From b3b4319b5633365ddbda6ae380fc2b9c924cbcdb Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 6 Nov 2022 11:58:53 -0500 Subject: [PATCH] Fixes for 5.15 Signed-off-by: Sasha Levin --- .../drm-msm-hdmi-fix-irq-lifetime.patch | 50 ++++++++++ ...mi-remove-spurious-irqf_oneshot-flag.patch | 50 ++++++++++ ...-back-to-cfb_fillrect-on-32-bit-hcrx.patch | 39 ++++++++ ...sers-bcm47xxpart-fix-halfblock-reads.patch | 57 ++++++++++++ ...7xxpart-print-correct-offset-on-read.patch | 40 ++++++++ .../s390-boot-add-secure-boot-trailer.patch | 48 ++++++++++ ...cdev-information-only-for-io-subchan.patch | 46 +++++++++ ...-of-bounds-access-on-cio_ignore-free.patch | 66 +++++++++++++ ...-missing-ex_table-entries-to-__clear.patch | 52 +++++++++++ queue-5.15/series | 10 ++ ...b-implement-the-stifb_fillrect-funct.patch | 93 +++++++++++++++++++ 11 files changed, 551 insertions(+) create mode 100644 queue-5.15/drm-msm-hdmi-fix-irq-lifetime.patch create mode 100644 queue-5.15/drm-msm-hdmi-remove-spurious-irqf_oneshot-flag.patch create mode 100644 queue-5.15/fbdev-stifb-fall-back-to-cfb_fillrect-on-32-bit-hcrx.patch create mode 100644 queue-5.15/mtd-parsers-bcm47xxpart-fix-halfblock-reads.patch create mode 100644 queue-5.15/mtd-parsers-bcm47xxpart-print-correct-offset-on-read.patch create mode 100644 queue-5.15/s390-boot-add-secure-boot-trailer.patch create mode 100644 queue-5.15/s390-cio-derive-cdev-information-only-for-io-subchan.patch create mode 100644 queue-5.15/s390-cio-fix-out-of-bounds-access-on-cio_ignore-free.patch create mode 100644 queue-5.15/s390-uaccess-add-missing-ex_table-entries-to-__clear.patch create mode 100644 queue-5.15/video-fbdev-stifb-implement-the-stifb_fillrect-funct.patch diff --git a/queue-5.15/drm-msm-hdmi-fix-irq-lifetime.patch b/queue-5.15/drm-msm-hdmi-fix-irq-lifetime.patch new file mode 100644 index 00000000000..d904e916266 --- /dev/null +++ b/queue-5.15/drm-msm-hdmi-fix-irq-lifetime.patch @@ -0,0 +1,50 @@ +From 9b73ce41a9157680291e3d134fabf588a5ec8eb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Sep 2022 10:53:18 +0200 +Subject: drm/msm/hdmi: fix IRQ lifetime + +From: Johan Hovold + +[ Upstream commit 152d394842bb564148e68b92486a87db0bf54859 ] + +Device-managed resources allocated post component bind must be tied to +the lifetime of the aggregate DRM device or they will not necessarily be +released when binding of the aggregate device is deferred. + +This is specifically true for the HDMI IRQ, which will otherwise remain +requested so that the next bind attempt fails when requesting the IRQ a +second time. + +Fix this by tying the device-managed lifetime of the HDMI IRQ to the DRM +device so that it is released when bind fails. + +Fixes: 067fef372c73 ("drm/msm/hdmi: refactor bind/init") +Cc: stable@vger.kernel.org # 3.19 +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Johan Hovold +Tested-by: Kuogee Hsieh +Reviewed-by: Kuogee Hsieh +Patchwork: https://patchwork.freedesktop.org/patch/502666/ +Link: https://lore.kernel.org/r/20220913085320.8577-9-johan+linaro@kernel.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/hdmi/hdmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c +index 0b756e84d393..f6b09e8eca67 100644 +--- a/drivers/gpu/drm/msm/hdmi/hdmi.c ++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c +@@ -330,7 +330,7 @@ int msm_hdmi_modeset_init(struct hdmi *hdmi, + goto fail; + } + +- ret = devm_request_irq(&pdev->dev, hdmi->irq, ++ ret = devm_request_irq(dev->dev, hdmi->irq, + msm_hdmi_irq, IRQF_TRIGGER_HIGH, + "hdmi_isr", hdmi); + if (ret < 0) { +-- +2.35.1 + diff --git a/queue-5.15/drm-msm-hdmi-remove-spurious-irqf_oneshot-flag.patch b/queue-5.15/drm-msm-hdmi-remove-spurious-irqf_oneshot-flag.patch new file mode 100644 index 00000000000..a96b32dad8c --- /dev/null +++ b/queue-5.15/drm-msm-hdmi-remove-spurious-irqf_oneshot-flag.patch @@ -0,0 +1,50 @@ +From 8f46c2aaadb2bb9a7aead1c2d505ddd22167450f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Feb 2022 17:47:33 +0000 +Subject: drm/msm/hdmi: Remove spurious IRQF_ONESHOT flag + +From: Daniel Thompson + +[ Upstream commit 088604d37e23e9ec01a501d0e3630bc4f02027a0 ] + +Quoting the header comments, IRQF_ONESHOT is "Used by threaded interrupts +which need to keep the irq line disabled until the threaded handler has +been run.". When applied to an interrupt that doesn't request a threaded +irq then IRQF_ONESHOT has a lesser known (undocumented?) side effect, +which it to disable the forced threading of irqs. For "normal" kernels +if there is no thread_fn then IRQF_ONESHOT is a nop. + +In this case disabling forced threading is not appropriate because the +driver calls wake_up_all() (via msm_hdmi_i2c_irq) and also directly uses +the regular spinlock API for locking (in msm_hdmi_hdcp_irq() ). Neither +of these APIs can be called from no-thread interrupt handlers on +PREEMPT_RT systems. + +Fix this by removing IRQF_ONESHOT. + +Signed-off-by: Daniel Thompson +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20220201174734.196718-3-daniel.thompson@linaro.org +Signed-off-by: Dmitry Baryshkov +Stable-dep-of: 152d394842bb ("drm/msm/hdmi: fix IRQ lifetime") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/hdmi/hdmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c +index e082e01b5e8d..0b756e84d393 100644 +--- a/drivers/gpu/drm/msm/hdmi/hdmi.c ++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c +@@ -331,7 +331,7 @@ int msm_hdmi_modeset_init(struct hdmi *hdmi, + } + + ret = devm_request_irq(&pdev->dev, hdmi->irq, +- msm_hdmi_irq, IRQF_TRIGGER_HIGH | IRQF_ONESHOT, ++ msm_hdmi_irq, IRQF_TRIGGER_HIGH, + "hdmi_isr", hdmi); + if (ret < 0) { + DRM_DEV_ERROR(dev->dev, "failed to request IRQ%u: %d\n", +-- +2.35.1 + diff --git a/queue-5.15/fbdev-stifb-fall-back-to-cfb_fillrect-on-32-bit-hcrx.patch b/queue-5.15/fbdev-stifb-fall-back-to-cfb_fillrect-on-32-bit-hcrx.patch new file mode 100644 index 00000000000..d903cb042ca --- /dev/null +++ b/queue-5.15/fbdev-stifb-fall-back-to-cfb_fillrect-on-32-bit-hcrx.patch @@ -0,0 +1,39 @@ +From ec41e8fb431f7470bb09c29062282e676bec1012 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Oct 2022 20:01:17 +0200 +Subject: fbdev: stifb: Fall back to cfb_fillrect() on 32-bit HCRX cards + +From: Helge Deller + +[ Upstream commit 776d875fd4cbb3884860ea7f63c3958f02b0c80e ] + +When the text console is scrolling text upwards it calls the fillrect() +function to empty the new line. The current implementation doesn't seem +to work correctly on HCRX cards in 32-bit mode and leave garbage in that +line instead. Fix it by falling back to standard cfb_fillrect() in that +case. + +Signed-off-by: Helge Deller +Cc: +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/stifb.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/stifb.c b/drivers/video/fbdev/stifb.c +index 7753e586e65a..3feb6e40d56d 100644 +--- a/drivers/video/fbdev/stifb.c ++++ b/drivers/video/fbdev/stifb.c +@@ -1055,7 +1055,8 @@ stifb_fillrect(struct fb_info *info, const struct fb_fillrect *rect) + { + struct stifb_info *fb = container_of(info, struct stifb_info, info); + +- if (rect->rop != ROP_COPY) ++ if (rect->rop != ROP_COPY || ++ (fb->id == S9000_ID_HCRX && fb->info.var.bits_per_pixel == 32)) + return cfb_fillrect(info, rect); + + SETUP_HW(fb); +-- +2.35.1 + diff --git a/queue-5.15/mtd-parsers-bcm47xxpart-fix-halfblock-reads.patch b/queue-5.15/mtd-parsers-bcm47xxpart-fix-halfblock-reads.patch new file mode 100644 index 00000000000..b3654cff41b --- /dev/null +++ b/queue-5.15/mtd-parsers-bcm47xxpart-fix-halfblock-reads.patch @@ -0,0 +1,57 @@ +From 3dfdf77e2e1d1fca79cda91d25811a4051bc66d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 11:11:29 +0200 +Subject: mtd: parsers: bcm47xxpart: Fix halfblock reads +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linus Walleij + +[ Upstream commit 05e258c6ec669d6d18c494ea03d35962d6f5b545 ] + +There is some code in the parser that tries to read 0x8000 +bytes into a block to "read in the middle" of the block. Well +that only works if the block is also 0x10000 bytes all the time, +else we get these parse errors as we reach the end of the flash: + +spi-nor spi0.0: mx25l1606e (2048 Kbytes) +mtd_read error while parsing (offset: 0x200000): -22 +mtd_read error while parsing (offset: 0x201000): -22 +(...) + +Fix the code to do what I think was intended. + +Cc: stable@vger.kernel.org +Fixes: f0501e81fbaa ("mtd: bcm47xxpart: alternative MAGIC for board_data partition") +Cc: Rafał Miłecki +Cc: Florian Fainelli +Signed-off-by: Linus Walleij +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20221018091129.280026-1-linus.walleij@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/mtd/parsers/bcm47xxpart.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/parsers/bcm47xxpart.c b/drivers/mtd/parsers/bcm47xxpart.c +index 50fcf4c2174b..13daf9bffd08 100644 +--- a/drivers/mtd/parsers/bcm47xxpart.c ++++ b/drivers/mtd/parsers/bcm47xxpart.c +@@ -233,11 +233,11 @@ static int bcm47xxpart_parse(struct mtd_info *master, + } + + /* Read middle of the block */ +- err = mtd_read(master, offset + 0x8000, 0x4, &bytes_read, ++ err = mtd_read(master, offset + (blocksize / 2), 0x4, &bytes_read, + (uint8_t *)buf); + if (err && !mtd_is_bitflip(err)) { + pr_err("mtd_read error while parsing (offset: 0x%X): %d\n", +- offset + 0x8000, err); ++ offset + (blocksize / 2), err); + continue; + } + +-- +2.35.1 + diff --git a/queue-5.15/mtd-parsers-bcm47xxpart-print-correct-offset-on-read.patch b/queue-5.15/mtd-parsers-bcm47xxpart-print-correct-offset-on-read.patch new file mode 100644 index 00000000000..3fe8ca121f9 --- /dev/null +++ b/queue-5.15/mtd-parsers-bcm47xxpart-print-correct-offset-on-read.patch @@ -0,0 +1,40 @@ +From b7ff8adffa5fc9a91778a1e946c720e047bbb7ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Mar 2022 12:43:16 +0100 +Subject: mtd: parsers: bcm47xxpart: print correct offset on read error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 4c38eded807043f40f4dc49da6df097f9dcac393 ] + +mtd_read() gets called with offset + 0x8000 as argument so use the same +value in pr_err(). + +Signed-off-by: Rafał Miłecki +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220317114316.29827-1-zajec5@gmail.com +Stable-dep-of: 05e258c6ec66 ("mtd: parsers: bcm47xxpart: Fix halfblock reads") +Signed-off-by: Sasha Levin +--- + drivers/mtd/parsers/bcm47xxpart.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/parsers/bcm47xxpart.c b/drivers/mtd/parsers/bcm47xxpart.c +index 6012a10f10c8..50fcf4c2174b 100644 +--- a/drivers/mtd/parsers/bcm47xxpart.c ++++ b/drivers/mtd/parsers/bcm47xxpart.c +@@ -237,7 +237,7 @@ static int bcm47xxpart_parse(struct mtd_info *master, + (uint8_t *)buf); + if (err && !mtd_is_bitflip(err)) { + pr_err("mtd_read error while parsing (offset: 0x%X): %d\n", +- offset, err); ++ offset + 0x8000, err); + continue; + } + +-- +2.35.1 + diff --git a/queue-5.15/s390-boot-add-secure-boot-trailer.patch b/queue-5.15/s390-boot-add-secure-boot-trailer.patch new file mode 100644 index 00000000000..36f981c6daa --- /dev/null +++ b/queue-5.15/s390-boot-add-secure-boot-trailer.patch @@ -0,0 +1,48 @@ +From e9d17c7a72af99c77113fdcaecf329cc967729b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Sep 2022 15:01:36 +0200 +Subject: s390/boot: add secure boot trailer + +From: Peter Oberparleiter + +[ Upstream commit aa127a069ef312aca02b730d5137e1778d0c3ba7 ] + +This patch enhances the kernel image adding a trailer as required for +secure boot by future firmware versions. + +Cc: # 5.2+ +Signed-off-by: Peter Oberparleiter +Reviewed-by: Sven Schnelle +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/boot/compressed/vmlinux.lds.S | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/boot/compressed/vmlinux.lds.S b/arch/s390/boot/compressed/vmlinux.lds.S +index 918e05137d4c..1686a852534f 100644 +--- a/arch/s390/boot/compressed/vmlinux.lds.S ++++ b/arch/s390/boot/compressed/vmlinux.lds.S +@@ -93,8 +93,17 @@ SECTIONS + _compressed_start = .; + *(.vmlinux.bin.compressed) + _compressed_end = .; +- FILL(0xff); +- . = ALIGN(4096); ++ } ++ ++#define SB_TRAILER_SIZE 32 ++ /* Trailer needed for Secure Boot */ ++ . += SB_TRAILER_SIZE; /* make sure .sb.trailer does not overwrite the previous section */ ++ . = ALIGN(4096) - SB_TRAILER_SIZE; ++ .sb.trailer : { ++ QUAD(0) ++ QUAD(0) ++ QUAD(0) ++ QUAD(0x000000207a49504c) + } + _end = .; + +-- +2.35.1 + diff --git a/queue-5.15/s390-cio-derive-cdev-information-only-for-io-subchan.patch b/queue-5.15/s390-cio-derive-cdev-information-only-for-io-subchan.patch new file mode 100644 index 00000000000..e8405160a7b --- /dev/null +++ b/queue-5.15/s390-cio-derive-cdev-information-only-for-io-subchan.patch @@ -0,0 +1,46 @@ +From 6fef76b403845a2cac730de8e4874d693c4b5c0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Sep 2021 15:04:01 +0200 +Subject: s390/cio: derive cdev information only for IO-subchannels + +From: Vineeth Vijayan + +[ Upstream commit 0c3812c347bfb0dc213556a195e79850c55702f5 ] + +cdev->online for the purge function must not be checked for the +non-IO subchannel type. Make sure that we are deriving the cdev only +from sch-type SUBCHANNEL_TYPE_IO. + +Signed-off-by: Vineeth Vijayan +Reviewed-by: Peter Oberparleiter +Signed-off-by: Vasily Gorbik +Stable-dep-of: 1b6074112742 ("s390/cio: fix out-of-bounds access on cio_ignore free") +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/css.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c +index c27809792609..ce9e7517430f 100644 +--- a/drivers/s390/cio/css.c ++++ b/drivers/s390/cio/css.c +@@ -792,10 +792,13 @@ static int __unset_online(struct device *dev, void *data) + { + struct idset *set = data; + struct subchannel *sch = to_subchannel(dev); +- struct ccw_device *cdev = sch_get_cdev(sch); ++ struct ccw_device *cdev; + +- if (cdev && cdev->online) +- idset_sch_del(set, sch->schid); ++ if (sch->st == SUBCHANNEL_TYPE_IO) { ++ cdev = sch_get_cdev(sch); ++ if (cdev && cdev->online) ++ idset_sch_del(set, sch->schid); ++ } + + return 0; + } +-- +2.35.1 + diff --git a/queue-5.15/s390-cio-fix-out-of-bounds-access-on-cio_ignore-free.patch b/queue-5.15/s390-cio-fix-out-of-bounds-access-on-cio_ignore-free.patch new file mode 100644 index 00000000000..fe0094d0868 --- /dev/null +++ b/queue-5.15/s390-cio-fix-out-of-bounds-access-on-cio_ignore-free.patch @@ -0,0 +1,66 @@ +From bfbf966318d4d292b6d891f5fdec10e4648a54d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Oct 2022 12:24:58 +0200 +Subject: s390/cio: fix out-of-bounds access on cio_ignore free + +From: Peter Oberparleiter + +[ Upstream commit 1b6074112742f65ece71b0f299ca5a6a887d2db6 ] + +The channel-subsystem-driver scans for newly available devices whenever +device-IDs are removed from the cio_ignore list using a command such as: + + echo free >/proc/cio_ignore + +Since an I/O device scan might interfer with running I/Os, commit +172da89ed0ea ("s390/cio: avoid excessive path-verification requests") +introduced an optimization to exclude online devices from the scan. + +The newly added check for online devices incorrectly assumes that +an I/O-subchannel's drvdata points to a struct io_subchannel_private. +For devices that are bound to a non-default I/O subchannel driver, such +as the vfio_ccw driver, this results in an out-of-bounds read access +during each scan. + +Fix this by changing the scan logic to rely on a driver-independent +online indication. For this we can use struct subchannel->config.ena, +which is the driver's requested subchannel-enabled state. Since I/Os +can only be started on enabled subchannels, this matches the intent +of the original optimization of not scanning devices where I/O might +be running. + +Fixes: 172da89ed0ea ("s390/cio: avoid excessive path-verification requests") +Fixes: 0c3812c347bf ("s390/cio: derive cdev information only for IO-subchannels") +Cc: # v5.15 +Reported-by: Alexander Egorenkov +Reviewed-by: Vineeth Vijayan +Signed-off-by: Peter Oberparleiter +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/css.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c +index ce9e7517430f..2ba9e0135565 100644 +--- a/drivers/s390/cio/css.c ++++ b/drivers/s390/cio/css.c +@@ -792,13 +792,9 @@ static int __unset_online(struct device *dev, void *data) + { + struct idset *set = data; + struct subchannel *sch = to_subchannel(dev); +- struct ccw_device *cdev; + +- if (sch->st == SUBCHANNEL_TYPE_IO) { +- cdev = sch_get_cdev(sch); +- if (cdev && cdev->online) +- idset_sch_del(set, sch->schid); +- } ++ if (sch->st == SUBCHANNEL_TYPE_IO && sch->config.ena) ++ idset_sch_del(set, sch->schid); + + return 0; + } +-- +2.35.1 + diff --git a/queue-5.15/s390-uaccess-add-missing-ex_table-entries-to-__clear.patch b/queue-5.15/s390-uaccess-add-missing-ex_table-entries-to-__clear.patch new file mode 100644 index 00000000000..eac11f02b35 --- /dev/null +++ b/queue-5.15/s390-uaccess-add-missing-ex_table-entries-to-__clear.patch @@ -0,0 +1,52 @@ +From c85c5ecf9947b9b151b76ca72aceb587498f7dff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 13:39:43 +0200 +Subject: s390/uaccess: add missing EX_TABLE entries to __clear_user() + +From: Heiko Carstens + +[ Upstream commit 4e1b5a86a5edfbefc9396d41b0fc1a2ebd0101b6 ] + +For some exception types the instruction address points behind the +instruction that caused the exception. Take that into account and add +the missing exception table entries. + +Cc: +Reviewed-by: Vasily Gorbik +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/lib/uaccess.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/s390/lib/uaccess.c b/arch/s390/lib/uaccess.c +index a596e69d3c47..0b012ce0921c 100644 +--- a/arch/s390/lib/uaccess.c ++++ b/arch/s390/lib/uaccess.c +@@ -212,7 +212,7 @@ static inline unsigned long clear_user_mvcos(void __user *to, unsigned long size + asm volatile( + " llilh 0,%[spec]\n" + "0: .insn ss,0xc80000000000,0(%0,%1),0(%4),0\n" +- " jz 4f\n" ++ "6: jz 4f\n" + "1: algr %0,%2\n" + " slgr %1,%2\n" + " j 0b\n" +@@ -222,11 +222,11 @@ static inline unsigned long clear_user_mvcos(void __user *to, unsigned long size + " clgr %0,%3\n" /* copy crosses next page boundary? */ + " jnh 5f\n" + "3: .insn ss,0xc80000000000,0(%3,%1),0(%4),0\n" +- " slgr %0,%3\n" ++ "7: slgr %0,%3\n" + " j 5f\n" + "4: slgr %0,%0\n" + "5:\n" +- EX_TABLE(0b,2b) EX_TABLE(3b,5b) ++ EX_TABLE(0b,2b) EX_TABLE(6b,2b) EX_TABLE(3b,5b) EX_TABLE(7b,5b) + : "+a" (size), "+a" (to), "+a" (tmp1), "=a" (tmp2) + : "a" (empty_zero_page), [spec] "K" (0x81UL) + : "cc", "memory", "0"); +-- +2.35.1 + diff --git a/queue-5.15/series b/queue-5.15/series index bffbf9a7f59..1b742881e68 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -58,3 +58,13 @@ net-smc-fix-possible-leaked-pernet-namespace-in-smc_.patch net-neigh-fix-null-ptr-deref-in-neigh_table_clear.patch ipv6-fix-warning-in-ip6_route_net_exit_late.patch vsock-fix-possible-infinite-sleep-in-vsock_connectib.patch +drm-msm-hdmi-remove-spurious-irqf_oneshot-flag.patch +drm-msm-hdmi-fix-irq-lifetime.patch +video-fbdev-stifb-implement-the-stifb_fillrect-funct.patch +fbdev-stifb-fall-back-to-cfb_fillrect-on-32-bit-hcrx.patch +mtd-parsers-bcm47xxpart-print-correct-offset-on-read.patch +mtd-parsers-bcm47xxpart-fix-halfblock-reads.patch +s390-uaccess-add-missing-ex_table-entries-to-__clear.patch +s390-boot-add-secure-boot-trailer.patch +s390-cio-derive-cdev-information-only-for-io-subchan.patch +s390-cio-fix-out-of-bounds-access-on-cio_ignore-free.patch diff --git a/queue-5.15/video-fbdev-stifb-implement-the-stifb_fillrect-funct.patch b/queue-5.15/video-fbdev-stifb-implement-the-stifb_fillrect-funct.patch new file mode 100644 index 00000000000..55cf0576c9b --- /dev/null +++ b/queue-5.15/video-fbdev-stifb-implement-the-stifb_fillrect-funct.patch @@ -0,0 +1,93 @@ +From ed8c5d6677c231cdb6d441a3cf957a550deb6a74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jan 2022 16:35:53 +0100 +Subject: video/fbdev/stifb: Implement the stifb_fillrect() function + +From: Helge Deller + +[ Upstream commit 9c379c65241707e44072139d782bc2dfec9b4ab3 ] + +The stifb driver (for Artist/HCRX graphics on PA-RISC) was missing +the fillrect function. +Tested on a 715/64 PA-RISC machine and in qemu. + +Signed-off-by: Helge Deller +Stable-dep-of: 776d875fd4cb ("fbdev: stifb: Fall back to cfb_fillrect() on 32-bit HCRX cards") +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/stifb.c | 45 +++++++++++++++++++++++++++++++++++-- + 1 file changed, 43 insertions(+), 2 deletions(-) + +diff --git a/drivers/video/fbdev/stifb.c b/drivers/video/fbdev/stifb.c +index b0470f4f595e..7753e586e65a 100644 +--- a/drivers/video/fbdev/stifb.c ++++ b/drivers/video/fbdev/stifb.c +@@ -1041,6 +1041,47 @@ stifb_copyarea(struct fb_info *info, const struct fb_copyarea *area) + SETUP_FB(fb); + } + ++#define ARTIST_VRAM_SIZE 0x000804 ++#define ARTIST_VRAM_SRC 0x000808 ++#define ARTIST_VRAM_SIZE_TRIGGER_WINFILL 0x000a04 ++#define ARTIST_VRAM_DEST_TRIGGER_BLOCKMOVE 0x000b00 ++#define ARTIST_SRC_BM_ACCESS 0x018008 ++#define ARTIST_FGCOLOR 0x018010 ++#define ARTIST_BGCOLOR 0x018014 ++#define ARTIST_BITMAP_OP 0x01801c ++ ++static void ++stifb_fillrect(struct fb_info *info, const struct fb_fillrect *rect) ++{ ++ struct stifb_info *fb = container_of(info, struct stifb_info, info); ++ ++ if (rect->rop != ROP_COPY) ++ return cfb_fillrect(info, rect); ++ ++ SETUP_HW(fb); ++ ++ if (fb->info.var.bits_per_pixel == 32) { ++ WRITE_WORD(0xBBA0A000, fb, REG_10); ++ ++ NGLE_REALLY_SET_IMAGE_PLANEMASK(fb, 0xffffffff); ++ } else { ++ WRITE_WORD(fb->id == S9000_ID_HCRX ? 0x13a02000 : 0x13a01000, fb, REG_10); ++ ++ NGLE_REALLY_SET_IMAGE_PLANEMASK(fb, 0xff); ++ } ++ ++ WRITE_WORD(0x03000300, fb, ARTIST_BITMAP_OP); ++ WRITE_WORD(0x2ea01000, fb, ARTIST_SRC_BM_ACCESS); ++ NGLE_QUICK_SET_DST_BM_ACCESS(fb, 0x2ea01000); ++ NGLE_REALLY_SET_IMAGE_FG_COLOR(fb, rect->color); ++ WRITE_WORD(0, fb, ARTIST_BGCOLOR); ++ ++ NGLE_SET_DSTXY(fb, (rect->dx << 16) | (rect->dy)); ++ SET_LENXY_START_RECFILL(fb, (rect->width << 16) | (rect->height)); ++ ++ SETUP_FB(fb); ++} ++ + static void __init + stifb_init_display(struct stifb_info *fb) + { +@@ -1105,7 +1146,7 @@ static const struct fb_ops stifb_ops = { + .owner = THIS_MODULE, + .fb_setcolreg = stifb_setcolreg, + .fb_blank = stifb_blank, +- .fb_fillrect = cfb_fillrect, ++ .fb_fillrect = stifb_fillrect, + .fb_copyarea = stifb_copyarea, + .fb_imageblit = cfb_imageblit, + }; +@@ -1297,7 +1338,7 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref) + goto out_err0; + } + info->screen_size = fix->smem_len; +- info->flags = FBINFO_DEFAULT | FBINFO_HWACCEL_COPYAREA; ++ info->flags = FBINFO_HWACCEL_COPYAREA | FBINFO_HWACCEL_FILLRECT; + info->pseudo_palette = &fb->pseudo_palette; + + /* This has to be done !!! */ +-- +2.35.1 + -- 2.47.3