--- /dev/null
+From 88a173e5dd05e788068e8fa20a8c37c44bd8f416 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Mon, 11 Dec 2023 10:11:34 +0200
+Subject: drm/i915: Reject async flips with bigjoiner
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 88a173e5dd05e788068e8fa20a8c37c44bd8f416 upstream.
+
+Currently async flips are busted when bigjoiner is in use.
+As a short term fix simply reject async flips in that case.
+
+Cc: stable@vger.kernel.org
+Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/9769
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231211081134.2698-1-ville.syrjala@linux.intel.com
+Reviewed-by: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
+(cherry picked from commit e93bffc2ac0a833b42841f31fff955549d38ce98)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_display.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/gpu/drm/i915/display/intel_display.c
++++ b/drivers/gpu/drm/i915/display/intel_display.c
+@@ -15761,6 +15761,17 @@ static void intel_atomic_track_fbs(struc
+ struct intel_plane *plane;
+ int i;
+
++ /*
++ * FIXME: Bigjoiner+async flip is busted currently.
++ * Remove this check once the issues are fixed.
++ */
++ if (new_crtc_state->bigjoiner_pipes) {
++ drm_dbg_kms(&i915->drm,
++ "[CRTC:%d:%s] async flip disallowed with bigjoiner\n",
++ crtc->base.base.id, crtc->base.name);
++ return -EINVAL;
++ }
++
+ for_each_oldnew_intel_plane_in_state(state, plane, old_plane_state,
+ new_plane_state, i)
+ intel_frontbuffer_track(to_intel_frontbuffer(old_plane_state->hw.fb),
--- /dev/null
+From a2a8aefecbd0f87d6127951cef33b3def8439057 Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <festevam@denx.de>
+Date: Fri, 15 Dec 2023 11:13:57 +0000
+Subject: dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp
+
+From: Fabio Estevam <festevam@denx.de>
+
+commit a2a8aefecbd0f87d6127951cef33b3def8439057 upstream.
+
+Both imx23.dtsi and imx28.dtsi describe the OCOTP nodes in
+the format:
+
+compatible = "fsl,imx28-ocotp", "fsl,ocotp";
+
+Document the "fsl,ocotp" entry to fix the following schema
+warning:
+
+efuse@8002c000: compatible: ['fsl,imx23-ocotp', 'fsl,ocotp'] is too long
+from schema $id: http://devicetree.org/schemas/nvmem/mxs-ocotp.yaml#
+
+Fixes: 2c504460f502 ("dt-bindings: nvmem: Convert MXS OCOTP to json-schema")
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Fabio Estevam <festevam@denx.de>
+Acked-by: Conor Dooley <conor.dooley@microchip.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20231215111358.316727-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/nvmem/mxs-ocotp.yaml | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/Documentation/devicetree/bindings/nvmem/mxs-ocotp.yaml
++++ b/Documentation/devicetree/bindings/nvmem/mxs-ocotp.yaml
+@@ -14,9 +14,11 @@ allOf:
+
+ properties:
+ compatible:
+- enum:
+- - fsl,imx23-ocotp
+- - fsl,imx28-ocotp
++ items:
++ - enum:
++ - fsl,imx23-ocotp
++ - fsl,imx28-ocotp
++ - const: fsl,ocotp
+
+ "#address-cells":
+ const: 1
+@@ -40,7 +42,7 @@ additionalProperties: false
+ examples:
+ - |
+ ocotp: efuse@8002c000 {
+- compatible = "fsl,imx28-ocotp";
++ compatible = "fsl,imx28-ocotp", "fsl,ocotp";
+ #address-cells = <1>;
+ #size-cells = <1>;
+ reg = <0x8002c000 0x2000>;
--- /dev/null
+From ea3715941a9b7d816a1e9096ac0577900af2a69e Mon Sep 17 00:00:00 2001
+From: Christoffer Sandberg <cs@tuxedo.de>
+Date: Fri, 22 Dec 2023 23:25:38 -0800
+Subject: Input: soc_button_array - add mapping for airplane mode button
+
+From: Christoffer Sandberg <cs@tuxedo.de>
+
+commit ea3715941a9b7d816a1e9096ac0577900af2a69e upstream.
+
+This add a mapping for the airplane mode button on the TUXEDO Pulse Gen3.
+
+While it is physically a key it behaves more like a switch, sending a key
+down on first press and a key up on 2nd press. Therefor the switch event
+is used here. Besides this behaviour it uses the HID usage-id 0xc6
+(Wireless Radio Button) and not 0xc8 (Wireless Radio Slider Switch), but
+since neither 0xc6 nor 0xc8 are currently implemented at all in
+soc_button_array this not to standard behaviour is not put behind a quirk
+for the moment.
+
+Signed-off-by: Christoffer Sandberg <cs@tuxedo.de>
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Link: https://lore.kernel.org/r/20231215171718.80229-1-wse@tuxedocomputers.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/misc/soc_button_array.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/input/misc/soc_button_array.c
++++ b/drivers/input/misc/soc_button_array.c
+@@ -299,6 +299,11 @@ static int soc_button_parse_btn_desc(str
+ info->name = "power";
+ info->event_code = KEY_POWER;
+ info->wakeup = true;
++ } else if (upage == 0x01 && usage == 0xc6) {
++ info->name = "airplane mode switch";
++ info->event_type = EV_SW;
++ info->event_code = SW_RFKILL_ALL;
++ info->active_low = false;
+ } else if (upage == 0x01 && usage == 0xca) {
+ info->name = "rotation lock switch";
+ info->event_type = EV_SW;
--- /dev/null
+From ff49bf1867578f23a5ffdd38f927f6e1e16796c4 Mon Sep 17 00:00:00 2001
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+Date: Wed, 6 Dec 2023 23:09:13 +0300
+Subject: net: 9p: avoid freeing uninit memory in p9pdu_vreadf
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+commit ff49bf1867578f23a5ffdd38f927f6e1e16796c4 upstream.
+
+If some of p9pdu_readf() calls inside case 'T' in p9pdu_vreadf() fails,
+the error path is not handled properly. *wnames or members of *wnames
+array may be left uninitialized and invalidly freed.
+
+Initialize *wnames to NULL in beginning of case 'T'. Initialize the first
+*wnames array element to NULL and nullify the failing *wnames element so
+that the error path freeing loop stops on the first NULL element and
+doesn't proceed further.
+
+Found by Linux Verification Center (linuxtesting.org).
+
+Fixes: ace51c4dd2f9 ("9p: add new protocol support code")
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Message-ID: <20231206200913.16135-1-pchelkin@ispras.ru>
+Cc: stable@vger.kernel.org
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/9p/protocol.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- a/net/9p/protocol.c
++++ b/net/9p/protocol.c
+@@ -228,6 +228,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int p
+ uint16_t *nwname = va_arg(ap, uint16_t *);
+ char ***wnames = va_arg(ap, char ***);
+
++ *wnames = NULL;
++
+ errcode = p9pdu_readf(pdu, proto_version,
+ "w", nwname);
+ if (!errcode) {
+@@ -237,6 +239,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int p
+ GFP_NOFS);
+ if (!*wnames)
+ errcode = -ENOMEM;
++ else
++ (*wnames)[0] = NULL;
+ }
+
+ if (!errcode) {
+@@ -248,8 +252,10 @@ p9pdu_vreadf(struct p9_fcall *pdu, int p
+ proto_version,
+ "s",
+ &(*wnames)[i]);
+- if (errcode)
++ if (errcode) {
++ (*wnames)[i] = NULL;
+ break;
++ }
+ }
+ }
+
+@@ -257,11 +263,14 @@ p9pdu_vreadf(struct p9_fcall *pdu, int p
+ if (*wnames) {
+ int i;
+
+- for (i = 0; i < *nwname; i++)
++ for (i = 0; i < *nwname; i++) {
++ if (!(*wnames)[i])
++ break;
+ kfree((*wnames)[i]);
++ }
++ kfree(*wnames);
++ *wnames = NULL;
+ }
+- kfree(*wnames);
+- *wnames = NULL;
+ }
+ }
+ break;
--- /dev/null
+From 3dc5d44545453de1de9c53cc529cc960a85933da Mon Sep 17 00:00:00 2001
+From: Ronald Wahl <ronald.wahl@raritan.com>
+Date: Thu, 14 Dec 2023 19:11:12 +0100
+Subject: net: ks8851: Fix TX stall caused by TX buffer overrun
+
+From: Ronald Wahl <ronald.wahl@raritan.com>
+
+commit 3dc5d44545453de1de9c53cc529cc960a85933da upstream.
+
+There is a bug in the ks8851 Ethernet driver that more data is written
+to the hardware TX buffer than actually available. This is caused by
+wrong accounting of the free TX buffer space.
+
+The driver maintains a tx_space variable that represents the TX buffer
+space that is deemed to be free. The ks8851_start_xmit_spi() function
+adds an SKB to a queue if tx_space is large enough and reduces tx_space
+by the amount of buffer space it will later need in the TX buffer and
+then schedules a work item. If there is not enough space then the TX
+queue is stopped.
+
+The worker function ks8851_tx_work() dequeues all the SKBs and writes
+the data into the hardware TX buffer. The last packet will trigger an
+interrupt after it was send. Here it is assumed that all data fits into
+the TX buffer.
+
+In the interrupt routine (which runs asynchronously because it is a
+threaded interrupt) tx_space is updated with the current value from the
+hardware. Also the TX queue is woken up again.
+
+Now it could happen that after data was sent to the hardware and before
+handling the TX interrupt new data is queued in ks8851_start_xmit_spi()
+when the TX buffer space had still some space left. When the interrupt
+is actually handled tx_space is updated from the hardware but now we
+already have new SKBs queued that have not been written to the hardware
+TX buffer yet. Since tx_space has been overwritten by the value from the
+hardware the space is not accounted for.
+
+Now we have more data queued then buffer space available in the hardware
+and ks8851_tx_work() will potentially overrun the hardware TX buffer. In
+many cases it will still work because often the buffer is written out
+fast enough so that no overrun occurs but for example if the peer
+throttles us via flow control then an overrun may happen.
+
+This can be fixed in different ways. The most simple way would be to set
+tx_space to 0 before writing data to the hardware TX buffer preventing
+the queuing of more SKBs until the TX interrupt has been handled. I have
+chosen a slightly more efficient (and still rather simple) way and
+track the amount of data that is already queued and not yet written to
+the hardware. When new SKBs are to be queued the already queued amount
+of data is honoured when checking free TX buffer space.
+
+I tested this with a setup of two linked KS8851 running iperf3 between
+the two in bidirectional mode. Before the fix I got a stall after some
+minutes. With the fix I saw now issues anymore after hours.
+
+Fixes: 3ba81f3ece3c ("net: Micrel KS8851 SPI network driver")
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: Ben Dooks <ben.dooks@codethink.co.uk>
+Cc: Tristram Ha <Tristram.Ha@microchip.com>
+Cc: netdev@vger.kernel.org
+Cc: stable@vger.kernel.org # 5.10+
+Signed-off-by: Ronald Wahl <ronald.wahl@raritan.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://lore.kernel.org/r/20231214181112.76052-1-rwahl@gmx.de
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/micrel/ks8851.h | 3 ++
+ drivers/net/ethernet/micrel/ks8851_common.c | 20 ++++++-------
+ drivers/net/ethernet/micrel/ks8851_spi.c | 42 ++++++++++++++++++----------
+ 3 files changed, 40 insertions(+), 25 deletions(-)
+
+--- a/drivers/net/ethernet/micrel/ks8851.h
++++ b/drivers/net/ethernet/micrel/ks8851.h
+@@ -350,6 +350,8 @@ union ks8851_tx_hdr {
+ * @rxd: Space for receiving SPI data, in DMA-able space.
+ * @txd: Space for transmitting SPI data, in DMA-able space.
+ * @msg_enable: The message flags controlling driver output (see ethtool).
++ * @tx_space: Free space in the hardware TX buffer (cached copy of KS_TXMIR).
++ * @queued_len: Space required in hardware TX buffer for queued packets in txq.
+ * @fid: Incrementing frame id tag.
+ * @rc_ier: Cached copy of KS_IER.
+ * @rc_ccr: Cached copy of KS_CCR.
+@@ -398,6 +400,7 @@ struct ks8851_net {
+ struct work_struct rxctrl_work;
+
+ struct sk_buff_head txq;
++ unsigned int queued_len;
+
+ struct eeprom_93cx6 eeprom;
+ struct regulator *vdd_reg;
+--- a/drivers/net/ethernet/micrel/ks8851_common.c
++++ b/drivers/net/ethernet/micrel/ks8851_common.c
+@@ -363,16 +363,18 @@ static irqreturn_t ks8851_irq(int irq, v
+ handled |= IRQ_RXPSI;
+
+ if (status & IRQ_TXI) {
+- handled |= IRQ_TXI;
++ unsigned short tx_space = ks8851_rdreg16(ks, KS_TXMIR);
+
+- /* no lock here, tx queue should have been stopped */
++ netif_dbg(ks, intr, ks->netdev,
++ "%s: txspace %d\n", __func__, tx_space);
+
+- /* update our idea of how much tx space is available to the
+- * system */
+- ks->tx_space = ks8851_rdreg16(ks, KS_TXMIR);
++ spin_lock(&ks->statelock);
++ ks->tx_space = tx_space;
++ if (netif_queue_stopped(ks->netdev))
++ netif_wake_queue(ks->netdev);
++ spin_unlock(&ks->statelock);
+
+- netif_dbg(ks, intr, ks->netdev,
+- "%s: txspace %d\n", __func__, ks->tx_space);
++ handled |= IRQ_TXI;
+ }
+
+ if (status & IRQ_RXI)
+@@ -415,9 +417,6 @@ static irqreturn_t ks8851_irq(int irq, v
+ if (status & IRQ_LCI)
+ mii_check_link(&ks->mii);
+
+- if (status & IRQ_TXI)
+- netif_wake_queue(ks->netdev);
+-
+ return IRQ_HANDLED;
+ }
+
+@@ -501,6 +500,7 @@ static int ks8851_net_open(struct net_de
+ ks8851_wrreg16(ks, KS_ISR, ks->rc_ier);
+ ks8851_wrreg16(ks, KS_IER, ks->rc_ier);
+
++ ks->queued_len = 0;
+ netif_start_queue(ks->netdev);
+
+ netif_dbg(ks, ifup, ks->netdev, "network device up\n");
+--- a/drivers/net/ethernet/micrel/ks8851_spi.c
++++ b/drivers/net/ethernet/micrel/ks8851_spi.c
+@@ -289,6 +289,18 @@ static void ks8851_wrfifo_spi(struct ks8
+ }
+
+ /**
++ * calc_txlen - calculate size of message to send packet
++ * @len: Length of data
++ *
++ * Returns the size of the TXFIFO message needed to send
++ * this packet.
++ */
++static unsigned int calc_txlen(unsigned int len)
++{
++ return ALIGN(len + 4, 4);
++}
++
++/**
+ * ks8851_rx_skb_spi - receive skbuff
+ * @ks: The device state
+ * @skb: The skbuff
+@@ -307,7 +319,9 @@ static void ks8851_rx_skb_spi(struct ks8
+ */
+ static void ks8851_tx_work(struct work_struct *work)
+ {
++ unsigned int dequeued_len = 0;
+ struct ks8851_net_spi *kss;
++ unsigned short tx_space;
+ struct ks8851_net *ks;
+ unsigned long flags;
+ struct sk_buff *txb;
+@@ -324,6 +338,8 @@ static void ks8851_tx_work(struct work_s
+ last = skb_queue_empty(&ks->txq);
+
+ if (txb) {
++ dequeued_len += calc_txlen(txb->len);
++
+ ks8851_wrreg16_spi(ks, KS_RXQCR,
+ ks->rc_rxqcr | RXQCR_SDA);
+ ks8851_wrfifo_spi(ks, txb, last);
+@@ -334,6 +350,13 @@ static void ks8851_tx_work(struct work_s
+ }
+ }
+
++ tx_space = ks8851_rdreg16_spi(ks, KS_TXMIR);
++
++ spin_lock(&ks->statelock);
++ ks->queued_len -= dequeued_len;
++ ks->tx_space = tx_space;
++ spin_unlock(&ks->statelock);
++
+ ks8851_unlock_spi(ks, &flags);
+ }
+
+@@ -349,18 +372,6 @@ static void ks8851_flush_tx_work_spi(str
+ }
+
+ /**
+- * calc_txlen - calculate size of message to send packet
+- * @len: Length of data
+- *
+- * Returns the size of the TXFIFO message needed to send
+- * this packet.
+- */
+-static unsigned int calc_txlen(unsigned int len)
+-{
+- return ALIGN(len + 4, 4);
+-}
+-
+-/**
+ * ks8851_start_xmit_spi - transmit packet using SPI
+ * @skb: The buffer to transmit
+ * @dev: The device used to transmit the packet.
+@@ -388,16 +399,17 @@ static netdev_tx_t ks8851_start_xmit_spi
+
+ spin_lock(&ks->statelock);
+
+- if (needed > ks->tx_space) {
++ if (ks->queued_len + needed > ks->tx_space) {
+ netif_stop_queue(dev);
+ ret = NETDEV_TX_BUSY;
+ } else {
+- ks->tx_space -= needed;
++ ks->queued_len += needed;
+ skb_queue_tail(&ks->txq, skb);
+ }
+
+ spin_unlock(&ks->statelock);
+- schedule_work(&kss->tx_work);
++ if (ret == NETDEV_TX_OK)
++ schedule_work(&kss->tx_work);
+
+ return ret;
+ }
--- /dev/null
+From 23484d817082c3005252d8edfc8292c8a1006b5b Mon Sep 17 00:00:00 2001
+From: Rouven Czerwinski <r.czerwinski@pengutronix.de>
+Date: Thu, 7 Dec 2023 08:58:36 +0100
+Subject: net: rfkill: gpio: set GPIO direction
+
+From: Rouven Czerwinski <r.czerwinski@pengutronix.de>
+
+commit 23484d817082c3005252d8edfc8292c8a1006b5b upstream.
+
+Fix the undefined usage of the GPIO consumer API after retrieving the
+GPIO description with GPIO_ASIS. The API documentation mentions that
+GPIO_ASIS won't set a GPIO direction and requires the user to set a
+direction before using the GPIO.
+
+This can be confirmed on i.MX6 hardware, where rfkill-gpio is no longer
+able to enabled/disable a device, presumably because the GPIO controller
+was never configured for the output direction.
+
+Fixes: b2f750c3a80b ("net: rfkill: gpio: prevent value glitch during probe")
+Cc: stable@vger.kernel.org
+Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
+Link: https://msgid.link/20231207075835.3091694-1-r.czerwinski@pengutronix.de
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rfkill/rfkill-gpio.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/net/rfkill/rfkill-gpio.c
++++ b/net/rfkill/rfkill-gpio.c
+@@ -116,6 +116,14 @@ static int rfkill_gpio_probe(struct plat
+ return -EINVAL;
+ }
+
++ ret = gpiod_direction_output(rfkill->reset_gpio, true);
++ if (ret)
++ return ret;
++
++ ret = gpiod_direction_output(rfkill->shutdown_gpio, true);
++ if (ret)
++ return ret;
++
+ rfkill->rfkill_dev = rfkill_alloc(rfkill->name, &pdev->dev,
+ rfkill->type, &rfkill_gpio_ops,
+ rfkill);
usb-serial-option-add-quectel-rm500q-r13-firmware-support.patch
bluetooth-hci_event-fix-not-checking-if-hci_op_inquiry-has-been-sent.patch
bluetooth-l2cap-send-reject-on-command-corrupted-request.patch
+input-soc_button_array-add-mapping-for-airplane-mode-button.patch
+net-9p-avoid-freeing-uninit-memory-in-p9pdu_vreadf.patch
+net-rfkill-gpio-set-gpio-direction.patch
+net-ks8851-fix-tx-stall-caused-by-tx-buffer-overrun.patch
+dt-bindings-nvmem-mxs-ocotp-document-fsl-ocotp.patch
+drm-i915-reject-async-flips-with-bigjoiner.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
