From: Greg Kroah-Hartman Date: Mon, 6 Jun 2022 13:49:45 +0000 (+0200) Subject: 5.17-stable patches X-Git-Tag: v5.10.121~81 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d7690e208459e72e2573fc32055fd5f6b6c74f84;p=thirdparty%2Fkernel%2Fstable-queue.git 5.17-stable patches added patches: drm-amdgpu-cs-make-commands-with-0-chunks-illegal-behaviour.patch drm-bridge-analogix_dp-grab-runtime-pm-reference-for-dp-aux.patch drm-etnaviv-check-for-reaped-mapping-in-etnaviv_iommu_unmap_gem.patch drm-i915-dsi-fix-vbt-send-packet-port-selection-for-icl.patch drm-nouveau-clk-fix-an-incorrect-null-check-on-list-iterator.patch drm-nouveau-kms-nv50-atom-fix-an-incorrect-null-check-on-list-iterator.patch drm-nouveau-subdev-bus-ratelimit-logging-for-fault-errors.patch md-fix-an-incorrect-null-check-in-does_sb_need_changing.patch md-fix-an-incorrect-null-check-in-md_reload_sb.patch media-coda-add-more-h264-levels-for-coda960.patch media-coda-fix-reported-h264-profile.patch mtd-cfi_cmdset_0002-move-and-rename-chip_check-chip_ready-chip_good_for_write.patch mtd-cfi_cmdset_0002-use-chip_ready-for-write-on-s29gl064n.patch --- diff --git a/queue-5.17/drm-amdgpu-cs-make-commands-with-0-chunks-illegal-behaviour.patch b/queue-5.17/drm-amdgpu-cs-make-commands-with-0-chunks-illegal-behaviour.patch new file mode 100644 index 00000000000..a54fb04c73f --- /dev/null +++ b/queue-5.17/drm-amdgpu-cs-make-commands-with-0-chunks-illegal-behaviour.patch @@ -0,0 +1,64 @@ +From 31ab27b14daaa75541a415c6794d6f3567fea44a Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Mon, 23 May 2022 10:24:18 +1000 +Subject: drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. + +From: Dave Airlie + +commit 31ab27b14daaa75541a415c6794d6f3567fea44a upstream. + +Submitting a cs with 0 chunks, causes an oops later, found trying +to execute the wrong userspace driver. + +MESA_LOADER_DRIVER_OVERRIDE=v3d glxinfo + +[172536.665184] BUG: kernel NULL pointer dereference, address: 00000000000001d8 +[172536.665188] #PF: supervisor read access in kernel mode +[172536.665189] #PF: error_code(0x0000) - not-present page +[172536.665191] PGD 6712a0067 P4D 6712a0067 PUD 5af9ff067 PMD 0 +[172536.665195] Oops: 0000 [#1] SMP NOPTI +[172536.665197] CPU: 7 PID: 2769838 Comm: glxinfo Tainted: P O 5.10.81 #1-NixOS +[172536.665199] Hardware name: To be filled by O.E.M. To be filled by O.E.M./CROSSHAIR V FORMULA-Z, BIOS 2201 03/23/2015 +[172536.665272] RIP: 0010:amdgpu_cs_ioctl+0x96/0x1ce0 [amdgpu] +[172536.665274] Code: 75 18 00 00 4c 8b b2 88 00 00 00 8b 46 08 48 89 54 24 68 49 89 f7 4c 89 5c 24 60 31 d2 4c 89 74 24 30 85 c0 0f 85 c0 01 00 00 <48> 83 ba d8 01 00 00 00 48 8b b4 24 90 00 00 00 74 16 48 8b 46 10 +[172536.665276] RSP: 0018:ffffb47c0e81bbe0 EFLAGS: 00010246 +[172536.665277] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 +[172536.665278] RDX: 0000000000000000 RSI: ffffb47c0e81be28 RDI: ffffb47c0e81bd68 +[172536.665279] RBP: ffff936524080010 R08: 0000000000000000 R09: ffffb47c0e81be38 +[172536.665281] R10: ffff936524080010 R11: ffff936524080000 R12: ffffb47c0e81bc40 +[172536.665282] R13: ffffb47c0e81be28 R14: ffff9367bc410000 R15: ffffb47c0e81be28 +[172536.665283] FS: 00007fe35e05d740(0000) GS:ffff936c1edc0000(0000) knlGS:0000000000000000 +[172536.665284] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[172536.665286] CR2: 00000000000001d8 CR3: 0000000532e46000 CR4: 00000000000406e0 +[172536.665287] Call Trace: +[172536.665322] ? amdgpu_cs_find_mapping+0x110/0x110 [amdgpu] +[172536.665332] drm_ioctl_kernel+0xaa/0xf0 [drm] +[172536.665338] drm_ioctl+0x201/0x3b0 [drm] +[172536.665369] ? amdgpu_cs_find_mapping+0x110/0x110 [amdgpu] +[172536.665372] ? selinux_file_ioctl+0x135/0x230 +[172536.665399] amdgpu_drm_ioctl+0x49/0x80 [amdgpu] +[172536.665403] __x64_sys_ioctl+0x83/0xb0 +[172536.665406] do_syscall_64+0x33/0x40 +[172536.665409] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2018 +Signed-off-by: Dave Airlie +Cc: stable@vger.kernel.org +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -115,7 +115,7 @@ static int amdgpu_cs_parser_init(struct + int ret; + + if (cs->in.num_chunks == 0) +- return 0; ++ return -EINVAL; + + chunk_array = kvmalloc_array(cs->in.num_chunks, sizeof(uint64_t), GFP_KERNEL); + if (!chunk_array) diff --git a/queue-5.17/drm-bridge-analogix_dp-grab-runtime-pm-reference-for-dp-aux.patch b/queue-5.17/drm-bridge-analogix_dp-grab-runtime-pm-reference-for-dp-aux.patch new file mode 100644 index 00000000000..362f16b6060 --- /dev/null +++ b/queue-5.17/drm-bridge-analogix_dp-grab-runtime-pm-reference-for-dp-aux.patch @@ -0,0 +1,54 @@ +From 8fb6c44fe8468f92ac7b8bbfcca4404a4e88645f Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Tue, 1 Mar 2022 18:11:38 -0800 +Subject: drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX + +From: Brian Norris + +commit 8fb6c44fe8468f92ac7b8bbfcca4404a4e88645f upstream. + +If the display is not enable()d, then we aren't holding a runtime PM +reference here. Thus, it's easy to accidentally cause a hang, if user +space is poking around at /dev/drm_dp_aux0 at the "wrong" time. + +Let's get a runtime PM reference, and check that we "see" the panel. +Don't force any panel power-up, etc., because that can be intrusive, and +that's not what other drivers do (see +drivers/gpu/drm/bridge/ti-sn65dsi86.c and +drivers/gpu/drm/bridge/parade-ps8640.c.) + +Fixes: 0d97ad03f422 ("drm/bridge: analogix_dp: Remove duplicated code") +Cc: +Cc: Tomeu Vizoso +Signed-off-by: Brian Norris +Reviewed-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://patchwork.freedesktop.org/patch/msgid/20220301181107.v4.1.I773a08785666ebb236917b0c8e6c05e3de471e75@changeid +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/bridge/analogix/analogix_dp_core.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c ++++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c +@@ -1632,8 +1632,19 @@ static ssize_t analogix_dpaux_transfer(s + struct drm_dp_aux_msg *msg) + { + struct analogix_dp_device *dp = to_dp(aux); ++ int ret; + +- return analogix_dp_transfer(dp, msg); ++ pm_runtime_get_sync(dp->dev); ++ ++ ret = analogix_dp_detect_hpd(dp); ++ if (ret) ++ goto out; ++ ++ ret = analogix_dp_transfer(dp, msg); ++out: ++ pm_runtime_put(dp->dev); ++ ++ return ret; + } + + struct analogix_dp_device * diff --git a/queue-5.17/drm-etnaviv-check-for-reaped-mapping-in-etnaviv_iommu_unmap_gem.patch b/queue-5.17/drm-etnaviv-check-for-reaped-mapping-in-etnaviv_iommu_unmap_gem.patch new file mode 100644 index 00000000000..065fb42b525 --- /dev/null +++ b/queue-5.17/drm-etnaviv-check-for-reaped-mapping-in-etnaviv_iommu_unmap_gem.patch @@ -0,0 +1,41 @@ +From e168c25526cd0368af098095c2ded4a008007e1b Mon Sep 17 00:00:00 2001 +From: Lucas Stach +Date: Wed, 23 Mar 2022 17:08:22 +0100 +Subject: drm/etnaviv: check for reaped mapping in etnaviv_iommu_unmap_gem +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lucas Stach + +commit e168c25526cd0368af098095c2ded4a008007e1b upstream. + +When the mapping is already reaped the unmap must be a no-op, as we +would otherwise try to remove the mapping twice, corrupting the involved +data structures. + +Cc: stable@vger.kernel.org # 5.4 +Signed-off-by: Lucas Stach +Reviewed-by: Philipp Zabel +Tested-by: Guido Günther +Acked-by: Guido Günther +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c +@@ -286,6 +286,12 @@ void etnaviv_iommu_unmap_gem(struct etna + + mutex_lock(&context->lock); + ++ /* Bail if the mapping has been reaped by another thread */ ++ if (!mapping->context) { ++ mutex_unlock(&context->lock); ++ return; ++ } ++ + /* If the vram node is on the mm, unmap and remove the node */ + if (mapping->vram_node.mm == &context->mm) + etnaviv_iommu_remove_mapping(context, mapping); diff --git a/queue-5.17/drm-i915-dsi-fix-vbt-send-packet-port-selection-for-icl.patch b/queue-5.17/drm-i915-dsi-fix-vbt-send-packet-port-selection-for-icl.patch new file mode 100644 index 00000000000..9fff3fd72e1 --- /dev/null +++ b/queue-5.17/drm-i915-dsi-fix-vbt-send-packet-port-selection-for-icl.patch @@ -0,0 +1,91 @@ +From 0ea917819d12fed41ea4662cc26ffa0060a5c354 Mon Sep 17 00:00:00 2001 +From: Jani Nikula +Date: Fri, 20 May 2022 12:46:00 +0300 +Subject: drm/i915/dsi: fix VBT send packet port selection for ICL+ +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jani Nikula + +commit 0ea917819d12fed41ea4662cc26ffa0060a5c354 upstream. + +The VBT send packet port selection was never updated for ICL+ where the +2nd link is on port B instead of port C as in VLV+ DSI. + +First, single link DSI needs to use the configured port instead of +relying on the VBT sequence block port. Remove the hard-coded port C +check here and make it generic. For reference, see commit f915084edc5a +("drm/i915: Changes related to the sequence port no for") for the +original VLV specific fix. + +Second, the sequence block port number is either 0 or 1, where 1 +indicates the 2nd link. Remove the hard-coded port C here for 2nd +link. (This could be a "find second set bit" on DSI ports, but just +check the two possible options.) + +Third, sanity check the result with a warning to avoid a NULL pointer +dereference. + +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/5984 +Cc: stable@vger.kernel.org # v4.19+ +Cc: Ville Syrjala +Signed-off-by: Jani Nikula +Reviewed-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20220520094600.2066945-1-jani.nikula@intel.com +(cherry picked from commit 08c59dde71b73a0ac94e3ed2d431345b01f20485) +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_dsi_vbt.c | 33 ++++++++++++++++++--------- + 1 file changed, 22 insertions(+), 11 deletions(-) + +--- a/drivers/gpu/drm/i915/display/intel_dsi_vbt.c ++++ b/drivers/gpu/drm/i915/display/intel_dsi_vbt.c +@@ -122,9 +122,25 @@ struct i2c_adapter_lookup { + #define ICL_GPIO_DDPA_CTRLCLK_2 8 + #define ICL_GPIO_DDPA_CTRLDATA_2 9 + +-static enum port intel_dsi_seq_port_to_port(u8 port) ++static enum port intel_dsi_seq_port_to_port(struct intel_dsi *intel_dsi, ++ u8 seq_port) + { +- return port ? PORT_C : PORT_A; ++ /* ++ * If single link DSI is being used on any port, the VBT sequence block ++ * send packet apparently always has 0 for the port. Just use the port ++ * we have configured, and ignore the sequence block port. ++ */ ++ if (hweight8(intel_dsi->ports) == 1) ++ return ffs(intel_dsi->ports) - 1; ++ ++ if (seq_port) { ++ if (intel_dsi->ports & PORT_B) ++ return PORT_B; ++ else if (intel_dsi->ports & PORT_C) ++ return PORT_C; ++ } ++ ++ return PORT_A; + } + + static const u8 *mipi_exec_send_packet(struct intel_dsi *intel_dsi, +@@ -146,15 +162,10 @@ static const u8 *mipi_exec_send_packet(s + + seq_port = (flags >> MIPI_PORT_SHIFT) & 3; + +- /* For DSI single link on Port A & C, the seq_port value which is +- * parsed from Sequence Block#53 of VBT has been set to 0 +- * Now, read/write of packets for the DSI single link on Port A and +- * Port C will based on the DVO port from VBT block 2. +- */ +- if (intel_dsi->ports == (1 << PORT_C)) +- port = PORT_C; +- else +- port = intel_dsi_seq_port_to_port(seq_port); ++ port = intel_dsi_seq_port_to_port(intel_dsi, seq_port); ++ ++ if (drm_WARN_ON(&dev_priv->drm, !intel_dsi->dsi_hosts[port])) ++ goto out; + + dsi_device = intel_dsi->dsi_hosts[port]->device; + if (!dsi_device) { diff --git a/queue-5.17/drm-nouveau-clk-fix-an-incorrect-null-check-on-list-iterator.patch b/queue-5.17/drm-nouveau-clk-fix-an-incorrect-null-check-on-list-iterator.patch new file mode 100644 index 00000000000..48a4db299d9 --- /dev/null +++ b/queue-5.17/drm-nouveau-clk-fix-an-incorrect-null-check-on-list-iterator.patch @@ -0,0 +1,58 @@ +From 1c3b2a27def609473ed13b1cd668cb10deab49b4 Mon Sep 17 00:00:00 2001 +From: Xiaomeng Tong +Date: Sun, 27 Mar 2022 15:58:24 +0800 +Subject: drm/nouveau/clk: Fix an incorrect NULL check on list iterator + +From: Xiaomeng Tong + +commit 1c3b2a27def609473ed13b1cd668cb10deab49b4 upstream. + +The bug is here: + if (nvkm_cstate_valid(clk, cstate, max_volt, clk->temp)) + return cstate; + +The list iterator value 'cstate' will *always* be set and non-NULL +by list_for_each_entry_from_reverse(), so it is incorrect to assume +that the iterator value will be unchanged if the list is empty or no +element is found (In fact, it will be a bogus pointer to an invalid +structure object containing the HEAD). Also it missed a NULL check +at callsite and may lead to invalid memory access after that. + +To fix this bug, just return 'encoder' when found, otherwise return +NULL. And add the NULL check. + +Cc: stable@vger.kernel.org +Fixes: 1f7f3d91ad38a ("drm/nouveau/clk: Respect voltage limits in nvkm_cstate_prog") +Signed-off-by: Xiaomeng Tong +Reviewed-by: Lyude Paul +Signed-off-by: Lyude Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20220327075824.11806-1-xiam0nd.tong@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c +@@ -135,10 +135,10 @@ nvkm_cstate_find_best(struct nvkm_clk *c + + list_for_each_entry_from_reverse(cstate, &pstate->list, head) { + if (nvkm_cstate_valid(clk, cstate, max_volt, clk->temp)) +- break; ++ return cstate; + } + +- return cstate; ++ return NULL; + } + + static struct nvkm_cstate * +@@ -169,6 +169,8 @@ nvkm_cstate_prog(struct nvkm_clk *clk, s + if (!list_empty(&pstate->list)) { + cstate = nvkm_cstate_get(clk, pstate, cstatei); + cstate = nvkm_cstate_find_best(clk, pstate, cstate); ++ if (!cstate) ++ return -EINVAL; + } else { + cstate = &pstate->base; + } diff --git a/queue-5.17/drm-nouveau-kms-nv50-atom-fix-an-incorrect-null-check-on-list-iterator.patch b/queue-5.17/drm-nouveau-kms-nv50-atom-fix-an-incorrect-null-check-on-list-iterator.patch new file mode 100644 index 00000000000..47d8187b811 --- /dev/null +++ b/queue-5.17/drm-nouveau-kms-nv50-atom-fix-an-incorrect-null-check-on-list-iterator.patch @@ -0,0 +1,97 @@ +From 6ce4431c7ba7954c4fa6a96ce16ca1b2943e1a83 Mon Sep 17 00:00:00 2001 +From: Xiaomeng Tong +Date: Sun, 27 Mar 2022 15:39:25 +0800 +Subject: drm/nouveau/kms/nv50-: atom: fix an incorrect NULL check on list iterator + +From: Xiaomeng Tong + +commit 6ce4431c7ba7954c4fa6a96ce16ca1b2943e1a83 upstream. + +The bug is here: + return encoder; + +The list iterator value 'encoder' will *always* be set and non-NULL +by drm_for_each_encoder_mask(), so it is incorrect to assume that the +iterator value will be NULL if the list is empty or no element found. +Otherwise it will bypass some NULL checks and lead to invalid memory +access passing the check. + +To fix this bug, just return 'encoder' when found, otherwise return +NULL. + +Cc: stable@vger.kernel.org +Fixes: 12885ecbfe62d ("drm/nouveau/kms/nvd9-: Add CRC support") +Signed-off-by: Xiaomeng Tong +Reviewed-by: Lyude Paul +[Changed commit title] +Signed-off-by: Lyude Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20220327073925.11121-1-xiam0nd.tong@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/dispnv50/atom.h | 6 +++--- + drivers/gpu/drm/nouveau/dispnv50/crc.c | 27 ++++++++++++++++++++++----- + 2 files changed, 25 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/nouveau/dispnv50/atom.h ++++ b/drivers/gpu/drm/nouveau/dispnv50/atom.h +@@ -160,14 +160,14 @@ nv50_head_atom_get(struct drm_atomic_sta + static inline struct drm_encoder * + nv50_head_atom_get_encoder(struct nv50_head_atom *atom) + { +- struct drm_encoder *encoder = NULL; ++ struct drm_encoder *encoder; + + /* We only ever have a single encoder */ + drm_for_each_encoder_mask(encoder, atom->state.crtc->dev, + atom->state.encoder_mask) +- break; ++ return encoder; + +- return encoder; ++ return NULL; + } + + #define nv50_wndw_atom(p) container_of((p), struct nv50_wndw_atom, state) +--- a/drivers/gpu/drm/nouveau/dispnv50/crc.c ++++ b/drivers/gpu/drm/nouveau/dispnv50/crc.c +@@ -390,9 +390,18 @@ void nv50_crc_atomic_check_outp(struct n + struct nv50_head_atom *armh = nv50_head_atom(old_crtc_state); + struct nv50_head_atom *asyh = nv50_head_atom(new_crtc_state); + struct nv50_outp_atom *outp_atom; +- struct nouveau_encoder *outp = +- nv50_real_outp(nv50_head_atom_get_encoder(armh)); +- struct drm_encoder *encoder = &outp->base.base; ++ struct nouveau_encoder *outp; ++ struct drm_encoder *encoder, *enc; ++ ++ enc = nv50_head_atom_get_encoder(armh); ++ if (!enc) ++ continue; ++ ++ outp = nv50_real_outp(enc); ++ if (!outp) ++ continue; ++ ++ encoder = &outp->base.base; + + if (!asyh->clr.crc) + continue; +@@ -443,8 +452,16 @@ void nv50_crc_atomic_set(struct nv50_hea + struct drm_device *dev = crtc->dev; + struct nv50_crc *crc = &head->crc; + const struct nv50_crc_func *func = nv50_disp(dev)->core->func->crc; +- struct nouveau_encoder *outp = +- nv50_real_outp(nv50_head_atom_get_encoder(asyh)); ++ struct nouveau_encoder *outp; ++ struct drm_encoder *encoder; ++ ++ encoder = nv50_head_atom_get_encoder(asyh); ++ if (!encoder) ++ return; ++ ++ outp = nv50_real_outp(encoder); ++ if (!outp) ++ return; + + func->set_src(head, outp->or, nv50_crc_source_type(outp, asyh->crc.src), + &crc->ctx[crc->ctx_idx]); diff --git a/queue-5.17/drm-nouveau-subdev-bus-ratelimit-logging-for-fault-errors.patch b/queue-5.17/drm-nouveau-subdev-bus-ratelimit-logging-for-fault-errors.patch new file mode 100644 index 00000000000..2039d1dee93 --- /dev/null +++ b/queue-5.17/drm-nouveau-subdev-bus-ratelimit-logging-for-fault-errors.patch @@ -0,0 +1,95 @@ +From 9887bda0c831df0c044d6de147d002e48024fb4a Mon Sep 17 00:00:00 2001 +From: Lyude Paul +Date: Fri, 29 Apr 2022 15:53:47 -0400 +Subject: drm/nouveau/subdev/bus: Ratelimit logging for fault errors + +From: Lyude Paul + +commit 9887bda0c831df0c044d6de147d002e48024fb4a upstream. + +There's plenty of ways to fudge the GPU when developing on nouveau by +mistake, some of which can result in nouveau seriously spamming dmesg with +fault errors. This can be somewhat annoying, as it can quickly overrun the +message buffer (or your terminal emulator's buffer) and get rid of actually +useful feedback from the driver. While working on my new atomic only MST +branch, I ran into this issue a couple of times. + +So, let's fix this by adding nvkm_error_ratelimited(), and using it to +ratelimit errors from faults. This should be fine for developers, since +it's nearly always only the first few faults that we care about seeing. +Plus, you can turn off rate limiting in the kernel if you really need to. + +Signed-off-by: Lyude Paul +Reviewed-by: Karol Herbst +Cc: stable@vger.kernel.org +Link: https://patchwork.freedesktop.org/patch/msgid/20220429195350.85620-1-lyude@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/include/nvkm/core/subdev.h | 2 ++ + drivers/gpu/drm/nouveau/nvkm/subdev/bus/gf100.c | 14 +++++++------- + drivers/gpu/drm/nouveau/nvkm/subdev/bus/nv31.c | 6 +++--- + drivers/gpu/drm/nouveau/nvkm/subdev/bus/nv50.c | 6 +++--- + 4 files changed, 15 insertions(+), 13 deletions(-) + +--- a/drivers/gpu/drm/nouveau/include/nvkm/core/subdev.h ++++ b/drivers/gpu/drm/nouveau/include/nvkm/core/subdev.h +@@ -62,4 +62,6 @@ void nvkm_subdev_intr(struct nvkm_subdev + #define nvkm_debug(s,f,a...) nvkm_printk((s), DEBUG, info, f, ##a) + #define nvkm_trace(s,f,a...) nvkm_printk((s), TRACE, info, f, ##a) + #define nvkm_spam(s,f,a...) nvkm_printk((s), SPAM, dbg, f, ##a) ++ ++#define nvkm_error_ratelimited(s,f,a...) nvkm_printk((s), ERROR, err_ratelimited, f, ##a) + #endif +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bus/gf100.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bus/gf100.c +@@ -35,13 +35,13 @@ gf100_bus_intr(struct nvkm_bus *bus) + u32 addr = nvkm_rd32(device, 0x009084); + u32 data = nvkm_rd32(device, 0x009088); + +- nvkm_error(subdev, +- "MMIO %s of %08x FAULT at %06x [ %s%s%s]\n", +- (addr & 0x00000002) ? "write" : "read", data, +- (addr & 0x00fffffc), +- (stat & 0x00000002) ? "!ENGINE " : "", +- (stat & 0x00000004) ? "PRIVRING " : "", +- (stat & 0x00000008) ? "TIMEOUT " : ""); ++ nvkm_error_ratelimited(subdev, ++ "MMIO %s of %08x FAULT at %06x [ %s%s%s]\n", ++ (addr & 0x00000002) ? "write" : "read", data, ++ (addr & 0x00fffffc), ++ (stat & 0x00000002) ? "!ENGINE " : "", ++ (stat & 0x00000004) ? "PRIVRING " : "", ++ (stat & 0x00000008) ? "TIMEOUT " : ""); + + nvkm_wr32(device, 0x009084, 0x00000000); + nvkm_wr32(device, 0x001100, (stat & 0x0000000e)); +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bus/nv31.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bus/nv31.c +@@ -45,9 +45,9 @@ nv31_bus_intr(struct nvkm_bus *bus) + u32 addr = nvkm_rd32(device, 0x009084); + u32 data = nvkm_rd32(device, 0x009088); + +- nvkm_error(subdev, "MMIO %s of %08x FAULT at %06x\n", +- (addr & 0x00000002) ? "write" : "read", data, +- (addr & 0x00fffffc)); ++ nvkm_error_ratelimited(subdev, "MMIO %s of %08x FAULT at %06x\n", ++ (addr & 0x00000002) ? "write" : "read", data, ++ (addr & 0x00fffffc)); + + stat &= ~0x00000008; + nvkm_wr32(device, 0x001100, 0x00000008); +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bus/nv50.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bus/nv50.c +@@ -60,9 +60,9 @@ nv50_bus_intr(struct nvkm_bus *bus) + u32 addr = nvkm_rd32(device, 0x009084); + u32 data = nvkm_rd32(device, 0x009088); + +- nvkm_error(subdev, "MMIO %s of %08x FAULT at %06x\n", +- (addr & 0x00000002) ? "write" : "read", data, +- (addr & 0x00fffffc)); ++ nvkm_error_ratelimited(subdev, "MMIO %s of %08x FAULT at %06x\n", ++ (addr & 0x00000002) ? "write" : "read", data, ++ (addr & 0x00fffffc)); + + stat &= ~0x00000008; + nvkm_wr32(device, 0x001100, 0x00000008); diff --git a/queue-5.17/md-fix-an-incorrect-null-check-in-does_sb_need_changing.patch b/queue-5.17/md-fix-an-incorrect-null-check-in-does_sb_need_changing.patch new file mode 100644 index 00000000000..55dbd7eee98 --- /dev/null +++ b/queue-5.17/md-fix-an-incorrect-null-check-in-does_sb_need_changing.patch @@ -0,0 +1,55 @@ +From fc8738343eefc4ea8afb6122826dea48eacde514 Mon Sep 17 00:00:00 2001 +From: Xiaomeng Tong +Date: Fri, 8 Apr 2022 16:37:28 +0800 +Subject: md: fix an incorrect NULL check in does_sb_need_changing + +From: Xiaomeng Tong + +commit fc8738343eefc4ea8afb6122826dea48eacde514 upstream. + +The bug is here: + if (!rdev) + +The list iterator value 'rdev' will *always* be set and non-NULL +by rdev_for_each(), so it is incorrect to assume that the iterator +value will be NULL if the list is empty or no element found. +Otherwise it will bypass the NULL check and lead to invalid memory +access passing the check. + +To fix the bug, use a new variable 'iter' as the list iterator, +while using the original variable 'rdev' as a dedicated pointer to +point to the found element. + +Cc: stable@vger.kernel.org +Fixes: 2aa82191ac36 ("md-cluster: Perform a lazy update") +Acked-by: Guoqing Jiang +Signed-off-by: Xiaomeng Tong +Acked-by: Goldwyn Rodrigues +Signed-off-by: Song Liu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/md.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -2629,14 +2629,16 @@ static void sync_sbs(struct mddev *mddev + + static bool does_sb_need_changing(struct mddev *mddev) + { +- struct md_rdev *rdev; ++ struct md_rdev *rdev = NULL, *iter; + struct mdp_superblock_1 *sb; + int role; + + /* Find a good rdev */ +- rdev_for_each(rdev, mddev) +- if ((rdev->raid_disk >= 0) && !test_bit(Faulty, &rdev->flags)) ++ rdev_for_each(iter, mddev) ++ if ((iter->raid_disk >= 0) && !test_bit(Faulty, &iter->flags)) { ++ rdev = iter; + break; ++ } + + /* No good device found. */ + if (!rdev) diff --git a/queue-5.17/md-fix-an-incorrect-null-check-in-md_reload_sb.patch b/queue-5.17/md-fix-an-incorrect-null-check-in-md_reload_sb.patch new file mode 100644 index 00000000000..c8a169cdbd3 --- /dev/null +++ b/queue-5.17/md-fix-an-incorrect-null-check-in-md_reload_sb.patch @@ -0,0 +1,57 @@ +From 64c54d9244a4efe9bc6e9c98e13c4bbb8bb39083 Mon Sep 17 00:00:00 2001 +From: Xiaomeng Tong +Date: Fri, 8 Apr 2022 16:47:15 +0800 +Subject: md: fix an incorrect NULL check in md_reload_sb + +From: Xiaomeng Tong + +commit 64c54d9244a4efe9bc6e9c98e13c4bbb8bb39083 upstream. + +The bug is here: + if (!rdev || rdev->desc_nr != nr) { + +The list iterator value 'rdev' will *always* be set and non-NULL +by rdev_for_each_rcu(), so it is incorrect to assume that the +iterator value will be NULL if the list is empty or no element +found (In fact, it will be a bogus pointer to an invalid struct +object containing the HEAD). Otherwise it will bypass the check +and lead to invalid memory access passing the check. + +To fix the bug, use a new variable 'iter' as the list iterator, +while using the original variable 'pdev' as a dedicated pointer to +point to the found element. + +Cc: stable@vger.kernel.org +Fixes: 70bcecdb1534 ("md-cluster: Improve md_reload_sb to be less error prone") +Signed-off-by: Xiaomeng Tong +Signed-off-by: Song Liu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/md.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -9794,16 +9794,18 @@ static int read_rdev(struct mddev *mddev + + void md_reload_sb(struct mddev *mddev, int nr) + { +- struct md_rdev *rdev; ++ struct md_rdev *rdev = NULL, *iter; + int err; + + /* Find the rdev */ +- rdev_for_each_rcu(rdev, mddev) { +- if (rdev->desc_nr == nr) ++ rdev_for_each_rcu(iter, mddev) { ++ if (iter->desc_nr == nr) { ++ rdev = iter; + break; ++ } + } + +- if (!rdev || rdev->desc_nr != nr) { ++ if (!rdev) { + pr_warn("%s: %d Could not find rdev with nr %d\n", __func__, __LINE__, nr); + return; + } diff --git a/queue-5.17/media-coda-add-more-h264-levels-for-coda960.patch b/queue-5.17/media-coda-add-more-h264-levels-for-coda960.patch new file mode 100644 index 00000000000..2a82c795fd5 --- /dev/null +++ b/queue-5.17/media-coda-add-more-h264-levels-for-coda960.patch @@ -0,0 +1,51 @@ +From eb2fd187abc878a2dfad46902becb74963473c7d Mon Sep 17 00:00:00 2001 +From: Nicolas Dufresne +Date: Wed, 6 Apr 2022 21:23:43 +0100 +Subject: media: coda: Add more H264 levels for CODA960 + +From: Nicolas Dufresne + +commit eb2fd187abc878a2dfad46902becb74963473c7d upstream. + +Add H264 level 1.0, 4.1, 4.2 to the list of supported formats. +While the hardware does not fully support these levels, it does support +most of them. The constraints on frame size and pixel formats already +cover the limitation. + +This fixes negotiation of level on GStreamer 1.17.1. + +Cc: stable@vger.kernel.org +Fixes: 42a68012e67c2 ("media: coda: add read-only h.264 decoder profile/level controls") +Suggested-by: Philipp Zabel +Signed-off-by: Nicolas Dufresne +Signed-off-by: Ezequiel Garcia +Signed-off-by: Fabio Estevam +Reviewed-by: Philipp Zabel +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/coda/coda-common.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/media/platform/coda/coda-common.c ++++ b/drivers/media/platform/coda/coda-common.c +@@ -2367,12 +2367,15 @@ static void coda_encode_ctrls(struct cod + if (ctx->dev->devtype->product == CODA_960) { + v4l2_ctrl_new_std_menu(&ctx->ctrls, &coda_ctrl_ops, + V4L2_CID_MPEG_VIDEO_H264_LEVEL, +- V4L2_MPEG_VIDEO_H264_LEVEL_4_0, +- ~((1 << V4L2_MPEG_VIDEO_H264_LEVEL_2_0) | ++ V4L2_MPEG_VIDEO_H264_LEVEL_4_2, ++ ~((1 << V4L2_MPEG_VIDEO_H264_LEVEL_1_0) | ++ (1 << V4L2_MPEG_VIDEO_H264_LEVEL_2_0) | + (1 << V4L2_MPEG_VIDEO_H264_LEVEL_3_0) | + (1 << V4L2_MPEG_VIDEO_H264_LEVEL_3_1) | + (1 << V4L2_MPEG_VIDEO_H264_LEVEL_3_2) | +- (1 << V4L2_MPEG_VIDEO_H264_LEVEL_4_0)), ++ (1 << V4L2_MPEG_VIDEO_H264_LEVEL_4_0) | ++ (1 << V4L2_MPEG_VIDEO_H264_LEVEL_4_1) | ++ (1 << V4L2_MPEG_VIDEO_H264_LEVEL_4_2)), + V4L2_MPEG_VIDEO_H264_LEVEL_4_0); + } + v4l2_ctrl_new_std(&ctx->ctrls, &coda_ctrl_ops, diff --git a/queue-5.17/media-coda-fix-reported-h264-profile.patch b/queue-5.17/media-coda-fix-reported-h264-profile.patch new file mode 100644 index 00000000000..f188265f844 --- /dev/null +++ b/queue-5.17/media-coda-fix-reported-h264-profile.patch @@ -0,0 +1,56 @@ +From 7110c08ea71953a7fc342f0b76046f72442cf26c Mon Sep 17 00:00:00 2001 +From: Nicolas Dufresne +Date: Wed, 6 Apr 2022 21:23:42 +0100 +Subject: media: coda: Fix reported H264 profile + +From: Nicolas Dufresne + +commit 7110c08ea71953a7fc342f0b76046f72442cf26c upstream. + +The CODA960 manual states that ASO/FMO features of baseline are not +supported, so for this reason this driver should only report +constrained baseline support. + +This fixes negotiation issue with constrained baseline content +on GStreamer 1.17.1. + +ASO/FMO features are unsupported for the encoder and untested for the +decoder because there is currently no userspace support. Neither GStreamer +parsers nor FFMPEG parsers support ASO/FMO. + +Cc: stable@vger.kernel.org +Fixes: 42a68012e67c2 ("media: coda: add read-only h.264 decoder profile/level controls") +Signed-off-by: Nicolas Dufresne +Signed-off-by: Ezequiel Garcia +Tested-by: Pascal Speck +Signed-off-by: Fabio Estevam +Reviewed-by: Philipp Zabel +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/coda/coda-common.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/media/platform/coda/coda-common.c ++++ b/drivers/media/platform/coda/coda-common.c +@@ -2352,8 +2352,8 @@ static void coda_encode_ctrls(struct cod + V4L2_CID_MPEG_VIDEO_H264_CHROMA_QP_INDEX_OFFSET, -12, 12, 1, 0); + v4l2_ctrl_new_std_menu(&ctx->ctrls, &coda_ctrl_ops, + V4L2_CID_MPEG_VIDEO_H264_PROFILE, +- V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE, 0x0, +- V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE); ++ V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE, 0x0, ++ V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE); + if (ctx->dev->devtype->product == CODA_HX4 || + ctx->dev->devtype->product == CODA_7541) { + v4l2_ctrl_new_std_menu(&ctx->ctrls, &coda_ctrl_ops, +@@ -2434,7 +2434,7 @@ static void coda_decode_ctrls(struct cod + ctx->h264_profile_ctrl = v4l2_ctrl_new_std_menu(&ctx->ctrls, + &coda_ctrl_ops, V4L2_CID_MPEG_VIDEO_H264_PROFILE, + V4L2_MPEG_VIDEO_H264_PROFILE_HIGH, +- ~((1 << V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE) | ++ ~((1 << V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE) | + (1 << V4L2_MPEG_VIDEO_H264_PROFILE_MAIN) | + (1 << V4L2_MPEG_VIDEO_H264_PROFILE_HIGH)), + V4L2_MPEG_VIDEO_H264_PROFILE_HIGH); diff --git a/queue-5.17/mtd-cfi_cmdset_0002-move-and-rename-chip_check-chip_ready-chip_good_for_write.patch b/queue-5.17/mtd-cfi_cmdset_0002-move-and-rename-chip_check-chip_ready-chip_good_for_write.patch new file mode 100644 index 00000000000..e7a525d532b --- /dev/null +++ b/queue-5.17/mtd-cfi_cmdset_0002-move-and-rename-chip_check-chip_ready-chip_good_for_write.patch @@ -0,0 +1,269 @@ +From 083084df578a8bdb18334f69e7b32d690aaa3247 Mon Sep 17 00:00:00 2001 +From: Tokunori Ikegami +Date: Thu, 24 Mar 2022 02:04:55 +0900 +Subject: mtd: cfi_cmdset_0002: Move and rename chip_check/chip_ready/chip_good_for_write + +From: Tokunori Ikegami + +commit 083084df578a8bdb18334f69e7b32d690aaa3247 upstream. + +This is a preparation patch for the S29GL064N buffer writes fix. There +is no functional change. + +Link: https://lore.kernel.org/r/b687c259-6413-26c9-d4c9-b3afa69ea124@pengutronix.de/ +Fixes: dfeae1073583("mtd: cfi_cmdset_0002: Change write buffer to check correct value") +Signed-off-by: Tokunori Ikegami +Cc: stable@vger.kernel.org +Acked-by: Vignesh Raghavendra +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220323170458.5608-2-ikegami.t@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/chips/cfi_cmdset_0002.c | 95 ++++++++++++------------------------ + 1 file changed, 32 insertions(+), 63 deletions(-) + +--- a/drivers/mtd/chips/cfi_cmdset_0002.c ++++ b/drivers/mtd/chips/cfi_cmdset_0002.c +@@ -802,21 +802,25 @@ static struct mtd_info *cfi_amdstd_setup + } + + /* +- * Return true if the chip is ready. ++ * Return true if the chip is ready and has the correct value. + * + * Ready is one of: read mode, query mode, erase-suspend-read mode (in any + * non-suspended sector) and is indicated by no toggle bits toggling. + * ++ * Error are indicated by toggling bits or bits held with the wrong value, ++ * or with bits toggling. ++ * + * Note that anything more complicated than checking if no bits are toggling + * (including checking DQ5 for an error status) is tricky to get working + * correctly and is therefore not done (particularly with interleaved chips + * as each chip must be checked independently of the others). + */ + static int __xipram chip_ready(struct map_info *map, struct flchip *chip, +- unsigned long addr) ++ unsigned long addr, map_word *expected) + { + struct cfi_private *cfi = map->fldrv_priv; + map_word d, t; ++ int ret; + + if (cfi_use_status_reg(cfi)) { + map_word ready = CMD(CFI_SR_DRB); +@@ -826,57 +830,20 @@ static int __xipram chip_ready(struct ma + */ + cfi_send_gen_cmd(0x70, cfi->addr_unlock1, chip->start, map, cfi, + cfi->device_type, NULL); +- d = map_read(map, addr); ++ t = map_read(map, addr); + +- return map_word_andequal(map, d, ready, ready); ++ return map_word_andequal(map, t, ready, ready); + } + + d = map_read(map, addr); + t = map_read(map, addr); + +- return map_word_equal(map, d, t); +-} +- +-/* +- * Return true if the chip is ready and has the correct value. +- * +- * Ready is one of: read mode, query mode, erase-suspend-read mode (in any +- * non-suspended sector) and it is indicated by no bits toggling. +- * +- * Error are indicated by toggling bits or bits held with the wrong value, +- * or with bits toggling. +- * +- * Note that anything more complicated than checking if no bits are toggling +- * (including checking DQ5 for an error status) is tricky to get working +- * correctly and is therefore not done (particularly with interleaved chips +- * as each chip must be checked independently of the others). +- * +- */ +-static int __xipram chip_good(struct map_info *map, struct flchip *chip, +- unsigned long addr, map_word expected) +-{ +- struct cfi_private *cfi = map->fldrv_priv; +- map_word oldd, curd; +- +- if (cfi_use_status_reg(cfi)) { +- map_word ready = CMD(CFI_SR_DRB); +- +- /* +- * For chips that support status register, check device +- * ready bit +- */ +- cfi_send_gen_cmd(0x70, cfi->addr_unlock1, chip->start, map, cfi, +- cfi->device_type, NULL); +- curd = map_read(map, addr); +- +- return map_word_andequal(map, curd, ready, ready); +- } ++ ret = map_word_equal(map, d, t); + +- oldd = map_read(map, addr); +- curd = map_read(map, addr); ++ if (!ret || !expected) ++ return ret; + +- return map_word_equal(map, oldd, curd) && +- map_word_equal(map, curd, expected); ++ return map_word_equal(map, t, *expected); + } + + static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr, int mode) +@@ -893,7 +860,7 @@ static int get_chip(struct map_info *map + + case FL_STATUS: + for (;;) { +- if (chip_ready(map, chip, adr)) ++ if (chip_ready(map, chip, adr, NULL)) + break; + + if (time_after(jiffies, timeo)) { +@@ -932,7 +899,7 @@ static int get_chip(struct map_info *map + chip->state = FL_ERASE_SUSPENDING; + chip->erase_suspended = 1; + for (;;) { +- if (chip_ready(map, chip, adr)) ++ if (chip_ready(map, chip, adr, NULL)) + break; + + if (time_after(jiffies, timeo)) { +@@ -1463,7 +1430,7 @@ static int do_otp_lock(struct map_info * + /* wait for chip to become ready */ + timeo = jiffies + msecs_to_jiffies(2); + for (;;) { +- if (chip_ready(map, chip, adr)) ++ if (chip_ready(map, chip, adr, NULL)) + break; + + if (time_after(jiffies, timeo)) { +@@ -1695,11 +1662,11 @@ static int __xipram do_write_oneword_onc + } + + /* +- * We check "time_after" and "!chip_good" before checking +- * "chip_good" to avoid the failure due to scheduling. ++ * We check "time_after" and "!chip_ready" before checking ++ * "chip_ready" to avoid the failure due to scheduling. + */ + if (time_after(jiffies, timeo) && +- !chip_good(map, chip, adr, datum)) { ++ !chip_ready(map, chip, adr, &datum)) { + xip_enable(map, chip, adr); + printk(KERN_WARNING "MTD %s(): software timeout\n", __func__); + xip_disable(map, chip, adr); +@@ -1707,7 +1674,7 @@ static int __xipram do_write_oneword_onc + break; + } + +- if (chip_good(map, chip, adr, datum)) { ++ if (chip_ready(map, chip, adr, &datum)) { + if (cfi_check_err_status(map, chip, adr)) + ret = -EIO; + break; +@@ -1975,18 +1942,18 @@ static int __xipram do_write_buffer_wait + } + + /* +- * We check "time_after" and "!chip_good" before checking +- * "chip_good" to avoid the failure due to scheduling. ++ * We check "time_after" and "!chip_ready" before checking ++ * "chip_ready" to avoid the failure due to scheduling. + */ + if (time_after(jiffies, timeo) && +- !chip_good(map, chip, adr, datum)) { ++ !chip_ready(map, chip, adr, &datum)) { + pr_err("MTD %s(): software timeout, address:0x%.8lx.\n", + __func__, adr); + ret = -EIO; + break; + } + +- if (chip_good(map, chip, adr, datum)) { ++ if (chip_ready(map, chip, adr, &datum)) { + if (cfi_check_err_status(map, chip, adr)) + ret = -EIO; + break; +@@ -2195,7 +2162,7 @@ static int cfi_amdstd_panic_wait(struct + * If the driver thinks the chip is idle, and no toggle bits + * are changing, then the chip is actually idle for sure. + */ +- if (chip->state == FL_READY && chip_ready(map, chip, adr)) ++ if (chip->state == FL_READY && chip_ready(map, chip, adr, NULL)) + return 0; + + /* +@@ -2212,7 +2179,7 @@ static int cfi_amdstd_panic_wait(struct + + /* wait for the chip to become ready */ + for (i = 0; i < jiffies_to_usecs(timeo); i++) { +- if (chip_ready(map, chip, adr)) ++ if (chip_ready(map, chip, adr, NULL)) + return 0; + + udelay(1); +@@ -2276,13 +2243,13 @@ retry: + map_write(map, datum, adr); + + for (i = 0; i < jiffies_to_usecs(uWriteTimeout); i++) { +- if (chip_ready(map, chip, adr)) ++ if (chip_ready(map, chip, adr, NULL)) + break; + + udelay(1); + } + +- if (!chip_good(map, chip, adr, datum) || ++ if (!chip_ready(map, chip, adr, &datum) || + cfi_check_err_status(map, chip, adr)) { + /* reset on all failures. */ + map_write(map, CMD(0xF0), chip->start); +@@ -2424,6 +2391,7 @@ static int __xipram do_erase_chip(struct + DECLARE_WAITQUEUE(wait, current); + int ret; + int retry_cnt = 0; ++ map_word datum = map_word_ff(map); + + adr = cfi->addr_unlock1; + +@@ -2478,7 +2446,7 @@ static int __xipram do_erase_chip(struct + chip->erase_suspended = 0; + } + +- if (chip_good(map, chip, adr, map_word_ff(map))) { ++ if (chip_ready(map, chip, adr, &datum)) { + if (cfi_check_err_status(map, chip, adr)) + ret = -EIO; + break; +@@ -2523,6 +2491,7 @@ static int __xipram do_erase_oneblock(st + DECLARE_WAITQUEUE(wait, current); + int ret; + int retry_cnt = 0; ++ map_word datum = map_word_ff(map); + + adr += chip->start; + +@@ -2577,7 +2546,7 @@ static int __xipram do_erase_oneblock(st + chip->erase_suspended = 0; + } + +- if (chip_good(map, chip, adr, map_word_ff(map))) { ++ if (chip_ready(map, chip, adr, &datum)) { + if (cfi_check_err_status(map, chip, adr)) + ret = -EIO; + break; +@@ -2771,7 +2740,7 @@ static int __maybe_unused do_ppb_xxlock( + */ + timeo = jiffies + msecs_to_jiffies(2000); /* 2s max (un)locking */ + for (;;) { +- if (chip_ready(map, chip, adr)) ++ if (chip_ready(map, chip, adr, NULL)) + break; + + if (time_after(jiffies, timeo)) { diff --git a/queue-5.17/mtd-cfi_cmdset_0002-use-chip_ready-for-write-on-s29gl064n.patch b/queue-5.17/mtd-cfi_cmdset_0002-use-chip_ready-for-write-on-s29gl064n.patch new file mode 100644 index 00000000000..45cd0933500 --- /dev/null +++ b/queue-5.17/mtd-cfi_cmdset_0002-use-chip_ready-for-write-on-s29gl064n.patch @@ -0,0 +1,143 @@ +From 0a8e98305f63deaf0a799d5cf5532cc83af035d1 Mon Sep 17 00:00:00 2001 +From: Tokunori Ikegami +Date: Thu, 24 Mar 2022 02:04:56 +0900 +Subject: mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N + +From: Tokunori Ikegami + +commit 0a8e98305f63deaf0a799d5cf5532cc83af035d1 upstream. + +Since commit dfeae1073583("mtd: cfi_cmdset_0002: Change write buffer to +check correct value") buffered writes fail on S29GL064N. This is +because, on S29GL064N, reads return 0xFF at the end of DQ polling for +write completion, where as, chip_good() check expects actual data +written to the last location to be returned post DQ polling completion. +Fix is to revert to using chip_good() for S29GL064N which only checks +for DQ lines to settle down to determine write completion. + +Link: https://lore.kernel.org/r/b687c259-6413-26c9-d4c9-b3afa69ea124@pengutronix.de/ +Fixes: dfeae1073583("mtd: cfi_cmdset_0002: Change write buffer to check correct value") +Cc: stable@vger.kernel.org +Signed-off-by: Tokunori Ikegami +Acked-by: Vignesh Raghavendra +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220323170458.5608-3-ikegami.t@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/chips/cfi_cmdset_0002.c | 42 +++++++++++++++++++++++++++++------- + include/linux/mtd/cfi.h | 1 + 2 files changed, 35 insertions(+), 8 deletions(-) + +--- a/drivers/mtd/chips/cfi_cmdset_0002.c ++++ b/drivers/mtd/chips/cfi_cmdset_0002.c +@@ -59,6 +59,10 @@ + #define CFI_SR_WBASB BIT(3) + #define CFI_SR_SLSB BIT(1) + ++enum cfi_quirks { ++ CFI_QUIRK_DQ_TRUE_DATA = BIT(0), ++}; ++ + static int cfi_amdstd_read (struct mtd_info *, loff_t, size_t, size_t *, u_char *); + static int cfi_amdstd_write_words(struct mtd_info *, loff_t, size_t, size_t *, const u_char *); + #if !FORCE_WORD_WRITE +@@ -436,6 +440,15 @@ static void fixup_s29ns512p_sectors(stru + mtd->name); + } + ++static void fixup_quirks(struct mtd_info *mtd) ++{ ++ struct map_info *map = mtd->priv; ++ struct cfi_private *cfi = map->fldrv_priv; ++ ++ if (cfi->mfr == CFI_MFR_AMD && cfi->id == 0x0c01) ++ cfi->quirks |= CFI_QUIRK_DQ_TRUE_DATA; ++} ++ + /* Used to fix CFI-Tables of chips without Extended Query Tables */ + static struct cfi_fixup cfi_nopri_fixup_table[] = { + { CFI_MFR_SST, 0x234a, fixup_sst39vf }, /* SST39VF1602 */ +@@ -474,6 +487,7 @@ static struct cfi_fixup cfi_fixup_table[ + #if !FORCE_WORD_WRITE + { CFI_MFR_ANY, CFI_ID_ANY, fixup_use_write_buffers }, + #endif ++ { CFI_MFR_ANY, CFI_ID_ANY, fixup_quirks }, + { 0, 0, NULL } + }; + static struct cfi_fixup jedec_fixup_table[] = { +@@ -846,6 +860,18 @@ static int __xipram chip_ready(struct ma + return map_word_equal(map, t, *expected); + } + ++static int __xipram chip_good(struct map_info *map, struct flchip *chip, ++ unsigned long addr, map_word *expected) ++{ ++ struct cfi_private *cfi = map->fldrv_priv; ++ map_word *datum = expected; ++ ++ if (cfi->quirks & CFI_QUIRK_DQ_TRUE_DATA) ++ datum = NULL; ++ ++ return chip_ready(map, chip, addr, datum); ++} ++ + static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr, int mode) + { + DECLARE_WAITQUEUE(wait, current); +@@ -1662,11 +1688,11 @@ static int __xipram do_write_oneword_onc + } + + /* +- * We check "time_after" and "!chip_ready" before checking +- * "chip_ready" to avoid the failure due to scheduling. ++ * We check "time_after" and "!chip_good" before checking ++ * "chip_good" to avoid the failure due to scheduling. + */ + if (time_after(jiffies, timeo) && +- !chip_ready(map, chip, adr, &datum)) { ++ !chip_good(map, chip, adr, &datum)) { + xip_enable(map, chip, adr); + printk(KERN_WARNING "MTD %s(): software timeout\n", __func__); + xip_disable(map, chip, adr); +@@ -1674,7 +1700,7 @@ static int __xipram do_write_oneword_onc + break; + } + +- if (chip_ready(map, chip, adr, &datum)) { ++ if (chip_good(map, chip, adr, &datum)) { + if (cfi_check_err_status(map, chip, adr)) + ret = -EIO; + break; +@@ -1942,18 +1968,18 @@ static int __xipram do_write_buffer_wait + } + + /* +- * We check "time_after" and "!chip_ready" before checking +- * "chip_ready" to avoid the failure due to scheduling. ++ * We check "time_after" and "!chip_good" before checking ++ * "chip_good" to avoid the failure due to scheduling. + */ + if (time_after(jiffies, timeo) && +- !chip_ready(map, chip, adr, &datum)) { ++ !chip_good(map, chip, adr, &datum)) { + pr_err("MTD %s(): software timeout, address:0x%.8lx.\n", + __func__, adr); + ret = -EIO; + break; + } + +- if (chip_ready(map, chip, adr, &datum)) { ++ if (chip_good(map, chip, adr, &datum)) { + if (cfi_check_err_status(map, chip, adr)) + ret = -EIO; + break; +--- a/include/linux/mtd/cfi.h ++++ b/include/linux/mtd/cfi.h +@@ -286,6 +286,7 @@ struct cfi_private { + map_word sector_erase_cmd; + unsigned long chipshift; /* Because they're of the same type */ + const char *im_name; /* inter_module name for cmdset_setup */ ++ unsigned long quirks; + struct flchip chips[]; /* per-chip data structure for each chip */ + }; + diff --git a/queue-5.17/series b/queue-5.17/series index 0b239085a43..da6c8c0e2a2 100644 --- a/queue-5.17/series +++ b/queue-5.17/series @@ -687,3 +687,16 @@ landlock-define-access_mask_t-to-enforce-a-consistent-access-mask-size.patch landlock-reduce-the-maximum-number-of-layers-to-16.patch landlock-create-find_rule-from-unmask_layers.patch landlock-fix-same-layer-rule-unions.patch +drm-amdgpu-cs-make-commands-with-0-chunks-illegal-behaviour.patch +drm-nouveau-subdev-bus-ratelimit-logging-for-fault-errors.patch +drm-etnaviv-check-for-reaped-mapping-in-etnaviv_iommu_unmap_gem.patch +drm-nouveau-clk-fix-an-incorrect-null-check-on-list-iterator.patch +drm-nouveau-kms-nv50-atom-fix-an-incorrect-null-check-on-list-iterator.patch +drm-bridge-analogix_dp-grab-runtime-pm-reference-for-dp-aux.patch +drm-i915-dsi-fix-vbt-send-packet-port-selection-for-icl.patch +md-fix-an-incorrect-null-check-in-does_sb_need_changing.patch +md-fix-an-incorrect-null-check-in-md_reload_sb.patch +mtd-cfi_cmdset_0002-move-and-rename-chip_check-chip_ready-chip_good_for_write.patch +mtd-cfi_cmdset_0002-use-chip_ready-for-write-on-s29gl064n.patch +media-coda-fix-reported-h264-profile.patch +media-coda-add-more-h264-levels-for-coda960.patch