--- /dev/null
+From 9b73ce41a9157680291e3d134fabf588a5ec8eb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Sep 2022 10:53:18 +0200
+Subject: drm/msm/hdmi: fix IRQ lifetime
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 152d394842bb564148e68b92486a87db0bf54859 ]
+
+Device-managed resources allocated post component bind must be tied to
+the lifetime of the aggregate DRM device or they will not necessarily be
+released when binding of the aggregate device is deferred.
+
+This is specifically true for the HDMI IRQ, which will otherwise remain
+requested so that the next bind attempt fails when requesting the IRQ a
+second time.
+
+Fix this by tying the device-managed lifetime of the HDMI IRQ to the DRM
+device so that it is released when bind fails.
+
+Fixes: 067fef372c73 ("drm/msm/hdmi: refactor bind/init")
+Cc: stable@vger.kernel.org # 3.19
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Tested-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Reviewed-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/502666/
+Link: https://lore.kernel.org/r/20220913085320.8577-9-johan+linaro@kernel.org
+Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/hdmi/hdmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c
+index 0b756e84d393..f6b09e8eca67 100644
+--- a/drivers/gpu/drm/msm/hdmi/hdmi.c
++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c
+@@ -330,7 +330,7 @@ int msm_hdmi_modeset_init(struct hdmi *hdmi,
+ goto fail;
+ }
+
+- ret = devm_request_irq(&pdev->dev, hdmi->irq,
++ ret = devm_request_irq(dev->dev, hdmi->irq,
+ msm_hdmi_irq, IRQF_TRIGGER_HIGH,
+ "hdmi_isr", hdmi);
+ if (ret < 0) {
+--
+2.35.1
+
--- /dev/null
+From 8f46c2aaadb2bb9a7aead1c2d505ddd22167450f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Feb 2022 17:47:33 +0000
+Subject: drm/msm/hdmi: Remove spurious IRQF_ONESHOT flag
+
+From: Daniel Thompson <daniel.thompson@linaro.org>
+
+[ Upstream commit 088604d37e23e9ec01a501d0e3630bc4f02027a0 ]
+
+Quoting the header comments, IRQF_ONESHOT is "Used by threaded interrupts
+which need to keep the irq line disabled until the threaded handler has
+been run.". When applied to an interrupt that doesn't request a threaded
+irq then IRQF_ONESHOT has a lesser known (undocumented?) side effect,
+which it to disable the forced threading of irqs. For "normal" kernels
+if there is no thread_fn then IRQF_ONESHOT is a nop.
+
+In this case disabling forced threading is not appropriate because the
+driver calls wake_up_all() (via msm_hdmi_i2c_irq) and also directly uses
+the regular spinlock API for locking (in msm_hdmi_hdcp_irq() ). Neither
+of these APIs can be called from no-thread interrupt handlers on
+PREEMPT_RT systems.
+
+Fix this by removing IRQF_ONESHOT.
+
+Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20220201174734.196718-3-daniel.thompson@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Stable-dep-of: 152d394842bb ("drm/msm/hdmi: fix IRQ lifetime")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/hdmi/hdmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c
+index e082e01b5e8d..0b756e84d393 100644
+--- a/drivers/gpu/drm/msm/hdmi/hdmi.c
++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c
+@@ -331,7 +331,7 @@ int msm_hdmi_modeset_init(struct hdmi *hdmi,
+ }
+
+ ret = devm_request_irq(&pdev->dev, hdmi->irq,
+- msm_hdmi_irq, IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
++ msm_hdmi_irq, IRQF_TRIGGER_HIGH,
+ "hdmi_isr", hdmi);
+ if (ret < 0) {
+ DRM_DEV_ERROR(dev->dev, "failed to request IRQ%u: %d\n",
+--
+2.35.1
+
--- /dev/null
+From ec41e8fb431f7470bb09c29062282e676bec1012 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Oct 2022 20:01:17 +0200
+Subject: fbdev: stifb: Fall back to cfb_fillrect() on 32-bit HCRX cards
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit 776d875fd4cbb3884860ea7f63c3958f02b0c80e ]
+
+When the text console is scrolling text upwards it calls the fillrect()
+function to empty the new line. The current implementation doesn't seem
+to work correctly on HCRX cards in 32-bit mode and leave garbage in that
+line instead. Fix it by falling back to standard cfb_fillrect() in that
+case.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/stifb.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/stifb.c b/drivers/video/fbdev/stifb.c
+index 7753e586e65a..3feb6e40d56d 100644
+--- a/drivers/video/fbdev/stifb.c
++++ b/drivers/video/fbdev/stifb.c
+@@ -1055,7 +1055,8 @@ stifb_fillrect(struct fb_info *info, const struct fb_fillrect *rect)
+ {
+ struct stifb_info *fb = container_of(info, struct stifb_info, info);
+
+- if (rect->rop != ROP_COPY)
++ if (rect->rop != ROP_COPY ||
++ (fb->id == S9000_ID_HCRX && fb->info.var.bits_per_pixel == 32))
+ return cfb_fillrect(info, rect);
+
+ SETUP_HW(fb);
+--
+2.35.1
+
--- /dev/null
+From 3dfdf77e2e1d1fca79cda91d25811a4051bc66d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Oct 2022 11:11:29 +0200
+Subject: mtd: parsers: bcm47xxpart: Fix halfblock reads
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 05e258c6ec669d6d18c494ea03d35962d6f5b545 ]
+
+There is some code in the parser that tries to read 0x8000
+bytes into a block to "read in the middle" of the block. Well
+that only works if the block is also 0x10000 bytes all the time,
+else we get these parse errors as we reach the end of the flash:
+
+spi-nor spi0.0: mx25l1606e (2048 Kbytes)
+mtd_read error while parsing (offset: 0x200000): -22
+mtd_read error while parsing (offset: 0x201000): -22
+(...)
+
+Fix the code to do what I think was intended.
+
+Cc: stable@vger.kernel.org
+Fixes: f0501e81fbaa ("mtd: bcm47xxpart: alternative MAGIC for board_data partition")
+Cc: Rafał Miłecki <zajec5@gmail.com>
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20221018091129.280026-1-linus.walleij@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/parsers/bcm47xxpart.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mtd/parsers/bcm47xxpart.c b/drivers/mtd/parsers/bcm47xxpart.c
+index 50fcf4c2174b..13daf9bffd08 100644
+--- a/drivers/mtd/parsers/bcm47xxpart.c
++++ b/drivers/mtd/parsers/bcm47xxpart.c
+@@ -233,11 +233,11 @@ static int bcm47xxpart_parse(struct mtd_info *master,
+ }
+
+ /* Read middle of the block */
+- err = mtd_read(master, offset + 0x8000, 0x4, &bytes_read,
++ err = mtd_read(master, offset + (blocksize / 2), 0x4, &bytes_read,
+ (uint8_t *)buf);
+ if (err && !mtd_is_bitflip(err)) {
+ pr_err("mtd_read error while parsing (offset: 0x%X): %d\n",
+- offset + 0x8000, err);
++ offset + (blocksize / 2), err);
+ continue;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From b7ff8adffa5fc9a91778a1e946c720e047bbb7ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Mar 2022 12:43:16 +0100
+Subject: mtd: parsers: bcm47xxpart: print correct offset on read error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 4c38eded807043f40f4dc49da6df097f9dcac393 ]
+
+mtd_read() gets called with offset + 0x8000 as argument so use the same
+value in pr_err().
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220317114316.29827-1-zajec5@gmail.com
+Stable-dep-of: 05e258c6ec66 ("mtd: parsers: bcm47xxpart: Fix halfblock reads")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/parsers/bcm47xxpart.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/parsers/bcm47xxpart.c b/drivers/mtd/parsers/bcm47xxpart.c
+index 6012a10f10c8..50fcf4c2174b 100644
+--- a/drivers/mtd/parsers/bcm47xxpart.c
++++ b/drivers/mtd/parsers/bcm47xxpart.c
+@@ -237,7 +237,7 @@ static int bcm47xxpart_parse(struct mtd_info *master,
+ (uint8_t *)buf);
+ if (err && !mtd_is_bitflip(err)) {
+ pr_err("mtd_read error while parsing (offset: 0x%X): %d\n",
+- offset, err);
++ offset + 0x8000, err);
+ continue;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From e9d17c7a72af99c77113fdcaecf329cc967729b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Sep 2022 15:01:36 +0200
+Subject: s390/boot: add secure boot trailer
+
+From: Peter Oberparleiter <oberpar@linux.ibm.com>
+
+[ Upstream commit aa127a069ef312aca02b730d5137e1778d0c3ba7 ]
+
+This patch enhances the kernel image adding a trailer as required for
+secure boot by future firmware versions.
+
+Cc: <stable@vger.kernel.org> # 5.2+
+Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Reviewed-by: Sven Schnelle <svens@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/boot/compressed/vmlinux.lds.S | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/boot/compressed/vmlinux.lds.S b/arch/s390/boot/compressed/vmlinux.lds.S
+index 918e05137d4c..1686a852534f 100644
+--- a/arch/s390/boot/compressed/vmlinux.lds.S
++++ b/arch/s390/boot/compressed/vmlinux.lds.S
+@@ -93,8 +93,17 @@ SECTIONS
+ _compressed_start = .;
+ *(.vmlinux.bin.compressed)
+ _compressed_end = .;
+- FILL(0xff);
+- . = ALIGN(4096);
++ }
++
++#define SB_TRAILER_SIZE 32
++ /* Trailer needed for Secure Boot */
++ . += SB_TRAILER_SIZE; /* make sure .sb.trailer does not overwrite the previous section */
++ . = ALIGN(4096) - SB_TRAILER_SIZE;
++ .sb.trailer : {
++ QUAD(0)
++ QUAD(0)
++ QUAD(0)
++ QUAD(0x000000207a49504c)
+ }
+ _end = .;
+
+--
+2.35.1
+
--- /dev/null
+From 6fef76b403845a2cac730de8e4874d693c4b5c0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Sep 2021 15:04:01 +0200
+Subject: s390/cio: derive cdev information only for IO-subchannels
+
+From: Vineeth Vijayan <vneethv@linux.ibm.com>
+
+[ Upstream commit 0c3812c347bfb0dc213556a195e79850c55702f5 ]
+
+cdev->online for the purge function must not be checked for the
+non-IO subchannel type. Make sure that we are deriving the cdev only
+from sch-type SUBCHANNEL_TYPE_IO.
+
+Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
+Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Stable-dep-of: 1b6074112742 ("s390/cio: fix out-of-bounds access on cio_ignore free")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/cio/css.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
+index c27809792609..ce9e7517430f 100644
+--- a/drivers/s390/cio/css.c
++++ b/drivers/s390/cio/css.c
+@@ -792,10 +792,13 @@ static int __unset_online(struct device *dev, void *data)
+ {
+ struct idset *set = data;
+ struct subchannel *sch = to_subchannel(dev);
+- struct ccw_device *cdev = sch_get_cdev(sch);
++ struct ccw_device *cdev;
+
+- if (cdev && cdev->online)
+- idset_sch_del(set, sch->schid);
++ if (sch->st == SUBCHANNEL_TYPE_IO) {
++ cdev = sch_get_cdev(sch);
++ if (cdev && cdev->online)
++ idset_sch_del(set, sch->schid);
++ }
+
+ return 0;
+ }
+--
+2.35.1
+
--- /dev/null
+From bfbf966318d4d292b6d891f5fdec10e4648a54d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Oct 2022 12:24:58 +0200
+Subject: s390/cio: fix out-of-bounds access on cio_ignore free
+
+From: Peter Oberparleiter <oberpar@linux.ibm.com>
+
+[ Upstream commit 1b6074112742f65ece71b0f299ca5a6a887d2db6 ]
+
+The channel-subsystem-driver scans for newly available devices whenever
+device-IDs are removed from the cio_ignore list using a command such as:
+
+ echo free >/proc/cio_ignore
+
+Since an I/O device scan might interfer with running I/Os, commit
+172da89ed0ea ("s390/cio: avoid excessive path-verification requests")
+introduced an optimization to exclude online devices from the scan.
+
+The newly added check for online devices incorrectly assumes that
+an I/O-subchannel's drvdata points to a struct io_subchannel_private.
+For devices that are bound to a non-default I/O subchannel driver, such
+as the vfio_ccw driver, this results in an out-of-bounds read access
+during each scan.
+
+Fix this by changing the scan logic to rely on a driver-independent
+online indication. For this we can use struct subchannel->config.ena,
+which is the driver's requested subchannel-enabled state. Since I/Os
+can only be started on enabled subchannels, this matches the intent
+of the original optimization of not scanning devices where I/O might
+be running.
+
+Fixes: 172da89ed0ea ("s390/cio: avoid excessive path-verification requests")
+Fixes: 0c3812c347bf ("s390/cio: derive cdev information only for IO-subchannels")
+Cc: <stable@vger.kernel.org> # v5.15
+Reported-by: Alexander Egorenkov <egorenar@linux.ibm.com>
+Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
+Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/cio/css.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
+index ce9e7517430f..2ba9e0135565 100644
+--- a/drivers/s390/cio/css.c
++++ b/drivers/s390/cio/css.c
+@@ -792,13 +792,9 @@ static int __unset_online(struct device *dev, void *data)
+ {
+ struct idset *set = data;
+ struct subchannel *sch = to_subchannel(dev);
+- struct ccw_device *cdev;
+
+- if (sch->st == SUBCHANNEL_TYPE_IO) {
+- cdev = sch_get_cdev(sch);
+- if (cdev && cdev->online)
+- idset_sch_del(set, sch->schid);
+- }
++ if (sch->st == SUBCHANNEL_TYPE_IO && sch->config.ena)
++ idset_sch_del(set, sch->schid);
+
+ return 0;
+ }
+--
+2.35.1
+
--- /dev/null
+From c85c5ecf9947b9b151b76ca72aceb587498f7dff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Oct 2022 13:39:43 +0200
+Subject: s390/uaccess: add missing EX_TABLE entries to __clear_user()
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit 4e1b5a86a5edfbefc9396d41b0fc1a2ebd0101b6 ]
+
+For some exception types the instruction address points behind the
+instruction that caused the exception. Take that into account and add
+the missing exception table entries.
+
+Cc: <stable@vger.kernel.org>
+Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/lib/uaccess.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/s390/lib/uaccess.c b/arch/s390/lib/uaccess.c
+index a596e69d3c47..0b012ce0921c 100644
+--- a/arch/s390/lib/uaccess.c
++++ b/arch/s390/lib/uaccess.c
+@@ -212,7 +212,7 @@ static inline unsigned long clear_user_mvcos(void __user *to, unsigned long size
+ asm volatile(
+ " llilh 0,%[spec]\n"
+ "0: .insn ss,0xc80000000000,0(%0,%1),0(%4),0\n"
+- " jz 4f\n"
++ "6: jz 4f\n"
+ "1: algr %0,%2\n"
+ " slgr %1,%2\n"
+ " j 0b\n"
+@@ -222,11 +222,11 @@ static inline unsigned long clear_user_mvcos(void __user *to, unsigned long size
+ " clgr %0,%3\n" /* copy crosses next page boundary? */
+ " jnh 5f\n"
+ "3: .insn ss,0xc80000000000,0(%3,%1),0(%4),0\n"
+- " slgr %0,%3\n"
++ "7: slgr %0,%3\n"
+ " j 5f\n"
+ "4: slgr %0,%0\n"
+ "5:\n"
+- EX_TABLE(0b,2b) EX_TABLE(3b,5b)
++ EX_TABLE(0b,2b) EX_TABLE(6b,2b) EX_TABLE(3b,5b) EX_TABLE(7b,5b)
+ : "+a" (size), "+a" (to), "+a" (tmp1), "=a" (tmp2)
+ : "a" (empty_zero_page), [spec] "K" (0x81UL)
+ : "cc", "memory", "0");
+--
+2.35.1
+
net-neigh-fix-null-ptr-deref-in-neigh_table_clear.patch
ipv6-fix-warning-in-ip6_route_net_exit_late.patch
vsock-fix-possible-infinite-sleep-in-vsock_connectib.patch
+drm-msm-hdmi-remove-spurious-irqf_oneshot-flag.patch
+drm-msm-hdmi-fix-irq-lifetime.patch
+video-fbdev-stifb-implement-the-stifb_fillrect-funct.patch
+fbdev-stifb-fall-back-to-cfb_fillrect-on-32-bit-hcrx.patch
+mtd-parsers-bcm47xxpart-print-correct-offset-on-read.patch
+mtd-parsers-bcm47xxpart-fix-halfblock-reads.patch
+s390-uaccess-add-missing-ex_table-entries-to-__clear.patch
+s390-boot-add-secure-boot-trailer.patch
+s390-cio-derive-cdev-information-only-for-io-subchan.patch
+s390-cio-fix-out-of-bounds-access-on-cio_ignore-free.patch
--- /dev/null
+From ed8c5d6677c231cdb6d441a3cf957a550deb6a74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Jan 2022 16:35:53 +0100
+Subject: video/fbdev/stifb: Implement the stifb_fillrect() function
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit 9c379c65241707e44072139d782bc2dfec9b4ab3 ]
+
+The stifb driver (for Artist/HCRX graphics on PA-RISC) was missing
+the fillrect function.
+Tested on a 715/64 PA-RISC machine and in qemu.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Stable-dep-of: 776d875fd4cb ("fbdev: stifb: Fall back to cfb_fillrect() on 32-bit HCRX cards")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/stifb.c | 45 +++++++++++++++++++++++++++++++++++--
+ 1 file changed, 43 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/video/fbdev/stifb.c b/drivers/video/fbdev/stifb.c
+index b0470f4f595e..7753e586e65a 100644
+--- a/drivers/video/fbdev/stifb.c
++++ b/drivers/video/fbdev/stifb.c
+@@ -1041,6 +1041,47 @@ stifb_copyarea(struct fb_info *info, const struct fb_copyarea *area)
+ SETUP_FB(fb);
+ }
+
++#define ARTIST_VRAM_SIZE 0x000804
++#define ARTIST_VRAM_SRC 0x000808
++#define ARTIST_VRAM_SIZE_TRIGGER_WINFILL 0x000a04
++#define ARTIST_VRAM_DEST_TRIGGER_BLOCKMOVE 0x000b00
++#define ARTIST_SRC_BM_ACCESS 0x018008
++#define ARTIST_FGCOLOR 0x018010
++#define ARTIST_BGCOLOR 0x018014
++#define ARTIST_BITMAP_OP 0x01801c
++
++static void
++stifb_fillrect(struct fb_info *info, const struct fb_fillrect *rect)
++{
++ struct stifb_info *fb = container_of(info, struct stifb_info, info);
++
++ if (rect->rop != ROP_COPY)
++ return cfb_fillrect(info, rect);
++
++ SETUP_HW(fb);
++
++ if (fb->info.var.bits_per_pixel == 32) {
++ WRITE_WORD(0xBBA0A000, fb, REG_10);
++
++ NGLE_REALLY_SET_IMAGE_PLANEMASK(fb, 0xffffffff);
++ } else {
++ WRITE_WORD(fb->id == S9000_ID_HCRX ? 0x13a02000 : 0x13a01000, fb, REG_10);
++
++ NGLE_REALLY_SET_IMAGE_PLANEMASK(fb, 0xff);
++ }
++
++ WRITE_WORD(0x03000300, fb, ARTIST_BITMAP_OP);
++ WRITE_WORD(0x2ea01000, fb, ARTIST_SRC_BM_ACCESS);
++ NGLE_QUICK_SET_DST_BM_ACCESS(fb, 0x2ea01000);
++ NGLE_REALLY_SET_IMAGE_FG_COLOR(fb, rect->color);
++ WRITE_WORD(0, fb, ARTIST_BGCOLOR);
++
++ NGLE_SET_DSTXY(fb, (rect->dx << 16) | (rect->dy));
++ SET_LENXY_START_RECFILL(fb, (rect->width << 16) | (rect->height));
++
++ SETUP_FB(fb);
++}
++
+ static void __init
+ stifb_init_display(struct stifb_info *fb)
+ {
+@@ -1105,7 +1146,7 @@ static const struct fb_ops stifb_ops = {
+ .owner = THIS_MODULE,
+ .fb_setcolreg = stifb_setcolreg,
+ .fb_blank = stifb_blank,
+- .fb_fillrect = cfb_fillrect,
++ .fb_fillrect = stifb_fillrect,
+ .fb_copyarea = stifb_copyarea,
+ .fb_imageblit = cfb_imageblit,
+ };
+@@ -1297,7 +1338,7 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref)
+ goto out_err0;
+ }
+ info->screen_size = fix->smem_len;
+- info->flags = FBINFO_DEFAULT | FBINFO_HWACCEL_COPYAREA;
++ info->flags = FBINFO_HWACCEL_COPYAREA | FBINFO_HWACCEL_FILLRECT;
+ info->pseudo_palette = &fb->pseudo_palette;
+
+ /* This has to be done !!! */
+--
+2.35.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
