From: Sasha Levin Date: Mon, 7 Aug 2023 12:15:29 +0000 (-0400) Subject: Fixes for 6.4 X-Git-Tag: v4.14.321~15 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b5e8014edd44d0fc67c7b4be61aed1211620cb4a;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.4 Signed-off-by: Sasha Levin --- diff --git a/queue-6.4/clk-mediatek-mt8183-add-back-sspm-related-clocks.patch b/queue-6.4/clk-mediatek-mt8183-add-back-sspm-related-clocks.patch new file mode 100644 index 00000000000..13f49842b13 --- /dev/null +++ b/queue-6.4/clk-mediatek-mt8183-add-back-sspm-related-clocks.patch @@ -0,0 +1,109 @@ +From 2db62b3b7d86749587564120d586315e47951691 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 15:42:50 +0800 +Subject: clk: mediatek: mt8183: Add back SSPM related clocks + +From: Chen-Yu Tsai + +[ Upstream commit 1eb8d61ac5c9c7ec56bb96d433532807509b9288 ] + +This reverts commit 860690a93ef23b567f781c1b631623e27190f101. + +On the MT8183, the SSPM related clocks were removed claiming a lack of +usage. This however causes some issues when the driver was converted to +the new simple-probe mechanism. This mechanism allocates enough space +for all the clocks defined in the clock driver, not the highest index +in the DT binding. This leads to out-of-bound writes if their are holes +in the DT binding or the driver (due to deprecated or unimplemented +clocks). These errors can go unnoticed and cause memory corruption, +leading to crashes in unrelated areas, or nothing at all. KASAN will +detect them. + +Add the SSPM related clocks back to the MT8183 clock driver to fully +implement the DT binding. The SSPM clocks are for the power management +co-processor, and should never be turned off. They are marked as such. + +Fixes: 3f37ba7cc385 ("clk: mediatek: mt8183: Convert all remaining clocks to common probe") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20230719074251.1219089-1-wenst@chromium.org +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mt8183.c | 27 +++++++++++++++++++++++++++ + 1 file changed, 27 insertions(+) + +diff --git a/drivers/clk/mediatek/clk-mt8183.c b/drivers/clk/mediatek/clk-mt8183.c +index 2336a1b69c093..3b605c30e8494 100644 +--- a/drivers/clk/mediatek/clk-mt8183.c ++++ b/drivers/clk/mediatek/clk-mt8183.c +@@ -328,6 +328,14 @@ static const char * const atb_parents[] = { + "syspll_d5" + }; + ++static const char * const sspm_parents[] = { ++ "clk26m", ++ "univpll_d2_d4", ++ "syspll_d2_d2", ++ "univpll_d2_d2", ++ "syspll_d3" ++}; ++ + static const char * const dpi0_parents[] = { + "clk26m", + "tvdpll_d2", +@@ -506,6 +514,9 @@ static const struct mtk_mux top_muxes[] = { + /* CLK_CFG_6 */ + MUX_GATE_CLR_SET_UPD(CLK_TOP_MUX_ATB, "atb_sel", + atb_parents, 0xa0, 0xa4, 0xa8, 0, 2, 7, 0x004, 24), ++ MUX_GATE_CLR_SET_UPD_FLAGS(CLK_TOP_MUX_SSPM, "sspm_sel", ++ sspm_parents, 0xa0, 0xa4, 0xa8, 8, 3, 15, 0x004, 25, ++ CLK_IS_CRITICAL | CLK_SET_RATE_PARENT), + MUX_GATE_CLR_SET_UPD(CLK_TOP_MUX_DPI0, "dpi0_sel", + dpi0_parents, 0xa0, 0xa4, 0xa8, 16, 4, 23, 0x004, 26), + MUX_GATE_CLR_SET_UPD(CLK_TOP_MUX_SCAM, "scam_sel", +@@ -671,10 +682,18 @@ static const struct mtk_gate_regs infra3_cg_regs = { + GATE_MTK(_id, _name, _parent, &infra2_cg_regs, _shift, \ + &mtk_clk_gate_ops_setclr) + ++#define GATE_INFRA2_FLAGS(_id, _name, _parent, _shift, _flag) \ ++ GATE_MTK_FLAGS(_id, _name, _parent, &infra2_cg_regs, \ ++ _shift, &mtk_clk_gate_ops_setclr, _flag) ++ + #define GATE_INFRA3(_id, _name, _parent, _shift) \ + GATE_MTK(_id, _name, _parent, &infra3_cg_regs, _shift, \ + &mtk_clk_gate_ops_setclr) + ++#define GATE_INFRA3_FLAGS(_id, _name, _parent, _shift, _flag) \ ++ GATE_MTK_FLAGS(_id, _name, _parent, &infra3_cg_regs, \ ++ _shift, &mtk_clk_gate_ops_setclr, _flag) ++ + static const struct mtk_gate infra_clks[] = { + /* INFRA0 */ + GATE_INFRA0(CLK_INFRA_PMIC_TMR, "infra_pmic_tmr", "axi_sel", 0), +@@ -746,7 +765,11 @@ static const struct mtk_gate infra_clks[] = { + GATE_INFRA2(CLK_INFRA_UNIPRO_TICK, "infra_unipro_tick", "fufs_sel", 12), + GATE_INFRA2(CLK_INFRA_UFS_MP_SAP_BCLK, "infra_ufs_mp_sap_bck", "fufs_sel", 13), + GATE_INFRA2(CLK_INFRA_MD32_BCLK, "infra_md32_bclk", "axi_sel", 14), ++ /* infra_sspm is main clock in co-processor, should not be closed in Linux. */ ++ GATE_INFRA2_FLAGS(CLK_INFRA_SSPM, "infra_sspm", "sspm_sel", 15, CLK_IS_CRITICAL), + GATE_INFRA2(CLK_INFRA_UNIPRO_MBIST, "infra_unipro_mbist", "axi_sel", 16), ++ /* infra_sspm_bus_hclk is main clock in co-processor, should not be closed in Linux. */ ++ GATE_INFRA2_FLAGS(CLK_INFRA_SSPM_BUS_HCLK, "infra_sspm_bus_hclk", "axi_sel", 17, CLK_IS_CRITICAL), + GATE_INFRA2(CLK_INFRA_I2C5, "infra_i2c5", "i2c_sel", 18), + GATE_INFRA2(CLK_INFRA_I2C5_ARBITER, "infra_i2c5_arbiter", "i2c_sel", 19), + GATE_INFRA2(CLK_INFRA_I2C5_IMM, "infra_i2c5_imm", "i2c_sel", 20), +@@ -764,6 +787,10 @@ static const struct mtk_gate infra_clks[] = { + GATE_INFRA3(CLK_INFRA_MSDC0_SELF, "infra_msdc0_self", "msdc50_0_sel", 0), + GATE_INFRA3(CLK_INFRA_MSDC1_SELF, "infra_msdc1_self", "msdc50_0_sel", 1), + GATE_INFRA3(CLK_INFRA_MSDC2_SELF, "infra_msdc2_self", "msdc50_0_sel", 2), ++ /* infra_sspm_26m_self is main clock in co-processor, should not be closed in Linux. */ ++ GATE_INFRA3_FLAGS(CLK_INFRA_SSPM_26M_SELF, "infra_sspm_26m_self", "f_f26m_ck", 3, CLK_IS_CRITICAL), ++ /* infra_sspm_32k_self is main clock in co-processor, should not be closed in Linux. */ ++ GATE_INFRA3_FLAGS(CLK_INFRA_SSPM_32K_SELF, "infra_sspm_32k_self", "f_f26m_ck", 4, CLK_IS_CRITICAL), + GATE_INFRA3(CLK_INFRA_UFS_AXI, "infra_ufs_axi", "axi_sel", 5), + GATE_INFRA3(CLK_INFRA_I2C6, "infra_i2c6", "i2c_sel", 6), + GATE_INFRA3(CLK_INFRA_AP_MSDC0, "infra_ap_msdc0", "msdc50_hclk_sel", 7), +-- +2.40.1 + diff --git a/queue-6.4/drm-imx-ipuv3-fix-front-porch-adjustment-upon-hactiv.patch b/queue-6.4/drm-imx-ipuv3-fix-front-porch-adjustment-upon-hactiv.patch new file mode 100644 index 00000000000..13af4b896a6 --- /dev/null +++ b/queue-6.4/drm-imx-ipuv3-fix-front-porch-adjustment-upon-hactiv.patch @@ -0,0 +1,42 @@ +From df0a276570d1352be2cb6feb94a21cbd365ec9f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 09:21:37 +0200 +Subject: drm/imx/ipuv3: Fix front porch adjustment upon hactive aligning + +From: Alexander Stein + +[ Upstream commit ee31742bf17636da1304af77b2cb1c29b5dda642 ] + +When hactive is not aligned to 8 pixels, it is aligned accordingly and +hfront porch needs to be reduced the same amount. Unfortunately the front +porch is set to the difference rather than reducing it. There are some +Samsung TVs which can't cope with a front porch of instead of 70. + +Fixes: 94dfec48fca7 ("drm/imx: Add 8 pixel alignment fix") +Signed-off-by: Alexander Stein +Reviewed-by: Philipp Zabel +Link: https://lore.kernel.org/r/20230515072137.116211-1-alexander.stein@ew.tq-group.com +[p.zabel@pengutronix.de: Fixed subject] +Signed-off-by: Philipp Zabel +Link: https://patchwork.freedesktop.org/patch/msgid/20230515072137.116211-1-alexander.stein@ew.tq-group.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c +index 5f26090b0c985..89585b31b985e 100644 +--- a/drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c ++++ b/drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c +@@ -310,7 +310,7 @@ static void ipu_crtc_mode_set_nofb(struct drm_crtc *crtc) + dev_warn(ipu_crtc->dev, "8-pixel align hactive %d -> %d\n", + sig_cfg.mode.hactive, new_hactive); + +- sig_cfg.mode.hfront_porch = new_hactive - sig_cfg.mode.hactive; ++ sig_cfg.mode.hfront_porch -= new_hactive - sig_cfg.mode.hactive; + sig_cfg.mode.hactive = new_hactive; + } + +-- +2.40.1 + diff --git a/queue-6.4/mtd-rawnand-fsl_upm-fix-an-off-by-one-test-in-fun_ex.patch b/queue-6.4/mtd-rawnand-fsl_upm-fix-an-off-by-one-test-in-fun_ex.patch new file mode 100644 index 00000000000..76b8e5c114d --- /dev/null +++ b/queue-6.4/mtd-rawnand-fsl_upm-fix-an-off-by-one-test-in-fun_ex.patch @@ -0,0 +1,43 @@ +From a5ec3af420084c2f7db2aa5433993660fcd812fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 23:55:01 +0200 +Subject: mtd: rawnand: fsl_upm: Fix an off-by one test in fun_exec_op() + +From: Christophe JAILLET + +[ Upstream commit c6abce60338aa2080973cd95be0aedad528bb41f ] + +'op-cs' is copied in 'fun->mchip_number' which is used to access the +'mchip_offsets' and the 'rnb_gpio' arrays. +These arrays have NAND_MAX_CHIPS elements, so the index must be below this +limit. + +Fix the sanity check in order to avoid the NAND_MAX_CHIPS value. This +would lead to out-of-bound accesses. + +Fixes: 54309d657767 ("mtd: rawnand: fsl_upm: Implement exec_op()") +Signed-off-by: Christophe JAILLET +Reviewed-by: Dan Carpenter +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/cd01cba1c7eda58bdabaae174c78c067325803d2.1689803636.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/fsl_upm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/fsl_upm.c b/drivers/mtd/nand/raw/fsl_upm.c +index 086426139173f..7366e85c09fd9 100644 +--- a/drivers/mtd/nand/raw/fsl_upm.c ++++ b/drivers/mtd/nand/raw/fsl_upm.c +@@ -135,7 +135,7 @@ static int fun_exec_op(struct nand_chip *chip, const struct nand_operation *op, + unsigned int i; + int ret; + +- if (op->cs > NAND_MAX_CHIPS) ++ if (op->cs >= NAND_MAX_CHIPS) + return -EINVAL; + + if (check_only) +-- +2.40.1 + diff --git a/queue-6.4/mtd-rawnand-omap_elm-fix-incorrect-type-in-assignmen.patch b/queue-6.4/mtd-rawnand-omap_elm-fix-incorrect-type-in-assignmen.patch new file mode 100644 index 00000000000..eba0a063cf7 --- /dev/null +++ b/queue-6.4/mtd-rawnand-omap_elm-fix-incorrect-type-in-assignmen.patch @@ -0,0 +1,120 @@ +From a059094b4d31c37fffd0fd47c1c474db33fbb691 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jun 2023 00:10:21 +0530 +Subject: mtd: rawnand: omap_elm: Fix incorrect type in assignment + +From: Roger Quadros + +[ Upstream commit d8403b9eeee66d5dd81ecb9445800b108c267ce3 ] + +Once the ECC word endianness is converted to BE32, we force cast it +to u32 so we can use elm_write_reg() which in turn uses writel(). + +Fixes below sparse warnings: + + drivers/mtd/nand/raw/omap_elm.c:180:37: sparse: expected unsigned int [usertype] val + drivers/mtd/nand/raw/omap_elm.c:180:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:185:37: sparse: expected unsigned int [usertype] val + drivers/mtd/nand/raw/omap_elm.c:185:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:190:37: sparse: expected unsigned int [usertype] val + drivers/mtd/nand/raw/omap_elm.c:190:37: sparse: got restricted __be32 [usertype] +>> drivers/mtd/nand/raw/omap_elm.c:200:40: sparse: sparse: restricted __be32 degrades to integer + drivers/mtd/nand/raw/omap_elm.c:206:39: sparse: sparse: restricted __be32 degrades to integer + drivers/mtd/nand/raw/omap_elm.c:210:37: sparse: expected unsigned int [assigned] [usertype] val + drivers/mtd/nand/raw/omap_elm.c:210:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:213:37: sparse: expected unsigned int [assigned] [usertype] val + drivers/mtd/nand/raw/omap_elm.c:213:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:216:37: sparse: expected unsigned int [assigned] [usertype] val + drivers/mtd/nand/raw/omap_elm.c:216:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:219:37: sparse: expected unsigned int [assigned] [usertype] val + drivers/mtd/nand/raw/omap_elm.c:219:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:222:37: sparse: expected unsigned int [assigned] [usertype] val + drivers/mtd/nand/raw/omap_elm.c:222:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:225:37: sparse: expected unsigned int [assigned] [usertype] val + drivers/mtd/nand/raw/omap_elm.c:225:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:228:39: sparse: sparse: restricted __be32 degrades to integer + +Fixes: bf22433575ef ("mtd: devices: elm: Add support for ELM error correction") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202306212211.WDXokuWh-lkp@intel.com/ +Signed-off-by: Roger Quadros +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20230624184021.7740-1-rogerq@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/omap_elm.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/drivers/mtd/nand/raw/omap_elm.c b/drivers/mtd/nand/raw/omap_elm.c +index 6e1eac6644a66..4a97d4a76454a 100644 +--- a/drivers/mtd/nand/raw/omap_elm.c ++++ b/drivers/mtd/nand/raw/omap_elm.c +@@ -177,17 +177,17 @@ static void elm_load_syndrome(struct elm_info *info, + switch (info->bch_type) { + case BCH8_ECC: + /* syndrome fragment 0 = ecc[9-12B] */ +- val = cpu_to_be32(*(u32 *) &ecc[9]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[9]); + elm_write_reg(info, offset, val); + + /* syndrome fragment 1 = ecc[5-8B] */ + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[5]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[5]); + elm_write_reg(info, offset, val); + + /* syndrome fragment 2 = ecc[1-4B] */ + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[1]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[1]); + elm_write_reg(info, offset, val); + + /* syndrome fragment 3 = ecc[0B] */ +@@ -197,35 +197,35 @@ static void elm_load_syndrome(struct elm_info *info, + break; + case BCH4_ECC: + /* syndrome fragment 0 = ecc[20-52b] bits */ +- val = (cpu_to_be32(*(u32 *) &ecc[3]) >> 4) | ++ val = ((__force u32)cpu_to_be32(*(u32 *)&ecc[3]) >> 4) | + ((ecc[2] & 0xf) << 28); + elm_write_reg(info, offset, val); + + /* syndrome fragment 1 = ecc[0-20b] bits */ + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[0]) >> 12; ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[0]) >> 12; + elm_write_reg(info, offset, val); + break; + case BCH16_ECC: +- val = cpu_to_be32(*(u32 *) &ecc[22]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[22]); + elm_write_reg(info, offset, val); + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[18]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[18]); + elm_write_reg(info, offset, val); + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[14]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[14]); + elm_write_reg(info, offset, val); + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[10]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[10]); + elm_write_reg(info, offset, val); + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[6]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[6]); + elm_write_reg(info, offset, val); + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[2]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[2]); + elm_write_reg(info, offset, val); + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[0]) >> 16; ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[0]) >> 16; + elm_write_reg(info, offset, val); + break; + default: +-- +2.40.1 + diff --git a/queue-6.4/mtd-rawnand-rockchip-align-hwecc-vs.-raw-page-helper.patch b/queue-6.4/mtd-rawnand-rockchip-align-hwecc-vs.-raw-page-helper.patch new file mode 100644 index 00000000000..660b65bc3e7 --- /dev/null +++ b/queue-6.4/mtd-rawnand-rockchip-align-hwecc-vs.-raw-page-helper.patch @@ -0,0 +1,114 @@ +From 5bb49938b7ec6450712e1ca1538f42f786863b32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jul 2023 17:21:21 +0200 +Subject: mtd: rawnand: rockchip: Align hwecc vs. raw page helper layouts + +From: Johan Jonker + +[ Upstream commit ea690ad78dd611e3906df5b948a516000b05c1cb ] + +Currently, read/write_page_hwecc() and read/write_page_raw() are not +aligned: there is a mismatch in the OOB bytes which are not +read/written at the same offset in both cases (raw vs. hwecc). + +This is a real problem when relying on the presence of the Page +Addresses (PA) when using the NAND chip as a boot device, as the +BootROM expects additional data in the OOB area at specific locations. + +Rockchip boot blocks are written per 4 x 512 byte sectors per page. +Each page with boot blocks must have a page address (PA) pointer in OOB +to the next page. Pages are written in a pattern depending on the NAND chip ID. + +Generate boot block page address and pattern for hwecc in user space +and copy PA data to/from the already reserved last 4 bytes before ECC +in the chip->oob_poi data layout. + +Align the different helpers. This change breaks existing jffs2 users. + +Fixes: 058e0e847d54 ("mtd: rawnand: rockchip: NFC driver for RK3308, RK2928 and others") +Signed-off-by: Johan Jonker +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/5e782c08-862b-51ae-47ff-3299940928ca@gmail.com +Signed-off-by: Sasha Levin +--- + .../mtd/nand/raw/rockchip-nand-controller.c | 34 ++++++++++++------- + 1 file changed, 21 insertions(+), 13 deletions(-) + +diff --git a/drivers/mtd/nand/raw/rockchip-nand-controller.c b/drivers/mtd/nand/raw/rockchip-nand-controller.c +index 37fc07ba57aab..5a04680342c32 100644 +--- a/drivers/mtd/nand/raw/rockchip-nand-controller.c ++++ b/drivers/mtd/nand/raw/rockchip-nand-controller.c +@@ -598,7 +598,7 @@ static int rk_nfc_write_page_hwecc(struct nand_chip *chip, const u8 *buf, + int pages_per_blk = mtd->erasesize / mtd->writesize; + int ret = 0, i, boot_rom_mode = 0; + dma_addr_t dma_data, dma_oob; +- u32 reg; ++ u32 tmp; + u8 *oob; + + nand_prog_page_begin_op(chip, page, 0, NULL, 0); +@@ -625,6 +625,13 @@ static int rk_nfc_write_page_hwecc(struct nand_chip *chip, const u8 *buf, + * + * 0xFF 0xFF 0xFF 0xFF | BBM OOB1 OOB2 OOB3 | ... + * ++ * The code here just swaps the first 4 bytes with the last ++ * 4 bytes without losing any data. ++ * ++ * The chip->oob_poi data layout: ++ * ++ * BBM OOB1 OOB2 OOB3 |......| PA0 PA1 PA2 PA3 ++ * + * Configure the ECC algorithm supported by the boot ROM. + */ + if ((page < (pages_per_blk * rknand->boot_blks)) && +@@ -635,21 +642,17 @@ static int rk_nfc_write_page_hwecc(struct nand_chip *chip, const u8 *buf, + } + + for (i = 0; i < ecc->steps; i++) { +- if (!i) { +- reg = 0xFFFFFFFF; +- } else { ++ if (!i) ++ oob = chip->oob_poi + (ecc->steps - 1) * NFC_SYS_DATA_SIZE; ++ else + oob = chip->oob_poi + (i - 1) * NFC_SYS_DATA_SIZE; +- reg = oob[0] | oob[1] << 8 | oob[2] << 16 | +- oob[3] << 24; +- } + +- if (!i && boot_rom_mode) +- reg = (page & (pages_per_blk - 1)) * 4; ++ tmp = oob[0] | oob[1] << 8 | oob[2] << 16 | oob[3] << 24; + + if (nfc->cfg->type == NFC_V9) +- nfc->oob_buf[i] = reg; ++ nfc->oob_buf[i] = tmp; + else +- nfc->oob_buf[i * (oob_step / 4)] = reg; ++ nfc->oob_buf[i * (oob_step / 4)] = tmp; + } + + dma_data = dma_map_single(nfc->dev, (void *)nfc->page_buf, +@@ -812,12 +815,17 @@ static int rk_nfc_read_page_hwecc(struct nand_chip *chip, u8 *buf, int oob_on, + goto timeout_err; + } + +- for (i = 1; i < ecc->steps; i++) { +- oob = chip->oob_poi + (i - 1) * NFC_SYS_DATA_SIZE; ++ for (i = 0; i < ecc->steps; i++) { ++ if (!i) ++ oob = chip->oob_poi + (ecc->steps - 1) * NFC_SYS_DATA_SIZE; ++ else ++ oob = chip->oob_poi + (i - 1) * NFC_SYS_DATA_SIZE; ++ + if (nfc->cfg->type == NFC_V9) + tmp = nfc->oob_buf[i]; + else + tmp = nfc->oob_buf[i * (oob_step / 4)]; ++ + *oob++ = (u8)tmp; + *oob++ = (u8)(tmp >> 8); + *oob++ = (u8)(tmp >> 16); +-- +2.40.1 + diff --git a/queue-6.4/mtd-rawnand-rockchip-fix-oobfree-offset-and-descript.patch b/queue-6.4/mtd-rawnand-rockchip-fix-oobfree-offset-and-descript.patch new file mode 100644 index 00000000000..657bb8a3aef --- /dev/null +++ b/queue-6.4/mtd-rawnand-rockchip-fix-oobfree-offset-and-descript.patch @@ -0,0 +1,65 @@ +From 83128e90e22ac7fcb58ba7cb262e42b6efc4305c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jul 2023 17:21:01 +0200 +Subject: mtd: rawnand: rockchip: fix oobfree offset and description + +From: Johan Jonker + +[ Upstream commit d0ca3b92b7a6f42841ea9da8492aaf649db79780 ] + +Rockchip boot blocks are written per 4 x 512 byte sectors per page. +Each page with boot blocks must have a page address (PA) pointer in OOB +to the next page. + +The currently advertised free OOB area starts at offset 6, like +if 4 PA bytes were located right after the BBM. This is wrong as the +PA bytes are located right before the ECC bytes. + +Fix the layout by allowing access to all bytes between the BBM and the +PA bytes instead of reserving 4 bytes right after the BBM. + +This change breaks existing jffs2 users. + +Fixes: 058e0e847d54 ("mtd: rawnand: rockchip: NFC driver for RK3308, RK2928 and others") +Signed-off-by: Johan Jonker +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/d202f12d-188c-20e8-f2c2-9cc874ad4d22@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/rockchip-nand-controller.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/drivers/mtd/nand/raw/rockchip-nand-controller.c b/drivers/mtd/nand/raw/rockchip-nand-controller.c +index 2312e27362cbe..37fc07ba57aab 100644 +--- a/drivers/mtd/nand/raw/rockchip-nand-controller.c ++++ b/drivers/mtd/nand/raw/rockchip-nand-controller.c +@@ -562,9 +562,10 @@ static int rk_nfc_write_page_raw(struct nand_chip *chip, const u8 *buf, + * BBM OOB1 OOB2 OOB3 |......| PA0 PA1 PA2 PA3 + * + * The rk_nfc_ooblayout_free() function already has reserved +- * these 4 bytes with: ++ * these 4 bytes together with 2 bytes for BBM ++ * by reducing it's length: + * +- * oob_region->offset = NFC_SYS_DATA_SIZE + 2; ++ * oob_region->length = rknand->metadata_size - NFC_SYS_DATA_SIZE - 2; + */ + if (!i) + memcpy(rk_nfc_oob_ptr(chip, i), +@@ -933,12 +934,8 @@ static int rk_nfc_ooblayout_free(struct mtd_info *mtd, int section, + if (section) + return -ERANGE; + +- /* +- * The beginning of the OOB area stores the reserved data for the NFC, +- * the size of the reserved data is NFC_SYS_DATA_SIZE bytes. +- */ + oob_region->length = rknand->metadata_size - NFC_SYS_DATA_SIZE - 2; +- oob_region->offset = NFC_SYS_DATA_SIZE + 2; ++ oob_region->offset = 2; + + return 0; + } +-- +2.40.1 + diff --git a/queue-6.4/mtd-spi-nor-avoid-holes-in-struct-spi_mem_op.patch b/queue-6.4/mtd-spi-nor-avoid-holes-in-struct-spi_mem_op.patch new file mode 100644 index 00000000000..d2cb6b723d2 --- /dev/null +++ b/queue-6.4/mtd-spi-nor-avoid-holes-in-struct-spi_mem_op.patch @@ -0,0 +1,112 @@ +From 35d29ad3963ac8a9ed9f222fb1fd8840ca41ec2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 21:00:25 +0200 +Subject: mtd: spi-nor: avoid holes in struct spi_mem_op + +From: Arnd Bergmann + +[ Upstream commit 71c8f9cf2623d0db79665f876b95afcdd8214aec ] + +gcc gets confused when -ftrivial-auto-var-init=pattern is used on sparse +bit fields such as 'struct spi_mem_op', which caused the previous false +positive warning about an uninitialized variable: + +drivers/mtd/spi-nor/spansion.c: error: 'op' is used uninitialized [-Werror=uninitialized] + +In fact, the variable is fully initialized and gcc does not see it being +used, so the warning is entirely bogus. The problem appears to be +a misoptimization in the initialization of single bit fields when the +rest of the bytes are not initialized. + +A previous workaround added another initialization, which ended up +shutting up the warning in spansion.c, though it apparently still happens +in other files as reported by Peter Foley in the gcc bugzilla. The +workaround of adding a fake initialization seems particularly bad +because it would set values that can never be correct but prevent the +compiler from warning about actually missing initializations. + +Revert the broken workaround and instead pad the structure to only +have bitfields that add up to full bytes, which should avoid this +behavior in all drivers. + +I also filed a new bug against gcc with what I found, so this can +hopefully be addressed in future gcc releases. At the moment, only +gcc-12 and gcc-13 are affected. + +Cc: Peter Foley +Cc: Pedro Falcato +Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110743 +Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108402 +Link: https://godbolt.org/z/efMMsG1Kx +Fixes: 420c4495b5e56 ("mtd: spi-nor: spansion: make sure local struct does not contain garbage") +Signed-off-by: Arnd Bergmann +Acked-by: Mark Brown +Acked-by: Tudor Ambarus +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20230719190045.4007391-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/mtd/spi-nor/spansion.c | 4 ++-- + include/linux/spi/spi-mem.h | 4 ++++ + 2 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/spi-nor/spansion.c b/drivers/mtd/spi-nor/spansion.c +index 36876aa849ede..15f9a80c10b9b 100644 +--- a/drivers/mtd/spi-nor/spansion.c ++++ b/drivers/mtd/spi-nor/spansion.c +@@ -361,7 +361,7 @@ static int cypress_nor_determine_addr_mode_by_sr1(struct spi_nor *nor, + */ + static int cypress_nor_set_addr_mode_nbytes(struct spi_nor *nor) + { +- struct spi_mem_op op = {}; ++ struct spi_mem_op op; + u8 addr_mode; + int ret; + +@@ -492,7 +492,7 @@ s25fs256t_post_bfpt_fixup(struct spi_nor *nor, + const struct sfdp_parameter_header *bfpt_header, + const struct sfdp_bfpt *bfpt) + { +- struct spi_mem_op op = {}; ++ struct spi_mem_op op; + int ret; + + ret = cypress_nor_set_addr_mode_nbytes(nor); +diff --git a/include/linux/spi/spi-mem.h b/include/linux/spi/spi-mem.h +index 8e984d75f5b6c..6b0a7dc48a4b7 100644 +--- a/include/linux/spi/spi-mem.h ++++ b/include/linux/spi/spi-mem.h +@@ -101,6 +101,7 @@ struct spi_mem_op { + u8 nbytes; + u8 buswidth; + u8 dtr : 1; ++ u8 __pad : 7; + u16 opcode; + } cmd; + +@@ -108,6 +109,7 @@ struct spi_mem_op { + u8 nbytes; + u8 buswidth; + u8 dtr : 1; ++ u8 __pad : 7; + u64 val; + } addr; + +@@ -115,12 +117,14 @@ struct spi_mem_op { + u8 nbytes; + u8 buswidth; + u8 dtr : 1; ++ u8 __pad : 7; + } dummy; + + struct { + u8 buswidth; + u8 dtr : 1; + u8 ecc : 1; ++ u8 __pad : 6; + enum spi_mem_data_dir dir; + unsigned int nbytes; + union { +-- +2.40.1 + diff --git a/queue-6.4/powerpc-mm-altmap-fix-altmap-boundary-check.patch b/queue-6.4/powerpc-mm-altmap-fix-altmap-boundary-check.patch new file mode 100644 index 00000000000..4ac0d8021b4 --- /dev/null +++ b/queue-6.4/powerpc-mm-altmap-fix-altmap-boundary-check.patch @@ -0,0 +1,41 @@ +From 916acd209f84c563dd9b1110c022a119c3bc9f4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 23:43:20 +0530 +Subject: powerpc/mm/altmap: Fix altmap boundary check + +From: Aneesh Kumar K.V + +[ Upstream commit 6722b25712054c0f903b839b8f5088438dd04df3 ] + +altmap->free includes the entire free space from which altmap blocks +can be allocated. So when checking whether the kernel is doing altmap +block free, compute the boundary correctly, otherwise memory hotunplug +can fail. + +Fixes: 9ef34630a461 ("powerpc/mm: Fallback to RAM if the altmap is unusable") +Signed-off-by: "Aneesh Kumar K.V" +Reviewed-by: David Hildenbrand +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230724181320.471386-1-aneesh.kumar@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/init_64.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c +index fe1b83020e0df..0ec5b45b1e86a 100644 +--- a/arch/powerpc/mm/init_64.c ++++ b/arch/powerpc/mm/init_64.c +@@ -314,8 +314,7 @@ void __ref vmemmap_free(unsigned long start, unsigned long end, + start = ALIGN_DOWN(start, page_size); + if (altmap) { + alt_start = altmap->base_pfn; +- alt_end = altmap->base_pfn + altmap->reserve + +- altmap->free + altmap->alloc + altmap->align; ++ alt_end = altmap->base_pfn + altmap->reserve + altmap->free; + } + + pr_debug("vmemmap_free %lx...%lx\n", start, end); +-- +2.40.1 + diff --git a/queue-6.4/series b/queue-6.4/series index dc21521321a..8eab08bed69 100644 --- a/queue-6.4/series +++ b/queue-6.4/series @@ -145,3 +145,11 @@ ext2-drop-fragment-support.patch btrfs-remove-bug_on-s-in-add_new_free_space.patch f2fs-fix-to-do-sanity-check-on-direct-node-in-truncate_dnode.patch io_uring-annotate-offset-timeout-races.patch +mtd-rawnand-omap_elm-fix-incorrect-type-in-assignmen.patch +mtd-rawnand-rockchip-fix-oobfree-offset-and-descript.patch +mtd-rawnand-rockchip-align-hwecc-vs.-raw-page-helper.patch +clk-mediatek-mt8183-add-back-sspm-related-clocks.patch +mtd-spi-nor-avoid-holes-in-struct-spi_mem_op.patch +mtd-rawnand-fsl_upm-fix-an-off-by-one-test-in-fun_ex.patch +powerpc-mm-altmap-fix-altmap-boundary-check.patch +drm-imx-ipuv3-fix-front-porch-adjustment-upon-hactiv.patch