From d55b57628adb45b582ee928ef9fd12d35a2b743b Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Mon, 29 Jan 2024 08:31:28 -0500 Subject: [PATCH] Fixes for 6.7 Signed-off-by: Sasha Levin --- ...12-tab3-add-samsung-invert-vclk-flag.patch | 40 ++++ ...ing-genhd_fl_no_part-to-bdev_add_par.patch | 60 +++++ ...-unlock-in-cifs_chan_skip_or_disable.patch | 39 +++ ...te-fix-setting-scaling-max-min-freq-.patch | 47 ++++ ...25-ensure-bridge-is-suspended-in-dis.patch | 86 +++++++ ...e-ps8640-ensure-bridge-is-suspended-.patch | 86 +++++++ ...e-ps8640-make-sure-we-drop-the-aux-m.patch | 46 ++++ ...e-ps8640-wait-for-hpd-when-doing-an-.patch | 51 ++++ ...sung-dsim-don-t-use-force_stop_state.patch | 129 ++++++++++ ...i902x-fix-audio-codec-unregistration.patch | 85 +++++++ ...ridge-sii902x-fix-probing-race-issue.patch | 130 ++++++++++ ...ccidental-on-stack-copy-of-exynos_dr.patch | 66 ++++++ ...inor-fix-for-loop-iteration-in-gsc_r.patch | 39 +++ ...m-rm692e5-select-config_drm_display_.patch | 44 ++++ ...g-s6d7aa0-drop-drm_bus_flag_de_high-.patch | 42 ++++ ...-add-missing-bus-flags-for-tianma-tm.patch | 49 ++++ ...-add-missing-rwlock_init-for-the-dri.patch | 38 +++ ...-add-missing-rwlock_init-in-ffa_setu.patch | 37 +++ ...e-arm_ffa-check-xa_load-return-value.patch | 54 +++++ ...i-fix-the-clock-protocol-version-for.patch | 43 ++++ ...arm_scmi-use-xa_insert-to-store-opps.patch | 75 ++++++ ...i-use-xa_insert-when-saving-raw-queu.patch | 65 +++++ ...-prevent-the-reuse-of-stale-pi_state.patch | 136 +++++++++++ ...ear-interrupt-after-set-the-interrup.patch | 160 +++++++++++++ ...ll-rcutree_report_cpu_starting-at-tl.patch | 80 +++++++ ...sh-when-reserved-memory-is-not-added.patch | 46 ++++ ...egister-smp_ops-on-non-smp-platforms.patch | 44 ++++ ...x-mlxbf-pmc-fix-offset-calculation-f.patch | 49 ++++ ...el-ifs-call-release_firmware-when-ha.patch | 48 ++++ ...-fix-error-handling-in-legacy-wmi-no.patch | 78 ++++++ ...-separate-sg2042-mtime-and-mtimecmp-.patch | 224 ++++++++++++++++++ queue-6.7/series | 35 +++ ...fix-sfdp-bfpt-read-by-usig-mspi-read.patch | 49 ++++ ...fix-finalize-message-on-error-return.patch | 43 ++++ ...move-meteor-lake-s-soc-pci-id-from-t.patch | 38 +++ ...reverse-the-order-of-interleaved-wri.patch | 64 +++++ 36 files changed, 2445 insertions(+) create mode 100644 queue-6.7/arm-dts-exynos4212-tab3-add-samsung-invert-vclk-flag.patch create mode 100644 queue-6.7/block-move-checking-genhd_fl_no_part-to-bdev_add_par.patch create mode 100644 queue-6.7/cifs-fix-stray-unlock-in-cifs_chan_skip_or_disable.patch create mode 100644 queue-6.7/cpufreq-amd-pstate-fix-setting-scaling-max-min-freq-.patch create mode 100644 queue-6.7/drm-bridge-anx7625-ensure-bridge-is-suspended-in-dis.patch create mode 100644 queue-6.7/drm-bridge-parade-ps8640-ensure-bridge-is-suspended-.patch create mode 100644 queue-6.7/drm-bridge-parade-ps8640-make-sure-we-drop-the-aux-m.patch create mode 100644 queue-6.7/drm-bridge-parade-ps8640-wait-for-hpd-when-doing-an-.patch create mode 100644 queue-6.7/drm-bridge-samsung-dsim-don-t-use-force_stop_state.patch create mode 100644 queue-6.7/drm-bridge-sii902x-fix-audio-codec-unregistration.patch create mode 100644 queue-6.7/drm-bridge-sii902x-fix-probing-race-issue.patch create mode 100644 queue-6.7/drm-exynos-fix-accidental-on-stack-copy-of-exynos_dr.patch create mode 100644 queue-6.7/drm-exynos-gsc-minor-fix-for-loop-iteration-in-gsc_r.patch create mode 100644 queue-6.7/drm-panel-raydium-rm692e5-select-config_drm_display_.patch create mode 100644 queue-6.7/drm-panel-samsung-s6d7aa0-drop-drm_bus_flag_de_high-.patch create mode 100644 queue-6.7/drm-panel-simple-add-missing-bus-flags-for-tianma-tm.patch create mode 100644 queue-6.7/firmware-arm_ffa-add-missing-rwlock_init-for-the-dri.patch create mode 100644 queue-6.7/firmware-arm_ffa-add-missing-rwlock_init-in-ffa_setu.patch create mode 100644 queue-6.7/firmware-arm_ffa-check-xa_load-return-value.patch create mode 100644 queue-6.7/firmware-arm_scmi-fix-the-clock-protocol-version-for.patch create mode 100644 queue-6.7/firmware-arm_scmi-use-xa_insert-to-store-opps.patch create mode 100644 queue-6.7/firmware-arm_scmi-use-xa_insert-when-saving-raw-queu.patch create mode 100644 queue-6.7/futex-prevent-the-reuse-of-stale-pi_state.patch create mode 100644 queue-6.7/gpio-eic-sprd-clear-interrupt-after-set-the-interrup.patch create mode 100644 queue-6.7/loongarch-smp-call-rcutree_report_cpu_starting-at-tl.patch create mode 100644 queue-6.7/memblock-fix-crash-when-reserved-memory-is-not-added.patch create mode 100644 queue-6.7/mips-lantiq-register-smp_ops-on-non-smp-platforms.patch create mode 100644 queue-6.7/platform-mellanox-mlxbf-pmc-fix-offset-calculation-f.patch create mode 100644 queue-6.7/platform-x86-intel-ifs-call-release_firmware-when-ha.patch create mode 100644 queue-6.7/platform-x86-wmi-fix-error-handling-in-legacy-wmi-no.patch create mode 100644 queue-6.7/riscv-dts-sophgo-separate-sg2042-mtime-and-mtimecmp-.patch create mode 100644 queue-6.7/spi-bcm-qspi-fix-sfdp-bfpt-read-by-usig-mspi-read.patch create mode 100644 queue-6.7/spi-fix-finalize-message-on-error-return.patch create mode 100644 queue-6.7/spi-intel-pci-remove-meteor-lake-s-soc-pci-id-from-t.patch create mode 100644 queue-6.7/spi-spi-cadence-reverse-the-order-of-interleaved-wri.patch diff --git a/queue-6.7/arm-dts-exynos4212-tab3-add-samsung-invert-vclk-flag.patch b/queue-6.7/arm-dts-exynos4212-tab3-add-samsung-invert-vclk-flag.patch new file mode 100644 index 00000000000..3203d2b26f1 --- /dev/null +++ b/queue-6.7/arm-dts-exynos4212-tab3-add-samsung-invert-vclk-flag.patch @@ -0,0 +1,40 @@ +From d315cb1145a05ff114b017f0a21ea8ecbffc0a71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jan 2024 07:53:01 +0100 +Subject: ARM: dts: exynos4212-tab3: add samsung,invert-vclk flag to fimd + +From: Artur Weber + +[ Upstream commit eab4f56d3e75dad697acf8dc2c8be3c341d6c63e ] + +After more investigation, I've found that it's not the panel driver +config that needs to be modified to invert the data polarity, but +the FIMD config. + +Add the missing invert-vclk option that is required to get the display +to work correctly. + +Fixes: ee37a457af1d ("ARM: dts: exynos: Add Samsung Galaxy Tab 3 8.0 boards") +Signed-off-by: Artur Weber +Link: https://lore.kernel.org/r/20240105-tab3-display-fixes-v2-1-904d1207bf6f@gmail.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/samsung/exynos4212-tab3.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/samsung/exynos4212-tab3.dtsi b/arch/arm/boot/dts/samsung/exynos4212-tab3.dtsi +index d7954ff466b4..e5254e32aa8f 100644 +--- a/arch/arm/boot/dts/samsung/exynos4212-tab3.dtsi ++++ b/arch/arm/boot/dts/samsung/exynos4212-tab3.dtsi +@@ -434,6 +434,7 @@ &exynos_usbphy { + }; + + &fimd { ++ samsung,invert-vclk; + status = "okay"; + }; + +-- +2.43.0 + diff --git a/queue-6.7/block-move-checking-genhd_fl_no_part-to-bdev_add_par.patch b/queue-6.7/block-move-checking-genhd_fl_no_part-to-bdev_add_par.patch new file mode 100644 index 00000000000..33284487ebf --- /dev/null +++ b/queue-6.7/block-move-checking-genhd_fl_no_part-to-bdev_add_par.patch @@ -0,0 +1,60 @@ +From fa419eea174bdbe306d524f45a5ab6c0a2b2e604 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jan 2024 21:04:01 +0800 +Subject: block: Move checking GENHD_FL_NO_PART to bdev_add_partition() + +From: Li Lingfeng + +[ Upstream commit 7777f47f2ea64efd1016262e7b59fab34adfb869 ] + +Commit 1a721de8489f ("block: don't add or resize partition on the disk +with GENHD_FL_NO_PART") prevented all operations about partitions on disks +with GENHD_FL_NO_PART in blkpg_do_ioctl() since they are meaningless. +However, it changed error code in some scenarios. So move checking +GENHD_FL_NO_PART to bdev_add_partition() to eliminate impact. + +Fixes: 1a721de8489f ("block: don't add or resize partition on the disk with GENHD_FL_NO_PART") +Reported-by: Allison Karlitskaya +Closes: https://lore.kernel.org/all/CAOYeF9VsmqKMcQjo1k6YkGNujwN-nzfxY17N3F-CMikE1tYp+w@mail.gmail.com/ +Signed-off-by: Li Lingfeng +Reviewed-by: Yu Kuai +Link: https://lore.kernel.org/r/20240118130401.792757-1-lilingfeng@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/ioctl.c | 2 -- + block/partitions/core.c | 5 +++++ + 2 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/block/ioctl.c b/block/ioctl.c +index 9c73a763ef88..438f79c564cf 100644 +--- a/block/ioctl.c ++++ b/block/ioctl.c +@@ -20,8 +20,6 @@ static int blkpg_do_ioctl(struct block_device *bdev, + struct blkpg_partition p; + sector_t start, length; + +- if (disk->flags & GENHD_FL_NO_PART) +- return -EINVAL; + if (!capable(CAP_SYS_ADMIN)) + return -EACCES; + if (copy_from_user(&p, upart, sizeof(struct blkpg_partition))) +diff --git a/block/partitions/core.c b/block/partitions/core.c +index f47ffcfdfcec..f14602022c5e 100644 +--- a/block/partitions/core.c ++++ b/block/partitions/core.c +@@ -447,6 +447,11 @@ int bdev_add_partition(struct gendisk *disk, int partno, sector_t start, + goto out; + } + ++ if (disk->flags & GENHD_FL_NO_PART) { ++ ret = -EINVAL; ++ goto out; ++ } ++ + if (partition_overlaps(disk, start, length, -1)) { + ret = -EBUSY; + goto out; +-- +2.43.0 + diff --git a/queue-6.7/cifs-fix-stray-unlock-in-cifs_chan_skip_or_disable.patch b/queue-6.7/cifs-fix-stray-unlock-in-cifs_chan_skip_or_disable.patch new file mode 100644 index 00000000000..eaf2db6cb78 --- /dev/null +++ b/queue-6.7/cifs-fix-stray-unlock-in-cifs_chan_skip_or_disable.patch @@ -0,0 +1,39 @@ +From b0e7ac8c14acacc1ba5a19cd2be944c679a1b72b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 05:07:57 +0000 +Subject: cifs: fix stray unlock in cifs_chan_skip_or_disable + +From: Shyam Prasad N + +[ Upstream commit 993d1c346b1a51ac41b2193609a0d4e51e9748f4 ] + +A recent change moved the code that decides to skip +a channel or disable multichannel entirely, into a +helper function. + +During this, a mutex_unlock of the session_mutex +should have been removed. Doing that here. + +Fixes: f591062bdbf4 ("cifs: handle servers that still advertise multichannel after disabling") +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2pdu.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c +index bfec2ca0f4e6..f5006aa97f5b 100644 +--- a/fs/smb/client/smb2pdu.c ++++ b/fs/smb/client/smb2pdu.c +@@ -195,7 +195,6 @@ cifs_chan_skip_or_disable(struct cifs_ses *ses, + pserver = server->primary_server; + cifs_signal_cifsd_for_reconnect(pserver, false); + skip_terminate: +- mutex_unlock(&ses->session_mutex); + return -EHOSTDOWN; + } + +-- +2.43.0 + diff --git a/queue-6.7/cpufreq-amd-pstate-fix-setting-scaling-max-min-freq-.patch b/queue-6.7/cpufreq-amd-pstate-fix-setting-scaling-max-min-freq-.patch new file mode 100644 index 00000000000..19d4946d225 --- /dev/null +++ b/queue-6.7/cpufreq-amd-pstate-fix-setting-scaling-max-min-freq-.patch @@ -0,0 +1,47 @@ +From 58a9b7f54a6752f01fca5bb341e247b47abb2bf1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jan 2024 05:33:19 -0600 +Subject: cpufreq/amd-pstate: Fix setting scaling max/min freq values + +From: Mario Limonciello + +[ Upstream commit 22fb4f041999f5f16ecbda15a2859b4ef4cbf47e ] + +Scaling min/max freq values were being cached and lagging a setting +each time. Fix the ordering of the clamp call to ensure they work. + +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217931 +Fixes: febab20caeba ("cpufreq/amd-pstate: Fix scaling_min_freq and scaling_max_freq update") +Signed-off-by: Mario Limonciello +Reviewed-by: Wyes Karny +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/amd-pstate.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/cpufreq/amd-pstate.c b/drivers/cpufreq/amd-pstate.c +index 1f6186475715..1791d37fbc53 100644 +--- a/drivers/cpufreq/amd-pstate.c ++++ b/drivers/cpufreq/amd-pstate.c +@@ -1232,14 +1232,13 @@ static void amd_pstate_epp_update_limit(struct cpufreq_policy *policy) + max_limit_perf = div_u64(policy->max * cpudata->highest_perf, cpudata->max_freq); + min_limit_perf = div_u64(policy->min * cpudata->highest_perf, cpudata->max_freq); + ++ WRITE_ONCE(cpudata->max_limit_perf, max_limit_perf); ++ WRITE_ONCE(cpudata->min_limit_perf, min_limit_perf); ++ + max_perf = clamp_t(unsigned long, max_perf, cpudata->min_limit_perf, + cpudata->max_limit_perf); + min_perf = clamp_t(unsigned long, min_perf, cpudata->min_limit_perf, + cpudata->max_limit_perf); +- +- WRITE_ONCE(cpudata->max_limit_perf, max_limit_perf); +- WRITE_ONCE(cpudata->min_limit_perf, min_limit_perf); +- + value = READ_ONCE(cpudata->cppc_req_cached); + + if (cpudata->policy == CPUFREQ_POLICY_PERFORMANCE) +-- +2.43.0 + diff --git a/queue-6.7/drm-bridge-anx7625-ensure-bridge-is-suspended-in-dis.patch b/queue-6.7/drm-bridge-anx7625-ensure-bridge-is-suspended-in-dis.patch new file mode 100644 index 00000000000..696ea30161d --- /dev/null +++ b/queue-6.7/drm-bridge-anx7625-ensure-bridge-is-suspended-in-dis.patch @@ -0,0 +1,86 @@ +From 0f5c28ac1b9e6a561b2e3e2384c8eebfdb7d991f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jan 2024 17:58:14 -0800 +Subject: drm/bridge: anx7625: Ensure bridge is suspended in disable() + +From: Hsin-Yi Wang + +[ Upstream commit 4d5b7daa3c610af3f322ad1e91fc0c752ff32f0e ] + +Similar to commit 26db46bc9c67 ("drm/bridge: parade-ps8640: Ensure bridge +is suspended in .post_disable()"). Add a mutex to ensure that aux transfer +won't race with atomic_disable by holding the PM reference and prevent +the bridge from suspend. + +Also we need to use pm_runtime_put_sync_suspend() to suspend the bridge +instead of idle with pm_runtime_put_sync(). + +Fixes: 3203e497eb76 ("drm/bridge: anx7625: Synchronously run runtime suspend.") +Fixes: adca62ec370c ("drm/bridge: anx7625: Support reading edid through aux channel") +Signed-off-by: Hsin-Yi Wang +Tested-by: Xuxin Xiong +Reviewed-by: Pin-yen Lin +Reviewed-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://patchwork.freedesktop.org/patch/msgid/20240118015916.2296741-1-hsinyi@chromium.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/analogix/anx7625.c | 7 ++++++- + drivers/gpu/drm/bridge/analogix/anx7625.h | 2 ++ + 2 files changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c +index 51abe42c639e..5168628f11cf 100644 +--- a/drivers/gpu/drm/bridge/analogix/anx7625.c ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c +@@ -1741,6 +1741,7 @@ static ssize_t anx7625_aux_transfer(struct drm_dp_aux *aux, + u8 request = msg->request & ~DP_AUX_I2C_MOT; + int ret = 0; + ++ mutex_lock(&ctx->aux_lock); + pm_runtime_get_sync(dev); + msg->reply = 0; + switch (request) { +@@ -1757,6 +1758,7 @@ static ssize_t anx7625_aux_transfer(struct drm_dp_aux *aux, + msg->size, msg->buffer); + pm_runtime_mark_last_busy(dev); + pm_runtime_put_autosuspend(dev); ++ mutex_unlock(&ctx->aux_lock); + + return ret; + } +@@ -2453,7 +2455,9 @@ static void anx7625_bridge_atomic_disable(struct drm_bridge *bridge, + ctx->connector = NULL; + anx7625_dp_stop(ctx); + +- pm_runtime_put_sync(dev); ++ mutex_lock(&ctx->aux_lock); ++ pm_runtime_put_sync_suspend(dev); ++ mutex_unlock(&ctx->aux_lock); + } + + static enum drm_connector_status +@@ -2647,6 +2651,7 @@ static int anx7625_i2c_probe(struct i2c_client *client) + + mutex_init(&platform->lock); + mutex_init(&platform->hdcp_wq_lock); ++ mutex_init(&platform->aux_lock); + + INIT_DELAYED_WORK(&platform->hdcp_work, hdcp_check_work_func); + platform->hdcp_workqueue = create_workqueue("hdcp workqueue"); +diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.h b/drivers/gpu/drm/bridge/analogix/anx7625.h +index 5af819611ebc..80d3fb4e985f 100644 +--- a/drivers/gpu/drm/bridge/analogix/anx7625.h ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.h +@@ -471,6 +471,8 @@ struct anx7625_data { + struct workqueue_struct *hdcp_workqueue; + /* Lock for hdcp work queue */ + struct mutex hdcp_wq_lock; ++ /* Lock for aux transfer and disable */ ++ struct mutex aux_lock; + char edid_block; + struct display_timing dt; + u8 display_timing_valid; +-- +2.43.0 + diff --git a/queue-6.7/drm-bridge-parade-ps8640-ensure-bridge-is-suspended-.patch b/queue-6.7/drm-bridge-parade-ps8640-ensure-bridge-is-suspended-.patch new file mode 100644 index 00000000000..68bae7d3e63 --- /dev/null +++ b/queue-6.7/drm-bridge-parade-ps8640-ensure-bridge-is-suspended-.patch @@ -0,0 +1,86 @@ +From 62efff1bf6970a63bc254971d556674c1e3a2a7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jan 2024 20:04:57 +0800 +Subject: drm/bridge: parade-ps8640: Ensure bridge is suspended in + .post_disable() + +From: Pin-yen Lin + +[ Upstream commit 26db46bc9c675e43230cc6accd110110a7654299 ] + +The ps8640 bridge seems to expect everything to be power cycled at the +disable process, but sometimes ps8640_aux_transfer() holds the runtime +PM reference and prevents the bridge from suspend. + +Prevent that by introducing a mutex lock between ps8640_aux_transfer() +and .post_disable() to make sure the bridge is really powered off. + +Fixes: 826cff3f7ebb ("drm/bridge: parade-ps8640: Enable runtime power management") +Signed-off-by: Pin-yen Lin +Reviewed-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://patchwork.freedesktop.org/patch/msgid/20240109120528.1292601-1-treapking@chromium.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/parade-ps8640.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/gpu/drm/bridge/parade-ps8640.c b/drivers/gpu/drm/bridge/parade-ps8640.c +index fb5e9ae9ad81..166bfc725ef4 100644 +--- a/drivers/gpu/drm/bridge/parade-ps8640.c ++++ b/drivers/gpu/drm/bridge/parade-ps8640.c +@@ -107,6 +107,7 @@ struct ps8640 { + struct device_link *link; + bool pre_enabled; + bool need_post_hpd_delay; ++ struct mutex aux_lock; + }; + + static const struct regmap_config ps8640_regmap_config[] = { +@@ -345,6 +346,7 @@ static ssize_t ps8640_aux_transfer(struct drm_dp_aux *aux, + struct device *dev = &ps_bridge->page[PAGE0_DP_CNTL]->dev; + int ret; + ++ mutex_lock(&ps_bridge->aux_lock); + pm_runtime_get_sync(dev); + ret = _ps8640_wait_hpd_asserted(ps_bridge, 200 * 1000); + if (ret) { +@@ -354,6 +356,7 @@ static ssize_t ps8640_aux_transfer(struct drm_dp_aux *aux, + ret = ps8640_aux_transfer_msg(aux, msg); + pm_runtime_mark_last_busy(dev); + pm_runtime_put_autosuspend(dev); ++ mutex_unlock(&ps_bridge->aux_lock); + + return ret; + } +@@ -475,7 +478,18 @@ static void ps8640_atomic_post_disable(struct drm_bridge *bridge, + ps_bridge->pre_enabled = false; + + ps8640_bridge_vdo_control(ps_bridge, DISABLE); ++ ++ /* ++ * The bridge seems to expect everything to be power cycled at the ++ * disable process, so grab a lock here to make sure ++ * ps8640_aux_transfer() is not holding a runtime PM reference and ++ * preventing the bridge from suspend. ++ */ ++ mutex_lock(&ps_bridge->aux_lock); ++ + pm_runtime_put_sync_suspend(&ps_bridge->page[PAGE0_DP_CNTL]->dev); ++ ++ mutex_unlock(&ps_bridge->aux_lock); + } + + static int ps8640_bridge_attach(struct drm_bridge *bridge, +@@ -624,6 +638,8 @@ static int ps8640_probe(struct i2c_client *client) + if (!ps_bridge) + return -ENOMEM; + ++ mutex_init(&ps_bridge->aux_lock); ++ + ps_bridge->supplies[0].supply = "vdd12"; + ps_bridge->supplies[1].supply = "vdd33"; + ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(ps_bridge->supplies), +-- +2.43.0 + diff --git a/queue-6.7/drm-bridge-parade-ps8640-make-sure-we-drop-the-aux-m.patch b/queue-6.7/drm-bridge-parade-ps8640-make-sure-we-drop-the-aux-m.patch new file mode 100644 index 00000000000..e59ac19b50e --- /dev/null +++ b/queue-6.7/drm-bridge-parade-ps8640-make-sure-we-drop-the-aux-m.patch @@ -0,0 +1,46 @@ +From 81fc49df427c4c8c7bd0427a3b722dd037e462c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jan 2024 10:35:03 -0800 +Subject: drm/bridge: parade-ps8640: Make sure we drop the AUX mutex in the + error case + +From: Douglas Anderson + +[ Upstream commit a20f1b02bafcbf5a32d96a1d4185d6981cf7d016 ] + +After commit 26db46bc9c67 ("drm/bridge: parade-ps8640: Ensure bridge +is suspended in .post_disable()"), if we hit the error case in +ps8640_aux_transfer() then we return without dropping the mutex. Fix +this oversight. + +Fixes: 26db46bc9c67 ("drm/bridge: parade-ps8640: Ensure bridge is suspended in .post_disable()") +Reviewed-by: Hsin-Yi Wang +Signed-off-by: Douglas Anderson +Link: https://patchwork.freedesktop.org/patch/msgid/20240117103502.1.Ib726a0184913925efc7e99c4d4fc801982e1bc24@changeid +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/parade-ps8640.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/parade-ps8640.c b/drivers/gpu/drm/bridge/parade-ps8640.c +index 166bfc725ef4..14d4dcf239da 100644 +--- a/drivers/gpu/drm/bridge/parade-ps8640.c ++++ b/drivers/gpu/drm/bridge/parade-ps8640.c +@@ -351,11 +351,13 @@ static ssize_t ps8640_aux_transfer(struct drm_dp_aux *aux, + ret = _ps8640_wait_hpd_asserted(ps_bridge, 200 * 1000); + if (ret) { + pm_runtime_put_sync_suspend(dev); +- return ret; ++ goto exit; + } + ret = ps8640_aux_transfer_msg(aux, msg); + pm_runtime_mark_last_busy(dev); + pm_runtime_put_autosuspend(dev); ++ ++exit: + mutex_unlock(&ps_bridge->aux_lock); + + return ret; +-- +2.43.0 + diff --git a/queue-6.7/drm-bridge-parade-ps8640-wait-for-hpd-when-doing-an-.patch b/queue-6.7/drm-bridge-parade-ps8640-wait-for-hpd-when-doing-an-.patch new file mode 100644 index 00000000000..58dafa82e71 --- /dev/null +++ b/queue-6.7/drm-bridge-parade-ps8640-wait-for-hpd-when-doing-an-.patch @@ -0,0 +1,51 @@ +From ebd2e72fb4ab946e9e535399c0f53a481e01db3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Dec 2023 13:55:48 -0800 +Subject: drm/bridge: parade-ps8640: Wait for HPD when doing an AUX transfer + +From: Douglas Anderson + +[ Upstream commit 024b32db43a359e0ded3fcc6cd86247cbbed4224 ] + +Unlike what is claimed in commit f5aa7d46b0ee ("drm/bridge: +parade-ps8640: Provide wait_hpd_asserted() in struct drm_dp_aux"), if +someone manually tries to do an AUX transfer (like via `i2cdump ${bus} +0x50 i`) while the panel is off we don't just get a simple transfer +error. Instead, the whole ps8640 gets thrown for a loop and goes into +a bad state. + +Let's put the function to wait for the HPD (and the magical 50 ms +after first reset) back in when we're doing an AUX transfer. This +shouldn't actually make things much slower (assuming the panel is on) +because we should immediately poll and see the HPD high. Mostly this +is just an extra i2c transfer to the bridge. + +Fixes: f5aa7d46b0ee ("drm/bridge: parade-ps8640: Provide wait_hpd_asserted() in struct drm_dp_aux") +Tested-by: Pin-yen Lin +Reviewed-by: Pin-yen Lin +Signed-off-by: Douglas Anderson +Link: https://patchwork.freedesktop.org/patch/msgid/20231221135548.1.I10f326a9305d57ad32cee7f8d9c60518c8be20fb@changeid +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/parade-ps8640.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/bridge/parade-ps8640.c b/drivers/gpu/drm/bridge/parade-ps8640.c +index 541e4f5afc4c..fb5e9ae9ad81 100644 +--- a/drivers/gpu/drm/bridge/parade-ps8640.c ++++ b/drivers/gpu/drm/bridge/parade-ps8640.c +@@ -346,6 +346,11 @@ static ssize_t ps8640_aux_transfer(struct drm_dp_aux *aux, + int ret; + + pm_runtime_get_sync(dev); ++ ret = _ps8640_wait_hpd_asserted(ps_bridge, 200 * 1000); ++ if (ret) { ++ pm_runtime_put_sync_suspend(dev); ++ return ret; ++ } + ret = ps8640_aux_transfer_msg(aux, msg); + pm_runtime_mark_last_busy(dev); + pm_runtime_put_autosuspend(dev); +-- +2.43.0 + diff --git a/queue-6.7/drm-bridge-samsung-dsim-don-t-use-force_stop_state.patch b/queue-6.7/drm-bridge-samsung-dsim-don-t-use-force_stop_state.patch new file mode 100644 index 00000000000..14e45b2b8c7 --- /dev/null +++ b/queue-6.7/drm-bridge-samsung-dsim-don-t-use-force_stop_state.patch @@ -0,0 +1,129 @@ +From 2860fbf5bb4345f45798f33bbf58d39830938647 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Nov 2023 17:43:44 +0100 +Subject: drm: bridge: samsung-dsim: Don't use FORCE_STOP_STATE + +From: Michael Walle + +[ Upstream commit ff3d5d04db07e5374758baa7e877fde8d683ebab ] + +The FORCE_STOP_STATE bit is unsuitable to force the DSI link into LP-11 +mode. It seems the bridge internally queues DSI packets and when the +FORCE_STOP_STATE bit is cleared, they are sent in close succession +without any useful timing (this also means that the DSI lanes won't go +into LP-11 mode). The length of this gibberish varies between 1ms and +5ms. This sometimes breaks an attached bridge (TI SN65DSI84 in this +case). In our case, the bridge will fail in about 1 per 500 reboots. + +The FORCE_STOP_STATE handling was introduced to have the DSI lanes in +LP-11 state during the .pre_enable phase. But as it turns out, none of +this is needed at all. Between samsung_dsim_init() and +samsung_dsim_set_display_enable() the lanes are already in LP-11 mode. +The code as it was before commit 20c827683de0 ("drm: bridge: +samsung-dsim: Fix init during host transfer") and 0c14d3130654 ("drm: +bridge: samsung-dsim: Fix i.MX8M enable flow to meet spec") was correct +in this regard. + +This patch basically reverts both commits. It was tested on an i.MX8M +SoC with an SN65DSI84 bridge. The signals were probed and the DSI +packets were decoded during initialization and link start-up. After this +patch the first DSI packet on the link is a VSYNC packet and the timing +is correct. + +Command mode between .pre_enable and .enable was also briefly tested by +a quick hack. There was no DSI link partner which would have responded, +but it was made sure the DSI packet was send on the link. As a side +note, the command mode seems to just work in HS mode. I couldn't find +that the bridge will handle commands in LP mode. + +Fixes: 20c827683de0 ("drm: bridge: samsung-dsim: Fix init during host transfer") +Fixes: 0c14d3130654 ("drm: bridge: samsung-dsim: Fix i.MX8M enable flow to meet spec") +Signed-off-by: Michael Walle +Signed-off-by: Inki Dae +Link: https://patchwork.freedesktop.org/patch/msgid/20231113164344.1612602-1-mwalle@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/samsung-dsim.c | 32 ++------------------------- + 1 file changed, 2 insertions(+), 30 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/samsung-dsim.c b/drivers/gpu/drm/bridge/samsung-dsim.c +index be5914caa17d..63a1a0c88be4 100644 +--- a/drivers/gpu/drm/bridge/samsung-dsim.c ++++ b/drivers/gpu/drm/bridge/samsung-dsim.c +@@ -969,10 +969,6 @@ static int samsung_dsim_init_link(struct samsung_dsim *dsi) + reg = samsung_dsim_read(dsi, DSIM_ESCMODE_REG); + reg &= ~DSIM_STOP_STATE_CNT_MASK; + reg |= DSIM_STOP_STATE_CNT(driver_data->reg_values[STOP_STATE_CNT]); +- +- if (!samsung_dsim_hw_is_exynos(dsi->plat_data->hw_type)) +- reg |= DSIM_FORCE_STOP_STATE; +- + samsung_dsim_write(dsi, DSIM_ESCMODE_REG, reg); + + reg = DSIM_BTA_TIMEOUT(0xff) | DSIM_LPDR_TIMEOUT(0xffff); +@@ -1431,18 +1427,6 @@ static void samsung_dsim_disable_irq(struct samsung_dsim *dsi) + disable_irq(dsi->irq); + } + +-static void samsung_dsim_set_stop_state(struct samsung_dsim *dsi, bool enable) +-{ +- u32 reg = samsung_dsim_read(dsi, DSIM_ESCMODE_REG); +- +- if (enable) +- reg |= DSIM_FORCE_STOP_STATE; +- else +- reg &= ~DSIM_FORCE_STOP_STATE; +- +- samsung_dsim_write(dsi, DSIM_ESCMODE_REG, reg); +-} +- + static int samsung_dsim_init(struct samsung_dsim *dsi) + { + const struct samsung_dsim_driver_data *driver_data = dsi->driver_data; +@@ -1492,9 +1476,6 @@ static void samsung_dsim_atomic_pre_enable(struct drm_bridge *bridge, + ret = samsung_dsim_init(dsi); + if (ret) + return; +- +- samsung_dsim_set_display_mode(dsi); +- samsung_dsim_set_display_enable(dsi, true); + } + } + +@@ -1503,12 +1484,8 @@ static void samsung_dsim_atomic_enable(struct drm_bridge *bridge, + { + struct samsung_dsim *dsi = bridge_to_dsi(bridge); + +- if (samsung_dsim_hw_is_exynos(dsi->plat_data->hw_type)) { +- samsung_dsim_set_display_mode(dsi); +- samsung_dsim_set_display_enable(dsi, true); +- } else { +- samsung_dsim_set_stop_state(dsi, false); +- } ++ samsung_dsim_set_display_mode(dsi); ++ samsung_dsim_set_display_enable(dsi, true); + + dsi->state |= DSIM_STATE_VIDOUT_AVAILABLE; + } +@@ -1521,9 +1498,6 @@ static void samsung_dsim_atomic_disable(struct drm_bridge *bridge, + if (!(dsi->state & DSIM_STATE_ENABLED)) + return; + +- if (!samsung_dsim_hw_is_exynos(dsi->plat_data->hw_type)) +- samsung_dsim_set_stop_state(dsi, true); +- + dsi->state &= ~DSIM_STATE_VIDOUT_AVAILABLE; + } + +@@ -1828,8 +1802,6 @@ static ssize_t samsung_dsim_host_transfer(struct mipi_dsi_host *host, + if (ret) + return ret; + +- samsung_dsim_set_stop_state(dsi, false); +- + ret = mipi_dsi_create_packet(&xfer.packet, msg); + if (ret < 0) + return ret; +-- +2.43.0 + diff --git a/queue-6.7/drm-bridge-sii902x-fix-audio-codec-unregistration.patch b/queue-6.7/drm-bridge-sii902x-fix-audio-codec-unregistration.patch new file mode 100644 index 00000000000..918347f7356 --- /dev/null +++ b/queue-6.7/drm-bridge-sii902x-fix-audio-codec-unregistration.patch @@ -0,0 +1,85 @@ +From 661e3f0e8adee3a7a39f658731a474127ea8932b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jan 2024 15:31:08 +0200 +Subject: drm/bridge: sii902x: Fix audio codec unregistration + +From: Tomi Valkeinen + +[ Upstream commit 3fc6c76a8d208d3955c9e64b382d0ff370bc61fc ] + +The driver never unregisters the audio codec platform device, which can +lead to a crash on module reloading, nor does it handle the return value +from sii902x_audio_codec_init(). + +Signed-off-by: Tomi Valkeinen +Fixes: ff5781634c41 ("drm/bridge: sii902x: Implement HDMI audio support") +Cc: Jyri Sarha +Acked-by: Linus Walleij +Link: https://lore.kernel.org/r/20240103-si902x-fixes-v1-2-b9fd3e448411@ideasonboard.com +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20240103-si902x-fixes-v1-2-b9fd3e448411@ideasonboard.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/sii902x.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/sii902x.c b/drivers/gpu/drm/bridge/sii902x.c +index 69da73e414a9..4560ae9cbce1 100644 +--- a/drivers/gpu/drm/bridge/sii902x.c ++++ b/drivers/gpu/drm/bridge/sii902x.c +@@ -1080,7 +1080,9 @@ static int sii902x_init(struct sii902x *sii902x) + return ret; + } + +- sii902x_audio_codec_init(sii902x, dev); ++ ret = sii902x_audio_codec_init(sii902x, dev); ++ if (ret) ++ return ret; + + i2c_set_clientdata(sii902x->i2c, sii902x); + +@@ -1088,13 +1090,15 @@ static int sii902x_init(struct sii902x *sii902x) + 1, 0, I2C_MUX_GATE, + sii902x_i2c_bypass_select, + sii902x_i2c_bypass_deselect); +- if (!sii902x->i2cmux) +- return -ENOMEM; ++ if (!sii902x->i2cmux) { ++ ret = -ENOMEM; ++ goto err_unreg_audio; ++ } + + sii902x->i2cmux->priv = sii902x; + ret = i2c_mux_add_adapter(sii902x->i2cmux, 0, 0, 0); + if (ret) +- return ret; ++ goto err_unreg_audio; + + sii902x->bridge.funcs = &sii902x_bridge_funcs; + sii902x->bridge.of_node = dev->of_node; +@@ -1107,6 +1111,12 @@ static int sii902x_init(struct sii902x *sii902x) + drm_bridge_add(&sii902x->bridge); + + return 0; ++ ++err_unreg_audio: ++ if (!PTR_ERR_OR_ZERO(sii902x->audio.pdev)) ++ platform_device_unregister(sii902x->audio.pdev); ++ ++ return ret; + } + + static int sii902x_probe(struct i2c_client *client) +@@ -1179,6 +1189,9 @@ static void sii902x_remove(struct i2c_client *client) + + drm_bridge_remove(&sii902x->bridge); + i2c_mux_del_adapters(sii902x->i2cmux); ++ ++ if (!PTR_ERR_OR_ZERO(sii902x->audio.pdev)) ++ platform_device_unregister(sii902x->audio.pdev); + } + + static const struct of_device_id sii902x_dt_ids[] = { +-- +2.43.0 + diff --git a/queue-6.7/drm-bridge-sii902x-fix-probing-race-issue.patch b/queue-6.7/drm-bridge-sii902x-fix-probing-race-issue.patch new file mode 100644 index 00000000000..f36098c1552 --- /dev/null +++ b/queue-6.7/drm-bridge-sii902x-fix-probing-race-issue.patch @@ -0,0 +1,130 @@ +From 391eeffa0041d7cbc2e60fe2528e7ad11e4c39fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jan 2024 15:31:07 +0200 +Subject: drm/bridge: sii902x: Fix probing race issue + +From: Tomi Valkeinen + +[ Upstream commit 08ac6f132dd77e40f786d8af51140c96c6d739c9 ] + +A null pointer dereference crash has been observed rarely on TI +platforms using sii9022 bridge: + +[ 53.271356] sii902x_get_edid+0x34/0x70 [sii902x] +[ 53.276066] sii902x_bridge_get_edid+0x14/0x20 [sii902x] +[ 53.281381] drm_bridge_get_edid+0x20/0x34 [drm] +[ 53.286305] drm_bridge_connector_get_modes+0x8c/0xcc [drm_kms_helper] +[ 53.292955] drm_helper_probe_single_connector_modes+0x190/0x538 [drm_kms_helper] +[ 53.300510] drm_client_modeset_probe+0x1f0/0xbd4 [drm] +[ 53.305958] __drm_fb_helper_initial_config_and_unlock+0x50/0x510 [drm_kms_helper] +[ 53.313611] drm_fb_helper_initial_config+0x48/0x58 [drm_kms_helper] +[ 53.320039] drm_fbdev_dma_client_hotplug+0x84/0xd4 [drm_dma_helper] +[ 53.326401] drm_client_register+0x5c/0xa0 [drm] +[ 53.331216] drm_fbdev_dma_setup+0xc8/0x13c [drm_dma_helper] +[ 53.336881] tidss_probe+0x128/0x264 [tidss] +[ 53.341174] platform_probe+0x68/0xc4 +[ 53.344841] really_probe+0x188/0x3c4 +[ 53.348501] __driver_probe_device+0x7c/0x16c +[ 53.352854] driver_probe_device+0x3c/0x10c +[ 53.357033] __device_attach_driver+0xbc/0x158 +[ 53.361472] bus_for_each_drv+0x88/0xe8 +[ 53.365303] __device_attach+0xa0/0x1b4 +[ 53.369135] device_initial_probe+0x14/0x20 +[ 53.373314] bus_probe_device+0xb0/0xb4 +[ 53.377145] deferred_probe_work_func+0xcc/0x124 +[ 53.381757] process_one_work+0x1f0/0x518 +[ 53.385770] worker_thread+0x1e8/0x3dc +[ 53.389519] kthread+0x11c/0x120 +[ 53.392750] ret_from_fork+0x10/0x20 + +The issue here is as follows: + +- tidss probes, but is deferred as sii902x is still missing. +- sii902x starts probing and enters sii902x_init(). +- sii902x calls drm_bridge_add(). Now the sii902x bridge is ready from + DRM's perspective. +- sii902x calls sii902x_audio_codec_init() and + platform_device_register_data() +- The registration of the audio platform device causes probing of the + deferred devices. +- tidss probes, which eventually causes sii902x_bridge_get_edid() to be + called. +- sii902x_bridge_get_edid() tries to use the i2c to read the edid. + However, the sii902x driver has not set up the i2c part yet, leading + to the crash. + +Fix this by moving the drm_bridge_add() to the end of the +sii902x_init(), which is also at the very end of sii902x_probe(). + +Signed-off-by: Tomi Valkeinen +Fixes: 21d808405fe4 ("drm/bridge/sii902x: Fix EDID readback") +Acked-by: Linus Walleij +Link: https://lore.kernel.org/r/20240103-si902x-fixes-v1-1-b9fd3e448411@ideasonboard.com +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20240103-si902x-fixes-v1-1-b9fd3e448411@ideasonboard.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/sii902x.c | 29 ++++++++++++++++------------- + 1 file changed, 16 insertions(+), 13 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/sii902x.c b/drivers/gpu/drm/bridge/sii902x.c +index 2bdc5b439beb..69da73e414a9 100644 +--- a/drivers/gpu/drm/bridge/sii902x.c ++++ b/drivers/gpu/drm/bridge/sii902x.c +@@ -1080,16 +1080,6 @@ static int sii902x_init(struct sii902x *sii902x) + return ret; + } + +- sii902x->bridge.funcs = &sii902x_bridge_funcs; +- sii902x->bridge.of_node = dev->of_node; +- sii902x->bridge.timings = &default_sii902x_timings; +- sii902x->bridge.ops = DRM_BRIDGE_OP_DETECT | DRM_BRIDGE_OP_EDID; +- +- if (sii902x->i2c->irq > 0) +- sii902x->bridge.ops |= DRM_BRIDGE_OP_HPD; +- +- drm_bridge_add(&sii902x->bridge); +- + sii902x_audio_codec_init(sii902x, dev); + + i2c_set_clientdata(sii902x->i2c, sii902x); +@@ -1102,7 +1092,21 @@ static int sii902x_init(struct sii902x *sii902x) + return -ENOMEM; + + sii902x->i2cmux->priv = sii902x; +- return i2c_mux_add_adapter(sii902x->i2cmux, 0, 0, 0); ++ ret = i2c_mux_add_adapter(sii902x->i2cmux, 0, 0, 0); ++ if (ret) ++ return ret; ++ ++ sii902x->bridge.funcs = &sii902x_bridge_funcs; ++ sii902x->bridge.of_node = dev->of_node; ++ sii902x->bridge.timings = &default_sii902x_timings; ++ sii902x->bridge.ops = DRM_BRIDGE_OP_DETECT | DRM_BRIDGE_OP_EDID; ++ ++ if (sii902x->i2c->irq > 0) ++ sii902x->bridge.ops |= DRM_BRIDGE_OP_HPD; ++ ++ drm_bridge_add(&sii902x->bridge); ++ ++ return 0; + } + + static int sii902x_probe(struct i2c_client *client) +@@ -1170,12 +1174,11 @@ static int sii902x_probe(struct i2c_client *client) + } + + static void sii902x_remove(struct i2c_client *client) +- + { + struct sii902x *sii902x = i2c_get_clientdata(client); + +- i2c_mux_del_adapters(sii902x->i2cmux); + drm_bridge_remove(&sii902x->bridge); ++ i2c_mux_del_adapters(sii902x->i2cmux); + } + + static const struct of_device_id sii902x_dt_ids[] = { +-- +2.43.0 + diff --git a/queue-6.7/drm-exynos-fix-accidental-on-stack-copy-of-exynos_dr.patch b/queue-6.7/drm-exynos-fix-accidental-on-stack-copy-of-exynos_dr.patch new file mode 100644 index 00000000000..35952e3e227 --- /dev/null +++ b/queue-6.7/drm-exynos-fix-accidental-on-stack-copy-of-exynos_dr.patch @@ -0,0 +1,66 @@ +From d509e6a0e4ced504ba4ea23c403e1bdbd7b99c27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Dec 2023 13:32:15 +0100 +Subject: drm/exynos: fix accidental on-stack copy of exynos_drm_plane + +From: Arnd Bergmann + +[ Upstream commit 960b537e91725bcb17dd1b19e48950e62d134078 ] + +gcc rightfully complains about excessive stack usage in the fimd_win_set_pixfmt() +function: + +drivers/gpu/drm/exynos/exynos_drm_fimd.c: In function 'fimd_win_set_pixfmt': +drivers/gpu/drm/exynos/exynos_drm_fimd.c:750:1: error: the frame size of 1032 bytes is larger than 1024 byte +drivers/gpu/drm/exynos/exynos5433_drm_decon.c: In function 'decon_win_set_pixfmt': +drivers/gpu/drm/exynos/exynos5433_drm_decon.c:381:1: error: the frame size of 1032 bytes is larger than 1024 bytes + +There is really no reason to copy the large exynos_drm_plane +structure to the stack before using one of its members, so just +use a pointer instead. + +Fixes: 6f8ee5c21722 ("drm/exynos: fimd: Make plane alpha configurable") +Signed-off-by: Arnd Bergmann +Reviewed-by: Marek Szyprowski +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos5433_drm_decon.c | 4 ++-- + drivers/gpu/drm/exynos/exynos_drm_fimd.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c +index 4d986077738b..bce027552474 100644 +--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c ++++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c +@@ -319,9 +319,9 @@ static void decon_win_set_bldmod(struct decon_context *ctx, unsigned int win, + static void decon_win_set_pixfmt(struct decon_context *ctx, unsigned int win, + struct drm_framebuffer *fb) + { +- struct exynos_drm_plane plane = ctx->planes[win]; ++ struct exynos_drm_plane *plane = &ctx->planes[win]; + struct exynos_drm_plane_state *state = +- to_exynos_plane_state(plane.base.state); ++ to_exynos_plane_state(plane->base.state); + unsigned int alpha = state->base.alpha; + unsigned int pixel_alpha; + unsigned long val; +diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c +index 8dde7b1e9b35..5bdc246f5fad 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c +@@ -661,9 +661,9 @@ static void fimd_win_set_bldmod(struct fimd_context *ctx, unsigned int win, + static void fimd_win_set_pixfmt(struct fimd_context *ctx, unsigned int win, + struct drm_framebuffer *fb, int width) + { +- struct exynos_drm_plane plane = ctx->planes[win]; ++ struct exynos_drm_plane *plane = &ctx->planes[win]; + struct exynos_drm_plane_state *state = +- to_exynos_plane_state(plane.base.state); ++ to_exynos_plane_state(plane->base.state); + uint32_t pixel_format = fb->format->format; + unsigned int alpha = state->base.alpha; + u32 val = WINCONx_ENWIN; +-- +2.43.0 + diff --git a/queue-6.7/drm-exynos-gsc-minor-fix-for-loop-iteration-in-gsc_r.patch b/queue-6.7/drm-exynos-gsc-minor-fix-for-loop-iteration-in-gsc_r.patch new file mode 100644 index 00000000000..4857041d6e7 --- /dev/null +++ b/queue-6.7/drm-exynos-gsc-minor-fix-for-loop-iteration-in-gsc_r.patch @@ -0,0 +1,39 @@ +From 3629a80be4134d79b70dfb9b39bebf16266a5179 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Dec 2023 12:53:15 +0300 +Subject: drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume + +From: Fedor Pchelkin + +[ Upstream commit 4050957c7c2c14aa795dbf423b4180d5ac04e113 ] + +Do not forget to call clk_disable_unprepare() on the first element of +ctx->clocks array. + +Found by Linux Verification Center (linuxtesting.org). + +Fixes: 8b7d3ec83aba ("drm/exynos: gsc: Convert driver to IPP v2 core API") +Signed-off-by: Fedor Pchelkin +Reviewed-by: Marek Szyprowski +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos_drm_gsc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c +index 34cdabc30b4f..5302bebbe38c 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c +@@ -1342,7 +1342,7 @@ static int __maybe_unused gsc_runtime_resume(struct device *dev) + for (i = 0; i < ctx->num_clocks; i++) { + ret = clk_prepare_enable(ctx->clocks[i]); + if (ret) { +- while (--i > 0) ++ while (--i >= 0) + clk_disable_unprepare(ctx->clocks[i]); + return ret; + } +-- +2.43.0 + diff --git a/queue-6.7/drm-panel-raydium-rm692e5-select-config_drm_display_.patch b/queue-6.7/drm-panel-raydium-rm692e5-select-config_drm_display_.patch new file mode 100644 index 00000000000..214b53fb111 --- /dev/null +++ b/queue-6.7/drm-panel-raydium-rm692e5-select-config_drm_display_.patch @@ -0,0 +1,44 @@ +From 268babb74274b785274a491fe167d2317b1d891e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Oct 2023 13:55:58 +0200 +Subject: drm/panel/raydium-rm692e5: select CONFIG_DRM_DISPLAY_DP_HELPER + +From: Arnd Bergmann + +[ Upstream commit 589830b13ac21bddf99b9bc5a4ec17813d0869ef ] + +As with several other panel drivers, this fails to link without the DP +helper library: + +ld: drivers/gpu/drm/panel/panel-raydium-rm692e5.o: in function `rm692e5_prepare': +panel-raydium-rm692e5.c:(.text+0x11f4): undefined reference to `drm_dsc_pps_payload_pack' + +Select the same symbols that the others already use. + +Fixes: 988d0ff29ecf7 ("drm/panel: Add driver for BOE RM692E5 AMOLED panel") +Signed-off-by: Arnd Bergmann +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20231023115619.3551348-1-arnd@kernel.org +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20231023115619.3551348-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/Kconfig | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/panel/Kconfig b/drivers/gpu/drm/panel/Kconfig +index 99e14dc212ec..a4ac4b47777f 100644 +--- a/drivers/gpu/drm/panel/Kconfig ++++ b/drivers/gpu/drm/panel/Kconfig +@@ -530,6 +530,8 @@ config DRM_PANEL_RAYDIUM_RM692E5 + depends on OF + depends on DRM_MIPI_DSI + depends on BACKLIGHT_CLASS_DEVICE ++ select DRM_DISPLAY_DP_HELPER ++ select DRM_DISPLAY_HELPER + help + Say Y here if you want to enable support for Raydium RM692E5-based + display panels, such as the one found in the Fairphone 5 smartphone. +-- +2.43.0 + diff --git a/queue-6.7/drm-panel-samsung-s6d7aa0-drop-drm_bus_flag_de_high-.patch b/queue-6.7/drm-panel-samsung-s6d7aa0-drop-drm_bus_flag_de_high-.patch new file mode 100644 index 00000000000..0c1c38039ee --- /dev/null +++ b/queue-6.7/drm-panel-samsung-s6d7aa0-drop-drm_bus_flag_de_high-.patch @@ -0,0 +1,42 @@ +From 81552d2abae99f72b82668fcf0cd99181293e5fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jan 2024 07:53:02 +0100 +Subject: drm/panel: samsung-s6d7aa0: drop DRM_BUS_FLAG_DE_HIGH for lsl080al02 + +From: Artur Weber + +[ Upstream commit 62b143b5ec4a14e1ae0dede5aabaf1832e3b0073 ] + +It turns out that I had misconfigured the device I was using the panel +with; the bus data polarity is not high for this panel, I had to change +the config on the display controller's side. + +Fix the panel config to properly reflect its accurate settings. + +Fixes: 6810bb390282 ("drm/panel: Add Samsung S6D7AA0 panel controller driver") +Reviewed-by: Jessica Zhang +Signed-off-by: Artur Weber +Link: https://lore.kernel.org/r/20240105-tab3-display-fixes-v2-2-904d1207bf6f@gmail.com +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20240105-tab3-display-fixes-v2-2-904d1207bf6f@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-samsung-s6d7aa0.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-samsung-s6d7aa0.c b/drivers/gpu/drm/panel/panel-samsung-s6d7aa0.c +index ea5a85779382..f23d8832a1ad 100644 +--- a/drivers/gpu/drm/panel/panel-samsung-s6d7aa0.c ++++ b/drivers/gpu/drm/panel/panel-samsung-s6d7aa0.c +@@ -309,7 +309,7 @@ static const struct s6d7aa0_panel_desc s6d7aa0_lsl080al02_desc = { + .off_func = s6d7aa0_lsl080al02_off, + .drm_mode = &s6d7aa0_lsl080al02_mode, + .mode_flags = MIPI_DSI_MODE_VSYNC_FLUSH | MIPI_DSI_MODE_VIDEO_NO_HFP, +- .bus_flags = DRM_BUS_FLAG_DE_HIGH, ++ .bus_flags = 0, + + .has_backlight = false, + .use_passwd3 = false, +-- +2.43.0 + diff --git a/queue-6.7/drm-panel-simple-add-missing-bus-flags-for-tianma-tm.patch b/queue-6.7/drm-panel-simple-add-missing-bus-flags-for-tianma-tm.patch new file mode 100644 index 00000000000..70e7c5aa1d2 --- /dev/null +++ b/queue-6.7/drm-panel-simple-add-missing-bus-flags-for-tianma-tm.patch @@ -0,0 +1,49 @@ +From 38a88faf9e7c010929d52b253fc65db6dec2e235 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Oct 2023 10:42:08 +0200 +Subject: drm: panel-simple: add missing bus flags for Tianma tm070jvhg[30/33] + +From: Markus Niebel + +[ Upstream commit 45dd7df26cee741b31c25ffdd44fb8794eb45ccd ] + +The DE signal is active high on this display, fill in the missing +bus_flags. This aligns panel_desc with its display_timing. + +Fixes: 9a2654c0f62a ("drm/panel: Add and fill drm_panel type field") +Fixes: b3bfcdf8a3b6 ("drm/panel: simple: add Tianma TM070JVHG33") + +Signed-off-by: Markus Niebel +Signed-off-by: Alexander Stein +Reviewed-by: Sam Ravnborg +Link: https://lore.kernel.org/r/20231012084208.2731650-1-alexander.stein@ew.tq-group.com +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20231012084208.2731650-1-alexander.stein@ew.tq-group.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-simple.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index 9367a4572dcf..1ba633fd5696 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -3861,6 +3861,7 @@ static const struct panel_desc tianma_tm070jdhg30 = { + }, + .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, + .connector_type = DRM_MODE_CONNECTOR_LVDS, ++ .bus_flags = DRM_BUS_FLAG_DE_HIGH, + }; + + static const struct panel_desc tianma_tm070jvhg33 = { +@@ -3873,6 +3874,7 @@ static const struct panel_desc tianma_tm070jvhg33 = { + }, + .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, + .connector_type = DRM_MODE_CONNECTOR_LVDS, ++ .bus_flags = DRM_BUS_FLAG_DE_HIGH, + }; + + static const struct display_timing tianma_tm070rvhg71_timing = { +-- +2.43.0 + diff --git a/queue-6.7/firmware-arm_ffa-add-missing-rwlock_init-for-the-dri.patch b/queue-6.7/firmware-arm_ffa-add-missing-rwlock_init-for-the-dri.patch new file mode 100644 index 00000000000..f6473c9bda7 --- /dev/null +++ b/queue-6.7/firmware-arm_ffa-add-missing-rwlock_init-for-the-dri.patch @@ -0,0 +1,38 @@ +From 0798ad1d14fa306b796e56cd485d0b907c0a754c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jan 2024 12:34:12 +0000 +Subject: firmware: arm_ffa: Add missing rwlock_init() for the driver partition + +From: Cristian Marussi + +[ Upstream commit 5ff30ade16cd9efc2466d3ea22bbaf370772941a ] + +Add the missing rwlock initialization for the FF-A partition associated +the driver in ffa_setup_partitions(). It will the primary scheduler +partition in the host or the VM partition in the virtualised environment. +IOW, it corresponds to the partition with VM ID == drv_info->vm_id. + +Fixes: 1b6bf41b7a65 ("firmware: arm_ffa: Add notification handling mechanism") +Signed-off-by: Cristian Marussi +Link: https://lore.kernel.org/r/20240108-ffa_fixes_6-8-v1-2-75bf7035bc50@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_ffa/driver.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c +index ed1d6a24934e..8df92c9521f4 100644 +--- a/drivers/firmware/arm_ffa/driver.c ++++ b/drivers/firmware/arm_ffa/driver.c +@@ -1237,6 +1237,7 @@ static void ffa_setup_partitions(void) + info = kzalloc(sizeof(*info), GFP_KERNEL); + if (!info) + return; ++ rwlock_init(&info->rw_lock); + xa_store(&drv_info->partition_info, drv_info->vm_id, info, GFP_KERNEL); + drv_info->partition_count++; + } +-- +2.43.0 + diff --git a/queue-6.7/firmware-arm_ffa-add-missing-rwlock_init-in-ffa_setu.patch b/queue-6.7/firmware-arm_ffa-add-missing-rwlock_init-in-ffa_setu.patch new file mode 100644 index 00000000000..6eaaa3e4bad --- /dev/null +++ b/queue-6.7/firmware-arm_ffa-add-missing-rwlock_init-in-ffa_setu.patch @@ -0,0 +1,37 @@ +From 760cd70e7368ed3b960c057d0578147a8a5c30ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jan 2024 12:34:11 +0000 +Subject: firmware: arm_ffa: Add missing rwlock_init() in + ffa_setup_partitions() + +From: Cristian Marussi + +[ Upstream commit 59b2e242b13192e50bf47df3780bf8a7e2260e98 ] + +Add the missing rwlock initialization for the individual FF-A partition +information in ffa_setup_partitions(). + +Fixes: 0184450b8b1e ("firmware: arm_ffa: Add schedule receiver callback mechanism") +Signed-off-by: Cristian Marussi +Link: https://lore.kernel.org/r/20240108-ffa_fixes_6-8-v1-1-75bf7035bc50@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_ffa/driver.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c +index 6146b2927d5c..ed1d6a24934e 100644 +--- a/drivers/firmware/arm_ffa/driver.c ++++ b/drivers/firmware/arm_ffa/driver.c +@@ -1226,6 +1226,7 @@ static void ffa_setup_partitions(void) + ffa_device_unregister(ffa_dev); + continue; + } ++ rwlock_init(&info->rw_lock); + xa_store(&drv_info->partition_info, tpbuf->id, info, GFP_KERNEL); + } + drv_info->partition_count = count; +-- +2.43.0 + diff --git a/queue-6.7/firmware-arm_ffa-check-xa_load-return-value.patch b/queue-6.7/firmware-arm_ffa-check-xa_load-return-value.patch new file mode 100644 index 00000000000..ef0fd5941b5 --- /dev/null +++ b/queue-6.7/firmware-arm_ffa-check-xa_load-return-value.patch @@ -0,0 +1,54 @@ +From 407375a011519fd5f951fd8b62627a95fc6022bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jan 2024 12:34:13 +0000 +Subject: firmware: arm_ffa: Check xa_load() return value + +From: Cristian Marussi + +[ Upstream commit c00d9738fd5fce15dc5494d05b7599dce23e8146 ] + +Add a check to verify the result of xa_load() during the partition +lookups done while registering/unregistering the scheduler receiver +interrupt callbacks and while executing the main scheduler receiver +interrupt callback handler. + +Fixes: 0184450b8b1e ("firmware: arm_ffa: Add schedule receiver callback mechanism") +Signed-off-by: Cristian Marussi +Link: https://lore.kernel.org/r/20240108-ffa_fixes_6-8-v1-3-75bf7035bc50@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_ffa/driver.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c +index 8df92c9521f4..0ea1dd6e55c4 100644 +--- a/drivers/firmware/arm_ffa/driver.c ++++ b/drivers/firmware/arm_ffa/driver.c +@@ -733,6 +733,11 @@ static void __do_sched_recv_cb(u16 part_id, u16 vcpu, bool is_per_vcpu) + void *cb_data; + + partition = xa_load(&drv_info->partition_info, part_id); ++ if (!partition) { ++ pr_err("%s: Invalid partition ID 0x%x\n", __func__, part_id); ++ return; ++ } ++ + read_lock(&partition->rw_lock); + callback = partition->callback; + cb_data = partition->cb_data; +@@ -915,6 +920,11 @@ static int ffa_sched_recv_cb_update(u16 part_id, ffa_sched_recv_cb callback, + return -EOPNOTSUPP; + + partition = xa_load(&drv_info->partition_info, part_id); ++ if (!partition) { ++ pr_err("%s: Invalid partition ID 0x%x\n", __func__, part_id); ++ return -EINVAL; ++ } ++ + write_lock(&partition->rw_lock); + + cb_valid = !!partition->callback; +-- +2.43.0 + diff --git a/queue-6.7/firmware-arm_scmi-fix-the-clock-protocol-version-for.patch b/queue-6.7/firmware-arm_scmi-fix-the-clock-protocol-version-for.patch new file mode 100644 index 00000000000..745c845e786 --- /dev/null +++ b/queue-6.7/firmware-arm_scmi-fix-the-clock-protocol-version-for.patch @@ -0,0 +1,43 @@ +From 282ee61f0a34024228575d5784ac23bbed0e2831 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jan 2024 15:01:06 +0000 +Subject: firmware: arm_scmi: Fix the clock protocol version for v3.2 + +From: Cristian Marussi + +[ Upstream commit 27600c96e2ffa6c1b2cb378ddc75c6620c628d04 ] + +The clock protocol version as per the SCMI v3.2 specification is 0x30000. +Enable the v3.0 clock protocol features only when clock protocol version +equals 0x30000. + +The previous beta version of the spec had this value set to 0x20001 and +th same value trickled down from the initial development. The version +update were missed in the driver. + +Fixes: e49e314a2cf7 ("firmware: arm_scmi: Add clock v3.2 CONFIG_SET support") +Signed-off-by: Cristian Marussi +Link: https://lore.kernel.org/r/20240109150106.2066739-1-cristian.marussi@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/clock.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/firmware/arm_scmi/clock.c b/drivers/firmware/arm_scmi/clock.c +index 42b81c181d68..96b4f0694fed 100644 +--- a/drivers/firmware/arm_scmi/clock.c ++++ b/drivers/firmware/arm_scmi/clock.c +@@ -951,8 +951,7 @@ static int scmi_clock_protocol_init(const struct scmi_protocol_handle *ph) + scmi_clock_describe_rates_get(ph, clkid, clk); + } + +- if (PROTOCOL_REV_MAJOR(version) >= 0x2 && +- PROTOCOL_REV_MINOR(version) >= 0x1) { ++ if (PROTOCOL_REV_MAJOR(version) >= 0x3) { + cinfo->clock_config_set = scmi_clock_config_set_v2; + cinfo->clock_config_get = scmi_clock_config_get_v2; + } else { +-- +2.43.0 + diff --git a/queue-6.7/firmware-arm_scmi-use-xa_insert-to-store-opps.patch b/queue-6.7/firmware-arm_scmi-use-xa_insert-to-store-opps.patch new file mode 100644 index 00000000000..480470a1a81 --- /dev/null +++ b/queue-6.7/firmware-arm_scmi-use-xa_insert-to-store-opps.patch @@ -0,0 +1,75 @@ +From 0b343b105b5ffe1dd49ceac1b7f7a121216381d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jan 2024 18:50:49 +0000 +Subject: firmware: arm_scmi: Use xa_insert() to store opps + +From: Cristian Marussi + +[ Upstream commit e8ef4bbe39b9576a73f104f6af743fb9c7b624ba ] + +When storing opps by level or index use xa_insert() instead of xa_store() +and add error-checking to spot bad duplicates indexes possibly wrongly +provided by the platform firmware. + +Fixes: 31c7c1397a33 ("firmware: arm_scmi: Add v3.2 perf level indexing mode support") +Signed-off-by: Cristian Marussi +Link: https://lore.kernel.org/r/20240108185050.1628687-1-cristian.marussi@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/perf.c | 23 ++++++++++++++++++----- + 1 file changed, 18 insertions(+), 5 deletions(-) + +diff --git a/drivers/firmware/arm_scmi/perf.c b/drivers/firmware/arm_scmi/perf.c +index e11555de99ab..d26eca37dc14 100644 +--- a/drivers/firmware/arm_scmi/perf.c ++++ b/drivers/firmware/arm_scmi/perf.c +@@ -347,8 +347,8 @@ process_response_opp(struct scmi_opp *opp, unsigned int loop_idx, + } + + static inline void +-process_response_opp_v4(struct perf_dom_info *dom, struct scmi_opp *opp, +- unsigned int loop_idx, ++process_response_opp_v4(struct device *dev, struct perf_dom_info *dom, ++ struct scmi_opp *opp, unsigned int loop_idx, + const struct scmi_msg_resp_perf_describe_levels_v4 *r) + { + opp->perf = le32_to_cpu(r->opp[loop_idx].perf_val); +@@ -359,10 +359,23 @@ process_response_opp_v4(struct perf_dom_info *dom, struct scmi_opp *opp, + /* Note that PERF v4 reports always five 32-bit words */ + opp->indicative_freq = le32_to_cpu(r->opp[loop_idx].indicative_freq); + if (dom->level_indexing_mode) { ++ int ret; ++ + opp->level_index = le32_to_cpu(r->opp[loop_idx].level_index); + +- xa_store(&dom->opps_by_idx, opp->level_index, opp, GFP_KERNEL); +- xa_store(&dom->opps_by_lvl, opp->perf, opp, GFP_KERNEL); ++ ret = xa_insert(&dom->opps_by_idx, opp->level_index, opp, ++ GFP_KERNEL); ++ if (ret) ++ dev_warn(dev, ++ "Failed to add opps_by_idx at %d - ret:%d\n", ++ opp->level_index, ret); ++ ++ ret = xa_insert(&dom->opps_by_lvl, opp->perf, opp, GFP_KERNEL); ++ if (ret) ++ dev_warn(dev, ++ "Failed to add opps_by_lvl at %d - ret:%d\n", ++ opp->perf, ret); ++ + hash_add(dom->opps_by_freq, &opp->hash, opp->indicative_freq); + } + } +@@ -379,7 +392,7 @@ iter_perf_levels_process_response(const struct scmi_protocol_handle *ph, + if (PROTOCOL_REV_MAJOR(p->version) <= 0x3) + process_response_opp(opp, st->loop_idx, response); + else +- process_response_opp_v4(p->perf_dom, opp, st->loop_idx, ++ process_response_opp_v4(ph->dev, p->perf_dom, opp, st->loop_idx, + response); + p->perf_dom->opp_count++; + +-- +2.43.0 + diff --git a/queue-6.7/firmware-arm_scmi-use-xa_insert-when-saving-raw-queu.patch b/queue-6.7/firmware-arm_scmi-use-xa_insert-when-saving-raw-queu.patch new file mode 100644 index 00000000000..8a86f02697f --- /dev/null +++ b/queue-6.7/firmware-arm_scmi-use-xa_insert-when-saving-raw-queu.patch @@ -0,0 +1,65 @@ +From 0b01a8b2d44b26326d43bf948c7063e7768a783c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jan 2024 18:50:50 +0000 +Subject: firmware: arm_scmi: Use xa_insert() when saving raw queues + +From: Cristian Marussi + +[ Upstream commit b5dc0ffd36560dbadaed9a3d9fd7838055d62d74 ] + +Use xa_insert() when saving per-channel raw queues to better check for +duplicates. + +Fixes: 7860701d1e6e ("firmware: arm_scmi: Add per-channel raw injection support") +Signed-off-by: Cristian Marussi +Link: https://lore.kernel.org/r/20240108185050.1628687-2-cristian.marussi@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/raw_mode.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/firmware/arm_scmi/raw_mode.c b/drivers/firmware/arm_scmi/raw_mode.c +index 0493aa3c12bf..350573518503 100644 +--- a/drivers/firmware/arm_scmi/raw_mode.c ++++ b/drivers/firmware/arm_scmi/raw_mode.c +@@ -1111,7 +1111,6 @@ static int scmi_raw_mode_setup(struct scmi_raw_mode_info *raw, + int i; + + for (i = 0; i < num_chans; i++) { +- void *xret; + struct scmi_raw_queue *q; + + q = scmi_raw_queue_init(raw); +@@ -1120,13 +1119,12 @@ static int scmi_raw_mode_setup(struct scmi_raw_mode_info *raw, + goto err_xa; + } + +- xret = xa_store(&raw->chans_q, channels[i], q, ++ ret = xa_insert(&raw->chans_q, channels[i], q, + GFP_KERNEL); +- if (xa_err(xret)) { ++ if (ret) { + dev_err(dev, + "Fail to allocate Raw queue 0x%02X\n", + channels[i]); +- ret = xa_err(xret); + goto err_xa; + } + } +@@ -1322,6 +1320,12 @@ void scmi_raw_message_report(void *r, struct scmi_xfer *xfer, + dev = raw->handle->dev; + q = scmi_raw_queue_select(raw, idx, + SCMI_XFER_IS_CHAN_SET(xfer) ? chan_id : 0); ++ if (!q) { ++ dev_warn(dev, ++ "RAW[%d] - NO queue for chan 0x%X. Dropping report.\n", ++ idx, chan_id); ++ return; ++ } + + /* + * Grab the msg_q_lock upfront to avoid a possible race between +-- +2.43.0 + diff --git a/queue-6.7/futex-prevent-the-reuse-of-stale-pi_state.patch b/queue-6.7/futex-prevent-the-reuse-of-stale-pi_state.patch new file mode 100644 index 00000000000..4e72597203d --- /dev/null +++ b/queue-6.7/futex-prevent-the-reuse-of-stale-pi_state.patch @@ -0,0 +1,136 @@ +From daed3912693f49cbe547d04b3a17f34e174810f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jan 2024 12:54:51 +0100 +Subject: futex: Prevent the reuse of stale pi_state + +From: Sebastian Andrzej Siewior + +[ Upstream commit e626cb02ee8399fd42c415e542d031d185783903 ] + +Jiri Slaby reported a futex state inconsistency resulting in -EINVAL during +a lock operation for a PI futex. It requires that the a lock process is +interrupted by a timeout or signal: + + T1 Owns the futex in user space. + + T2 Tries to acquire the futex in kernel (futex_lock_pi()). Allocates a + pi_state and attaches itself to it. + + T2 Times out and removes its rt_waiter from the rt_mutex. Drops the + rtmutex lock and tries to acquire the hash bucket lock to remove + the futex_q. The lock is contended and T2 schedules out. + + T1 Unlocks the futex (futex_unlock_pi()). Finds a futex_q but no + rt_waiter. Unlocks the futex (do_uncontended) and makes it available + to user space. + + T3 Acquires the futex in user space. + + T4 Tries to acquire the futex in kernel (futex_lock_pi()). Finds the + existing futex_q of T2 and tries to attach itself to the existing + pi_state. This (attach_to_pi_state()) fails with -EINVAL because uval + contains the TID of T3 but pi_state points to T1. + +It's incorrect to unlock the futex and make it available for user space to +acquire as long as there is still an existing state attached to it in the +kernel. + +T1 cannot hand over the futex to T2 because T2 already gave up and started +to clean up and is blocked on the hash bucket lock, so T2's futex_q with +the pi_state pointing to T1 is still queued. + +T2 observes the futex_q, but ignores it as there is no waiter on the +corresponding rt_mutex and takes the uncontended path which allows the +subsequent caller of futex_lock_pi() (T4) to observe that stale state. + +To prevent this the unlock path must dequeue all futex_q entries which +point to the same pi_state when there is no waiter on the rt mutex. This +requires obviously to make the dequeue conditional in the locking path to +prevent a double dequeue. With that it's guaranteed that user space cannot +observe an uncontended futex which has kernel state attached. + +Fixes: fbeb558b0dd0d ("futex/pi: Fix recursive rt_mutex waiter state") +Reported-by: Jiri Slaby +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Thomas Gleixner +Tested-by: Jiri Slaby +Link: https://lore.kernel.org/r/20240118115451.0TkD_ZhB@linutronix.de +Closes: https://lore.kernel.org/all/4611bcf2-44d0-4c34-9b84-17406f881003@kernel.org +Signed-off-by: Sasha Levin +--- + kernel/futex/core.c | 15 ++++++++++++--- + kernel/futex/pi.c | 11 ++++++++--- + 2 files changed, 20 insertions(+), 6 deletions(-) + +diff --git a/kernel/futex/core.c b/kernel/futex/core.c +index dad981a865b8..52d0bf67e715 100644 +--- a/kernel/futex/core.c ++++ b/kernel/futex/core.c +@@ -626,12 +626,21 @@ int futex_unqueue(struct futex_q *q) + } + + /* +- * PI futexes can not be requeued and must remove themselves from the +- * hash bucket. The hash bucket lock (i.e. lock_ptr) is held. ++ * PI futexes can not be requeued and must remove themselves from the hash ++ * bucket. The hash bucket lock (i.e. lock_ptr) is held. + */ + void futex_unqueue_pi(struct futex_q *q) + { +- __futex_unqueue(q); ++ /* ++ * If the lock was not acquired (due to timeout or signal) then the ++ * rt_waiter is removed before futex_q is. If this is observed by ++ * an unlocker after dropping the rtmutex wait lock and before ++ * acquiring the hash bucket lock, then the unlocker dequeues the ++ * futex_q from the hash bucket list to guarantee consistent state ++ * vs. userspace. Therefore the dequeue here must be conditional. ++ */ ++ if (!plist_node_empty(&q->list)) ++ __futex_unqueue(q); + + BUG_ON(!q->pi_state); + put_pi_state(q->pi_state); +diff --git a/kernel/futex/pi.c b/kernel/futex/pi.c +index 90e5197f4e56..5722467f2737 100644 +--- a/kernel/futex/pi.c ++++ b/kernel/futex/pi.c +@@ -1135,6 +1135,7 @@ int futex_unlock_pi(u32 __user *uaddr, unsigned int flags) + + hb = futex_hash(&key); + spin_lock(&hb->lock); ++retry_hb: + + /* + * Check waiters first. We do not trust user space values at +@@ -1177,12 +1178,17 @@ int futex_unlock_pi(u32 __user *uaddr, unsigned int flags) + /* + * Futex vs rt_mutex waiter state -- if there are no rt_mutex + * waiters even though futex thinks there are, then the waiter +- * is leaving and the uncontended path is safe to take. ++ * is leaving. The entry needs to be removed from the list so a ++ * new futex_lock_pi() is not using this stale PI-state while ++ * the futex is available in user space again. ++ * There can be more than one task on its way out so it needs ++ * to retry. + */ + rt_waiter = rt_mutex_top_waiter(&pi_state->pi_mutex); + if (!rt_waiter) { ++ __futex_unqueue(top_waiter); + raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock); +- goto do_uncontended; ++ goto retry_hb; + } + + get_pi_state(pi_state); +@@ -1217,7 +1223,6 @@ int futex_unlock_pi(u32 __user *uaddr, unsigned int flags) + return ret; + } + +-do_uncontended: + /* + * We have no kernel internal state, i.e. no waiters in the + * kernel. Waiters which are about to queue themselves are stuck +-- +2.43.0 + diff --git a/queue-6.7/gpio-eic-sprd-clear-interrupt-after-set-the-interrup.patch b/queue-6.7/gpio-eic-sprd-clear-interrupt-after-set-the-interrup.patch new file mode 100644 index 00000000000..ff1178635ce --- /dev/null +++ b/queue-6.7/gpio-eic-sprd-clear-interrupt-after-set-the-interrup.patch @@ -0,0 +1,160 @@ +From ccc6e77dd9120c50d28f3973338675e30c57c4a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jan 2024 15:38:48 +0800 +Subject: gpio: eic-sprd: Clear interrupt after set the interrupt type + +From: Wenhua Lin + +[ Upstream commit 84aef4ed59705585d629e81d633a83b7d416f5fb ] + +The raw interrupt status of eic maybe set before the interrupt is enabled, +since the eic interrupt has a latch function, which would trigger the +interrupt event once enabled it from user side. To solve this problem, +interrupts generated before setting the interrupt trigger type are ignored. + +Fixes: 25518e024e3a ("gpio: Add Spreadtrum EIC driver support") +Acked-by: Chunyan Zhang +Signed-off-by: Wenhua Lin +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-eic-sprd.c | 32 ++++++++++++++++++++++++++++---- + 1 file changed, 28 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c +index be7f2fa5aa7b..806b88d8dfb7 100644 +--- a/drivers/gpio/gpio-eic-sprd.c ++++ b/drivers/gpio/gpio-eic-sprd.c +@@ -330,20 +330,27 @@ static int sprd_eic_irq_set_type(struct irq_data *data, unsigned int flow_type) + switch (flow_type) { + case IRQ_TYPE_LEVEL_HIGH: + sprd_eic_update(chip, offset, SPRD_EIC_DBNC_IEV, 1); ++ sprd_eic_update(chip, offset, SPRD_EIC_DBNC_IC, 1); + break; + case IRQ_TYPE_LEVEL_LOW: + sprd_eic_update(chip, offset, SPRD_EIC_DBNC_IEV, 0); ++ sprd_eic_update(chip, offset, SPRD_EIC_DBNC_IC, 1); + break; + case IRQ_TYPE_EDGE_RISING: + case IRQ_TYPE_EDGE_FALLING: + case IRQ_TYPE_EDGE_BOTH: + state = sprd_eic_get(chip, offset); +- if (state) ++ if (state) { + sprd_eic_update(chip, offset, + SPRD_EIC_DBNC_IEV, 0); +- else ++ sprd_eic_update(chip, offset, ++ SPRD_EIC_DBNC_IC, 1); ++ } else { + sprd_eic_update(chip, offset, + SPRD_EIC_DBNC_IEV, 1); ++ sprd_eic_update(chip, offset, ++ SPRD_EIC_DBNC_IC, 1); ++ } + break; + default: + return -ENOTSUPP; +@@ -355,20 +362,27 @@ static int sprd_eic_irq_set_type(struct irq_data *data, unsigned int flow_type) + switch (flow_type) { + case IRQ_TYPE_LEVEL_HIGH: + sprd_eic_update(chip, offset, SPRD_EIC_LATCH_INTPOL, 0); ++ sprd_eic_update(chip, offset, SPRD_EIC_LATCH_INTCLR, 1); + break; + case IRQ_TYPE_LEVEL_LOW: + sprd_eic_update(chip, offset, SPRD_EIC_LATCH_INTPOL, 1); ++ sprd_eic_update(chip, offset, SPRD_EIC_LATCH_INTCLR, 1); + break; + case IRQ_TYPE_EDGE_RISING: + case IRQ_TYPE_EDGE_FALLING: + case IRQ_TYPE_EDGE_BOTH: + state = sprd_eic_get(chip, offset); +- if (state) ++ if (state) { + sprd_eic_update(chip, offset, + SPRD_EIC_LATCH_INTPOL, 0); +- else ++ sprd_eic_update(chip, offset, ++ SPRD_EIC_LATCH_INTCLR, 1); ++ } else { + sprd_eic_update(chip, offset, + SPRD_EIC_LATCH_INTPOL, 1); ++ sprd_eic_update(chip, offset, ++ SPRD_EIC_LATCH_INTCLR, 1); ++ } + break; + default: + return -ENOTSUPP; +@@ -382,29 +396,34 @@ static int sprd_eic_irq_set_type(struct irq_data *data, unsigned int flow_type) + sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTBOTH, 0); + sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTMODE, 0); + sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTPOL, 1); ++ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTCLR, 1); + irq_set_handler_locked(data, handle_edge_irq); + break; + case IRQ_TYPE_EDGE_FALLING: + sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTBOTH, 0); + sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTMODE, 0); + sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTPOL, 0); ++ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTCLR, 1); + irq_set_handler_locked(data, handle_edge_irq); + break; + case IRQ_TYPE_EDGE_BOTH: + sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTMODE, 0); + sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTBOTH, 1); ++ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTCLR, 1); + irq_set_handler_locked(data, handle_edge_irq); + break; + case IRQ_TYPE_LEVEL_HIGH: + sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTBOTH, 0); + sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTMODE, 1); + sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTPOL, 1); ++ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTCLR, 1); + irq_set_handler_locked(data, handle_level_irq); + break; + case IRQ_TYPE_LEVEL_LOW: + sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTBOTH, 0); + sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTMODE, 1); + sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTPOL, 0); ++ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTCLR, 1); + irq_set_handler_locked(data, handle_level_irq); + break; + default: +@@ -417,29 +436,34 @@ static int sprd_eic_irq_set_type(struct irq_data *data, unsigned int flow_type) + sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTBOTH, 0); + sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTMODE, 0); + sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTPOL, 1); ++ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTCLR, 1); + irq_set_handler_locked(data, handle_edge_irq); + break; + case IRQ_TYPE_EDGE_FALLING: + sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTBOTH, 0); + sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTMODE, 0); + sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTPOL, 0); ++ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTCLR, 1); + irq_set_handler_locked(data, handle_edge_irq); + break; + case IRQ_TYPE_EDGE_BOTH: + sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTMODE, 0); + sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTBOTH, 1); ++ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTCLR, 1); + irq_set_handler_locked(data, handle_edge_irq); + break; + case IRQ_TYPE_LEVEL_HIGH: + sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTBOTH, 0); + sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTMODE, 1); + sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTPOL, 1); ++ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTCLR, 1); + irq_set_handler_locked(data, handle_level_irq); + break; + case IRQ_TYPE_LEVEL_LOW: + sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTBOTH, 0); + sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTMODE, 1); + sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTPOL, 0); ++ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTCLR, 1); + irq_set_handler_locked(data, handle_level_irq); + break; + default: +-- +2.43.0 + diff --git a/queue-6.7/loongarch-smp-call-rcutree_report_cpu_starting-at-tl.patch b/queue-6.7/loongarch-smp-call-rcutree_report_cpu_starting-at-tl.patch new file mode 100644 index 00000000000..1b2dd0e1b26 --- /dev/null +++ b/queue-6.7/loongarch-smp-call-rcutree_report_cpu_starting-at-tl.patch @@ -0,0 +1,80 @@ +From c2d61000454daa06a6a1a6ce8f4ce10272d5d328 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 16:22:07 +0800 +Subject: LoongArch/smp: Call rcutree_report_cpu_starting() at tlb_init() + +From: Huacai Chen + +[ Upstream commit 5056c596c3d1848021a4eaa76ee42f4c05c50346 ] + +Machines which have more than 8 nodes fail to boot SMP after commit +a2ccf46333d7b2cf96 ("LoongArch/smp: Call rcutree_report_cpu_starting() +earlier"). Because such machines use tlb-based per-cpu base address +rather than dmw-based per-cpu base address, resulting per-cpu variables +can only be accessed after tlb_init(). But rcutree_report_cpu_starting() +is now called before tlb_init() and accesses per-cpu variables indeed. + +Since the original patch want to avoid the lockdep warning caused by +page allocation in tlb_init(), we can move rcutree_report_cpu_starting() +to tlb_init() where after tlb exception configuration but before page +allocation. + +Fixes: a2ccf46333d7b2cf96 ("LoongArch/smp: Call rcutree_report_cpu_starting() earlier") +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/kernel/smp.c | 1 - + arch/loongarch/mm/tlb.c | 16 ++++++++++------ + 2 files changed, 10 insertions(+), 7 deletions(-) + +diff --git a/arch/loongarch/kernel/smp.c b/arch/loongarch/kernel/smp.c +index 5bca12d16e06..2fbf541d7b4f 100644 +--- a/arch/loongarch/kernel/smp.c ++++ b/arch/loongarch/kernel/smp.c +@@ -506,7 +506,6 @@ asmlinkage void start_secondary(void) + sync_counter(); + cpu = raw_smp_processor_id(); + set_my_cpu_offset(per_cpu_offset(cpu)); +- rcutree_report_cpu_starting(cpu); + + cpu_probe(); + constant_clockevent_init(); +diff --git a/arch/loongarch/mm/tlb.c b/arch/loongarch/mm/tlb.c +index 2c0a411f23aa..0b95d32b30c9 100644 +--- a/arch/loongarch/mm/tlb.c ++++ b/arch/loongarch/mm/tlb.c +@@ -284,12 +284,16 @@ static void setup_tlb_handler(int cpu) + set_handler(EXCCODE_TLBNR * VECSIZE, handle_tlb_protect, VECSIZE); + set_handler(EXCCODE_TLBNX * VECSIZE, handle_tlb_protect, VECSIZE); + set_handler(EXCCODE_TLBPE * VECSIZE, handle_tlb_protect, VECSIZE); +- } ++ } else { ++ int vec_sz __maybe_unused; ++ void *addr __maybe_unused; ++ struct page *page __maybe_unused; ++ ++ /* Avoid lockdep warning */ ++ rcutree_report_cpu_starting(cpu); ++ + #ifdef CONFIG_NUMA +- else { +- void *addr; +- struct page *page; +- const int vec_sz = sizeof(exception_handlers); ++ vec_sz = sizeof(exception_handlers); + + if (pcpu_handlers[cpu]) + return; +@@ -305,8 +309,8 @@ static void setup_tlb_handler(int cpu) + csr_write64(pcpu_handlers[cpu], LOONGARCH_CSR_EENTRY); + csr_write64(pcpu_handlers[cpu], LOONGARCH_CSR_MERRENTRY); + csr_write64(pcpu_handlers[cpu] + 80*VECSIZE, LOONGARCH_CSR_TLBRENTRY); +- } + #endif ++ } + } + + void tlb_init(int cpu) +-- +2.43.0 + diff --git a/queue-6.7/memblock-fix-crash-when-reserved-memory-is-not-added.patch b/queue-6.7/memblock-fix-crash-when-reserved-memory-is-not-added.patch new file mode 100644 index 00000000000..5d2ebdaa4f2 --- /dev/null +++ b/queue-6.7/memblock-fix-crash-when-reserved-memory-is-not-added.patch @@ -0,0 +1,46 @@ +From 46646d8abe91f917f8821fe61042b29409cd389b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jan 2024 14:18:53 +0800 +Subject: memblock: fix crash when reserved memory is not added to memory + +From: Yajun Deng + +[ Upstream commit 6a9531c3a88096a26cf3ac582f7ec44f94a7dcb2 ] + +After commit 61167ad5fecd ("mm: pass nid to reserve_bootmem_region()") +nid of a reserved region is used by init_reserved_page() (with +CONFIG_DEFERRED_STRUCT_PAGE_INIT=y) to access node strucure. +In many cases the nid of the reserved memory is not set and this causes +a crash. + +When the nid of a reserved region is not set, fall back to +early_pfn_to_nid(), so that nid of the first_online_node will be passed +to init_reserved_page(). + +Fixes: 61167ad5fecd ("mm: pass nid to reserve_bootmem_region()") +Signed-off-by: Yajun Deng +Link: https://lore.kernel.org/r/20240118061853.2652295-1-yajun.deng@linux.dev +[rppt: massaged the commit message] +Signed-off-by: Mike Rapoport (IBM) +Signed-off-by: Sasha Levin +--- + mm/memblock.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/mm/memblock.c b/mm/memblock.c +index 5a88d6d24d79..4823ad979b72 100644 +--- a/mm/memblock.c ++++ b/mm/memblock.c +@@ -2141,6 +2141,9 @@ static void __init memmap_init_reserved_pages(void) + start = region->base; + end = start + region->size; + ++ if (nid == NUMA_NO_NODE || nid >= MAX_NUMNODES) ++ nid = early_pfn_to_nid(PFN_DOWN(start)); ++ + reserve_bootmem_region(start, end, nid); + } + } +-- +2.43.0 + diff --git a/queue-6.7/mips-lantiq-register-smp_ops-on-non-smp-platforms.patch b/queue-6.7/mips-lantiq-register-smp_ops-on-non-smp-platforms.patch new file mode 100644 index 00000000000..81df2ac6734 --- /dev/null +++ b/queue-6.7/mips-lantiq-register-smp_ops-on-non-smp-platforms.patch @@ -0,0 +1,44 @@ +From fb5123412443c1b85b3dc45d8984dc21d7aa54b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jan 2024 19:47:09 +0100 +Subject: MIPS: lantiq: register smp_ops on non-smp platforms + +From: Aleksander Jan Bajkowski + +[ Upstream commit 4bf2a626dc4bb46f0754d8ac02ec8584ff114ad5 ] + +Lantiq uses a common kernel config for devices with 24Kc and 34Kc cores. +The changes made previously to add support for interrupts on all cores +work on 24Kc platforms with SMP disabled and 34Kc platforms with SMP +enabled. This patch fixes boot issues on Danube (single core 24Kc) with +SMP enabled. + +Fixes: 730320fd770d ("MIPS: lantiq: enable all hardware interrupts on second VPE") +Signed-off-by: Aleksander Jan Bajkowski +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/lantiq/prom.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/arch/mips/lantiq/prom.c b/arch/mips/lantiq/prom.c +index a3cf29365858..0c45767eacf6 100644 +--- a/arch/mips/lantiq/prom.c ++++ b/arch/mips/lantiq/prom.c +@@ -108,10 +108,9 @@ void __init prom_init(void) + prom_init_cmdline(); + + #if defined(CONFIG_MIPS_MT_SMP) +- if (cpu_has_mipsmt) { +- lantiq_smp_ops = vsmp_smp_ops; ++ lantiq_smp_ops = vsmp_smp_ops; ++ if (cpu_has_mipsmt) + lantiq_smp_ops.init_secondary = lantiq_init_secondary; +- register_smp_ops(&lantiq_smp_ops); +- } ++ register_smp_ops(&lantiq_smp_ops); + #endif + } +-- +2.43.0 + diff --git a/queue-6.7/platform-mellanox-mlxbf-pmc-fix-offset-calculation-f.patch b/queue-6.7/platform-mellanox-mlxbf-pmc-fix-offset-calculation-f.patch new file mode 100644 index 00000000000..ffd9821332e --- /dev/null +++ b/queue-6.7/platform-mellanox-mlxbf-pmc-fix-offset-calculation-f.patch @@ -0,0 +1,49 @@ +From a893c4f0eab8f41f0be3c5486fd264aa99fd2678 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jan 2024 05:01:34 -0500 +Subject: platform/mellanox: mlxbf-pmc: Fix offset calculation for crspace + events + +From: Shravan Kumar Ramani + +[ Upstream commit 732c35ce6d4892f7b07cc9aca61a6ad0fd400a26 ] + +The event selector fields for 2 counters are contained in one +32-bit register and the current logic does not account for this. + +Fixes: 423c3361855c ("platform/mellanox: mlxbf-pmc: Add support for BlueField-3") +Signed-off-by: Shravan Kumar Ramani +Reviewed-by: David Thompson +Reviewed-by: Vadim Pasternak +Link: https://lore.kernel.org/r/8834cfa496c97c7c2fcebcfca5a2aa007e20ae96.1705485095.git.shravankr@nvidia.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/mlxbf-pmc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c +index 1dd84c7a79de..b1995ac268d7 100644 +--- a/drivers/platform/mellanox/mlxbf-pmc.c ++++ b/drivers/platform/mellanox/mlxbf-pmc.c +@@ -1170,7 +1170,7 @@ static int mlxbf_pmc_program_crspace_counter(int blk_num, uint32_t cnt_num, + int ret; + + addr = pmc->block[blk_num].mmio_base + +- (rounddown(cnt_num, 2) * MLXBF_PMC_CRSPACE_PERFSEL_SZ); ++ ((cnt_num / 2) * MLXBF_PMC_CRSPACE_PERFSEL_SZ); + ret = mlxbf_pmc_readl(addr, &word); + if (ret) + return ret; +@@ -1413,7 +1413,7 @@ static int mlxbf_pmc_read_crspace_event(int blk_num, uint32_t cnt_num, + int ret; + + addr = pmc->block[blk_num].mmio_base + +- (rounddown(cnt_num, 2) * MLXBF_PMC_CRSPACE_PERFSEL_SZ); ++ ((cnt_num / 2) * MLXBF_PMC_CRSPACE_PERFSEL_SZ); + ret = mlxbf_pmc_readl(addr, &word); + if (ret) + return ret; +-- +2.43.0 + diff --git a/queue-6.7/platform-x86-intel-ifs-call-release_firmware-when-ha.patch b/queue-6.7/platform-x86-intel-ifs-call-release_firmware-when-ha.patch new file mode 100644 index 00000000000..c6df93be44d --- /dev/null +++ b/queue-6.7/platform-x86-intel-ifs-call-release_firmware-when-ha.patch @@ -0,0 +1,48 @@ +From 3feddba66bb6ced7403aefe4a09b9bcdc5b73c74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jan 2024 00:22:50 -0800 +Subject: platform/x86/intel/ifs: Call release_firmware() when handling errors. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jithu Joseph + +[ Upstream commit 8c898ec07a2fc1d4694e81097a48e94a3816308d ] + +Missing release_firmware() due to error handling blocked any future image +loading. + +Fix the return code and release_fiwmare() to release the bad image. + +Fixes: 25a76dbb36dd ("platform/x86/intel/ifs: Validate image size") +Reported-by: Pengfei Xu +Signed-off-by: Jithu Joseph +Signed-off-by: Ashok Raj +Tested-by: Pengfei Xu +Reviewed-by: Tony Luck +Reviewed-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20240125082254.424859-2-ashok.raj@intel.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/ifs/load.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/intel/ifs/load.c b/drivers/platform/x86/intel/ifs/load.c +index a1ee1a74fc3c..2cf3b4a8813f 100644 +--- a/drivers/platform/x86/intel/ifs/load.c ++++ b/drivers/platform/x86/intel/ifs/load.c +@@ -399,7 +399,8 @@ int ifs_load_firmware(struct device *dev) + if (fw->size != expected_size) { + dev_err(dev, "File size mismatch (expected %u, actual %zu). Corrupted IFS image.\n", + expected_size, fw->size); +- return -EINVAL; ++ ret = -EINVAL; ++ goto release; + } + + ret = image_sanity_check(dev, (struct microcode_header_intel *)fw->data); +-- +2.43.0 + diff --git a/queue-6.7/platform-x86-wmi-fix-error-handling-in-legacy-wmi-no.patch b/queue-6.7/platform-x86-wmi-fix-error-handling-in-legacy-wmi-no.patch new file mode 100644 index 00000000000..ff27e1199e0 --- /dev/null +++ b/queue-6.7/platform-x86-wmi-fix-error-handling-in-legacy-wmi-no.patch @@ -0,0 +1,78 @@ +From 329632aefbc2ae039df2c8cfcfebde824be611bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jan 2024 20:27:04 +0100 +Subject: platform/x86: wmi: Fix error handling in legacy WMI notify handler + functions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit 6ba7843b59b77360812617d071313c7f35f3757a ] + +When wmi_install_notify_handler()/wmi_remove_notify_handler() are +unable to enable/disable the WMI device, they unconditionally return +an error to the caller. +When registering legacy WMI notify handlers, this means that the +callback remains registered despite wmi_install_notify_handler() +having returned an error. +When removing legacy WMI notify handlers, this means that the +callback is removed despite wmi_remove_notify_handler() having +returned an error. + +Fix this by only warning when the WMI device could not be enabled. +This behaviour matches the bus-based WMI interface. + +Tested on a Dell Inspiron 3505 and a Acer Aspire E1-731. + +Fixes: 58f6425eb92f ("WMI: Cater for multiple events with same GUID") +Signed-off-by: Armin Wolf +Reviewed-by: Ilpo Järvinen +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20240103192707.115512-2-W_Armin@gmx.de +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/wmi.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c +index 5dd22258cb3b..bd017478e61b 100644 +--- a/drivers/platform/x86/wmi.c ++++ b/drivers/platform/x86/wmi.c +@@ -686,9 +686,10 @@ acpi_status wmi_install_notify_handler(const char *guid, + block->handler_data = data; + + wmi_status = wmi_method_enable(block, true); +- if ((wmi_status != AE_OK) || +- ((wmi_status == AE_OK) && (status == AE_NOT_EXIST))) +- status = wmi_status; ++ if (ACPI_FAILURE(wmi_status)) ++ dev_warn(&block->dev.dev, "Failed to enable device\n"); ++ ++ status = AE_OK; + } + } + +@@ -729,12 +730,13 @@ acpi_status wmi_remove_notify_handler(const char *guid) + status = AE_OK; + } else { + wmi_status = wmi_method_enable(block, false); ++ if (ACPI_FAILURE(wmi_status)) ++ dev_warn(&block->dev.dev, "Failed to disable device\n"); ++ + block->handler = NULL; + block->handler_data = NULL; +- if ((wmi_status != AE_OK) || +- ((wmi_status == AE_OK) && +- (status == AE_NOT_EXIST))) +- status = wmi_status; ++ ++ status = AE_OK; + } + } + } +-- +2.43.0 + diff --git a/queue-6.7/riscv-dts-sophgo-separate-sg2042-mtime-and-mtimecmp-.patch b/queue-6.7/riscv-dts-sophgo-separate-sg2042-mtime-and-mtimecmp-.patch new file mode 100644 index 00000000000..3dda55eccff --- /dev/null +++ b/queue-6.7/riscv-dts-sophgo-separate-sg2042-mtime-and-mtimecmp-.patch @@ -0,0 +1,224 @@ +From 802534c05f9fb26f958a480707e56247c184fca5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 17:20:00 +0800 +Subject: riscv: dts: sophgo: separate sg2042 mtime and mtimecmp to fit aclint + format + +From: Inochi Amaoto + +[ Upstream commit 1f4a994be2c3d13852fd5c1054f292bd303352cc ] + +Change the timer layout in the dtb to fit the format that needed by +the SBI. + +Fixes: 967a94a92aaa ("riscv: dts: add initial Sophgo SG2042 SoC device tree") +Reviewed-by: Chen Wang +Reviewed-by: Guo Ren +Signed-off-by: Inochi Amaoto +Signed-off-by: Chen Wang +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/riscv/boot/dts/sophgo/sg2042.dtsi | 80 +++++++++++++++----------- + 1 file changed, 48 insertions(+), 32 deletions(-) + +diff --git a/arch/riscv/boot/dts/sophgo/sg2042.dtsi b/arch/riscv/boot/dts/sophgo/sg2042.dtsi +index 93256540d078..ead1cc35d88b 100644 +--- a/arch/riscv/boot/dts/sophgo/sg2042.dtsi ++++ b/arch/riscv/boot/dts/sophgo/sg2042.dtsi +@@ -93,144 +93,160 @@ clint_mswi: interrupt-controller@7094000000 { + <&cpu63_intc 3>; + }; + +- clint_mtimer0: timer@70ac000000 { ++ clint_mtimer0: timer@70ac004000 { + compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer"; +- reg = <0x00000070 0xac000000 0x00000000 0x00007ff8>; ++ reg = <0x00000070 0xac004000 0x00000000 0x0000c000>; ++ reg-names = "mtimecmp"; + interrupts-extended = <&cpu0_intc 7>, + <&cpu1_intc 7>, + <&cpu2_intc 7>, + <&cpu3_intc 7>; + }; + +- clint_mtimer1: timer@70ac010000 { ++ clint_mtimer1: timer@70ac014000 { + compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer"; +- reg = <0x00000070 0xac010000 0x00000000 0x00007ff8>; ++ reg = <0x00000070 0xac014000 0x00000000 0x0000c000>; ++ reg-names = "mtimecmp"; + interrupts-extended = <&cpu4_intc 7>, + <&cpu5_intc 7>, + <&cpu6_intc 7>, + <&cpu7_intc 7>; + }; + +- clint_mtimer2: timer@70ac020000 { ++ clint_mtimer2: timer@70ac024000 { + compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer"; +- reg = <0x00000070 0xac020000 0x00000000 0x00007ff8>; ++ reg = <0x00000070 0xac024000 0x00000000 0x0000c000>; ++ reg-names = "mtimecmp"; + interrupts-extended = <&cpu8_intc 7>, + <&cpu9_intc 7>, + <&cpu10_intc 7>, + <&cpu11_intc 7>; + }; + +- clint_mtimer3: timer@70ac030000 { ++ clint_mtimer3: timer@70ac034000 { + compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer"; +- reg = <0x00000070 0xac030000 0x00000000 0x00007ff8>; ++ reg = <0x00000070 0xac034000 0x00000000 0x0000c000>; ++ reg-names = "mtimecmp"; + interrupts-extended = <&cpu12_intc 7>, + <&cpu13_intc 7>, + <&cpu14_intc 7>, + <&cpu15_intc 7>; + }; + +- clint_mtimer4: timer@70ac040000 { ++ clint_mtimer4: timer@70ac044000 { + compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer"; +- reg = <0x00000070 0xac040000 0x00000000 0x00007ff8>; ++ reg = <0x00000070 0xac044000 0x00000000 0x0000c000>; ++ reg-names = "mtimecmp"; + interrupts-extended = <&cpu16_intc 7>, + <&cpu17_intc 7>, + <&cpu18_intc 7>, + <&cpu19_intc 7>; + }; + +- clint_mtimer5: timer@70ac050000 { ++ clint_mtimer5: timer@70ac054000 { + compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer"; +- reg = <0x00000070 0xac050000 0x00000000 0x00007ff8>; ++ reg = <0x00000070 0xac054000 0x00000000 0x0000c000>; ++ reg-names = "mtimecmp"; + interrupts-extended = <&cpu20_intc 7>, + <&cpu21_intc 7>, + <&cpu22_intc 7>, + <&cpu23_intc 7>; + }; + +- clint_mtimer6: timer@70ac060000 { ++ clint_mtimer6: timer@70ac064000 { + compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer"; +- reg = <0x00000070 0xac060000 0x00000000 0x00007ff8>; ++ reg = <0x00000070 0xac064000 0x00000000 0x0000c000>; ++ reg-names = "mtimecmp"; + interrupts-extended = <&cpu24_intc 7>, + <&cpu25_intc 7>, + <&cpu26_intc 7>, + <&cpu27_intc 7>; + }; + +- clint_mtimer7: timer@70ac070000 { ++ clint_mtimer7: timer@70ac074000 { + compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer"; +- reg = <0x00000070 0xac070000 0x00000000 0x00007ff8>; ++ reg = <0x00000070 0xac074000 0x00000000 0x0000c000>; ++ reg-names = "mtimecmp"; + interrupts-extended = <&cpu28_intc 7>, + <&cpu29_intc 7>, + <&cpu30_intc 7>, + <&cpu31_intc 7>; + }; + +- clint_mtimer8: timer@70ac080000 { ++ clint_mtimer8: timer@70ac084000 { + compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer"; +- reg = <0x00000070 0xac080000 0x00000000 0x00007ff8>; ++ reg = <0x00000070 0xac084000 0x00000000 0x0000c000>; ++ reg-names = "mtimecmp"; + interrupts-extended = <&cpu32_intc 7>, + <&cpu33_intc 7>, + <&cpu34_intc 7>, + <&cpu35_intc 7>; + }; + +- clint_mtimer9: timer@70ac090000 { ++ clint_mtimer9: timer@70ac094000 { + compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer"; +- reg = <0x00000070 0xac090000 0x00000000 0x00007ff8>; ++ reg = <0x00000070 0xac094000 0x00000000 0x0000c000>; ++ reg-names = "mtimecmp"; + interrupts-extended = <&cpu36_intc 7>, + <&cpu37_intc 7>, + <&cpu38_intc 7>, + <&cpu39_intc 7>; + }; + +- clint_mtimer10: timer@70ac0a0000 { ++ clint_mtimer10: timer@70ac0a4000 { + compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer"; +- reg = <0x00000070 0xac0a0000 0x00000000 0x00007ff8>; ++ reg = <0x00000070 0xac0a4000 0x00000000 0x0000c000>; ++ reg-names = "mtimecmp"; + interrupts-extended = <&cpu40_intc 7>, + <&cpu41_intc 7>, + <&cpu42_intc 7>, + <&cpu43_intc 7>; + }; + +- clint_mtimer11: timer@70ac0b0000 { ++ clint_mtimer11: timer@70ac0b4000 { + compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer"; +- reg = <0x00000070 0xac0b0000 0x00000000 0x00007ff8>; ++ reg = <0x00000070 0xac0b4000 0x00000000 0x0000c000>; ++ reg-names = "mtimecmp"; + interrupts-extended = <&cpu44_intc 7>, + <&cpu45_intc 7>, + <&cpu46_intc 7>, + <&cpu47_intc 7>; + }; + +- clint_mtimer12: timer@70ac0c0000 { ++ clint_mtimer12: timer@70ac0c4000 { + compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer"; +- reg = <0x00000070 0xac0c0000 0x00000000 0x00007ff8>; ++ reg = <0x00000070 0xac0c4000 0x00000000 0x0000c000>; ++ reg-names = "mtimecmp"; + interrupts-extended = <&cpu48_intc 7>, + <&cpu49_intc 7>, + <&cpu50_intc 7>, + <&cpu51_intc 7>; + }; + +- clint_mtimer13: timer@70ac0d0000 { ++ clint_mtimer13: timer@70ac0d4000 { + compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer"; +- reg = <0x00000070 0xac0d0000 0x00000000 0x00007ff8>; ++ reg = <0x00000070 0xac0d4000 0x00000000 0x0000c000>; ++ reg-names = "mtimecmp"; + interrupts-extended = <&cpu52_intc 7>, + <&cpu53_intc 7>, + <&cpu54_intc 7>, + <&cpu55_intc 7>; + }; + +- clint_mtimer14: timer@70ac0e0000 { ++ clint_mtimer14: timer@70ac0e4000 { + compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer"; +- reg = <0x00000070 0xac0e0000 0x00000000 0x00007ff8>; ++ reg = <0x00000070 0xac0e4000 0x00000000 0x0000c000>; ++ reg-names = "mtimecmp"; + interrupts-extended = <&cpu56_intc 7>, + <&cpu57_intc 7>, + <&cpu58_intc 7>, + <&cpu59_intc 7>; + }; + +- clint_mtimer15: timer@70ac0f0000 { ++ clint_mtimer15: timer@70ac0f4000 { + compatible = "sophgo,sg2042-aclint-mtimer", "thead,c900-aclint-mtimer"; +- reg = <0x00000070 0xac0f0000 0x00000000 0x00007ff8>; ++ reg = <0x00000070 0xac0f4000 0x00000000 0x0000c000>; ++ reg-names = "mtimecmp"; + interrupts-extended = <&cpu60_intc 7>, + <&cpu61_intc 7>, + <&cpu62_intc 7>, +-- +2.43.0 + diff --git a/queue-6.7/series b/queue-6.7/series index 7cafca00433..ab3f906cafa 100644 --- a/queue-6.7/series +++ b/queue-6.7/series @@ -303,3 +303,38 @@ drm-amd-display-init-link-enc-resources-in-dc_state-.patch drm-amdgpu-enable-tunneling-on-high-priority-compute.patch drm-amdgpu-gfx10-set-unord_dispatch-in-compute-mqds.patch drm-amdgpu-gfx11-set-unord_dispatch-in-compute-mqds.patch +drm-bridge-parade-ps8640-wait-for-hpd-when-doing-an-.patch +drm-panel-simple-add-missing-bus-flags-for-tianma-tm.patch +drm-panel-samsung-s6d7aa0-drop-drm_bus_flag_de_high-.patch +drm-panel-raydium-rm692e5-select-config_drm_display_.patch +drm-bridge-sii902x-fix-probing-race-issue.patch +drm-bridge-sii902x-fix-audio-codec-unregistration.patch +drm-bridge-parade-ps8640-ensure-bridge-is-suspended-.patch +drm-bridge-parade-ps8640-make-sure-we-drop-the-aux-m.patch +memblock-fix-crash-when-reserved-memory-is-not-added.patch +futex-prevent-the-reuse-of-stale-pi_state.patch +drm-exynos-fix-accidental-on-stack-copy-of-exynos_dr.patch +drm-exynos-gsc-minor-fix-for-loop-iteration-in-gsc_r.patch +firmware-arm_scmi-use-xa_insert-to-store-opps.patch +firmware-arm_scmi-use-xa_insert-when-saving-raw-queu.patch +firmware-arm_scmi-fix-the-clock-protocol-version-for.patch +firmware-arm_ffa-add-missing-rwlock_init-in-ffa_setu.patch +firmware-arm_ffa-add-missing-rwlock_init-for-the-dri.patch +firmware-arm_ffa-check-xa_load-return-value.patch +platform-x86-wmi-fix-error-handling-in-legacy-wmi-no.patch +gpio-eic-sprd-clear-interrupt-after-set-the-interrup.patch +arm-dts-exynos4212-tab3-add-samsung-invert-vclk-flag.patch +platform-mellanox-mlxbf-pmc-fix-offset-calculation-f.patch +spi-intel-pci-remove-meteor-lake-s-soc-pci-id-from-t.patch +block-move-checking-genhd_fl_no_part-to-bdev_add_par.patch +drm-bridge-anx7625-ensure-bridge-is-suspended-in-dis.patch +cpufreq-amd-pstate-fix-setting-scaling-max-min-freq-.patch +spi-bcm-qspi-fix-sfdp-bfpt-read-by-usig-mspi-read.patch +spi-spi-cadence-reverse-the-order-of-interleaved-wri.patch +cifs-fix-stray-unlock-in-cifs_chan_skip_or_disable.patch +spi-fix-finalize-message-on-error-return.patch +loongarch-smp-call-rcutree_report_cpu_starting-at-tl.patch +mips-lantiq-register-smp_ops-on-non-smp-platforms.patch +riscv-dts-sophgo-separate-sg2042-mtime-and-mtimecmp-.patch +drm-bridge-samsung-dsim-don-t-use-force_stop_state.patch +platform-x86-intel-ifs-call-release_firmware-when-ha.patch diff --git a/queue-6.7/spi-bcm-qspi-fix-sfdp-bfpt-read-by-usig-mspi-read.patch b/queue-6.7/spi-bcm-qspi-fix-sfdp-bfpt-read-by-usig-mspi-read.patch new file mode 100644 index 00000000000..966a4a384c3 --- /dev/null +++ b/queue-6.7/spi-bcm-qspi-fix-sfdp-bfpt-read-by-usig-mspi-read.patch @@ -0,0 +1,49 @@ +From 7bc5c640746e53d9842b6e1ecfad9463dd4999b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jan 2024 16:00:32 -0500 +Subject: spi: bcm-qspi: fix SFDP BFPT read by usig mspi read + +From: Kamal Dasu + +[ Upstream commit 574bf7bbe83794a902679846770f75a9b7f28176 ] + +SFDP read shall use the mspi reads when using the bcm_qspi_exec_mem_op() +call. This fixes SFDP parameter page read failures seen with parts that +now use SFDP protocol to read the basic flash parameter table. + +Fixes: 5f195ee7d830 ("spi: bcm-qspi: Implement the spi_mem interface") +Signed-off-by: Kamal Dasu +Tested-by: Florian Fainelli +Reviewed-by: Florian Fainelli +Link: https://msgid.link/r/20240109210033.43249-1-kamal.dasu@broadcom.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bcm-qspi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c +index ef08fcac2f6d..0407b91183ca 100644 +--- a/drivers/spi/spi-bcm-qspi.c ++++ b/drivers/spi/spi-bcm-qspi.c +@@ -19,7 +19,7 @@ + #include + #include + #include +-#include ++#include + #include + #include + #include "spi-bcm-qspi.h" +@@ -1221,7 +1221,7 @@ static int bcm_qspi_exec_mem_op(struct spi_mem *mem, + + /* non-aligned and very short transfers are handled by MSPI */ + if (!IS_ALIGNED((uintptr_t)addr, 4) || !IS_ALIGNED((uintptr_t)buf, 4) || +- len < 4) ++ len < 4 || op->cmd.opcode == SPINOR_OP_RDSFDP) + mspi_read = true; + + if (!has_bspi(qspi) || mspi_read) +-- +2.43.0 + diff --git a/queue-6.7/spi-fix-finalize-message-on-error-return.patch b/queue-6.7/spi-fix-finalize-message-on-error-return.patch new file mode 100644 index 00000000000..a10ad485e42 --- /dev/null +++ b/queue-6.7/spi-fix-finalize-message-on-error-return.patch @@ -0,0 +1,43 @@ +From 614db1c2aeb592475e9d28fe2126d33f22797776 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jan 2024 14:53:09 -0600 +Subject: spi: fix finalize message on error return + +From: David Lechner + +[ Upstream commit 8c2ae772fe08e33f3d7a83849e85539320701abd ] + +In __spi_pump_transfer_message(), the message was not finalized in the +first error return as it is in the other error return paths. Not +finalizing the message could cause anything waiting on the message to +complete to hang forever. + +This adds the missing call to spi_finalize_current_message(). + +Fixes: ae7d2346dc89 ("spi: Don't use the message queue if possible in spi_sync") +Signed-off-by: David Lechner +Link: https://msgid.link/r/20240125205312.3458541-2-dlechner@baylibre.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 8ead7acb99f3..4adc56dabf55 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -1624,6 +1624,10 @@ static int __spi_pump_transfer_message(struct spi_controller *ctlr, + pm_runtime_put_noidle(ctlr->dev.parent); + dev_err(&ctlr->dev, "Failed to power device: %d\n", + ret); ++ ++ msg->status = ret; ++ spi_finalize_current_message(ctlr); ++ + return ret; + } + } +-- +2.43.0 + diff --git a/queue-6.7/spi-intel-pci-remove-meteor-lake-s-soc-pci-id-from-t.patch b/queue-6.7/spi-intel-pci-remove-meteor-lake-s-soc-pci-id-from-t.patch new file mode 100644 index 00000000000..43c262dcd15 --- /dev/null +++ b/queue-6.7/spi-intel-pci-remove-meteor-lake-s-soc-pci-id-from-t.patch @@ -0,0 +1,38 @@ +From b6a4358c6fcf988447a7bfecf5b3b985521e09a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jan 2024 14:00:33 +0200 +Subject: spi: intel-pci: Remove Meteor Lake-S SoC PCI ID from the list + +From: Mika Westerberg + +[ Upstream commit 6c314425b9ef6b247cefd0903e287eb072580c3b ] + +Turns out this "SoC" side controller does not support certain commands, +such as reading chip JEDEC ID, so the controller is pretty much unusable +in Linux. We should be using the "PCH" side controller instead. For this +reason remove this PCI ID from the list. + +Fixes: c2912d42e86e ("spi: intel-pci: Add support for Meteor Lake-S SPI serial flash") +Signed-off-by: Mika Westerberg +Link: https://msgid.link/r/20240122120034.2664812-2-mika.westerberg@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-intel-pci.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/spi/spi-intel-pci.c b/drivers/spi/spi-intel-pci.c +index 57d767a68e7b..b9918dcc3802 100644 +--- a/drivers/spi/spi-intel-pci.c ++++ b/drivers/spi/spi-intel-pci.c +@@ -84,7 +84,6 @@ static const struct pci_device_id intel_spi_pci_ids[] = { + { PCI_VDEVICE(INTEL, 0xa2a4), (unsigned long)&cnl_info }, + { PCI_VDEVICE(INTEL, 0xa324), (unsigned long)&cnl_info }, + { PCI_VDEVICE(INTEL, 0xa3a4), (unsigned long)&cnl_info }, +- { PCI_VDEVICE(INTEL, 0xae23), (unsigned long)&cnl_info }, + { }, + }; + MODULE_DEVICE_TABLE(pci, intel_spi_pci_ids); +-- +2.43.0 + diff --git a/queue-6.7/spi-spi-cadence-reverse-the-order-of-interleaved-wri.patch b/queue-6.7/spi-spi-cadence-reverse-the-order-of-interleaved-wri.patch new file mode 100644 index 00000000000..70a10baa018 --- /dev/null +++ b/queue-6.7/spi-spi-cadence-reverse-the-order-of-interleaved-wri.patch @@ -0,0 +1,64 @@ +From c0fc58fd437b9b4b7572c19e39fc9534793b9171 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Dec 2023 14:36:52 +0530 +Subject: spi: spi-cadence: Reverse the order of interleaved write and read + operations + +From: Amit Kumar Mahapatra + +[ Upstream commit 633cd6fe6e1993ba80e0954c2db127a0b1a3e66f ] + +In the existing implementation, when executing interleaved write and read +operations in the ISR for a transfer length greater than the FIFO size, +the TXFIFO write precedes the RXFIFO read. Consequently, the initially +received data in the RXFIFO is pushed out and lost, leading to a failure +in data integrity. To address this issue, reverse the order of interleaved +operations and conduct the RXFIFO read followed by the TXFIFO write. + +Fixes: 6afe2ae8dc48 ("spi: spi-cadence: Interleave write of TX and read of RX FIFO") +Signed-off-by: Amit Kumar Mahapatra +Link: https://msgid.link/r/20231218090652.18403-1-amit.kumar-mahapatra@amd.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-cadence.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c +index a50eb4db79de..e5140532071d 100644 +--- a/drivers/spi/spi-cadence.c ++++ b/drivers/spi/spi-cadence.c +@@ -317,6 +317,15 @@ static void cdns_spi_process_fifo(struct cdns_spi *xspi, int ntx, int nrx) + xspi->rx_bytes -= nrx; + + while (ntx || nrx) { ++ if (nrx) { ++ u8 data = cdns_spi_read(xspi, CDNS_SPI_RXD); ++ ++ if (xspi->rxbuf) ++ *xspi->rxbuf++ = data; ++ ++ nrx--; ++ } ++ + if (ntx) { + if (xspi->txbuf) + cdns_spi_write(xspi, CDNS_SPI_TXD, *xspi->txbuf++); +@@ -326,14 +335,6 @@ static void cdns_spi_process_fifo(struct cdns_spi *xspi, int ntx, int nrx) + ntx--; + } + +- if (nrx) { +- u8 data = cdns_spi_read(xspi, CDNS_SPI_RXD); +- +- if (xspi->rxbuf) +- *xspi->rxbuf++ = data; +- +- nrx--; +- } + } + } + +-- +2.43.0 + -- 2.47.3