diff --git a/config/arm64/default b/config/arm64/default index 37ed08a..2e36fc8 100644 --- a/config/arm64/default +++ b/config/arm64/default @@ -5971,6 +5971,10 @@ CONFIG_IR_TOY=m CONFIG_CEC_CORE=m CONFIG_CEC_NOTIFIER=y CONFIG_CEC_PIN=y + +# +# CEC support +# CONFIG_MEDIA_CEC_RC=y CONFIG_CEC_PIN_ERROR_INJ=y CONFIG_MEDIA_CEC_SUPPORT=y @@ -5982,6 +5986,8 @@ CONFIG_CEC_SAMSUNG_S5P=m CONFIG_CEC_TEGRA=m CONFIG_USB_PULSE8_CEC=m CONFIG_USB_RAINSHADOW_CEC=m +# end of CEC support + CONFIG_MEDIA_SUPPORT=m CONFIG_MEDIA_SUPPORT_FILTER=y CONFIG_MEDIA_SUBDRV_AUTOSELECT=y diff --git a/config/armv7hl/default b/config/armv7hl/default index 05835da..bc89a6c 100644 --- a/config/armv7hl/default +++ b/config/armv7hl/default @@ -5906,6 +5906,10 @@ CONFIG_IR_TOY=m CONFIG_CEC_CORE=y CONFIG_CEC_NOTIFIER=y CONFIG_CEC_PIN=y + +# +# CEC support +# # CONFIG_CEC_PIN_ERROR_INJ is not set CONFIG_MEDIA_CEC_SUPPORT=y CONFIG_CEC_CH7322=m @@ -5917,6 +5921,8 @@ CONFIG_CEC_STI=m CONFIG_CEC_TEGRA=m CONFIG_USB_PULSE8_CEC=m CONFIG_USB_RAINSHADOW_CEC=m +# end of CEC support + CONFIG_MEDIA_SUPPORT=m CONFIG_MEDIA_SUPPORT_FILTER=y CONFIG_MEDIA_SUBDRV_AUTOSELECT=y diff --git a/config/ppc64le/default b/config/ppc64le/default index 77f64d2..f51c129 100644 --- a/config/ppc64le/default +++ b/config/ppc64le/default @@ -4277,11 +4277,17 @@ CONFIG_IR_SIR=m CONFIG_RC_XBOX_DVD=m CONFIG_IR_TOY=m CONFIG_CEC_CORE=m + +# +# CEC support +# CONFIG_MEDIA_CEC_RC=y CONFIG_MEDIA_CEC_SUPPORT=y CONFIG_CEC_CH7322=m CONFIG_USB_PULSE8_CEC=m CONFIG_USB_RAINSHADOW_CEC=m +# end of CEC support + # CONFIG_MEDIA_SUPPORT is not set # diff --git a/config/s390x/default b/config/s390x/default index 29c01fb..e9011d7 100644 --- a/config/s390x/default +++ b/config/s390x/default @@ -2743,8 +2743,14 @@ CONFIG_RC_LOOPBACK=m # CONFIG_IR_SERIAL is not set # CONFIG_IR_SIR is not set CONFIG_CEC_CORE=m + +# +# CEC support +# # CONFIG_MEDIA_CEC_RC is not set # CONFIG_MEDIA_CEC_SUPPORT is not set +# end of CEC support + # CONFIG_MEDIA_SUPPORT is not set # diff --git a/config/s390x/zfcpdump b/config/s390x/zfcpdump index a8ec1fc..7962757 100644 --- a/config/s390x/zfcpdump +++ b/config/s390x/zfcpdump @@ -954,7 +954,12 @@ CONFIG_PTP_1588_CLOCK_OPTIONAL=y # CONFIG_WATCHDOG is not set # CONFIG_REGULATOR is not set # CONFIG_RC_CORE is not set + +# +# CEC support +# # CONFIG_MEDIA_CEC_SUPPORT is not set +# end of CEC support # # Graphics support diff --git a/config/x86_64/default b/config/x86_64/default index b014560..bd85006 100644 --- a/config/x86_64/default +++ b/config/x86_64/default @@ -5380,6 +5380,10 @@ CONFIG_IR_TOY=m CONFIG_CEC_CORE=m CONFIG_CEC_NOTIFIER=y CONFIG_CEC_PIN=y + +# +# CEC support +# CONFIG_MEDIA_CEC_RC=y # CONFIG_CEC_PIN_ERROR_INJ is not set CONFIG_MEDIA_CEC_SUPPORT=y @@ -5390,6 +5394,8 @@ CONFIG_CEC_SECO=m # CONFIG_CEC_SECO_RC is not set CONFIG_USB_PULSE8_CEC=m CONFIG_USB_RAINSHADOW_CEC=m +# end of CEC support + CONFIG_MEDIA_SUPPORT=m CONFIG_MEDIA_SUPPORT_FILTER=y CONFIG_MEDIA_SUBDRV_AUTOSELECT=y diff --git a/patches.suse/firmware-psci-fix-application-of-sizeof-to-pointer.patch b/patches.suse/firmware-psci-fix-application-of-sizeof-to-pointer.patch new file mode 100644 index 0000000..58f70cc --- /dev/null +++ b/patches.suse/firmware-psci-fix-application-of-sizeof-to-pointer.patch @@ -0,0 +1,44 @@ +From 2ac5fb35cd520ab1851c9a4816c523b65276052f Mon Sep 17 00:00:00 2001 +From: jing yangyang +Date: Thu, 19 Aug 2021 19:30:16 -0700 +Subject: [PATCH] firmware/psci: fix application of sizeof to pointer +Git-commit: 2ac5fb35cd520ab1851c9a4816c523b65276052f +Patch-mainline: v5.16-rc1 +References: git-fixes + +sizeof when applied to a pointer typed expression gives the size of +the pointer. + +./drivers/firmware/psci/psci_checker.c:158:41-47: ERROR application of sizeof to pointer + +This issue was detected with the help of Coccinelle. + +Fixes: 7401056de5f8 ("drivers/firmware: psci_checker: stash and use topology_core_cpumask for hotplug tests") +Cc: stable@vger.kernel.org +Reported-by: Zeal Robot +Acked-by: Mark Rutland +Reviewed-by: Gustavo A. R. Silva +Signed-off-by: jing yangyang +Signed-off-by: Gustavo A. R. Silva +Acked-by: Takashi Iwai + +--- + drivers/firmware/psci/psci_checker.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/psci/psci_checker.c b/drivers/firmware/psci/psci_checker.c +index 9a369a2eda71..116eb465cdb4 100644 +--- a/drivers/firmware/psci/psci_checker.c ++++ b/drivers/firmware/psci/psci_checker.c +@@ -155,7 +155,7 @@ static int alloc_init_cpu_groups(cpumask_var_t **pcpu_groups) + if (!alloc_cpumask_var(&tmp, GFP_KERNEL)) + return -ENOMEM; + +- cpu_groups = kcalloc(nb_available_cpus, sizeof(cpu_groups), ++ cpu_groups = kcalloc(nb_available_cpus, sizeof(*cpu_groups), + GFP_KERNEL); + if (!cpu_groups) { + free_cpumask_var(tmp); +-- +2.26.2 + diff --git a/patches.suse/fortify-Fix-dropped-strcpy-compile-time-write-overfl.patch b/patches.suse/fortify-Fix-dropped-strcpy-compile-time-write-overfl.patch new file mode 100644 index 0000000..5fbaabc --- /dev/null +++ b/patches.suse/fortify-Fix-dropped-strcpy-compile-time-write-overfl.patch @@ -0,0 +1,42 @@ +From 072af0c638dc8a5c7db2edc4dddbd6d44bee3bdb Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Mon, 2 Aug 2021 10:25:01 -0700 +Subject: [PATCH] fortify: Fix dropped strcpy() compile-time write overflow check +Git-commit: 072af0c638dc8a5c7db2edc4dddbd6d44bee3bdb +Patch-mainline: v5.16-rc1 +References: git-fixes + +The implementation for intra-object overflow in str*-family functions +accidentally dropped compile-time write overflow checking in strcpy(), +leaving it entirely to run-time. Add back the intended check. + +Fixes: 6a39e62abbaf ("lib: string.h: detect intra-object overflow in fortified string functions") +Cc: Daniel Axtens +Cc: Francis Laniel +Signed-off-by: Kees Cook +Reviewed-by: Nick Desaulniers +Acked-by: Takashi Iwai + +--- + include/linux/fortify-string.h | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/include/linux/fortify-string.h b/include/linux/fortify-string.h +index 7e67d02764db..68bc5978d916 100644 +--- a/include/linux/fortify-string.h ++++ b/include/linux/fortify-string.h +@@ -287,7 +287,10 @@ __FORTIFY_INLINE char *strcpy(char *p, const char *q) + if (p_size == (size_t)-1 && q_size == (size_t)-1) + return __underlying_strcpy(p, q); + size = strlen(q) + 1; +- /* test here to use the more stringent object size */ ++ /* Compile-time check for const size overflow. */ ++ if (__builtin_constant_p(size) && p_size < size) ++ __write_overflow(); ++ /* Run-time check for dynamic size overflow. */ + if (p_size < size) + fortify_panic(__func__); + memcpy(p, q, size); +-- +2.26.2 + diff --git a/patches.suse/gpio-mlxbf2-Convert-to-device-PM-ops.patch b/patches.suse/gpio-mlxbf2-Convert-to-device-PM-ops.patch index f4c4cfc..c4ed891 100644 --- a/patches.suse/gpio-mlxbf2-Convert-to-device-PM-ops.patch +++ b/patches.suse/gpio-mlxbf2-Convert-to-device-PM-ops.patch @@ -3,7 +3,7 @@ Date: Mon, 16 Aug 2021 14:59:48 +0300 Subject: gpio: mlxbf2: Convert to device PM ops Git-commit: dabe57c3a32d763b4b096915f8488dd9100c37e9 Patch-mainline: v5.15-rc1 -References: jsc#SLE-95282 +References: jsc#SLE-19248 jsc#SLE-19789 Convert driver to use modern device PM ops interface. diff --git a/patches.suse/gpio-mlxbf2-Drop-wrong-use-of-ACPI_PTR.patch b/patches.suse/gpio-mlxbf2-Drop-wrong-use-of-ACPI_PTR.patch index 5be2c8d..b92e9e4 100644 --- a/patches.suse/gpio-mlxbf2-Drop-wrong-use-of-ACPI_PTR.patch +++ b/patches.suse/gpio-mlxbf2-Drop-wrong-use-of-ACPI_PTR.patch @@ -3,7 +3,7 @@ Date: Mon, 16 Aug 2021 14:59:49 +0300 Subject: gpio: mlxbf2: Drop wrong use of ACPI_PTR() Git-commit: 603607e70e3626e6ceb3ddec86e2a060c6cd6191 Patch-mainline: v5.15-rc1 -References: jsc#SLE-95282 +References: jsc#SLE-19248 jsc#SLE-19789 ACPI_PTR() is more harmful than helpful. For example, in this case if CONFIG_ACPI=n, the ID table left unused which is not what we want. diff --git a/patches.suse/gpio-mlxbf2-Use-DEFINE_RES_MEM_NAMED-helper-macro.patch b/patches.suse/gpio-mlxbf2-Use-DEFINE_RES_MEM_NAMED-helper-macro.patch index eeba321..7c71f33 100644 --- a/patches.suse/gpio-mlxbf2-Use-DEFINE_RES_MEM_NAMED-helper-macro.patch +++ b/patches.suse/gpio-mlxbf2-Use-DEFINE_RES_MEM_NAMED-helper-macro.patch @@ -3,7 +3,7 @@ Date: Mon, 16 Aug 2021 14:59:51 +0300 Subject: gpio: mlxbf2: Use DEFINE_RES_MEM_NAMED() helper macro Git-commit: d0ef631d40baa2be1951d122ca59d0cf6e39cf46 Patch-mainline: v5.15-rc1 -References: jsc#SLE-95282 +References: jsc#SLE-19248 jsc#SLE-19789 Use DEFINE_RES_MEM_NAMED() to save a couple of lines of code, which makes the code a bit shorter and easier to read. diff --git a/patches.suse/gpio-mlxbf2-Use-devm_platform_ioremap_resource.patch b/patches.suse/gpio-mlxbf2-Use-devm_platform_ioremap_resource.patch index a49732b..8c5a608 100644 --- a/patches.suse/gpio-mlxbf2-Use-devm_platform_ioremap_resource.patch +++ b/patches.suse/gpio-mlxbf2-Use-devm_platform_ioremap_resource.patch @@ -3,7 +3,7 @@ Date: Mon, 16 Aug 2021 14:59:50 +0300 Subject: gpio: mlxbf2: Use devm_platform_ioremap_resource() Git-commit: 4e6864f8563df318f1aac92f23d06210a2b3d15f Patch-mainline: v5.15-rc1 -References: jsc#SLE-95282 +References: jsc#SLE-19248 jsc#SLE-19789 Simplify the platform_get_resource() and devm_ioremap_resource() calls with devm_platform_ioremap_resource(). diff --git a/patches.suse/hwmon-Fix-possible-memleak-in-__hwmon_device_registe.patch b/patches.suse/hwmon-Fix-possible-memleak-in-__hwmon_device_registe.patch new file mode 100644 index 0000000..b8c121d --- /dev/null +++ b/patches.suse/hwmon-Fix-possible-memleak-in-__hwmon_device_registe.patch @@ -0,0 +1,68 @@ +From ada61aa0b1184a8fda1a89a340c7d6cc4e59aee5 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Tue, 12 Oct 2021 19:27:58 +0800 +Subject: [PATCH] hwmon: Fix possible memleak in __hwmon_device_register() +Git-commit: ada61aa0b1184a8fda1a89a340c7d6cc4e59aee5 +Patch-mainline: v5.16-rc1 +References: git-fixes + +I got memory leak as follows when doing fault injection test: + +unreferenced object 0xffff888102740438 (size 8): + comm "27", pid 859, jiffies 4295031351 (age 143.992s) + hex dump (first 8 bytes): + 68 77 6d 6f 6e 30 00 00 hwmon0.. + backtrace: + [<00000000544b5996>] __kmalloc_track_caller+0x1a6/0x300 + [<00000000df0d62b9>] kvasprintf+0xad/0x140 + [<00000000d3d2a3da>] kvasprintf_const+0x62/0x190 + [<000000005f8f0f29>] kobject_set_name_vargs+0x56/0x140 + [<00000000b739e4b9>] dev_set_name+0xb0/0xe0 + [<0000000095b69c25>] __hwmon_device_register+0xf19/0x1e50 [hwmon] + [<00000000a7e65b52>] hwmon_device_register_with_info+0xcb/0x110 [hwmon] + [<000000006f181e86>] devm_hwmon_device_register_with_info+0x85/0x100 [hwmon] + [<0000000081bdc567>] tmp421_probe+0x2d2/0x465 [tmp421] + [<00000000502cc3f8>] i2c_device_probe+0x4e1/0xbb0 + [<00000000f90bda3b>] really_probe+0x285/0xc30 + [<000000007eac7b77>] __driver_probe_device+0x35f/0x4f0 + [<000000004953d43d>] driver_probe_device+0x4f/0x140 + [<000000002ada2d41>] __device_attach_driver+0x24c/0x330 + [<00000000b3977977>] bus_for_each_drv+0x15d/0x1e0 + [<000000005bf2a8e3>] __device_attach+0x267/0x410 + +When device_register() returns an error, the name allocated in +dev_set_name() will be leaked, the put_device() should be used +instead of calling hwmon_dev_release() to give up the device +reference, then the name will be freed in kobject_cleanup(). + +Reported-by: Hulk Robot +Fixes: bab2243ce189 ("hwmon: Introduce hwmon_device_register_with_groups") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20211012112758.2681084-1-yangyingliang@huawei.com +Signed-off-by: Guenter Roeck +Acked-by: Takashi Iwai + +--- + drivers/hwmon/hwmon.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c +index 8d3b1dae31df..3501a3ead4ba 100644 +--- a/drivers/hwmon/hwmon.c ++++ b/drivers/hwmon/hwmon.c +@@ -796,8 +796,10 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata, + dev_set_drvdata(hdev, drvdata); + dev_set_name(hdev, HWMON_ID_FORMAT, id); + err = device_register(hdev); +- if (err) +- goto free_hwmon; ++ if (err) { ++ put_device(hdev); ++ goto ida_remove; ++ } + + INIT_LIST_HEAD(&hwdev->tzdata); + +-- +2.26.2 + diff --git a/patches.suse/hwmon-pmbus-lm25066-Add-offset-coefficients.patch b/patches.suse/hwmon-pmbus-lm25066-Add-offset-coefficients.patch new file mode 100644 index 0000000..014bcfa --- /dev/null +++ b/patches.suse/hwmon-pmbus-lm25066-Add-offset-coefficients.patch @@ -0,0 +1,158 @@ +From ae59dc455a78fb73034dd1fbb337d7e59c27cbd8 Mon Sep 17 00:00:00 2001 +From: Zev Weiss +Date: Tue, 28 Sep 2021 02:22:35 -0700 +Subject: [PATCH] hwmon: (pmbus/lm25066) Add offset coefficients +Git-commit: ae59dc455a78fb73034dd1fbb337d7e59c27cbd8 +Patch-mainline: v5.16-rc1 +References: git-fixes + +With the exception of the lm5066i, all the devices handled by this +driver had been missing their offset ('b') coefficients for direct +format readings. + +Cc: stable@vger.kernel.org +Fixes: 58615a94f6a1 ("hwmon: (pmbus/lm25066) Add support for LM25056") +Fixes: e53e6497fc9f ("hwmon: (pmbus/lm25066) Refactor device specific coefficients") +Signed-off-by: Zev Weiss +Link: https://lore.kernel.org/r/20210928092242.30036-2-zev@bewilderbeest.net +Signed-off-by: Guenter Roeck +Acked-by: Takashi Iwai + +--- + drivers/hwmon/pmbus/lm25066.c | 23 +++++++++++++++++++++++ + 1 file changed, 23 insertions(+) + +diff --git a/drivers/hwmon/pmbus/lm25066.c b/drivers/hwmon/pmbus/lm25066.c +index d209e0afc2ca..1a660c4cd19f 100644 +--- a/drivers/hwmon/pmbus/lm25066.c ++++ b/drivers/hwmon/pmbus/lm25066.c +@@ -55,22 +55,27 @@ static struct __coeff lm25066_coeff[6][PSC_NUM_CLASSES + 2] = { + [lm25056] = { + [PSC_VOLTAGE_IN] = { + .m = 16296, ++ .b = 1343, + .R = -2, + }, + [PSC_CURRENT_IN] = { + .m = 13797, ++ .b = -1833, + .R = -2, + }, + [PSC_CURRENT_IN_L] = { + .m = 6726, ++ .b = -537, + .R = -2, + }, + [PSC_POWER] = { + .m = 5501, ++ .b = -2908, + .R = -3, + }, + [PSC_POWER_L] = { + .m = 26882, ++ .b = -5646, + .R = -4, + }, + [PSC_TEMPERATURE] = { +@@ -82,26 +87,32 @@ static struct __coeff lm25066_coeff[6][PSC_NUM_CLASSES + 2] = { + [lm25066] = { + [PSC_VOLTAGE_IN] = { + .m = 22070, ++ .b = -1800, + .R = -2, + }, + [PSC_VOLTAGE_OUT] = { + .m = 22070, ++ .b = -1800, + .R = -2, + }, + [PSC_CURRENT_IN] = { + .m = 13661, ++ .b = -5200, + .R = -2, + }, + [PSC_CURRENT_IN_L] = { + .m = 6852, ++ .b = -3100, + .R = -2, + }, + [PSC_POWER] = { + .m = 736, ++ .b = -3300, + .R = -2, + }, + [PSC_POWER_L] = { + .m = 369, ++ .b = -1900, + .R = -2, + }, + [PSC_TEMPERATURE] = { +@@ -111,26 +122,32 @@ static struct __coeff lm25066_coeff[6][PSC_NUM_CLASSES + 2] = { + [lm5064] = { + [PSC_VOLTAGE_IN] = { + .m = 4611, ++ .b = -642, + .R = -2, + }, + [PSC_VOLTAGE_OUT] = { + .m = 4621, ++ .b = 423, + .R = -2, + }, + [PSC_CURRENT_IN] = { + .m = 10742, ++ .b = 1552, + .R = -2, + }, + [PSC_CURRENT_IN_L] = { + .m = 5456, ++ .b = 2118, + .R = -2, + }, + [PSC_POWER] = { + .m = 1204, ++ .b = 8524, + .R = -3, + }, + [PSC_POWER_L] = { + .m = 612, ++ .b = 11202, + .R = -3, + }, + [PSC_TEMPERATURE] = { +@@ -140,26 +157,32 @@ static struct __coeff lm25066_coeff[6][PSC_NUM_CLASSES + 2] = { + [lm5066] = { + [PSC_VOLTAGE_IN] = { + .m = 4587, ++ .b = -1200, + .R = -2, + }, + [PSC_VOLTAGE_OUT] = { + .m = 4587, ++ .b = -2400, + .R = -2, + }, + [PSC_CURRENT_IN] = { + .m = 10753, ++ .b = -1200, + .R = -2, + }, + [PSC_CURRENT_IN_L] = { + .m = 5405, ++ .b = -600, + .R = -2, + }, + [PSC_POWER] = { + .m = 1204, ++ .b = -6000, + .R = -3, + }, + [PSC_POWER_L] = { + .m = 605, ++ .b = -8000, + .R = -3, + }, + [PSC_TEMPERATURE] = { +-- +2.26.2 + diff --git a/patches.suse/hwmon-pmbus-lm25066-Let-compiler-determine-outer-dim.patch b/patches.suse/hwmon-pmbus-lm25066-Let-compiler-determine-outer-dim.patch new file mode 100644 index 0000000..e1d940c --- /dev/null +++ b/patches.suse/hwmon-pmbus-lm25066-Let-compiler-determine-outer-dim.patch @@ -0,0 +1,37 @@ +From b7931a7b0e0df4d2a25fedd895ad32c746b77bc1 Mon Sep 17 00:00:00 2001 +From: Zev Weiss +Date: Tue, 28 Sep 2021 02:22:38 -0700 +Subject: [PATCH] hwmon: (pmbus/lm25066) Let compiler determine outer dimension of lm25066_coeff +Git-commit: b7931a7b0e0df4d2a25fedd895ad32c746b77bc1 +Patch-mainline: v5.16-rc1 +References: git-fixes + +Maintaining this manually is error prone (there are currently only +five chips supported, not six); gcc can do it for us automatically. + +Signed-off-by: Zev Weiss +Fixes: 666c14906b49 ("hwmon: (pmbus/lm25066) Drop support for LM25063") +Link: https://lore.kernel.org/r/20210928092242.30036-5-zev@bewilderbeest.net +Signed-off-by: Guenter Roeck +Acked-by: Takashi Iwai + +--- + drivers/hwmon/pmbus/lm25066.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/pmbus/lm25066.c b/drivers/hwmon/pmbus/lm25066.c +index 4dc003ff859e..1ff5407b6977 100644 +--- a/drivers/hwmon/pmbus/lm25066.c ++++ b/drivers/hwmon/pmbus/lm25066.c +@@ -51,7 +51,7 @@ struct __coeff { + #define PSC_CURRENT_IN_L (PSC_NUM_CLASSES) + #define PSC_POWER_L (PSC_NUM_CLASSES + 1) + +-static struct __coeff lm25066_coeff[6][PSC_NUM_CLASSES + 2] = { ++static struct __coeff lm25066_coeff[][PSC_NUM_CLASSES + 2] = { + [lm25056] = { + [PSC_VOLTAGE_IN] = { + .m = 16296, +-- +2.26.2 + diff --git a/patches.suse/hwmon-tmp401-Drop-support-for-TMP461.patch b/patches.suse/hwmon-tmp401-Drop-support-for-TMP461.patch new file mode 100644 index 0000000..4a6c109 --- /dev/null +++ b/patches.suse/hwmon-tmp401-Drop-support-for-TMP461.patch @@ -0,0 +1,160 @@ +From 38d9f06c57403383d574727d9978ad049b011197 Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Fri, 15 Oct 2021 17:34:25 -0700 +Subject: [PATCH] hwmon: (tmp401) Drop support for TMP461 +Git-commit: 38d9f06c57403383d574727d9978ad049b011197 +Patch-mainline: v5.16-rc1 +References: git-fixes + +TMP461 is almost identical to TMP451, which is already supported by the +lm90 driver. At the same time, unlike other sensors from the TMP401 +compatible series, it only supports 8-bit temperature read operations, +and it supports negative temperatures when configured for its default +temperature range, and it supports a temperature offset register. +Supporting this chip in the tmp401 driver adds unnecessary complexity. +Remove its support from this driver and support the chip with the lm90 +driver instead. + +Fixes: 24333ac26d01 ("hwmon: (tmp401) use smb word operations instead of 2 smb byte operations") +Reported-by: David T. Wilson +Cc: David T. Wilson +Signed-off-by: Guenter Roeck +Acked-by: Takashi Iwai + +--- + Documentation/hwmon/tmp401.rst | 15 +-------------- + drivers/hwmon/Kconfig | 2 +- + drivers/hwmon/tmp401.c | 25 ++----------------------- + 3 files changed, 4 insertions(+), 38 deletions(-) + +diff --git a/Documentation/hwmon/tmp401.rst b/Documentation/hwmon/tmp401.rst +index 14bf1fbf4493..3aacf3d3bdf3 100644 +--- a/Documentation/hwmon/tmp401.rst ++++ b/Documentation/hwmon/tmp401.rst +@@ -43,12 +43,6 @@ Supported chips: + + Datasheet: http://focus.ti.com/docs/prod/folders/print/tmp435.html + +- * Texas Instruments TMP461 +- +- Prefix: 'tmp461' +- +- Datasheet: https://www.ti.com/product/tmp461 +- + + + Authors: +@@ -60,7 +54,7 @@ Description + ----------- + + This driver implements support for Texas Instruments TMP401, TMP411, +-TMP431, TMP432, TMP435, and TMP461 chips. These chips implement one or two ++TMP431, TMP432, and TMP435 chips. These chips implement one or two + remote and one local temperature sensors. Temperature is measured in degrees + Celsius. Resolution of the remote sensor is 0.0625 degree. Local + sensor resolution can be set to 0.5, 0.25, 0.125 or 0.0625 degree (not +@@ -84,10 +78,3 @@ some additional features. + + TMP432 is compatible with TMP401 and TMP431. It supports two external + temperature sensors. +- +-TMP461 is compatible with TMP401. It supports offset correction +-that is applied to the remote sensor. +- +-* Sensor offset values are temperature values +- +- Exported via sysfs attribute tempX_offset +diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig +index 8c776fb92445..64bd3dfba2c4 100644 +--- a/drivers/hwmon/Kconfig ++++ b/drivers/hwmon/Kconfig +@@ -1941,7 +1941,7 @@ config SENSORS_TMP401 + depends on I2C + help + If you say yes here you get support for Texas Instruments TMP401, +- TMP411, TMP431, TMP432, TMP435, and TMP461 temperature sensor chips. ++ TMP411, TMP431, TMP432, and TMP435 temperature sensor chips. + + This driver can also be built as a module. If so, the module + will be called tmp401. +diff --git a/drivers/hwmon/tmp401.c b/drivers/hwmon/tmp401.c +index 88007416c210..b31f4964f852 100644 +--- a/drivers/hwmon/tmp401.c ++++ b/drivers/hwmon/tmp401.c +@@ -34,7 +34,7 @@ + static const unsigned short normal_i2c[] = { 0x48, 0x49, 0x4a, 0x4c, 0x4d, + 0x4e, 0x4f, I2C_CLIENT_END }; + +-enum chips { tmp401, tmp411, tmp431, tmp432, tmp435, tmp461 }; ++enum chips { tmp401, tmp411, tmp431, tmp432, tmp435 }; + + /* + * The TMP401 registers, note some registers have different addresses for +@@ -56,7 +56,6 @@ static const u8 TMP401_TEMP_MSB_READ[7][2] = { + { 0x20, 0x19 }, /* therm (crit) limit */ + { 0x30, 0x34 }, /* lowest */ + { 0x32, 0x36 }, /* highest */ +- { 0, 0x11 }, /* offset */ + }; + + static const u8 TMP401_TEMP_MSB_WRITE[7][2] = { +@@ -66,7 +65,6 @@ static const u8 TMP401_TEMP_MSB_WRITE[7][2] = { + { 0x20, 0x19 }, /* therm (crit) limit */ + { 0x30, 0x34 }, /* lowest */ + { 0x32, 0x36 }, /* highest */ +- { 0, 0x11 }, /* offset */ + }; + + static const u8 TMP432_TEMP_MSB_READ[4][3] = { +@@ -123,7 +121,6 @@ static const struct i2c_device_id tmp401_id[] = { + { "tmp431", tmp431 }, + { "tmp432", tmp432 }, + { "tmp435", tmp435 }, +- { "tmp461", tmp461 }, + { } + }; + MODULE_DEVICE_TABLE(i2c, tmp401_id); +@@ -570,21 +567,6 @@ static const struct attribute_group tmp432_group = { + .attrs = tmp432_attributes, + }; + +-/* +- * Additional features of the TMP461 chip. +- * The TMP461 temperature offset for the remote channel. +- */ +-static SENSOR_DEVICE_ATTR_2_RW(temp2_offset, temp, 6, 1); +- +-static struct attribute *tmp461_attributes[] = { +- &sensor_dev_attr_temp2_offset.dev_attr.attr, +- NULL +-}; +- +-static const struct attribute_group tmp461_group = { +- .attrs = tmp461_attributes, +-}; +- + /* + * Begin non sysfs callback code (aka Real code) + */ +@@ -686,7 +668,7 @@ static int tmp401_detect(struct i2c_client *client, + static int tmp401_probe(struct i2c_client *client) + { + static const char * const names[] = { +- "TMP401", "TMP411", "TMP431", "TMP432", "TMP435", "TMP461" ++ "TMP401", "TMP411", "TMP431", "TMP432", "TMP435" + }; + struct device *dev = &client->dev; + struct device *hwmon_dev; +@@ -717,9 +699,6 @@ static int tmp401_probe(struct i2c_client *client) + if (data->kind == tmp432) + data->groups[groups++] = &tmp432_group; + +- if (data->kind == tmp461) +- data->groups[groups++] = &tmp461_group; +- + hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name, + data, data->groups); + if (IS_ERR(hwmon_dev)) +-- +2.26.2 + diff --git a/patches.suse/hwrng-mtk-Force-runtime-pm-ops-for-sleep-ops.patch b/patches.suse/hwrng-mtk-Force-runtime-pm-ops-for-sleep-ops.patch new file mode 100644 index 0000000..c3a6f37 --- /dev/null +++ b/patches.suse/hwrng-mtk-Force-runtime-pm-ops-for-sleep-ops.patch @@ -0,0 +1,53 @@ +From b6f5f0c8f72d348b2d07b20d7b680ef13a7ffe98 Mon Sep 17 00:00:00 2001 +From: Markus Schneider-Pargmann +Date: Thu, 30 Sep 2021 21:12:42 +0200 +Subject: [PATCH] hwrng: mtk - Force runtime pm ops for sleep ops +Git-commit: b6f5f0c8f72d348b2d07b20d7b680ef13a7ffe98 +Patch-mainline: v5.16-rc1 +References: git-fixes + +Currently mtk_rng_runtime_suspend/resume is called for both runtime pm +and system sleep operations. + +This is wrong as these should only be runtime ops as the name already +suggests. Currently freezing the system will lead to a call to +mtk_rng_runtime_suspend even if the device currently isn't active. This +leads to a clock warning because it is disabled/unprepared although it +isn't enabled/prepared currently. + +This patch fixes this by only setting the runtime pm ops and forces to +call the runtime pm ops from the system sleep ops as well if active but +not otherwise. + +Fixes: 81d2b34508c6 ("hwrng: mtk - add runtime PM support") +Signed-off-by: Markus Schneider-Pargmann +Signed-off-by: Herbert Xu +Acked-by: Takashi Iwai + +--- + drivers/char/hw_random/mtk-rng.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/hw_random/mtk-rng.c b/drivers/char/hw_random/mtk-rng.c +index 8ad7b515a51b..6c00ea008555 100644 +--- a/drivers/char/hw_random/mtk-rng.c ++++ b/drivers/char/hw_random/mtk-rng.c +@@ -166,8 +166,13 @@ static int mtk_rng_runtime_resume(struct device *dev) + return mtk_rng_init(&priv->rng); + } + +-static UNIVERSAL_DEV_PM_OPS(mtk_rng_pm_ops, mtk_rng_runtime_suspend, +- mtk_rng_runtime_resume, NULL); ++static const struct dev_pm_ops mtk_rng_pm_ops = { ++ SET_RUNTIME_PM_OPS(mtk_rng_runtime_suspend, ++ mtk_rng_runtime_resume, NULL) ++ SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, ++ pm_runtime_force_resume) ++}; ++ + #define MTK_RNG_PM_OPS (&mtk_rng_pm_ops) + #else /* CONFIG_PM */ + #define MTK_RNG_PM_OPS NULL +-- +2.26.2 + diff --git a/patches.suse/ipmi-kcs_bmc-Fix-a-memory-leak-in-the-error-handling.patch b/patches.suse/ipmi-kcs_bmc-Fix-a-memory-leak-in-the-error-handling.patch new file mode 100644 index 0000000..53b7fe2 --- /dev/null +++ b/patches.suse/ipmi-kcs_bmc-Fix-a-memory-leak-in-the-error-handling.patch @@ -0,0 +1,45 @@ +From f281d010b87454e72475b668ad66e34961f744e0 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Tue, 7 Sep 2021 23:06:32 +0200 +Subject: [PATCH] ipmi: kcs_bmc: Fix a memory leak in the error handling path of 'kcs_bmc_serio_add_device()' +Git-commit: f281d010b87454e72475b668ad66e34961f744e0 +Patch-mainline: v5.16-rc1 +References: git-fixes + +In the unlikely event where 'devm_kzalloc()' fails and 'kzalloc()' +succeeds, 'port' would be leaking. + +Test each allocation separately to avoid the leak. + +Fixes: 3a3d2f6a4c64 ("ipmi: kcs_bmc: Add serio adaptor") +Signed-off-by: Christophe JAILLET +Message-id: +Reviewed-by: Andrew Jeffery +Signed-off-by: Corey Minyard +Acked-by: Takashi Iwai + +--- + drivers/char/ipmi/kcs_bmc_serio.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/char/ipmi/kcs_bmc_serio.c b/drivers/char/ipmi/kcs_bmc_serio.c +index 7948cabde50b..7e2067628a6c 100644 +--- a/drivers/char/ipmi/kcs_bmc_serio.c ++++ b/drivers/char/ipmi/kcs_bmc_serio.c +@@ -73,10 +73,12 @@ static int kcs_bmc_serio_add_device(struct kcs_bmc_device *kcs_bmc) + struct serio *port; + + priv = devm_kzalloc(kcs_bmc->dev, sizeof(*priv), GFP_KERNEL); ++ if (!priv) ++ return -ENOMEM; + + /* Use kzalloc() as the allocation is cleaned up with kfree() via serio_unregister_port() */ + port = kzalloc(sizeof(*port), GFP_KERNEL); +- if (!(priv && port)) ++ if (!port) + return -ENOMEM; + + port->id.type = SERIO_8042; +-- +2.26.2 + diff --git a/patches.suse/ipmi-watchdog-Set-panic-count-to-proper-value-on-a-p.patch b/patches.suse/ipmi-watchdog-Set-panic-count-to-proper-value-on-a-p.patch new file mode 100644 index 0000000..691bc6b --- /dev/null +++ b/patches.suse/ipmi-watchdog-Set-panic-count-to-proper-value-on-a-p.patch @@ -0,0 +1,63 @@ +From db05ddf7f321634c5659a0cf7ea56594e22365f7 Mon Sep 17 00:00:00 2001 +From: Corey Minyard +Date: Mon, 20 Sep 2021 06:25:37 -0500 +Subject: [PATCH] ipmi:watchdog: Set panic count to proper value on a panic +Git-commit: db05ddf7f321634c5659a0cf7ea56594e22365f7 +Patch-mainline: v5.16-rc1 +References: git-fixes + +You will get two decrements when the messages on a panic are sent, not +one, since commit 2033f6858970 ("ipmi: Free receive messages when in an +oops") was added, but the watchdog code had a bug where it didn't set +the value properly. + +Reported-by: Anton Lundin +Cc: # v5.4+ +Fixes: 2033f6858970 ("ipmi: Free receive messages when in an oops") +Signed-off-by: Corey Minyard +Acked-by: Takashi Iwai + +--- + drivers/char/ipmi/ipmi_watchdog.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c +index e4ff3b50de7f..f855a9665c28 100644 +--- a/drivers/char/ipmi/ipmi_watchdog.c ++++ b/drivers/char/ipmi/ipmi_watchdog.c +@@ -497,7 +497,7 @@ static void panic_halt_ipmi_heartbeat(void) + msg.cmd = IPMI_WDOG_RESET_TIMER; + msg.data = NULL; + msg.data_len = 0; +- atomic_inc(&panic_done_count); ++ atomic_add(2, &panic_done_count); + rv = ipmi_request_supply_msgs(watchdog_user, + (struct ipmi_addr *) &addr, + 0, +@@ -507,7 +507,7 @@ static void panic_halt_ipmi_heartbeat(void) + &panic_halt_heartbeat_recv_msg, + 1); + if (rv) +- atomic_dec(&panic_done_count); ++ atomic_sub(2, &panic_done_count); + } + + static struct ipmi_smi_msg panic_halt_smi_msg = { +@@ -531,12 +531,12 @@ static void panic_halt_ipmi_set_timeout(void) + /* Wait for the messages to be free. */ + while (atomic_read(&panic_done_count) != 0) + ipmi_poll_interface(watchdog_user); +- atomic_inc(&panic_done_count); ++ atomic_add(2, &panic_done_count); + rv = __ipmi_set_timeout(&panic_halt_smi_msg, + &panic_halt_recv_msg, + &send_heartbeat_now); + if (rv) { +- atomic_dec(&panic_done_count); ++ atomic_sub(2, &panic_done_count); + pr_warn("Unable to extend the watchdog timeout\n"); + } else { + if (send_heartbeat_now) +-- +2.26.2 + diff --git a/patches.suse/irqchip-Fix-compile-testing-without-CONFIG_OF.patch b/patches.suse/irqchip-Fix-compile-testing-without-CONFIG_OF.patch new file mode 100644 index 0000000..e2d4e2a --- /dev/null +++ b/patches.suse/irqchip-Fix-compile-testing-without-CONFIG_OF.patch @@ -0,0 +1,52 @@ +From 1ba5478270a5c3a02b08052a3c003c282f2db94a Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Fri, 22 Oct 2021 17:49:21 +0200 +Subject: [PATCH] irqchip: Fix compile-testing without CONFIG_OF +Git-commit: 1ba5478270a5c3a02b08052a3c003c282f2db94a +Patch-mainline: v5.16-rc1 +References: git-fixes + +Drivers using the new IRQCHIP_PLATFORM_DRIVER_BEGIN helper +fail to link when compile-testing without CONFIG_OF, +as that means CONFIG_IRQCHIP is disabled as well: + +Ld.lld: error: undefined symbol: platform_irqchip_probe +>>> referenced by irq-meson-gpio.c +>>> irqchip/irq-meson-gpio.o:(meson_gpio_intc_driver) in archive drivers/built-in.a +>>> referenced by irq-mchp-eic.c +>>> irqchip/irq-mchp-eic.o:(mchp_eic_driver) in archive drivers/built-in.a + +As the drivers are not actually used in this case, just +making the reference to this symbol conditional helps +avoid the link failure. + +Fixes: f8410e626569 ("irqchip: Add IRQCHIP_PLATFORM_DRIVER_BEGIN/END and IRQCHIP_MATCH helper macros") +Signed-off-by: Arnd Bergmann +Reviewed-by: Florian Fainelli +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20211022154927.920491-1-arnd@kernel.org +Acked-by: Takashi Iwai + +--- + include/linux/irqchip.h | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/include/linux/irqchip.h b/include/linux/irqchip.h +index 67351aac65ef..29dbe675fc7a 100644 +--- a/include/linux/irqchip.h ++++ b/include/linux/irqchip.h +@@ -39,8 +39,9 @@ static const struct of_device_id drv_name##_irqchip_match_table[] = { + {}, \ + }; \ + MODULE_DEVICE_TABLE(of, drv_name##_irqchip_match_table); \ +-static struct platform_driver drv_name##_driver = { \ +- .probe = platform_irqchip_probe, \ ++static struct platform_driver drv_name##_driver = { \ ++ .probe = IS_ENABLED(CONFIG_IRQCHIP) ? \ ++ platform_irqchip_probe : NULL, \ + .driver = { \ + .name = #drv_name, \ + .owner = THIS_MODULE, \ +-- +2.26.2 + diff --git a/patches.suse/mailbox-Remove-WARN_ON-for-async_cb.cb-in-cmdq_exec_.patch b/patches.suse/mailbox-Remove-WARN_ON-for-async_cb.cb-in-cmdq_exec_.patch new file mode 100644 index 0000000..124bbc4 --- /dev/null +++ b/patches.suse/mailbox-Remove-WARN_ON-for-async_cb.cb-in-cmdq_exec_.patch @@ -0,0 +1,39 @@ +From ce1537fe288469bf68ee0aabdb860a790b4755ef Mon Sep 17 00:00:00 2001 +From: "jason-jh.lin" +Date: Wed, 29 Sep 2021 15:08:07 +0800 +Subject: [PATCH] mailbox: Remove WARN_ON for async_cb.cb in cmdq_exec_done +Git-commit: ce1537fe288469bf68ee0aabdb860a790b4755ef +Patch-mainline: v5.16-rc1 +References: git-fixes + +Because mtk_drm_crtc_update_config is not using cmdq_pkt_flush_async, +it won't have pkt->async_cb.cb anymore. + +So remove the WARN_ON check of pkt->async_cb.cb at cmdq_exec_done. + +Fixes: 1b6b0ce2240e ("mailbox: mtk-cmdq: Use mailbox rx_callback") +Signed-off-by: jason-jh.lin +Reviewed-by: Chun-Kuang Hu +Tested-by: Enric Balletbo i Serra +Signed-off-by: Jassi Brar +Acked-by: Takashi Iwai + +--- + drivers/mailbox/mtk-cmdq-mailbox.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c +index 505b4988680b..4e9517efac29 100644 +--- a/drivers/mailbox/mtk-cmdq-mailbox.c ++++ b/drivers/mailbox/mtk-cmdq-mailbox.c +@@ -195,7 +195,6 @@ static void cmdq_task_exec_done(struct cmdq_task *task, int sta) + struct cmdq_task_cb *cb = &task->pkt->async_cb; + struct cmdq_cb_data data; + +- WARN_ON(cb->cb == (cmdq_async_flush_cb)NULL); + data.sta = sta; + data.data = cb->data; + data.pkt = task->pkt; +-- +2.26.2 + diff --git a/patches.suse/media-CEC-keep-related-menu-entries-together.patch b/patches.suse/media-CEC-keep-related-menu-entries-together.patch new file mode 100644 index 0000000..dc01acc --- /dev/null +++ b/patches.suse/media-CEC-keep-related-menu-entries-together.patch @@ -0,0 +1,47 @@ +From 2d080eb6a29fb9c128bf5c4239a1a3c8fd8424f9 Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Wed, 22 Sep 2021 00:10:40 +0200 +Subject: [PATCH] media: CEC: keep related menu entries together +Git-commit: 2d080eb6a29fb9c128bf5c4239a1a3c8fd8424f9 +Patch-mainline: v5.16-rc1 +References: git-fixes + +Keep all of the CEC menu items grouped together. +By grouping all of these menu entries inside a menu/endmenu block, +they are forced to be kept together and they are displayed/presented +in a group for users. + +Tested with xconfig, gconfig, menuconfig, and nconfig. + +Fixes: 46d2a3b964dd ("media: place CEC menu before MEDIA_SUPPORT") +Signed-off-by: Randy Dunlap +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/cec/Kconfig | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/media/cec/Kconfig b/drivers/media/cec/Kconfig +index 9ba3a00dce31..94ef3349b8d6 100644 +--- a/drivers/media/cec/Kconfig ++++ b/drivers/media/cec/Kconfig +@@ -8,6 +8,8 @@ config CEC_NOTIFIER + config CEC_PIN + bool + ++menu "CEC support" ++ + config MEDIA_CEC_RC + bool "HDMI CEC RC integration" + depends on CEC_CORE && RC_CORE +@@ -37,3 +39,5 @@ source "drivers/media/cec/i2c/Kconfig" + source "drivers/media/cec/platform/Kconfig" + source "drivers/media/cec/usb/Kconfig" + endif ++ ++endmenu +-- +2.26.2 + diff --git a/patches.suse/media-TDA1997x-handle-short-reads-of-hdmi-info-frame.patch b/patches.suse/media-TDA1997x-handle-short-reads-of-hdmi-info-frame.patch new file mode 100644 index 0000000..7d3c648 --- /dev/null +++ b/patches.suse/media-TDA1997x-handle-short-reads-of-hdmi-info-frame.patch @@ -0,0 +1,74 @@ +From 48d219f9cc667bc6fbc3e3af0b1bfd75db94fce4 Mon Sep 17 00:00:00 2001 +From: Tom Rix +Date: Thu, 12 Aug 2021 19:00:43 +0200 +Subject: [PATCH] media: TDA1997x: handle short reads of hdmi info frame. +Git-commit: 48d219f9cc667bc6fbc3e3af0b1bfd75db94fce4 +Patch-mainline: v5.16-rc1 +References: git-fixes + +Static analysis reports this representative problem + +tda1997x.c:1939: warning: 7th function call argument is an uninitialized +value + +The 7th argument is buffer[0], which is set in the earlier call to +io_readn(). When io_readn() call to io_read() fails with the first +read, buffer[0] is not set and 0 is returned and stored in len. + +The later call to hdmi_infoframe_unpack()'s size parameter is the +static size of buffer, always 40, so a short read is not caught +in hdmi_infoframe_unpacks()'s checking. The variable len should be +used instead. + +Zero initialize buffer to 0 so it is in a known start state. + +Fixes: 9ac0038db9a7 ("media: i2c: Add TDA1997x HDMI receiver driver") +Signed-off-by: Tom Rix +Reviewed-by: Tim Harvey +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/i2c/tda1997x.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c +index 1e2a263be933..0b995424cb34 100644 +--- a/drivers/media/i2c/tda1997x.c ++++ b/drivers/media/i2c/tda1997x.c +@@ -1248,13 +1248,13 @@ tda1997x_parse_infoframe(struct tda1997x_state *state, u16 addr) + { + struct v4l2_subdev *sd = &state->sd; + union hdmi_infoframe frame; +- u8 buffer[40]; ++ u8 buffer[40] = { 0 }; + u8 reg; + int len, err; + + /* read data */ + len = io_readn(sd, addr, sizeof(buffer), buffer); +- err = hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)); ++ err = hdmi_infoframe_unpack(&frame, buffer, len); + if (err) { + v4l_err(state->client, + "failed parsing %d byte infoframe: 0x%04x/0x%02x\n", +@@ -1928,13 +1928,13 @@ static int tda1997x_log_infoframe(struct v4l2_subdev *sd, int addr) + { + struct tda1997x_state *state = to_state(sd); + union hdmi_infoframe frame; +- u8 buffer[40]; ++ u8 buffer[40] = { 0 }; + int len, err; + + /* read data */ + len = io_readn(sd, addr, sizeof(buffer), buffer); + v4l2_dbg(1, debug, sd, "infoframe: addr=%d len=%d\n", addr, len); +- err = hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)); ++ err = hdmi_infoframe_unpack(&frame, buffer, len); + if (err) { + v4l_err(state->client, + "failed parsing %d byte infoframe: 0x%04x/0x%02x\n", +-- +2.26.2 + diff --git a/patches.suse/media-atmel-fix-the-ispck-initialization.patch b/patches.suse/media-atmel-fix-the-ispck-initialization.patch new file mode 100644 index 0000000..66df7f3 --- /dev/null +++ b/patches.suse/media-atmel-fix-the-ispck-initialization.patch @@ -0,0 +1,253 @@ +From d7f26849ed7cc875d0ff7480c2efebeeccea2bad Mon Sep 17 00:00:00 2001 +From: Eugen Hristev +Date: Mon, 13 Sep 2021 12:22:54 +0200 +Subject: [PATCH] media: atmel: fix the ispck initialization +Git-commit: d7f26849ed7cc875d0ff7480c2efebeeccea2bad +Patch-mainline: v5.16-rc1 +References: git-fixes + +The runtime enabling of the ISPCK (internally clocks the pipeline inside +the ISC) has to be done after the pm_runtime for the ISC dev has been +started. + +After the commit by Mauro: +the ISC failed to probe with the error: + +atmel-sama5d2-isc f0008000.isc: failed to enable ispck: -13 +Atmel-sama5d2-isc: probe of f0008000.isc failed with error -13 + +This is because the enabling of the ispck is done too early in the probe, +and the PM runtime returns invalid request. +Thus, moved this clock enabling after pm_runtime_idle is called. + +The ISPCK is required only for sama5d2 type of ISC. +Thus, add a bool inside the isc struct that is platform dependent. +For the sama7g5-isc, the enabling of the ISPCK is wrong and does not make +sense. Removed it from the sama7g5 probe. In sama7g5-isc, there is only +one clock, the MCK, which also clocks the internal pipeline of the ISC. + +Adapted the clk_prepare and clk_unprepare to request the runtime PM +for both clocks (MCK and ISPCK) in case of sama5d2-isc, and the single +clock (MCK) in case of sama7g5-isc. + +Fixes: dd97908ee350 ("media: atmel: properly get pm_runtime") +Signed-off-by: Eugen Hristev +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/platform/atmel/atmel-isc-base.c | 25 ++++++------ + drivers/media/platform/atmel/atmel-isc.h | 2 + + .../media/platform/atmel/atmel-sama5d2-isc.c | 39 ++++++++++--------- + .../media/platform/atmel/atmel-sama7g5-isc.c | 22 ++--------- + 4 files changed, 38 insertions(+), 50 deletions(-) + +diff --git a/drivers/media/platform/atmel/atmel-isc-base.c b/drivers/media/platform/atmel/atmel-isc-base.c +index 3e0a3837d608..660cd0ab6749 100644 +--- a/drivers/media/platform/atmel/atmel-isc-base.c ++++ b/drivers/media/platform/atmel/atmel-isc-base.c +@@ -123,11 +123,9 @@ static int isc_clk_prepare(struct clk_hw *hw) + struct isc_clk *isc_clk = to_isc_clk(hw); + int ret; + +- if (isc_clk->id == ISC_ISPCK) { +- ret = pm_runtime_resume_and_get(isc_clk->dev); +- if (ret < 0) +- return ret; +- } ++ ret = pm_runtime_resume_and_get(isc_clk->dev); ++ if (ret < 0) ++ return ret; + + return isc_wait_clk_stable(hw); + } +@@ -138,8 +136,7 @@ static void isc_clk_unprepare(struct clk_hw *hw) + + isc_wait_clk_stable(hw); + +- if (isc_clk->id == ISC_ISPCK) +- pm_runtime_put_sync(isc_clk->dev); ++ pm_runtime_put_sync(isc_clk->dev); + } + + static int isc_clk_enable(struct clk_hw *hw) +@@ -186,16 +183,13 @@ static int isc_clk_is_enabled(struct clk_hw *hw) + u32 status; + int ret; + +- if (isc_clk->id == ISC_ISPCK) { +- ret = pm_runtime_resume_and_get(isc_clk->dev); +- if (ret < 0) +- return 0; +- } ++ ret = pm_runtime_resume_and_get(isc_clk->dev); ++ if (ret < 0) ++ return 0; + + regmap_read(isc_clk->regmap, ISC_CLKSR, &status); + +- if (isc_clk->id == ISC_ISPCK) +- pm_runtime_put_sync(isc_clk->dev); ++ pm_runtime_put_sync(isc_clk->dev); + + return status & ISC_CLK(isc_clk->id) ? 1 : 0; + } +@@ -325,6 +319,9 @@ static int isc_clk_register(struct isc_device *isc, unsigned int id) + const char *parent_names[3]; + int num_parents; + ++ if (id == ISC_ISPCK && !isc->ispck_required) ++ return 0; ++ + num_parents = of_clk_get_parent_count(np); + if (num_parents < 1 || num_parents > 3) + return -EINVAL; +diff --git a/drivers/media/platform/atmel/atmel-isc.h b/drivers/media/platform/atmel/atmel-isc.h +index 19cc60dfcbe0..2bfcb135ef13 100644 +--- a/drivers/media/platform/atmel/atmel-isc.h ++++ b/drivers/media/platform/atmel/atmel-isc.h +@@ -178,6 +178,7 @@ struct isc_reg_offsets { + * @hclock: Hclock clock input (refer datasheet) + * @ispck: iscpck clock (refer datasheet) + * @isc_clks: ISC clocks ++ * @ispck_required: ISC requires ISP Clock initialization + * @dcfg: DMA master configuration, architecture dependent + * + * @dev: Registered device driver +@@ -252,6 +253,7 @@ struct isc_device { + struct clk *hclock; + struct clk *ispck; + struct isc_clk isc_clks[2]; ++ bool ispck_required; + u32 dcfg; + + struct device *dev; +diff --git a/drivers/media/platform/atmel/atmel-sama5d2-isc.c b/drivers/media/platform/atmel/atmel-sama5d2-isc.c +index 0fa6013560df..1b2063cce0f7 100644 +--- a/drivers/media/platform/atmel/atmel-sama5d2-isc.c ++++ b/drivers/media/platform/atmel/atmel-sama5d2-isc.c +@@ -454,6 +454,9 @@ static int atmel_isc_probe(struct platform_device *pdev) + /* sama5d2-isc - 8 bits per beat */ + isc->dcfg = ISC_DCFG_YMBSIZE_BEATS8 | ISC_DCFG_CMBSIZE_BEATS8; + ++ /* sama5d2-isc : ISPCK is required and mandatory */ ++ isc->ispck_required = true; ++ + ret = isc_pipeline_init(isc); + if (ret) + return ret; +@@ -476,22 +479,6 @@ static int atmel_isc_probe(struct platform_device *pdev) + dev_err(dev, "failed to init isc clock: %d\n", ret); + goto unprepare_hclk; + } +- +- isc->ispck = isc->isc_clks[ISC_ISPCK].clk; +- +- ret = clk_prepare_enable(isc->ispck); +- if (ret) { +- dev_err(dev, "failed to enable ispck: %d\n", ret); +- goto unprepare_hclk; +- } +- +- /* ispck should be greater or equal to hclock */ +- ret = clk_set_rate(isc->ispck, clk_get_rate(isc->hclock)); +- if (ret) { +- dev_err(dev, "failed to set ispck rate: %d\n", ret); +- goto unprepare_clk; +- } +- + ret = v4l2_device_register(dev, &isc->v4l2_dev); + if (ret) { + dev_err(dev, "unable to register v4l2 device.\n"); +@@ -546,19 +533,35 @@ static int atmel_isc_probe(struct platform_device *pdev) + pm_runtime_enable(dev); + pm_request_idle(dev); + ++ isc->ispck = isc->isc_clks[ISC_ISPCK].clk; ++ ++ ret = clk_prepare_enable(isc->ispck); ++ if (ret) { ++ dev_err(dev, "failed to enable ispck: %d\n", ret); ++ goto cleanup_subdev; ++ } ++ ++ /* ispck should be greater or equal to hclock */ ++ ret = clk_set_rate(isc->ispck, clk_get_rate(isc->hclock)); ++ if (ret) { ++ dev_err(dev, "failed to set ispck rate: %d\n", ret); ++ goto unprepare_clk; ++ } ++ + regmap_read(isc->regmap, ISC_VERSION + isc->offsets.version, &ver); + dev_info(dev, "Microchip ISC version %x\n", ver); + + return 0; + ++unprepare_clk: ++ clk_disable_unprepare(isc->ispck); ++ + cleanup_subdev: + isc_subdev_cleanup(isc); + + unregister_v4l2_device: + v4l2_device_unregister(&isc->v4l2_dev); + +-unprepare_clk: +- clk_disable_unprepare(isc->ispck); + unprepare_hclk: + clk_disable_unprepare(isc->hclock); + +diff --git a/drivers/media/platform/atmel/atmel-sama7g5-isc.c b/drivers/media/platform/atmel/atmel-sama7g5-isc.c +index ee68cf1f4243..5d1c76f680f3 100644 +--- a/drivers/media/platform/atmel/atmel-sama7g5-isc.c ++++ b/drivers/media/platform/atmel/atmel-sama7g5-isc.c +@@ -447,6 +447,9 @@ static int microchip_xisc_probe(struct platform_device *pdev) + /* sama7g5-isc RAM access port is full AXI4 - 32 bits per beat */ + isc->dcfg = ISC_DCFG_YMBSIZE_BEATS32 | ISC_DCFG_CMBSIZE_BEATS32; + ++ /* sama7g5-isc : ISPCK does not exist, ISC is clocked by MCK */ ++ isc->ispck_required = false; ++ + ret = isc_pipeline_init(isc); + if (ret) + return ret; +@@ -470,25 +473,10 @@ static int microchip_xisc_probe(struct platform_device *pdev) + goto unprepare_hclk; + } + +- isc->ispck = isc->isc_clks[ISC_ISPCK].clk; +- +- ret = clk_prepare_enable(isc->ispck); +- if (ret) { +- dev_err(dev, "failed to enable ispck: %d\n", ret); +- goto unprepare_hclk; +- } +- +- /* ispck should be greater or equal to hclock */ +- ret = clk_set_rate(isc->ispck, clk_get_rate(isc->hclock)); +- if (ret) { +- dev_err(dev, "failed to set ispck rate: %d\n", ret); +- goto unprepare_clk; +- } +- + ret = v4l2_device_register(dev, &isc->v4l2_dev); + if (ret) { + dev_err(dev, "unable to register v4l2 device.\n"); +- goto unprepare_clk; ++ goto unprepare_hclk; + } + + ret = xisc_parse_dt(dev, isc); +@@ -550,8 +538,6 @@ static int microchip_xisc_probe(struct platform_device *pdev) + unregister_v4l2_device: + v4l2_device_unregister(&isc->v4l2_dev); + +-unprepare_clk: +- clk_disable_unprepare(isc->ispck); + unprepare_hclk: + clk_disable_unprepare(isc->hclock); + +-- +2.26.2 + diff --git a/patches.suse/media-cedrus-Fix-SUNXI-tile-size-calculation-448ea5ee473b.patch b/patches.suse/media-cedrus-Fix-SUNXI-tile-size-calculation-448ea5ee473b.patch new file mode 100644 index 0000000..aee5a8a --- /dev/null +++ b/patches.suse/media-cedrus-Fix-SUNXI-tile-size-calculation-448ea5ee473b.patch @@ -0,0 +1,39 @@ +From 448ea5ee473b9a41ec1235217648bd48096dfcf0 Mon Sep 17 00:00:00 2001 +From: Nicolas Dufresne +Date: Thu, 19 Aug 2021 16:00:09 +0200 +Subject: [PATCH] media: cedrus: Fix SUNXI tile size calculation +Git-commit: 448ea5ee473b9a41ec1235217648bd48096dfcf0 +Patch-mainline: v5.16-rc1 +References: git-fixes + +Tiled formats requires full rows being allocated (even for Chroma +planes). When the number of Luma tiles is odd, we need to round up +to twice the tile width in order to roundup the number of Chroma +tiles. + +This was notice with a crash running BA1_FT_C compliance test using +sunxi tiles using GStreamer. Cedrus driver would allocate 9 rows for +Luma, but only 4.5 rows for Chroma, causing userspace to crash. + +Signed-off-by: Nicolas Dufresne +Fixes: 50e761516f2b8 ("media: platform: Add Cedrus VPU decoder driver") +Reviewed-by: Jernej Skrabec +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/staging/media/sunxi/cedrus/cedrus_video.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/media/sunxi/cedrus/cedrus_video.c ++++ b/drivers/staging/media/sunxi/cedrus/cedrus_video.c +@@ -150,7 +150,7 @@ void cedrus_prepare_format(struct v4l2_p + sizeimage = bytesperline * height; + + /* Chroma plane size. */ +- sizeimage += bytesperline * height / 2; ++ sizeimage += bytesperline * ALIGN(height, 64) / 2; + + break; + } diff --git a/patches.suse/media-cx23885-Fix-snd_card_free-call-on-null-card-po.patch b/patches.suse/media-cx23885-Fix-snd_card_free-call-on-null-card-po.patch new file mode 100644 index 0000000..9604307 --- /dev/null +++ b/patches.suse/media-cx23885-Fix-snd_card_free-call-on-null-card-po.patch @@ -0,0 +1,50 @@ +From 7266dda2f1dfe151b12ef0c14eb4d4e622fb211c Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Wed, 4 Aug 2021 10:50:10 +0200 +Subject: [PATCH] media: cx23885: Fix snd_card_free call on null card pointer +Git-commit: 7266dda2f1dfe151b12ef0c14eb4d4e622fb211c +Patch-mainline: v5.16-rc1 +References: git-fixes + +Currently a call to snd_card_new that fails will set card with a NULL +pointer, this causes a null pointer dereference on the error cleanup +path when card it passed to snd_card_free. Fix this by adding a new +error exit path that does not call snd_card_free and exiting via this +new path. + +Addresses-coverity: ("Explicit null dereference") + +Fixes: 9e44d63246a9 ("[media] cx23885: Add ALSA support") +Signed-off-by: Colin Ian King +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/pci/cx23885/cx23885-alsa.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/pci/cx23885/cx23885-alsa.c b/drivers/media/pci/cx23885/cx23885-alsa.c +index ab14d35214aa..25dc8d4dc5b7 100644 +--- a/drivers/media/pci/cx23885/cx23885-alsa.c ++++ b/drivers/media/pci/cx23885/cx23885-alsa.c +@@ -550,7 +550,7 @@ struct cx23885_audio_dev *cx23885_audio_register(struct cx23885_dev *dev) + SNDRV_DEFAULT_IDX1, SNDRV_DEFAULT_STR1, + THIS_MODULE, sizeof(struct cx23885_audio_dev), &card); + if (err < 0) +- goto error; ++ goto error_msg; + + chip = (struct cx23885_audio_dev *) card->private_data; + chip->dev = dev; +@@ -576,6 +576,7 @@ struct cx23885_audio_dev *cx23885_audio_register(struct cx23885_dev *dev) + + error: + snd_card_free(card); ++error_msg: + pr_err("%s(): Failed to register analog audio adapter\n", + __func__); + +-- +2.26.2 + diff --git a/patches.suse/media-cxd2880-spi-Fix-a-null-pointer-dereference-on-.patch b/patches.suse/media-cxd2880-spi-Fix-a-null-pointer-dereference-on-.patch new file mode 100644 index 0000000..a21b6e3 --- /dev/null +++ b/patches.suse/media-cxd2880-spi-Fix-a-null-pointer-dereference-on-.patch @@ -0,0 +1,42 @@ +From 11b982e950d2138e90bd120501df10a439006ff8 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Tue, 20 Jul 2021 18:07:49 +0200 +Subject: [PATCH] media: cxd2880-spi: Fix a null pointer dereference on error handling path +Git-commit: 11b982e950d2138e90bd120501df10a439006ff8 +Patch-mainline: v5.16-rc1 +References: git-fixes + +Currently the null pointer check on dvb_spi->vcc_supply is inverted and +this leads to only null values of the dvb_spi->vcc_supply being passed +to the call of regulator_disable causing null pointer dereferences. +Fix this by only calling regulator_disable if dvb_spi->vcc_supply is +not null. + +Addresses-coverity: ("Dereference after null check") + +Fixes: dcb014582101 ("media: cxd2880-spi: Fix an error handling path") +Signed-off-by: Colin Ian King +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/spi/cxd2880-spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/spi/cxd2880-spi.c b/drivers/media/spi/cxd2880-spi.c +index b91a1e845b97..506f52c1af10 100644 +--- a/drivers/media/spi/cxd2880-spi.c ++++ b/drivers/media/spi/cxd2880-spi.c +@@ -618,7 +618,7 @@ cxd2880_spi_probe(struct spi_device *spi) + fail_attach: + dvb_unregister_adapter(&dvb_spi->adapter); + fail_adapter: +- if (!dvb_spi->vcc_supply) ++ if (dvb_spi->vcc_supply) + regulator_disable(dvb_spi->vcc_supply); + fail_regulator: + kfree(dvb_spi); +-- +2.26.2 + diff --git a/patches.suse/media-dvb-frontends-mn88443x-Handle-errors-of-clk_pr.patch b/patches.suse/media-dvb-frontends-mn88443x-Handle-errors-of-clk_pr.patch new file mode 100644 index 0000000..6e42853 --- /dev/null +++ b/patches.suse/media-dvb-frontends-mn88443x-Handle-errors-of-clk_pr.patch @@ -0,0 +1,80 @@ +From 69a10678e2fba3d182e78ea041f2d1b1a6058764 Mon Sep 17 00:00:00 2001 +From: Evgeny Novikov +Date: Sun, 22 Aug 2021 11:48:03 +0200 +Subject: [PATCH] media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable() +Git-commit: 69a10678e2fba3d182e78ea041f2d1b1a6058764 +Patch-mainline: v5.16-rc1 +References: git-fixes + +mn88443x_cmn_power_on() did not handle possible errors of +clk_prepare_enable() and always finished successfully so that its caller +mn88443x_probe() did not care about failed preparing/enabling of clocks +as well. + +Add missed error handling in both mn88443x_cmn_power_on() and +mn88443x_probe(). This required to change the return value of the former +from "void" to "int". + +Found by Linux Driver Verification project (linuxtesting.org). + +Fixes: 0f408ce8941f ("media: dvb-frontends: add Socionext MN88443x ISDB-S/T demodulator driver") +Signed-off-by: Evgeny Novikov +Co-developed-by: Kirill Shilimanov +Signed-off-by: Kirill Shilimanov +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/dvb-frontends/mn88443x.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/dvb-frontends/mn88443x.c b/drivers/media/dvb-frontends/mn88443x.c +index e4528784f847..fff212c0bf3b 100644 +--- a/drivers/media/dvb-frontends/mn88443x.c ++++ b/drivers/media/dvb-frontends/mn88443x.c +@@ -204,11 +204,18 @@ struct mn88443x_priv { + struct regmap *regmap_t; + }; + +-static void mn88443x_cmn_power_on(struct mn88443x_priv *chip) ++static int mn88443x_cmn_power_on(struct mn88443x_priv *chip) + { ++ struct device *dev = &chip->client_s->dev; + struct regmap *r_t = chip->regmap_t; ++ int ret; + +- clk_prepare_enable(chip->mclk); ++ ret = clk_prepare_enable(chip->mclk); ++ if (ret) { ++ dev_err(dev, "Failed to prepare and enable mclk: %d\n", ++ ret); ++ return ret; ++ } + + gpiod_set_value_cansleep(chip->reset_gpio, 1); + usleep_range(100, 1000); +@@ -222,6 +229,8 @@ static void mn88443x_cmn_power_on(struct mn88443x_priv *chip) + } else { + regmap_write(r_t, HIZSET3, 0x8f); + } ++ ++ return 0; + } + + static void mn88443x_cmn_power_off(struct mn88443x_priv *chip) +@@ -738,7 +747,10 @@ static int mn88443x_probe(struct i2c_client *client, + chip->fe.demodulator_priv = chip; + i2c_set_clientdata(client, chip); + +- mn88443x_cmn_power_on(chip); ++ ret = mn88443x_cmn_power_on(chip); ++ if (ret) ++ goto err_i2c_t; ++ + mn88443x_s_sleep(chip); + mn88443x_t_sleep(chip); + +-- +2.26.2 + diff --git a/patches.suse/media-dvb-usb-fix-ununit-value-in-az6027_rc_query.patch b/patches.suse/media-dvb-usb-fix-ununit-value-in-az6027_rc_query.patch new file mode 100644 index 0000000..ed45567 --- /dev/null +++ b/patches.suse/media-dvb-usb-fix-ununit-value-in-az6027_rc_query.patch @@ -0,0 +1,39 @@ +From afae4ef7d5ad913cab1316137854a36bea6268a5 Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Fri, 13 Aug 2021 16:34:20 +0200 +Subject: [PATCH] media: dvb-usb: fix ununit-value in az6027_rc_query +Git-commit: afae4ef7d5ad913cab1316137854a36bea6268a5 +Patch-mainline: v5.16-rc1 +References: git-fixes + +Syzbot reported ununit-value bug in az6027_rc_query(). The problem was +in missing state pointer initialization. Since this function does nothing +we can simply initialize state to REMOTE_NO_KEY_PRESSED. + +Reported-and-tested-by: syzbot+2cd8c5db4a85f0a04142@syzkaller.appspotmail.com + +Fixes: 76f9a820c867 ("V4L/DVB: AZ6027: Initial import of the driver") +Signed-off-by: Pavel Skripkin +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/usb/dvb-usb/az6027.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/usb/dvb-usb/az6027.c b/drivers/media/usb/dvb-usb/az6027.c +index 1c39b61cde29..86788771175b 100644 +--- a/drivers/media/usb/dvb-usb/az6027.c ++++ b/drivers/media/usb/dvb-usb/az6027.c +@@ -391,6 +391,7 @@ static struct rc_map_table rc_map_az6027_table[] = { + /* remote control stuff (does not work with my box) */ + static int az6027_rc_query(struct dvb_usb_device *d, u32 *event, int *state) + { ++ *state = REMOTE_NO_KEY_PRESSED; + return 0; + } + +-- +2.26.2 + diff --git a/patches.suse/media-em28xx-Don-t-use-ops-suspend-if-it-is-NULL.patch b/patches.suse/media-em28xx-Don-t-use-ops-suspend-if-it-is-NULL.patch new file mode 100644 index 0000000..8c4e200 --- /dev/null +++ b/patches.suse/media-em28xx-Don-t-use-ops-suspend-if-it-is-NULL.patch @@ -0,0 +1,43 @@ +From 51fa3b70d27342baf1ea8aaab3e96e5f4f26d5b2 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Fri, 17 Sep 2021 18:07:02 +0200 +Subject: [PATCH] media: em28xx: Don't use ops->suspend if it is NULL +Git-commit: 51fa3b70d27342baf1ea8aaab3e96e5f4f26d5b2 +Patch-mainline: v5.16-rc1 +References: git-fixes + +The call to ops->suspend for the dev->dev_next case can currently +trigger a call on a null function pointer if ops->suspend is null. +Skip over the use of function ops->suspend if it is null. + +Addresses-coverity: ("Dereference after null check") + +Fixes: be7fd3c3a8c5 ("media: em28xx: Hauppauge DualHD second tuner functionality") +Signed-off-by: Colin Ian King +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/usb/em28xx/em28xx-core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c +index 584fa400cd7d..acc0bf7dbe2b 100644 +--- a/drivers/media/usb/em28xx/em28xx-core.c ++++ b/drivers/media/usb/em28xx/em28xx-core.c +@@ -1154,8 +1154,9 @@ int em28xx_suspend_extension(struct em28xx *dev) + dev_info(&dev->intf->dev, "Suspending extensions\n"); + mutex_lock(&em28xx_devlist_mutex); + list_for_each_entry(ops, &em28xx_extension_devlist, next) { +- if (ops->suspend) +- ops->suspend(dev); ++ if (!ops->suspend) ++ continue; ++ ops->suspend(dev); + if (dev->dev_next) + ops->suspend(dev->dev_next); + } +-- +2.26.2 + diff --git a/patches.suse/media-em28xx-add-missing-em28xx_close_extension.patch b/patches.suse/media-em28xx-add-missing-em28xx_close_extension.patch new file mode 100644 index 0000000..406bbd6 --- /dev/null +++ b/patches.suse/media-em28xx-add-missing-em28xx_close_extension.patch @@ -0,0 +1,44 @@ +From 2c98b8a3458df03abdc6945bbef67ef91d181938 Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Thu, 29 Jul 2021 22:23:33 +0200 +Subject: [PATCH] media: em28xx: add missing em28xx_close_extension +Git-commit: 2c98b8a3458df03abdc6945bbef67ef91d181938 +Patch-mainline: v5.16-rc1 +References: git-fixes + +If em28xx dev has ->dev_next pointer, we need to delete ->dev_next list +node from em28xx_extension_devlist on disconnect to avoid UAF bugs and +corrupted list bugs, since driver frees this pointer on disconnect. + +Reported-and-tested-by: syzbot+a6969ef522a36d3344c9@syzkaller.appspotmail.com + +Fixes: 1a23f81b7dc3 ("V4L/DVB (9979): em28xx: move usb probe code to a proper place") +Signed-off-by: Pavel Skripkin +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/usb/em28xx/em28xx-cards.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c +index c1e0dccb7408..948e22e29b42 100644 +--- a/drivers/media/usb/em28xx/em28xx-cards.c ++++ b/drivers/media/usb/em28xx/em28xx-cards.c +@@ -4139,8 +4139,11 @@ static void em28xx_usb_disconnect(struct usb_interface *intf) + + em28xx_close_extension(dev); + +- if (dev->dev_next) ++ if (dev->dev_next) { ++ em28xx_close_extension(dev->dev_next); + em28xx_release_resources(dev->dev_next); ++ } ++ + em28xx_release_resources(dev); + + if (dev->dev_next) { +-- +2.26.2 + diff --git a/patches.suse/media-i2c-ths8200-needs-V4L2_ASYNC.patch b/patches.suse/media-i2c-ths8200-needs-V4L2_ASYNC.patch new file mode 100644 index 0000000..1c2d5ea --- /dev/null +++ b/patches.suse/media-i2c-ths8200-needs-V4L2_ASYNC.patch @@ -0,0 +1,44 @@ +From e4625044d656f3c33ece0cc9da22577bc10ca5d3 Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Sun, 5 Sep 2021 01:28:08 +0200 +Subject: [PATCH] media: i2c: ths8200 needs V4L2_ASYNC +Git-commit: e4625044d656f3c33ece0cc9da22577bc10ca5d3 +Patch-mainline: v5.16-rc1 +References: git-fixes + +Fix the build errors reported by the kernel test robot by +selecting V4L2_ASYNC: + +Mips-linux-ld: drivers/media/i2c/ths8200.o: in function `ths8200_remove': +ths8200.c:(.text+0x1ec): undefined reference to `v4l2_async_unregister_subdev' +Mips-linux-ld: drivers/media/i2c/ths8200.o: in function `ths8200_probe': +ths8200.c:(.text+0x404): undefined reference to `v4l2_async_register_subdev' + +Fixes: ed29f89497006 ("media: i2c: ths8200: support asynchronous probing") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Reviewed-by: Lad Prabhakar +Acked-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/i2c/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig +index cfbcda1f7e48..adb348aa8396 100644 +--- a/drivers/media/i2c/Kconfig ++++ b/drivers/media/i2c/Kconfig +@@ -597,6 +597,7 @@ config VIDEO_AK881X + config VIDEO_THS8200 + tristate "Texas Instruments THS8200 video encoder" + depends on VIDEO_V4L2 && I2C ++ select V4L2_ASYNC + help + Support for the Texas Instruments THS8200 video encoder. + +-- +2.26.2 + diff --git a/patches.suse/media-imx-jpeg-Fix-the-error-handling-path-of-mxc_jp.patch b/patches.suse/media-imx-jpeg-Fix-the-error-handling-path-of-mxc_jp.patch new file mode 100644 index 0000000..07e73a4 --- /dev/null +++ b/patches.suse/media-imx-jpeg-Fix-the-error-handling-path-of-mxc_jp.patch @@ -0,0 +1,40 @@ +From 5c47dc6657543b3c4dffcbe741fb693b9b96796d Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sat, 21 Aug 2021 13:12:53 +0200 +Subject: [PATCH] media: imx-jpeg: Fix the error handling path of 'mxc_jpeg_probe()' +Git-commit: 5c47dc6657543b3c4dffcbe741fb693b9b96796d +Patch-mainline: v5.16-rc1 +References: git-fixes + +A successful 'mxc_jpeg_attach_pm_domains()' call should be balanced by a +corresponding 'mxc_jpeg_detach_pm_domains()' call in the error handling +path of the probe, as already done in the remove function. + +Update the error handling path accordingly. + +Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder") +Signed-off-by: Christophe JAILLET +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/platform/imx-jpeg/mxc-jpeg.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/platform/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/imx-jpeg/mxc-jpeg.c +index b3cc5199ef28..73e73b6f2e5b 100644 +--- a/drivers/media/platform/imx-jpeg/mxc-jpeg.c ++++ b/drivers/media/platform/imx-jpeg/mxc-jpeg.c +@@ -2086,6 +2086,8 @@ static int mxc_jpeg_probe(struct platform_device *pdev) + v4l2_device_unregister(&jpeg->v4l2_dev); + + err_register: ++ mxc_jpeg_detach_pm_domains(jpeg); ++ + err_irq: + return ret; + } +-- +2.26.2 + diff --git a/patches.suse/media-imx258-Fix-getting-clock-frequency.patch b/patches.suse/media-imx258-Fix-getting-clock-frequency.patch new file mode 100644 index 0000000..9e24721 --- /dev/null +++ b/patches.suse/media-imx258-Fix-getting-clock-frequency.patch @@ -0,0 +1,52 @@ +From d170b0ea1760989fe8ac053bef83e61f3bf87992 Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Mon, 16 Aug 2021 15:08:59 +0200 +Subject: [PATCH] media: imx258: Fix getting clock frequency +Git-commit: d170b0ea1760989fe8ac053bef83e61f3bf87992 +Patch-mainline: v5.16-rc1 +References: git-fixes + +Obtain the clock frequency by reading the clock-frequency property if +there's no clock. + +Fixes: 9fda25332c4b ("media: i2c: imx258: get clock from device properties and enable it via runtime PM") +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/i2c/imx258.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/media/i2c/imx258.c b/drivers/media/i2c/imx258.c +index 81cdf37216ca..c249507aa2db 100644 +--- a/drivers/media/i2c/imx258.c ++++ b/drivers/media/i2c/imx258.c +@@ -1260,18 +1260,18 @@ static int imx258_probe(struct i2c_client *client) + return -ENOMEM; + + imx258->clk = devm_clk_get_optional(&client->dev, NULL); ++ if (IS_ERR(imx258->clk)) ++ return dev_err_probe(&client->dev, PTR_ERR(imx258->clk), ++ "error getting clock\n"); + if (!imx258->clk) { + dev_dbg(&client->dev, + "no clock provided, using clock-frequency property\n"); + + device_property_read_u32(&client->dev, "clock-frequency", &val); +- if (val != IMX258_INPUT_CLOCK_FREQ) +- return -EINVAL; +- } else if (IS_ERR(imx258->clk)) { +- return dev_err_probe(&client->dev, PTR_ERR(imx258->clk), +- "error getting clock\n"); ++ } else { ++ val = clk_get_rate(imx258->clk); + } +- if (clk_get_rate(imx258->clk) != IMX258_INPUT_CLOCK_FREQ) { ++ if (val != IMX258_INPUT_CLOCK_FREQ) { + dev_err(&client->dev, "input clock frequency not supported\n"); + return -EINVAL; + } +-- +2.26.2 + diff --git a/patches.suse/media-ir_toy-assignment-to-be16-should-be-of-correct.patch b/patches.suse/media-ir_toy-assignment-to-be16-should-be-of-correct.patch new file mode 100644 index 0000000..a08b168 --- /dev/null +++ b/patches.suse/media-ir_toy-assignment-to-be16-should-be-of-correct.patch @@ -0,0 +1,37 @@ +From febfe985fc2ea052a363f6525ff624b8efd5273c Mon Sep 17 00:00:00 2001 +From: Sean Young +Date: Wed, 13 Oct 2021 09:14:10 +0100 +Subject: [PATCH] media: ir_toy: assignment to be16 should be of correct type +Git-commit: febfe985fc2ea052a363f6525ff624b8efd5273c +Patch-mainline: v5.16-rc1 +References: git-fixes + +commit f0c15b360fb6 ("media: ir_toy: prevent device from hanging during +transmit") removed a cpu_to_be16() cast, which causes a sparse warning. + +Fixes: f0c15b360fb6 ("media: ir_toy: prevent device from hanging during transmit") +Reported-by: Hans Verkuil +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/rc/ir_toy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/rc/ir_toy.c b/drivers/media/rc/ir_toy.c +index 71aced52248f..7e98e7e3aace 100644 +--- a/drivers/media/rc/ir_toy.c ++++ b/drivers/media/rc/ir_toy.c +@@ -318,7 +318,7 @@ static int irtoy_tx(struct rc_dev *rc, uint *txbuf, uint count) + buf[i] = cpu_to_be16(v); + } + +- buf[count] = 0xffff; ++ buf[count] = cpu_to_be16(0xffff); + + irtoy->tx_buf = buf; + irtoy->tx_len = size; +-- +2.26.2 + diff --git a/patches.suse/media-ite-cir-IR-receiver-stop-working-after-receive.patch b/patches.suse/media-ite-cir-IR-receiver-stop-working-after-receive.patch new file mode 100644 index 0000000..3affe87 --- /dev/null +++ b/patches.suse/media-ite-cir-IR-receiver-stop-working-after-receive.patch @@ -0,0 +1,41 @@ +From fdc881783099c6343921ff017450831c8766d12a Mon Sep 17 00:00:00 2001 +From: Sean Young +Date: Sun, 17 Oct 2021 13:01:15 +0100 +Subject: [PATCH] media: ite-cir: IR receiver stop working after receive overflow +Git-commit: fdc881783099c6343921ff017450831c8766d12a +Patch-mainline: v5.16-rc1 +References: git-fixes + +On an Intel NUC6iSYK, no IR is reported after a receive overflow. + +When a receiver overflow occurs, this condition is only cleared by +reading the fifo. Make sure we read anything in the fifo. + +Fixes: 28c7afb07ccf ("media: ite-cir: check for receive overflow") +Suggested-by: Bryan Pass +Tested-by: Bryan Pass +Cc: stable@vger.kernel.org> +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/rc/ite-cir.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c +index 5bc23e8c6d91..4f77d4ebacdc 100644 +--- a/drivers/media/rc/ite-cir.c ++++ b/drivers/media/rc/ite-cir.c +@@ -242,7 +242,7 @@ static irqreturn_t ite_cir_isr(int irq, void *data) + } + + /* check for the receive interrupt */ +- if (iflags & ITE_IRQ_RX_FIFO) { ++ if (iflags & (ITE_IRQ_RX_FIFO | ITE_IRQ_RX_FIFO_OVERRUN)) { + /* read the FIFO bytes */ + rx_bytes = dev->params->get_rx_bytes(dev, rx_buf, + ITE_RX_FIFO_LEN); +-- +2.26.2 + diff --git a/patches.suse/media-ivtv-fix-build-for-UML.patch b/patches.suse/media-ivtv-fix-build-for-UML.patch new file mode 100644 index 0000000..c4075b3 --- /dev/null +++ b/patches.suse/media-ivtv-fix-build-for-UML.patch @@ -0,0 +1,88 @@ +From 6cb67bea945bdf0ad40e633cd2d9fbeb0855675b Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Sun, 10 Oct 2021 20:38:36 +0100 +Subject: [PATCH] media: ivtv: fix build for UML +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 6cb67bea945bdf0ad40e633cd2d9fbeb0855675b +Patch-mainline: v5.16-rc1 +References: git-fixes + +Prevent the use of page table macros and types from 2 conflicting +places. This fixes multiple build errors and warnings, e.g.: + +../arch/x86/include/asm/pgtable_64_types.h:21:34: error: conflicting types for ‘pte_t’ + typedef struct { pteval_t pte; } pte_t; + ^~~~~ +In file included from ../include/linux/mm_types_task.h:16:0, + from ../include/linux/mm_types.h:5, + from ../include/linux/buildid.h:5, + from ../include/linux/module.h:14, + from ../drivers/media/pci/ivtv/ivtv-driver.h:40, + from ../drivers/media/pci/ivtv/ivtvfb.c:29: +../arch/um/include/asm/page.h:57:39: note: previous declaration of ‘pte_t’ was here + typedef struct { unsigned long pte; } pte_t; + +../arch/x86/include/asm/pgtable_types.h:284:43: error: expected ‘)’ before ‘prot’ + static inline pgprot_t pgprot_nx(pgprot_t prot) + ^ +../include/linux/pgtable.h:914:26: note: in definition of macro ‘pgprot_nx’ + #define pgprot_nx(prot) (prot) + ^~~~ +In file included from ../arch/x86/include/asm/memtype.h:6:0, + from ../drivers/media/pci/ivtv/ivtvfb.c:40: +../arch/x86/include/asm/pgtable_types.h:288:0: warning: "pgprot_nx" redefined + #define pgprot_nx pgprot_nx + +../arch/x86/include/asm/page_types.h:11:0: warning: "PAGE_SIZE" redefined + #define PAGE_SIZE (_AC(1,UL) << PAGE_SHIFT) + +In file included from ../include/linux/mm_types_task.h:16:0, + from ../include/linux/mm_types.h:5, + from ../include/linux/buildid.h:5, + from ../include/linux/module.h:14, + from ../drivers/media/pci/ivtv/ivtv-driver.h:40, + from ../drivers/media/pci/ivtv/ivtvfb.c:29: +../arch/um/include/asm/page.h:14:0: note: this is the location of the previous definition + #define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT) + +Fixes: 68f5d3f3b654 ("um: add PCI over virtio emulation driver") +Signed-off-by: Randy Dunlap +Cc: Johannes Berg +Cc: Andy Walls +Cc: linux-um@lists.infradead.org +Cc: Richard Weinberger +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/pci/ivtv/ivtvfb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/pci/ivtv/ivtvfb.c b/drivers/media/pci/ivtv/ivtvfb.c +index c58ca8aa6d90..2c43ebf83966 100644 +--- a/drivers/media/pci/ivtv/ivtvfb.c ++++ b/drivers/media/pci/ivtv/ivtvfb.c +@@ -36,7 +36,7 @@ + #include + #include + +-#ifdef CONFIG_X86_64 ++#if defined(CONFIG_X86_64) && !defined(CONFIG_UML) + #include + #endif + +@@ -1157,7 +1157,7 @@ static int ivtvfb_init_card(struct ivtv *itv) + { + int rc; + +-#ifdef CONFIG_X86_64 ++#if defined(CONFIG_X86_64) && !defined(CONFIG_UML) + if (pat_enabled()) { + if (ivtvfb_force_pat) { + pr_info("PAT is enabled. Write-combined framebuffer caching will be disabled.\n"); +-- +2.26.2 + diff --git a/patches.suse/media-meson-ge2d-Fix-rotation-parameter-changes-dete.patch b/patches.suse/media-meson-ge2d-Fix-rotation-parameter-changes-dete.patch new file mode 100644 index 0000000..121ae60 --- /dev/null +++ b/patches.suse/media-meson-ge2d-Fix-rotation-parameter-changes-dete.patch @@ -0,0 +1,44 @@ +From 4b9e3e8af4b336eefca1f1ee535bc4b6734ed6aa Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Fri, 30 Jul 2021 21:35:05 +0200 +Subject: [PATCH] media: meson-ge2d: Fix rotation parameter changes detection in 'ge2d_s_ctrl()' +Git-commit: 4b9e3e8af4b336eefca1f1ee535bc4b6734ed6aa +Patch-mainline: v5.16-rc1 +References: git-fixes + +There is likely a typo here. To be consistent, we should compare +'fmt.height' with 'ctx->out.pix_fmt.height', not 'ctx->out.pix_fmt.width'. + +Instead of fixing the test, just remove it and copy 'fmt' unconditionally. + +Fixes: 59a635327ca7 ("media: meson: Add M2M driver for the Amlogic GE2D Accelerator Unit") +Signed-off-by: Christophe JAILLET +Acked-by: Neil Armstrong +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/platform/meson/ge2d/ge2d.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/drivers/media/platform/meson/ge2d/ge2d.c b/drivers/media/platform/meson/ge2d/ge2d.c +index a1393fefa8ae..9b1e973e78da 100644 +--- a/drivers/media/platform/meson/ge2d/ge2d.c ++++ b/drivers/media/platform/meson/ge2d/ge2d.c +@@ -779,11 +779,7 @@ static int ge2d_s_ctrl(struct v4l2_ctrl *ctrl) + * If the rotation parameter changes the OUTPUT frames + * parameters, take them in account + */ +- if (fmt.width != ctx->out.pix_fmt.width || +- fmt.height != ctx->out.pix_fmt.width || +- fmt.bytesperline > ctx->out.pix_fmt.bytesperline || +- fmt.sizeimage > ctx->out.pix_fmt.sizeimage) +- ctx->out.pix_fmt = fmt; ++ ctx->out.pix_fmt = fmt; + + break; + } +-- +2.26.2 + diff --git a/patches.suse/media-mtk-vcodec-venc-fix-return-value-when-start_st.patch b/patches.suse/media-mtk-vcodec-venc-fix-return-value-when-start_st.patch new file mode 100644 index 0000000..651a346 --- /dev/null +++ b/patches.suse/media-mtk-vcodec-venc-fix-return-value-when-start_st.patch @@ -0,0 +1,51 @@ +From 065a7c66bd8b21db212fa86187ff12f0cac6ea6d Mon Sep 17 00:00:00 2001 +From: Dafna Hirschfeld +Date: Fri, 28 May 2021 10:36:41 +0200 +Subject: [PATCH] media: mtk-vcodec: venc: fix return value when start_streaming fails +Git-commit: 065a7c66bd8b21db212fa86187ff12f0cac6ea6d +Patch-mainline: v5.16-rc1 +References: git-fixes + +In case vb2ops_venc_start_streaming fails, the error value +is overwritten by the ret value of pm_runtime_put which might +be 0. Fix it. + +Fixes: 985c73693fe5a (" media: mtk-vcodec: Separating mtk encoder driver") +Signed-off-by: Dafna Hirschfeld +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c +index efa53ea573a2..7457451ebff0 100644 +--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c ++++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c +@@ -873,7 +873,7 @@ static int vb2ops_venc_start_streaming(struct vb2_queue *q, unsigned int count) + { + struct mtk_vcodec_ctx *ctx = vb2_get_drv_priv(q); + struct venc_enc_param param; +- int ret; ++ int ret, pm_ret; + int i; + + /* Once state turn into MTK_STATE_ABORT, we need stop_streaming +@@ -925,9 +925,9 @@ static int vb2ops_venc_start_streaming(struct vb2_queue *q, unsigned int count) + return 0; + + err_set_param: +- ret = pm_runtime_put(&ctx->dev->plat_dev->dev); +- if (ret < 0) +- mtk_v4l2_err("pm_runtime_put fail %d", ret); ++ pm_ret = pm_runtime_put(&ctx->dev->plat_dev->dev); ++ if (pm_ret < 0) ++ mtk_v4l2_err("pm_runtime_put fail %d", pm_ret); + + err_start_stream: + for (i = 0; i < q->num_buffers; ++i) { +-- +2.26.2 + diff --git a/patches.suse/media-mtk-vpu-Fix-a-resource-leak-in-the-error-handl.patch b/patches.suse/media-mtk-vpu-Fix-a-resource-leak-in-the-error-handl.patch new file mode 100644 index 0000000..f79bd38 --- /dev/null +++ b/patches.suse/media-mtk-vpu-Fix-a-resource-leak-in-the-error-handl.patch @@ -0,0 +1,51 @@ +From 2143ad413c05c7be24c3a92760e367b7f6aaac92 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Thu, 19 Aug 2021 22:21:25 +0200 +Subject: [PATCH] media: mtk-vpu: Fix a resource leak in the error handling path of 'mtk_vpu_probe()' +Git-commit: 2143ad413c05c7be24c3a92760e367b7f6aaac92 +Patch-mainline: v5.16-rc1 +References: git-fixes + +A successful 'clk_prepare()' call should be balanced by a corresponding +'clk_unprepare()' call in the error handling path of the probe, as already +done in the remove function. + +Update the error handling path accordingly. + +Fixes: 3003a180ef6b ("[media] VPU: mediatek: support Mediatek VPU") +Signed-off-by: Christophe JAILLET +Reviewed-by: Houlong Wei +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/platform/mtk-vpu/mtk_vpu.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/mtk-vpu/mtk_vpu.c b/drivers/media/platform/mtk-vpu/mtk_vpu.c +index ec290dde59cf..7f1647da0ade 100644 +--- a/drivers/media/platform/mtk-vpu/mtk_vpu.c ++++ b/drivers/media/platform/mtk-vpu/mtk_vpu.c +@@ -848,7 +848,8 @@ static int mtk_vpu_probe(struct platform_device *pdev) + vpu->wdt.wq = create_singlethread_workqueue("vpu_wdt"); + if (!vpu->wdt.wq) { + dev_err(dev, "initialize wdt workqueue failed\n"); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto clk_unprepare; + } + INIT_WORK(&vpu->wdt.ws, vpu_wdt_reset_func); + mutex_init(&vpu->vpu_mutex); +@@ -942,6 +943,8 @@ static int mtk_vpu_probe(struct platform_device *pdev) + vpu_clock_disable(vpu); + workqueue_destroy: + destroy_workqueue(vpu->wdt.wq); ++clk_unprepare: ++ clk_unprepare(vpu->clk); + + return ret; + } +-- +2.26.2 + diff --git a/patches.suse/media-mxl111sf-change-mutex_init-location.patch b/patches.suse/media-mxl111sf-change-mutex_init-location.patch new file mode 100644 index 0000000..ddf72f4 --- /dev/null +++ b/patches.suse/media-mxl111sf-change-mutex_init-location.patch @@ -0,0 +1,117 @@ +From 44870a9e7a3c24acbb3f888b2a7cc22c9bdf7e7f Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Thu, 19 Aug 2021 12:42:21 +0200 +Subject: [PATCH] media: mxl111sf: change mutex_init() location +Git-commit: 44870a9e7a3c24acbb3f888b2a7cc22c9bdf7e7f +Patch-mainline: v5.16-rc1 +References: git-fixes + +Syzbot reported, that mxl111sf_ctrl_msg() uses uninitialized +mutex. The problem was in wrong mutex_init() location. + +Previous mutex_init(&state->msg_lock) call was in ->init() function, but +dvb_usbv2_init() has this order of calls: + + dvb_usbv2_init() + dvb_usbv2_adapter_init() + dvb_usbv2_adapter_frontend_init() + props->frontend_attach() + + props->init() + +Since mxl111sf_* devices call mxl111sf_ctrl_msg() in ->frontend_attach() +internally we need to initialize state->msg_lock before +frontend_attach(). To achieve it, ->probe() call added to all mxl111sf_* +devices, which will simply initiaize mutex. + +Reported-and-tested-by: syzbot+5ca0bf339f13c4243001@syzkaller.appspotmail.com + +Fixes: 8572211842af ("[media] mxl111sf: convert to new DVB USB") +Signed-off-by: Pavel Skripkin +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/usb/dvb-usb-v2/mxl111sf.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/usb/dvb-usb-v2/mxl111sf.c b/drivers/media/usb/dvb-usb-v2/mxl111sf.c +index 7865fa0a8295..cd5861a30b6f 100644 +--- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c ++++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c +@@ -931,8 +931,6 @@ static int mxl111sf_init(struct dvb_usb_device *d) + .len = sizeof(eeprom), .buf = eeprom }, + }; + +- mutex_init(&state->msg_lock); +- + ret = get_chip_info(state); + if (mxl_fail(ret)) + pr_err("failed to get chip info during probe"); +@@ -1074,6 +1072,14 @@ static int mxl111sf_get_stream_config_dvbt(struct dvb_frontend *fe, + return 0; + } + ++static int mxl111sf_probe(struct dvb_usb_device *dev) ++{ ++ struct mxl111sf_state *state = d_to_priv(dev); ++ ++ mutex_init(&state->msg_lock); ++ return 0; ++} ++ + static struct dvb_usb_device_properties mxl111sf_props_dvbt = { + .driver_name = KBUILD_MODNAME, + .owner = THIS_MODULE, +@@ -1083,6 +1089,7 @@ static struct dvb_usb_device_properties mxl111sf_props_dvbt = { + .generic_bulk_ctrl_endpoint = 0x02, + .generic_bulk_ctrl_endpoint_response = 0x81, + ++ .probe = mxl111sf_probe, + .i2c_algo = &mxl111sf_i2c_algo, + .frontend_attach = mxl111sf_frontend_attach_dvbt, + .tuner_attach = mxl111sf_attach_tuner, +@@ -1124,6 +1131,7 @@ static struct dvb_usb_device_properties mxl111sf_props_atsc = { + .generic_bulk_ctrl_endpoint = 0x02, + .generic_bulk_ctrl_endpoint_response = 0x81, + ++ .probe = mxl111sf_probe, + .i2c_algo = &mxl111sf_i2c_algo, + .frontend_attach = mxl111sf_frontend_attach_atsc, + .tuner_attach = mxl111sf_attach_tuner, +@@ -1165,6 +1173,7 @@ static struct dvb_usb_device_properties mxl111sf_props_mh = { + .generic_bulk_ctrl_endpoint = 0x02, + .generic_bulk_ctrl_endpoint_response = 0x81, + ++ .probe = mxl111sf_probe, + .i2c_algo = &mxl111sf_i2c_algo, + .frontend_attach = mxl111sf_frontend_attach_mh, + .tuner_attach = mxl111sf_attach_tuner, +@@ -1233,6 +1242,7 @@ static struct dvb_usb_device_properties mxl111sf_props_atsc_mh = { + .generic_bulk_ctrl_endpoint = 0x02, + .generic_bulk_ctrl_endpoint_response = 0x81, + ++ .probe = mxl111sf_probe, + .i2c_algo = &mxl111sf_i2c_algo, + .frontend_attach = mxl111sf_frontend_attach_atsc_mh, + .tuner_attach = mxl111sf_attach_tuner, +@@ -1311,6 +1321,7 @@ static struct dvb_usb_device_properties mxl111sf_props_mercury = { + .generic_bulk_ctrl_endpoint = 0x02, + .generic_bulk_ctrl_endpoint_response = 0x81, + ++ .probe = mxl111sf_probe, + .i2c_algo = &mxl111sf_i2c_algo, + .frontend_attach = mxl111sf_frontend_attach_mercury, + .tuner_attach = mxl111sf_attach_tuner, +@@ -1381,6 +1392,7 @@ static struct dvb_usb_device_properties mxl111sf_props_mercury_mh = { + .generic_bulk_ctrl_endpoint = 0x02, + .generic_bulk_ctrl_endpoint_response = 0x81, + ++ .probe = mxl111sf_probe, + .i2c_algo = &mxl111sf_i2c_algo, + .frontend_attach = mxl111sf_frontend_attach_mercury_mh, + .tuner_attach = mxl111sf_attach_tuner, +-- +2.26.2 + diff --git a/patches.suse/media-ov8856-Set-default-mbus-format-but-allow-calle.patch b/patches.suse/media-ov8856-Set-default-mbus-format-but-allow-calle.patch new file mode 100644 index 0000000..c8ba36d --- /dev/null +++ b/patches.suse/media-ov8856-Set-default-mbus-format-but-allow-calle.patch @@ -0,0 +1,280 @@ +From f1363166f91efb99f815ac9833056c4a7e8ee2b2 Mon Sep 17 00:00:00 2001 +From: Hsin-Yi Wang +Date: Mon, 5 Jul 2021 10:17:24 +0200 +Subject: [PATCH] media: ov8856: Set default mbus format but allow caller to alter +Git-commit: f1363166f91efb99f815ac9833056c4a7e8ee2b2 +Patch-mainline: v5.16-rc1 +References: git-fixes + +Setting the value of V_WIN_OFF (0x3818) from 0x02 to 0x01 to use GRBG +format still results in wrong color output if data is tuned in BGGR mode +before. + +Set default mbus format for the supported modes, but allow the caller of +set(get)_fmt to change the bayer format between BGGR and GRBG. + +Set the default mbus format for 3264x2448 (and 1632x1224) to BGGR as the +data sheet states the value of this reg should be 0x02 by default. + +If new modes are added in the future, they can add the +mipi_data_mbus_{format} settings into bayer_offset_configs to adjust their +offset regs. + +Fixes: 2984b0ddd557 ("media: ov8856: Configure sensor for GRBG Bayer for all modes") +Signed-off-by: Hsin-Yi Wang +Reviewed-by: Robert Foss +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/i2c/ov8856.c | 83 +++++++++++++++++++++++++++++++++----- + 1 file changed, 72 insertions(+), 11 deletions(-) + +diff --git a/drivers/media/i2c/ov8856.c b/drivers/media/i2c/ov8856.c +index aa74744b91c7..c6c6050cda1a 100644 +--- a/drivers/media/i2c/ov8856.c ++++ b/drivers/media/i2c/ov8856.c +@@ -107,6 +107,11 @@ static const char * const ov8856_supply_names[] = { + "dvdd", /* Digital core power */ + }; + ++enum { ++ OV8856_MEDIA_BUS_FMT_SBGGR10_1X10, ++ OV8856_MEDIA_BUS_FMT_SGRBG10_1X10, ++}; ++ + struct ov8856_reg { + u16 address; + u8 val; +@@ -145,6 +150,9 @@ struct ov8856_mode { + + /* Number of data lanes */ + u8 data_lanes; ++ ++ /* Default MEDIA_BUS_FMT for this mode */ ++ u32 default_mbus_index; + }; + + struct ov8856_mipi_data_rates { +@@ -1055,7 +1063,7 @@ static const struct ov8856_reg lane_4_mode_3264x2448[] = { + {0x3810, 0x00}, + {0x3811, 0x04}, + {0x3812, 0x00}, +- {0x3813, 0x01}, ++ {0x3813, 0x02}, + {0x3814, 0x01}, + {0x3815, 0x01}, + {0x3816, 0x00}, +@@ -1259,7 +1267,7 @@ static const struct ov8856_reg lane_4_mode_1632x1224[] = { + {0x3810, 0x00}, + {0x3811, 0x02}, + {0x3812, 0x00}, +- {0x3813, 0x01}, ++ {0x3813, 0x02}, + {0x3814, 0x03}, + {0x3815, 0x01}, + {0x3816, 0x00}, +@@ -1372,6 +1380,19 @@ static const struct ov8856_reg lane_4_mode_1632x1224[] = { + {0x5e10, 0xfc} + }; + ++static const struct ov8856_reg mipi_data_mbus_sbggr10_1x10[] = { ++ {0x3813, 0x02}, ++}; ++ ++static const struct ov8856_reg mipi_data_mbus_sgrbg10_1x10[] = { ++ {0x3813, 0x01}, ++}; ++ ++static const u32 ov8856_mbus_codes[] = { ++ MEDIA_BUS_FMT_SBGGR10_1X10, ++ MEDIA_BUS_FMT_SGRBG10_1X10 ++}; ++ + static const char * const ov8856_test_pattern_menu[] = { + "Disabled", + "Standard Color Bar", +@@ -1380,6 +1401,17 @@ static const char * const ov8856_test_pattern_menu[] = { + "Bottom-Top Darker Color Bar" + }; + ++static const struct ov8856_reg_list bayer_offset_configs[] = { ++ [OV8856_MEDIA_BUS_FMT_SBGGR10_1X10] = { ++ .num_of_regs = ARRAY_SIZE(mipi_data_mbus_sbggr10_1x10), ++ .regs = mipi_data_mbus_sbggr10_1x10, ++ }, ++ [OV8856_MEDIA_BUS_FMT_SGRBG10_1X10] = { ++ .num_of_regs = ARRAY_SIZE(mipi_data_mbus_sgrbg10_1x10), ++ .regs = mipi_data_mbus_sgrbg10_1x10, ++ } ++}; ++ + struct ov8856 { + struct v4l2_subdev sd; + struct media_pad pad; +@@ -1399,6 +1431,9 @@ struct ov8856 { + /* Current mode */ + const struct ov8856_mode *cur_mode; + ++ /* Application specified mbus format */ ++ u32 cur_mbus_index; ++ + /* To serialize asynchronus callbacks */ + struct mutex mutex; + +@@ -1450,6 +1485,7 @@ static const struct ov8856_lane_cfg lane_cfg_2 = { + }, + .link_freq_index = 0, + .data_lanes = 2, ++ .default_mbus_index = OV8856_MEDIA_BUS_FMT_SGRBG10_1X10, + }, + { + .width = 1640, +@@ -1464,6 +1500,7 @@ static const struct ov8856_lane_cfg lane_cfg_2 = { + }, + .link_freq_index = 1, + .data_lanes = 2, ++ .default_mbus_index = OV8856_MEDIA_BUS_FMT_SGRBG10_1X10, + }} + }; + +@@ -1499,6 +1536,7 @@ static const struct ov8856_lane_cfg lane_cfg_4 = { + }, + .link_freq_index = 0, + .data_lanes = 4, ++ .default_mbus_index = OV8856_MEDIA_BUS_FMT_SGRBG10_1X10, + }, + { + .width = 1640, +@@ -1513,6 +1551,7 @@ static const struct ov8856_lane_cfg lane_cfg_4 = { + }, + .link_freq_index = 1, + .data_lanes = 4, ++ .default_mbus_index = OV8856_MEDIA_BUS_FMT_SGRBG10_1X10, + }, + { + .width = 3264, +@@ -1527,6 +1566,7 @@ static const struct ov8856_lane_cfg lane_cfg_4 = { + }, + .link_freq_index = 0, + .data_lanes = 4, ++ .default_mbus_index = OV8856_MEDIA_BUS_FMT_SBGGR10_1X10, + }, + { + .width = 1632, +@@ -1541,6 +1581,7 @@ static const struct ov8856_lane_cfg lane_cfg_4 = { + }, + .link_freq_index = 1, + .data_lanes = 4, ++ .default_mbus_index = OV8856_MEDIA_BUS_FMT_SBGGR10_1X10, + }} + }; + +@@ -1904,12 +1945,21 @@ static int ov8856_init_controls(struct ov8856 *ov8856) + return 0; + } + +-static void ov8856_update_pad_format(const struct ov8856_mode *mode, ++static void ov8856_update_pad_format(struct ov8856 *ov8856, ++ const struct ov8856_mode *mode, + struct v4l2_mbus_framefmt *fmt) + { ++ int index; ++ + fmt->width = mode->width; + fmt->height = mode->height; +- fmt->code = MEDIA_BUS_FMT_SGRBG10_1X10; ++ for (index = 0; index < ARRAY_SIZE(ov8856_mbus_codes); ++index) ++ if (ov8856_mbus_codes[index] == fmt->code) ++ break; ++ if (index == ARRAY_SIZE(ov8856_mbus_codes)) ++ index = mode->default_mbus_index; ++ fmt->code = ov8856_mbus_codes[index]; ++ ov8856->cur_mbus_index = index; + fmt->field = V4L2_FIELD_NONE; + } + +@@ -1935,6 +1985,13 @@ static int ov8856_start_streaming(struct ov8856 *ov8856) + return ret; + } + ++ reg_list = &bayer_offset_configs[ov8856->cur_mbus_index]; ++ ret = ov8856_write_reg_list(ov8856, reg_list); ++ if (ret) { ++ dev_err(&client->dev, "failed to set mbus format"); ++ return ret; ++ } ++ + ret = __v4l2_ctrl_handler_setup(ov8856->sd.ctrl_handler); + if (ret) + return ret; +@@ -2096,7 +2153,7 @@ static int ov8856_set_format(struct v4l2_subdev *sd, + fmt->format.height); + + mutex_lock(&ov8856->mutex); +- ov8856_update_pad_format(mode, &fmt->format); ++ ov8856_update_pad_format(ov8856, mode, &fmt->format); + if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) { + *v4l2_subdev_get_try_format(sd, sd_state, fmt->pad) = fmt->format; + } else { +@@ -2140,7 +2197,7 @@ static int ov8856_get_format(struct v4l2_subdev *sd, + sd_state, + fmt->pad); + else +- ov8856_update_pad_format(ov8856->cur_mode, &fmt->format); ++ ov8856_update_pad_format(ov8856, ov8856->cur_mode, &fmt->format); + + mutex_unlock(&ov8856->mutex); + +@@ -2151,11 +2208,10 @@ static int ov8856_enum_mbus_code(struct v4l2_subdev *sd, + struct v4l2_subdev_state *sd_state, + struct v4l2_subdev_mbus_code_enum *code) + { +- /* Only one bayer order GRBG is supported */ +- if (code->index > 0) ++ if (code->index >= ARRAY_SIZE(ov8856_mbus_codes)) + return -EINVAL; + +- code->code = MEDIA_BUS_FMT_SGRBG10_1X10; ++ code->code = ov8856_mbus_codes[code->index]; + + return 0; + } +@@ -2165,11 +2221,15 @@ static int ov8856_enum_frame_size(struct v4l2_subdev *sd, + struct v4l2_subdev_frame_size_enum *fse) + { + struct ov8856 *ov8856 = to_ov8856(sd); ++ int index; + + if (fse->index >= ov8856->modes_size) + return -EINVAL; + +- if (fse->code != MEDIA_BUS_FMT_SGRBG10_1X10) ++ for (index = 0; index < ARRAY_SIZE(ov8856_mbus_codes); ++index) ++ if (fse->code == ov8856_mbus_codes[index]) ++ break; ++ if (index == ARRAY_SIZE(ov8856_mbus_codes)) + return -EINVAL; + + fse->min_width = ov8856->priv_lane->supported_modes[fse->index].width; +@@ -2185,7 +2245,7 @@ static int ov8856_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh) + struct ov8856 *ov8856 = to_ov8856(sd); + + mutex_lock(&ov8856->mutex); +- ov8856_update_pad_format(&ov8856->priv_lane->supported_modes[0], ++ ov8856_update_pad_format(ov8856, &ov8856->priv_lane->supported_modes[0], + v4l2_subdev_get_try_format(sd, fh->state, 0)); + mutex_unlock(&ov8856->mutex); + +@@ -2426,6 +2486,7 @@ static int ov8856_probe(struct i2c_client *client) + + mutex_init(&ov8856->mutex); + ov8856->cur_mode = &ov8856->priv_lane->supported_modes[0]; ++ ov8856->cur_mbus_index = ov8856->cur_mode->default_mbus_index; + ret = ov8856_init_controls(ov8856); + if (ret) { + dev_err(&client->dev, "failed to init controls: %d", ret); +-- +2.26.2 + diff --git a/patches.suse/media-radio-wl1273-Avoid-card-name-truncation.patch b/patches.suse/media-radio-wl1273-Avoid-card-name-truncation.patch new file mode 100644 index 0000000..7b6fa09 --- /dev/null +++ b/patches.suse/media-radio-wl1273-Avoid-card-name-truncation.patch @@ -0,0 +1,39 @@ +From dfadec236aa99f6086141949c9dc3ec50f3ff20d Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Tue, 3 Aug 2021 21:46:08 +0200 +Subject: [PATCH] media: radio-wl1273: Avoid card name truncation +Git-commit: dfadec236aa99f6086141949c9dc3ec50f3ff20d +Patch-mainline: v5.16-rc1 +References: git-fixes + +The "card" string only holds 31 characters (and the terminating NUL). +In order to avoid truncation, use a shorter card description instead of +the current result, "Texas Instruments Wl1273 FM Rad". + +Suggested-by: Hans Verkuil +Fixes: 87d1a50ce451 ("[media] V4L2: WL1273 FM Radio: TI WL1273 FM radio driver") +Signed-off-by: Kees Cook +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/radio/radio-wl1273.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/radio/radio-wl1273.c b/drivers/media/radio/radio-wl1273.c +index 112376873167..484046471c03 100644 +--- a/drivers/media/radio/radio-wl1273.c ++++ b/drivers/media/radio/radio-wl1273.c +@@ -1279,7 +1279,7 @@ static int wl1273_fm_vidioc_querycap(struct file *file, void *priv, + + strscpy(capability->driver, WL1273_FM_DRIVER_NAME, + sizeof(capability->driver)); +- strscpy(capability->card, "Texas Instruments Wl1273 FM Radio", ++ strscpy(capability->card, "TI Wl1273 FM Radio", + sizeof(capability->card)); + strscpy(capability->bus_info, radio->bus_type, + sizeof(capability->bus_info)); +-- +2.26.2 + diff --git a/patches.suse/media-rkvdec-Do-not-override-sizeimage-for-output-fo.patch b/patches.suse/media-rkvdec-Do-not-override-sizeimage-for-output-fo.patch new file mode 100644 index 0000000..42aa9e9 --- /dev/null +++ b/patches.suse/media-rkvdec-Do-not-override-sizeimage-for-output-fo.patch @@ -0,0 +1,48 @@ +From 298d8e8f7bcf023aceb60232d59b983255fec0df Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Fri, 8 Oct 2021 11:04:22 +0100 +Subject: [PATCH] media: rkvdec: Do not override sizeimage for output format +Git-commit: 298d8e8f7bcf023aceb60232d59b983255fec0df +Patch-mainline: v5.16-rc1 +References: git-fixes + +The rkvdec H.264 decoder currently overrides sizeimage for the output +format. This causes issues when userspace requires and requests a larger +buffer, but ends up with one of insufficient size. + +Instead, only provide a default size if none was requested. This fixes +the video_decode_accelerator_tests from Chromium failing on the first +frame due to insufficient buffer space. It also aligns the behavior +of the rkvdec driver with the Hantro and Cedrus drivers. + +Fixes: cd33c830448b ("media: rkvdec: Add the rkvdec driver") +Cc: +Signed-off-by: Chen-Yu Tsai +Reviewed-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/staging/media/rkvdec/rkvdec-h264.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/media/rkvdec/rkvdec-h264.c b/drivers/staging/media/rkvdec/rkvdec-h264.c +index 76e97cbe2512..951e19231da2 100644 +--- a/drivers/staging/media/rkvdec/rkvdec-h264.c ++++ b/drivers/staging/media/rkvdec/rkvdec-h264.c +@@ -1015,8 +1015,9 @@ static int rkvdec_h264_adjust_fmt(struct rkvdec_ctx *ctx, + struct v4l2_pix_format_mplane *fmt = &f->fmt.pix_mp; + + fmt->num_planes = 1; +- fmt->plane_fmt[0].sizeimage = fmt->width * fmt->height * +- RKVDEC_H264_MAX_DEPTH_IN_BYTES; ++ if (!fmt->plane_fmt[0].sizeimage) ++ fmt->plane_fmt[0].sizeimage = fmt->width * fmt->height * ++ RKVDEC_H264_MAX_DEPTH_IN_BYTES; + return 0; + } + +-- +2.26.2 + diff --git a/patches.suse/media-rkvdec-Support-dynamic-resolution-changes.patch b/patches.suse/media-rkvdec-Support-dynamic-resolution-changes.patch new file mode 100644 index 0000000..48eac00 --- /dev/null +++ b/patches.suse/media-rkvdec-Support-dynamic-resolution-changes.patch @@ -0,0 +1,111 @@ +From 0887e9e152efbd3601d6c907e90033d25067277d Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Fri, 8 Oct 2021 11:04:23 +0100 +Subject: [PATCH] media: rkvdec: Support dynamic resolution changes +Git-commit: 0887e9e152efbd3601d6c907e90033d25067277d +Patch-mainline: v5.16-rc1 +References: git-fixes + +The mem-to-mem stateless decoder API specifies support for dynamic +resolution changes. In particular, the decoder should accept format +changes on the OUTPUT queue even when buffers have been allocated, +as long as it is not streaming. + +Relax restrictions for S_FMT as described in the previous paragraph, +and as long as the codec format remains the same. This aligns it with +the Hantro and Cedrus decoders. This change was mostly based on commit +ae02d49493b5 ("media: hantro: Fix s_fmt for dynamic resolution changes"). + +Since rkvdec_s_fmt() is now just a wrapper around the output/capture +variants without any additional shared functionality, drop the wrapper +and call the respective functions directly. + +Fixes: cd33c830448b ("media: rkvdec: Add the rkvdec driver") +Cc: +Signed-off-by: Chen-Yu Tsai +Reviewed-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/staging/media/rkvdec/rkvdec.c | 40 +++++++++++++-------------- + 1 file changed, 20 insertions(+), 20 deletions(-) + +diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c +index bf00fe6534a3..4fd4a2907da7 100644 +--- a/drivers/staging/media/rkvdec/rkvdec.c ++++ b/drivers/staging/media/rkvdec/rkvdec.c +@@ -280,31 +280,20 @@ static int rkvdec_try_output_fmt(struct file *file, void *priv, + return 0; + } + +-static int rkvdec_s_fmt(struct file *file, void *priv, +- struct v4l2_format *f, +- int (*try_fmt)(struct file *, void *, +- struct v4l2_format *)) ++static int rkvdec_s_capture_fmt(struct file *file, void *priv, ++ struct v4l2_format *f) + { + struct rkvdec_ctx *ctx = fh_to_rkvdec_ctx(priv); + struct vb2_queue *vq; ++ int ret; + +- if (!try_fmt) +- return -EINVAL; +- +- vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, f->type); ++ /* Change not allowed if queue is busy */ ++ vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, ++ V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE); + if (vb2_is_busy(vq)) + return -EBUSY; + +- return try_fmt(file, priv, f); +-} +- +-static int rkvdec_s_capture_fmt(struct file *file, void *priv, +- struct v4l2_format *f) +-{ +- struct rkvdec_ctx *ctx = fh_to_rkvdec_ctx(priv); +- int ret; +- +- ret = rkvdec_s_fmt(file, priv, f, rkvdec_try_capture_fmt); ++ ret = rkvdec_try_capture_fmt(file, priv, f); + if (ret) + return ret; + +@@ -319,9 +308,20 @@ static int rkvdec_s_output_fmt(struct file *file, void *priv, + struct v4l2_m2m_ctx *m2m_ctx = ctx->fh.m2m_ctx; + const struct rkvdec_coded_fmt_desc *desc; + struct v4l2_format *cap_fmt; +- struct vb2_queue *peer_vq; ++ struct vb2_queue *peer_vq, *vq; + int ret; + ++ /* ++ * In order to support dynamic resolution change, the decoder admits ++ * a resolution change, as long as the pixelformat remains. Can't be ++ * done if streaming. ++ */ ++ vq = v4l2_m2m_get_vq(m2m_ctx, V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE); ++ if (vb2_is_streaming(vq) || ++ (vb2_is_busy(vq) && ++ f->fmt.pix_mp.pixelformat != ctx->coded_fmt.fmt.pix_mp.pixelformat)) ++ return -EBUSY; ++ + /* + * Since format change on the OUTPUT queue will reset the CAPTURE + * queue, we can't allow doing so when the CAPTURE queue has buffers +@@ -331,7 +331,7 @@ static int rkvdec_s_output_fmt(struct file *file, void *priv, + if (vb2_is_busy(peer_vq)) + return -EBUSY; + +- ret = rkvdec_s_fmt(file, priv, f, rkvdec_try_output_fmt); ++ ret = rkvdec_try_output_fmt(file, priv, f); + if (ret) + return ret; + +-- +2.26.2 + diff --git a/patches.suse/media-si470x-Avoid-card-name-truncation.patch b/patches.suse/media-si470x-Avoid-card-name-truncation.patch new file mode 100644 index 0000000..8e15f98 --- /dev/null +++ b/patches.suse/media-si470x-Avoid-card-name-truncation.patch @@ -0,0 +1,54 @@ +From 2908249f3878a591f7918368fdf0b7b0a6c3158c Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Tue, 3 Aug 2021 21:46:09 +0200 +Subject: [PATCH] media: si470x: Avoid card name truncation +Git-commit: 2908249f3878a591f7918368fdf0b7b0a6c3158c +Patch-mainline: v5.16-rc1 +References: git-fixes + +The "card" string only holds 31 characters (and the terminating NUL). +In order to avoid truncation, use a shorter card description instead of +the current result, "Silicon Labs Si470x FM Radio Re". + +Suggested-by: Hans Verkuil +Fixes: 78656acdcf48 ("V4L/DVB (7038): USB radio driver for Silicon Labs Si470x FM Radio Receivers") +Fixes: cc35bbddfe10 ("V4L/DVB (12416): radio-si470x: add i2c driver for si470x") +Signed-off-by: Kees Cook +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/radio/si470x/radio-si470x-i2c.c | 2 +- + drivers/media/radio/si470x/radio-si470x-usb.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c +index f491420d7b53..a972c0705ac7 100644 +--- a/drivers/media/radio/si470x/radio-si470x-i2c.c ++++ b/drivers/media/radio/si470x/radio-si470x-i2c.c +@@ -11,7 +11,7 @@ + + /* driver definitions */ + #define DRIVER_AUTHOR "Joonyoung Shim "; +-#define DRIVER_CARD "Silicon Labs Si470x FM Radio Receiver" ++#define DRIVER_CARD "Silicon Labs Si470x FM Radio" + #define DRIVER_DESC "I2C radio driver for Si470x FM Radio Receivers" + #define DRIVER_VERSION "1.0.2" + +diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c +index fedff68d8c49..3f8634a46573 100644 +--- a/drivers/media/radio/si470x/radio-si470x-usb.c ++++ b/drivers/media/radio/si470x/radio-si470x-usb.c +@@ -16,7 +16,7 @@ + + /* driver definitions */ + #define DRIVER_AUTHOR "Tobias Lorenz " +-#define DRIVER_CARD "Silicon Labs Si470x FM Radio Receiver" ++#define DRIVER_CARD "Silicon Labs Si470x FM Radio" + #define DRIVER_DESC "USB radio driver for Si470x FM Radio Receivers" + #define DRIVER_VERSION "1.0.10" + +-- +2.26.2 + diff --git a/patches.suse/media-staging-intel-ipu3-css-Fix-wrong-size-comparis.patch b/patches.suse/media-staging-intel-ipu3-css-Fix-wrong-size-comparis.patch new file mode 100644 index 0000000..5dd92ee --- /dev/null +++ b/patches.suse/media-staging-intel-ipu3-css-Fix-wrong-size-comparis.patch @@ -0,0 +1,87 @@ +From a44f9d6f9dc1fb314a3f1ed2dcd4fbbcc3d9f892 Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Tue, 10 Aug 2021 19:09:55 +0200 +Subject: [PATCH] media: staging/intel-ipu3: css: Fix wrong size comparison imgu_css_fw_init +Git-commit: a44f9d6f9dc1fb314a3f1ed2dcd4fbbcc3d9f892 +Patch-mainline: v5.16-rc1 +References: git-fixes + +There is a wrong comparison of the total size of the loaded firmware +css->fw->size with the size of a pointer to struct imgu_fw_header. + +Turn binary_header into a flexible-array member[1][2], use the +struct_size() helper and fix the wrong size comparison. Notice +that the loaded firmware needs to contain at least one 'struct +imgu_fw_info' item in the binary_header[] array. + +It's also worth mentioning that + + "css->fw->size < struct_size(css->fwp, binary_header, 1)" + +with binary_header declared as a flexible-array member is equivalent +to + + "css->fw->size < sizeof(struct imgu_fw_header)" + +with binary_header declared as a one-element array (as in the original +code). + +The replacement of the one-element array with a flexible-array member +also helps with the ongoing efforts to globally enable -Warray-bounds +and get us closer to being able to tighten the FORTIFY_SOURCE routines +on memcpy(). + +[1] https://en.wikipedia.org/wiki/Flexible_array_member +[2] https://www.kernel.org/doc/html/v5.10/process/deprecated.html#zero-length-and-one-element-arrays + +Link: https://github.com/KSPP/linux/issues/79 +Link: https://github.com/KSPP/linux/issues/109 + +Fixes: 09d290f0ba21 ("media: staging/intel-ipu3: css: Add support for firmware management") +Cc: stable@vger.kernel.org +Signed-off-by: Gustavo A. R. Silva +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/staging/media/ipu3/ipu3-css-fw.c | 7 +++---- + drivers/staging/media/ipu3/ipu3-css-fw.h | 2 +- + 2 files changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/staging/media/ipu3/ipu3-css-fw.c b/drivers/staging/media/ipu3/ipu3-css-fw.c +index 45aff76198e2..981693eed815 100644 +--- a/drivers/staging/media/ipu3/ipu3-css-fw.c ++++ b/drivers/staging/media/ipu3/ipu3-css-fw.c +@@ -124,12 +124,11 @@ int imgu_css_fw_init(struct imgu_css *css) + /* Check and display fw header info */ + + css->fwp = (struct imgu_fw_header *)css->fw->data; +- if (css->fw->size < sizeof(struct imgu_fw_header *) || ++ if (css->fw->size < struct_size(css->fwp, binary_header, 1) || + css->fwp->file_header.h_size != sizeof(struct imgu_fw_bi_file_h)) + goto bad_fw; +- if (sizeof(struct imgu_fw_bi_file_h) + +- css->fwp->file_header.binary_nr * sizeof(struct imgu_fw_info) > +- css->fw->size) ++ if (struct_size(css->fwp, binary_header, ++ css->fwp->file_header.binary_nr) > css->fw->size) + goto bad_fw; + + dev_info(dev, "loaded firmware version %.64s, %u binaries, %zu bytes\n", +diff --git a/drivers/staging/media/ipu3/ipu3-css-fw.h b/drivers/staging/media/ipu3/ipu3-css-fw.h +index 3c078f15a295..c0bc57fd678a 100644 +--- a/drivers/staging/media/ipu3/ipu3-css-fw.h ++++ b/drivers/staging/media/ipu3/ipu3-css-fw.h +@@ -171,7 +171,7 @@ struct imgu_fw_bi_file_h { + + struct imgu_fw_header { + struct imgu_fw_bi_file_h file_header; +- struct imgu_fw_info binary_header[1]; /* binary_nr items */ ++ struct imgu_fw_info binary_header[]; /* binary_nr items */ + }; + + /******************* Firmware functions *******************/ +-- +2.26.2 + diff --git a/patches.suse/media-sun6i-csi-Allow-the-video-device-to-be-open-mu.patch b/patches.suse/media-sun6i-csi-Allow-the-video-device-to-be-open-mu.patch new file mode 100644 index 0000000..692db02 --- /dev/null +++ b/patches.suse/media-sun6i-csi-Allow-the-video-device-to-be-open-mu.patch @@ -0,0 +1,54 @@ +From 8ed852834683ebe064157e069af8dfb41cad6403 Mon Sep 17 00:00:00 2001 +From: Ondrej Jirman +Date: Wed, 8 Sep 2021 12:56:09 +0200 +Subject: [PATCH] media: sun6i-csi: Allow the video device to be open multiple times +Git-commit: 8ed852834683ebe064157e069af8dfb41cad6403 +Patch-mainline: v5.16-rc1 +References: git-fixes + +Previously it was possible, but a recent fix for uninitialized +`ret` variable broke this behavior. + +v4l2_fh_is_singular_file() check is there just to determine +whether the power needs to be enabled, and it's not a failure +if it returns false. + +Fixes: ba9139116bc0 ("media: sun6i-csi: add a missing return code") +Signed-off-by: Ondrej Jirman +Reviewed-by: Jernej Skrabec +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c b/drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c +index 33459892c1a9..607a8d39fbe2 100644 +--- a/drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c ++++ b/drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c +@@ -467,7 +467,7 @@ static const struct v4l2_ioctl_ops sun6i_video_ioctl_ops = { + static int sun6i_video_open(struct file *file) + { + struct sun6i_video *video = video_drvdata(file); +- int ret; ++ int ret = 0; + + if (mutex_lock_interruptible(&video->lock)) + return -ERESTARTSYS; +@@ -481,10 +481,8 @@ static int sun6i_video_open(struct file *file) + goto fh_release; + + /* check if already powered */ +- if (!v4l2_fh_is_singular_file(file)) { +- ret = -EBUSY; ++ if (!v4l2_fh_is_singular_file(file)) + goto unlock; +- } + + ret = sun6i_csi_set_power(video->csi, true); + if (ret < 0) +-- +2.26.2 + diff --git a/patches.suse/media-tm6000-Avoid-card-name-truncation.patch b/patches.suse/media-tm6000-Avoid-card-name-truncation.patch new file mode 100644 index 0000000..1487728 --- /dev/null +++ b/patches.suse/media-tm6000-Avoid-card-name-truncation.patch @@ -0,0 +1,40 @@ +From 42bb98e420d454fef3614b70ea11cc59068395f6 Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Tue, 3 Aug 2021 21:46:10 +0200 +Subject: [PATCH] media: tm6000: Avoid card name truncation +Git-commit: 42bb98e420d454fef3614b70ea11cc59068395f6 +Patch-mainline: v5.16-rc1 +References: git-fixes + +The "card" string only holds 31 characters (and the terminating NUL). +In order to avoid truncation, use a shorter card description instead of +the current result, "Trident TVMaster TM5600/6000/60". + +Suggested-by: Hans Verkuil +Fixes: e28f49b0b2a8 ("V4L/DVB: tm6000: fix some info messages") +Signed-off-by: Kees Cook +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/usb/tm6000/tm6000-video.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/media/usb/tm6000/tm6000-video.c b/drivers/media/usb/tm6000/tm6000-video.c +index 3f650ede0c3d..e293f6f3d1bc 100644 +--- a/drivers/media/usb/tm6000/tm6000-video.c ++++ b/drivers/media/usb/tm6000/tm6000-video.c +@@ -852,8 +852,7 @@ static int vidioc_querycap(struct file *file, void *priv, + struct tm6000_core *dev = ((struct tm6000_fh *)priv)->dev; + + strscpy(cap->driver, "tm6000", sizeof(cap->driver)); +- strscpy(cap->card, "Trident TVMaster TM5600/6000/6010", +- sizeof(cap->card)); ++ strscpy(cap->card, "Trident TM5600/6000/6010", sizeof(cap->card)); + usb_make_path(dev->udev, cap->bus_info, sizeof(cap->bus_info)); + cap->capabilities = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_READWRITE | + V4L2_CAP_DEVICE_CAPS; +-- +2.26.2 + diff --git a/patches.suse/media-ttusb-dec-avoid-release-of-non-acquired-mutex.patch b/patches.suse/media-ttusb-dec-avoid-release-of-non-acquired-mutex.patch new file mode 100644 index 0000000..3e1b3df --- /dev/null +++ b/patches.suse/media-ttusb-dec-avoid-release-of-non-acquired-mutex.patch @@ -0,0 +1,69 @@ +From 36b9d695aa6fb8e9a312db21af41f90824d16ab4 Mon Sep 17 00:00:00 2001 +From: Evgeny Novikov +Date: Tue, 20 Jul 2021 11:28:27 +0200 +Subject: [PATCH] media: ttusb-dec: avoid release of non-acquired mutex +Git-commit: 36b9d695aa6fb8e9a312db21af41f90824d16ab4 +Patch-mainline: v5.16-rc1 +References: git-fixes + +ttusb_dec_send_command() invokes mutex_lock_interruptible() that can +fail but then it releases the non-acquired mutex. The patch fixes that. + +Found by Linux Driver Verification project (linuxtesting.org). + +Fixes: dba328bab4c6 ("media: ttusb-dec: cleanup an error handling logic") +Signed-off-by: Evgeny Novikov +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/usb/ttusb-dec/ttusb_dec.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c +index bfda46a36dc5..38822cedd93a 100644 +--- a/drivers/media/usb/ttusb-dec/ttusb_dec.c ++++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c +@@ -327,7 +327,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, + result = mutex_lock_interruptible(&dec->usb_mutex); + if (result) { + printk("%s: Failed to lock usb mutex.\n", __func__); +- goto err; ++ goto err_free; + } + + b[0] = 0xaa; +@@ -349,7 +349,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, + if (result) { + printk("%s: command bulk message failed: error %d\n", + __func__, result); +- goto err; ++ goto err_mutex_unlock; + } + + result = usb_bulk_msg(dec->udev, dec->result_pipe, b, +@@ -358,7 +358,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, + if (result) { + printk("%s: result bulk message failed: error %d\n", + __func__, result); +- goto err; ++ goto err_mutex_unlock; + } else { + if (debug) { + printk(KERN_DEBUG "%s: result: %*ph\n", +@@ -371,9 +371,9 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, + memcpy(cmd_result, &b[4], b[3]); + } + +-err: ++err_mutex_unlock: + mutex_unlock(&dec->usb_mutex); +- ++err_free: + kfree(b); + return result; + } +-- +2.26.2 + diff --git a/patches.suse/media-v4l2-ioctl-Fix-check_ext_ctrls.patch b/patches.suse/media-v4l2-ioctl-Fix-check_ext_ctrls.patch new file mode 100644 index 0000000..33d1097 --- /dev/null +++ b/patches.suse/media-v4l2-ioctl-Fix-check_ext_ctrls.patch @@ -0,0 +1,167 @@ +From 861f92cb9160b14beef0ada047384c2340701ee2 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Fri, 18 Jun 2021 14:29:03 +0200 +Subject: [PATCH] media: v4l2-ioctl: Fix check_ext_ctrls +Git-commit: 861f92cb9160b14beef0ada047384c2340701ee2 +Patch-mainline: v5.16-rc1 +References: git-fixes + +Drivers that do not use the ctrl-framework use this function instead. + +Fix the following issues: + +- Do not check for multiple classes when getting the DEF_VAL. +- Return -EINVAL for request_api calls +- Default value cannot be changed, return EINVAL as soon as possible. +- Return the right error_idx +[If an error is found when validating the list of controls passed with +VIDIOC_G_EXT_CTRLS, then error_idx shall be set to ctrls->count to +indicate to userspace that no actual hardware was touched. +It would have been much nicer of course if error_idx could point to the +control index that failed the validation, but sadly that's not how the +API was designed.] + +Fixes v4l2-compliance: +Control ioctls (Input 0): + warn: v4l2-test-controls.cpp(834): error_idx should be equal to count + warn: v4l2-test-controls.cpp(855): error_idx should be equal to count + fail: v4l2-test-controls.cpp(813): doioctl(node, VIDIOC_G_EXT_CTRLS, &ctrls) + test VIDIOC_G/S/TRY_EXT_CTRLS: FAIL +Buffer ioctls (Input 0): + fail: v4l2-test-buffers.cpp(1994): ret != EINVAL && ret != EBADR && ret != ENOTTY + test Requests: FAIL + +Cc: stable@vger.kernel.org +Fixes: 6fa6f831f095 ("media: v4l2-ctrls: add core request support") +Suggested-by: Hans Verkuil +Reviewed-by: Hans Verkuil +Signed-off-by: Ricardo Ribalda +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/v4l2-core/v4l2-ioctl.c | 60 ++++++++++++++++++---------- + 1 file changed, 39 insertions(+), 21 deletions(-) + +diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c +index d4f97ab1b237..dc817f8ba9d7 100644 +--- a/drivers/media/v4l2-core/v4l2-ioctl.c ++++ b/drivers/media/v4l2-core/v4l2-ioctl.c +@@ -869,7 +869,7 @@ static void v4l_print_default(const void *arg, bool write_only) + pr_cont("driver-specific ioctl\n"); + } + +-static int check_ext_ctrls(struct v4l2_ext_controls *c, int allow_priv) ++static bool check_ext_ctrls(struct v4l2_ext_controls *c, unsigned long ioctl) + { + __u32 i; + +@@ -878,23 +878,41 @@ static int check_ext_ctrls(struct v4l2_ext_controls *c, int allow_priv) + for (i = 0; i < c->count; i++) + c->controls[i].reserved2[0] = 0; + +- /* V4L2_CID_PRIVATE_BASE cannot be used as control class +- when using extended controls. +- Only when passed in through VIDIOC_G_CTRL and VIDIOC_S_CTRL +- is it allowed for backwards compatibility. +- */ +- if (!allow_priv && c->which == V4L2_CID_PRIVATE_BASE) +- return 0; +- if (!c->which) +- return 1; ++ switch (c->which) { ++ case V4L2_CID_PRIVATE_BASE: ++ /* ++ * V4L2_CID_PRIVATE_BASE cannot be used as control class ++ * when using extended controls. ++ * Only when passed in through VIDIOC_G_CTRL and VIDIOC_S_CTRL ++ * is it allowed for backwards compatibility. ++ */ ++ if (ioctl == VIDIOC_G_CTRL || ioctl == VIDIOC_S_CTRL) ++ return false; ++ break; ++ case V4L2_CTRL_WHICH_DEF_VAL: ++ /* Default value cannot be changed */ ++ if (ioctl == VIDIOC_S_EXT_CTRLS || ++ ioctl == VIDIOC_TRY_EXT_CTRLS) { ++ c->error_idx = c->count; ++ return false; ++ } ++ return true; ++ case V4L2_CTRL_WHICH_CUR_VAL: ++ return true; ++ case V4L2_CTRL_WHICH_REQUEST_VAL: ++ c->error_idx = c->count; ++ return false; ++ } ++ + /* Check that all controls are from the same control class. */ + for (i = 0; i < c->count; i++) { + if (V4L2_CTRL_ID2WHICH(c->controls[i].id) != c->which) { +- c->error_idx = i; +- return 0; ++ c->error_idx = ioctl == VIDIOC_TRY_EXT_CTRLS ? i : ++ c->count; ++ return false; + } + } +- return 1; ++ return true; + } + + static int check_fmt(struct file *file, enum v4l2_buf_type type) +@@ -2189,7 +2207,7 @@ static int v4l_g_ctrl(const struct v4l2_ioctl_ops *ops, + ctrls.controls = &ctrl; + ctrl.id = p->id; + ctrl.value = p->value; +- if (check_ext_ctrls(&ctrls, 1)) { ++ if (check_ext_ctrls(&ctrls, VIDIOC_G_CTRL)) { + int ret = ops->vidioc_g_ext_ctrls(file, fh, &ctrls); + + if (ret == 0) +@@ -2223,7 +2241,7 @@ static int v4l_s_ctrl(const struct v4l2_ioctl_ops *ops, + ctrls.controls = &ctrl; + ctrl.id = p->id; + ctrl.value = p->value; +- if (check_ext_ctrls(&ctrls, 1)) ++ if (check_ext_ctrls(&ctrls, VIDIOC_S_CTRL)) + return ops->vidioc_s_ext_ctrls(file, fh, &ctrls); + return -EINVAL; + } +@@ -2245,8 +2263,8 @@ static int v4l_g_ext_ctrls(const struct v4l2_ioctl_ops *ops, + vfd, vfd->v4l2_dev->mdev, p); + if (ops->vidioc_g_ext_ctrls == NULL) + return -ENOTTY; +- return check_ext_ctrls(p, 0) ? ops->vidioc_g_ext_ctrls(file, fh, p) : +- -EINVAL; ++ return check_ext_ctrls(p, VIDIOC_G_EXT_CTRLS) ? ++ ops->vidioc_g_ext_ctrls(file, fh, p) : -EINVAL; + } + + static int v4l_s_ext_ctrls(const struct v4l2_ioctl_ops *ops, +@@ -2266,8 +2284,8 @@ static int v4l_s_ext_ctrls(const struct v4l2_ioctl_ops *ops, + vfd, vfd->v4l2_dev->mdev, p); + if (ops->vidioc_s_ext_ctrls == NULL) + return -ENOTTY; +- return check_ext_ctrls(p, 0) ? ops->vidioc_s_ext_ctrls(file, fh, p) : +- -EINVAL; ++ return check_ext_ctrls(p, VIDIOC_S_EXT_CTRLS) ? ++ ops->vidioc_s_ext_ctrls(file, fh, p) : -EINVAL; + } + + static int v4l_try_ext_ctrls(const struct v4l2_ioctl_ops *ops, +@@ -2287,8 +2305,8 @@ static int v4l_try_ext_ctrls(const struct v4l2_ioctl_ops *ops, + vfd, vfd->v4l2_dev->mdev, p); + if (ops->vidioc_try_ext_ctrls == NULL) + return -ENOTTY; +- return check_ext_ctrls(p, 0) ? ops->vidioc_try_ext_ctrls(file, fh, p) : +- -EINVAL; ++ return check_ext_ctrls(p, VIDIOC_TRY_EXT_CTRLS) ? ++ ops->vidioc_try_ext_ctrls(file, fh, p) : -EINVAL; + } + + /* +-- +2.26.2 + diff --git a/patches.suse/media-v4l2-ioctl-S_CTRL-output-the-right-value.patch b/patches.suse/media-v4l2-ioctl-S_CTRL-output-the-right-value.patch new file mode 100644 index 0000000..8c6a3c5 --- /dev/null +++ b/patches.suse/media-v4l2-ioctl-S_CTRL-output-the-right-value.patch @@ -0,0 +1,61 @@ +From c87ed93574e3cd8346c05bd934c617596c12541b Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Fri, 18 Jun 2021 14:29:06 +0200 +Subject: [PATCH] media: v4l2-ioctl: S_CTRL output the right value +Git-commit: c87ed93574e3cd8346c05bd934c617596c12541b +Patch-mainline: v5.16-rc1 +References: git-fixes + +If the driver does not implement s_ctrl, but it does implement +s_ext_ctrls, we convert the call. + +When that happens we have also to convert back the response from +s_ext_ctrls. + +Fixes v4l2_compliance: +Control ioctls (Input 0): + fail: v4l2-test-controls.cpp(411): returned control value out of range + fail: v4l2-test-controls.cpp(507): invalid control 00980900 + test VIDIOC_G/S_CTRL: FAIL + +Fixes: 35ea11ff8471 ("V4L/DVB (8430): videodev: move some functions from v4l2-dev.h to v4l2-common.h or v4l2-ioctl.h") +Reviewed-by: Hans Verkuil +Signed-off-by: Ricardo Ribalda +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/v4l2-core/v4l2-ioctl.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c +index dc817f8ba9d7..bc83d23ce25d 100644 +--- a/drivers/media/v4l2-core/v4l2-ioctl.c ++++ b/drivers/media/v4l2-core/v4l2-ioctl.c +@@ -2226,6 +2226,7 @@ static int v4l_s_ctrl(const struct v4l2_ioctl_ops *ops, + test_bit(V4L2_FL_USES_V4L2_FH, &vfd->flags) ? fh : NULL; + struct v4l2_ext_controls ctrls; + struct v4l2_ext_control ctrl; ++ int ret; + + if (vfh && vfh->ctrl_handler) + return v4l2_s_ctrl(vfh, vfh->ctrl_handler, p); +@@ -2241,9 +2242,11 @@ static int v4l_s_ctrl(const struct v4l2_ioctl_ops *ops, + ctrls.controls = &ctrl; + ctrl.id = p->id; + ctrl.value = p->value; +- if (check_ext_ctrls(&ctrls, VIDIOC_S_CTRL)) +- return ops->vidioc_s_ext_ctrls(file, fh, &ctrls); +- return -EINVAL; ++ if (!check_ext_ctrls(&ctrls, VIDIOC_S_CTRL)) ++ return -EINVAL; ++ ret = ops->vidioc_s_ext_ctrls(file, fh, &ctrls); ++ p->value = ctrl.value; ++ return ret; + } + + static int v4l_g_ext_ctrls(const struct v4l2_ioctl_ops *ops, +-- +2.26.2 + diff --git a/patches.suse/media-venus-fix-vpp-frequency-calculation-for-decode.patch b/patches.suse/media-venus-fix-vpp-frequency-calculation-for-decode.patch new file mode 100644 index 0000000..6883efc --- /dev/null +++ b/patches.suse/media-venus-fix-vpp-frequency-calculation-for-decode.patch @@ -0,0 +1,51 @@ +From 1444232152ea33f5ae41fc14bade3e74d642b634 Mon Sep 17 00:00:00 2001 +From: Mansur Alisha Shaik +Date: Tue, 14 Sep 2021 05:57:07 +0200 +Subject: [PATCH] media: venus: fix vpp frequency calculation for decoder +Git-commit: 1444232152ea33f5ae41fc14bade3e74d642b634 +Patch-mainline: v5.16-rc1 +References: git-fixes + +In existing video driver implementation vpp frequency calculation in +calculate_inst_freq() is always zero because the value of vpp_freq_per_mb +is always zero for decoder. + +Fixed this by correcting the calculating the vpp frequency calculation for +decoder. + +Fixes: 3cfe5815ce0e ("media: venus: Enable low power setting for encoder") +Signed-off-by: Mansur Alisha Shaik +Signed-off-by: Stanimir Varbanov +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/platform/qcom/venus/pm_helpers.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/qcom/venus/pm_helpers.c b/drivers/media/platform/qcom/venus/pm_helpers.c +index 679177e7ad22..cedc664ba755 100644 +--- a/drivers/media/platform/qcom/venus/pm_helpers.c ++++ b/drivers/media/platform/qcom/venus/pm_helpers.c +@@ -1085,12 +1085,16 @@ static unsigned long calculate_inst_freq(struct venus_inst *inst, + if (inst->state != INST_START) + return 0; + +- if (inst->session_type == VIDC_SESSION_TYPE_ENC) ++ if (inst->session_type == VIDC_SESSION_TYPE_ENC) { + vpp_freq_per_mb = inst->flags & VENUS_LOW_POWER ? + inst->clk_data.low_power_freq : + inst->clk_data.vpp_freq; + +- vpp_freq = mbs_per_sec * vpp_freq_per_mb; ++ vpp_freq = mbs_per_sec * vpp_freq_per_mb; ++ } else { ++ vpp_freq = mbs_per_sec * inst->clk_data.vpp_freq; ++ } ++ + /* 21 / 20 is overhead factor */ + vpp_freq += vpp_freq / 20; + vsp_freq = mbs_per_sec * inst->clk_data.vsp_freq; +-- +2.26.2 + diff --git a/patches.suse/memstick-avoid-out-of-range-warning.patch b/patches.suse/memstick-avoid-out-of-range-warning.patch new file mode 100644 index 0000000..118a882 --- /dev/null +++ b/patches.suse/memstick-avoid-out-of-range-warning.patch @@ -0,0 +1,44 @@ +From 4853396f03c3019eccf5cd113e464231e9ddf0b3 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 27 Sep 2021 11:44:47 +0200 +Subject: [PATCH] memstick: avoid out-of-range warning +Git-commit: 4853396f03c3019eccf5cd113e464231e9ddf0b3 +Patch-mainline: v5.16-rc1 +References: git-fixes + +clang-14 complains about a sanity check that always passes when the +page size is 64KB or larger: + +drivers/memstick/core/ms_block.c:1739:21: error: result of comparison of constant 65536 with expression of type 'unsigned short' is always false [-Werror,-Wtautological-constant-out-of-range-compare] + if (msb->page_size > PAGE_SIZE) { + ~~~~~~~~~~~~~~ ^ ~~~~~~~~~ + +This is fine, it will still work on all architectures, so just shut +up that warning with a cast. + +Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20210927094520.696665-1-arnd@kernel.org +Signed-off-by: Ulf Hansson +Acked-by: Takashi Iwai + +--- + drivers/memstick/core/ms_block.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c +index 772edbdc9587..0cda6c6baefc 100644 +--- a/drivers/memstick/core/ms_block.c ++++ b/drivers/memstick/core/ms_block.c +@@ -1736,7 +1736,7 @@ static int msb_init_card(struct memstick_dev *card) + msb->pages_in_block = boot_block->attr.block_size * 2; + msb->block_size = msb->page_size * msb->pages_in_block; + +- if (msb->page_size > PAGE_SIZE) { ++ if ((size_t)msb->page_size > PAGE_SIZE) { + /* this isn't supported by linux at all, anyway*/ + dbg("device page %d size isn't supported", msb->page_size); + return -EINVAL; +-- +2.26.2 + diff --git a/patches.suse/memstick-jmb38x_ms-use-appropriate-free-function-in-.patch b/patches.suse/memstick-jmb38x_ms-use-appropriate-free-function-in-.patch new file mode 100644 index 0000000..394bdcb --- /dev/null +++ b/patches.suse/memstick-jmb38x_ms-use-appropriate-free-function-in-.patch @@ -0,0 +1,39 @@ +From beae4a6258e64af609ad5995cc6b6056eb0d898e Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 11 Oct 2021 15:39:12 +0300 +Subject: [PATCH] memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host() +Git-commit: beae4a6258e64af609ad5995cc6b6056eb0d898e +Patch-mainline: v5.16-rc1 +References: git-fixes + +The "msh" pointer is device managed, meaning that memstick_alloc_host() +calls device_initialize() on it. That means that it can't be free +using kfree() but must instead be freed with memstick_free_host(). +Otherwise it leads to a tiny memory leak of device resources. + +Fixes: 60fdd931d577 ("memstick: add support for JMicron jmb38x MemoryStick host controller") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20211011123912.GD15188@kili +Signed-off-by: Ulf Hansson +Acked-by: Takashi Iwai + +--- + drivers/memstick/host/jmb38x_ms.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/memstick/host/jmb38x_ms.c b/drivers/memstick/host/jmb38x_ms.c +index a7a0f0caea15..21cb2a786058 100644 +--- a/drivers/memstick/host/jmb38x_ms.c ++++ b/drivers/memstick/host/jmb38x_ms.c +@@ -882,7 +882,7 @@ static struct memstick_host *jmb38x_ms_alloc_host(struct jmb38x_ms *jm, int cnt) + + iounmap(host->addr); + err_out_free: +- kfree(msh); ++ memstick_free_host(msh); + return NULL; + } + +-- +2.26.2 + diff --git a/patches.suse/mmc-mxs-mmc-disable-regulator-on-error-and-in-the-re.patch b/patches.suse/mmc-mxs-mmc-disable-regulator-on-error-and-in-the-re.patch new file mode 100644 index 0000000..ff37a4b --- /dev/null +++ b/patches.suse/mmc-mxs-mmc-disable-regulator-on-error-and-in-the-re.patch @@ -0,0 +1,55 @@ +From ce5f6c2c9b0fcb4094f8e162cfd37fb4294204f7 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sat, 16 Oct 2021 08:21:44 +0200 +Subject: [PATCH] mmc: mxs-mmc: disable regulator on error and in the remove function +Git-commit: ce5f6c2c9b0fcb4094f8e162cfd37fb4294204f7 +Patch-mainline: v5.16-rc1 +References: git-fixes + +The 'reg_vmmc' regulator is enabled in the probe. It is never disabled. +Neither in the error handling path of the probe nor in the remove +function. + +Register a devm_action to disable it when needed. + +Fixes: 4dc5a79f1350 ("mmc: mxs-mmc: enable regulator for mmc slot") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/4aadb3c97835f7b80f00819c3d549e6130384e67.1634365151.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Ulf Hansson +Acked-by: Takashi Iwai + +--- + drivers/mmc/host/mxs-mmc.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c +index 947581de7860..8c3655d3be96 100644 +--- a/drivers/mmc/host/mxs-mmc.c ++++ b/drivers/mmc/host/mxs-mmc.c +@@ -552,6 +552,11 @@ static const struct of_device_id mxs_mmc_dt_ids[] = { + }; + MODULE_DEVICE_TABLE(of, mxs_mmc_dt_ids); + ++static void mxs_mmc_regulator_disable(void *regulator) ++{ ++ regulator_disable(regulator); ++} ++ + static int mxs_mmc_probe(struct platform_device *pdev) + { + struct device_node *np = pdev->dev.of_node; +@@ -591,6 +596,11 @@ static int mxs_mmc_probe(struct platform_device *pdev) + "Failed to enable vmmc regulator: %d\n", ret); + goto out_mmc_free; + } ++ ++ ret = devm_add_action_or_reset(&pdev->dev, mxs_mmc_regulator_disable, ++ reg_vmmc); ++ if (ret) ++ goto out_mmc_free; + } + + ssp->clk = devm_clk_get(&pdev->dev, NULL); +-- +2.26.2 + diff --git a/patches.suse/mmc-sdhci-omap-Fix-NULL-pointer-exception-if-regulat.patch b/patches.suse/mmc-sdhci-omap-Fix-NULL-pointer-exception-if-regulat.patch new file mode 100644 index 0000000..60c9779 --- /dev/null +++ b/patches.suse/mmc-sdhci-omap-Fix-NULL-pointer-exception-if-regulat.patch @@ -0,0 +1,54 @@ +From 8e0e7bd38b1ec7f9e5d18725ad41828be4e09859 Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Tue, 21 Sep 2021 14:00:25 +0300 +Subject: [PATCH] mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured +Git-commit: 8e0e7bd38b1ec7f9e5d18725ad41828be4e09859 +Patch-mainline: v5.16-rc1 +References: git-fixes + +If sdhci-omap is configured for an unused device instance and the device +is not set as disabled, we can get a NULL pointer dereference: + +Unable to handle kernel NULL pointer dereference at virtual address +00000045 +... +(regulator_set_voltage) from [] (mmc_regulator_set_ocr+0x44/0xd0) +(mmc_regulator_set_ocr) from [] (sdhci_set_ios+0xa4/0x490) +(sdhci_set_ios) from [] (sdhci_omap_set_ios+0x124/0x160) +(sdhci_omap_set_ios) from [] (mmc_power_up.part.0+0x3c/0x154) +(mmc_power_up.part.0) from [] (mmc_start_host+0x88/0x9c) +(mmc_start_host) from [] (mmc_add_host+0x58/0x7c) +(mmc_add_host) from [] (__sdhci_add_host+0xf0/0x22c) +(__sdhci_add_host) from [] (sdhci_omap_probe+0x318/0x72c) +(sdhci_omap_probe) from [] (platform_probe+0x58/0xb8) + +AFAIK we are not seeing this with the devices configured in the mainline +kernel but this can cause issues for folks bringing up their boards. + +Fixes: 7d326930d352 ("mmc: sdhci-omap: Add OMAP SDHCI driver") +Signed-off-by: Tony Lindgren +Link: https://lore.kernel.org/r/20210921110029.21944-2-tony@atomide.com +Signed-off-by: Ulf Hansson +Acked-by: Takashi Iwai + +--- + drivers/mmc/host/sdhci-omap.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c +index 8f4d1f003f65..3ddced779e96 100644 +--- a/drivers/mmc/host/sdhci-omap.c ++++ b/drivers/mmc/host/sdhci-omap.c +@@ -682,7 +682,8 @@ static void sdhci_omap_set_power(struct sdhci_host *host, unsigned char mode, + { + struct mmc_host *mmc = host->mmc; + +- mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd); ++ if (!IS_ERR(mmc->supply.vmmc)) ++ mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd); + } + + static int sdhci_omap_enable_dma(struct sdhci_host *host) +-- +2.26.2 + diff --git a/patches.suse/mmc-sdhci-omap-Fix-context-restore.patch b/patches.suse/mmc-sdhci-omap-Fix-context-restore.patch new file mode 100644 index 0000000..965e96a --- /dev/null +++ b/patches.suse/mmc-sdhci-omap-Fix-context-restore.patch @@ -0,0 +1,78 @@ +From d806e334d0390502cd2a820ad33d65d7f9bba618 Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Tue, 21 Sep 2021 14:00:26 +0300 +Subject: [PATCH] mmc: sdhci-omap: Fix context restore +Git-commit: d806e334d0390502cd2a820ad33d65d7f9bba618 +Patch-mainline: v5.16-rc1 +References: git-fixes + +We need to restore context in a specified order with HCTL set in two +phases. This is similar to what omap_hsmmc_context_restore() is doing. +Otherwise SDIO can stop working on resume. + +And for PM runtime and SDIO cards, we need to also save SYSCTL, IE and +ISE. + +This should not be a problem currently, and these patches can be applied +whenever suitable. + +Fixes: ee0f309263a6 ("mmc: sdhci-omap: Add Support for Suspend/Resume") +Signed-off-by: Tony Lindgren +Link: https://lore.kernel.org/r/20210921110029.21944-3-tony@atomide.com +Signed-off-by: Ulf Hansson +Acked-by: Takashi Iwai + +--- + drivers/mmc/host/sdhci-omap.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c +index 3ddced779e96..fd188b6d88f4 100644 +--- a/drivers/mmc/host/sdhci-omap.c ++++ b/drivers/mmc/host/sdhci-omap.c +@@ -62,6 +62,8 @@ + #define SDHCI_OMAP_IE 0x234 + #define INT_CC_EN BIT(0) + ++#define SDHCI_OMAP_ISE 0x238 ++ + #define SDHCI_OMAP_AC12 0x23c + #define AC12_V1V8_SIGEN BIT(19) + #define AC12_SCLK_SEL BIT(23) +@@ -113,6 +115,8 @@ struct sdhci_omap_host { + u32 hctl; + u32 sysctl; + u32 capa; ++ u32 ie; ++ u32 ise; + }; + + static void sdhci_omap_start_clock(struct sdhci_omap_host *omap_host); +@@ -1245,14 +1249,23 @@ static void sdhci_omap_context_save(struct sdhci_omap_host *omap_host) + { + omap_host->con = sdhci_omap_readl(omap_host, SDHCI_OMAP_CON); + omap_host->hctl = sdhci_omap_readl(omap_host, SDHCI_OMAP_HCTL); ++ omap_host->sysctl = sdhci_omap_readl(omap_host, SDHCI_OMAP_SYSCTL); + omap_host->capa = sdhci_omap_readl(omap_host, SDHCI_OMAP_CAPA); ++ omap_host->ie = sdhci_omap_readl(omap_host, SDHCI_OMAP_IE); ++ omap_host->ise = sdhci_omap_readl(omap_host, SDHCI_OMAP_ISE); + } + ++/* Order matters here, HCTL must be restored in two phases */ + static void sdhci_omap_context_restore(struct sdhci_omap_host *omap_host) + { +- sdhci_omap_writel(omap_host, SDHCI_OMAP_CON, omap_host->con); + sdhci_omap_writel(omap_host, SDHCI_OMAP_HCTL, omap_host->hctl); + sdhci_omap_writel(omap_host, SDHCI_OMAP_CAPA, omap_host->capa); ++ sdhci_omap_writel(omap_host, SDHCI_OMAP_HCTL, omap_host->hctl); ++ ++ sdhci_omap_writel(omap_host, SDHCI_OMAP_SYSCTL, omap_host->sysctl); ++ sdhci_omap_writel(omap_host, SDHCI_OMAP_CON, omap_host->con); ++ sdhci_omap_writel(omap_host, SDHCI_OMAP_IE, omap_host->ie); ++ sdhci_omap_writel(omap_host, SDHCI_OMAP_ISE, omap_host->ise); + } + + static int __maybe_unused sdhci_omap_suspend(struct device *dev) +-- +2.26.2 + diff --git a/patches.suse/regulator-dt-bindings-samsung-s5m8767-correct-s5m876.patch b/patches.suse/regulator-dt-bindings-samsung-s5m8767-correct-s5m876.patch new file mode 100644 index 0000000..9da5b5b --- /dev/null +++ b/patches.suse/regulator-dt-bindings-samsung-s5m8767-correct-s5m876.patch @@ -0,0 +1,39 @@ +From a7fda04bc9b6ad9da8e19c9e6e3b1dab773d068a Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Fri, 8 Oct 2021 13:37:14 +0200 +Subject: [PATCH] regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property +Git-commit: a7fda04bc9b6ad9da8e19c9e6e3b1dab773d068a +Patch-mainline: v5.16-rc1 +References: git-fixes + +The driver was always parsing "s5m8767,pmic-buck-default-dvs-idx", not +"s5m8767,pmic-buck234-default-dvs-idx". + +Cc: +Fixes: 26aec009f6b6 ("regulator: add device tree support for s5m8767") +Signed-off-by: Krzysztof Kozlowski +Acked-by: Rob Herring +Message-id: <20211008113723.134648-3-krzysztof.kozlowski@canonical.com> +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt b/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt +index d9cff1614f7a..6cd83d920155 100644 +--- a/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt ++++ b/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt +@@ -39,7 +39,7 @@ Optional properties of the main device node (the parent!): + + Additional properties required if either of the optional properties are used: + +- - s5m8767,pmic-buck234-default-dvs-idx: Default voltage setting selected from ++ - s5m8767,pmic-buck-default-dvs-idx: Default voltage setting selected from + the possible 8 options selectable by the dvs gpios. The value of this + property should be between 0 and 7. If not specified or if out of range, the + default value of this property is set to 0. +-- +2.26.2 + diff --git a/patches.suse/regulator-s5m8767-do-not-use-reset-value-as-DVS-volt.patch b/patches.suse/regulator-s5m8767-do-not-use-reset-value-as-DVS-volt.patch new file mode 100644 index 0000000..0707ec6 --- /dev/null +++ b/patches.suse/regulator-s5m8767-do-not-use-reset-value-as-DVS-volt.patch @@ -0,0 +1,120 @@ +From b16bef60a9112b1e6daf3afd16484eb06e7ce792 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Fri, 8 Oct 2021 13:37:13 +0200 +Subject: [PATCH] regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled +Git-commit: b16bef60a9112b1e6daf3afd16484eb06e7ce792 +Patch-mainline: v5.16-rc1 +References: git-fixes + +The driver and its bindings, before commit 04f9f068a619 ("regulator: +S5m8767: Modify parsing method of the voltage table of buck2/3/4") were +requiring to provide at least one safe/default voltage for DVS registers +if DVS GPIO is not being enabled. + +IOW, if s5m8767,pmic-buck2-uses-gpio-dvs is missing, the +s5m8767,pmic-buck2-dvs-voltage should still be present and contain one +voltage. + +This requirement was coming from driver behavior matching this condition +(none of DVS GPIO is enabled): it was always initializing the DVS +selector pins to 0 and keeping the DVS enable setting at reset value +(enabled). Therefore if none of DVS GPIO is enabled in devicetree, +driver was configuring the first DVS voltage for buck[234]. + +Mentioned commit 04f9f068a619 ("regulator: s5m8767: Modify parsing +method of the voltage table of buck2/3/4") broke it because DVS voltage +won't be parsed from devicetree if DVS GPIO is not enabled. After the +change, driver will configure bucks to use the register reset value as +voltage which might have unpleasant effects. + +Fix this by relaxing the bindings constrain: if DVS GPIO is not enabled +in devicetree (therefore DVS voltage is also not parsed), explicitly +disable it. + +Cc: +Fixes: 04f9f068a619 ("regulator: s5m8767: Modify parsing method of the voltage table of buck2/3/4") +Signed-off-by: Krzysztof Kozlowski +Acked-by: Rob Herring +Message-id: <20211008113723.134648-2-krzysztof.kozlowski@canonical.com> +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + .../bindings/regulator/samsung,s5m8767.txt | 21 +++++++------------ + drivers/regulator/s5m8767.c | 21 ++++++++----------- + 2 files changed, 17 insertions(+), 25 deletions(-) + +diff --git a/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt b/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt +index 093edda0c8df..d9cff1614f7a 100644 +--- a/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt ++++ b/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt +@@ -13,6 +13,14 @@ common regulator binding documented in: + + + Required properties of the main device node (the parent!): ++ - s5m8767,pmic-buck-ds-gpios: GPIO specifiers for three host gpio's used ++ for selecting GPIO DVS lines. It is one-to-one mapped to dvs gpio lines. ++ ++ [1] If either of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional ++ property is specified, then all the eight voltage values for the ++ 's5m8767,pmic-buck[2/3/4]-dvs-voltage' should be specified. ++ ++Optional properties of the main device node (the parent!): + - s5m8767,pmic-buck2-dvs-voltage: A set of 8 voltage values in micro-volt (uV) + units for buck2 when changing voltage using gpio dvs. Refer to [1] below + for additional information. +@@ -25,19 +33,6 @@ Required properties of the main device node (the parent!): + units for buck4 when changing voltage using gpio dvs. Refer to [1] below + for additional information. + +- - s5m8767,pmic-buck-ds-gpios: GPIO specifiers for three host gpio's used +- for selecting GPIO DVS lines. It is one-to-one mapped to dvs gpio lines. +- +- [1] If none of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional +- property is specified, the 's5m8767,pmic-buck[2/3/4]-dvs-voltage' +- property should specify atleast one voltage level (which would be a +- safe operating voltage). +- +- If either of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional +- property is specified, then all the eight voltage values for the +- 's5m8767,pmic-buck[2/3/4]-dvs-voltage' should be specified. +- +-Optional properties of the main device node (the parent!): + - s5m8767,pmic-buck2-uses-gpio-dvs: 'buck2' can be controlled by gpio dvs. + - s5m8767,pmic-buck3-uses-gpio-dvs: 'buck3' can be controlled by gpio dvs. + - s5m8767,pmic-buck4-uses-gpio-dvs: 'buck4' can be controlled by gpio dvs. +diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c +index 7c111bbdc2af..35269f998210 100644 +--- a/drivers/regulator/s5m8767.c ++++ b/drivers/regulator/s5m8767.c +@@ -850,18 +850,15 @@ static int s5m8767_pmic_probe(struct platform_device *pdev) + /* DS4 GPIO */ + gpio_direction_output(pdata->buck_ds[2], 0x0); + +- if (pdata->buck2_gpiodvs || pdata->buck3_gpiodvs || +- pdata->buck4_gpiodvs) { +- regmap_update_bits(s5m8767->iodev->regmap_pmic, +- S5M8767_REG_BUCK2CTRL, 1 << 1, +- (pdata->buck2_gpiodvs) ? (1 << 1) : (0 << 1)); +- regmap_update_bits(s5m8767->iodev->regmap_pmic, +- S5M8767_REG_BUCK3CTRL, 1 << 1, +- (pdata->buck3_gpiodvs) ? (1 << 1) : (0 << 1)); +- regmap_update_bits(s5m8767->iodev->regmap_pmic, +- S5M8767_REG_BUCK4CTRL, 1 << 1, +- (pdata->buck4_gpiodvs) ? (1 << 1) : (0 << 1)); +- } ++ regmap_update_bits(s5m8767->iodev->regmap_pmic, ++ S5M8767_REG_BUCK2CTRL, 1 << 1, ++ (pdata->buck2_gpiodvs) ? (1 << 1) : (0 << 1)); ++ regmap_update_bits(s5m8767->iodev->regmap_pmic, ++ S5M8767_REG_BUCK3CTRL, 1 << 1, ++ (pdata->buck3_gpiodvs) ? (1 << 1) : (0 << 1)); ++ regmap_update_bits(s5m8767->iodev->regmap_pmic, ++ S5M8767_REG_BUCK4CTRL, 1 << 1, ++ (pdata->buck4_gpiodvs) ? (1 << 1) : (0 << 1)); + + /* Initialize GPIO DVS registers */ + for (i = 0; i < 8; i++) { +-- +2.26.2 + diff --git a/patches.suse/selinux-smack-fix-subjective-objective-credential-us.patch b/patches.suse/selinux-smack-fix-subjective-objective-credential-us.patch index 1355982..0e410a5 100644 --- a/patches.suse/selinux-smack-fix-subjective-objective-credential-us.patch +++ b/patches.suse/selinux-smack-fix-subjective-objective-credential-us.patch @@ -4,7 +4,7 @@ Date: Thu, 23 Sep 2021 09:50:11 -0400 Subject: [PATCH] selinux,smack: fix subjective/objective credential use mixups Git-commit: a3727a8bac0a9e77c70820655fd8715523ba3db7 Patch-mainline: v5.15-rc3 -References: stable-5.14.8 +References: CVE-2021-43057 bsc#1192260 stable-5.14.8 commit a3727a8bac0a9e77c70820655fd8715523ba3db7 upstream. diff --git a/patches.suse/spi-Fixed-division-by-zero-warning.patch b/patches.suse/spi-Fixed-division-by-zero-warning.patch new file mode 100644 index 0000000..8937670 --- /dev/null +++ b/patches.suse/spi-Fixed-division-by-zero-warning.patch @@ -0,0 +1,82 @@ +From 09134c5322df9f105d9ed324051872d5d0e162aa Mon Sep 17 00:00:00 2001 +From: Yoshitaka Ikeda +Date: Wed, 8 Sep 2021 05:29:12 +0000 +Subject: [PATCH] spi: Fixed division by zero warning +Git-commit: 09134c5322df9f105d9ed324051872d5d0e162aa +Patch-mainline: v5.16-rc1 +References: git-fixes + +The reason for dividing by zero is because the dummy bus width is zero, +but if the dummy n bytes is zero, it indicates that there is no data transfer, +so there is no need for calculation. + +Fixes: 7512eaf54190 ("spi: cadence-quadspi: Fix dummy cycle calculation when buswidth > 1") +Signed-off-by: Yoshitaka Ikeda +Acked-by: Pratyush Yadav +Link: https://lore.kernel.org/r/OSZPR01MB70049C8F56ED8902852DF97B8BD49@OSZPR01MB7004.jpnprd01.prod.outlook.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + drivers/spi/atmel-quadspi.c | 2 +- + drivers/spi/spi-bcm-qspi.c | 3 ++- + drivers/spi/spi-mtk-nor.c | 2 +- + drivers/spi/spi-stm32-qspi.c | 2 +- + 4 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/atmel-quadspi.c b/drivers/spi/atmel-quadspi.c +index 95d4fa32c299..92d9610df1fd 100644 +--- a/drivers/spi/atmel-quadspi.c ++++ b/drivers/spi/atmel-quadspi.c +@@ -310,7 +310,7 @@ static int atmel_qspi_set_cfg(struct atmel_qspi *aq, + return mode; + ifr |= atmel_qspi_modes[mode].config; + +- if (op->dummy.buswidth && op->dummy.nbytes) ++ if (op->dummy.nbytes) + dummy_cycles = op->dummy.nbytes * 8 / op->dummy.buswidth; + + /* +diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c +index a78e56f566dd..0d95fe54b3c0 100644 +--- a/drivers/spi/spi-bcm-qspi.c ++++ b/drivers/spi/spi-bcm-qspi.c +@@ -395,7 +395,8 @@ static int bcm_qspi_bspi_set_flex_mode(struct bcm_qspi *qspi, + if (addrlen == BSPI_ADDRLEN_4BYTES) + bpp = BSPI_BPP_ADDR_SELECT_MASK; + +- bpp |= (op->dummy.nbytes * 8) / op->dummy.buswidth; ++ if (op->dummy.nbytes) ++ bpp |= (op->dummy.nbytes * 8) / op->dummy.buswidth; + + switch (width) { + case SPI_NBITS_SINGLE: +diff --git a/drivers/spi/spi-mtk-nor.c b/drivers/spi/spi-mtk-nor.c +index 41e7b341d261..5c93730615f8 100644 +--- a/drivers/spi/spi-mtk-nor.c ++++ b/drivers/spi/spi-mtk-nor.c +@@ -160,7 +160,7 @@ static bool mtk_nor_match_read(const struct spi_mem_op *op) + { + int dummy = 0; + +- if (op->dummy.buswidth) ++ if (op->dummy.nbytes) + dummy = op->dummy.nbytes * BITS_PER_BYTE / op->dummy.buswidth; + + if ((op->data.buswidth == 2) || (op->data.buswidth == 4)) { +diff --git a/drivers/spi/spi-stm32-qspi.c b/drivers/spi/spi-stm32-qspi.c +index 27f35aa2d746..514337c86d2c 100644 +--- a/drivers/spi/spi-stm32-qspi.c ++++ b/drivers/spi/spi-stm32-qspi.c +@@ -397,7 +397,7 @@ static int stm32_qspi_send(struct spi_mem *mem, const struct spi_mem_op *op) + ccr |= FIELD_PREP(CCR_ADSIZE_MASK, op->addr.nbytes - 1); + } + +- if (op->dummy.buswidth && op->dummy.nbytes) ++ if (op->dummy.nbytes) + ccr |= FIELD_PREP(CCR_DCYC_MASK, + op->dummy.nbytes * 8 / op->dummy.buswidth); + +-- +2.26.2 + diff --git a/patches.suse/spi-spi-rpc-if-Check-return-value-of-rpcif_sw_init.patch b/patches.suse/spi-spi-rpc-if-Check-return-value-of-rpcif_sw_init.patch new file mode 100644 index 0000000..1015038 --- /dev/null +++ b/patches.suse/spi-spi-rpc-if-Check-return-value-of-rpcif_sw_init.patch @@ -0,0 +1,42 @@ +From 0b0a281ed7001d4c4f4c47bdc84680c4997761ca Mon Sep 17 00:00:00 2001 +From: Lad Prabhakar +Date: Mon, 25 Oct 2021 21:56:27 +0100 +Subject: [PATCH] spi: spi-rpc-if: Check return value of rpcif_sw_init() +Git-commit: 0b0a281ed7001d4c4f4c47bdc84680c4997761ca +Patch-mainline: v5.16-rc1 +References: git-fixes + +rpcif_sw_init() can fail so make sure we check the return value +of it and on error exit rpcif_spi_probe() callback with error code. + +Fixes: eb8d6d464a27 ("spi: add Renesas RPC-IF driver") +Signed-off-by: Lad Prabhakar +Reviewed-by: Biju Das +Reviewed-by: Wolfram Sang +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20211025205631.21151-4-prabhakar.mahadev-lad.rj@bp.renesas.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + drivers/spi/spi-rpc-if.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-rpc-if.c b/drivers/spi/spi-rpc-if.c +index c53138ce0030..83796a4ead34 100644 +--- a/drivers/spi/spi-rpc-if.c ++++ b/drivers/spi/spi-rpc-if.c +@@ -139,7 +139,9 @@ static int rpcif_spi_probe(struct platform_device *pdev) + return -ENOMEM; + + rpc = spi_controller_get_devdata(ctlr); +- rpcif_sw_init(rpc, parent); ++ error = rpcif_sw_init(rpc, parent); ++ if (error) ++ return error; + + platform_set_drvdata(pdev, ctlr); + +-- +2.26.2 + diff --git a/patches.suse/tpm-Check-for-integer-overflow-in-tpm2_map_response_.patch b/patches.suse/tpm-Check-for-integer-overflow-in-tpm2_map_response_.patch new file mode 100644 index 0000000..32a1ca4 --- /dev/null +++ b/patches.suse/tpm-Check-for-integer-overflow-in-tpm2_map_response_.patch @@ -0,0 +1,39 @@ +From a0bcce2b2a169e10eb265c8f0ebdd5ae4c875670 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 8 Sep 2021 08:33:57 +0300 +Subject: [PATCH] tpm: Check for integer overflow in tpm2_map_response_body() +Git-commit: a0bcce2b2a169e10eb265c8f0ebdd5ae4c875670 +Patch-mainline: v5.16-rc1 +References: git-fixes + +The "4 * be32_to_cpu(data->count)" multiplication can potentially +overflow which would lead to memory corruption. Add a check for that. + +Cc: stable@vger.kernel.org +Fixes: 745b361e989a ("tpm: infrastructure for TPM spaces") +Signed-off-by: Dan Carpenter +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Acked-by: Takashi Iwai + +--- + drivers/char/tpm/tpm2-space.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c +index 784b8b3cb903..97e916856cf3 100644 +--- a/drivers/char/tpm/tpm2-space.c ++++ b/drivers/char/tpm/tpm2-space.c +@@ -455,6 +455,9 @@ static int tpm2_map_response_body(struct tpm_chip *chip, u32 cc, u8 *rsp, + if (be32_to_cpu(data->capability) != TPM2_CAP_HANDLES) + return 0; + ++ if (be32_to_cpu(data->count) > (UINT_MAX - TPM_HEADER_SIZE - 9) / 4) ++ return -EFAULT; ++ + if (len != TPM_HEADER_SIZE + 9 + 4 * be32_to_cpu(data->count)) + return -EFAULT; + +-- +2.26.2 + diff --git a/patches.suse/tpm-fix-Atmel-TPM-crash-caused-by-too-frequent-queri.patch b/patches.suse/tpm-fix-Atmel-TPM-crash-caused-by-too-frequent-queri.patch new file mode 100644 index 0000000..4da8e74 --- /dev/null +++ b/patches.suse/tpm-fix-Atmel-TPM-crash-caused-by-too-frequent-queri.patch @@ -0,0 +1,171 @@ +From 79ca6f74dae067681a779fd573c2eb59649989bc Mon Sep 17 00:00:00 2001 +From: Hao Wu +Date: Wed, 8 Sep 2021 02:26:06 -0700 +Subject: [PATCH] tpm: fix Atmel TPM crash caused by too frequent queries +Git-commit: 79ca6f74dae067681a779fd573c2eb59649989bc +Patch-mainline: v5.16-rc1 +References: git-fixes + +The Atmel TPM 1.2 chips crash with error +`tpm_try_transmit: send(): error -62` since kernel 4.14. +It is observed from the kernel log after running `tpm_sealdata -z`. +The error thrown from the command is as follows +``` +$ tpm_sealdata -z +Tspi_Key_LoadKey failed: 0x00001087 - layer=tddl, +code=0087 (135), I/O error +``` + +The issue was reproduced with the following Atmel TPM chip: +``` +$ tpm_version +T0 TPM 1.2 Version Info: + Chip Version: 1.2.66.1 + Spec Level: 2 + Errata Revision: 3 + TPM Vendor ID: ATML + TPM Version: 01010000 + Manufacturer Info: 41544d4c +``` + +The root cause of the issue is due to the TPM calls to msleep() +were replaced with usleep_range() [1], which reduces +the actual timeout. Via experiments, it is observed that +the original msleep(5) actually sleeps for 15ms. +Because of a known timeout issue in Atmel TPM 1.2 chip, +the shorter timeout than 15ms can cause the error described above. + +A few further changes in kernel 4.16 [2] and 4.18 [3, 4] further +reduced the timeout to less than 1ms. With experiments, +the problematic timeout in the latest kernel is the one +for `wait_for_tpm_stat`. + +To fix it, the patch reverts the timeout of `wait_for_tpm_stat` +to 15ms for all Atmel TPM 1.2 chips, but leave it untouched +for Ateml TPM 2.0 chip, and chips from other vendors. +As explained above, the chosen 15ms timeout is +the actual timeout before this issue introduced, +thus the old value is used here. +Particularly, TPM_ATML_TIMEOUT_WAIT_STAT_MIN is set to 14700us, +TPM_ATML_TIMEOUT_WAIT_STAT_MIN is set to 15000us according to +the existing TPM_TIMEOUT_RANGE_US (300us). +The fixed has been tested in the system with the affected Atmel chip +with no issues observed after boot up. + + References: +[1] 9f3fc7bcddcb tpm: replace msleep() with usleep_range() in TPM +1.2/2.0 generic drivers +[2] cf151a9a44d5 tpm: reduce tpm polling delay in tpm_tis_core +[3] 59f5a6b07f64 tpm: reduce poll sleep time in tpm_transmit() +[4] 424eaf910c32 tpm: reduce polling time to usecs for even finer +granularity + +Fixes: 9f3fc7bcddcb ("tpm: replace msleep() with usleep_range() in TPM 1.2/2.0 generic drivers") +Link: https://patchwork.kernel.org/project/linux-integrity/patch/20200926223150.109645-1-hao.wu@rubrik.com/ +Signed-off-by: Hao Wu +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Acked-by: Takashi Iwai + +--- + drivers/char/tpm/tpm_tis_core.c | 26 ++++++++++++++++++-------- + drivers/char/tpm/tpm_tis_core.h | 4 ++++ + include/linux/tpm.h | 1 + + 3 files changed, 23 insertions(+), 8 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index 69579efb247b..b2659a4c4016 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -48,6 +48,7 @@ static int wait_for_tpm_stat(struct tpm_chip *chip, u8 mask, + unsigned long timeout, wait_queue_head_t *queue, + bool check_cancel) + { ++ struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev); + unsigned long stop; + long rc; + u8 status; +@@ -80,8 +81,8 @@ static int wait_for_tpm_stat(struct tpm_chip *chip, u8 mask, + } + } else { + do { +- usleep_range(TPM_TIMEOUT_USECS_MIN, +- TPM_TIMEOUT_USECS_MAX); ++ usleep_range(priv->timeout_min, ++ priv->timeout_max); + status = chip->ops->status(chip); + if ((status & mask) == mask) + return 0; +@@ -945,7 +946,22 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + chip->timeout_b = msecs_to_jiffies(TIS_TIMEOUT_B_MAX); + chip->timeout_c = msecs_to_jiffies(TIS_TIMEOUT_C_MAX); + chip->timeout_d = msecs_to_jiffies(TIS_TIMEOUT_D_MAX); ++ priv->timeout_min = TPM_TIMEOUT_USECS_MIN; ++ priv->timeout_max = TPM_TIMEOUT_USECS_MAX; + priv->phy_ops = phy_ops; ++ ++ rc = tpm_tis_read32(priv, TPM_DID_VID(0), &vendor); ++ if (rc < 0) ++ goto out_err; ++ ++ priv->manufacturer_id = vendor; ++ ++ if (priv->manufacturer_id == TPM_VID_ATML && ++ !(chip->flags & TPM_CHIP_FLAG_TPM2)) { ++ priv->timeout_min = TIS_TIMEOUT_MIN_ATML; ++ priv->timeout_max = TIS_TIMEOUT_MAX_ATML; ++ } ++ + dev_set_drvdata(&chip->dev, priv); + + if (is_bsw()) { +@@ -988,12 +1004,6 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + if (rc) + goto out_err; + +- rc = tpm_tis_read32(priv, TPM_DID_VID(0), &vendor); +- if (rc < 0) +- goto out_err; +- +- priv->manufacturer_id = vendor; +- + rc = tpm_tis_read8(priv, TPM_RID(0), &rid); + if (rc < 0) + goto out_err; +diff --git a/drivers/char/tpm/tpm_tis_core.h b/drivers/char/tpm/tpm_tis_core.h +index b2a3c6c72882..3be24f221e32 100644 +--- a/drivers/char/tpm/tpm_tis_core.h ++++ b/drivers/char/tpm/tpm_tis_core.h +@@ -54,6 +54,8 @@ enum tis_defaults { + TIS_MEM_LEN = 0x5000, + TIS_SHORT_TIMEOUT = 750, /* ms */ + TIS_LONG_TIMEOUT = 2000, /* 2 sec */ ++ TIS_TIMEOUT_MIN_ATML = 14700, /* usecs */ ++ TIS_TIMEOUT_MAX_ATML = 15000, /* usecs */ + }; + + /* Some timeout values are needed before it is known whether the chip is +@@ -98,6 +100,8 @@ struct tpm_tis_data { + wait_queue_head_t read_queue; + const struct tpm_tis_phy_ops *phy_ops; + unsigned short rng_quality; ++ unsigned int timeout_min; /* usecs */ ++ unsigned int timeout_max; /* usecs */ + }; + + struct tpm_tis_phy_ops { +diff --git a/include/linux/tpm.h b/include/linux/tpm.h +index aa11fe323c56..12d827734686 100644 +--- a/include/linux/tpm.h ++++ b/include/linux/tpm.h +@@ -269,6 +269,7 @@ enum tpm2_cc_attrs { + #define TPM_VID_INTEL 0x8086 + #define TPM_VID_WINBOND 0x1050 + #define TPM_VID_STM 0x104A ++#define TPM_VID_ATML 0x1114 + + enum tpm_chip_flags { + TPM_CHIP_FLAG_TPM2 = BIT(1), +-- +2.26.2 + diff --git a/patches.suse/tpm_tis_spi-Add-missing-SPI-ID.patch b/patches.suse/tpm_tis_spi-Add-missing-SPI-ID.patch new file mode 100644 index 0000000..8035d7b --- /dev/null +++ b/patches.suse/tpm_tis_spi-Add-missing-SPI-ID.patch @@ -0,0 +1,44 @@ +From 7eba41fe8c7bb01ff3d4b757bd622375792bc720 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Fri, 24 Sep 2021 15:41:11 +0100 +Subject: [PATCH] tpm_tis_spi: Add missing SPI ID +Git-commit: 7eba41fe8c7bb01ff3d4b757bd622375792bc720 +Patch-mainline: v5.16-rc1 +References: git-fixes + +In commit c46ed2281bbe ("tpm_tis_spi: add missing SPI device ID entries") +we added SPI IDs for all the DT aliases to handle the fact that we always +use SPI modaliases to load modules even when probed via DT however the +mentioned commit missed that the SPI and OF device ID entries did not +match and were different and so DT nodes with compatible +"tcg,tpm_tis-spi" will not match. Add an extra ID for tpm_tis-spi +rather than just fix the existing one since what's currently there is +going to be better for anyone actually using SPI IDs to instantiate. + +Fixes: c46ed2281bbe ("tpm_tis_spi: add missing SPI device ID entries") +Fixes: 96c8395e2166 ("spi: Revert modalias changes") +Signed-off-by: Mark Brown +Reviewed-by: Jarkko Sakkinen +Reviewed-by: Javier Martinez Canillas +Signed-off-by: Jarkko Sakkinen +Acked-by: Takashi Iwai + +--- + drivers/char/tpm/tpm_tis_spi_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/char/tpm/tpm_tis_spi_main.c b/drivers/char/tpm/tpm_tis_spi_main.c +index 54584b4b00d1..aaa59a00eeae 100644 +--- a/drivers/char/tpm/tpm_tis_spi_main.c ++++ b/drivers/char/tpm/tpm_tis_spi_main.c +@@ -267,6 +267,7 @@ static const struct spi_device_id tpm_tis_spi_id[] = { + { "st33htpm-spi", (unsigned long)tpm_tis_spi_probe }, + { "slb9670", (unsigned long)tpm_tis_spi_probe }, + { "tpm_tis_spi", (unsigned long)tpm_tis_spi_probe }, ++ { "tpm_tis-spi", (unsigned long)tpm_tis_spi_probe }, + { "cr50", (unsigned long)cr50_spi_probe }, + {} + }; +-- +2.26.2 + diff --git a/series.conf b/series.conf index b47ccba..fe07a5b 100644 --- a/series.conf +++ b/series.conf @@ -3353,6 +3353,10 @@ patches.suse/mmc-tmio-reenable-card-irqs-after-the-reset-callback.patch patches.suse/gpio-xgs-iproc-fix-parsing-of-ngpios-property.patch patches.suse/scsi-ibmvfc-Fix-up-duplicate-response-detection.patch + patches.suse/tpm-Check-for-integer-overflow-in-tpm2_map_response_.patch + patches.suse/tpm-fix-Atmel-TPM-crash-caused-by-too-frequent-queri.patch + patches.suse/tpm_tis_spi-Add-missing-SPI-ID.patch + patches.suse/irqchip-Fix-compile-testing-without-CONFIG_OF.patch patches.suse/sched-fair-Add-NOHZ-balancer-flag-for-nohz.next_balance-updates.patch patches.suse/sched-fair-Trigger-nohz.next_balance-updates-when-a-CPU-goes-NOHZ-idle.patch patches.suse/sched-Switch-wait_task_inactive-to-HRTIMER_MODE_REL_HARD.patch @@ -3395,9 +3399,60 @@ patches.suse/irq_work-Allow-irq_work_sync-to-sleep-if-irq_work-no-IRQ-support.patch patches.suse/irq_work-Handle-some-irq_work-in-a-per-CPU-thread-on-PREEMPT_RT.patch patches.suse/irq_work-Also-rcuwait-for-IRQ_WORK_HARD_IRQ-on-PREEMPT_RT.patch + patches.suse/fortify-Fix-dropped-strcpy-compile-time-write-overfl.patch + patches.suse/firmware-psci-fix-application-of-sizeof-to-pointer.patch + patches.suse/media-em28xx-add-missing-em28xx_close_extension.patch + patches.suse/media-meson-ge2d-Fix-rotation-parameter-changes-dete.patch + patches.suse/media-cxd2880-spi-Fix-a-null-pointer-dereference-on-.patch + patches.suse/media-ttusb-dec-avoid-release-of-non-acquired-mutex.patch + patches.suse/media-dvb-usb-fix-ununit-value-in-az6027_rc_query.patch + patches.suse/media-staging-intel-ipu3-css-Fix-wrong-size-comparis.patch + patches.suse/media-imx258-Fix-getting-clock-frequency.patch + patches.suse/media-ov8856-Set-default-mbus-format-but-allow-calle.patch + patches.suse/media-v4l2-ioctl-Fix-check_ext_ctrls.patch + patches.suse/media-v4l2-ioctl-S_CTRL-output-the-right-value.patch + patches.suse/media-mtk-vcodec-venc-fix-return-value-when-start_st.patch patches.suse/media-firewire-firedtv-avc-fix-a-buffer-overflow-in-.patch + patches.suse/media-TDA1997x-handle-short-reads-of-hdmi-info-frame.patch + patches.suse/media-mtk-vpu-Fix-a-resource-leak-in-the-error-handl.patch + patches.suse/media-imx-jpeg-Fix-the-error-handling-path-of-mxc_jp.patch + patches.suse/media-i2c-ths8200-needs-V4L2_ASYNC.patch + patches.suse/media-sun6i-csi-Allow-the-video-device-to-be-open-mu.patch + patches.suse/media-radio-wl1273-Avoid-card-name-truncation.patch + patches.suse/media-si470x-Avoid-card-name-truncation.patch + patches.suse/media-tm6000-Avoid-card-name-truncation.patch + patches.suse/media-cx23885-Fix-snd_card_free-call-on-null-card-po.patch + patches.suse/media-atmel-fix-the-ispck-initialization.patch + patches.suse/media-mxl111sf-change-mutex_init-location.patch + patches.suse/media-cedrus-Fix-SUNXI-tile-size-calculation-448ea5ee473b.patch + patches.suse/media-em28xx-Don-t-use-ops-suspend-if-it-is-NULL.patch + patches.suse/media-CEC-keep-related-menu-entries-together.patch + patches.suse/media-venus-fix-vpp-frequency-calculation-for-decode.patch + patches.suse/media-dvb-frontends-mn88443x-Handle-errors-of-clk_pr.patch + patches.suse/media-rkvdec-Do-not-override-sizeimage-for-output-fo.patch + patches.suse/media-rkvdec-Support-dynamic-resolution-changes.patch + patches.suse/media-ivtv-fix-build-for-UML.patch + patches.suse/media-ir_toy-assignment-to-be16-should-be-of-correct.patch + patches.suse/media-ite-cir-IR-receiver-stop-working-after-receive.patch + patches.suse/ipmi-watchdog-Set-panic-count-to-proper-value-on-a-p.patch + patches.suse/ipmi-kcs_bmc-Fix-a-memory-leak-in-the-error-handling.patch + patches.suse/mmc-sdhci-omap-Fix-NULL-pointer-exception-if-regulat.patch + patches.suse/mmc-sdhci-omap-Fix-context-restore.patch + patches.suse/memstick-avoid-out-of-range-warning.patch + patches.suse/memstick-jmb38x_ms-use-appropriate-free-function-in-.patch + patches.suse/mmc-mxs-mmc-disable-regulator-on-error-and-in-the-re.patch patches.suse/dt-bindings-mmc-fsl-imx-esdhc-add-NXP-S32G2-support.patch patches.suse/mmc-sdhci-esdhc-imx-add-NXP-S32G2-support.patch + patches.suse/mailbox-Remove-WARN_ON-for-async_cb.cb-in-cmdq_exec_.patch + patches.suse/regulator-s5m8767-do-not-use-reset-value-as-DVS-volt.patch + patches.suse/regulator-dt-bindings-samsung-s5m8767-correct-s5m876.patch + patches.suse/spi-Fixed-division-by-zero-warning.patch + patches.suse/spi-spi-rpc-if-Check-return-value-of-rpcif_sw_init.patch + patches.suse/hwmon-Fix-possible-memleak-in-__hwmon_device_registe.patch + patches.suse/hwmon-pmbus-lm25066-Add-offset-coefficients.patch + patches.suse/hwmon-pmbus-lm25066-Let-compiler-determine-outer-dim.patch + patches.suse/hwmon-tmp401-Drop-support-for-TMP461.patch + patches.suse/hwrng-mtk-Force-runtime-pm-ops-for-sleep-ops.patch # netdev/net-next patches.suse/ibmvnic-Consolidate-code-in-replenish_rx_pool.patch