]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
Fixes for 6.6
authorSasha Levin <sashal@kernel.org>
Mon, 13 Nov 2023 04:28:49 +0000 (23:28 -0500)
committerSasha Levin <sashal@kernel.org>
Mon, 13 Nov 2023 04:28:49 +0000 (23:28 -0500)
Signed-off-by: Sasha Levin <sashal@kernel.org>
15 files changed:
queue-6.6/alsa-hda-realtek-add-support-dual-speaker-for-dell.patch [new file with mode: 0644]
queue-6.6/arm64-arm-arm_pmuv3-perf-don-t-truncate-64-bit-regis.patch [new file with mode: 0644]
queue-6.6/asoc-dapm-fix-clock-get-name.patch [new file with mode: 0644]
queue-6.6/asoc-hdmi-codec-register-hpd-callback-on-component-p.patch [new file with mode: 0644]
queue-6.6/asoc-mediatek-mt8186_mt6366_rt1019_rt5682s-trivial-f.patch [new file with mode: 0644]
queue-6.6/asoc-rt712-sdca-fix-speaker-route-missing-issue.patch [new file with mode: 0644]
queue-6.6/drm-syncobj-fix-drm_syncobj_wait_flags_wait_availabl.patch [new file with mode: 0644]
queue-6.6/drm-vc4-tests-fix-uaf-in-the-mock-helpers.patch [new file with mode: 0644]
queue-6.6/fbdev-fsl-diu-fb-mark-wr_reg_wa-static.patch [new file with mode: 0644]
queue-6.6/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch [new file with mode: 0644]
queue-6.6/fbdev-imsttfb-fix-double-free-in-probe.patch [new file with mode: 0644]
queue-6.6/fbdev-omapfb-drop-unused-remove-function.patch [new file with mode: 0644]
queue-6.6/series
queue-6.6/spi-spi-zynq-qspi-add-spi-mem-to-driver-kconfig-depe.patch [new file with mode: 0644]
queue-6.6/tracing-kprobes-fix-the-order-of-argument-descriptio.patch [new file with mode: 0644]

diff --git a/queue-6.6/alsa-hda-realtek-add-support-dual-speaker-for-dell.patch b/queue-6.6/alsa-hda-realtek-add-support-dual-speaker-for-dell.patch
new file mode 100644 (file)
index 0000000..58bdf71
--- /dev/null
@@ -0,0 +1,112 @@
+From 6606de9cc496d00f55163cd2eb8550d274b67a27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Nov 2023 15:45:00 +0800
+Subject: ALSA: hda/realtek: Add support dual speaker for Dell
+
+From: Kailang Yang <kailang@realtek.com>
+
+[ Upstream commit f0d9da19d7de9e845e7a93a901c4b9658df6b492 ]
+
+Dell new platform support dual speaker. But BIOS verb table only show one speaker.
+It will fill verb table for second speaker. Then bind with CS AMP model.
+
+Fixes: de90f5165b1c ("ALSA: hda/realtek: Add support for DELL Oasis 13/14/16 laptops")
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Link: https://lore.kernel.org/r/4dd390a77bf742b8a518ac2deee00b0f@realtek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 40 +++++++++++++++++++++++++++++------
+ 1 file changed, 33 insertions(+), 7 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 9677c09cf7a98..3ed2cba5ee8ad 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7262,8 +7262,10 @@ enum {
+       ALC256_FIXUP_ASUS_MIC_NO_PRESENCE,
+       ALC299_FIXUP_PREDATOR_SPK,
+       ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE,
++      ALC289_FIXUP_DELL_SPK1,
+       ALC289_FIXUP_DELL_SPK2,
+       ALC289_FIXUP_DUAL_SPK,
++      ALC289_FIXUP_RTK_AMP_DUAL_SPK,
+       ALC294_FIXUP_SPK2_TO_DAC1,
+       ALC294_FIXUP_ASUS_DUAL_SPK,
+       ALC285_FIXUP_THINKPAD_X1_GEN7,
+@@ -7363,6 +7365,7 @@ enum {
+       ALC287_FIXUP_THINKPAD_I2S_SPK,
+       ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD,
+       ALC2XX_FIXUP_HEADSET_MIC,
++      ALC289_FIXUP_DELL_CS35L41_SPI_2,
+ };
+ /* A special fixup for Lenovo C940 and Yoga Duet 7;
+@@ -8589,6 +8592,15 @@ static const struct hda_fixup alc269_fixups[] = {
+               .chained = true,
+               .chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE
+       },
++      [ALC289_FIXUP_DELL_SPK1] = {
++              .type = HDA_FIXUP_PINS,
++              .v.pins = (const struct hda_pintbl[]) {
++                      { 0x14, 0x90170140 },
++                      { }
++              },
++              .chained = true,
++              .chain_id = ALC269_FIXUP_DELL4_MIC_NO_PRESENCE
++      },
+       [ALC289_FIXUP_DELL_SPK2] = {
+               .type = HDA_FIXUP_PINS,
+               .v.pins = (const struct hda_pintbl[]) {
+@@ -8604,6 +8616,12 @@ static const struct hda_fixup alc269_fixups[] = {
+               .chained = true,
+               .chain_id = ALC289_FIXUP_DELL_SPK2
+       },
++      [ALC289_FIXUP_RTK_AMP_DUAL_SPK] = {
++              .type = HDA_FIXUP_FUNC,
++              .v.func = alc285_fixup_speaker2_to_dac1,
++              .chained = true,
++              .chain_id = ALC289_FIXUP_DELL_SPK1
++      },
+       [ALC294_FIXUP_SPK2_TO_DAC1] = {
+               .type = HDA_FIXUP_FUNC,
+               .v.func = alc285_fixup_speaker2_to_dac1,
+@@ -9471,6 +9489,12 @@ static const struct hda_fixup alc269_fixups[] = {
+               .type = HDA_FIXUP_FUNC,
+               .v.func = alc_fixup_headset_mic,
+       },
++      [ALC289_FIXUP_DELL_CS35L41_SPI_2] = {
++              .type = HDA_FIXUP_FUNC,
++              .v.func = cs35l41_fixup_spi_two,
++              .chained = true,
++              .chain_id = ALC289_FIXUP_DUAL_SPK
++      },
+ };
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -9581,13 +9605,15 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+       SND_PCI_QUIRK(0x1028, 0x0c1c, "Dell Precision 3540", ALC236_FIXUP_DELL_DUAL_CODECS),
+       SND_PCI_QUIRK(0x1028, 0x0c1d, "Dell Precision 3440", ALC236_FIXUP_DELL_DUAL_CODECS),
+       SND_PCI_QUIRK(0x1028, 0x0c1e, "Dell Precision 3540", ALC236_FIXUP_DELL_DUAL_CODECS),
+-      SND_PCI_QUIRK(0x1028, 0x0cbd, "Dell Oasis 13 CS MTL-U", ALC245_FIXUP_CS35L41_SPI_2),
+-      SND_PCI_QUIRK(0x1028, 0x0cbe, "Dell Oasis 13 2-IN-1 MTL-U", ALC245_FIXUP_CS35L41_SPI_2),
+-      SND_PCI_QUIRK(0x1028, 0x0cbf, "Dell Oasis 13 Low Weight MTU-L", ALC245_FIXUP_CS35L41_SPI_2),
+-      SND_PCI_QUIRK(0x1028, 0x0cc1, "Dell Oasis 14 MTL-H/U", ALC245_FIXUP_CS35L41_SPI_2),
+-      SND_PCI_QUIRK(0x1028, 0x0cc2, "Dell Oasis 14 2-in-1 MTL-H/U", ALC245_FIXUP_CS35L41_SPI_2),
+-      SND_PCI_QUIRK(0x1028, 0x0cc3, "Dell Oasis 14 Low Weight MTL-U", ALC245_FIXUP_CS35L41_SPI_2),
+-      SND_PCI_QUIRK(0x1028, 0x0cc4, "Dell Oasis 16 MTL-H/U", ALC245_FIXUP_CS35L41_SPI_2),
++      SND_PCI_QUIRK(0x1028, 0x0cbd, "Dell Oasis 13 CS MTL-U", ALC289_FIXUP_DELL_CS35L41_SPI_2),
++      SND_PCI_QUIRK(0x1028, 0x0cbe, "Dell Oasis 13 2-IN-1 MTL-U", ALC289_FIXUP_DELL_CS35L41_SPI_2),
++      SND_PCI_QUIRK(0x1028, 0x0cbf, "Dell Oasis 13 Low Weight MTU-L", ALC289_FIXUP_DELL_CS35L41_SPI_2),
++      SND_PCI_QUIRK(0x1028, 0x0cc0, "Dell Oasis 13", ALC289_FIXUP_RTK_AMP_DUAL_SPK),
++      SND_PCI_QUIRK(0x1028, 0x0cc1, "Dell Oasis 14 MTL-H/U", ALC289_FIXUP_DELL_CS35L41_SPI_2),
++      SND_PCI_QUIRK(0x1028, 0x0cc2, "Dell Oasis 14 2-in-1 MTL-H/U", ALC289_FIXUP_DELL_CS35L41_SPI_2),
++      SND_PCI_QUIRK(0x1028, 0x0cc3, "Dell Oasis 14 Low Weight MTL-U", ALC289_FIXUP_DELL_CS35L41_SPI_2),
++      SND_PCI_QUIRK(0x1028, 0x0cc4, "Dell Oasis 16 MTL-H/U", ALC289_FIXUP_DELL_CS35L41_SPI_2),
++      SND_PCI_QUIRK(0x1028, 0x0cc5, "Dell Oasis 14", ALC289_FIXUP_RTK_AMP_DUAL_SPK),
+       SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+       SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+       SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
+-- 
+2.42.0
+
diff --git a/queue-6.6/arm64-arm-arm_pmuv3-perf-don-t-truncate-64-bit-regis.patch b/queue-6.6/arm64-arm-arm_pmuv3-perf-don-t-truncate-64-bit-regis.patch
new file mode 100644 (file)
index 0000000..0c9bd5a
--- /dev/null
@@ -0,0 +1,215 @@
+From 616b3d1c5ebcce0dbe9bf97c469b4319daaf2520 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Nov 2023 11:30:12 -0700
+Subject: arm64/arm: arm_pmuv3: perf: Don't truncate 64-bit registers
+
+From: Ilkka Koskinen <ilkka@os.amperecomputing.com>
+
+[ Upstream commit 403edfa436286b21f5ffe6856ae5b36396e8966c ]
+
+The driver used to truncate several 64-bit registers such as PMCEID[n]
+registers used to describe whether architectural and microarchitectural
+events in range 0x4000-0x401f exist. Due to discarding the bits, the
+driver made the events invisible, even if they existed.
+
+Moreover, PMCCFILTR and PMCR registers have additional bits in the upper
+32 bits. This patch makes them available although they aren't currently
+used. Finally, functions handling PMXEVCNTR and PMXEVTYPER registers are
+removed as they not being used at all.
+
+Fixes: df29ddf4f04b ("arm64: perf: Abstract system register accesses away")
+Reported-by: Carl Worth <carl@os.amperecomputing.com>
+Signed-off-by: Ilkka Koskinen <ilkka@os.amperecomputing.com>
+Acked-by: Will Deacon <will@kernel.org>
+Closes: https://lore.kernel.org/..
+Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
+Link: https://lore.kernel.org/r/20231102183012.1251410-1-ilkka@os.amperecomputing.com
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/arm_pmuv3.h   | 48 ++++++++++++++----------------
+ arch/arm64/include/asm/arm_pmuv3.h | 25 ++++------------
+ drivers/perf/arm_pmuv3.c           |  6 ++--
+ 3 files changed, 31 insertions(+), 48 deletions(-)
+
+diff --git a/arch/arm/include/asm/arm_pmuv3.h b/arch/arm/include/asm/arm_pmuv3.h
+index 72529f5e2bed9..a41b503b7dcde 100644
+--- a/arch/arm/include/asm/arm_pmuv3.h
++++ b/arch/arm/include/asm/arm_pmuv3.h
+@@ -23,6 +23,8 @@
+ #define PMUSERENR             __ACCESS_CP15(c9,  0, c14, 0)
+ #define PMINTENSET            __ACCESS_CP15(c9,  0, c14, 1)
+ #define PMINTENCLR            __ACCESS_CP15(c9,  0, c14, 2)
++#define PMCEID2                       __ACCESS_CP15(c9,  0, c14, 4)
++#define PMCEID3                       __ACCESS_CP15(c9,  0, c14, 5)
+ #define PMMIR                 __ACCESS_CP15(c9,  0, c14, 6)
+ #define PMCCFILTR             __ACCESS_CP15(c14, 0, c15, 7)
+@@ -150,21 +152,6 @@ static inline u64 read_pmccntr(void)
+       return read_sysreg(PMCCNTR);
+ }
+-static inline void write_pmxevcntr(u32 val)
+-{
+-      write_sysreg(val, PMXEVCNTR);
+-}
+-
+-static inline u32 read_pmxevcntr(void)
+-{
+-      return read_sysreg(PMXEVCNTR);
+-}
+-
+-static inline void write_pmxevtyper(u32 val)
+-{
+-      write_sysreg(val, PMXEVTYPER);
+-}
+-
+ static inline void write_pmcntenset(u32 val)
+ {
+       write_sysreg(val, PMCNTENSET);
+@@ -205,16 +192,6 @@ static inline void write_pmuserenr(u32 val)
+       write_sysreg(val, PMUSERENR);
+ }
+-static inline u32 read_pmceid0(void)
+-{
+-      return read_sysreg(PMCEID0);
+-}
+-
+-static inline u32 read_pmceid1(void)
+-{
+-      return read_sysreg(PMCEID1);
+-}
+-
+ static inline void kvm_set_pmu_events(u32 set, struct perf_event_attr *attr) {}
+ static inline void kvm_clr_pmu_events(u32 clr) {}
+ static inline bool kvm_pmu_counter_deferred(struct perf_event_attr *attr)
+@@ -231,6 +208,7 @@ static inline void kvm_vcpu_pmu_resync_el0(void) {}
+ /* PMU Version in DFR Register */
+ #define ARMV8_PMU_DFR_VER_NI        0
++#define ARMV8_PMU_DFR_VER_V3P1      0x4
+ #define ARMV8_PMU_DFR_VER_V3P4      0x5
+ #define ARMV8_PMU_DFR_VER_V3P5      0x6
+ #define ARMV8_PMU_DFR_VER_IMP_DEF   0xF
+@@ -251,4 +229,24 @@ static inline bool is_pmuv3p5(int pmuver)
+       return pmuver >= ARMV8_PMU_DFR_VER_V3P5;
+ }
++static inline u64 read_pmceid0(void)
++{
++      u64 val = read_sysreg(PMCEID0);
++
++      if (read_pmuver() >= ARMV8_PMU_DFR_VER_V3P1)
++              val |= (u64)read_sysreg(PMCEID2) << 32;
++
++      return val;
++}
++
++static inline u64 read_pmceid1(void)
++{
++      u64 val = read_sysreg(PMCEID1);
++
++      if (read_pmuver() >= ARMV8_PMU_DFR_VER_V3P1)
++              val |= (u64)read_sysreg(PMCEID3) << 32;
++
++      return val;
++}
++
+ #endif
+diff --git a/arch/arm64/include/asm/arm_pmuv3.h b/arch/arm64/include/asm/arm_pmuv3.h
+index 18dc2fb3d7b7b..c27404fa4418a 100644
+--- a/arch/arm64/include/asm/arm_pmuv3.h
++++ b/arch/arm64/include/asm/arm_pmuv3.h
+@@ -46,12 +46,12 @@ static inline u32 read_pmuver(void)
+                       ID_AA64DFR0_EL1_PMUVer_SHIFT);
+ }
+-static inline void write_pmcr(u32 val)
++static inline void write_pmcr(u64 val)
+ {
+       write_sysreg(val, pmcr_el0);
+ }
+-static inline u32 read_pmcr(void)
++static inline u64 read_pmcr(void)
+ {
+       return read_sysreg(pmcr_el0);
+ }
+@@ -71,21 +71,6 @@ static inline u64 read_pmccntr(void)
+       return read_sysreg(pmccntr_el0);
+ }
+-static inline void write_pmxevcntr(u32 val)
+-{
+-      write_sysreg(val, pmxevcntr_el0);
+-}
+-
+-static inline u32 read_pmxevcntr(void)
+-{
+-      return read_sysreg(pmxevcntr_el0);
+-}
+-
+-static inline void write_pmxevtyper(u32 val)
+-{
+-      write_sysreg(val, pmxevtyper_el0);
+-}
+-
+ static inline void write_pmcntenset(u32 val)
+ {
+       write_sysreg(val, pmcntenset_el0);
+@@ -106,7 +91,7 @@ static inline void write_pmintenclr(u32 val)
+       write_sysreg(val, pmintenclr_el1);
+ }
+-static inline void write_pmccfiltr(u32 val)
++static inline void write_pmccfiltr(u64 val)
+ {
+       write_sysreg(val, pmccfiltr_el0);
+ }
+@@ -126,12 +111,12 @@ static inline void write_pmuserenr(u32 val)
+       write_sysreg(val, pmuserenr_el0);
+ }
+-static inline u32 read_pmceid0(void)
++static inline u64 read_pmceid0(void)
+ {
+       return read_sysreg(pmceid0_el0);
+ }
+-static inline u32 read_pmceid1(void)
++static inline u64 read_pmceid1(void)
+ {
+       return read_sysreg(pmceid1_el0);
+ }
+diff --git a/drivers/perf/arm_pmuv3.c b/drivers/perf/arm_pmuv3.c
+index 8fcaa26f0f8a6..d681638ec6b82 100644
+--- a/drivers/perf/arm_pmuv3.c
++++ b/drivers/perf/arm_pmuv3.c
+@@ -428,12 +428,12 @@ static inline bool armv8pmu_event_is_chained(struct perf_event *event)
+ #define       ARMV8_IDX_TO_COUNTER(x) \
+       (((x) - ARMV8_IDX_COUNTER0) & ARMV8_PMU_COUNTER_MASK)
+-static inline u32 armv8pmu_pmcr_read(void)
++static inline u64 armv8pmu_pmcr_read(void)
+ {
+       return read_pmcr();
+ }
+-static inline void armv8pmu_pmcr_write(u32 val)
++static inline void armv8pmu_pmcr_write(u64 val)
+ {
+       val &= ARMV8_PMU_PMCR_MASK;
+       isb();
+@@ -957,7 +957,7 @@ static int armv8pmu_set_event_filter(struct hw_perf_event *event,
+ static void armv8pmu_reset(void *info)
+ {
+       struct arm_pmu *cpu_pmu = (struct arm_pmu *)info;
+-      u32 pmcr;
++      u64 pmcr;
+       /* The counter and interrupt enable registers are unknown at reset. */
+       armv8pmu_disable_counter(U32_MAX);
+-- 
+2.42.0
+
diff --git a/queue-6.6/asoc-dapm-fix-clock-get-name.patch b/queue-6.6/asoc-dapm-fix-clock-get-name.patch
new file mode 100644 (file)
index 0000000..6f35a89
--- /dev/null
@@ -0,0 +1,37 @@
+From 7edbc669280a04dded30b5436a03829598e6f8d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 11:37:09 +0100
+Subject: ASoC: dapm: fix clock get name
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 4bdcbc31ad2112385ad525b28972c45015e6ad70 ]
+
+The name currently used to get the clock includes the dapm prefix.
+It should use the name as provided to the widget, without the prefix.
+
+Fixes: 3caac759681e ("ASoC: soc-dapm.c: fixup snd_soc_dapm_new_control_unlocked() error handling")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20231106103712.703962-1-jbrunet@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-dapm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 312e555798315..85e3bbf7e5f0e 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -3670,7 +3670,7 @@ snd_soc_dapm_new_control_unlocked(struct snd_soc_dapm_context *dapm,
+               dapm_pinctrl_event(w, NULL, SND_SOC_DAPM_POST_PMD);
+               break;
+       case snd_soc_dapm_clock_supply:
+-              w->clk = devm_clk_get(dapm->dev, w->name);
++              w->clk = devm_clk_get(dapm->dev, widget->name);
+               if (IS_ERR(w->clk)) {
+                       ret = PTR_ERR(w->clk);
+                       goto request_failed;
+-- 
+2.42.0
+
diff --git a/queue-6.6/asoc-hdmi-codec-register-hpd-callback-on-component-p.patch b/queue-6.6/asoc-hdmi-codec-register-hpd-callback-on-component-p.patch
new file mode 100644 (file)
index 0000000..d3e5863
--- /dev/null
@@ -0,0 +1,85 @@
+From dd0b5bfc09fddec3dafbc076191d688475c6031d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 11:40:11 +0100
+Subject: ASoC: hdmi-codec: register hpd callback on component probe
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 15be353d55f9e12e34f9a819f51eb41fdef5eda8 ]
+
+The HDMI hotplug callback to the hdmi-codec is currently registered when
+jack is set.
+
+The hotplug not only serves to report the ASoC jack state but also to get
+the ELD. It should be registered when the component probes instead, so it
+does not depend on the card driver registering a jack for the HDMI to
+properly report the ELD.
+
+Fixes: 25ce4f2b3593 ("ASoC: hdmi-codec: Get ELD in before reporting plugged event")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20231106104013.704356-1-jbrunet@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/hdmi-codec.c | 27 +++++++++++++++++++--------
+ 1 file changed, 19 insertions(+), 8 deletions(-)
+
+diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c
+index 09eef6042aad6..20da1eaa4f1c7 100644
+--- a/sound/soc/codecs/hdmi-codec.c
++++ b/sound/soc/codecs/hdmi-codec.c
+@@ -877,18 +877,13 @@ static int hdmi_codec_set_jack(struct snd_soc_component *component,
+                              void *data)
+ {
+       struct hdmi_codec_priv *hcp = snd_soc_component_get_drvdata(component);
+-      int ret = -ENOTSUPP;
+       if (hcp->hcd.ops->hook_plugged_cb) {
+               hcp->jack = jack;
+-              ret = hcp->hcd.ops->hook_plugged_cb(component->dev->parent,
+-                                                  hcp->hcd.data,
+-                                                  plugged_cb,
+-                                                  component->dev);
+-              if (ret)
+-                      hcp->jack = NULL;
++              return 0;
+       }
+-      return ret;
++
++      return -ENOTSUPP;
+ }
+ static int hdmi_dai_spdif_probe(struct snd_soc_dai *dai)
+@@ -982,6 +977,21 @@ static int hdmi_of_xlate_dai_id(struct snd_soc_component *component,
+       return ret;
+ }
++static int hdmi_probe(struct snd_soc_component *component)
++{
++      struct hdmi_codec_priv *hcp = snd_soc_component_get_drvdata(component);
++      int ret = 0;
++
++      if (hcp->hcd.ops->hook_plugged_cb) {
++              ret = hcp->hcd.ops->hook_plugged_cb(component->dev->parent,
++                                                  hcp->hcd.data,
++                                                  plugged_cb,
++                                                  component->dev);
++      }
++
++      return ret;
++}
++
+ static void hdmi_remove(struct snd_soc_component *component)
+ {
+       struct hdmi_codec_priv *hcp = snd_soc_component_get_drvdata(component);
+@@ -992,6 +1002,7 @@ static void hdmi_remove(struct snd_soc_component *component)
+ }
+ static const struct snd_soc_component_driver hdmi_driver = {
++      .probe                  = hdmi_probe,
+       .remove                 = hdmi_remove,
+       .dapm_widgets           = hdmi_widgets,
+       .num_dapm_widgets       = ARRAY_SIZE(hdmi_widgets),
+-- 
+2.42.0
+
diff --git a/queue-6.6/asoc-mediatek-mt8186_mt6366_rt1019_rt5682s-trivial-f.patch b/queue-6.6/asoc-mediatek-mt8186_mt6366_rt1019_rt5682s-trivial-f.patch
new file mode 100644 (file)
index 0000000..e738f24
--- /dev/null
@@ -0,0 +1,50 @@
+From 99ac767258e29d5303decad273316014d03e6f7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Oct 2023 12:31:39 +0200
+Subject: ASoC: mediatek: mt8186_mt6366_rt1019_rt5682s: trivial: fix error
+ messages
+
+From: Eugen Hristev <eugen.hristev@collabora.com>
+
+[ Upstream commit 004fc58edea6f00db9ad07b40b882e8d976f7a54 ]
+
+Property 'playback-codecs' is referenced as 'speaker-codec' in the error
+message, and this can lead to confusion.
+Correct the error message such that the correct property name is
+referenced.
+
+Fixes: 0da16e370dd7 ("ASoC: mediatek: mt8186: add machine driver with mt6366, rt1019 and rt5682s")
+Signed-off-by: Eugen Hristev <eugen.hristev@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20231031103139.77395-1-eugen.hristev@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/mediatek/mt8186/mt8186-mt6366-rt1019-rt5682s.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/mediatek/mt8186/mt8186-mt6366-rt1019-rt5682s.c b/sound/soc/mediatek/mt8186/mt8186-mt6366-rt1019-rt5682s.c
+index 9c11016f032c2..9777ba89e956c 100644
+--- a/sound/soc/mediatek/mt8186/mt8186-mt6366-rt1019-rt5682s.c
++++ b/sound/soc/mediatek/mt8186/mt8186-mt6366-rt1019-rt5682s.c
+@@ -1179,7 +1179,7 @@ static int mt8186_mt6366_rt1019_rt5682s_dev_probe(struct platform_device *pdev)
+       playback_codec = of_get_child_by_name(pdev->dev.of_node, "playback-codecs");
+       if (!playback_codec) {
+               ret = -EINVAL;
+-              dev_err_probe(&pdev->dev, ret, "Property 'speaker-codecs' missing or invalid\n");
++              dev_err_probe(&pdev->dev, ret, "Property 'playback-codecs' missing or invalid\n");
+               goto err_playback_codec;
+       }
+@@ -1193,7 +1193,7 @@ static int mt8186_mt6366_rt1019_rt5682s_dev_probe(struct platform_device *pdev)
+       for_each_card_prelinks(card, i, dai_link) {
+               ret = mt8186_mt6366_card_set_be_link(card, dai_link, playback_codec, "I2S3");
+               if (ret) {
+-                      dev_err_probe(&pdev->dev, ret, "%s set speaker_codec fail\n",
++                      dev_err_probe(&pdev->dev, ret, "%s set playback_codec fail\n",
+                                     dai_link->name);
+                       goto err_probe;
+               }
+-- 
+2.42.0
+
diff --git a/queue-6.6/asoc-rt712-sdca-fix-speaker-route-missing-issue.patch b/queue-6.6/asoc-rt712-sdca-fix-speaker-route-missing-issue.patch
new file mode 100644 (file)
index 0000000..4a0a325
--- /dev/null
@@ -0,0 +1,56 @@
+From 863fe3c97f315429839fd6dc791398a1801c2e4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Oct 2023 18:36:44 +0800
+Subject: ASoC: rt712-sdca: fix speaker route missing issue
+
+From: Shuming Fan <shumingf@realtek.com>
+
+[ Upstream commit 1a3b7eab8500a6b923f7b62cc8aa4d832c7dfb3e ]
+
+Sometimes the codec probe would be called earlier than the hardware initialization.
+Therefore, the speaker route should be added before the the first_hw_init check.
+
+Signed-off-by: Shuming Fan <shumingf@realtek.com>
+Fixes: f3da2ed110e2 ("ASoC: rt1712-sdca: enable pm_runtime in probe,  keep status as 'suspended'")?
+Link: https://lore.kernel.org/r/20231030103644.1787948-1-shumingf@realtek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt712-sdca.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/sound/soc/codecs/rt712-sdca.c b/sound/soc/codecs/rt712-sdca.c
+index 7077ff6ba1f4b..6954fbe7ec5f3 100644
+--- a/sound/soc/codecs/rt712-sdca.c
++++ b/sound/soc/codecs/rt712-sdca.c
+@@ -963,13 +963,6 @@ static int rt712_sdca_probe(struct snd_soc_component *component)
+       rt712_sdca_parse_dt(rt712, &rt712->slave->dev);
+       rt712->component = component;
+-      if (!rt712->first_hw_init)
+-              return 0;
+-
+-      ret = pm_runtime_resume(component->dev);
+-      if (ret < 0 && ret != -EACCES)
+-              return ret;
+-
+       /* add SPK route */
+       if (rt712->hw_id != RT712_DEV_ID_713) {
+               snd_soc_add_component_controls(component,
+@@ -980,6 +973,13 @@ static int rt712_sdca_probe(struct snd_soc_component *component)
+                       rt712_sdca_spk_dapm_routes, ARRAY_SIZE(rt712_sdca_spk_dapm_routes));
+       }
++      if (!rt712->first_hw_init)
++              return 0;
++
++      ret = pm_runtime_resume(component->dev);
++      if (ret < 0 && ret != -EACCES)
++              return ret;
++
+       return 0;
+ }
+-- 
+2.42.0
+
diff --git a/queue-6.6/drm-syncobj-fix-drm_syncobj_wait_flags_wait_availabl.patch b/queue-6.6/drm-syncobj-fix-drm_syncobj_wait_flags_wait_availabl.patch
new file mode 100644 (file)
index 0000000..c7205e3
--- /dev/null
@@ -0,0 +1,66 @@
+From bc0c99c7e2fbea90aac76f94cb3c89b2dbee6915 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Aug 2023 09:26:05 -0700
+Subject: drm/syncobj: fix DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE
+
+From: Erik Kurzinger <ekurzinger@nvidia.com>
+
+[ Upstream commit 101c9f637efa1655f55876644d4439e552267527 ]
+
+If DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT is invoked with the
+DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE flag set but no fence has yet been
+submitted for the given timeline point the call will fail immediately
+with EINVAL. This does not match the intended behavior where the call
+should wait until the fence has been submitted (or the timeout expires).
+
+The following small example program illustrates the issue. It should
+wait for 5 seconds and then print ETIME, but instead it terminates right
+away after printing EINVAL.
+
+  #include <stdio.h>
+  #include <fcntl.h>
+  #include <time.h>
+  #include <errno.h>
+  #include <xf86drm.h>
+  int main(void)
+  {
+      int fd = open("/dev/dri/card0", O_RDWR);
+      uint32_t syncobj;
+      drmSyncobjCreate(fd, 0, &syncobj);
+      struct timespec ts;
+      clock_gettime(CLOCK_MONOTONIC, &ts);
+      uint64_t point = 1;
+      if (drmSyncobjTimelineWait(fd, &syncobj, &point, 1,
+                                 ts.tv_sec * 1000000000 + ts.tv_nsec + 5000000000, // 5s
+                                 DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE, NULL)) {
+          printf("drmSyncobjTimelineWait failed %d\n", errno);
+      }
+  }
+
+Fixes: 01d6c3578379 ("drm/syncobj: add support for timeline point wait v8")
+Signed-off-by: Erik Kurzinger <ekurzinger@nvidia.com>
+Reviewed by: Simon Ser <contact@emersion.fd>
+Signed-off-by: Simon Ser <contact@emersion.fr>
+Link: https://patchwork.freedesktop.org/patch/msgid/1fac96f1-2f3f-f9f9-4eb0-340f27a8f6c0@nvidia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_syncobj.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
+index f7003d1ec5ef1..01da6789d0440 100644
+--- a/drivers/gpu/drm/drm_syncobj.c
++++ b/drivers/gpu/drm/drm_syncobj.c
+@@ -1069,7 +1069,8 @@ static signed long drm_syncobj_array_wait_timeout(struct drm_syncobj **syncobjs,
+               fence = drm_syncobj_fence_get(syncobjs[i]);
+               if (!fence || dma_fence_chain_find_seqno(&fence, points[i])) {
+                       dma_fence_put(fence);
+-                      if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT) {
++                      if (flags & (DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT |
++                                   DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE)) {
+                               continue;
+                       } else {
+                               timeout = -EINVAL;
+-- 
+2.42.0
+
diff --git a/queue-6.6/drm-vc4-tests-fix-uaf-in-the-mock-helpers.patch b/queue-6.6/drm-vc4-tests-fix-uaf-in-the-mock-helpers.patch
new file mode 100644 (file)
index 0000000..3af260a
--- /dev/null
@@ -0,0 +1,62 @@
+From fda4be8c859f397e277d6db7875c84e2e45f75f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Oct 2023 12:56:40 +0200
+Subject: drm/vc4: tests: Fix UAF in the mock helpers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maxime Ripard <mripard@kernel.org>
+
+[ Upstream commit cdcd6aef9db5797995d4153ea19fdf56d189f0e4 ]
+
+The VC4 mock helpers allocate the CRTC, encoders and connectors using a
+call to kunit_kzalloc(), but the DRM device they are attache to survives
+for longer than the test itself which leads to use-after-frees reported
+by KASAN.
+
+Switch to drmm_kzalloc to tie the lifetime of these objects to the main
+DRM device.
+
+Fixes: f759f5b53f1c ("drm/vc4: tests: Introduce a mocking infrastructure")
+Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
+Closes: https://lore.kernel.org/all/CA+G9fYvJA2HGqzR9LGgq63v0SKaUejHAE6f7+z9cwWN-ourJ_g@mail.gmail.com/
+Tested-by: Anders Roxell <anders.roxell@linaro.org>
+Reviewed-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231024105640.352752-1-mripard@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/tests/vc4_mock_crtc.c   | 2 +-
+ drivers/gpu/drm/vc4/tests/vc4_mock_output.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/tests/vc4_mock_crtc.c b/drivers/gpu/drm/vc4/tests/vc4_mock_crtc.c
+index 5d12d7beef0eb..ade3309ae042f 100644
+--- a/drivers/gpu/drm/vc4/tests/vc4_mock_crtc.c
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock_crtc.c
+@@ -26,7 +26,7 @@ struct vc4_dummy_crtc *vc4_mock_pv(struct kunit *test,
+       struct vc4_crtc *vc4_crtc;
+       int ret;
+-      dummy_crtc = kunit_kzalloc(test, sizeof(*dummy_crtc), GFP_KERNEL);
++      dummy_crtc = drmm_kzalloc(drm, sizeof(*dummy_crtc), GFP_KERNEL);
+       KUNIT_ASSERT_NOT_NULL(test, dummy_crtc);
+       vc4_crtc = &dummy_crtc->crtc;
+diff --git a/drivers/gpu/drm/vc4/tests/vc4_mock_output.c b/drivers/gpu/drm/vc4/tests/vc4_mock_output.c
+index 6e11fcc9ef45e..e70d7c3076acf 100644
+--- a/drivers/gpu/drm/vc4/tests/vc4_mock_output.c
++++ b/drivers/gpu/drm/vc4/tests/vc4_mock_output.c
+@@ -32,7 +32,7 @@ struct vc4_dummy_output *vc4_dummy_output(struct kunit *test,
+       struct drm_encoder *enc;
+       int ret;
+-      dummy_output = kunit_kzalloc(test, sizeof(*dummy_output), GFP_KERNEL);
++      dummy_output = drmm_kzalloc(drm, sizeof(*dummy_output), GFP_KERNEL);
+       KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dummy_output);
+       dummy_output->encoder.type = vc4_encoder_type;
+-- 
+2.42.0
+
diff --git a/queue-6.6/fbdev-fsl-diu-fb-mark-wr_reg_wa-static.patch b/queue-6.6/fbdev-fsl-diu-fb-mark-wr_reg_wa-static.patch
new file mode 100644 (file)
index 0000000..8a2cc9a
--- /dev/null
@@ -0,0 +1,38 @@
+From fd72e63f681235ff27e0a80e5b712c9664cd4e5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Nov 2023 13:58:42 +0100
+Subject: fbdev: fsl-diu-fb: mark wr_reg_wa() static
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit a5035c81847430dfa3482807b07325f29e9e8c09 ]
+
+wr_reg_wa() is not an appropriate name for a global function, and doesn't need
+to be global anyway, so mark it static and avoid the warning:
+
+drivers/video/fbdev/fsl-diu-fb.c:493:6: error: no previous prototype for 'wr_reg_wa' [-Werror=missing-prototypes]
+
+Fixes: 0d9dab39fbbe ("powerpc/5121: fsl-diu-fb: fix issue with re-enabling DIU area descriptor")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/fsl-diu-fb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/fsl-diu-fb.c b/drivers/video/fbdev/fsl-diu-fb.c
+index 7fbd9f069ac2e..0bced82fa4940 100644
+--- a/drivers/video/fbdev/fsl-diu-fb.c
++++ b/drivers/video/fbdev/fsl-diu-fb.c
+@@ -490,7 +490,7 @@ static enum fsl_diu_monitor_port fsl_diu_name_to_port(const char *s)
+  * Workaround for failed writing desc register of planes.
+  * Needed with MPC5121 DIU rev 2.0 silicon.
+  */
+-void wr_reg_wa(u32 *reg, u32 val)
++static void wr_reg_wa(u32 *reg, u32 val)
+ {
+       do {
+               out_be32(reg, val);
+-- 
+2.42.0
+
diff --git a/queue-6.6/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch b/queue-6.6/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
new file mode 100644 (file)
index 0000000..c0c7213
--- /dev/null
@@ -0,0 +1,89 @@
+From 784d696c0b8219d9e638dfbc91e3f71b672084ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Oct 2023 15:05:44 +0300
+Subject: fbdev: imsttfb: fix a resource leak in probe
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit aba6ab57a910ad4b940c2024d15f2cdbf5b7f76b ]
+
+I've re-written the error handling but the bug is that if init_imstt()
+fails we need to call iounmap(par->cmap_regs).
+
+Fixes: c75f5a550610 ("fbdev: imsttfb: Fix use after free bug in imsttfb_probe")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/imsttfb.c | 29 ++++++++++++++++-------------
+ 1 file changed, 16 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c
+index 1b322ac35d863..f5eaa58a808fb 100644
+--- a/drivers/video/fbdev/imsttfb.c
++++ b/drivers/video/fbdev/imsttfb.c
+@@ -1494,8 +1494,8 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+       if (!request_mem_region(addr, size, "imsttfb")) {
+               printk(KERN_ERR "imsttfb: Can't reserve memory region\n");
+-              framebuffer_release(info);
+-              return -ENODEV;
++              ret = -ENODEV;
++              goto release_info;
+       }
+       switch (pdev->device) {
+@@ -1512,36 +1512,39 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+                       printk(KERN_INFO "imsttfb: Device 0x%x unknown, "
+                                        "contact maintainer.\n", pdev->device);
+                       ret = -ENODEV;
+-                      goto error;
++                      goto release_mem_region;
+       }
+       info->fix.smem_start = addr;
+       info->screen_base = (__u8 *)ioremap(addr, par->ramdac == IBM ?
+                                           0x400000 : 0x800000);
+       if (!info->screen_base)
+-              goto error;
++              goto release_mem_region;
+       info->fix.mmio_start = addr + 0x800000;
+       par->dc_regs = ioremap(addr + 0x800000, 0x1000);
+       if (!par->dc_regs)
+-              goto error;
++              goto unmap_screen_base;
+       par->cmap_regs_phys = addr + 0x840000;
+       par->cmap_regs = (__u8 *)ioremap(addr + 0x840000, 0x1000);
+       if (!par->cmap_regs)
+-              goto error;
++              goto unmap_dc_regs;
+       info->pseudo_palette = par->palette;
+       ret = init_imstt(info);
+       if (ret)
+-              goto error;
++              goto unmap_cmap_regs;
+       pci_set_drvdata(pdev, info);
+-      return ret;
++      return 0;
+-error:
+-      if (par->dc_regs)
+-              iounmap(par->dc_regs);
+-      if (info->screen_base)
+-              iounmap(info->screen_base);
++unmap_cmap_regs:
++      iounmap(par->cmap_regs);
++unmap_dc_regs:
++      iounmap(par->dc_regs);
++unmap_screen_base:
++      iounmap(info->screen_base);
++release_mem_region:
+       release_mem_region(addr, size);
++release_info:
+       framebuffer_release(info);
+       return ret;
+ }
+-- 
+2.42.0
+
diff --git a/queue-6.6/fbdev-imsttfb-fix-double-free-in-probe.patch b/queue-6.6/fbdev-imsttfb-fix-double-free-in-probe.patch
new file mode 100644 (file)
index 0000000..41ea916
--- /dev/null
@@ -0,0 +1,51 @@
+From 3d731db8017443b9b381093bbf8b0dfd9a3fc3bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Oct 2023 15:04:56 +0300
+Subject: fbdev: imsttfb: fix double free in probe()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit e08c30efda21ef4c0ec084a3a9581c220b442ba9 ]
+
+The init_imstt() function calls framebuffer_release() on error and then
+the probe() function calls it again.  It should only be done in probe.
+
+Fixes: 518ecb6a209f ("fbdev: imsttfb: Fix error path of imsttfb_probe()")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/imsttfb.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c
+index f4c8677488fb8..1b322ac35d863 100644
+--- a/drivers/video/fbdev/imsttfb.c
++++ b/drivers/video/fbdev/imsttfb.c
+@@ -1419,7 +1419,6 @@ static int init_imstt(struct fb_info *info)
+       if ((info->var.xres * info->var.yres) * (info->var.bits_per_pixel >> 3) > info->fix.smem_len
+           || !(compute_imstt_regvals(par, info->var.xres, info->var.yres))) {
+               printk("imsttfb: %ux%ux%u not supported\n", info->var.xres, info->var.yres, info->var.bits_per_pixel);
+-              framebuffer_release(info);
+               return -ENODEV;
+       }
+@@ -1451,14 +1450,11 @@ static int init_imstt(struct fb_info *info)
+                     FBINFO_HWACCEL_FILLRECT |
+                     FBINFO_HWACCEL_YPAN;
+-      if (fb_alloc_cmap(&info->cmap, 0, 0)) {
+-              framebuffer_release(info);
++      if (fb_alloc_cmap(&info->cmap, 0, 0))
+               return -ENODEV;
+-      }
+       if (register_framebuffer(info) < 0) {
+               fb_dealloc_cmap(&info->cmap);
+-              framebuffer_release(info);
+               return -ENODEV;
+       }
+-- 
+2.42.0
+
diff --git a/queue-6.6/fbdev-omapfb-drop-unused-remove-function.patch b/queue-6.6/fbdev-omapfb-drop-unused-remove-function.patch
new file mode 100644 (file)
index 0000000..ffbac1e
--- /dev/null
@@ -0,0 +1,54 @@
+From a772de6bea2f5a9b5dad8afe0d9145fd8ee62564 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Nov 2023 18:35:58 +0100
+Subject: fbdev: omapfb: Drop unused remove function
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit fc6699d62f5f4facc3e934efd25892fc36050b70 ]
+
+OMAP2_VRFB is a bool, so the vrfb driver can never be compiled as a
+module. With that __exit_p(vrfb_remove) always evaluates to NULL and
+vrfb_remove() is unused.
+
+If the driver was compilable as a module, it would fail to build because
+the type of vrfb_remove() isn't compatible with struct
+platform_driver::remove(). (The former returns void, the latter int.)
+
+Fixes: aa1e49a3752f ("OMAPDSS: VRFB: add omap_vrfb_supported()")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/omap2/omapfb/vrfb.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/video/fbdev/omap2/omapfb/vrfb.c b/drivers/video/fbdev/omap2/omapfb/vrfb.c
+index ee0dd4c6a6466..568e6e1eca628 100644
+--- a/drivers/video/fbdev/omap2/omapfb/vrfb.c
++++ b/drivers/video/fbdev/omap2/omapfb/vrfb.c
+@@ -368,17 +368,10 @@ static int __init vrfb_probe(struct platform_device *pdev)
+       return 0;
+ }
+-static void __exit vrfb_remove(struct platform_device *pdev)
+-{
+-      vrfb_loaded = false;
+-}
+-
+ static struct platform_driver vrfb_driver = {
+       .driver.name    = "omapvrfb",
+-      .remove         = __exit_p(vrfb_remove),
+ };
+-
+-module_platform_driver_probe(vrfb_driver, vrfb_probe);
++builtin_platform_driver_probe(vrfb_driver, vrfb_probe);
+ MODULE_AUTHOR("Tomi Valkeinen <tomi.valkeinen@ti.com>");
+ MODULE_DESCRIPTION("OMAP VRFB");
+-- 
+2.42.0
+
index 5f90feb82d52ec3db6f1250d3e32f264e7b313d8..e7913dbf99de8169323d9093b508f06b7fbcd6de 100644 (file)
@@ -579,3 +579,17 @@ net-ti-icss-iep-fix-setting-counter-value.patch
 drivers-perf-do-not-broadcast-to-other-cpus-when-sta.patch
 module-decompress-use-kvmalloc-consistently.patch
 fs-dlm-simplify-buffer-size-computation-in-dlm_creat.patch
+drm-vc4-tests-fix-uaf-in-the-mock-helpers.patch
+drm-syncobj-fix-drm_syncobj_wait_flags_wait_availabl.patch
+asoc-rt712-sdca-fix-speaker-route-missing-issue.patch
+asoc-mediatek-mt8186_mt6366_rt1019_rt5682s-trivial-f.patch
+asoc-hdmi-codec-register-hpd-callback-on-component-p.patch
+asoc-dapm-fix-clock-get-name.patch
+spi-spi-zynq-qspi-add-spi-mem-to-driver-kconfig-depe.patch
+arm64-arm-arm_pmuv3-perf-don-t-truncate-64-bit-regis.patch
+fbdev-omapfb-drop-unused-remove-function.patch
+fbdev-imsttfb-fix-double-free-in-probe.patch
+fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
+alsa-hda-realtek-add-support-dual-speaker-for-dell.patch
+fbdev-fsl-diu-fb-mark-wr_reg_wa-static.patch
+tracing-kprobes-fix-the-order-of-argument-descriptio.patch
diff --git a/queue-6.6/spi-spi-zynq-qspi-add-spi-mem-to-driver-kconfig-depe.patch b/queue-6.6/spi-spi-zynq-qspi-add-spi-mem-to-driver-kconfig-depe.patch
new file mode 100644 (file)
index 0000000..5a0ef18
--- /dev/null
@@ -0,0 +1,37 @@
+From 90da372db25268d32993692a5b24d50850a326f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Nov 2023 00:13:51 +0530
+Subject: spi: spi-zynq-qspi: add spi-mem to driver kconfig dependencies
+
+From: Amit Kumar Mahapatra <amit.kumar-mahapatra@amd.com>
+
+[ Upstream commit c2ded280a4b1b7bd93e53670528504be08d24967 ]
+
+Zynq QSPI driver has been converted to use spi-mem framework so
+add spi-mem to driver kconfig dependencies.
+
+Fixes: 67dca5e580f1 ("spi: spi-mem: Add support for Zynq QSPI controller")
+Signed-off-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@amd.com>
+Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+Link: https://lore.kernel.org/r/1699037031-702858-1-git-send-email-radhey.shyam.pandey@amd.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
+index 2c21d5b96fdce..bcbf840cd41c8 100644
+--- a/drivers/spi/Kconfig
++++ b/drivers/spi/Kconfig
+@@ -1157,6 +1157,7 @@ config SPI_XTENSA_XTFPGA
+ config SPI_ZYNQ_QSPI
+       tristate "Xilinx Zynq QSPI controller"
+       depends on ARCH_ZYNQ || COMPILE_TEST
++      depends on SPI_MEM
+       help
+         This enables support for the Zynq Quad SPI controller
+         in master mode.
+-- 
+2.42.0
+
diff --git a/queue-6.6/tracing-kprobes-fix-the-order-of-argument-descriptio.patch b/queue-6.6/tracing-kprobes-fix-the-order-of-argument-descriptio.patch
new file mode 100644 (file)
index 0000000..fdc66c8
--- /dev/null
@@ -0,0 +1,45 @@
+From 4fe24f7437237476fc7e3a39e70d67cc77c2e54a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Oct 2023 12:13:05 +0800
+Subject: tracing/kprobes: Fix the order of argument descriptions
+
+From: Yujie Liu <yujie.liu@intel.com>
+
+[ Upstream commit f032c53bea6d2057c14553832d846be2f151cfb2 ]
+
+The order of descriptions should be consistent with the argument list of
+the function, so "kretprobe" should be the second one.
+
+int __kprobe_event_gen_cmd_start(struct dynevent_cmd *cmd, bool kretprobe,
+                                 const char *name, const char *loc, ...)
+
+Link: https://lore.kernel.org/all/20231031041305.3363712-1-yujie.liu@intel.com/
+
+Fixes: 2a588dd1d5d6 ("tracing: Add kprobe event command generation functions")
+Suggested-by: Mukesh Ojha <quic_mojha@quicinc.com>
+Signed-off-by: Yujie Liu <yujie.liu@intel.com>
+Reviewed-by: Mukesh Ojha <quic_mojha@quicinc.com>
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_kprobe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
+index e834f149695b7..47812aa16bb57 100644
+--- a/kernel/trace/trace_kprobe.c
++++ b/kernel/trace/trace_kprobe.c
+@@ -1020,9 +1020,9 @@ EXPORT_SYMBOL_GPL(kprobe_event_cmd_init);
+ /**
+  * __kprobe_event_gen_cmd_start - Generate a kprobe event command from arg list
+  * @cmd: A pointer to the dynevent_cmd struct representing the new event
++ * @kretprobe: Is this a return probe?
+  * @name: The name of the kprobe event
+  * @loc: The location of the kprobe event
+- * @kretprobe: Is this a return probe?
+  * @...: Variable number of arg (pairs), one pair for each field
+  *
+  * NOTE: Users normally won't want to call this function directly, but
+-- 
+2.42.0
+