From fcf4868eb9dac00eaa41af2745dbd2f817258caa Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Mon, 7 Aug 2023 08:15:32 -0400 Subject: [PATCH] Fixes for 5.15 Signed-off-by: Sasha Levin --- ...fsl-dcu-use-drm_plane_helper_destroy.patch | 46 +++++++ ...x-front-porch-adjustment-upon-hactiv.patch | 42 ++++++ ...upm-fix-an-off-by-one-test-in-fun_ex.patch | 43 +++++++ ..._elm-fix-incorrect-type-in-assignmen.patch | 120 ++++++++++++++++++ ...chip-align-hwecc-vs.-raw-page-helper.patch | 114 +++++++++++++++++ ...chip-fix-oobfree-offset-and-descript.patch | 65 ++++++++++ ...-mm-altmap-fix-altmap-boundary-check.patch | 41 ++++++ queue-5.15/series | 7 + 8 files changed, 478 insertions(+) create mode 100644 queue-5.15/drm-fsl-dcu-use-drm_plane_helper_destroy.patch create mode 100644 queue-5.15/drm-imx-ipuv3-fix-front-porch-adjustment-upon-hactiv.patch create mode 100644 queue-5.15/mtd-rawnand-fsl_upm-fix-an-off-by-one-test-in-fun_ex.patch create mode 100644 queue-5.15/mtd-rawnand-omap_elm-fix-incorrect-type-in-assignmen.patch create mode 100644 queue-5.15/mtd-rawnand-rockchip-align-hwecc-vs.-raw-page-helper.patch create mode 100644 queue-5.15/mtd-rawnand-rockchip-fix-oobfree-offset-and-descript.patch create mode 100644 queue-5.15/powerpc-mm-altmap-fix-altmap-boundary-check.patch diff --git a/queue-5.15/drm-fsl-dcu-use-drm_plane_helper_destroy.patch b/queue-5.15/drm-fsl-dcu-use-drm_plane_helper_destroy.patch new file mode 100644 index 00000000000..0b5f11bb300 --- /dev/null +++ b/queue-5.15/drm-fsl-dcu-use-drm_plane_helper_destroy.patch @@ -0,0 +1,46 @@ +From 4ce2adea8fbf96444a6665d026114193ffb26e46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Jul 2022 10:30:58 +0200 +Subject: drm/fsl-dcu: Use drm_plane_helper_destroy() + +From: Thomas Zimmermann + +[ Upstream commit a4d847df8b440cc667c18f99abe84ccaa83afac4 ] + +Replace the driver's own function with drm_plane_helper_destroy(). No +functional changes. + +Signed-off-by: Thomas Zimmermann +Reviewed-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20220720083058.15371-8-tzimmermann@suse.de +Stable-dep-of: ee31742bf176 ("drm/imx/ipuv3: Fix front porch adjustment upon hactive aligning") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c +index 8fe953d6e0a94..8a9e6db71e46b 100644 +--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c ++++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c +@@ -170,16 +170,10 @@ static const struct drm_plane_helper_funcs fsl_dcu_drm_plane_helper_funcs = { + .atomic_update = fsl_dcu_drm_plane_atomic_update, + }; + +-static void fsl_dcu_drm_plane_destroy(struct drm_plane *plane) +-{ +- drm_plane_cleanup(plane); +- kfree(plane); +-} +- + static const struct drm_plane_funcs fsl_dcu_drm_plane_funcs = { + .atomic_duplicate_state = drm_atomic_helper_plane_duplicate_state, + .atomic_destroy_state = drm_atomic_helper_plane_destroy_state, +- .destroy = fsl_dcu_drm_plane_destroy, ++ .destroy = drm_plane_helper_destroy, + .disable_plane = drm_atomic_helper_disable_plane, + .reset = drm_atomic_helper_plane_reset, + .update_plane = drm_atomic_helper_update_plane, +-- +2.40.1 + diff --git a/queue-5.15/drm-imx-ipuv3-fix-front-porch-adjustment-upon-hactiv.patch b/queue-5.15/drm-imx-ipuv3-fix-front-porch-adjustment-upon-hactiv.patch new file mode 100644 index 00000000000..d2011677e00 --- /dev/null +++ b/queue-5.15/drm-imx-ipuv3-fix-front-porch-adjustment-upon-hactiv.patch @@ -0,0 +1,42 @@ +From 06f661f692fcd05ab33cb561ed73f1b771bc33d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 09:21:37 +0200 +Subject: drm/imx/ipuv3: Fix front porch adjustment upon hactive aligning + +From: Alexander Stein + +[ Upstream commit ee31742bf17636da1304af77b2cb1c29b5dda642 ] + +When hactive is not aligned to 8 pixels, it is aligned accordingly and +hfront porch needs to be reduced the same amount. Unfortunately the front +porch is set to the difference rather than reducing it. There are some +Samsung TVs which can't cope with a front porch of instead of 70. + +Fixes: 94dfec48fca7 ("drm/imx: Add 8 pixel alignment fix") +Signed-off-by: Alexander Stein +Reviewed-by: Philipp Zabel +Link: https://lore.kernel.org/r/20230515072137.116211-1-alexander.stein@ew.tq-group.com +[p.zabel@pengutronix.de: Fixed subject] +Signed-off-by: Philipp Zabel +Link: https://patchwork.freedesktop.org/patch/msgid/20230515072137.116211-1-alexander.stein@ew.tq-group.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/imx/ipuv3-crtc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c +index f7863d6dea804..ba5b16618c237 100644 +--- a/drivers/gpu/drm/imx/ipuv3-crtc.c ++++ b/drivers/gpu/drm/imx/ipuv3-crtc.c +@@ -311,7 +311,7 @@ static void ipu_crtc_mode_set_nofb(struct drm_crtc *crtc) + dev_warn(ipu_crtc->dev, "8-pixel align hactive %d -> %d\n", + sig_cfg.mode.hactive, new_hactive); + +- sig_cfg.mode.hfront_porch = new_hactive - sig_cfg.mode.hactive; ++ sig_cfg.mode.hfront_porch -= new_hactive - sig_cfg.mode.hactive; + sig_cfg.mode.hactive = new_hactive; + } + +-- +2.40.1 + diff --git a/queue-5.15/mtd-rawnand-fsl_upm-fix-an-off-by-one-test-in-fun_ex.patch b/queue-5.15/mtd-rawnand-fsl_upm-fix-an-off-by-one-test-in-fun_ex.patch new file mode 100644 index 00000000000..d18c496fac9 --- /dev/null +++ b/queue-5.15/mtd-rawnand-fsl_upm-fix-an-off-by-one-test-in-fun_ex.patch @@ -0,0 +1,43 @@ +From b592e08ae7a446d813fd6e9c42b4d2bf3483dd7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 23:55:01 +0200 +Subject: mtd: rawnand: fsl_upm: Fix an off-by one test in fun_exec_op() + +From: Christophe JAILLET + +[ Upstream commit c6abce60338aa2080973cd95be0aedad528bb41f ] + +'op-cs' is copied in 'fun->mchip_number' which is used to access the +'mchip_offsets' and the 'rnb_gpio' arrays. +These arrays have NAND_MAX_CHIPS elements, so the index must be below this +limit. + +Fix the sanity check in order to avoid the NAND_MAX_CHIPS value. This +would lead to out-of-bound accesses. + +Fixes: 54309d657767 ("mtd: rawnand: fsl_upm: Implement exec_op()") +Signed-off-by: Christophe JAILLET +Reviewed-by: Dan Carpenter +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/cd01cba1c7eda58bdabaae174c78c067325803d2.1689803636.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/fsl_upm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/fsl_upm.c b/drivers/mtd/nand/raw/fsl_upm.c +index b3cc427100a22..636e65328bb32 100644 +--- a/drivers/mtd/nand/raw/fsl_upm.c ++++ b/drivers/mtd/nand/raw/fsl_upm.c +@@ -135,7 +135,7 @@ static int fun_exec_op(struct nand_chip *chip, const struct nand_operation *op, + unsigned int i; + int ret; + +- if (op->cs > NAND_MAX_CHIPS) ++ if (op->cs >= NAND_MAX_CHIPS) + return -EINVAL; + + if (check_only) +-- +2.40.1 + diff --git a/queue-5.15/mtd-rawnand-omap_elm-fix-incorrect-type-in-assignmen.patch b/queue-5.15/mtd-rawnand-omap_elm-fix-incorrect-type-in-assignmen.patch new file mode 100644 index 00000000000..adda07b5ad0 --- /dev/null +++ b/queue-5.15/mtd-rawnand-omap_elm-fix-incorrect-type-in-assignmen.patch @@ -0,0 +1,120 @@ +From 48835d20509140a3cd94ec8d1d2975e521887f74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jun 2023 00:10:21 +0530 +Subject: mtd: rawnand: omap_elm: Fix incorrect type in assignment + +From: Roger Quadros + +[ Upstream commit d8403b9eeee66d5dd81ecb9445800b108c267ce3 ] + +Once the ECC word endianness is converted to BE32, we force cast it +to u32 so we can use elm_write_reg() which in turn uses writel(). + +Fixes below sparse warnings: + + drivers/mtd/nand/raw/omap_elm.c:180:37: sparse: expected unsigned int [usertype] val + drivers/mtd/nand/raw/omap_elm.c:180:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:185:37: sparse: expected unsigned int [usertype] val + drivers/mtd/nand/raw/omap_elm.c:185:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:190:37: sparse: expected unsigned int [usertype] val + drivers/mtd/nand/raw/omap_elm.c:190:37: sparse: got restricted __be32 [usertype] +>> drivers/mtd/nand/raw/omap_elm.c:200:40: sparse: sparse: restricted __be32 degrades to integer + drivers/mtd/nand/raw/omap_elm.c:206:39: sparse: sparse: restricted __be32 degrades to integer + drivers/mtd/nand/raw/omap_elm.c:210:37: sparse: expected unsigned int [assigned] [usertype] val + drivers/mtd/nand/raw/omap_elm.c:210:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:213:37: sparse: expected unsigned int [assigned] [usertype] val + drivers/mtd/nand/raw/omap_elm.c:213:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:216:37: sparse: expected unsigned int [assigned] [usertype] val + drivers/mtd/nand/raw/omap_elm.c:216:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:219:37: sparse: expected unsigned int [assigned] [usertype] val + drivers/mtd/nand/raw/omap_elm.c:219:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:222:37: sparse: expected unsigned int [assigned] [usertype] val + drivers/mtd/nand/raw/omap_elm.c:222:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:225:37: sparse: expected unsigned int [assigned] [usertype] val + drivers/mtd/nand/raw/omap_elm.c:225:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:228:39: sparse: sparse: restricted __be32 degrades to integer + +Fixes: bf22433575ef ("mtd: devices: elm: Add support for ELM error correction") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202306212211.WDXokuWh-lkp@intel.com/ +Signed-off-by: Roger Quadros +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20230624184021.7740-1-rogerq@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/omap_elm.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/drivers/mtd/nand/raw/omap_elm.c b/drivers/mtd/nand/raw/omap_elm.c +index 2b21ce04b3ec6..1a48347be3fe4 100644 +--- a/drivers/mtd/nand/raw/omap_elm.c ++++ b/drivers/mtd/nand/raw/omap_elm.c +@@ -177,17 +177,17 @@ static void elm_load_syndrome(struct elm_info *info, + switch (info->bch_type) { + case BCH8_ECC: + /* syndrome fragment 0 = ecc[9-12B] */ +- val = cpu_to_be32(*(u32 *) &ecc[9]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[9]); + elm_write_reg(info, offset, val); + + /* syndrome fragment 1 = ecc[5-8B] */ + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[5]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[5]); + elm_write_reg(info, offset, val); + + /* syndrome fragment 2 = ecc[1-4B] */ + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[1]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[1]); + elm_write_reg(info, offset, val); + + /* syndrome fragment 3 = ecc[0B] */ +@@ -197,35 +197,35 @@ static void elm_load_syndrome(struct elm_info *info, + break; + case BCH4_ECC: + /* syndrome fragment 0 = ecc[20-52b] bits */ +- val = (cpu_to_be32(*(u32 *) &ecc[3]) >> 4) | ++ val = ((__force u32)cpu_to_be32(*(u32 *)&ecc[3]) >> 4) | + ((ecc[2] & 0xf) << 28); + elm_write_reg(info, offset, val); + + /* syndrome fragment 1 = ecc[0-20b] bits */ + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[0]) >> 12; ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[0]) >> 12; + elm_write_reg(info, offset, val); + break; + case BCH16_ECC: +- val = cpu_to_be32(*(u32 *) &ecc[22]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[22]); + elm_write_reg(info, offset, val); + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[18]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[18]); + elm_write_reg(info, offset, val); + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[14]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[14]); + elm_write_reg(info, offset, val); + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[10]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[10]); + elm_write_reg(info, offset, val); + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[6]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[6]); + elm_write_reg(info, offset, val); + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[2]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[2]); + elm_write_reg(info, offset, val); + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[0]) >> 16; ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[0]) >> 16; + elm_write_reg(info, offset, val); + break; + default: +-- +2.40.1 + diff --git a/queue-5.15/mtd-rawnand-rockchip-align-hwecc-vs.-raw-page-helper.patch b/queue-5.15/mtd-rawnand-rockchip-align-hwecc-vs.-raw-page-helper.patch new file mode 100644 index 00000000000..cf7a085e429 --- /dev/null +++ b/queue-5.15/mtd-rawnand-rockchip-align-hwecc-vs.-raw-page-helper.patch @@ -0,0 +1,114 @@ +From f2ff1129ac6d9cc0d27280b29fe3ee1f5bacf14c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jul 2023 17:21:21 +0200 +Subject: mtd: rawnand: rockchip: Align hwecc vs. raw page helper layouts + +From: Johan Jonker + +[ Upstream commit ea690ad78dd611e3906df5b948a516000b05c1cb ] + +Currently, read/write_page_hwecc() and read/write_page_raw() are not +aligned: there is a mismatch in the OOB bytes which are not +read/written at the same offset in both cases (raw vs. hwecc). + +This is a real problem when relying on the presence of the Page +Addresses (PA) when using the NAND chip as a boot device, as the +BootROM expects additional data in the OOB area at specific locations. + +Rockchip boot blocks are written per 4 x 512 byte sectors per page. +Each page with boot blocks must have a page address (PA) pointer in OOB +to the next page. Pages are written in a pattern depending on the NAND chip ID. + +Generate boot block page address and pattern for hwecc in user space +and copy PA data to/from the already reserved last 4 bytes before ECC +in the chip->oob_poi data layout. + +Align the different helpers. This change breaks existing jffs2 users. + +Fixes: 058e0e847d54 ("mtd: rawnand: rockchip: NFC driver for RK3308, RK2928 and others") +Signed-off-by: Johan Jonker +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/5e782c08-862b-51ae-47ff-3299940928ca@gmail.com +Signed-off-by: Sasha Levin +--- + .../mtd/nand/raw/rockchip-nand-controller.c | 34 ++++++++++++------- + 1 file changed, 21 insertions(+), 13 deletions(-) + +diff --git a/drivers/mtd/nand/raw/rockchip-nand-controller.c b/drivers/mtd/nand/raw/rockchip-nand-controller.c +index 45cdc6ca210ca..99242bd684375 100644 +--- a/drivers/mtd/nand/raw/rockchip-nand-controller.c ++++ b/drivers/mtd/nand/raw/rockchip-nand-controller.c +@@ -598,7 +598,7 @@ static int rk_nfc_write_page_hwecc(struct nand_chip *chip, const u8 *buf, + int pages_per_blk = mtd->erasesize / mtd->writesize; + int ret = 0, i, boot_rom_mode = 0; + dma_addr_t dma_data, dma_oob; +- u32 reg; ++ u32 tmp; + u8 *oob; + + nand_prog_page_begin_op(chip, page, 0, NULL, 0); +@@ -625,6 +625,13 @@ static int rk_nfc_write_page_hwecc(struct nand_chip *chip, const u8 *buf, + * + * 0xFF 0xFF 0xFF 0xFF | BBM OOB1 OOB2 OOB3 | ... + * ++ * The code here just swaps the first 4 bytes with the last ++ * 4 bytes without losing any data. ++ * ++ * The chip->oob_poi data layout: ++ * ++ * BBM OOB1 OOB2 OOB3 |......| PA0 PA1 PA2 PA3 ++ * + * Configure the ECC algorithm supported by the boot ROM. + */ + if ((page < (pages_per_blk * rknand->boot_blks)) && +@@ -635,21 +642,17 @@ static int rk_nfc_write_page_hwecc(struct nand_chip *chip, const u8 *buf, + } + + for (i = 0; i < ecc->steps; i++) { +- if (!i) { +- reg = 0xFFFFFFFF; +- } else { ++ if (!i) ++ oob = chip->oob_poi + (ecc->steps - 1) * NFC_SYS_DATA_SIZE; ++ else + oob = chip->oob_poi + (i - 1) * NFC_SYS_DATA_SIZE; +- reg = oob[0] | oob[1] << 8 | oob[2] << 16 | +- oob[3] << 24; +- } + +- if (!i && boot_rom_mode) +- reg = (page & (pages_per_blk - 1)) * 4; ++ tmp = oob[0] | oob[1] << 8 | oob[2] << 16 | oob[3] << 24; + + if (nfc->cfg->type == NFC_V9) +- nfc->oob_buf[i] = reg; ++ nfc->oob_buf[i] = tmp; + else +- nfc->oob_buf[i * (oob_step / 4)] = reg; ++ nfc->oob_buf[i * (oob_step / 4)] = tmp; + } + + dma_data = dma_map_single(nfc->dev, (void *)nfc->page_buf, +@@ -812,12 +815,17 @@ static int rk_nfc_read_page_hwecc(struct nand_chip *chip, u8 *buf, int oob_on, + goto timeout_err; + } + +- for (i = 1; i < ecc->steps; i++) { +- oob = chip->oob_poi + (i - 1) * NFC_SYS_DATA_SIZE; ++ for (i = 0; i < ecc->steps; i++) { ++ if (!i) ++ oob = chip->oob_poi + (ecc->steps - 1) * NFC_SYS_DATA_SIZE; ++ else ++ oob = chip->oob_poi + (i - 1) * NFC_SYS_DATA_SIZE; ++ + if (nfc->cfg->type == NFC_V9) + tmp = nfc->oob_buf[i]; + else + tmp = nfc->oob_buf[i * (oob_step / 4)]; ++ + *oob++ = (u8)tmp; + *oob++ = (u8)(tmp >> 8); + *oob++ = (u8)(tmp >> 16); +-- +2.40.1 + diff --git a/queue-5.15/mtd-rawnand-rockchip-fix-oobfree-offset-and-descript.patch b/queue-5.15/mtd-rawnand-rockchip-fix-oobfree-offset-and-descript.patch new file mode 100644 index 00000000000..0187e196fb3 --- /dev/null +++ b/queue-5.15/mtd-rawnand-rockchip-fix-oobfree-offset-and-descript.patch @@ -0,0 +1,65 @@ +From 86402a7d05eb1f1774d7bdc0a49389e17ac46bca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jul 2023 17:21:01 +0200 +Subject: mtd: rawnand: rockchip: fix oobfree offset and description + +From: Johan Jonker + +[ Upstream commit d0ca3b92b7a6f42841ea9da8492aaf649db79780 ] + +Rockchip boot blocks are written per 4 x 512 byte sectors per page. +Each page with boot blocks must have a page address (PA) pointer in OOB +to the next page. + +The currently advertised free OOB area starts at offset 6, like +if 4 PA bytes were located right after the BBM. This is wrong as the +PA bytes are located right before the ECC bytes. + +Fix the layout by allowing access to all bytes between the BBM and the +PA bytes instead of reserving 4 bytes right after the BBM. + +This change breaks existing jffs2 users. + +Fixes: 058e0e847d54 ("mtd: rawnand: rockchip: NFC driver for RK3308, RK2928 and others") +Signed-off-by: Johan Jonker +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/d202f12d-188c-20e8-f2c2-9cc874ad4d22@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/rockchip-nand-controller.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/drivers/mtd/nand/raw/rockchip-nand-controller.c b/drivers/mtd/nand/raw/rockchip-nand-controller.c +index b5405bc7ca3a3..45cdc6ca210ca 100644 +--- a/drivers/mtd/nand/raw/rockchip-nand-controller.c ++++ b/drivers/mtd/nand/raw/rockchip-nand-controller.c +@@ -562,9 +562,10 @@ static int rk_nfc_write_page_raw(struct nand_chip *chip, const u8 *buf, + * BBM OOB1 OOB2 OOB3 |......| PA0 PA1 PA2 PA3 + * + * The rk_nfc_ooblayout_free() function already has reserved +- * these 4 bytes with: ++ * these 4 bytes together with 2 bytes for BBM ++ * by reducing it's length: + * +- * oob_region->offset = NFC_SYS_DATA_SIZE + 2; ++ * oob_region->length = rknand->metadata_size - NFC_SYS_DATA_SIZE - 2; + */ + if (!i) + memcpy(rk_nfc_oob_ptr(chip, i), +@@ -935,12 +936,8 @@ static int rk_nfc_ooblayout_free(struct mtd_info *mtd, int section, + if (section) + return -ERANGE; + +- /* +- * The beginning of the OOB area stores the reserved data for the NFC, +- * the size of the reserved data is NFC_SYS_DATA_SIZE bytes. +- */ + oob_region->length = rknand->metadata_size - NFC_SYS_DATA_SIZE - 2; +- oob_region->offset = NFC_SYS_DATA_SIZE + 2; ++ oob_region->offset = 2; + + return 0; + } +-- +2.40.1 + diff --git a/queue-5.15/powerpc-mm-altmap-fix-altmap-boundary-check.patch b/queue-5.15/powerpc-mm-altmap-fix-altmap-boundary-check.patch new file mode 100644 index 00000000000..44cc29057e5 --- /dev/null +++ b/queue-5.15/powerpc-mm-altmap-fix-altmap-boundary-check.patch @@ -0,0 +1,41 @@ +From 8ec027435fc8bdeb28cecc17a2542cda8b25371a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 23:43:20 +0530 +Subject: powerpc/mm/altmap: Fix altmap boundary check + +From: Aneesh Kumar K.V + +[ Upstream commit 6722b25712054c0f903b839b8f5088438dd04df3 ] + +altmap->free includes the entire free space from which altmap blocks +can be allocated. So when checking whether the kernel is doing altmap +block free, compute the boundary correctly, otherwise memory hotunplug +can fail. + +Fixes: 9ef34630a461 ("powerpc/mm: Fallback to RAM if the altmap is unusable") +Signed-off-by: "Aneesh Kumar K.V" +Reviewed-by: David Hildenbrand +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230724181320.471386-1-aneesh.kumar@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/init_64.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c +index b76cd49d521b9..db040f34c0046 100644 +--- a/arch/powerpc/mm/init_64.c ++++ b/arch/powerpc/mm/init_64.c +@@ -313,8 +313,7 @@ void __ref vmemmap_free(unsigned long start, unsigned long end, + start = ALIGN_DOWN(start, page_size); + if (altmap) { + alt_start = altmap->base_pfn; +- alt_end = altmap->base_pfn + altmap->reserve + +- altmap->free + altmap->alloc + altmap->align; ++ alt_end = altmap->base_pfn + altmap->reserve + altmap->free; + } + + pr_debug("vmemmap_free %lx...%lx\n", start, end); +-- +2.40.1 + diff --git a/queue-5.15/series b/queue-5.15/series index f64afaffb02..7605dfcff74 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -77,3 +77,10 @@ bluetooth-l2cap-fix-use-after-free-in-l2cap_sock_ready_cb.patch net-usbnet-fix-warning-in-usbnet_start_xmit-usb_submit_urb.patch fs-protect-reconfiguration-of-sb-read-write-from-racing-writes.patch ext2-drop-fragment-support.patch +mtd-rawnand-omap_elm-fix-incorrect-type-in-assignmen.patch +mtd-rawnand-rockchip-fix-oobfree-offset-and-descript.patch +mtd-rawnand-rockchip-align-hwecc-vs.-raw-page-helper.patch +mtd-rawnand-fsl_upm-fix-an-off-by-one-test-in-fun_ex.patch +powerpc-mm-altmap-fix-altmap-boundary-check.patch +drm-fsl-dcu-use-drm_plane_helper_destroy.patch +drm-imx-ipuv3-fix-front-porch-adjustment-upon-hactiv.patch -- 2.47.3