From: Greg Kroah-Hartman Date: Sat, 2 Apr 2022 12:37:39 +0000 (+0200) Subject: 5.17-stable patches X-Git-Tag: v5.17.2~186 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=cc113cf40c6ac977fa80979c9144317be496e246;p=thirdparty%2Fkernel%2Fstable-queue.git 5.17-stable patches added patches: arm-dts-at91-sama5d2-fix-pmerrloc-resource-size.patch arm-dts-at91-sama7g5-remove-unused-properties-in-i2c-nodes.patch arm-dts-exynos-add-missing-hdmi-supplies-on-smdk5250.patch arm-dts-exynos-add-missing-hdmi-supplies-on-smdk5420.patch arm-dts-exynos-fix-uart3-pins-configuration-in-exynos5250.patch carl9170-fix-missing-bit-wise-or-operator-for-tx_params.patch drm-edid-check-basic-audio-support-on-cea-extension-block.patch fbdev-hot-unplug-firmware-fb-devices-on-forced-removal.patch mgag200-fix-memmapsl-configuration-in-gctl6-register.patch pstore-don-t-use-semaphores-in-always-atomic-context-code.patch rfkill-make-new-event-layout-opt-in.patch thermal-int340x-increase-bitmap-size.patch video-fbdev-atari-atari-2-bpp-ste-palette-bugfix.patch video-fbdev-sm712fb-fix-crash-in-smtcfb_read.patch --- diff --git a/queue-5.17/arm-dts-at91-sama5d2-fix-pmerrloc-resource-size.patch b/queue-5.17/arm-dts-at91-sama5d2-fix-pmerrloc-resource-size.patch new file mode 100644 index 00000000000..860c654d091 --- /dev/null +++ b/queue-5.17/arm-dts-at91-sama5d2-fix-pmerrloc-resource-size.patch @@ -0,0 +1,36 @@ +From 0fb578a529ac7aca326a9fa475b4a6f58a756fda Mon Sep 17 00:00:00 2001 +From: Tudor Ambarus +Date: Tue, 11 Jan 2022 15:23:01 +0200 +Subject: ARM: dts: at91: sama5d2: Fix PMERRLOC resource size + +From: Tudor Ambarus + +commit 0fb578a529ac7aca326a9fa475b4a6f58a756fda upstream. + +PMERRLOC resource size was set to 0x100, which resulted in HSMC_ERRLOCx +register being truncated to offset x = 21, causing error correction to +fail if more than 22 bit errors and if 24 or 32 bit error correction +was supported. + +Fixes: d9c41bf30cf8 ("ARM: dts: at91: Declare EBI/NAND controllers") +Signed-off-by: Tudor Ambarus +Cc: # 4.13.x +Acked-by: Alexander Dahl +Signed-off-by: Nicolas Ferre +Link: https://lore.kernel.org/r/20220111132301.906712-1-tudor.ambarus@microchip.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/sama5d2.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/sama5d2.dtsi ++++ b/arch/arm/boot/dts/sama5d2.dtsi +@@ -415,7 +415,7 @@ + pmecc: ecc-engine@f8014070 { + compatible = "atmel,sama5d2-pmecc"; + reg = <0xf8014070 0x490>, +- <0xf8014500 0x100>; ++ <0xf8014500 0x200>; + }; + }; + diff --git a/queue-5.17/arm-dts-at91-sama7g5-remove-unused-properties-in-i2c-nodes.patch b/queue-5.17/arm-dts-at91-sama7g5-remove-unused-properties-in-i2c-nodes.patch new file mode 100644 index 00000000000..3adc8aa561d --- /dev/null +++ b/queue-5.17/arm-dts-at91-sama7g5-remove-unused-properties-in-i2c-nodes.patch @@ -0,0 +1,53 @@ +From cbb92a7717d2e1c512b7e81c6b22c7298b58a881 Mon Sep 17 00:00:00 2001 +From: Tudor Ambarus +Date: Wed, 2 Mar 2022 18:18:54 +0200 +Subject: ARM: dts: at91: sama7g5: Remove unused properties in i2c nodes + +From: Tudor Ambarus + +commit cbb92a7717d2e1c512b7e81c6b22c7298b58a881 upstream. + +The "atmel,use-dma-rx", "atmel,use-dma-rx" dt properties are not used by +the i2c-at91 driver, nor they are defined in the bindings file, thus remove +them. + +Cc: stable@vger.kernel.org +Fixes: 7540629e2fc7 ("ARM: dts: at91: add sama7g5 SoC DT and sama7g5-ek") +Signed-off-by: Tudor Ambarus +Reviewed-by: Eugen Hristev +Signed-off-by: Nicolas Ferre +Link: https://lore.kernel.org/r/20220302161854.32177-1-tudor.ambarus@microchip.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/sama7g5.dtsi | 6 ------ + 1 file changed, 6 deletions(-) + +--- a/arch/arm/boot/dts/sama7g5.dtsi ++++ b/arch/arm/boot/dts/sama7g5.dtsi +@@ -382,8 +382,6 @@ + dmas = <&dma0 AT91_XDMAC_DT_PERID(7)>, + <&dma0 AT91_XDMAC_DT_PERID(8)>; + dma-names = "rx", "tx"; +- atmel,use-dma-rx; +- atmel,use-dma-tx; + status = "disabled"; + }; + }; +@@ -558,8 +556,6 @@ + dmas = <&dma0 AT91_XDMAC_DT_PERID(21)>, + <&dma0 AT91_XDMAC_DT_PERID(22)>; + dma-names = "rx", "tx"; +- atmel,use-dma-rx; +- atmel,use-dma-tx; + status = "disabled"; + }; + }; +@@ -584,8 +580,6 @@ + dmas = <&dma0 AT91_XDMAC_DT_PERID(23)>, + <&dma0 AT91_XDMAC_DT_PERID(24)>; + dma-names = "rx", "tx"; +- atmel,use-dma-rx; +- atmel,use-dma-tx; + status = "disabled"; + }; + }; diff --git a/queue-5.17/arm-dts-exynos-add-missing-hdmi-supplies-on-smdk5250.patch b/queue-5.17/arm-dts-exynos-add-missing-hdmi-supplies-on-smdk5250.patch new file mode 100644 index 00000000000..5fd8b30a9bd --- /dev/null +++ b/queue-5.17/arm-dts-exynos-add-missing-hdmi-supplies-on-smdk5250.patch @@ -0,0 +1,34 @@ +From 60a9914cb2061ba612a3f14f6ad329912b486360 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 8 Feb 2022 18:18:14 +0100 +Subject: ARM: dts: exynos: add missing HDMI supplies on SMDK5250 + +From: Krzysztof Kozlowski + +commit 60a9914cb2061ba612a3f14f6ad329912b486360 upstream. + +Add required VDD supplies to HDMI block on SMDK5250. Without them, the +HDMI driver won't probe. Because of lack of schematics, use same +supplies as on Arndale 5250 board (voltage matches). + +Cc: # v3.15+ +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Alim Akhtar +Link: https://lore.kernel.org/r/20220208171823.226211-2-krzysztof.kozlowski@canonical.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/exynos5250-smdk5250.dts | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/arm/boot/dts/exynos5250-smdk5250.dts ++++ b/arch/arm/boot/dts/exynos5250-smdk5250.dts +@@ -118,6 +118,9 @@ + status = "okay"; + ddc = <&i2c_2>; + hpd-gpios = <&gpx3 7 GPIO_ACTIVE_HIGH>; ++ vdd-supply = <&ldo8_reg>; ++ vdd_osc-supply = <&ldo10_reg>; ++ vdd_pll-supply = <&ldo8_reg>; + }; + + &i2c_0 { diff --git a/queue-5.17/arm-dts-exynos-add-missing-hdmi-supplies-on-smdk5420.patch b/queue-5.17/arm-dts-exynos-add-missing-hdmi-supplies-on-smdk5420.patch new file mode 100644 index 00000000000..e19f0851a74 --- /dev/null +++ b/queue-5.17/arm-dts-exynos-add-missing-hdmi-supplies-on-smdk5420.patch @@ -0,0 +1,34 @@ +From 453a24ded415f7fce0499c6b0a2c7b28f84911f2 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 8 Feb 2022 18:18:15 +0100 +Subject: ARM: dts: exynos: add missing HDMI supplies on SMDK5420 + +From: Krzysztof Kozlowski + +commit 453a24ded415f7fce0499c6b0a2c7b28f84911f2 upstream. + +Add required VDD supplies to HDMI block on SMDK5420. Without them, the +HDMI driver won't probe. Because of lack of schematics, use same +supplies as on Arndale Octa and Odroid XU3 boards (voltage matches). + +Cc: # v3.15+ +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Alim Akhtar +Link: https://lore.kernel.org/r/20220208171823.226211-3-krzysztof.kozlowski@canonical.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/exynos5420-smdk5420.dts | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/arm/boot/dts/exynos5420-smdk5420.dts ++++ b/arch/arm/boot/dts/exynos5420-smdk5420.dts +@@ -124,6 +124,9 @@ + hpd-gpios = <&gpx3 7 GPIO_ACTIVE_HIGH>; + pinctrl-names = "default"; + pinctrl-0 = <&hdmi_hpd_irq>; ++ vdd-supply = <&ldo6_reg>; ++ vdd_osc-supply = <&ldo7_reg>; ++ vdd_pll-supply = <&ldo6_reg>; + }; + + &hsi2c_4 { diff --git a/queue-5.17/arm-dts-exynos-fix-uart3-pins-configuration-in-exynos5250.patch b/queue-5.17/arm-dts-exynos-fix-uart3-pins-configuration-in-exynos5250.patch new file mode 100644 index 00000000000..e224f38a7c0 --- /dev/null +++ b/queue-5.17/arm-dts-exynos-fix-uart3-pins-configuration-in-exynos5250.patch @@ -0,0 +1,34 @@ +From 372d7027fed43c8570018e124cf78b89523a1f8e Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Thu, 30 Dec 2021 20:53:23 +0100 +Subject: ARM: dts: exynos: fix UART3 pins configuration in Exynos5250 + +From: Krzysztof Kozlowski + +commit 372d7027fed43c8570018e124cf78b89523a1f8e upstream. + +The gpa1-4 pin was put twice in UART3 pin configuration of Exynos5250, +instead of proper pin gpa1-5. + +Fixes: f8bfe2b050f3 ("ARM: dts: add pin state information in client nodes for Exynos5 platforms") +Cc: +Signed-off-by: Krzysztof Kozlowski +Tested-by: Marek Szyprowski +Reviewed-by: Alim Akhtar +Link: https://lore.kernel.org/r/20211230195325.328220-1-krzysztof.kozlowski@canonical.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/exynos5250-pinctrl.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/exynos5250-pinctrl.dtsi ++++ b/arch/arm/boot/dts/exynos5250-pinctrl.dtsi +@@ -260,7 +260,7 @@ + }; + + uart3_data: uart3-data { +- samsung,pins = "gpa1-4", "gpa1-4"; ++ samsung,pins = "gpa1-4", "gpa1-5"; + samsung,pin-function = ; + samsung,pin-pud = ; + samsung,pin-drv = ; diff --git a/queue-5.17/carl9170-fix-missing-bit-wise-or-operator-for-tx_params.patch b/queue-5.17/carl9170-fix-missing-bit-wise-or-operator-for-tx_params.patch new file mode 100644 index 00000000000..0ba44eb56bb --- /dev/null +++ b/queue-5.17/carl9170-fix-missing-bit-wise-or-operator-for-tx_params.patch @@ -0,0 +1,39 @@ +From 02a95374b5eebdbd3b6413fd7ddec151d2ea75a1 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Tue, 25 Jan 2022 00:44:06 +0000 +Subject: carl9170: fix missing bit-wise or operator for tx_params + +From: Colin Ian King + +commit 02a95374b5eebdbd3b6413fd7ddec151d2ea75a1 upstream. + +Currently tx_params is being re-assigned with a new value and the +previous setting IEEE80211_HT_MCS_TX_RX_DIFF is being overwritten. +The assignment operator is incorrect, the original intent was to +bit-wise or the value in. Fix this by replacing the = operator +with |= instead. + +Kudos to Christian Lamparter for suggesting the correct fix. + +Fixes: fe8ee9ad80b2 ("carl9170: mac80211 glue and command interface") +Signed-off-by: Colin Ian King +Cc: +Acked-by: Christian Lamparter +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220125004406.344422-1-colin.i.king@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/carl9170/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/carl9170/main.c ++++ b/drivers/net/wireless/ath/carl9170/main.c +@@ -1914,7 +1914,7 @@ static int carl9170_parse_eeprom(struct + WARN_ON(!(tx_streams >= 1 && tx_streams <= + IEEE80211_HT_MCS_TX_MAX_STREAMS)); + +- tx_params = (tx_streams - 1) << ++ tx_params |= (tx_streams - 1) << + IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT; + + carl9170_band_2GHz.ht_cap.mcs.tx_params |= tx_params; diff --git a/queue-5.17/drm-edid-check-basic-audio-support-on-cea-extension-block.patch b/queue-5.17/drm-edid-check-basic-audio-support-on-cea-extension-block.patch new file mode 100644 index 00000000000..5827d779bc2 --- /dev/null +++ b/queue-5.17/drm-edid-check-basic-audio-support-on-cea-extension-block.patch @@ -0,0 +1,42 @@ +From 5662abf6e21338be6d085d6375d3732ac6147fd2 Mon Sep 17 00:00:00 2001 +From: Cooper Chiou +Date: Thu, 24 Mar 2022 14:12:18 +0800 +Subject: drm/edid: check basic audio support on CEA extension block + +From: Cooper Chiou + +commit 5662abf6e21338be6d085d6375d3732ac6147fd2 upstream. + +Tag code stored in bit7:5 for CTA block byte[3] is not the same as +CEA extension block definition. Only check CEA block has +basic audio support. + +v3: update commit message. + +Cc: stable@vger.kernel.org +Cc: Jani Nikula +Cc: Shawn C Lee +Cc: intel-gfx +Signed-off-by: Cooper Chiou +Signed-off-by: Lee Shawn C +Fixes: e28ad544f462 ("drm/edid: parse CEA blocks embedded in DisplayID") +Reviewed-by: Jani Nikula +Signed-off-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20220324061218.32739-1-shawn.c.lee@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_edid.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -4848,7 +4848,8 @@ bool drm_detect_monitor_audio(struct edi + if (!edid_ext) + goto end; + +- has_audio = ((edid_ext[3] & EDID_BASIC_AUDIO) != 0); ++ has_audio = (edid_ext[0] == CEA_EXT && ++ (edid_ext[3] & EDID_BASIC_AUDIO) != 0); + + if (has_audio) { + DRM_DEBUG_KMS("Monitor has basic audio support\n"); diff --git a/queue-5.17/fbdev-hot-unplug-firmware-fb-devices-on-forced-removal.patch b/queue-5.17/fbdev-hot-unplug-firmware-fb-devices-on-forced-removal.patch new file mode 100644 index 00000000000..1c471a5ac68 --- /dev/null +++ b/queue-5.17/fbdev-hot-unplug-firmware-fb-devices-on-forced-removal.patch @@ -0,0 +1,119 @@ +From 27599aacbaefcbf2af7b06b0029459bbf682000d Mon Sep 17 00:00:00 2001 +From: Thomas Zimmermann +Date: Tue, 25 Jan 2022 10:12:18 +0100 +Subject: fbdev: Hot-unplug firmware fb devices on forced removal + +From: Thomas Zimmermann + +commit 27599aacbaefcbf2af7b06b0029459bbf682000d upstream. + +Hot-unplug all firmware-framebuffer devices as part of removing +them via remove_conflicting_framebuffers() et al. Releases all +memory regions to be acquired by native drivers. + +Firmware, such as EFI, install a framebuffer while posting the +computer. After removing the firmware-framebuffer device from fbdev, +a native driver takes over the hardware and the firmware framebuffer +becomes invalid. + +Firmware-framebuffer drivers, specifically simplefb, don't release +their device from Linux' device hierarchy. It still owns the firmware +framebuffer and blocks the native drivers from loading. This has been +observed in the vmwgfx driver. [1] + +Initiating a device removal (i.e., hot unplug) as part of +remove_conflicting_framebuffers() removes the underlying device and +returns the memory range to the system. + +[1] https://lore.kernel.org/dri-devel/20220117180359.18114-1-zack@kde.org/ + +v2: + * rename variable 'dev' to 'device' (Javier) + +Signed-off-by: Thomas Zimmermann +Reported-by: Zack Rusin +Reviewed-by: Javier Martinez Canillas +Reviewed-by: Zack Rusin +Reviewed-by: Hans de Goede +CC: stable@vger.kernel.org # v5.11+ +Link: https://patchwork.freedesktop.org/patch/msgid/20220125091222.21457-2-tzimmermann@suse.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/core/fbmem.c | 29 ++++++++++++++++++++++++++--- + include/linux/fb.h | 1 + + 2 files changed, 27 insertions(+), 3 deletions(-) + +--- a/drivers/video/fbdev/core/fbmem.c ++++ b/drivers/video/fbdev/core/fbmem.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -1559,18 +1560,36 @@ static void do_remove_conflicting_frameb + /* check all firmware fbs and kick off if the base addr overlaps */ + for_each_registered_fb(i) { + struct apertures_struct *gen_aper; ++ struct device *device; + + if (!(registered_fb[i]->flags & FBINFO_MISC_FIRMWARE)) + continue; + + gen_aper = registered_fb[i]->apertures; ++ device = registered_fb[i]->device; + if (fb_do_apertures_overlap(gen_aper, a) || + (primary && gen_aper && gen_aper->count && + gen_aper->ranges[0].base == VGA_FB_PHYS)) { + + printk(KERN_INFO "fb%d: switching to %s from %s\n", + i, name, registered_fb[i]->fix.id); +- do_unregister_framebuffer(registered_fb[i]); ++ ++ /* ++ * If we kick-out a firmware driver, we also want to remove ++ * the underlying platform device, such as simple-framebuffer, ++ * VESA, EFI, etc. A native driver will then be able to ++ * allocate the memory range. ++ * ++ * If it's not a platform device, at least print a warning. A ++ * fix would add code to remove the device from the system. ++ */ ++ if (dev_is_platform(device)) { ++ registered_fb[i]->forced_out = true; ++ platform_device_unregister(to_platform_device(device)); ++ } else { ++ pr_warn("fb%d: cannot remove device\n", i); ++ do_unregister_framebuffer(registered_fb[i]); ++ } + } + } + } +@@ -1900,9 +1919,13 @@ EXPORT_SYMBOL(register_framebuffer); + void + unregister_framebuffer(struct fb_info *fb_info) + { +- mutex_lock(®istration_lock); ++ bool forced_out = fb_info->forced_out; ++ ++ if (!forced_out) ++ mutex_lock(®istration_lock); + do_unregister_framebuffer(fb_info); +- mutex_unlock(®istration_lock); ++ if (!forced_out) ++ mutex_unlock(®istration_lock); + } + EXPORT_SYMBOL(unregister_framebuffer); + +--- a/include/linux/fb.h ++++ b/include/linux/fb.h +@@ -502,6 +502,7 @@ struct fb_info { + } *apertures; + + bool skip_vt_switch; /* no VT switch on suspend/resume required */ ++ bool forced_out; /* set when being removed by another driver */ + }; + + static inline struct apertures_struct *alloc_apertures(unsigned int max_num) { diff --git a/queue-5.17/mgag200-fix-memmapsl-configuration-in-gctl6-register.patch b/queue-5.17/mgag200-fix-memmapsl-configuration-in-gctl6-register.patch new file mode 100644 index 00000000000..c4d6a70770b --- /dev/null +++ b/queue-5.17/mgag200-fix-memmapsl-configuration-in-gctl6-register.patch @@ -0,0 +1,83 @@ +From 028a73e10705af1ffd51f2537460f616dc58680e Mon Sep 17 00:00:00 2001 +From: Jocelyn Falempe +Date: Wed, 19 Jan 2022 11:29:05 +0100 +Subject: mgag200 fix memmapsl configuration in GCTL6 register +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jocelyn Falempe + +commit 028a73e10705af1ffd51f2537460f616dc58680e upstream. + +On some servers with MGA G200_SE_A (rev 42), booting with Legacy BIOS, +the hardware hangs when using kdump and kexec into the kdump kernel. +This happens when the uncompress code tries to write "Decompressing Linux" +to the VGA Console. + +It can be reproduced by writing to the VGA console (0xB8000) after +booting to graphic mode, it generates the following error: + +kernel:NMI: PCI system error (SERR) for reason a0 on CPU 0. +kernel:Dazed and confused, but trying to continue + +The root cause is the configuration of the MGA GCTL6 register + +According to the GCTL6 register documentation: + +bit 0 is gcgrmode: + 0: Enables alpha mode, and the character generator addressing system is + activated. + 1: Enables graphics mode, and the character addressing system is not + used. + +bit 1 is chainodd even: + 0: The A0 signal of the memory address bus is used during system memory + addressing. + 1: Allows A0 to be replaced by either the A16 signal of the system + address (ifmemmapsl is ‘00’), or by the hpgoddev (MISC<5>, odd/even + page select) field, described on page 3-294). + +bit 3-2 are memmapsl: + Memory map select bits 1 and 0. VGA. + These bits select where the video memory is mapped, as shown below: + 00 => A0000h - BFFFFh + 01 => A0000h - AFFFFh + 10 => B0000h - B7FFFh + 11 => B8000h - BFFFFh + +bit 7-4 are reserved. + +Current code set it to 0x05 => memmapsl to b01 => 0xa0000 (graphic mode) +But on x86, the VGA console is at 0xb8000 (text mode) +In arch/x86/boot/compressed/misc.c debug strings are written to 0xb8000 +As the driver doesn't use this mapping at 0xa0000, it is safe to set it to +0xb8000 instead, to avoid kernel hang on G200_SE_A rev42, with kexec/kdump. + +Thus changing the value 0x05 to 0x0d + +Signed-off-by: Jocelyn Falempe +Reviewed-by: Javier Martinez Canillas +Acked-by: Lyude Paul +Cc: stable@vger.kernel.org +Signed-off-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/20220119102905.1194787-1-jfalempe@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/mgag200/mgag200_mode.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/mgag200/mgag200_mode.c ++++ b/drivers/gpu/drm/mgag200/mgag200_mode.c +@@ -529,7 +529,10 @@ static void mgag200_set_format_regs(stru + WREG_GFX(3, 0x00); + WREG_GFX(4, 0x00); + WREG_GFX(5, 0x40); +- WREG_GFX(6, 0x05); ++ /* GCTL6 should be 0x05, but we configure memmapsl to 0xb8000 (text mode), ++ * so that it doesn't hang when running kexec/kdump on G200_SE rev42. ++ */ ++ WREG_GFX(6, 0x0d); + WREG_GFX(7, 0x0f); + WREG_GFX(8, 0x0f); + diff --git a/queue-5.17/pstore-don-t-use-semaphores-in-always-atomic-context-code.patch b/queue-5.17/pstore-don-t-use-semaphores-in-always-atomic-context-code.patch new file mode 100644 index 00000000000..644714c9390 --- /dev/null +++ b/queue-5.17/pstore-don-t-use-semaphores-in-always-atomic-context-code.patch @@ -0,0 +1,170 @@ +From 8126b1c73108bc691f5643df19071a59a69d0bc6 Mon Sep 17 00:00:00 2001 +From: Jann Horn +Date: Mon, 14 Mar 2022 19:59:53 +0100 +Subject: pstore: Don't use semaphores in always-atomic-context code + +From: Jann Horn + +commit 8126b1c73108bc691f5643df19071a59a69d0bc6 upstream. + +pstore_dump() is *always* invoked in atomic context (nowadays in an RCU +read-side critical section, before that under a spinlock). +It doesn't make sense to try to use semaphores here. + +This is mostly a revert of commit ea84b580b955 ("pstore: Convert buf_lock +to semaphore"), except that two parts aren't restored back exactly as they +were: + + - keep the lock initialization in pstore_register + - in efi_pstore_write(), always set the "block" flag to false + - omit "is_locked", that was unnecessary since + commit 959217c84c27 ("pstore: Actually give up during locking failure") + - fix the bailout message + +The actual problem that the buggy commit was trying to address may have +been that the use of preemptible() in efi_pstore_write() was wrong - it +only looks at preempt_count() and the state of IRQs, but __rcu_read_lock() +doesn't touch either of those under CONFIG_PREEMPT_RCU. +(Sidenote: CONFIG_PREEMPT_RCU means that the scheduler can preempt tasks in +RCU read-side critical sections, but you're not allowed to actively +block/reschedule.) + +Lockdep probably never caught the problem because it's very rare that you +actually hit the contended case, so lockdep always just sees the +down_trylock(), not the down_interruptible(), and so it can't tell that +there's a problem. + +Fixes: ea84b580b955 ("pstore: Convert buf_lock to semaphore") +Cc: stable@vger.kernel.org +Acked-by: Sebastian Andrzej Siewior +Signed-off-by: Jann Horn +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20220314185953.2068993-1-jannh@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/firmware/efi/efi-pstore.c | 2 +- + fs/pstore/platform.c | 38 ++++++++++++++++++-------------------- + include/linux/pstore.h | 6 +++--- + 3 files changed, 22 insertions(+), 24 deletions(-) + +--- a/drivers/firmware/efi/efi-pstore.c ++++ b/drivers/firmware/efi/efi-pstore.c +@@ -266,7 +266,7 @@ static int efi_pstore_write(struct pstor + efi_name[i] = name[i]; + + ret = efivar_entry_set_safe(efi_name, vendor, PSTORE_EFI_ATTRIBUTES, +- preemptible(), record->size, record->psi->buf); ++ false, record->size, record->psi->buf); + + if (record->reason == KMSG_DUMP_OOPS && try_module_get(THIS_MODULE)) + if (!schedule_work(&efivar_work)) +--- a/fs/pstore/platform.c ++++ b/fs/pstore/platform.c +@@ -143,21 +143,22 @@ static void pstore_timer_kick(void) + mod_timer(&pstore_timer, jiffies + msecs_to_jiffies(pstore_update_ms)); + } + +-/* +- * Should pstore_dump() wait for a concurrent pstore_dump()? If +- * not, the current pstore_dump() will report a failure to dump +- * and return. +- */ +-static bool pstore_cannot_wait(enum kmsg_dump_reason reason) ++static bool pstore_cannot_block_path(enum kmsg_dump_reason reason) + { +- /* In NMI path, pstore shouldn't block regardless of reason. */ ++ /* ++ * In case of NMI path, pstore shouldn't be blocked ++ * regardless of reason. ++ */ + if (in_nmi()) + return true; + + switch (reason) { + /* In panic case, other cpus are stopped by smp_send_stop(). */ + case KMSG_DUMP_PANIC: +- /* Emergency restart shouldn't be blocked. */ ++ /* ++ * Emergency restart shouldn't be blocked by spinning on ++ * pstore_info::buf_lock. ++ */ + case KMSG_DUMP_EMERG: + return true; + default: +@@ -389,21 +390,19 @@ static void pstore_dump(struct kmsg_dump + unsigned long total = 0; + const char *why; + unsigned int part = 1; ++ unsigned long flags = 0; + int ret; + + why = kmsg_dump_reason_str(reason); + +- if (down_trylock(&psinfo->buf_lock)) { +- /* Failed to acquire lock: give up if we cannot wait. */ +- if (pstore_cannot_wait(reason)) { +- pr_err("dump skipped in %s path: may corrupt error record\n", +- in_nmi() ? "NMI" : why); +- return; +- } +- if (down_interruptible(&psinfo->buf_lock)) { +- pr_err("could not grab semaphore?!\n"); ++ if (pstore_cannot_block_path(reason)) { ++ if (!spin_trylock_irqsave(&psinfo->buf_lock, flags)) { ++ pr_err("dump skipped in %s path because of concurrent dump\n", ++ in_nmi() ? "NMI" : why); + return; + } ++ } else { ++ spin_lock_irqsave(&psinfo->buf_lock, flags); + } + + kmsg_dump_rewind(&iter); +@@ -467,8 +466,7 @@ static void pstore_dump(struct kmsg_dump + total += record.size; + part++; + } +- +- up(&psinfo->buf_lock); ++ spin_unlock_irqrestore(&psinfo->buf_lock, flags); + } + + static struct kmsg_dumper pstore_dumper = { +@@ -594,7 +592,7 @@ int pstore_register(struct pstore_info * + psi->write_user = pstore_write_user_compat; + psinfo = psi; + mutex_init(&psinfo->read_mutex); +- sema_init(&psinfo->buf_lock, 1); ++ spin_lock_init(&psinfo->buf_lock); + + if (psi->flags & PSTORE_FLAGS_DMESG) + allocate_buf_for_compression(); +--- a/include/linux/pstore.h ++++ b/include/linux/pstore.h +@@ -14,7 +14,7 @@ + #include + #include + #include +-#include ++#include + #include + #include + +@@ -87,7 +87,7 @@ struct pstore_record { + * @owner: module which is responsible for this backend driver + * @name: name of the backend driver + * +- * @buf_lock: semaphore to serialize access to @buf ++ * @buf_lock: spinlock to serialize access to @buf + * @buf: preallocated crash dump buffer + * @bufsize: size of @buf available for crash dump bytes (must match + * smallest number of bytes available for writing to a +@@ -178,7 +178,7 @@ struct pstore_info { + struct module *owner; + const char *name; + +- struct semaphore buf_lock; ++ spinlock_t buf_lock; + char *buf; + size_t bufsize; + diff --git a/queue-5.17/rfkill-make-new-event-layout-opt-in.patch b/queue-5.17/rfkill-make-new-event-layout-opt-in.patch new file mode 100644 index 00000000000..5b0f0e4cea6 --- /dev/null +++ b/queue-5.17/rfkill-make-new-event-layout-opt-in.patch @@ -0,0 +1,180 @@ +From 54f586a9153201c6cff55e1f561990c78bd99aa7 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Wed, 16 Mar 2022 21:27:51 +0100 +Subject: rfkill: make new event layout opt-in + +From: Johannes Berg + +commit 54f586a9153201c6cff55e1f561990c78bd99aa7 upstream. + +Again new complaints surfaced that we had broken the ABI here, +although previously all the userspace tools had agreed that it +was their mistake and fixed it. Yet now there are cases (e.g. +RHEL) that want to run old userspace with newer kernels, and +thus are broken. + +Since this is a bit of a whack-a-mole thing, change the whole +extensibility scheme of rfkill to no longer just rely on the +message lengths, but instead require userspace to opt in via a +new ioctl to a given maximum event size that it is willing to +understand. + +By default, set that to RFKILL_EVENT_SIZE_V1 (8), so that the +behaviour for userspace not calling the ioctl will look as if +it's just running on an older kernel. + +Fixes: 14486c82612a ("rfkill: add a reason to the HW rfkill state") +Cc: stable@vger.kernel.org # 5.11+ +Signed-off-by: Johannes Berg +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220316212749.16491491b270.Ifcb1950998330a596f29a2a162e00b7546a1d6d0@changeid +Signed-off-by: Greg Kroah-Hartman +--- + include/uapi/linux/rfkill.h | 14 +++++++++++- + net/rfkill/core.c | 48 +++++++++++++++++++++++++++++++------------- + 2 files changed, 46 insertions(+), 16 deletions(-) + +--- a/include/uapi/linux/rfkill.h ++++ b/include/uapi/linux/rfkill.h +@@ -159,8 +159,16 @@ struct rfkill_event_ext { + * old behaviour for all userspace, unless it explicitly opts in to the + * rules outlined here by using the new &struct rfkill_event_ext. + * +- * Userspace using &struct rfkill_event_ext must adhere to the following +- * rules ++ * Additionally, some other userspace (bluez, g-s-d) was reading with a ++ * large size but as streaming reads rather than message-based, or with ++ * too strict checks for the returned size. So eventually, we completely ++ * reverted this, and extended messages need to be opted in to by using ++ * an ioctl: ++ * ++ * ioctl(fd, RFKILL_IOCTL_MAX_SIZE, sizeof(struct rfkill_event_ext)); ++ * ++ * Userspace using &struct rfkill_event_ext and the ioctl must adhere to ++ * the following rules: + * + * 1. accept short writes, optionally using them to detect that it's + * running on an older kernel; +@@ -175,6 +183,8 @@ struct rfkill_event_ext { + #define RFKILL_IOC_MAGIC 'R' + #define RFKILL_IOC_NOINPUT 1 + #define RFKILL_IOCTL_NOINPUT _IO(RFKILL_IOC_MAGIC, RFKILL_IOC_NOINPUT) ++#define RFKILL_IOC_MAX_SIZE 2 ++#define RFKILL_IOCTL_MAX_SIZE _IOW(RFKILL_IOC_MAGIC, RFKILL_IOC_EXT_SIZE, __u32) + + /* and that's all userspace gets */ + +--- a/net/rfkill/core.c ++++ b/net/rfkill/core.c +@@ -78,6 +78,7 @@ struct rfkill_data { + struct mutex mtx; + wait_queue_head_t read_wait; + bool input_handler; ++ u8 max_size; + }; + + +@@ -1153,6 +1154,8 @@ static int rfkill_fop_open(struct inode + if (!data) + return -ENOMEM; + ++ data->max_size = RFKILL_EVENT_SIZE_V1; ++ + INIT_LIST_HEAD(&data->events); + mutex_init(&data->mtx); + init_waitqueue_head(&data->read_wait); +@@ -1235,6 +1238,7 @@ static ssize_t rfkill_fop_read(struct fi + list); + + sz = min_t(unsigned long, sizeof(ev->ev), count); ++ sz = min_t(unsigned long, sz, data->max_size); + ret = sz; + if (copy_to_user(buf, &ev->ev, sz)) + ret = -EFAULT; +@@ -1249,6 +1253,7 @@ static ssize_t rfkill_fop_read(struct fi + static ssize_t rfkill_fop_write(struct file *file, const char __user *buf, + size_t count, loff_t *pos) + { ++ struct rfkill_data *data = file->private_data; + struct rfkill *rfkill; + struct rfkill_event_ext ev; + int ret; +@@ -1263,6 +1268,7 @@ static ssize_t rfkill_fop_write(struct f + * our API version even in a write() call, if it cares. + */ + count = min(count, sizeof(ev)); ++ count = min_t(size_t, count, data->max_size); + if (copy_from_user(&ev, buf, count)) + return -EFAULT; + +@@ -1322,31 +1328,47 @@ static int rfkill_fop_release(struct ino + return 0; + } + +-#ifdef CONFIG_RFKILL_INPUT + static long rfkill_fop_ioctl(struct file *file, unsigned int cmd, + unsigned long arg) + { + struct rfkill_data *data = file->private_data; ++ int ret = -ENOSYS; ++ u32 size; + + if (_IOC_TYPE(cmd) != RFKILL_IOC_MAGIC) + return -ENOSYS; + +- if (_IOC_NR(cmd) != RFKILL_IOC_NOINPUT) +- return -ENOSYS; +- + mutex_lock(&data->mtx); +- +- if (!data->input_handler) { +- if (atomic_inc_return(&rfkill_input_disabled) == 1) +- printk(KERN_DEBUG "rfkill: input handler disabled\n"); +- data->input_handler = true; ++ switch (_IOC_NR(cmd)) { ++#ifdef CONFIG_RFKILL_INPUT ++ case RFKILL_IOC_NOINPUT: ++ if (!data->input_handler) { ++ if (atomic_inc_return(&rfkill_input_disabled) == 1) ++ printk(KERN_DEBUG "rfkill: input handler disabled\n"); ++ data->input_handler = true; ++ } ++ ret = 0; ++ break; ++#endif ++ case RFKILL_IOC_MAX_SIZE: ++ if (get_user(size, (__u32 __user *)arg)) { ++ ret = -EFAULT; ++ break; ++ } ++ if (size < RFKILL_EVENT_SIZE_V1 || size > U8_MAX) { ++ ret = -EINVAL; ++ break; ++ } ++ data->max_size = size; ++ ret = 0; ++ break; ++ default: ++ break; + } +- + mutex_unlock(&data->mtx); + +- return 0; ++ return ret; + } +-#endif + + static const struct file_operations rfkill_fops = { + .owner = THIS_MODULE, +@@ -1355,10 +1377,8 @@ static const struct file_operations rfki + .write = rfkill_fop_write, + .poll = rfkill_fop_poll, + .release = rfkill_fop_release, +-#ifdef CONFIG_RFKILL_INPUT + .unlocked_ioctl = rfkill_fop_ioctl, + .compat_ioctl = compat_ptr_ioctl, +-#endif + .llseek = no_llseek, + }; + diff --git a/queue-5.17/series b/queue-5.17/series index 9c63cdfaaa9..78cea52af77 100644 --- a/queue-5.17/series +++ b/queue-5.17/series @@ -142,3 +142,17 @@ btrfs-zoned-put-block-group-after-final-usage.patch block-fix-rq-qos-breakage-from-skipping-rq_qos_done_bio.patch block-limit-request-dispatch-loop-duration.patch block-don-t-merge-across-cgroup-boundaries-if-blkcg-is-enabled.patch +drm-edid-check-basic-audio-support-on-cea-extension-block.patch +fbdev-hot-unplug-firmware-fb-devices-on-forced-removal.patch +video-fbdev-sm712fb-fix-crash-in-smtcfb_read.patch +video-fbdev-atari-atari-2-bpp-ste-palette-bugfix.patch +rfkill-make-new-event-layout-opt-in.patch +arm-dts-at91-sama7g5-remove-unused-properties-in-i2c-nodes.patch +arm-dts-at91-sama5d2-fix-pmerrloc-resource-size.patch +arm-dts-exynos-fix-uart3-pins-configuration-in-exynos5250.patch +arm-dts-exynos-add-missing-hdmi-supplies-on-smdk5250.patch +arm-dts-exynos-add-missing-hdmi-supplies-on-smdk5420.patch +mgag200-fix-memmapsl-configuration-in-gctl6-register.patch +carl9170-fix-missing-bit-wise-or-operator-for-tx_params.patch +pstore-don-t-use-semaphores-in-always-atomic-context-code.patch +thermal-int340x-increase-bitmap-size.patch diff --git a/queue-5.17/thermal-int340x-increase-bitmap-size.patch b/queue-5.17/thermal-int340x-increase-bitmap-size.patch new file mode 100644 index 00000000000..e4368f5a0ec --- /dev/null +++ b/queue-5.17/thermal-int340x-increase-bitmap-size.patch @@ -0,0 +1,35 @@ +From 668f69a5f863b877bc3ae129efe9a80b6f055141 Mon Sep 17 00:00:00 2001 +From: Srinivas Pandruvada +Date: Mon, 14 Mar 2022 15:08:55 -0700 +Subject: thermal: int340x: Increase bitmap size + +From: Srinivas Pandruvada + +commit 668f69a5f863b877bc3ae129efe9a80b6f055141 upstream. + +The number of policies are 10, so can't be supported by the bitmap size +of u8. + +Even though there are no platfoms with these many policies, but +for correctness increase to u32. + +Signed-off-by: Srinivas Pandruvada +Fixes: 16fc8eca1975 ("thermal/int340x_thermal: Add additional UUIDs") +Cc: 5.1+ # 5.1+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/thermal/intel/int340x_thermal/int3400_thermal.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c ++++ b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c +@@ -53,7 +53,7 @@ struct int3400_thermal_priv { + struct art *arts; + int trt_count; + struct trt *trts; +- u8 uuid_bitmap; ++ u32 uuid_bitmap; + int rel_misc_dev_res; + int current_uuid_index; + char *data_vault; diff --git a/queue-5.17/video-fbdev-atari-atari-2-bpp-ste-palette-bugfix.patch b/queue-5.17/video-fbdev-atari-atari-2-bpp-ste-palette-bugfix.patch new file mode 100644 index 00000000000..47f8d311d1f --- /dev/null +++ b/queue-5.17/video-fbdev-atari-atari-2-bpp-ste-palette-bugfix.patch @@ -0,0 +1,62 @@ +From c8be5edbd36ceed2ff3d6b8f8e40643c3f396ea3 Mon Sep 17 00:00:00 2001 +From: Michael Schmitz +Date: Wed, 16 Feb 2022 20:26:25 +1300 +Subject: video: fbdev: atari: Atari 2 bpp (STe) palette bugfix + +From: Michael Schmitz + +commit c8be5edbd36ceed2ff3d6b8f8e40643c3f396ea3 upstream. + +The code to set the shifter STe palette registers has a long +standing operator precedence bug, manifesting as colors set +on a 2 bits per pixel frame buffer coming up with a distinctive +blue tint. + +Add parentheses around the calculation of the per-color palette +data before shifting those into their respective bit field position. + +This bug goes back a long way (2.4 days at the very least) so there +won't be a Fixes: tag. + +Tested on ARAnyM as well on Falcon030 hardware. + +Cc: stable@vger.kernel.org +Reported-by: Geert Uytterhoeven +Link: https://lore.kernel.org/all/CAMuHMdU3ievhXxKR_xi_v3aumnYW7UNUO6qMdhgfyWTyVSsCkQ@mail.gmail.com +Tested-by: Michael Schmitz +Tested-by: Geert Uytterhoeven +Signed-off-by: Michael Schmitz +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/atafb.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/video/fbdev/atafb.c ++++ b/drivers/video/fbdev/atafb.c +@@ -1683,9 +1683,9 @@ static int falcon_setcolreg(unsigned int + ((blue & 0xfc00) >> 8)); + if (regno < 16) { + shifter_tt.color_reg[regno] = +- (((red & 0xe000) >> 13) | ((red & 0x1000) >> 12) << 8) | +- (((green & 0xe000) >> 13) | ((green & 0x1000) >> 12) << 4) | +- ((blue & 0xe000) >> 13) | ((blue & 0x1000) >> 12); ++ ((((red & 0xe000) >> 13) | ((red & 0x1000) >> 12)) << 8) | ++ ((((green & 0xe000) >> 13) | ((green & 0x1000) >> 12)) << 4) | ++ ((blue & 0xe000) >> 13) | ((blue & 0x1000) >> 12); + ((u32 *)info->pseudo_palette)[regno] = ((red & 0xf800) | + ((green & 0xfc00) >> 5) | + ((blue & 0xf800) >> 11)); +@@ -1971,9 +1971,9 @@ static int stste_setcolreg(unsigned int + green >>= 12; + if (ATARIHW_PRESENT(EXTD_SHIFTER)) + shifter_tt.color_reg[regno] = +- (((red & 0xe) >> 1) | ((red & 1) << 3) << 8) | +- (((green & 0xe) >> 1) | ((green & 1) << 3) << 4) | +- ((blue & 0xe) >> 1) | ((blue & 1) << 3); ++ ((((red & 0xe) >> 1) | ((red & 1) << 3)) << 8) | ++ ((((green & 0xe) >> 1) | ((green & 1) << 3)) << 4) | ++ ((blue & 0xe) >> 1) | ((blue & 1) << 3); + else + shifter_tt.color_reg[regno] = + ((red & 0xe) << 7) | diff --git a/queue-5.17/video-fbdev-sm712fb-fix-crash-in-smtcfb_read.patch b/queue-5.17/video-fbdev-sm712fb-fix-crash-in-smtcfb_read.patch new file mode 100644 index 00000000000..18f7e526ad6 --- /dev/null +++ b/queue-5.17/video-fbdev-sm712fb-fix-crash-in-smtcfb_read.patch @@ -0,0 +1,76 @@ +From bd771cf5c4254511cc4abb88f3dab3bd58bdf8e8 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sun, 27 Feb 2022 08:43:56 +0100 +Subject: video: fbdev: sm712fb: Fix crash in smtcfb_read() + +From: Helge Deller + +commit bd771cf5c4254511cc4abb88f3dab3bd58bdf8e8 upstream. + +Zheyu Ma reported this crash in the sm712fb driver when reading +three bytes from the framebuffer: + + BUG: unable to handle page fault for address: ffffc90001ffffff + RIP: 0010:smtcfb_read+0x230/0x3e0 + Call Trace: + vfs_read+0x198/0xa00 + ? do_sys_openat2+0x27d/0x350 + ? __fget_light+0x54/0x340 + ksys_read+0xce/0x190 + do_syscall_64+0x43/0x90 + +Fix it by removing the open-coded endianess fixup-code and +by moving the pointer post decrement out the fb_readl() function. + +Reported-by: Zheyu Ma +Signed-off-by: Helge Deller +Tested-by: Zheyu Ma +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/sm712fb.c | 25 +++++++------------------ + 1 file changed, 7 insertions(+), 18 deletions(-) + +--- a/drivers/video/fbdev/sm712fb.c ++++ b/drivers/video/fbdev/sm712fb.c +@@ -1047,7 +1047,7 @@ static ssize_t smtcfb_read(struct fb_inf + if (count + p > total_size) + count = total_size - p; + +- buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count, GFP_KERNEL); ++ buffer = kmalloc(PAGE_SIZE, GFP_KERNEL); + if (!buffer) + return -ENOMEM; + +@@ -1059,25 +1059,14 @@ static ssize_t smtcfb_read(struct fb_inf + while (count) { + c = (count > PAGE_SIZE) ? PAGE_SIZE : count; + dst = buffer; +- for (i = c >> 2; i--;) { +- *dst = fb_readl(src++); +- *dst = big_swap(*dst); ++ for (i = (c + 3) >> 2; i--;) { ++ u32 val; ++ ++ val = fb_readl(src); ++ *dst = big_swap(val); ++ src++; + dst++; + } +- if (c & 3) { +- u8 *dst8 = (u8 *)dst; +- u8 __iomem *src8 = (u8 __iomem *)src; +- +- for (i = c & 3; i--;) { +- if (i & 1) { +- *dst8++ = fb_readb(++src8); +- } else { +- *dst8++ = fb_readb(--src8); +- src8 += 2; +- } +- } +- src = (u32 __iomem *)src8; +- } + + if (copy_to_user(buf, buffer, c)) { + err = -EFAULT;