huawei.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index fe840536e6ac..edf41959a705 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -4104,9 +4104,7 @@ int blk_mq_init_allocated_queue(struct blk_mq_tag_set *set, + return 0; + + err_hctxs: +- xa_destroy(&q->hctx_table); +- q->nr_hw_queues = 0; +- blk_mq_sysfs_deinit(q); ++ blk_mq_release(q); + err_poll: + blk_stat_free_callback(q->poll_cb); + q->poll_cb = NULL; +-- +2.35.1 + diff --git a/queue-6.0/block-fix-possible-memory-leak-for-rq_wb-on-add_disk.patch b/queue-6.0/block-fix-possible-memory-leak-for-rq_wb-on-add_disk.patch new file mode 100644 index 00000000000..0695371e56d --- /dev/null +++ b/queue-6.0/block-fix-possible-memory-leak-for-rq_wb-on-add_disk.patch @@ -0,0 +1,67 @@ +From 06210ad0ed4a4035e83b993494e18a275d036be4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Oct 2022 15:13:55 +0800 +Subject: block: Fix possible memory leak for rq_wb on add_disk failure + +From: Chen Zhongjin + +[ Upstream commit fa81cbafbf5764ad5053512152345fab37a1fe18 ] + +kmemleak reported memory leaks in device_add_disk(): + +kmemleak: 3 new suspected memory leaks + +unreferenced object 0xffff88800f420800 (size 512): + comm "modprobe", pid 4275, jiffies 4295639067 (age 223.512s) + hex dump (first 32 bytes): + 04 00 00 00 08 00 00 00 01 00 00 00 00 00 00 00 ................ + 00 e1 f5 05 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<00000000d3662699>] kmalloc_trace+0x26/0x60 + [<00000000edc7aadc>] wbt_init+0x50/0x6f0 + [<0000000069601d16>] wbt_enable_default+0x157/0x1c0 + [<0000000028fc393f>] blk_register_queue+0x2a4/0x420 + [<000000007345a042>] device_add_disk+0x6fd/0xe40 + [<0000000060e6aab0>] nbd_dev_add+0x828/0xbf0 [nbd] + ... + +It is because the memory allocated in wbt_enable_default() is not +released in device_add_disk() error path. +Normally, these memory are freed in: + +del_gendisk() + rq_qos_exit() + rqos->ops->exit(rqos); + wbt_exit() + +So rq_qos_exit() is called to free the rq_wb memory for wbt_init(). +However in the error path of device_add_disk(), only +blk_unregister_queue() is called and make rq_wb memory leaked. + +Add rq_qos_exit() to the error path to fix it. + +Fixes: 83cbce957446 ("block: add error handling for device_add_disk / add_disk") +Signed-off-by: Chen Zhongjin +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20221029071355.35462-1-chenzhongjin@huawei.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/genhd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/block/genhd.c b/block/genhd.c +index 988ba52fd331..044ff97381e3 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -519,6 +519,7 @@ int __must_check device_add_disk(struct device *parent, struct gendisk *disk, + bdi_unregister(disk->bdi); + out_unregister_queue: + blk_unregister_queue(disk); ++ rq_qos_exit(disk->queue); + out_put_slave_dir: + kobject_put(disk->slave_dir); + out_put_holder_dir: +-- +2.35.1 + diff --git a/queue-6.0/clk-qcom-update-the-force-mem-core-bit-for-gpu-clock.patch b/queue-6.0/clk-qcom-update-the-force-mem-core-bit-for-gpu-clock.patch new file mode 100644 index 00000000000..334bf20c94b --- /dev/null +++ b/queue-6.0/clk-qcom-update-the-force-mem-core-bit-for-gpu-clock.patch @@ -0,0 +1,53 @@ +From e9b4bf58a940722540205f3b169a89709b355d25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Oct 2022 11:35:35 +0530 +Subject: clk: qcom: Update the force mem core bit for GPU clocks + +From: Taniya Das + +[ Upstream commit ffa20aa581cf5377fc397b0d0ff9d67ea823629b ] + +There are few GPU clocks which are powering up the memories +and thus enable the FORCE_MEM_PERIPH always for these clocks +to force the periph_on signal to remain active during halt +state of the clock. + +Fixes: a3cc092196ef ("clk: qcom: Add Global Clock controller (GCC) driver for SC7280") +Fixes: 3e0f01d6c7e7 ("clk: qcom: Add graphics clock controller driver for SC7280") +Signed-off-by: Taniya Das +Signed-off-by: Satya Priya +Link: https://lore.kernel.org/r/1666159535-6447-1-git-send-email-quic_c_skakit@quicinc.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sc7280.c | 1 + + drivers/clk/qcom/gpucc-sc7280.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/clk/qcom/gcc-sc7280.c b/drivers/clk/qcom/gcc-sc7280.c +index 7ff64d4d5920..2360f3f95618 100644 +--- a/drivers/clk/qcom/gcc-sc7280.c ++++ b/drivers/clk/qcom/gcc-sc7280.c +@@ -3467,6 +3467,7 @@ static int gcc_sc7280_probe(struct platform_device *pdev) + regmap_update_bits(regmap, 0x28004, BIT(0), BIT(0)); + regmap_update_bits(regmap, 0x28014, BIT(0), BIT(0)); + regmap_update_bits(regmap, 0x71004, BIT(0), BIT(0)); ++ regmap_update_bits(regmap, 0x7100C, BIT(13), BIT(13)); + + ret = qcom_cc_register_rcg_dfs(regmap, gcc_dfs_clocks, + ARRAY_SIZE(gcc_dfs_clocks)); +diff --git a/drivers/clk/qcom/gpucc-sc7280.c b/drivers/clk/qcom/gpucc-sc7280.c +index 9a832f2bcf49..1490cd45a654 100644 +--- a/drivers/clk/qcom/gpucc-sc7280.c ++++ b/drivers/clk/qcom/gpucc-sc7280.c +@@ -463,6 +463,7 @@ static int gpu_cc_sc7280_probe(struct platform_device *pdev) + */ + regmap_update_bits(regmap, 0x1170, BIT(0), BIT(0)); + regmap_update_bits(regmap, 0x1098, BIT(0), BIT(0)); ++ regmap_update_bits(regmap, 0x1098, BIT(13), BIT(13)); + + return qcom_cc_really_probe(pdev, &gpu_cc_sc7280_desc, regmap); + } +-- +2.35.1 + diff --git a/queue-6.0/clk-renesas-r8a779g0-fix-hscif-parent-clocks.patch b/queue-6.0/clk-renesas-r8a779g0-fix-hscif-parent-clocks.patch new file mode 100644 index 00000000000..88a0a00039a --- /dev/null +++ b/queue-6.0/clk-renesas-r8a779g0-fix-hscif-parent-clocks.patch @@ -0,0 +1,48 @@ +From 8e66b54c98992ece235dfcd34568009fbb41f85e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Oct 2022 15:10:01 +0200 +Subject: clk: renesas: r8a779g0: Fix HSCIF parent clocks + +From: Geert Uytterhoeven + +[ Upstream commit a9003f74f5a2f487e101f3aa1dd5c3d3a78c6999 ] + +As serial communication requires a clean clock signal, the High Speed +Serial Communication Interfaces with FIFO (HSCIF) is clocked by a clock +that is not affected by Spread Spectrum or Fractional Multiplication. + +Hence change the parent clocks for the HSCIF modules from the S0D3_PER +clock to the SASYNCPERD1 clock (which has the same clock rate), cfr. +R-Car V4H Hardware User's Manual rev. 0.54. + +Fixes: 0ab55cf1834177a2 ("clk: renesas: cpg-mssr: Add support for R-Car V4H") +Signed-off-by: Geert Uytterhoeven +Acked-by: Stephen Boyd +Link: https://lore.kernel.org/r/b7928abc8b9f53d5b06ec8624342f449de3d24ec.1665147497.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/clk/renesas/r8a779g0-cpg-mssr.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/renesas/r8a779g0-cpg-mssr.c b/drivers/clk/renesas/r8a779g0-cpg-mssr.c +index 3fc4233b1ead..c9c59c6f7139 100644 +--- a/drivers/clk/renesas/r8a779g0-cpg-mssr.c ++++ b/drivers/clk/renesas/r8a779g0-cpg-mssr.c +@@ -150,10 +150,10 @@ static const struct cpg_core_clk r8a779g0_core_clks[] __initconst = { + }; + + static const struct mssr_mod_clk r8a779g0_mod_clks[] __initconst = { +- DEF_MOD("hscif0", 514, R8A779G0_CLK_S0D3_PER), +- DEF_MOD("hscif1", 515, R8A779G0_CLK_S0D3_PER), +- DEF_MOD("hscif2", 516, R8A779G0_CLK_S0D3_PER), +- DEF_MOD("hscif3", 517, R8A779G0_CLK_S0D3_PER), ++ DEF_MOD("hscif0", 514, R8A779G0_CLK_SASYNCPERD1), ++ DEF_MOD("hscif1", 515, R8A779G0_CLK_SASYNCPERD1), ++ DEF_MOD("hscif2", 516, R8A779G0_CLK_SASYNCPERD1), ++ DEF_MOD("hscif3", 517, R8A779G0_CLK_SASYNCPERD1), + }; + + /* +-- +2.35.1 + diff --git a/queue-6.0/clk-rs9-fix-i2c-accessors.patch b/queue-6.0/clk-rs9-fix-i2c-accessors.patch new file mode 100644 index 00000000000..31246493d72 --- /dev/null +++ b/queue-6.0/clk-rs9-fix-i2c-accessors.patch @@ -0,0 +1,122 @@ +From a7adaed24804f2a8ddb58cb3dae41e194256f49e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Sep 2022 21:55:21 +0200 +Subject: clk: rs9: Fix I2C accessors + +From: Marek Vasut + +[ Upstream commit 2ff4ba9e37024735f5cefc5ea2a73fc66addfe0e ] + +Add custom I2C accessors to this driver, since the regular I2C regmap ones +do not generate the exact I2C transfers required by the chip. On I2C write, +it is mandatory to send transfer length first, on read the chip returns the +transfer length in first byte. Instead of always reading back 8 bytes, which +is the default and also the size of the entire register file, set BCP register +to 1 to read out 1 byte which is less wasteful. + +Fixes: 892e0ddea1aa ("clk: rs9: Add Renesas 9-series PCIe clock generator driver") +Reported-by: Alexander Stein +Signed-off-by: Marek Vasut +Link: https://lore.kernel.org/r/20220929195521.284497-1-marex@denx.de +Reviewed-by: Alexander Stein +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-renesas-pcie.c | 65 ++++++++++++++++++++++++++++++++-- + 1 file changed, 62 insertions(+), 3 deletions(-) + +diff --git a/drivers/clk/clk-renesas-pcie.c b/drivers/clk/clk-renesas-pcie.c +index 4f5df1fc74b4..e6247141d0c0 100644 +--- a/drivers/clk/clk-renesas-pcie.c ++++ b/drivers/clk/clk-renesas-pcie.c +@@ -90,13 +90,66 @@ static const struct regmap_access_table rs9_writeable_table = { + .n_yes_ranges = ARRAY_SIZE(rs9_writeable_ranges), + }; + ++static int rs9_regmap_i2c_write(void *context, ++ unsigned int reg, unsigned int val) ++{ ++ struct i2c_client *i2c = context; ++ const u8 data[3] = { reg, 1, val }; ++ const int count = ARRAY_SIZE(data); ++ int ret; ++ ++ ret = i2c_master_send(i2c, data, count); ++ if (ret == count) ++ return 0; ++ else if (ret < 0) ++ return ret; ++ else ++ return -EIO; ++} ++ ++static int rs9_regmap_i2c_read(void *context, ++ unsigned int reg, unsigned int *val) ++{ ++ struct i2c_client *i2c = context; ++ struct i2c_msg xfer[2]; ++ u8 txdata = reg; ++ u8 rxdata[2]; ++ int ret; ++ ++ xfer[0].addr = i2c->addr; ++ xfer[0].flags = 0; ++ xfer[0].len = 1; ++ xfer[0].buf = (void *)&txdata; ++ ++ xfer[1].addr = i2c->addr; ++ xfer[1].flags = I2C_M_RD; ++ xfer[1].len = 2; ++ xfer[1].buf = (void *)rxdata; ++ ++ ret = i2c_transfer(i2c->adapter, xfer, 2); ++ if (ret < 0) ++ return ret; ++ if (ret != 2) ++ return -EIO; ++ ++ /* ++ * Byte 0 is transfer length, which is always 1 due ++ * to BCP register programming to 1 in rs9_probe(), ++ * ignore it and use data from Byte 1. ++ */ ++ *val = rxdata[1]; ++ return 0; ++} ++ + static const struct regmap_config rs9_regmap_config = { + .reg_bits = 8, + .val_bits = 8, +- .cache_type = REGCACHE_FLAT, +- .max_register = 0x8, ++ .cache_type = REGCACHE_NONE, ++ .max_register = RS9_REG_BCP, + .rd_table = &rs9_readable_table, + .wr_table = &rs9_writeable_table, ++ .reg_write = rs9_regmap_i2c_write, ++ .reg_read = rs9_regmap_i2c_read, + }; + + static int rs9_get_output_config(struct rs9_driver_data *rs9, int idx) +@@ -242,11 +295,17 @@ static int rs9_probe(struct i2c_client *client) + return ret; + } + +- rs9->regmap = devm_regmap_init_i2c(client, &rs9_regmap_config); ++ rs9->regmap = devm_regmap_init(&client->dev, NULL, ++ client, &rs9_regmap_config); + if (IS_ERR(rs9->regmap)) + return dev_err_probe(&client->dev, PTR_ERR(rs9->regmap), + "Failed to allocate register map\n"); + ++ /* Always read back 1 Byte via I2C */ ++ ret = regmap_write(rs9->regmap, RS9_REG_BCP, 1); ++ if (ret < 0) ++ return ret; ++ + /* Register clock */ + for (i = 0; i < rs9->chip_info->num_clks; i++) { + snprintf(name, 5, "DIF%d", i); +-- +2.35.1 + diff --git a/queue-6.0/drm-amd-pm-skip-loading-pptable-from-driver-on-secur.patch b/queue-6.0/drm-amd-pm-skip-loading-pptable-from-driver-on-secur.patch new file mode 100644 index 00000000000..d85ac0e7288 --- /dev/null +++ b/queue-6.0/drm-amd-pm-skip-loading-pptable-from-driver-on-secur.patch @@ -0,0 +1,37 @@ +From 915ff778c54f4909b5c038711892b13d6c93500f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Sep 2022 17:15:04 +0800 +Subject: drm/amd/pm: skip loading pptable from driver on secure board for + smu_v13_0_10 + +From: Kenneth Feng + +[ Upstream commit f700486cd1f2bf381671d1c2c7dc9000db10c50e ] + +skip loading pptable from driver on secure board since it's loaded from psp. + +Signed-off-by: Kenneth Feng +Reviewed-by: Guan Yu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c +index 93f9b8377539..750d8da84fac 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c +@@ -210,7 +210,8 @@ int smu_v13_0_init_pptable_microcode(struct smu_context *smu) + return 0; + + if ((adev->ip_versions[MP1_HWIP][0] == IP_VERSION(13, 0, 7)) || +- (adev->ip_versions[MP1_HWIP][0] == IP_VERSION(13, 0, 0))) ++ (adev->ip_versions[MP1_HWIP][0] == IP_VERSION(13, 0, 0)) || ++ (adev->ip_versions[MP1_HWIP][0] == IP_VERSION(13, 0, 10))) + return 0; + + /* override pptable_id from driver parameter */ +-- +2.35.1 + diff --git a/queue-6.0/drm-amdgpu-dequeue-mes-scheduler-during-fini.patch b/queue-6.0/drm-amdgpu-dequeue-mes-scheduler-during-fini.patch new file mode 100644 index 00000000000..751be29526d --- /dev/null +++ b/queue-6.0/drm-amdgpu-dequeue-mes-scheduler-during-fini.patch @@ -0,0 +1,98 @@ +From 475f9b41ce74dc5e2a5611a362e513abbd0e7a0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Oct 2022 11:31:55 +0800 +Subject: drm/amdgpu: dequeue mes scheduler during fini + +From: YuBiao Wang + +[ Upstream commit 2abe92c7adc9c0397ba51bf74909b85bc0fff84b ] + +[Why] +If mes is not dequeued during fini, mes will be in an uncleaned state +during reload, then mes couldn't receive some commands which leads to +reload failure. + +[How] +Perform MES dequeue via MMIO after all the unmap jobs are done by mes +and before kiq fini. + +v2: Move the dequeue operation inside kiq_hw_fini. + +Signed-off-by: YuBiao Wang +Reviewed-by: Jack Xiao +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 42 ++++++++++++++++++++++++-- + 1 file changed, 39 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c b/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c +index f92744b8d79d..2dd827472d6e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c +@@ -1145,6 +1145,42 @@ static int mes_v11_0_sw_fini(void *handle) + return 0; + } + ++static void mes_v11_0_kiq_dequeue_sched(struct amdgpu_device *adev) ++{ ++ uint32_t data; ++ int i; ++ ++ mutex_lock(&adev->srbm_mutex); ++ soc21_grbm_select(adev, 3, AMDGPU_MES_SCHED_PIPE, 0, 0); ++ ++ /* disable the queue if it's active */ ++ if (RREG32_SOC15(GC, 0, regCP_HQD_ACTIVE) & 1) { ++ WREG32_SOC15(GC, 0, regCP_HQD_DEQUEUE_REQUEST, 1); ++ for (i = 0; i < adev->usec_timeout; i++) { ++ if (!(RREG32_SOC15(GC, 0, regCP_HQD_ACTIVE) & 1)) ++ break; ++ udelay(1); ++ } ++ } ++ data = RREG32_SOC15(GC, 0, regCP_HQD_PQ_DOORBELL_CONTROL); ++ data = REG_SET_FIELD(data, CP_HQD_PQ_DOORBELL_CONTROL, ++ DOORBELL_EN, 0); ++ data = REG_SET_FIELD(data, CP_HQD_PQ_DOORBELL_CONTROL, ++ DOORBELL_HIT, 1); ++ WREG32_SOC15(GC, 0, regCP_HQD_PQ_DOORBELL_CONTROL, data); ++ ++ WREG32_SOC15(GC, 0, regCP_HQD_PQ_DOORBELL_CONTROL, 0); ++ ++ WREG32_SOC15(GC, 0, regCP_HQD_PQ_WPTR_LO, 0); ++ WREG32_SOC15(GC, 0, regCP_HQD_PQ_WPTR_HI, 0); ++ WREG32_SOC15(GC, 0, regCP_HQD_PQ_RPTR, 0); ++ ++ soc21_grbm_select(adev, 0, 0, 0, 0); ++ mutex_unlock(&adev->srbm_mutex); ++ ++ adev->mes.ring.sched.ready = false; ++} ++ + static void mes_v11_0_kiq_setting(struct amdgpu_ring *ring) + { + uint32_t tmp; +@@ -1196,6 +1232,9 @@ static int mes_v11_0_kiq_hw_init(struct amdgpu_device *adev) + + static int mes_v11_0_kiq_hw_fini(struct amdgpu_device *adev) + { ++ if (adev->mes.ring.sched.ready) ++ mes_v11_0_kiq_dequeue_sched(adev); ++ + mes_v11_0_enable(adev, false); + return 0; + } +@@ -1251,9 +1290,6 @@ static int mes_v11_0_hw_init(void *handle) + + static int mes_v11_0_hw_fini(void *handle) + { +- struct amdgpu_device *adev = (struct amdgpu_device *)handle; +- +- adev->mes.ring.sched.ready = false; + return 0; + } + +-- +2.35.1 + diff --git a/queue-6.0/drm-amdgpu-program-gc-registers-through-rlcg-interfa.patch b/queue-6.0/drm-amdgpu-program-gc-registers-through-rlcg-interfa.patch new file mode 100644 index 00000000000..d11dc0ba4d7 --- /dev/null +++ b/queue-6.0/drm-amdgpu-program-gc-registers-through-rlcg-interfa.patch @@ -0,0 +1,109 @@ +From 68e7b645df6963b57d1af58508d797a93d440370 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Sep 2022 14:13:02 +0800 +Subject: drm/amdgpu: Program GC registers through RLCG interface in + gfx_v11/gmc_v11 + +From: Yifan Zha + +[ Upstream commit 97a3d6090f5c2a165dc88bda05c1dcf9f08bf886 ] + +[Why] +L1 blocks most of GC registers accessing by MMIO. + +[How] +Use RLCG interface to program GC registers under SRIOV VF in full access time. + +Signed-off-by: Yifan Zha +Reviewed-by: Hawking Zhang +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v11.c | 2 +- + drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 +- + drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c | 18 +++++++++++------- + 3 files changed, 13 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v11.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v11.c +index 0b0a72ca5695..7e80caa05060 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v11.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v11.c +@@ -111,7 +111,7 @@ static int init_interrupts_v11(struct amdgpu_device *adev, uint32_t pipe_id) + + lock_srbm(adev, mec, pipe, 0, 0); + +- WREG32(SOC15_REG_OFFSET(GC, 0, regCPC_INT_CNTL), ++ WREG32_SOC15(GC, 0, regCPC_INT_CNTL, + CP_INT_CNTL_RING0__TIME_STAMP_INT_ENABLE_MASK | + CP_INT_CNTL_RING0__OPCODE_ERROR_INT_ENABLE_MASK); + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +index daf8ba8235cd..03775e0a8100 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +@@ -1729,7 +1729,7 @@ static void gfx_v11_0_init_compute_vmid(struct amdgpu_device *adev) + WREG32_SOC15(GC, 0, regSH_MEM_BASES, sh_mem_bases); + + /* Enable trap for each kfd vmid. */ +- data = RREG32(SOC15_REG_OFFSET(GC, 0, regSPI_GDBG_PER_VMID_CNTL)); ++ data = RREG32_SOC15(GC, 0, regSPI_GDBG_PER_VMID_CNTL); + data = REG_SET_FIELD(data, SPI_GDBG_PER_VMID_CNTL, TRAP_EN, 1); + } + soc21_grbm_select(adev, 0, 0, 0, 0); +diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c +index 1471bfb9ae38..2475fdbe8010 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c +@@ -185,6 +185,10 @@ static void gmc_v11_0_flush_vm_hub(struct amdgpu_device *adev, uint32_t vmid, + /* Use register 17 for GART */ + const unsigned eng = 17; + unsigned int i; ++ unsigned char hub_ip = 0; ++ ++ hub_ip = (vmhub == AMDGPU_GFXHUB_0) ? ++ GC_HWIP : MMHUB_HWIP; + + spin_lock(&adev->gmc.invalidate_lock); + /* +@@ -198,8 +202,8 @@ static void gmc_v11_0_flush_vm_hub(struct amdgpu_device *adev, uint32_t vmid, + if (use_semaphore) { + for (i = 0; i < adev->usec_timeout; i++) { + /* a read return value of 1 means semaphore acuqire */ +- tmp = RREG32_NO_KIQ(hub->vm_inv_eng0_sem + +- hub->eng_distance * eng); ++ tmp = RREG32_RLC_NO_KIQ(hub->vm_inv_eng0_sem + ++ hub->eng_distance * eng, hub_ip); + if (tmp & 0x1) + break; + udelay(1); +@@ -209,12 +213,12 @@ static void gmc_v11_0_flush_vm_hub(struct amdgpu_device *adev, uint32_t vmid, + DRM_ERROR("Timeout waiting for sem acquire in VM flush!\n"); + } + +- WREG32_NO_KIQ(hub->vm_inv_eng0_req + hub->eng_distance * eng, inv_req); ++ WREG32_RLC_NO_KIQ(hub->vm_inv_eng0_req + hub->eng_distance * eng, inv_req, hub_ip); + + /* Wait for ACK with a delay.*/ + for (i = 0; i < adev->usec_timeout; i++) { +- tmp = RREG32_NO_KIQ(hub->vm_inv_eng0_ack + +- hub->eng_distance * eng); ++ tmp = RREG32_RLC_NO_KIQ(hub->vm_inv_eng0_ack + ++ hub->eng_distance * eng, hub_ip); + tmp &= 1 << vmid; + if (tmp) + break; +@@ -228,8 +232,8 @@ static void gmc_v11_0_flush_vm_hub(struct amdgpu_device *adev, uint32_t vmid, + * add semaphore release after invalidation, + * write with 0 means semaphore release + */ +- WREG32_NO_KIQ(hub->vm_inv_eng0_sem + +- hub->eng_distance * eng, 0); ++ WREG32_RLC_NO_KIQ(hub->vm_inv_eng0_sem + ++ hub->eng_distance * eng, 0, hub_ip); + + /* Issue additional private vm invalidation to MMHUB */ + if ((vmhub != AMDGPU_GFXHUB_0) && +-- +2.35.1 + diff --git a/queue-6.0/drm-amdgpu-set-vm_update_mode-0-as-default-for-sienn.patch b/queue-6.0/drm-amdgpu-set-vm_update_mode-0-as-default-for-sienn.patch new file mode 100644 index 00000000000..611f10f2a5d --- /dev/null +++ b/queue-6.0/drm-amdgpu-set-vm_update_mode-0-as-default-for-sienn.patch @@ -0,0 +1,87 @@ +From 4a84967ed8fe821d39da1749397ac1163db45e96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Oct 2022 15:39:44 +0200 +Subject: drm/amdgpu: set vm_update_mode=0 as default for Sienna Cichlid in + SRIOV case + +From: Danijel Slivka + +[ Upstream commit 65f8682b9aaae20c2cdee993e6fe52374ad513c9 ] + +For asic with VF MMIO access protection avoid using CPU for VM table updates. +CPU pagetable updates have issues with HDP flush as VF MMIO access protection +blocks write to mmBIF_BX_DEV0_EPF0_VF0_HDP_MEM_COHERENCY_FLUSH_CNTL register +during sriov runtime. + +v3: introduce virtualization capability flag AMDGPU_VF_MMIO_ACCESS_PROTECT +which indicates that VF MMIO write access is not allowed in sriov runtime + +Signed-off-by: Danijel Slivka +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 6 ++++++ + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 4 ++++ + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +++++- + 3 files changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +index 9be57389301b..af5aeb0ec2e9 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +@@ -726,6 +726,12 @@ void amdgpu_detect_virtualization(struct amdgpu_device *adev) + adev->virt.caps |= AMDGPU_PASSTHROUGH_MODE; + } + ++ if (amdgpu_sriov_vf(adev) && adev->asic_type == CHIP_SIENNA_CICHLID) ++ /* VF MMIO access (except mailbox range) from CPU ++ * will be blocked during sriov runtime ++ */ ++ adev->virt.caps |= AMDGPU_VF_MMIO_ACCESS_PROTECT; ++ + /* we have the ability to check now */ + if (amdgpu_sriov_vf(adev)) { + switch (adev->asic_type) { +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h +index 239f232f9c02..617d072275eb 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h +@@ -31,6 +31,7 @@ + #define AMDGPU_SRIOV_CAPS_IS_VF (1 << 2) /* this GPU is a virtual function */ + #define AMDGPU_PASSTHROUGH_MODE (1 << 3) /* thw whole GPU is pass through for VM */ + #define AMDGPU_SRIOV_CAPS_RUNTIME (1 << 4) /* is out of full access mode */ ++#define AMDGPU_VF_MMIO_ACCESS_PROTECT (1 << 5) /* MMIO write access is not allowed in sriov runtime */ + + /* flags for indirect register access path supported by rlcg for sriov */ + #define AMDGPU_RLCG_GC_WRITE_LEGACY (0x8 << 28) +@@ -294,6 +295,9 @@ struct amdgpu_video_codec_info; + #define amdgpu_passthrough(adev) \ + ((adev)->virt.caps & AMDGPU_PASSTHROUGH_MODE) + ++#define amdgpu_sriov_vf_mmio_access_protection(adev) \ ++((adev)->virt.caps & AMDGPU_VF_MMIO_ACCESS_PROTECT) ++ + static inline bool is_virtual_machine(void) + { + #if defined(CONFIG_X86) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +index 690fd4f639f1..04130f8813ef 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +@@ -2301,7 +2301,11 @@ void amdgpu_vm_manager_init(struct amdgpu_device *adev) + */ + #ifdef CONFIG_X86_64 + if (amdgpu_vm_update_mode == -1) { +- if (amdgpu_gmc_vram_full_visible(&adev->gmc)) ++ /* For asic with VF MMIO access protection ++ * avoid using CPU for VM table updates ++ */ ++ if (amdgpu_gmc_vram_full_visible(&adev->gmc) && ++ !amdgpu_sriov_vf_mmio_access_protection(adev)) + adev->vm_manager.vm_update_mode = + AMDGPU_VM_USE_CPU_FOR_COMPUTE; + else +-- +2.35.1 + diff --git a/queue-6.0/drm-amdkfd-fix-type-of-reset_type-parameter-in-hqd_d.patch b/queue-6.0/drm-amdkfd-fix-type-of-reset_type-parameter-in-hqd_d.patch new file mode 100644 index 00000000000..1ba47a150ef --- /dev/null +++ b/queue-6.0/drm-amdkfd-fix-type-of-reset_type-parameter-in-hqd_d.patch @@ -0,0 +1,51 @@ +From 27f14b0cb9d92b1d8c2248538884c100c6ee0f27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 09:28:38 -0700 +Subject: drm/amdkfd: Fix type of reset_type parameter in hqd_destroy() + callback + +From: Nathan Chancellor + +[ Upstream commit e688ba3e276422aa88eae7a54186a95320836081 ] + +When booting a kernel compiled with CONFIG_CFI_CLANG on a machine with +an RX 6700 XT, there is a CFI failure in kfd_destroy_mqd_cp(): + + [ 12.894543] CFI failure at kfd_destroy_mqd_cp+0x2a/0x40 [amdgpu] (target: hqd_destroy_v10_3+0x0/0x260 [amdgpu]; expected type: 0x8594d794) + +Clang's kernel Control Flow Integrity (kCFI) makes sure that all +indirect call targets have a type that exactly matches the function +pointer prototype. In this case, hqd_destroy()'s third parameter, +reset_type, should have a type of 'uint32_t' but every implementation of +this callback has a third parameter type of 'enum kfd_preempt_type'. + +Update the function pointer prototype to match reality so that there is +no more CFI violation. + +Link: https://github.com/ClangBuiltLinux/linux/issues/1738 +Signed-off-by: Nathan Chancellor +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/include/kgd_kfd_interface.h | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/include/kgd_kfd_interface.h b/drivers/gpu/drm/amd/include/kgd_kfd_interface.h +index e85364dff4e0..5cb3e8634739 100644 +--- a/drivers/gpu/drm/amd/include/kgd_kfd_interface.h ++++ b/drivers/gpu/drm/amd/include/kgd_kfd_interface.h +@@ -262,8 +262,9 @@ struct kfd2kgd_calls { + uint32_t queue_id); + + int (*hqd_destroy)(struct amdgpu_device *adev, void *mqd, +- uint32_t reset_type, unsigned int timeout, +- uint32_t pipe_id, uint32_t queue_id); ++ enum kfd_preempt_type reset_type, ++ unsigned int timeout, uint32_t pipe_id, ++ uint32_t queue_id); + + bool (*hqd_sdma_is_occupied)(struct amdgpu_device *adev, void *mqd); + +-- +2.35.1 + diff --git a/queue-6.0/drm-i915-stop-abusing-swiotlb_max_segment.patch b/queue-6.0/drm-i915-stop-abusing-swiotlb_max_segment.patch new file mode 100644 index 00000000000..23fc1ee1bba --- /dev/null +++ b/queue-6.0/drm-i915-stop-abusing-swiotlb_max_segment.patch @@ -0,0 +1,189 @@ +From c0b51f11794cfeb726b34c933d08b71838cc19c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Oct 2022 13:03:08 +0200 +Subject: drm/i915: stop abusing swiotlb_max_segment +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Robert Beckett + +[ Upstream commit d3f6bacfca86f6cf6bf85be1e8b54083d68d8195 ] + +swiotlb_max_segment used to return either the maximum size that swiotlb +could bounce, or for Xen PV PAGE_SIZE even if swiotlb could bounce buffer +larger mappings. This made i915 on Xen PV work as it bypasses the +coherency aspect of the DMA API and can't cope with bounce buffering +and this avoided bounce buffering for the Xen/PV case. + +So instead of adding this hack back, check for Xen/PV directly in i915 +for the Xen case and otherwise use the proper DMA API helper to query +the maximum mapping size. + +Replace swiotlb_max_segment() calls with dma_max_mapping_size(). +In i915_gem_object_get_pages_internal() no longer consider max_segment +only if CONFIG_SWIOTLB is enabled. There can be other (iommu related) +causes of specific max segment sizes. + +Fixes: a2daa27c0c61 ("swiotlb: simplify swiotlb_max_segment") +Reported-by: Marek Marczykowski-Górecki +Signed-off-by: Robert Beckett +Signed-off-by: Christoph Hellwig +[hch: added the Xen hack, rewrote the changelog] +Reviewed-by: Tvrtko Ursulin +Signed-off-by: Tvrtko Ursulin +Link: https://patchwork.freedesktop.org/patch/msgid/20221020110308.1582518-1-hch@lst.de +(cherry picked from commit 78a07fe777c42800bd1adaec12abe5dcee43919e) +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gem/i915_gem_internal.c | 19 +++-------- + drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 2 +- + drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 4 +-- + drivers/gpu/drm/i915/gem/i915_gem_userptr.c | 2 +- + drivers/gpu/drm/i915/i915_scatterlist.h | 34 ++++++++++++-------- + 5 files changed, 29 insertions(+), 32 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gem/i915_gem_internal.c b/drivers/gpu/drm/i915/gem/i915_gem_internal.c +index c698f95af15f..629acb403a2c 100644 +--- a/drivers/gpu/drm/i915/gem/i915_gem_internal.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_internal.c +@@ -6,7 +6,6 @@ + + #include + #include +-#include + + #include "i915_drv.h" + #include "i915_gem.h" +@@ -38,22 +37,12 @@ static int i915_gem_object_get_pages_internal(struct drm_i915_gem_object *obj) + struct scatterlist *sg; + unsigned int sg_page_sizes; + unsigned int npages; +- int max_order; ++ int max_order = MAX_ORDER; ++ unsigned int max_segment; + gfp_t gfp; + +- max_order = MAX_ORDER; +-#ifdef CONFIG_SWIOTLB +- if (is_swiotlb_active(obj->base.dev->dev)) { +- unsigned int max_segment; +- +- max_segment = swiotlb_max_segment(); +- if (max_segment) { +- max_segment = max_t(unsigned int, max_segment, +- PAGE_SIZE) >> PAGE_SHIFT; +- max_order = min(max_order, ilog2(max_segment)); +- } +- } +-#endif ++ max_segment = i915_sg_segment_size(i915->drm.dev) >> PAGE_SHIFT; ++ max_order = min(max_order, get_order(max_segment)); + + gfp = GFP_KERNEL | __GFP_HIGHMEM | __GFP_RECLAIMABLE; + if (IS_I965GM(i915) || IS_I965G(i915)) { +diff --git a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c +index 4eed3dd90ba8..34b9c76cd8e6 100644 +--- a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c +@@ -194,7 +194,7 @@ static int shmem_get_pages(struct drm_i915_gem_object *obj) + struct intel_memory_region *mem = obj->mm.region; + struct address_space *mapping = obj->base.filp->f_mapping; + const unsigned long page_count = obj->base.size / PAGE_SIZE; +- unsigned int max_segment = i915_sg_segment_size(); ++ unsigned int max_segment = i915_sg_segment_size(i915->drm.dev); + struct sg_table *st; + struct sgt_iter sgt_iter; + struct page *page; +diff --git a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c +index 6f3ab7ade41a..e85cfc36359a 100644 +--- a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c +@@ -189,7 +189,7 @@ static int i915_ttm_tt_shmem_populate(struct ttm_device *bdev, + struct drm_i915_private *i915 = container_of(bdev, typeof(*i915), bdev); + struct intel_memory_region *mr = i915->mm.regions[INTEL_MEMORY_SYSTEM]; + struct i915_ttm_tt *i915_tt = container_of(ttm, typeof(*i915_tt), ttm); +- const unsigned int max_segment = i915_sg_segment_size(); ++ const unsigned int max_segment = i915_sg_segment_size(i915->drm.dev); + const size_t size = (size_t)ttm->num_pages << PAGE_SHIFT; + struct file *filp = i915_tt->filp; + struct sgt_iter sgt_iter; +@@ -568,7 +568,7 @@ static struct i915_refct_sgt *i915_ttm_tt_get_st(struct ttm_tt *ttm) + ret = sg_alloc_table_from_pages_segment(st, + ttm->pages, ttm->num_pages, + 0, (unsigned long)ttm->num_pages << PAGE_SHIFT, +- i915_sg_segment_size(), GFP_KERNEL); ++ i915_sg_segment_size(i915_tt->dev), GFP_KERNEL); + if (ret) { + st->sgl = NULL; + return ERR_PTR(ret); +diff --git a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c +index 8423df021b71..e4515d6acd43 100644 +--- a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c +@@ -129,7 +129,7 @@ static void i915_gem_object_userptr_drop_ref(struct drm_i915_gem_object *obj) + static int i915_gem_userptr_get_pages(struct drm_i915_gem_object *obj) + { + const unsigned long num_pages = obj->base.size >> PAGE_SHIFT; +- unsigned int max_segment = i915_sg_segment_size(); ++ unsigned int max_segment = i915_sg_segment_size(obj->base.dev->dev); + struct sg_table *st; + unsigned int sg_page_sizes; + struct page **pvec; +diff --git a/drivers/gpu/drm/i915/i915_scatterlist.h b/drivers/gpu/drm/i915/i915_scatterlist.h +index 9ddb3e743a3e..b0a1db44f895 100644 +--- a/drivers/gpu/drm/i915/i915_scatterlist.h ++++ b/drivers/gpu/drm/i915/i915_scatterlist.h +@@ -9,7 +9,8 @@ + + #include + #include +-#include ++#include ++#include + + #include "i915_gem.h" + +@@ -127,19 +128,26 @@ static inline unsigned int i915_sg_dma_sizes(struct scatterlist *sg) + return page_sizes; + } + +-static inline unsigned int i915_sg_segment_size(void) ++static inline unsigned int i915_sg_segment_size(struct device *dev) + { +- unsigned int size = swiotlb_max_segment(); +- +- if (size == 0) +- size = UINT_MAX; +- +- size = rounddown(size, PAGE_SIZE); +- /* swiotlb_max_segment_size can return 1 byte when it means one page. */ +- if (size < PAGE_SIZE) +- size = PAGE_SIZE; +- +- return size; ++ size_t max = min_t(size_t, UINT_MAX, dma_max_mapping_size(dev)); ++ ++ /* ++ * For Xen PV guests pages aren't contiguous in DMA (machine) address ++ * space. The DMA API takes care of that both in dma_alloc_* (by ++ * calling into the hypervisor to make the pages contiguous) and in ++ * dma_map_* (by bounce buffering). But i915 abuses ignores the ++ * coherency aspects of the DMA API and thus can't cope with bounce ++ * buffering actually happening, so add a hack here to force small ++ * allocations and mappings when running in PV mode on Xen. ++ * ++ * Note this will still break if bounce buffering is required for other ++ * reasons, like confidential computing hypervisors or PCIe root ports ++ * with addressing limitations. ++ */ ++ if (xen_pv_domain()) ++ max = PAGE_SIZE; ++ return round_down(max, PAGE_SIZE); + } + + bool i915_sg_trim(struct sg_table *orig_st); +-- +2.35.1 + diff --git a/queue-6.0/drm-rockchip-dw_hdmi-filter-regulator-eprobe_defer-e.patch b/queue-6.0/drm-rockchip-dw_hdmi-filter-regulator-eprobe_defer-e.patch new file mode 100644 index 00000000000..00adac133ac --- /dev/null +++ b/queue-6.0/drm-rockchip-dw_hdmi-filter-regulator-eprobe_defer-e.patch @@ -0,0 +1,45 @@ +From 44496a603fb376cf32e7c1fdbcef1a664e75a474 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Sep 2022 22:37:52 +0200 +Subject: drm/rockchip: dw_hdmi: filter regulator -EPROBE_DEFER error messages + +From: Aurelien Jarno + +[ Upstream commit bfab00b94bd8569cdb84a6511d6615e6a8104e9c ] + +When the avdd-0v9 or avdd-1v8 supply are not yet available, EPROBE_DEFER +is returned by rockchip_hdmi_parse_dt(). This causes the following error +message to be printed multiple times: + + dwhdmi-rockchip fe0a0000.hdmi: [drm:dw_hdmi_rockchip_bind [rockchipdrm]] *ERROR* Unable to parse OF data + +Fix that by not printing the message when rockchip_hdmi_parse_dt() +returns -EPROBE_DEFER. + +Fixes: ca80c4eb4b01 ("drm/rockchip: dw_hdmi: add regulator support") +Signed-off-by: Aurelien Jarno +Reviewed-by: Dmitry Osipenko +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20220926203752.5430-1-aurelien@aurel32.net +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c b/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c +index c14f88893868..2f4b8f64cbad 100644 +--- a/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c ++++ b/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c +@@ -565,7 +565,8 @@ static int dw_hdmi_rockchip_bind(struct device *dev, struct device *master, + + ret = rockchip_hdmi_parse_dt(hdmi); + if (ret) { +- DRM_DEV_ERROR(hdmi->dev, "Unable to parse OF data\n"); ++ if (ret != -EPROBE_DEFER) ++ DRM_DEV_ERROR(hdmi->dev, "Unable to parse OF data\n"); + return ret; + } + +-- +2.35.1 + diff --git a/queue-6.0/drm-rockchip-fix-fbdev-on-non-iommu-devices.patch b/queue-6.0/drm-rockchip-fix-fbdev-on-non-iommu-devices.patch new file mode 100644 index 00000000000..2a862522ac2 --- /dev/null +++ b/queue-6.0/drm-rockchip-fix-fbdev-on-non-iommu-devices.patch @@ -0,0 +1,54 @@ +From 03720982f03574244b0a13c46b9258bc6bd3e04d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Oct 2022 19:12:47 +0100 +Subject: drm/rockchip: fix fbdev on non-IOMMU devices + +From: John Keeping + +[ Upstream commit ab78c74cfc5a3caa2bbb7627cb8f3bca40bb5fb0 ] + +When switching to the generic fbdev infrastructure, it was missed that +framebuffers were created with the alloc_kmap parameter to +rockchip_gem_create_object() set to true. The generic infrastructure +calls this via the .dumb_create() driver operation and thus creates a +buffer without an associated kmap. + +alloc_kmap only makes a difference on devices without an IOMMU, but when +it is missing rockchip_gem_prime_vmap() fails and the framebuffer cannot +be used. + +Detect the case where a buffer is being allocated for the framebuffer +and ensure a kernel mapping is created in this case. + +Fixes: 24af7c34b290 ("drm/rockchip: use generic fbdev setup") +Reported-by: Johan Jonker +Cc: Thomas Zimmermann +Signed-off-by: John Keeping +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20221020181248.2497065-1-john@metanate.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c +index 985584147da1..cf8322c300bd 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c +@@ -364,9 +364,12 @@ rockchip_gem_create_with_handle(struct drm_file *file_priv, + { + struct rockchip_gem_object *rk_obj; + struct drm_gem_object *obj; ++ bool is_framebuffer; + int ret; + +- rk_obj = rockchip_gem_create_object(drm, size, false); ++ is_framebuffer = drm->fb_helper && file_priv == drm->fb_helper->client.file; ++ ++ rk_obj = rockchip_gem_create_object(drm, size, is_framebuffer); + if (IS_ERR(rk_obj)) + return ERR_CAST(rk_obj); + +-- +2.35.1 + diff --git a/queue-6.0/drm-vc4-hdmi-check-the-hsm-rate-at-runtime_resume.patch b/queue-6.0/drm-vc4-hdmi-check-the-hsm-rate-at-runtime_resume.patch new file mode 100644 index 00000000000..06c254e1e68 --- /dev/null +++ b/queue-6.0/drm-vc4-hdmi-check-the-hsm-rate-at-runtime_resume.patch @@ -0,0 +1,73 @@ +From 2a7006d3630faa06b3b46a5add48c66d8c4bb04e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Sep 2022 11:21:18 +0200 +Subject: drm/vc4: hdmi: Check the HSM rate at runtime_resume + +From: Maxime Ripard + +[ Upstream commit 4190e8bbcbc77a9c36724681801cedc5229e7fc2 ] + +If our HSM clock has not been properly initialized, any register access +will silently lock up the system. + +Let's check that this can't happen by adding a check for the rate before +any register access, and error out otherwise. + +Link: https://lore.kernel.org/dri-devel/20220922145448.w3xfywkn5ecak2et@pengutronix.de/ +Reviewed-by: Javier Martinez Canillas +Tested-by: Stefan Wahren +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20220929-rpi-pi3-unplugged-fixes-v1-2-cd22e962296c@cerno.tech +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_hdmi.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c +index 780a19a75c3f..874c6bd787c5 100644 +--- a/drivers/gpu/drm/vc4/vc4_hdmi.c ++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c +@@ -2869,6 +2869,7 @@ static int vc4_hdmi_runtime_resume(struct device *dev) + struct vc4_hdmi *vc4_hdmi = dev_get_drvdata(dev); + unsigned long __maybe_unused flags; + u32 __maybe_unused value; ++ unsigned long rate; + int ret; + + /* +@@ -2884,6 +2885,21 @@ static int vc4_hdmi_runtime_resume(struct device *dev) + if (ret) + return ret; + ++ /* ++ * Whenever the RaspberryPi boots without an HDMI monitor ++ * plugged in, the firmware won't have initialized the HSM clock ++ * rate and it will be reported as 0. ++ * ++ * If we try to access a register of the controller in such a ++ * case, it will lead to a silent CPU stall. Let's make sure we ++ * prevent such a case. ++ */ ++ rate = clk_get_rate(vc4_hdmi->hsm_clock); ++ if (!rate) { ++ ret = -EINVAL; ++ goto err_disable_clk; ++ } ++ + if (vc4_hdmi->variant->reset) + vc4_hdmi->variant->reset(vc4_hdmi); + +@@ -2905,6 +2921,10 @@ static int vc4_hdmi_runtime_resume(struct device *dev) + #endif + + return 0; ++ ++err_disable_clk: ++ clk_disable_unprepare(vc4_hdmi->hsm_clock); ++ return ret; + } + + static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data) +-- +2.35.1 + diff --git a/queue-6.0/efi-tpm-pass-correct-address-to-memblock_reserve.patch b/queue-6.0/efi-tpm-pass-correct-address-to-memblock_reserve.patch new file mode 100644 index 00000000000..bb75b70741d --- /dev/null +++ b/queue-6.0/efi-tpm-pass-correct-address-to-memblock_reserve.patch @@ -0,0 +1,46 @@ +From a94b74be495ee9eb23e680e9e052d61434223e73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Oct 2022 08:23:52 -0700 +Subject: efi/tpm: Pass correct address to memblock_reserve + +From: Jerry Snitselaar + +[ Upstream commit f4cd18c5b2000df0c382f6530eeca9141ea41faf ] + +memblock_reserve() expects a physical address, but the address being +passed for the TPM final events log is what was returned from +early_memremap(). This results in something like the following: + +[ 0.000000] memblock_reserve: [0xffffffffff2c0000-0xffffffffff2c00e4] efi_tpm_eventlog_init+0x324/0x370 + +Pass the address from efi like what is done for the TPM events log. + +Fixes: c46f3405692d ("tpm: Reserve the TPM final events table") +Cc: Matthew Garrett +Cc: Jarkko Sakkinen +Cc: Bartosz Szczepanek +Cc: Ard Biesheuvel +Signed-off-by: Jerry Snitselaar +Acked-by: Jarkko Sakkinen +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/tpm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/efi/tpm.c b/drivers/firmware/efi/tpm.c +index 8f665678e9e3..e8d69bd548f3 100644 +--- a/drivers/firmware/efi/tpm.c ++++ b/drivers/firmware/efi/tpm.c +@@ -97,7 +97,7 @@ int __init efi_tpm_eventlog_init(void) + goto out_calc; + } + +- memblock_reserve((unsigned long)final_tbl, ++ memblock_reserve(efi.tpm_final_log, + tbl_size + sizeof(*final_tbl)); + efi_tpm_final_log_size = tbl_size; + +-- +2.35.1 + diff --git a/queue-6.0/firmware-arm_scmi-fix-deferred_tx_wq-release-on-erro.patch b/queue-6.0/firmware-arm_scmi-fix-deferred_tx_wq-release-on-erro.patch new file mode 100644 index 00000000000..7fdd8a78988 --- /dev/null +++ b/queue-6.0/firmware-arm_scmi-fix-deferred_tx_wq-release-on-erro.patch @@ -0,0 +1,88 @@ +From c2afe61bfb6524b6718f10a9672bf5ac1c71b89a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Oct 2022 15:08:31 +0100 +Subject: firmware: arm_scmi: Fix deferred_tx_wq release on error paths + +From: Cristian Marussi + +[ Upstream commit 1eff6929aff594fba3182660f7b6213ec0ceda0c ] + +Use devres to allocate the dedicated deferred_tx_wq polling workqueue so +as to automatically trigger the proper resource release on error path. + +Reported-by: Dan Carpenter +Fixes: 5a3b7185c47c ("firmware: arm_scmi: Add atomic mode support to virtio transport") +Signed-off-by: Cristian Marussi +Link: https://lore.kernel.org/r/20221028140833.280091-6-cristian.marussi@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/virtio.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/drivers/firmware/arm_scmi/virtio.c b/drivers/firmware/arm_scmi/virtio.c +index 36b7686843a4..33c9b81a55cd 100644 +--- a/drivers/firmware/arm_scmi/virtio.c ++++ b/drivers/firmware/arm_scmi/virtio.c +@@ -148,7 +148,6 @@ static void scmi_vio_channel_cleanup_sync(struct scmi_vio_channel *vioch) + { + unsigned long flags; + DECLARE_COMPLETION_ONSTACK(vioch_shutdown_done); +- void *deferred_wq = NULL; + + /* + * Prepare to wait for the last release if not already released +@@ -162,16 +161,11 @@ static void scmi_vio_channel_cleanup_sync(struct scmi_vio_channel *vioch) + + vioch->shutdown_done = &vioch_shutdown_done; + virtio_break_device(vioch->vqueue->vdev); +- if (!vioch->is_rx && vioch->deferred_tx_wq) { +- deferred_wq = vioch->deferred_tx_wq; ++ if (!vioch->is_rx && vioch->deferred_tx_wq) + /* Cannot be kicked anymore after this...*/ + vioch->deferred_tx_wq = NULL; +- } + spin_unlock_irqrestore(&vioch->lock, flags); + +- if (deferred_wq) +- destroy_workqueue(deferred_wq); +- + scmi_vio_channel_release(vioch); + + /* Let any possibly concurrent RX path release the channel */ +@@ -416,6 +410,11 @@ static bool virtio_chan_available(struct device *dev, int idx) + return vioch && !vioch->cinfo; + } + ++static void scmi_destroy_tx_workqueue(void *deferred_tx_wq) ++{ ++ destroy_workqueue(deferred_tx_wq); ++} ++ + static int virtio_chan_setup(struct scmi_chan_info *cinfo, struct device *dev, + bool tx) + { +@@ -430,6 +429,8 @@ static int virtio_chan_setup(struct scmi_chan_info *cinfo, struct device *dev, + + /* Setup a deferred worker for polling. */ + if (tx && !vioch->deferred_tx_wq) { ++ int ret; ++ + vioch->deferred_tx_wq = + alloc_workqueue(dev_name(&scmi_vdev->dev), + WQ_UNBOUND | WQ_FREEZABLE | WQ_SYSFS, +@@ -437,6 +438,11 @@ static int virtio_chan_setup(struct scmi_chan_info *cinfo, struct device *dev, + if (!vioch->deferred_tx_wq) + return -ENOMEM; + ++ ret = devm_add_action_or_reset(dev, scmi_destroy_tx_workqueue, ++ vioch->deferred_tx_wq); ++ if (ret) ++ return ret; ++ + INIT_WORK(&vioch->deferred_tx_work, + scmi_vio_deferred_tx_worker); + } +-- +2.35.1 + diff --git a/queue-6.0/firmware-arm_scmi-fix-devres-allocation-device-in-vi.patch b/queue-6.0/firmware-arm_scmi-fix-devres-allocation-device-in-vi.patch new file mode 100644 index 00000000000..61232188349 --- /dev/null +++ b/queue-6.0/firmware-arm_scmi-fix-devres-allocation-device-in-vi.patch @@ -0,0 +1,53 @@ +From a20c39804adb5ad40c83af4c3822f047abba32c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Oct 2022 15:08:30 +0100 +Subject: firmware: arm_scmi: Fix devres allocation device in virtio transport + +From: Cristian Marussi + +[ Upstream commit 5ffc1c4cb896f8d2cf10309422da3633a616d60f ] + +SCMI virtio transport device managed allocations must use the main +platform device in devres operations instead of the channel devices. + +Cc: Peter Hilber +Fixes: 46abe13b5e3d ("firmware: arm_scmi: Add virtio transport") +Signed-off-by: Cristian Marussi +Link: https://lore.kernel.org/r/20221028140833.280091-5-cristian.marussi@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/virtio.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/firmware/arm_scmi/virtio.c b/drivers/firmware/arm_scmi/virtio.c +index 14709dbc96a1..36b7686843a4 100644 +--- a/drivers/firmware/arm_scmi/virtio.c ++++ b/drivers/firmware/arm_scmi/virtio.c +@@ -444,12 +444,12 @@ static int virtio_chan_setup(struct scmi_chan_info *cinfo, struct device *dev, + for (i = 0; i < vioch->max_msg; i++) { + struct scmi_vio_msg *msg; + +- msg = devm_kzalloc(cinfo->dev, sizeof(*msg), GFP_KERNEL); ++ msg = devm_kzalloc(dev, sizeof(*msg), GFP_KERNEL); + if (!msg) + return -ENOMEM; + + if (tx) { +- msg->request = devm_kzalloc(cinfo->dev, ++ msg->request = devm_kzalloc(dev, + VIRTIO_SCMI_MAX_PDU_SIZE, + GFP_KERNEL); + if (!msg->request) +@@ -458,7 +458,7 @@ static int virtio_chan_setup(struct scmi_chan_info *cinfo, struct device *dev, + refcount_set(&msg->users, 1); + } + +- msg->input = devm_kzalloc(cinfo->dev, VIRTIO_SCMI_MAX_PDU_SIZE, ++ msg->input = devm_kzalloc(dev, VIRTIO_SCMI_MAX_PDU_SIZE, + GFP_KERNEL); + if (!msg->input) + return -ENOMEM; +-- +2.35.1 + diff --git a/queue-6.0/firmware-arm_scmi-make-rx-chan_setup-fail-on-memory-.patch b/queue-6.0/firmware-arm_scmi-make-rx-chan_setup-fail-on-memory-.patch new file mode 100644 index 00000000000..a44ccf6e2c8 --- /dev/null +++ b/queue-6.0/firmware-arm_scmi-make-rx-chan_setup-fail-on-memory-.patch @@ -0,0 +1,46 @@ +From 36a2afbf2d3bcb2e076d99fb82a2346083258a98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Oct 2022 15:08:29 +0100 +Subject: firmware: arm_scmi: Make Rx chan_setup fail on memory errors + +From: Cristian Marussi + +[ Upstream commit be9ba1f7f9e0b565b19f4294f5871da9d654bc6d ] + +SCMI Rx channels are optional and they can fail to be setup when not +present but anyway channels setup routines must bail-out on memory errors. + +Make channels setup, and related probing, fail when memory errors are +reported on Rx channels. + +Fixes: 5c8a47a5a91d ("firmware: arm_scmi: Make scmi core independent of the transport type") +Signed-off-by: Cristian Marussi +Link: https://lore.kernel.org/r/20221028140833.280091-4-cristian.marussi@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/driver.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c +index 1b9aa34b8e47..9022f5ee29aa 100644 +--- a/drivers/firmware/arm_scmi/driver.c ++++ b/drivers/firmware/arm_scmi/driver.c +@@ -2044,8 +2044,12 @@ scmi_txrx_setup(struct scmi_info *info, struct device *dev, int prot_id) + { + int ret = scmi_chan_setup(info, dev, prot_id, true); + +- if (!ret) /* Rx is optional, hence no error check */ +- scmi_chan_setup(info, dev, prot_id, false); ++ if (!ret) { ++ /* Rx is optional, report only memory errors */ ++ ret = scmi_chan_setup(info, dev, prot_id, false); ++ if (ret && ret != -ENOMEM) ++ ret = 0; ++ } + + return ret; + } +-- +2.35.1 + diff --git a/queue-6.0/firmware-arm_scmi-suppress-the-driver-s-bind-attribu.patch b/queue-6.0/firmware-arm_scmi-suppress-the-driver-s-bind-attribu.patch new file mode 100644 index 00000000000..b9634db59f6 --- /dev/null +++ b/queue-6.0/firmware-arm_scmi-suppress-the-driver-s-bind-attribu.patch @@ -0,0 +1,36 @@ +From 3a4a71414156a8f0ef08883b9cf25178fd60d4dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Oct 2022 15:08:27 +0100 +Subject: firmware: arm_scmi: Suppress the driver's bind attributes + +From: Cristian Marussi + +[ Upstream commit fd96fbc8fad35d6b1872c90df8a2f5d721f14d91 ] + +Suppress the capability to unbind the core SCMI driver since all the +SCMI stack protocol drivers depend on it. + +Fixes: aa4f886f3893 ("firmware: arm_scmi: add basic driver infrastructure for SCMI") +Signed-off-by: Cristian Marussi +Link: https://lore.kernel.org/r/20221028140833.280091-2-cristian.marussi@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/driver.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c +index 609ebedee9cb..1b9aa34b8e47 100644 +--- a/drivers/firmware/arm_scmi/driver.c ++++ b/drivers/firmware/arm_scmi/driver.c +@@ -2571,6 +2571,7 @@ MODULE_DEVICE_TABLE(of, scmi_of_match); + static struct platform_driver scmi_driver = { + .driver = { + .name = "arm-scmi", ++ .suppress_bind_attrs = true, + .of_match_table = scmi_of_match, + .dev_groups = versions_groups, + }, +-- +2.35.1 + diff --git a/queue-6.0/hid-saitek-add-madcatz-variant-of-mmo7-mouse-device-.patch b/queue-6.0/hid-saitek-add-madcatz-variant-of-mmo7-mouse-device-.patch new file mode 100644 index 00000000000..08c60559712 --- /dev/null +++ b/queue-6.0/hid-saitek-add-madcatz-variant-of-mmo7-mouse-device-.patch @@ -0,0 +1,61 @@ +From 35def7d052ecc4e5c9f0f9b811a8f22bd2dd02bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Oct 2022 19:51:23 +0100 +Subject: HID: saitek: add madcatz variant of MMO7 mouse device ID + +From: Samuel Bailey + +[ Upstream commit 79425b297f56bd481c6e97700a9a4e44c7bcfa35 ] + +The MadCatz variant of the MMO7 mouse has the ID 0738:1713 and the same +quirks as the Saitek variant. + +Signed-off-by: Samuel Bailey +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-quirks.c | 1 + + drivers/hid/hid-saitek.c | 2 ++ + 3 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 043cf1cc8794..256795ed6247 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -867,6 +867,7 @@ + #define USB_DEVICE_ID_MADCATZ_BEATPAD 0x4540 + #define USB_DEVICE_ID_MADCATZ_RAT5 0x1705 + #define USB_DEVICE_ID_MADCATZ_RAT9 0x1709 ++#define USB_DEVICE_ID_MADCATZ_MMO7 0x1713 + + #define USB_VENDOR_ID_MCC 0x09db + #define USB_DEVICE_ID_MCC_PMD1024LS 0x0076 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 70f602c64fd1..50e1c717fc0a 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -620,6 +620,7 @@ static const struct hid_device_id hid_have_special_driver[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_MMO7) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT5) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT9) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_MMO7) }, + #endif + #if IS_ENABLED(CONFIG_HID_SAMSUNG) + { HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_IR_REMOTE) }, +diff --git a/drivers/hid/hid-saitek.c b/drivers/hid/hid-saitek.c +index c7bf14c01960..b84e975977c4 100644 +--- a/drivers/hid/hid-saitek.c ++++ b/drivers/hid/hid-saitek.c +@@ -187,6 +187,8 @@ static const struct hid_device_id saitek_devices[] = { + .driver_data = SAITEK_RELEASE_MODE_RAT7 }, + { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_MMO7), + .driver_data = SAITEK_RELEASE_MODE_MMO7 }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_MMO7), ++ .driver_data = SAITEK_RELEASE_MODE_MMO7 }, + { } + }; + +-- +2.35.1 + diff --git a/queue-6.0/hwrng-bcm2835-use-hwrng_msleep-instead-of-cpu_relax.patch b/queue-6.0/hwrng-bcm2835-use-hwrng_msleep-instead-of-cpu_relax.patch new file mode 100644 index 00000000000..50e2eff835b --- /dev/null +++ b/queue-6.0/hwrng-bcm2835-use-hwrng_msleep-instead-of-cpu_relax.patch @@ -0,0 +1,55 @@ +From 97194199ea54564df7e241c8e16ceaaab0b18d8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Oct 2022 09:06:07 -0600 +Subject: hwrng: bcm2835 - use hwrng_msleep() instead of cpu_relax() + +From: Jason A. Donenfeld + +[ Upstream commit 96cb9d0554457086664d3bd10630b11193d863f1 ] + +Rather than busy looping, yield back to the scheduler and sleep for a +bit in the event that there's no data. This should hopefully prevent the +stalls that Mark reported: + +<6>[ 3.362859] Freeing initrd memory: 16196K +<3>[ 23.160131] rcu: INFO: rcu_sched self-detected stall on CPU +<3>[ 23.166057] rcu: 0-....: (2099 ticks this GP) idle=03b4/1/0x40000002 softirq=28/28 fqs=1050 +<4>[ 23.174895] (t=2101 jiffies g=-1147 q=2353 ncpus=4) +<4>[ 23.180203] CPU: 0 PID: 49 Comm: hwrng Not tainted 6.0.0 #1 +<4>[ 23.186125] Hardware name: BCM2835 +<4>[ 23.189837] PC is at bcm2835_rng_read+0x30/0x6c +<4>[ 23.194709] LR is at hwrng_fillfn+0x71/0xf4 +<4>[ 23.199218] pc : [] lr : [] psr: 40000033 +<4>[ 23.205840] sp : f093df70 ip : 00000000 fp : 00000000 +<4>[ 23.211404] r10: c3c7e800 r9 : 00000000 r8 : c17e6b20 +<4>[ 23.216968] r7 : c17e6b64 r6 : c18b0a74 r5 : c07ccd99 r4 : c3f171c0 +<4>[ 23.223855] r3 : 000fffff r2 : 00000040 r1 : c3c7e800 r0 : c3f171c0 +<4>[ 23.230743] Flags: nZcv IRQs on FIQs on Mode SVC_32 ISA Thumb Segment none +<4>[ 23.238426] Control: 50c5387d Table: 0020406a DAC: 00000051 +<4>[ 23.244519] CPU: 0 PID: 49 Comm: hwrng Not tainted 6.0.0 #1 + +Link: https://lore.kernel.org/all/Y0QJLauamRnCDUef@sirena.org.uk/ +Signed-off-by: Jason A. Donenfeld +Acked-by: Florian Fainelli +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/bcm2835-rng.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/char/hw_random/bcm2835-rng.c b/drivers/char/hw_random/bcm2835-rng.c +index e7dd457e9b22..e98fcac578d6 100644 +--- a/drivers/char/hw_random/bcm2835-rng.c ++++ b/drivers/char/hw_random/bcm2835-rng.c +@@ -71,7 +71,7 @@ static int bcm2835_rng_read(struct hwrng *rng, void *buf, size_t max, + while ((rng_readl(priv, RNG_STATUS) >> 24) == 0) { + if (!wait) + return 0; +- cpu_relax(); ++ hwrng_msleep(rng, 1000); + } + + num_words = rng_readl(priv, RNG_STATUS) >> 24; +-- +2.35.1 + diff --git a/queue-6.0/i2c-piix4-fix-adapter-not-be-removed-in-piix4_remove.patch b/queue-6.0/i2c-piix4-fix-adapter-not-be-removed-in-piix4_remove.patch new file mode 100644 index 00000000000..c0c23fe7b31 --- /dev/null +++ b/queue-6.0/i2c-piix4-fix-adapter-not-be-removed-in-piix4_remove.patch @@ -0,0 +1,81 @@ +From d74c1824e57620b1090319e34d176516de25e6ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Oct 2022 20:13:53 +0800 +Subject: i2c: piix4: Fix adapter not be removed in piix4_remove() + +From: Chen Zhongjin + +[ Upstream commit 569bea74c94d37785682b11bab76f557520477cd ] + +In piix4_probe(), the piix4 adapter will be registered in: + + piix4_probe() + piix4_add_adapters_sb800() / piix4_add_adapter() + i2c_add_adapter() + +Based on the probed device type, piix4_add_adapters_sb800() or single +piix4_add_adapter() will be called. +For the former case, piix4_adapter_count is set as the number of adapters, +while for antoher case it is not set and kept default *zero*. + +When piix4 is removed, piix4_remove() removes the adapters added in +piix4_probe(), basing on the piix4_adapter_count value. +Because the count is zero for the single adapter case, the adapter won't +be removed and makes the sources allocated for adapter leaked, such as +the i2c client and device. + +These sources can still be accessed by i2c or bus and cause problems. +An easily reproduced case is that if a new adapter is registered, i2c +will get the leaked adapter and try to call smbus_algorithm, which was +already freed: + +Triggered by: rmmod i2c_piix4 && modprobe max31730 + + BUG: unable to handle page fault for address: ffffffffc053d860 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + Oops: 0000 [#1] PREEMPT SMP KASAN + CPU: 0 PID: 3752 Comm: modprobe Tainted: G + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) + RIP: 0010:i2c_default_probe (drivers/i2c/i2c-core-base.c:2259) i2c_core + RSP: 0018:ffff888107477710 EFLAGS: 00000246 + ... + + i2c_detect (drivers/i2c/i2c-core-base.c:2302) i2c_core + __process_new_driver (drivers/i2c/i2c-core-base.c:1336) i2c_core + bus_for_each_dev (drivers/base/bus.c:301) + i2c_for_each_dev (drivers/i2c/i2c-core-base.c:1823) i2c_core + i2c_register_driver (drivers/i2c/i2c-core-base.c:1861) i2c_core + do_one_initcall (init/main.c:1296) + do_init_module (kernel/module/main.c:2455) + ... + + ---[ end trace 0000000000000000 ]--- + +Fix this problem by correctly set piix4_adapter_count as 1 for the +single adapter so it can be normally removed. + +Fixes: 528d53a1592b ("i2c: piix4: Fix probing of reserved ports on AMD Family 16h Model 30h") +Signed-off-by: Chen Zhongjin +Reviewed-by: Jean Delvare +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-piix4.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c +index 39cb1b7bb865..809fbd014cd6 100644 +--- a/drivers/i2c/busses/i2c-piix4.c ++++ b/drivers/i2c/busses/i2c-piix4.c +@@ -1080,6 +1080,7 @@ static int piix4_probe(struct pci_dev *dev, const struct pci_device_id *id) + "", &piix4_main_adapters[0]); + if (retval < 0) + return retval; ++ piix4_adapter_count = 1; + } + + /* Check for auxiliary SMBus on some AMD chipsets */ +-- +2.35.1 + diff --git a/queue-6.0/i2c-xiic-add-platform-module-alias.patch b/queue-6.0/i2c-xiic-add-platform-module-alias.patch new file mode 100644 index 00000000000..af522029064 --- /dev/null +++ b/queue-6.0/i2c-xiic-add-platform-module-alias.patch @@ -0,0 +1,38 @@ +From cc8cba6cee237bb7b3683ff659e692e9ec508760 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 16:03:37 +0200 +Subject: i2c: xiic: Add platform module alias +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Martin Tůma + +[ Upstream commit b8caf0a0e04583fb71e21495bef84509182227ea ] + +The missing "platform" alias is required for the mgb4 v4l2 driver to load +the i2c controller driver when probing the HW. + +Signed-off-by: Martin Tůma +Acked-by: Michal Simek +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-xiic.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index b3fe6b2aa3ca..277a02455cdd 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -920,6 +920,7 @@ static struct platform_driver xiic_i2c_driver = { + + module_platform_driver(xiic_i2c_driver); + ++MODULE_ALIAS("platform:" DRIVER_NAME); + MODULE_AUTHOR("info@mocean-labs.com"); + MODULE_DESCRIPTION("Xilinx I2C bus driver"); + MODULE_LICENSE("GPL v2"); +-- +2.35.1 + diff --git a/queue-6.0/io_uring-don-t-iopoll-from-io_ring_ctx_wait_and_kill.patch b/queue-6.0/io_uring-don-t-iopoll-from-io_ring_ctx_wait_and_kill.patch new file mode 100644 index 00000000000..b0837769d44 --- /dev/null +++ b/queue-6.0/io_uring-don-t-iopoll-from-io_ring_ctx_wait_and_kill.patch @@ -0,0 +1,51 @@ +From 7c2ee709197cf0202dc94660315b2ea4eee27c19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Oct 2022 21:30:51 +0100 +Subject: io_uring: don't iopoll from io_ring_ctx_wait_and_kill() + +From: Pavel Begunkov + +[ Upstream commit 02bac94bd8efd75f615ac7515dd2def75b43e5b9 ] + +We should not be completing requests from a task context that has already +undergone io_uring cancellations, i.e. __io_uring_cancel(), as there are +some assumptions, e.g. around cached task refs draining. Remove +iopolling from io_ring_ctx_wait_and_kill() as it can be called later +after PF_EXITING is set with the last task_work run. + +Signed-off-by: Pavel Begunkov +Link: https://lore.kernel.org/r/7c03cc91455c4a1af49c6b9cbda4e57ea467aa11.1665891182.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/io_uring.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c +index c5dd483a7de2..d29f397f095e 100644 +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -2653,15 +2653,12 @@ static __cold void io_ring_ctx_wait_and_kill(struct io_ring_ctx *ctx) + io_poll_remove_all(ctx, NULL, true); + mutex_unlock(&ctx->uring_lock); + +- /* failed during ring init, it couldn't have issued any requests */ +- if (ctx->rings) { ++ /* ++ * If we failed setting up the ctx, we might not have any rings ++ * and therefore did not submit any requests ++ */ ++ if (ctx->rings) + io_kill_timeouts(ctx, NULL, true); +- /* if we failed setting up the ctx, we might not have any rings */ +- io_iopoll_try_reap_events(ctx); +- /* drop cached put refs after potentially doing completions */ +- if (current->io_uring) +- io_uring_drop_tctx_refs(current); +- } + + INIT_WORK(&ctx->exit_work, io_ring_exit_work); + /* +-- +2.35.1 + diff --git a/queue-6.0/media-atomisp-ensure-that-userptr-pointers-are-page-.patch b/queue-6.0/media-atomisp-ensure-that-userptr-pointers-are-page-.patch new file mode 100644 index 00000000000..86e7ddb4dd7 --- /dev/null +++ b/queue-6.0/media-atomisp-ensure-that-userptr-pointers-are-page-.patch @@ -0,0 +1,44 @@ +From 58a3482a386a12a9ca97f517fd006be917767483 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Aug 2022 20:29:06 +0200 +Subject: media: atomisp: Ensure that USERPTR pointers are page aligned + +From: Hans de Goede + +[ Upstream commit 6e6c4ae0f0ba295dbf6cbd48d93bec169d6ce431 ] + +The atomisp code needs USERPTR pointers to be page aligned, +otherwise bad things (scribbling over other parts of the +process' RAM) happen. + +Add a check to ensure this and exit VIDIOC_QBUF calls with +unaligned pointers with -EINVAL. + +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c +index 459645c2e2a7..4de01aa28fe5 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c +@@ -1338,6 +1338,12 @@ static int atomisp_qbuf(struct file *file, void *fh, struct v4l2_buffer *buf) + * address and reprograme out page table properly + */ + if (buf->memory == V4L2_MEMORY_USERPTR) { ++ if (offset_in_page(buf->m.userptr)) { ++ dev_err(isp->dev, "Error userptr is not page aligned.\n"); ++ ret = -EINVAL; ++ goto error; ++ } ++ + vb = pipe->capq.bufs[buf->index]; + vm_mem = vb->priv; + if (!vm_mem) { +-- +2.35.1 + diff --git a/queue-6.0/media-atomisp-fix-locking-around-asd-streaming-read-.patch b/queue-6.0/media-atomisp-fix-locking-around-asd-streaming-read-.patch new file mode 100644 index 00000000000..f1c6841386a --- /dev/null +++ b/queue-6.0/media-atomisp-fix-locking-around-asd-streaming-read-.patch @@ -0,0 +1,309 @@ +From 9059642b7939ec250fd6068bed29ba310ae0ba58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Sep 2022 13:39:51 +0200 +Subject: media: atomisp: Fix locking around asd->streaming read/write + +From: Hans de Goede + +[ Upstream commit 2468083f799eb9eef7b03f48ebb9673ad5655f88 ] + +For reading / writing the asd->streaming enum the following rules +should be followed: + +1. Writers of streaming must hold both isp->mutex and isp->lock. +2. Readers of streaming need to hold only one of the two locks. + +Not all writers where properly taking both locks this fixes this. + +In the case of the readers, many readers depend on their caller +to hold isp->mutex, add asserts for this + +And in the case of atomisp_css_get_dis_stat() it is called with +isp->mutex held, so there is no need to take the spinlock just +for reading the streaming value. + +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../staging/media/atomisp/pci/atomisp_cmd.c | 32 +++++++++++++++++-- + .../media/atomisp/pci/atomisp_compat_css20.c | 10 +++--- + .../staging/media/atomisp/pci/atomisp_fops.c | 3 ++ + .../media/atomisp/pci/atomisp_internal.h | 2 +- + .../staging/media/atomisp/pci/atomisp_ioctl.c | 4 +++ + .../media/atomisp/pci/atomisp_subdev.c | 8 ++++- + .../media/atomisp/pci/atomisp_subdev.h | 6 +++- + 7 files changed, 55 insertions(+), 10 deletions(-) + +diff --git a/drivers/staging/media/atomisp/pci/atomisp_cmd.c b/drivers/staging/media/atomisp/pci/atomisp_cmd.c +index db6465756e49..4d5c7328610f 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp_cmd.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_cmd.c +@@ -908,6 +908,8 @@ void atomisp_buf_done(struct atomisp_sub_device *asd, int error, + struct v4l2_control ctrl; + bool reset_wdt_timer = false; + ++ lockdep_assert_held(&isp->mutex); ++ + if ( + buf_type != IA_CSS_BUFFER_TYPE_METADATA && + buf_type != IA_CSS_BUFFER_TYPE_3A_STATISTICS && +@@ -1307,6 +1309,9 @@ static void __atomisp_css_recover(struct atomisp_device *isp, bool isp_timeout) + bool stream_restart[MAX_STREAM_NUM] = {0}; + bool depth_mode = false; + int i, ret, depth_cnt = 0; ++ unsigned long flags; ++ ++ lockdep_assert_held(&isp->mutex); + + if (!isp->sw_contex.file_input) + atomisp_css_irq_enable(isp, +@@ -1331,7 +1336,9 @@ static void __atomisp_css_recover(struct atomisp_device *isp, bool isp_timeout) + + stream_restart[asd->index] = true; + ++ spin_lock_irqsave(&isp->lock, flags); + asd->streaming = ATOMISP_DEVICE_STREAMING_STOPPING; ++ spin_unlock_irqrestore(&isp->lock, flags); + + /* stream off sensor */ + ret = v4l2_subdev_call( +@@ -1346,7 +1353,9 @@ static void __atomisp_css_recover(struct atomisp_device *isp, bool isp_timeout) + css_pipe_id = atomisp_get_css_pipe_id(asd); + atomisp_css_stop(asd, css_pipe_id, true); + ++ spin_lock_irqsave(&isp->lock, flags); + asd->streaming = ATOMISP_DEVICE_STREAMING_DISABLED; ++ spin_unlock_irqrestore(&isp->lock, flags); + + asd->preview_exp_id = 1; + asd->postview_exp_id = 1; +@@ -1387,11 +1396,14 @@ static void __atomisp_css_recover(struct atomisp_device *isp, bool isp_timeout) + IA_CSS_INPUT_MODE_BUFFERED_SENSOR); + + css_pipe_id = atomisp_get_css_pipe_id(asd); +- if (atomisp_css_start(asd, css_pipe_id, true)) ++ if (atomisp_css_start(asd, css_pipe_id, true)) { + dev_warn(isp->dev, + "start SP failed, so do not set streaming to be enable!\n"); +- else ++ } else { ++ spin_lock_irqsave(&isp->lock, flags); + asd->streaming = ATOMISP_DEVICE_STREAMING_ENABLED; ++ spin_unlock_irqrestore(&isp->lock, flags); ++ } + + atomisp_csi2_configure(asd); + } +@@ -1627,6 +1639,8 @@ void atomisp_css_flush(struct atomisp_device *isp) + { + int i; + ++ lockdep_assert_held(&isp->mutex); ++ + if (!atomisp_streaming_count(isp)) + return; + +@@ -4077,6 +4091,8 @@ void atomisp_handle_parameter_and_buffer(struct atomisp_video_pipe *pipe) + unsigned long irqflags; + bool need_to_enqueue_buffer = false; + ++ lockdep_assert_held(&asd->isp->mutex); ++ + if (!asd) { + dev_err(pipe->isp->dev, "%s(): asd is NULL, device is %s\n", + __func__, pipe->vdev.name); +@@ -4170,6 +4186,8 @@ int atomisp_set_parameters(struct video_device *vdev, + struct atomisp_css_params *css_param = &asd->params.css_param; + int ret; + ++ lockdep_assert_held(&asd->isp->mutex); ++ + if (!asd) { + dev_err(pipe->isp->dev, "%s(): asd is NULL, device is %s\n", + __func__, vdev->name); +@@ -5604,6 +5622,8 @@ int atomisp_set_fmt(struct video_device *vdev, struct v4l2_format *f) + struct v4l2_subdev_fh fh; + int ret; + ++ lockdep_assert_held(&isp->mutex); ++ + if (!asd) { + dev_err(isp->dev, "%s(): asd is NULL, device is %s\n", + __func__, vdev->name); +@@ -6275,6 +6295,8 @@ int atomisp_offline_capture_configure(struct atomisp_sub_device *asd, + { + struct v4l2_ctrl *c; + ++ lockdep_assert_held(&asd->isp->mutex); ++ + /* + * In case of M10MO ZSL capture case, we need to issue a separate + * capture request to M10MO which will output captured jpeg image +@@ -6549,6 +6571,8 @@ int atomisp_exp_id_capture(struct atomisp_sub_device *asd, int *exp_id) + int value = *exp_id; + int ret; + ++ lockdep_assert_held(&isp->mutex); ++ + ret = __is_raw_buffer_locked(asd, value); + if (ret) { + dev_err(isp->dev, "%s exp_id %d invalid %d.\n", __func__, value, ret); +@@ -6570,6 +6594,8 @@ int atomisp_exp_id_unlock(struct atomisp_sub_device *asd, int *exp_id) + int value = *exp_id; + int ret; + ++ lockdep_assert_held(&isp->mutex); ++ + ret = __clear_raw_buffer_bitmap(asd, value); + if (ret) { + dev_err(isp->dev, "%s exp_id %d invalid %d.\n", __func__, value, ret); +@@ -6605,6 +6631,8 @@ int atomisp_inject_a_fake_event(struct atomisp_sub_device *asd, int *event) + if (!event || asd->streaming != ATOMISP_DEVICE_STREAMING_ENABLED) + return -EINVAL; + ++ lockdep_assert_held(&asd->isp->mutex); ++ + dev_dbg(asd->isp->dev, "%s: trying to inject a fake event 0x%x\n", + __func__, *event); + +diff --git a/drivers/staging/media/atomisp/pci/atomisp_compat_css20.c b/drivers/staging/media/atomisp/pci/atomisp_compat_css20.c +index 5aa108a1724c..19ecc751d594 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp_compat_css20.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_compat_css20.c +@@ -3626,6 +3626,8 @@ int atomisp_css_get_dis_stat(struct atomisp_sub_device *asd, + struct atomisp_dis_buf *dis_buf; + unsigned long flags; + ++ lockdep_assert_held(&isp->mutex); ++ + if (!asd->params.dvs_stat->hor_prod.odd_real || + !asd->params.dvs_stat->hor_prod.odd_imag || + !asd->params.dvs_stat->hor_prod.even_real || +@@ -3637,12 +3639,8 @@ int atomisp_css_get_dis_stat(struct atomisp_sub_device *asd, + return -EINVAL; + + /* isp needs to be streaming to get DIS statistics */ +- spin_lock_irqsave(&isp->lock, flags); +- if (asd->streaming != ATOMISP_DEVICE_STREAMING_ENABLED) { +- spin_unlock_irqrestore(&isp->lock, flags); ++ if (asd->streaming != ATOMISP_DEVICE_STREAMING_ENABLED) + return -EINVAL; +- } +- spin_unlock_irqrestore(&isp->lock, flags); + + if (atomisp_compare_dvs_grid(asd, &stats->dvs2_stat.grid_info) != 0) + /* If the grid info in the argument differs from the current +@@ -3827,6 +3825,8 @@ int atomisp_css_isr_thread(struct atomisp_device *isp, + bool reset_wdt_timer[MAX_STREAM_NUM] = {false}; + int i; + ++ lockdep_assert_held(&isp->mutex); ++ + while (!ia_css_dequeue_psys_event(¤t_event.event)) { + if (current_event.event.type == + IA_CSS_EVENT_TYPE_FW_ASSERT) { +diff --git a/drivers/staging/media/atomisp/pci/atomisp_fops.c b/drivers/staging/media/atomisp/pci/atomisp_fops.c +index 92cbc0e263e8..d24be2341a9b 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp_fops.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_fops.c +@@ -918,6 +918,7 @@ static int atomisp_release(struct file *file) + struct v4l2_requestbuffers req; + struct v4l2_subdev_fh fh; + struct v4l2_rect clear_compose = {0}; ++ unsigned long flags; + int ret = 0; + + v4l2_fh_init(&fh.vfh, vdev); +@@ -1008,7 +1009,9 @@ static int atomisp_release(struct file *file) + + /* clear the asd field to show this camera is not used */ + isp->inputs[asd->input_curr].asd = NULL; ++ spin_lock_irqsave(&isp->lock, flags); + asd->streaming = ATOMISP_DEVICE_STREAMING_DISABLED; ++ spin_unlock_irqrestore(&isp->lock, flags); + + if (atomisp_dev_users(isp)) + goto done; +diff --git a/drivers/staging/media/atomisp/pci/atomisp_internal.h b/drivers/staging/media/atomisp/pci/atomisp_internal.h +index f71ab1ee6e19..b86f9bd7574c 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp_internal.h ++++ b/drivers/staging/media/atomisp/pci/atomisp_internal.h +@@ -280,7 +280,7 @@ struct atomisp_device { + + atomic_t wdt_work_queued; + +- spinlock_t lock; /* Just for streaming below */ ++ spinlock_t lock; /* Protects asd[i].streaming */ + + bool need_gfx_throttle; + +diff --git a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c +index 4de01aa28fe5..44ed8aa51fdc 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c +@@ -1925,7 +1925,9 @@ static int atomisp_streamon(struct file *file, void *fh, + if (ret) + goto out; + ++ spin_lock_irqsave(&isp->lock, irqflags); + asd->streaming = ATOMISP_DEVICE_STREAMING_ENABLED; ++ spin_unlock_irqrestore(&isp->lock, irqflags); + atomic_set(&asd->sof_count, -1); + atomic_set(&asd->sequence, -1); + atomic_set(&asd->sequence_temp, -1); +@@ -2005,7 +2007,9 @@ static int atomisp_streamon(struct file *file, void *fh, + ret = v4l2_subdev_call(isp->inputs[asd->input_curr].camera, + video, s_stream, 1); + if (ret) { ++ spin_lock_irqsave(&isp->lock, irqflags); + asd->streaming = ATOMISP_DEVICE_STREAMING_DISABLED; ++ spin_unlock_irqrestore(&isp->lock, irqflags); + ret = -EINVAL; + goto out; + } +diff --git a/drivers/staging/media/atomisp/pci/atomisp_subdev.c b/drivers/staging/media/atomisp/pci/atomisp_subdev.c +index 394fe6959033..5a3dd476f194 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp_subdev.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_subdev.c +@@ -874,12 +874,18 @@ static int s_ctrl(struct v4l2_ctrl *ctrl) + { + struct atomisp_sub_device *asd = container_of( + ctrl->handler, struct atomisp_sub_device, ctrl_handler); ++ unsigned int streaming; ++ unsigned long flags; + + switch (ctrl->id) { + case V4L2_CID_RUN_MODE: + return __atomisp_update_run_mode(asd); + case V4L2_CID_DEPTH_MODE: +- if (asd->streaming != ATOMISP_DEVICE_STREAMING_DISABLED) { ++ /* Use spinlock instead of mutex to avoid possible locking issues */ ++ spin_lock_irqsave(&asd->isp->lock, flags); ++ streaming = asd->streaming; ++ spin_unlock_irqrestore(&asd->isp->lock, flags); ++ if (streaming != ATOMISP_DEVICE_STREAMING_DISABLED) { + dev_err(asd->isp->dev, + "ISP is streaming, it is not supported to change the depth mode\n"); + return -EINVAL; +diff --git a/drivers/staging/media/atomisp/pci/atomisp_subdev.h b/drivers/staging/media/atomisp/pci/atomisp_subdev.h +index 798a93793a9a..a955a38246cf 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp_subdev.h ++++ b/drivers/staging/media/atomisp/pci/atomisp_subdev.h +@@ -364,7 +364,11 @@ struct atomisp_sub_device { + atomic_t sequence; /* Sequence value that is assigned to buffer. */ + atomic_t sequence_temp; + +- unsigned int streaming; /* Hold both mutex and lock to change this */ ++ /* ++ * Writers of streaming must hold both isp->mutex and isp->lock. ++ * Readers of streaming need to hold only one of the two locks. ++ */ ++ unsigned int streaming; + bool stream_prepared; /* whether css stream is created */ + + /* subdev index: will be used to show which subdev is holding the +-- +2.35.1 + diff --git a/queue-6.0/media-atomisp-fix-v4l2_fh-resource-leak-on-open-erro.patch b/queue-6.0/media-atomisp-fix-v4l2_fh-resource-leak-on-open-erro.patch new file mode 100644 index 00000000000..0d9e07b5eac --- /dev/null +++ b/queue-6.0/media-atomisp-fix-v4l2_fh-resource-leak-on-open-erro.patch @@ -0,0 +1,35 @@ +From 63c59e68ddb07f9f33b20fde2eae5c75746074d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Aug 2022 12:35:43 +0200 +Subject: media: atomisp: Fix v4l2_fh resource leak on open errors + +From: Hans de Goede + +[ Upstream commit 5b9853ad1329be49343a608d574eb232ff1273d0 ] + +When atomisp_open() fails then it must call v4l2_fh_release() to undo +the results of v4l2_fh_open(). + +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/atomisp/pci/atomisp_fops.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/staging/media/atomisp/pci/atomisp_fops.c b/drivers/staging/media/atomisp/pci/atomisp_fops.c +index 77150e4ae144..92cbc0e263e8 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp_fops.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_fops.c +@@ -903,6 +903,7 @@ static int atomisp_open(struct file *file) + pm_runtime_put(vdev->v4l2_dev->dev); + error: + rt_mutex_unlock(&isp->mutex); ++ v4l2_fh_release(file); + return ret; + } + +-- +2.35.1 + diff --git a/queue-6.0/media-atomisp-fix-vidioc_try_fmt.patch b/queue-6.0/media-atomisp-fix-vidioc_try_fmt.patch new file mode 100644 index 00000000000..9ac3171a604 --- /dev/null +++ b/queue-6.0/media-atomisp-fix-vidioc_try_fmt.patch @@ -0,0 +1,53 @@ +From 579ea43747a24b499839720fc73d45addbcf48a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Aug 2022 16:53:00 +0200 +Subject: media: atomisp: Fix VIDIOC_TRY_FMT + +From: Hans de Goede + +[ Upstream commit 4d3aafb9c9bba59c9b6f6df8ea6c89483bfed8d4 ] + +atomisp_try_fmt() calls the sensor's try_fmt handler but it does +not copy the result back to the passed in v4l2_pix_format under +some circumstances. + +Potentially returning an unsupported resolution to userspace, +which VIDIOC_TRY_FMT is not supposed to do. + +atomisp_set_fmt() also uses atomisp_try_fmt() and relies +on this wrong behavior. The VIDIOC_TRY_FMT call passes NULL for +the res_overflow argument where as the atomisp_set_fmt() call +passes non NULL. + +Use the res_overflow argument to differentiate between the 2 callers +and always propagate the sensors result in the VIDIOC_TRY_FMT case. + +This fixes the resolution list in camorama showing resolutions like e.g. +1584x1184 instead of 1600x1200. + +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/atomisp/pci/atomisp_cmd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/media/atomisp/pci/atomisp_cmd.c b/drivers/staging/media/atomisp/pci/atomisp_cmd.c +index c932f340068f..db6465756e49 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp_cmd.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_cmd.c +@@ -4886,8 +4886,8 @@ int atomisp_try_fmt(struct video_device *vdev, struct v4l2_pix_format *f, + return 0; + } + +- if (snr_mbus_fmt->width < f->width +- && snr_mbus_fmt->height < f->height) { ++ if (!res_overflow || (snr_mbus_fmt->width < f->width && ++ snr_mbus_fmt->height < f->height)) { + f->width = snr_mbus_fmt->width; + f->height = snr_mbus_fmt->height; + /* Set the flag when resolution requested is +-- +2.35.1 + diff --git a/queue-6.0/media-cros-ec-cec-limit-msg.len-to-cec_max_msg_size.patch b/queue-6.0/media-cros-ec-cec-limit-msg.len-to-cec_max_msg_size.patch new file mode 100644 index 00000000000..c13a2d7430b --- /dev/null +++ b/queue-6.0/media-cros-ec-cec-limit-msg.len-to-cec_max_msg_size.patch @@ -0,0 +1,35 @@ +From b958d8383eb755e253d50ef51a74e57d28f93eb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Aug 2022 09:06:19 +0200 +Subject: media: cros-ec-cec: limit msg.len to CEC_MAX_MSG_SIZE + +From: Hans Verkuil + +[ Upstream commit 2dc73b48665411a08c4e5f0f823dea8510761603 ] + +I expect that the hardware will have limited this to 16, but just in +case it hasn't, check for this corner case. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/cec/platform/cros-ec/cros-ec-cec.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/cec/platform/cros-ec/cros-ec-cec.c b/drivers/media/cec/platform/cros-ec/cros-ec-cec.c +index 3b583ed4da9d..e5ebaa58be45 100644 +--- a/drivers/media/cec/platform/cros-ec/cros-ec-cec.c ++++ b/drivers/media/cec/platform/cros-ec/cros-ec-cec.c +@@ -44,6 +44,8 @@ static void handle_cec_message(struct cros_ec_cec *cros_ec_cec) + uint8_t *cec_message = cros_ec->event_data.data.cec_message; + unsigned int len = cros_ec->event_size; + ++ if (len > CEC_MAX_MSG_SIZE) ++ len = CEC_MAX_MSG_SIZE; + cros_ec_cec->rx_msg.len = len; + memcpy(cros_ec_cec->rx_msg.msg, cec_message, len); + +-- +2.35.1 + diff --git a/queue-6.0/media-dvb-frontends-drxk-initialize-err-to-0.patch b/queue-6.0/media-dvb-frontends-drxk-initialize-err-to-0.patch new file mode 100644 index 00000000000..6c8f6c76d8d --- /dev/null +++ b/queue-6.0/media-dvb-frontends-drxk-initialize-err-to-0.patch @@ -0,0 +1,42 @@ +From e1e9de43c791443a26ffc71561faeabd55339983 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Aug 2022 07:59:24 +0200 +Subject: media: dvb-frontends/drxk: initialize err to 0 + +From: Hans Verkuil + +[ Upstream commit 20694e96ca089ce6693c2348f8f628ee621e4e74 ] + +Fix a compiler warning: + +drivers/media/dvb-frontends/drxk_hard.c: In function 'drxk_read_ucblocks': +drivers/media/dvb-frontends/drxk_hard.c:6673:21: warning: 'err' may be used uninitialized [-Wmaybe-uninitialized] + 6673 | *ucblocks = (u32) err; + | ^~~~~~~~~ +drivers/media/dvb-frontends/drxk_hard.c:6663:13: note: 'err' was declared here + 6663 | u16 err; + | ^~~ + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-frontends/drxk_hard.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/dvb-frontends/drxk_hard.c b/drivers/media/dvb-frontends/drxk_hard.c +index 9430295a8175..ef0d063ec352 100644 +--- a/drivers/media/dvb-frontends/drxk_hard.c ++++ b/drivers/media/dvb-frontends/drxk_hard.c +@@ -6660,7 +6660,7 @@ static int drxk_read_snr(struct dvb_frontend *fe, u16 *snr) + static int drxk_read_ucblocks(struct dvb_frontend *fe, u32 *ucblocks) + { + struct drxk_state *state = fe->demodulator_priv; +- u16 err; ++ u16 err = 0; + + dprintk(1, "\n"); + +-- +2.35.1 + diff --git a/queue-6.0/media-hantro-hevc-fix-auxilary-buffer-size-calculati.patch b/queue-6.0/media-hantro-hevc-fix-auxilary-buffer-size-calculati.patch new file mode 100644 index 00000000000..08600938479 --- /dev/null +++ b/queue-6.0/media-hantro-hevc-fix-auxilary-buffer-size-calculati.patch @@ -0,0 +1,46 @@ +From 9a988c6f4929b0da567dc8dfb705990bd685b224 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Aug 2022 18:21:54 +0200 +Subject: media: hantro: HEVC: Fix auxilary buffer size calculation + +From: Benjamin Gaignard + +[ Upstream commit 8a438580a09ecef78cd6c5825d628b4d5ae1c127 ] + +SAO and FILTER buffers size depend of the bit depth. +Make sure we have enough space for 10bit bitstreams. + +Signed-off-by: Benjamin Gaignard +Reviewed-by: Ezequiel Garcia +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/hantro/hantro_hevc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/media/hantro/hantro_hevc.c b/drivers/staging/media/hantro/hantro_hevc.c +index b990bc98164c..9383fb7081f6 100644 +--- a/drivers/staging/media/hantro/hantro_hevc.c ++++ b/drivers/staging/media/hantro/hantro_hevc.c +@@ -104,7 +104,7 @@ static int tile_buffer_reallocate(struct hantro_ctx *ctx) + hevc_dec->tile_bsd.cpu = NULL; + } + +- size = VERT_FILTER_RAM_SIZE * height64 * (num_tile_cols - 1); ++ size = (VERT_FILTER_RAM_SIZE * height64 * (num_tile_cols - 1) * ctx->bit_depth) / 8; + hevc_dec->tile_filter.cpu = dma_alloc_coherent(vpu->dev, size, + &hevc_dec->tile_filter.dma, + GFP_KERNEL); +@@ -112,7 +112,7 @@ static int tile_buffer_reallocate(struct hantro_ctx *ctx) + goto err_free_tile_buffers; + hevc_dec->tile_filter.size = size; + +- size = VERT_SAO_RAM_SIZE * height64 * (num_tile_cols - 1); ++ size = (VERT_SAO_RAM_SIZE * height64 * (num_tile_cols - 1) * ctx->bit_depth) / 8; + hevc_dec->tile_sao.cpu = dma_alloc_coherent(vpu->dev, size, + &hevc_dec->tile_sao.dma, + GFP_KERNEL); +-- +2.35.1 + diff --git a/queue-6.0/media-hantro-hevc-fix-chroma-offset-computation.patch b/queue-6.0/media-hantro-hevc-fix-chroma-offset-computation.patch new file mode 100644 index 00000000000..ee5eab2204d --- /dev/null +++ b/queue-6.0/media-hantro-hevc-fix-chroma-offset-computation.patch @@ -0,0 +1,37 @@ +From 3bbc8c65a3ff7c8666aca1bfa5f93716a59d1ea0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Aug 2022 18:21:55 +0200 +Subject: media: hantro: HEVC: Fix chroma offset computation + +From: Benjamin Gaignard + +[ Upstream commit f64853ad7f964b3bf7c1d63b27ca7ef972797a1c ] + +The chroma offset depends of the bitstream depth. +Make sure that ctx->bit_depth is used to compute it. + +Signed-off-by: Benjamin Gaignard +Reviewed-by: Ezequiel Garcia +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/hantro/hantro_g2_hevc_dec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/media/hantro/hantro_g2_hevc_dec.c b/drivers/staging/media/hantro/hantro_g2_hevc_dec.c +index 233ecd863d5f..a917079a6ed3 100644 +--- a/drivers/staging/media/hantro/hantro_g2_hevc_dec.c ++++ b/drivers/staging/media/hantro/hantro_g2_hevc_dec.c +@@ -12,7 +12,7 @@ + + static size_t hantro_hevc_chroma_offset(struct hantro_ctx *ctx) + { +- return ctx->dst_fmt.width * ctx->dst_fmt.height; ++ return ctx->dst_fmt.width * ctx->dst_fmt.height * ctx->bit_depth / 8; + } + + static size_t hantro_hevc_motion_vectors_offset(struct hantro_ctx *ctx) +-- +2.35.1 + diff --git a/queue-6.0/media-hantro-store-hevc-bit-depth-in-context.patch b/queue-6.0/media-hantro-store-hevc-bit-depth-in-context.patch new file mode 100644 index 00000000000..25a55d3f05e --- /dev/null +++ b/queue-6.0/media-hantro-store-hevc-bit-depth-in-context.patch @@ -0,0 +1,49 @@ +From 6f02c0414226626dc47b22c692ec48d99928c748 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Aug 2022 18:21:53 +0200 +Subject: media: hantro: Store HEVC bit depth in context + +From: Benjamin Gaignard + +[ Upstream commit 4bec03301ecd81760c159402467dbb2cfd527684 ] + +Store HEVC bit depth in context. +Bit depth is equal to hevc sps bit_depth_luma_minus8 + 8. + +Signed-off-by: Benjamin Gaignard +Reviewed-by: Ezequiel Garcia +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/hantro/hantro_drv.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/staging/media/hantro/hantro_drv.c b/drivers/staging/media/hantro/hantro_drv.c +index 2036f72eeb4a..1dd8312d824c 100644 +--- a/drivers/staging/media/hantro/hantro_drv.c ++++ b/drivers/staging/media/hantro/hantro_drv.c +@@ -251,6 +251,11 @@ queue_init(void *priv, struct vb2_queue *src_vq, struct vb2_queue *dst_vq) + + static int hantro_try_ctrl(struct v4l2_ctrl *ctrl) + { ++ struct hantro_ctx *ctx; ++ ++ ctx = container_of(ctrl->handler, ++ struct hantro_ctx, ctrl_handler); ++ + if (ctrl->id == V4L2_CID_STATELESS_H264_SPS) { + const struct v4l2_ctrl_h264_sps *sps = ctrl->p_new.p_h264_sps; + +@@ -272,6 +277,8 @@ static int hantro_try_ctrl(struct v4l2_ctrl *ctrl) + if (sps->bit_depth_luma_minus8 != 0) + /* Only 8-bit is supported */ + return -EINVAL; ++ ++ ctx->bit_depth = sps->bit_depth_luma_minus8 + 8; + } else if (ctrl->id == V4L2_CID_STATELESS_VP9_FRAME) { + const struct v4l2_ctrl_vp9_frame *dec_params = ctrl->p_new.p_vp9_frame; + +-- +2.35.1 + diff --git a/queue-6.0/media-meson-vdec-fix-possible-refcount-leak-in-vdec_.patch b/queue-6.0/media-meson-vdec-fix-possible-refcount-leak-in-vdec_.patch new file mode 100644 index 00000000000..5a83cc555ad --- /dev/null +++ b/queue-6.0/media-meson-vdec-fix-possible-refcount-leak-in-vdec_.patch @@ -0,0 +1,43 @@ +From 5dedee1f5991bb90367162f034d8d06e7ba4689b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Sep 2022 09:46:30 +0200 +Subject: media: meson: vdec: fix possible refcount leak in vdec_probe() + +From: Hangyu Hua + +[ Upstream commit 7718999356234d9cc6a11b4641bb773928f1390f ] + +v4l2_device_unregister need to be called to put the refcount got by +v4l2_device_register when vdec_probe fails or vdec_remove is called. + +Signed-off-by: Hangyu Hua +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/meson/vdec/vdec.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c +index 8549d95be0f2..52f224d8def1 100644 +--- a/drivers/staging/media/meson/vdec/vdec.c ++++ b/drivers/staging/media/meson/vdec/vdec.c +@@ -1102,6 +1102,7 @@ static int vdec_probe(struct platform_device *pdev) + + err_vdev_release: + video_device_release(vdev); ++ v4l2_device_unregister(&core->v4l2_dev); + return ret; + } + +@@ -1110,6 +1111,7 @@ static int vdec_remove(struct platform_device *pdev) + struct amvdec_core *core = platform_get_drvdata(pdev); + + video_unregister_device(core->vdev_dec); ++ v4l2_device_unregister(&core->v4l2_dev); + + return 0; + } +-- +2.35.1 + diff --git a/queue-6.0/media-platform-cros-ec-add-kuldax-to-the-match-table.patch b/queue-6.0/media-platform-cros-ec-add-kuldax-to-the-match-table.patch new file mode 100644 index 00000000000..3855bfa2c92 --- /dev/null +++ b/queue-6.0/media-platform-cros-ec-add-kuldax-to-the-match-table.patch @@ -0,0 +1,36 @@ +From 8016872ce92f6fc06e9a6d060fc74887a137cf41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Sep 2022 05:30:16 +0200 +Subject: media: platform: cros-ec: Add Kuldax to the match table + +From: Rory Liu + +[ Upstream commit 594b6bdde2e7833a56413de5092b6e4188d33ff7 ] + +The Google Kuldax device uses the same approach as the Google Brask +which enables the HDMI CEC via the cros-ec-cec driver. + +Signed-off-by: Rory Liu +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/cec/platform/cros-ec/cros-ec-cec.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/cec/platform/cros-ec/cros-ec-cec.c b/drivers/media/cec/platform/cros-ec/cros-ec-cec.c +index e5ebaa58be45..6ebedc71d67d 100644 +--- a/drivers/media/cec/platform/cros-ec/cros-ec-cec.c ++++ b/drivers/media/cec/platform/cros-ec/cros-ec-cec.c +@@ -223,6 +223,8 @@ static const struct cec_dmi_match cec_dmi_match_table[] = { + { "Google", "Moli", "0000:00:02.0", "Port B" }, + /* Google Kinox */ + { "Google", "Kinox", "0000:00:02.0", "Port B" }, ++ /* Google Kuldax */ ++ { "Google", "Kuldax", "0000:00:02.0", "Port B" }, + }; + + static struct device *cros_ec_cec_find_hdmi_dev(struct device *dev, +-- +2.35.1 + diff --git a/queue-6.0/media-rkisp1-don-t-pass-the-quantization-to-rkisp1_c.patch b/queue-6.0/media-rkisp1-don-t-pass-the-quantization-to-rkisp1_c.patch new file mode 100644 index 00000000000..29bffe0e8cc --- /dev/null +++ b/queue-6.0/media-rkisp1-don-t-pass-the-quantization-to-rkisp1_c.patch @@ -0,0 +1,60 @@ +From da9733a45ef04df78f72dd8a5f4950577b7e2248 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Aug 2022 00:44:14 +0200 +Subject: media: rkisp1: Don't pass the quantization to rkisp1_csm_config() + +From: Laurent Pinchart + +[ Upstream commit 711d91497e203b058cf0a08c0f7d41c04efbde76 ] + +The rkisp1_csm_config() function takes a pointer to the rkisp1_params +structure which contains the quantization value. There's no need to pass +it separately to the function. Drop it from the function parameters. + +Signed-off-by: Laurent Pinchart +Reviewed-by: Dafna Hirschfeld +Reviewed-by: Paul Elder +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rockchip/rkisp1/rkisp1-params.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c +index 9da7dc1bc690..32485f7c79d5 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c +@@ -1066,7 +1066,7 @@ static void rkisp1_ie_enable(struct rkisp1_params *params, bool en) + } + } + +-static void rkisp1_csm_config(struct rkisp1_params *params, bool full_range) ++static void rkisp1_csm_config(struct rkisp1_params *params) + { + static const u16 full_range_coeff[] = { + 0x0026, 0x004b, 0x000f, +@@ -1080,7 +1080,7 @@ static void rkisp1_csm_config(struct rkisp1_params *params, bool full_range) + }; + unsigned int i; + +- if (full_range) { ++ if (params->quantization == V4L2_QUANTIZATION_FULL_RANGE) { + for (i = 0; i < ARRAY_SIZE(full_range_coeff); i++) + rkisp1_write(params->rkisp1, + RKISP1_CIF_ISP_CC_COEFF_0 + i * 4, +@@ -1552,11 +1552,7 @@ static void rkisp1_params_config_parameter(struct rkisp1_params *params) + rkisp1_param_set_bits(params, RKISP1_CIF_ISP_HIST_PROP_V10, + rkisp1_hst_params_default_config.mode); + +- /* set the range */ +- if (params->quantization == V4L2_QUANTIZATION_FULL_RANGE) +- rkisp1_csm_config(params, true); +- else +- rkisp1_csm_config(params, false); ++ rkisp1_csm_config(params); + + spin_lock_irq(¶ms->config_lock); + +-- +2.35.1 + diff --git a/queue-6.0/media-rkisp1-fix-source-pad-format-configuration.patch b/queue-6.0/media-rkisp1-fix-source-pad-format-configuration.patch new file mode 100644 index 00000000000..d8b907522d7 --- /dev/null +++ b/queue-6.0/media-rkisp1-fix-source-pad-format-configuration.patch @@ -0,0 +1,102 @@ +From 25cb51a2279af1372e0a15f555b2239b27a5ad29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Aug 2022 00:44:14 +0200 +Subject: media: rkisp1: Fix source pad format configuration + +From: Laurent Pinchart + +[ Upstream commit cb00f3a4421d5c7d7155bd4bded7fb2ff8eec211 ] + +The ISP converts Bayer data to YUV when operating normally, and can also +operate in pass-through mode where the input and output formats must +match. Converting from YUV to Bayer isn't possible. If such an invalid +configuration is attempted, adjust it by copying the sink pad media bus +code to the source pad. + +Signed-off-by: Laurent Pinchart +Reviewed-by: Dafna Hirschfeld +Reviewed-by: Paul Elder +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../platform/rockchip/rkisp1/rkisp1-isp.c | 40 +++++++++++++++---- + 1 file changed, 32 insertions(+), 8 deletions(-) + +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c +index 383a3ec83ca9..00032b849a07 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c +@@ -472,23 +472,43 @@ static void rkisp1_isp_set_src_fmt(struct rkisp1_isp *isp, + struct v4l2_mbus_framefmt *format, + unsigned int which) + { +- const struct rkisp1_mbus_info *mbus_info; ++ const struct rkisp1_mbus_info *sink_info; ++ const struct rkisp1_mbus_info *src_info; ++ struct v4l2_mbus_framefmt *sink_fmt; + struct v4l2_mbus_framefmt *src_fmt; + const struct v4l2_rect *src_crop; + ++ sink_fmt = rkisp1_isp_get_pad_fmt(isp, sd_state, ++ RKISP1_ISP_PAD_SINK_VIDEO, which); + src_fmt = rkisp1_isp_get_pad_fmt(isp, sd_state, + RKISP1_ISP_PAD_SOURCE_VIDEO, which); + src_crop = rkisp1_isp_get_pad_crop(isp, sd_state, + RKISP1_ISP_PAD_SOURCE_VIDEO, which); + ++ /* ++ * Media bus code. The ISP can operate in pass-through mode (Bayer in, ++ * Bayer out or YUV in, YUV out) or process Bayer data to YUV, but ++ * can't convert from YUV to Bayer. ++ */ ++ sink_info = rkisp1_mbus_info_get_by_code(sink_fmt->code); ++ + src_fmt->code = format->code; +- mbus_info = rkisp1_mbus_info_get_by_code(src_fmt->code); +- if (!mbus_info || !(mbus_info->direction & RKISP1_ISP_SD_SRC)) { ++ src_info = rkisp1_mbus_info_get_by_code(src_fmt->code); ++ if (!src_info || !(src_info->direction & RKISP1_ISP_SD_SRC)) { + src_fmt->code = RKISP1_DEF_SRC_PAD_FMT; +- mbus_info = rkisp1_mbus_info_get_by_code(src_fmt->code); ++ src_info = rkisp1_mbus_info_get_by_code(src_fmt->code); + } +- if (which == V4L2_SUBDEV_FORMAT_ACTIVE) +- isp->src_fmt = mbus_info; ++ ++ if (sink_info->pixel_enc == V4L2_PIXEL_ENC_YUV && ++ src_info->pixel_enc == V4L2_PIXEL_ENC_BAYER) { ++ src_fmt->code = sink_fmt->code; ++ src_info = sink_info; ++ } ++ ++ /* ++ * The source width and height must be identical to the source crop ++ * size. ++ */ + src_fmt->width = src_crop->width; + src_fmt->height = src_crop->height; + +@@ -498,14 +518,18 @@ static void rkisp1_isp_set_src_fmt(struct rkisp1_isp *isp, + */ + if (format->flags & V4L2_MBUS_FRAMEFMT_SET_CSC && + format->quantization == V4L2_QUANTIZATION_FULL_RANGE && +- mbus_info->pixel_enc == V4L2_PIXEL_ENC_YUV) ++ src_info->pixel_enc == V4L2_PIXEL_ENC_YUV) + src_fmt->quantization = V4L2_QUANTIZATION_FULL_RANGE; +- else if (mbus_info->pixel_enc == V4L2_PIXEL_ENC_YUV) ++ else if (src_info->pixel_enc == V4L2_PIXEL_ENC_YUV) + src_fmt->quantization = V4L2_QUANTIZATION_LIM_RANGE; + else + src_fmt->quantization = V4L2_QUANTIZATION_FULL_RANGE; + + *format = *src_fmt; ++ ++ /* Store the source format info when setting the active format. */ ++ if (which == V4L2_SUBDEV_FORMAT_ACTIVE) ++ isp->src_fmt = src_info; + } + + static void rkisp1_isp_set_src_crop(struct rkisp1_isp *isp, +-- +2.35.1 + diff --git a/queue-6.0/media-rkisp1-initialize-color-space-on-resizer-sink-.patch b/queue-6.0/media-rkisp1-initialize-color-space-on-resizer-sink-.patch new file mode 100644 index 00000000000..e6277a591e9 --- /dev/null +++ b/queue-6.0/media-rkisp1-initialize-color-space-on-resizer-sink-.patch @@ -0,0 +1,41 @@ +From e6f0b87644c75b9cb4855776870eb10b2ca998ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Aug 2022 00:44:14 +0200 +Subject: media: rkisp1: Initialize color space on resizer sink and source pads + +From: Laurent Pinchart + +[ Upstream commit 83b9296e399367862845d3b19984444fc756bd61 ] + +Initialize the four color space fields on the sink and source video pads +of the resizer in the .init_cfg() operation. The resizer can't perform +any color space conversion, so set the sink and source color spaces to +the same defaults, which match the ISP source video pad default. + +Signed-off-by: Laurent Pinchart +Reviewed-by: Paul Elder +Reviewed-by: Dafna Hirschfeld +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rockchip/rkisp1/rkisp1-resizer.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-resizer.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-resizer.c +index f4caa8f684aa..a2dc6f60d9cf 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-resizer.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-resizer.c +@@ -411,6 +411,10 @@ static int rkisp1_rsz_init_config(struct v4l2_subdev *sd, + sink_fmt->height = RKISP1_DEFAULT_HEIGHT; + sink_fmt->field = V4L2_FIELD_NONE; + sink_fmt->code = RKISP1_DEF_FMT; ++ sink_fmt->colorspace = V4L2_COLORSPACE_SRGB; ++ sink_fmt->xfer_func = V4L2_XFER_FUNC_SRGB; ++ sink_fmt->ycbcr_enc = V4L2_YCBCR_ENC_601; ++ sink_fmt->quantization = V4L2_QUANTIZATION_LIM_RANGE; + + sink_crop = v4l2_subdev_get_try_crop(sd, sd_state, + RKISP1_RSZ_PAD_SINK); +-- +2.35.1 + diff --git a/queue-6.0/media-rkisp1-use-correct-macro-for-gradient-register.patch b/queue-6.0/media-rkisp1-use-correct-macro-for-gradient-register.patch new file mode 100644 index 00000000000..19f2b5ae992 --- /dev/null +++ b/queue-6.0/media-rkisp1-use-correct-macro-for-gradient-register.patch @@ -0,0 +1,65 @@ +From a8f4059b9b6a8f9e0b838c48df3c8e6658088391 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Aug 2022 01:53:57 +0200 +Subject: media: rkisp1: Use correct macro for gradient registers + +From: Laurent Pinchart + +[ Upstream commit 4c3501f13e8e60f6e7e7308c77ac4404e1007c18 ] + +The rkisp1_lsc_config() function incorrectly uses the +RKISP1_CIF_ISP_LSC_SECT_SIZE() macro for the gradient registers. Replace +it with the correct macro, and rename it from +RKISP1_CIF_ISP_LSC_GRAD_SIZE() to RKISP1_CIF_ISP_LSC_SECT_GRAD() as the +corresponding registers store the gradients for each sector, not a size. +This doesn't cause any functional change as the two macros are defined +identically (the size and gradient registers store fields in the same +number of bits at the same positions). + +Signed-off-by: Laurent Pinchart +Reviewed-by: Dafna Hirschfeld +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rockchip/rkisp1/rkisp1-params.c | 4 ++-- + drivers/media/platform/rockchip/rkisp1/rkisp1-regs.h | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c +index 32485f7c79d5..02ac3043badd 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c +@@ -343,7 +343,7 @@ static void rkisp1_lsc_config(struct rkisp1_params *params, + RKISP1_CIF_ISP_LSC_XSIZE_01 + i * 4, data); + + /* program x grad tables */ +- data = RKISP1_CIF_ISP_LSC_SECT_SIZE(arg->x_grad_tbl[i * 2], ++ data = RKISP1_CIF_ISP_LSC_SECT_GRAD(arg->x_grad_tbl[i * 2], + arg->x_grad_tbl[i * 2 + 1]); + rkisp1_write(params->rkisp1, + RKISP1_CIF_ISP_LSC_XGRAD_01 + i * 4, data); +@@ -355,7 +355,7 @@ static void rkisp1_lsc_config(struct rkisp1_params *params, + RKISP1_CIF_ISP_LSC_YSIZE_01 + i * 4, data); + + /* program y grad tables */ +- data = RKISP1_CIF_ISP_LSC_SECT_SIZE(arg->y_grad_tbl[i * 2], ++ data = RKISP1_CIF_ISP_LSC_SECT_GRAD(arg->y_grad_tbl[i * 2], + arg->y_grad_tbl[i * 2 + 1]); + rkisp1_write(params->rkisp1, + RKISP1_CIF_ISP_LSC_YGRAD_01 + i * 4, data); +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-regs.h b/drivers/media/platform/rockchip/rkisp1/rkisp1-regs.h +index dd3e6c38be67..025491f8793f 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-regs.h ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-regs.h +@@ -576,7 +576,7 @@ + (((v0) & 0x1FFF) | (((v1) & 0x1FFF) << 13)) + #define RKISP1_CIF_ISP_LSC_SECT_SIZE(v0, v1) \ + (((v0) & 0xFFF) | (((v1) & 0xFFF) << 16)) +-#define RKISP1_CIF_ISP_LSC_GRAD_SIZE(v0, v1) \ ++#define RKISP1_CIF_ISP_LSC_SECT_GRAD(v0, v1) \ + (((v0) & 0xFFF) | (((v1) & 0xFFF) << 16)) + + /* LSC: ISP_LSC_TABLE_SEL */ +-- +2.35.1 + diff --git a/queue-6.0/media-rkisp1-zero-v4l2_subdev_format-fields-in-when-.patch b/queue-6.0/media-rkisp1-zero-v4l2_subdev_format-fields-in-when-.patch new file mode 100644 index 00000000000..18aa8f7306d --- /dev/null +++ b/queue-6.0/media-rkisp1-zero-v4l2_subdev_format-fields-in-when-.patch @@ -0,0 +1,47 @@ +From 61f48e51650f7099ae1f863065b70ac92ab9339c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Aug 2022 17:11:36 +0200 +Subject: media: rkisp1: Zero v4l2_subdev_format fields in when validating + links + +From: Laurent Pinchart + +[ Upstream commit c53e3a049f35978a150526671587fd46b1ae7ca1 ] + +The local sd_fmt variable in rkisp1_capture_link_validate() has +uninitialized fields, which causes random failures when calling the +subdev .get_fmt() operation. Fix it by initializing the variable when +declaring it, which zeros all other fields. + +Signed-off-by: Laurent Pinchart +Reviewed-by: Paul Elder +Reviewed-by: Dafna Hirschfeld +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c +index d5904c96ff3f..c66963a2ccd9 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c +@@ -1273,11 +1273,12 @@ static int rkisp1_capture_link_validate(struct media_link *link) + struct rkisp1_capture *cap = video_get_drvdata(vdev); + const struct rkisp1_capture_fmt_cfg *fmt = + rkisp1_find_fmt_cfg(cap, cap->pix.fmt.pixelformat); +- struct v4l2_subdev_format sd_fmt; ++ struct v4l2_subdev_format sd_fmt = { ++ .which = V4L2_SUBDEV_FORMAT_ACTIVE, ++ .pad = link->source->index, ++ }; + int ret; + +- sd_fmt.which = V4L2_SUBDEV_FORMAT_ACTIVE; +- sd_fmt.pad = link->source->index; + ret = v4l2_subdev_call(sd, pad, get_fmt, NULL, &sd_fmt); + if (ret) + return ret; +-- +2.35.1 + diff --git a/queue-6.0/media-s5p_cec-limit-msg.len-to-cec_max_msg_size.patch b/queue-6.0/media-s5p_cec-limit-msg.len-to-cec_max_msg_size.patch new file mode 100644 index 00000000000..bd4ab5bedee --- /dev/null +++ b/queue-6.0/media-s5p_cec-limit-msg.len-to-cec_max_msg_size.patch @@ -0,0 +1,35 @@ +From 60fb976c439d6b0fbca18d5c588845665168f565 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Aug 2022 09:02:42 +0200 +Subject: media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE + +From: Hans Verkuil + +[ Upstream commit 93f65ce036863893c164ca410938e0968964b26c ] + +I expect that the hardware will have limited this to 16, but just in +case it hasn't, check for this corner case. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/cec/platform/s5p/s5p_cec.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/cec/platform/s5p/s5p_cec.c b/drivers/media/cec/platform/s5p/s5p_cec.c +index ce9a9d922f11..0a30e7acdc10 100644 +--- a/drivers/media/cec/platform/s5p/s5p_cec.c ++++ b/drivers/media/cec/platform/s5p/s5p_cec.c +@@ -115,6 +115,8 @@ static irqreturn_t s5p_cec_irq_handler(int irq, void *priv) + dev_dbg(cec->dev, "Buffer overrun (worker did not process previous message)\n"); + cec->rx = STATE_BUSY; + cec->msg.len = status >> 24; ++ if (cec->msg.len > CEC_MAX_MSG_SIZE) ++ cec->msg.len = CEC_MAX_MSG_SIZE; + cec->msg.rx_status = CEC_RX_STATUS_OK; + s5p_cec_get_rx_buf(cec, cec->msg.len, + cec->msg.msg); +-- +2.35.1 + diff --git a/queue-6.0/media-v4l-subdev-fail-graciously-when-getting-try-da.patch b/queue-6.0/media-v4l-subdev-fail-graciously-when-getting-try-da.patch new file mode 100644 index 00000000000..c4251cd7f99 --- /dev/null +++ b/queue-6.0/media-v4l-subdev-fail-graciously-when-getting-try-da.patch @@ -0,0 +1,57 @@ +From 83a6d65280f0cf6183ed76917501331a562de4a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 13:53:58 +0200 +Subject: media: v4l: subdev: Fail graciously when getting try data for NULL + state + +From: Sakari Ailus + +[ Upstream commit 2ba3e38517f5a4ebf9c997168079dca01b7f9fc6 ] + +The state argument for the functions for obtaining various parts of the +state is NULL if it is called by drivers for active state. Fail graciously +in that case instead of dereferencing a NULL pointer. + +Suggested-by: Bingbu Cao +Signed-off-by: Sakari Ailus +Reviewed-by: Tomi Valkeinen +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + include/media/v4l2-subdev.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/include/media/v4l2-subdev.h b/include/media/v4l2-subdev.h +index 9689f38a0af1..ec1896886dbd 100644 +--- a/include/media/v4l2-subdev.h ++++ b/include/media/v4l2-subdev.h +@@ -1046,6 +1046,8 @@ v4l2_subdev_get_pad_format(struct v4l2_subdev *sd, + struct v4l2_subdev_state *state, + unsigned int pad) + { ++ if (WARN_ON(!state)) ++ return NULL; + if (WARN_ON(pad >= sd->entity.num_pads)) + pad = 0; + return &state->pads[pad].try_fmt; +@@ -1064,6 +1066,8 @@ v4l2_subdev_get_pad_crop(struct v4l2_subdev *sd, + struct v4l2_subdev_state *state, + unsigned int pad) + { ++ if (WARN_ON(!state)) ++ return NULL; + if (WARN_ON(pad >= sd->entity.num_pads)) + pad = 0; + return &state->pads[pad].try_crop; +@@ -1082,6 +1086,8 @@ v4l2_subdev_get_pad_compose(struct v4l2_subdev *sd, + struct v4l2_subdev_state *state, + unsigned int pad) + { ++ if (WARN_ON(!state)) ++ return NULL; + if (WARN_ON(pad >= sd->entity.num_pads)) + pad = 0; + return &state->pads[pad].try_compose; +-- +2.35.1 + diff --git a/queue-6.0/nvme-pci-disable-write-zeroes-on-various-kingston-ss.patch b/queue-6.0/nvme-pci-disable-write-zeroes-on-various-kingston-ss.patch new file mode 100644 index 00000000000..69cebc90907 --- /dev/null +++ b/queue-6.0/nvme-pci-disable-write-zeroes-on-various-kingston-ss.patch @@ -0,0 +1,44 @@ +From c0a7fb50f59edf1d0f64b5cac651bdd446729142 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Oct 2022 04:06:42 -0700 +Subject: nvme-pci: disable write zeroes on various Kingston SSD + +From: Xander Li + +[ Upstream commit ac9b57d4e1e3ecf0122e915bbba1bd4c90ec3031 ] + +Kingston SSDs do support NVMe Write_Zeroes cmd but take long time to +process. The firmware version is locked by these SSDs, we can not expect +firmware improvement, so disable Write_Zeroes cmd. + +Signed-off-by: Xander Li +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 57cc2bb5b1a2..554468ea5a2a 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -3508,6 +3508,16 @@ static const struct pci_device_id nvme_id_table[] = { + .driver_data = NVME_QUIRK_NO_DEEPEST_PS, }, + { PCI_DEVICE(0x2646, 0x2263), /* KINGSTON A2000 NVMe SSD */ + .driver_data = NVME_QUIRK_NO_DEEPEST_PS, }, ++ { PCI_DEVICE(0x2646, 0x5018), /* KINGSTON OM8SFP4xxxxP OS21012 NVMe SSD */ ++ .driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, }, ++ { PCI_DEVICE(0x2646, 0x5016), /* KINGSTON OM3PGP4xxxxP OS21011 NVMe SSD */ ++ .driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, }, ++ { PCI_DEVICE(0x2646, 0x501A), /* KINGSTON OM8PGP4xxxxP OS21005 NVMe SSD */ ++ .driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, }, ++ { PCI_DEVICE(0x2646, 0x501B), /* KINGSTON OM8PGP4xxxxQ OS21005 NVMe SSD */ ++ .driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, }, ++ { PCI_DEVICE(0x2646, 0x501E), /* KINGSTON OM3PGP4xxxxQ OS21011 NVMe SSD */ ++ .driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, }, + { PCI_DEVICE(0x1e4B, 0x1001), /* MAXIO MAP1001 */ + .driver_data = NVME_QUIRK_BOGUS_NID, }, + { PCI_DEVICE(0x1e4B, 0x1002), /* MAXIO MAP1002 */ +-- +2.35.1 + diff --git a/queue-6.0/scsi-core-restrict-legal-sdev_state-transitions-via-.patch b/queue-6.0/scsi-core-restrict-legal-sdev_state-transitions-via-.patch new file mode 100644 index 00000000000..74a5905406b --- /dev/null +++ b/queue-6.0/scsi-core-restrict-legal-sdev_state-transitions-via-.patch @@ -0,0 +1,54 @@ +From 0510e14220b309ff494517b55efd22459049268a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Sep 2022 18:02:42 -0600 +Subject: scsi: core: Restrict legal sdev_state transitions via sysfs + +From: Uday Shankar + +[ Upstream commit 2331ce6126be8864b39490e705286b66e2344aac ] + +Userspace can currently write to sysfs to transition sdev_state to RUNNING +or OFFLINE from any source state. This causes issues because proper +transitioning out of some states involves steps besides just changing +sdev_state, so allowing userspace to change sdev_state regardless of the +source state can result in inconsistencies; e.g. with ISCSI we can end up +with sdev_state == SDEV_RUNNING while the device queue is quiesced. Any +task attempting I/O on the device will then hang, and in more recent +kernels, iscsid will hang as well. + +More detail about this bug is provided in my first attempt: + +https://groups.google.com/g/open-iscsi/c/PNKca4HgPDs/m/CXaDkntOAQAJ + +Link: https://lore.kernel.org/r/20220924000241.2967323-1-ushankar@purestorage.com +Signed-off-by: Uday Shankar +Suggested-by: Mike Christie +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_sysfs.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c +index 5d61f58399dc..dc41d7c6b9b1 100644 +--- a/drivers/scsi/scsi_sysfs.c ++++ b/drivers/scsi/scsi_sysfs.c +@@ -828,6 +828,14 @@ store_state_field(struct device *dev, struct device_attribute *attr, + } + + mutex_lock(&sdev->state_mutex); ++ switch (sdev->sdev_state) { ++ case SDEV_RUNNING: ++ case SDEV_OFFLINE: ++ break; ++ default: ++ mutex_unlock(&sdev->state_mutex); ++ return -EINVAL; ++ } + if (sdev->sdev_state == SDEV_RUNNING && state == SDEV_RUNNING) { + ret = 0; + } else { +-- +2.35.1 + diff --git a/queue-6.0/series b/queue-6.0/series index 4f537a6fa8a..95cbe77d93e 100644 --- a/queue-6.0/series +++ b/queue-6.0/series @@ -63,3 +63,65 @@ bridge-fix-flushing-of-dynamic-fdb-entries.patch ipv6-fix-warning-in-ip6_route_net_exit_late.patch vsock-fix-possible-infinite-sleep-in-vsock_connectib.patch iio-adc-stm32-adc-fix-channel-sampling-time-init.patch +media-rkisp1-fix-source-pad-format-configuration.patch +media-rkisp1-don-t-pass-the-quantization-to-rkisp1_c.patch +media-rkisp1-initialize-color-space-on-resizer-sink-.patch +media-rkisp1-use-correct-macro-for-gradient-register.patch +media-rkisp1-zero-v4l2_subdev_format-fields-in-when-.patch +media-s5p_cec-limit-msg.len-to-cec_max_msg_size.patch +media-cros-ec-cec-limit-msg.len-to-cec_max_msg_size.patch +media-dvb-frontends-drxk-initialize-err-to-0.patch +media-platform-cros-ec-add-kuldax-to-the-match-table.patch +media-meson-vdec-fix-possible-refcount-leak-in-vdec_.patch +media-hantro-store-hevc-bit-depth-in-context.patch +media-hantro-hevc-fix-auxilary-buffer-size-calculati.patch +media-hantro-hevc-fix-chroma-offset-computation.patch +media-v4l-subdev-fail-graciously-when-getting-try-da.patch +media-atomisp-fix-vidioc_try_fmt.patch +media-atomisp-ensure-that-userptr-pointers-are-page-.patch +media-atomisp-fix-v4l2_fh-resource-leak-on-open-erro.patch +media-atomisp-fix-locking-around-asd-streaming-read-.patch +drm-vc4-hdmi-check-the-hsm-rate-at-runtime_resume.patch +acpi-apei-fix-integer-overflow-in-ghes_estatus_pool_.patch +hwrng-bcm2835-use-hwrng_msleep-instead-of-cpu_relax.patch +io_uring-don-t-iopoll-from-io_ring_ctx_wait_and_kill.patch +scsi-core-restrict-legal-sdev_state-transitions-via-.patch +hid-saitek-add-madcatz-variant-of-mmo7-mouse-device-.patch +drm-amdgpu-set-vm_update_mode-0-as-default-for-sienn.patch +drm-amd-pm-skip-loading-pptable-from-driver-on-secur.patch +drm-amdkfd-fix-type-of-reset_type-parameter-in-hqd_d.patch +drm-amdgpu-program-gc-registers-through-rlcg-interfa.patch +drm-amdgpu-dequeue-mes-scheduler-during-fini.patch +nvme-pci-disable-write-zeroes-on-various-kingston-ss.patch +i2c-xiic-add-platform-module-alias.patch +bio-safeguard-req_alloc_cache-bio-put.patch +clk-rs9-fix-i2c-accessors.patch +arm64-dts-imx8mm-enable-cpld_dn-pull-down-resistor-o.patch +efi-tpm-pass-correct-address-to-memblock_reserve.patch +clk-renesas-r8a779g0-fix-hscif-parent-clocks.patch +clk-qcom-update-the-force-mem-core-bit-for-gpu-clock.patch +arm64-dts-verdin-imx8mp-fix-ctrl_sleep_moci.patch +arm64-dts-imx8mm-remove-otg1-2-power-domain-dependen.patch +arm64-dts-imx8mm-correct-usb-power-domains.patch +arm64-dts-imx8mn-remove-otg1-power-domain-dependency.patch +arm64-dts-imx8mn-correct-the-usb-power-domain.patch +arm-dts-imx6qdl-gw59-10-13-fix-user-pushbutton-gpio-.patch +arm64-dts-imx8-correct-clock-order.patch +arm64-dts-imx93-add-gpio-clk.patch +arm64-dts-imx93-correct-gpio-ranges.patch +arm64-dts-lx2160a-specify-clock-frequencies-for-the-.patch +arm64-dts-ls1088a-specify-clock-frequencies-for-the-.patch +arm64-dts-ls208xa-specify-clock-frequencies-for-the-.patch +drm-rockchip-dw_hdmi-filter-regulator-eprobe_defer-e.patch +drm-rockchip-fix-fbdev-on-non-iommu-devices.patch +drm-i915-stop-abusing-swiotlb_max_segment.patch +ublk_drv-return-flag-of-ublk_f_uring_cmd_comp_in_tas.patch +block-fix-possible-memory-leak-for-rq_wb-on-add_disk.patch +blk-mq-fix-kmemleak-in-blk_mq_init_allocated_queue.patch +arm-dts-ux500-add-trips-to-battery-thermal-zones.patch +firmware-arm_scmi-suppress-the-driver-s-bind-attribu.patch +firmware-arm_scmi-make-rx-chan_setup-fail-on-memory-.patch +firmware-arm_scmi-fix-devres-allocation-device-in-vi.patch +firmware-arm_scmi-fix-deferred_tx_wq-release-on-erro.patch +arm64-dts-juno-add-thermal-critical-trip-points.patch +i2c-piix4-fix-adapter-not-be-removed-in-piix4_remove.patch diff --git a/queue-6.0/ublk_drv-return-flag-of-ublk_f_uring_cmd_comp_in_tas.patch b/queue-6.0/ublk_drv-return-flag-of-ublk_f_uring_cmd_comp_in_tas.patch new file mode 100644 index 00000000000..b222194ba75 --- /dev/null +++ b/queue-6.0/ublk_drv-return-flag-of-ublk_f_uring_cmd_comp_in_tas.patch @@ -0,0 +1,41 @@ +From 59d46d3986d7b8b5fbcf0fabddce97b6360857ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Oct 2022 09:04:29 +0800 +Subject: ublk_drv: return flag of UBLK_F_URING_CMD_COMP_IN_TASK in case of + module + +From: Ming Lei + +[ Upstream commit 224e858f215a3d6304f95a92357a1753475ca9cf ] + +UBLK_F_URING_CMD_COMP_IN_TASK needs to be set and returned to userspace +if ublk driver is built as module, otherwise userspace may get wrong +flags shown. + +Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") +Signed-off-by: Ming Lei +Reviewed-by: ZiyangZhang +Link: https://lore.kernel.org/r/20221029010432.598367-2-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/ublk_drv.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c +index 6a4a94b4cdf4..31a8715d3a4d 100644 +--- a/drivers/block/ublk_drv.c ++++ b/drivers/block/ublk_drv.c +@@ -1507,6 +1507,9 @@ static int ublk_ctrl_add_dev(struct io_uring_cmd *cmd) + */ + ub->dev_info.flags &= UBLK_F_ALL; + ++ if (!IS_BUILTIN(CONFIG_BLK_DEV_UBLK)) ++ ub->dev_info.flags |= UBLK_F_URING_CMD_COMP_IN_TASK; ++ + /* We are not ready to support zero copy */ + ub->dev_info.flags &= ~UBLK_F_SUPPORT_ZERO_COPY; + +-- +2.35.1 +