diff options
Diffstat (limited to 'freed-ora')
17 files changed, 3088 insertions, 74 deletions
diff --git a/freed-ora/current/f24/ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch b/freed-ora/current/f24/ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch new file mode 100644 index 000000000..801434a26 --- /dev/null +++ b/freed-ora/current/f24/ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch @@ -0,0 +1,80 @@ +From 873156565ca67779bbf5a3475ccd08ea3bb92522 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai <tiwai@suse.de> +Date: Tue, 15 Mar 2016 15:20:58 +0100 +Subject: [PATCH 2/2] ALSA: usb-audio: Add sanity checks for endpoint accesses + +Add some sanity check codes before actually accessing the endpoint via +get_endpoint() in order to avoid the invalid access through a +malformed USB descriptor. Mostly just checking bNumEndpoints, but in +one place (snd_microii_spdif_default_get()), the validity of iface and +altsetting index is checked as well. + +Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=971125 +Cc: <stable@vger.kernel.org> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +--- + sound/usb/clock.c | 2 ++ + sound/usb/endpoint.c | 3 +++ + sound/usb/mixer_quirks.c | 4 ++++ + sound/usb/pcm.c | 2 ++ + 4 files changed, 11 insertions(+) + +diff --git a/sound/usb/clock.c b/sound/usb/clock.c +index 2ed260b10f6d..7ccbcaf6a147 100644 +--- a/sound/usb/clock.c ++++ b/sound/usb/clock.c +@@ -285,6 +285,8 @@ static int set_sample_rate_v1(struct snd_usb_audio *chip, int iface, + unsigned char data[3]; + int err, crate; + ++ if (get_iface_desc(alts)->bNumEndpoints < 1) ++ return -EINVAL; + ep = get_endpoint(alts, 0)->bEndpointAddress; + + /* if endpoint doesn't have sampling rate control, bail out */ +diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c +index e6f71894ecdc..c2131b851602 100644 +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -415,6 +415,9 @@ exit_clear: + * + * New endpoints will be added to chip->ep_list and must be freed by + * calling snd_usb_endpoint_free(). ++ * ++ * For SND_USB_ENDPOINT_TYPE_SYNC, the caller needs to guarantee that ++ * bNumEndpoints > 1 beforehand. + */ + struct snd_usb_endpoint *snd_usb_add_endpoint(struct snd_usb_audio *chip, + struct usb_host_interface *alts, +diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c +index d3608c0a29f3..2d724e3c4cc0 100644 +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -1518,7 +1518,11 @@ static int snd_microii_spdif_default_get(struct snd_kcontrol *kcontrol, + + /* use known values for that card: interface#1 altsetting#1 */ + iface = usb_ifnum_to_if(chip->dev, 1); ++ if (!iface || iface->num_altsetting < 2) ++ return -EINVAL; + alts = &iface->altsetting[1]; ++ if (get_iface_desc(alts)->bNumEndpoints < 1) ++ return -EINVAL; + ep = get_endpoint(alts, 0)->bEndpointAddress; + + err = snd_usb_ctl_msg(chip->dev, +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index cdac5179db3f..4da64896df6d 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -159,6 +159,8 @@ static int init_pitch_v1(struct snd_usb_audio *chip, int iface, + unsigned char data[1]; + int err; + ++ if (get_iface_desc(alts)->bNumEndpoints < 1) ++ return -EINVAL; + ep = get_endpoint(alts, 0)->bEndpointAddress; + + data[0] = 1; +-- +2.5.0 + diff --git a/freed-ora/current/f24/ALSA-usb-audio-Fix-NULL-dereference-in-create_fixed_.patch b/freed-ora/current/f24/ALSA-usb-audio-Fix-NULL-dereference-in-create_fixed_.patch new file mode 100644 index 000000000..37cdb213a --- /dev/null +++ b/freed-ora/current/f24/ALSA-usb-audio-Fix-NULL-dereference-in-create_fixed_.patch @@ -0,0 +1,40 @@ +From b0bb5691b38e2f439b071e226bad9f699c33b77d Mon Sep 17 00:00:00 2001 +From: Takashi Iwai <tiwai@suse.de> +Date: Tue, 15 Mar 2016 12:09:10 +0100 +Subject: [PATCH 1/2] ALSA: usb-audio: Fix NULL dereference in + create_fixed_stream_quirk() + +create_fixed_stream_quirk() may cause a NULL-pointer dereference by +accessing the non-existing endpoint when a USB device with a malformed +USB descriptor is used. + +This patch avoids it simply by adding a sanity check of bNumEndpoints +before the accesses. + +Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=971125 +Cc: <stable@vger.kernel.org> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +--- + sound/usb/quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index eef9b8e4b949..e128ca62eb44 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -177,6 +177,12 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, + } + alts = &iface->altsetting[fp->altset_idx]; + altsd = get_iface_desc(alts); ++ if (altsd->bNumEndpoints < 1) { ++ kfree(fp); ++ kfree(rate_table); ++ return -EINVAL; ++ } ++ + fp->protocol = altsd->bInterfaceProtocol; + + if (fp->datainterval == 0) +-- +2.5.0 + diff --git a/freed-ora/current/f24/USB-input-powermate-fix-oops-with-malicious-USB-desc.patch b/freed-ora/current/f24/USB-input-powermate-fix-oops-with-malicious-USB-desc.patch new file mode 100644 index 000000000..7de890e1b --- /dev/null +++ b/freed-ora/current/f24/USB-input-powermate-fix-oops-with-malicious-USB-desc.patch @@ -0,0 +1,38 @@ +From 0383ff3ba89d3e6c604138e3ba46685621d71f98 Mon Sep 17 00:00:00 2001 +From: Josh Boyer <jwboyer@fedoraproject.org> +Date: Mon, 14 Mar 2016 10:02:51 -0400 +Subject: [PATCH] USB: input: powermate: fix oops with malicious USB + descriptors + +The powermate driver expects at least one valid USB endpoint in its +probe function. If given malicious descriptors that specify 0 for +the number of endpoints, it will crash. Validate the number of +endpoints on the interface before using them. + +The full report for this issue can be found here: +http://seclists.org/bugtraq/2016/Mar/85 + +Reported-by: Ralf Spenneberg <ralf@spenneberg.net> +Cc: stable <stable@vger.kernel.org> +Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> +--- + drivers/input/misc/powermate.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/input/misc/powermate.c b/drivers/input/misc/powermate.c +index 63b539d3daba..84909a12ff36 100644 +--- a/drivers/input/misc/powermate.c ++++ b/drivers/input/misc/powermate.c +@@ -307,6 +307,9 @@ static int powermate_probe(struct usb_interface *intf, const struct usb_device_i + int error = -ENOMEM; + + interface = intf->cur_altsetting; ++ if (interface->desc.bNumEndpoints < 1) ++ return -EINVAL; ++ + endpoint = &interface->endpoint[0].desc; + if (!usb_endpoint_is_int_in(endpoint)) + return -EIO; +-- +2.5.0 + diff --git a/freed-ora/current/f24/USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch b/freed-ora/current/f24/USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch new file mode 100644 index 000000000..7df3af2b1 --- /dev/null +++ b/freed-ora/current/f24/USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch @@ -0,0 +1,40 @@ +From 3620ebad64a327113bed34edefd45c3605086fc6 Mon Sep 17 00:00:00 2001 +From: Josh Boyer <jwboyer@fedoraproject.org> +Date: Mon, 14 Mar 2016 10:38:31 -0400 +Subject: [PATCH] USB: iowarrior: fix oops with malicious USB descriptors + +The iowarrior driver expects at least one valid endpoint. If given +malicious descriptors that specify 0 for the number of endpoints, +it will crash in the probe function. Ensure there is at least +one endpoint on the interface before using it. + +The full report of this issue can be found here: +http://seclists.org/bugtraq/2016/Mar/87 + +Reported-by: Ralf Spenneberg <ralf@spenneberg.net> +Cc: stable <stable@vger.kernel.org> +Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> +--- + drivers/usb/misc/iowarrior.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c +index c6bfd13f6c92..1950e87b4219 100644 +--- a/drivers/usb/misc/iowarrior.c ++++ b/drivers/usb/misc/iowarrior.c +@@ -787,6 +787,12 @@ static int iowarrior_probe(struct usb_interface *interface, + iface_desc = interface->cur_altsetting; + dev->product_id = le16_to_cpu(udev->descriptor.idProduct); + ++ if (iface_desc->desc.bNumEndpoints < 1) { ++ dev_err(&interface->dev, "Invalid number of endpoints\n"); ++ retval = -EINVAL; ++ goto error; ++ } ++ + /* set up the endpoint information */ + for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { + endpoint = &iface_desc->endpoint[i].desc; +-- +2.5.0 + diff --git a/freed-ora/current/f24/bcm283x-add-aux-uart-support-extra-DT-bits-initial-r.patch b/freed-ora/current/f24/bcm283x-add-aux-uart-support-extra-DT-bits-initial-r.patch new file mode 100644 index 000000000..beaa6bd0f --- /dev/null +++ b/freed-ora/current/f24/bcm283x-add-aux-uart-support-extra-DT-bits-initial-r.patch @@ -0,0 +1,2155 @@ +From 59fb5b800868d984e836ab4a38d8ba1598dc675a Mon Sep 17 00:00:00 2001 +From: Peter Robinson <pbrobinson@gmail.com> +Date: Fri, 18 Mar 2016 19:18:51 +0000 +Subject: [PATCH] bcm283x: add aux uart support, extra DT bits, initial rpi3, + VC4 fixes and VC4 DT bindings + +--- + .../devicetree/bindings/arm/bcm/brcm,bcm2835.txt | 4 + + .../bindings/serial/brcm,bcm2835-aux-uart.txt | 18 + + arch/arm/boot/dts/Makefile | 4 +- + arch/arm/boot/dts/bcm2835-rpi-a-plus.dts | 4 + + arch/arm/boot/dts/bcm2835-rpi-a.dts | 28 + + arch/arm/boot/dts/bcm2835-rpi-b-plus.dts | 4 + + arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts | 4 + + arch/arm/boot/dts/bcm2835-rpi-b.dts | 4 + + arch/arm/boot/dts/bcm2835-rpi.dtsi | 25 + + arch/arm/boot/dts/bcm2836-rpi-2-b.dts | 4 + + arch/arm/boot/dts/bcm2837-rpi-3-b.dts | 22 + + arch/arm/boot/dts/bcm2837.dtsi | 68 +++ + arch/arm/boot/dts/bcm283x.dtsi | 90 ++- + drivers/clk/bcm/clk-bcm2835.c | 12 +- + drivers/gpu/drm/vc4/vc4_bo.c | 7 +- + drivers/gpu/drm/vc4/vc4_crtc.c | 134 +++-- + drivers/gpu/drm/vc4/vc4_drv.h | 12 +- + drivers/gpu/drm/vc4/vc4_hdmi.c | 42 +- + drivers/gpu/drm/vc4/vc4_hvs.c | 97 ++++ + drivers/gpu/drm/vc4/vc4_kms.c | 9 + + drivers/gpu/drm/vc4/vc4_plane.c | 603 +++++++++++++++++++-- + drivers/gpu/drm/vc4/vc4_regs.h | 120 +++- + drivers/gpu/drm/vc4/vc4_v3d.c | 1 + + drivers/tty/serial/8250/8250_bcm2835aux.c | 146 +++++ + drivers/tty/serial/8250/Kconfig | 24 + + drivers/tty/serial/8250/Makefile | 1 + + 26 files changed, 1365 insertions(+), 122 deletions(-) + create mode 100644 Documentation/devicetree/bindings/serial/brcm,bcm2835-aux-uart.txt + create mode 100644 arch/arm/boot/dts/bcm2835-rpi-a.dts + create mode 100644 arch/arm/boot/dts/bcm2837-rpi-3-b.dts + create mode 100644 arch/arm/boot/dts/bcm2837.dtsi + create mode 100644 drivers/tty/serial/8250/8250_bcm2835aux.c + +diff --git a/Documentation/devicetree/bindings/arm/bcm/brcm,bcm2835.txt b/Documentation/devicetree/bindings/arm/bcm/brcm,bcm2835.txt +index 11d3056..6ffe087 100644 +--- a/Documentation/devicetree/bindings/arm/bcm/brcm,bcm2835.txt ++++ b/Documentation/devicetree/bindings/arm/bcm/brcm,bcm2835.txt +@@ -30,6 +30,10 @@ Raspberry Pi 2 Model B + Required root node properties: + compatible = "raspberrypi,2-model-b", "brcm,bcm2836"; + ++Raspberry Pi 3 Model B ++Required root node properties: ++compatible = "raspberrypi,3-model-b", "brcm,bcm2837"; ++ + Raspberry Pi Compute Module + Required root node properties: + compatible = "raspberrypi,compute-module", "brcm,bcm2835"; +diff --git a/Documentation/devicetree/bindings/serial/brcm,bcm2835-aux-uart.txt b/Documentation/devicetree/bindings/serial/brcm,bcm2835-aux-uart.txt +new file mode 100644 +index 0000000..b5cc629 +--- /dev/null ++++ b/Documentation/devicetree/bindings/serial/brcm,bcm2835-aux-uart.txt +@@ -0,0 +1,18 @@ ++* BCM2835 AUXILIAR UART ++ ++Required properties: ++ ++- compatible: "brcm,bcm2835-aux-uart" ++- reg: The base address of the UART register bank. ++- interrupts: A single interrupt specifier. ++- clocks: Clock driving the hardware; used to figure out the baud rate ++ divisor. ++ ++Example: ++ ++ uart1: serial@7e215040 { ++ compatible = "brcm,bcm2835-aux-uart"; ++ reg = <0x7e215040 0x40>; ++ interrupts = <1 29>; ++ clocks = <&aux BCM2835_AUX_CLOCK_UART>; ++ }; +diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile +index a4a6d70..a8a0767 100644 +--- a/arch/arm/boot/dts/Makefile ++++ b/arch/arm/boot/dts/Makefile +@@ -60,10 +60,12 @@ dtb-$(CONFIG_ARCH_AXXIA) += \ + axm5516-amarillo.dtb + dtb-$(CONFIG_ARCH_BCM2835) += \ + bcm2835-rpi-b.dtb \ ++ bcm2835-rpi-a.dtb \ + bcm2835-rpi-b-rev2.dtb \ + bcm2835-rpi-b-plus.dtb \ + bcm2835-rpi-a-plus.dtb \ +- bcm2836-rpi-2-b.dtb ++ bcm2836-rpi-2-b.dtb \ ++ bcm2837-rpi-3-b.dtb + dtb-$(CONFIG_ARCH_BCM_5301X) += \ + bcm4708-asus-rt-ac56u.dtb \ + bcm4708-asus-rt-ac68u.dtb \ +diff --git a/arch/arm/boot/dts/bcm2835-rpi-a-plus.dts b/arch/arm/boot/dts/bcm2835-rpi-a-plus.dts +index 228614f..35ff4e7a 100644 +--- a/arch/arm/boot/dts/bcm2835-rpi-a-plus.dts ++++ b/arch/arm/boot/dts/bcm2835-rpi-a-plus.dts +@@ -29,3 +29,7 @@ + brcm,function = <BCM2835_FSEL_ALT0>; + }; + }; ++ ++&hdmi { ++ hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>; ++}; +diff --git a/arch/arm/boot/dts/bcm2835-rpi-a.dts b/arch/arm/boot/dts/bcm2835-rpi-a.dts +new file mode 100644 +index 0000000..306a84e +--- /dev/null ++++ b/arch/arm/boot/dts/bcm2835-rpi-a.dts +@@ -0,0 +1,28 @@ ++/dts-v1/; ++#include "bcm2835.dtsi" ++#include "bcm2835-rpi.dtsi" ++ ++/ { ++ compatible = "raspberrypi,model-a", "brcm,bcm2835"; ++ model = "Raspberry Pi Model A"; ++ ++ leds { ++ act { ++ gpios = <&gpio 16 1>; ++ }; ++ }; ++}; ++ ++&gpio { ++ pinctrl-0 = <&gpioout &alt0 &i2s_alt2 &alt3>; ++ ++ /* I2S interface */ ++ i2s_alt2: i2s_alt2 { ++ brcm,pins = <28 29 30 31>; ++ brcm,function = <BCM2835_FSEL_ALT2>; ++ }; ++}; ++ ++&hdmi { ++ hpd-gpios = <&gpio 46 GPIO_ACTIVE_HIGH>; ++}; +diff --git a/arch/arm/boot/dts/bcm2835-rpi-b-plus.dts b/arch/arm/boot/dts/bcm2835-rpi-b-plus.dts +index ef54050..57d313b 100644 +--- a/arch/arm/boot/dts/bcm2835-rpi-b-plus.dts ++++ b/arch/arm/boot/dts/bcm2835-rpi-b-plus.dts +@@ -29,3 +29,7 @@ + brcm,function = <BCM2835_FSEL_ALT0>; + }; + }; ++ ++&hdmi { ++ hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>; ++}; +diff --git a/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts b/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts +index 86f1f2f..cf2774e 100644 +--- a/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts ++++ b/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts +@@ -22,3 +22,7 @@ + brcm,function = <BCM2835_FSEL_ALT2>; + }; + }; ++ ++&hdmi { ++ hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>; ++}; +diff --git a/arch/arm/boot/dts/bcm2835-rpi-b.dts b/arch/arm/boot/dts/bcm2835-rpi-b.dts +index 4859e9d..8b15f9c 100644 +--- a/arch/arm/boot/dts/bcm2835-rpi-b.dts ++++ b/arch/arm/boot/dts/bcm2835-rpi-b.dts +@@ -16,3 +16,7 @@ + &gpio { + pinctrl-0 = <&gpioout &alt0 &alt3>; + }; ++ ++&hdmi { ++ hpd-gpios = <&gpio 46 GPIO_ACTIVE_HIGH>; ++}; +diff --git a/arch/arm/boot/dts/bcm2835-rpi.dtsi b/arch/arm/boot/dts/bcm2835-rpi.dtsi +index 3afb9fe..40510df 100644 +--- a/arch/arm/boot/dts/bcm2835-rpi.dtsi ++++ b/arch/arm/boot/dts/bcm2835-rpi.dtsi +@@ -1,3 +1,5 @@ ++#include <dt-bindings/power/raspberrypi-power.h> ++ + / { + memory { + reg = <0 0x10000000>; +@@ -18,6 +20,12 @@ + compatible = "raspberrypi,bcm2835-firmware"; + mboxes = <&mailbox>; + }; ++ ++ power: power { ++ compatible = "raspberrypi,bcm2835-power"; ++ firmware = <&firmware>; ++ #power-domain-cells = <1>; ++ }; + }; + }; + +@@ -58,3 +66,20 @@ + status = "okay"; + bus-width = <4>; + }; ++ ++&usb { ++ power-domains = <&power RPI_POWER_DOMAIN_USB>; ++}; ++ ++&pwm { ++ status = "okay"; ++}; ++ ++&v3d { ++ power-domains = <&power RPI_POWER_DOMAIN_V3D>; ++}; ++ ++&hdmi { ++ power-domains = <&power RPI_POWER_DOMAIN_HDMI>; ++ status = "okay"; ++}; +diff --git a/arch/arm/boot/dts/bcm2836-rpi-2-b.dts b/arch/arm/boot/dts/bcm2836-rpi-2-b.dts +index ff94666..c4743f4 100644 +--- a/arch/arm/boot/dts/bcm2836-rpi-2-b.dts ++++ b/arch/arm/boot/dts/bcm2836-rpi-2-b.dts +@@ -33,3 +33,7 @@ + brcm,function = <BCM2835_FSEL_ALT0>; + }; + }; ++ ++&hdmi { ++ hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>; ++}; +diff --git a/arch/arm/boot/dts/bcm2837-rpi-3-b.dts b/arch/arm/boot/dts/bcm2837-rpi-3-b.dts +new file mode 100644 +index 0000000..5e8eafd +--- /dev/null ++++ b/arch/arm/boot/dts/bcm2837-rpi-3-b.dts +@@ -0,0 +1,22 @@ ++/dts-v1/; ++#include "bcm2837.dtsi" ++#include "bcm2835-rpi.dtsi" ++ ++/ { ++ compatible = "raspberrypi,3-model-b", "brcm,bcm2837"; ++ model = "Raspberry Pi 3 Model B"; ++ ++ memory { ++ reg = <0 0x40000000>; ++ }; ++}; ++ ++&gpio { ++ pinctrl-0 = <&gpioout &alt0 &i2s_alt0 &alt3>; ++ ++ /* I2S interface */ ++ i2s_alt0: i2s_alt0 { ++ brcm,pins = <28 29 30 31>; ++ brcm,function = <BCM2835_FSEL_ALT2>; ++ }; ++}; +diff --git a/arch/arm/boot/dts/bcm2837.dtsi b/arch/arm/boot/dts/bcm2837.dtsi +new file mode 100644 +index 0000000..2f36722 +--- /dev/null ++++ b/arch/arm/boot/dts/bcm2837.dtsi +@@ -0,0 +1,68 @@ ++#include "bcm283x.dtsi" ++ ++/ { ++ compatible = "brcm,bcm2836"; ++ ++ soc { ++ ranges = <0x7e000000 0x3f000000 0x1000000>, ++ <0x40000000 0x40000000 0x00001000>; ++ dma-ranges = <0xc0000000 0x00000000 0x3f000000>; ++ ++ local_intc: local_intc { ++ compatible = "brcm,bcm2836-l1-intc"; ++ reg = <0x40000000 0x100>; ++ interrupt-controller; ++ #interrupt-cells = <1>; ++ interrupt-parent = <&local_intc>; ++ }; ++ }; ++ ++ timer { ++ compatible = "arm,armv7-timer"; ++ interrupt-parent = <&local_intc>; ++ interrupts = <0>, // PHYS_SECURE_PPI ++ <1>, // PHYS_NONSECURE_PPI ++ <3>, // VIRT_PPI ++ <2>; // HYP_PPI ++ always-on; ++ }; ++ ++ cpus: cpus { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ cpu0: cpu@0 { ++ device_type = "cpu"; ++ compatible = "arm,cortex-a53"; ++ reg = <0>; ++ }; ++ ++ cpu1: cpu@1 { ++ device_type = "cpu"; ++ compatible = "arm,cortex-a53"; ++ reg = <1>; ++ }; ++ ++ cpu2: cpu@2 { ++ device_type = "cpu"; ++ compatible = "arm,cortex-a53"; ++ reg = <2>; ++ }; ++ ++ cpu3: cpu@3 { ++ device_type = "cpu"; ++ compatible = "arm,cortex-a53"; ++ reg = <3>; ++ }; ++ }; ++}; ++ ++/* Make the BCM2835-style global interrupt controller be a child of the ++ * CPU-local interrupt controller. ++ */ ++&intc { ++ compatible = "brcm,bcm2836-armctrl-ic"; ++ reg = <0x7e00b200 0x200>; ++ interrupt-parent = <&local_intc>; ++ interrupts = <8>; ++}; +diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi +index 971e741..31cc2f2 100644 +--- a/arch/arm/boot/dts/bcm283x.dtsi ++++ b/arch/arm/boot/dts/bcm283x.dtsi +@@ -1,5 +1,7 @@ + #include <dt-bindings/pinctrl/bcm2835.h> + #include <dt-bindings/clock/bcm2835.h> ++#include <dt-bindings/clock/bcm2835-aux.h> ++#include <dt-bindings/gpio/gpio.h> + #include "skeleton.dtsi" + + /* This include file covers the common peripherals and configuration between +@@ -111,7 +113,7 @@ + #interrupt-cells = <2>; + }; + +- uart0: uart@7e201000 { ++ uart0: serial@7e201000 { + compatible = "brcm,bcm2835-pl011", "arm,pl011", "arm,primecell"; + reg = <0x7e201000 0x1000>; + interrupts = <2 25>; +@@ -152,6 +154,18 @@ + status = "disabled"; + }; + ++ pixelvalve@7e206000 { ++ compatible = "brcm,bcm2835-pixelvalve0"; ++ reg = <0x7e206000 0x100>; ++ interrupts = <2 13>; /* pwa0 */ ++ }; ++ ++ pixelvalve@7e207000 { ++ compatible = "brcm,bcm2835-pixelvalve1"; ++ reg = <0x7e207000 0x100>; ++ interrupts = <2 14>; /* pwa1 */ ++ }; ++ + aux: aux@0x7e215000 { + compatible = "brcm,bcm2835-aux"; + #clock-cells = <1>; +@@ -159,6 +173,44 @@ + clocks = <&clocks BCM2835_CLOCK_VPU>; + }; + ++ uart1: serial@7e215040 { ++ compatible = "brcm,bcm2835-aux-uart"; ++ reg = <0x7e215040 0x40>; ++ interrupts = <1 29>; ++ clocks = <&aux BCM2835_AUX_CLOCK_UART>; ++ status = "disabled"; ++ }; ++ ++ spi1: spi@7e215080 { ++ compatible = "brcm,bcm2835-aux-spi"; ++ reg = <0x7e215080 0x40>; ++ interrupts = <1 29>; ++ clocks = <&aux BCM2835_AUX_CLOCK_SPI1>; ++ #address-cells = <1>; ++ #size-cells = <0>; ++ status = "disabled"; ++ }; ++ ++ spi2: spi@7e2150c0 { ++ compatible = "brcm,bcm2835-aux-spi"; ++ reg = <0x7e2150c0 0x40>; ++ interrupts = <1 29>; ++ clocks = <&aux BCM2835_AUX_CLOCK_SPI2>; ++ #address-cells = <1>; ++ #size-cells = <0>; ++ status = "disabled"; ++ }; ++ ++ pwm: pwm@7e20c000 { ++ compatible = "brcm,bcm2835-pwm"; ++ reg = <0x7e20c000 0x28>; ++ clocks = <&clocks BCM2835_CLOCK_PWM>; ++ assigned-clocks = <&clocks BCM2835_CLOCK_PWM>; ++ assigned-clock-rates = <10000000>; ++ #pwm-cells = <2>; ++ status = "disabled"; ++ }; ++ + sdhci: sdhci@7e300000 { + compatible = "brcm,bcm2835-sdhci"; + reg = <0x7e300000 0x100>; +@@ -167,6 +219,12 @@ + status = "disabled"; + }; + ++ hvs@7e400000 { ++ compatible = "brcm,bcm2835-hvs"; ++ reg = <0x7e400000 0x6000>; ++ interrupts = <2 1>; ++ }; ++ + i2c1: i2c@7e804000 { + compatible = "brcm,bcm2835-i2c"; + reg = <0x7e804000 0x1000>; +@@ -187,11 +245,39 @@ + status = "disabled"; + }; + +- usb@7e980000 { ++ pixelvalve@7e807000 { ++ compatible = "brcm,bcm2835-pixelvalve2"; ++ reg = <0x7e807000 0x100>; ++ interrupts = <2 10>; /* pixelvalve */ ++ }; ++ ++ hdmi: hdmi@7e902000 { ++ compatible = "brcm,bcm2835-hdmi"; ++ reg = <0x7e902000 0x600>, ++ <0x7e808000 0x100>; ++ interrupts = <2 8>, <2 9>; ++ ddc = <&i2c2>; ++ clocks = <&clocks BCM2835_PLLH_PIX>, ++ <&clocks BCM2835_CLOCK_HSM>; ++ clock-names = "pixel", "hdmi"; ++ status = "disabled"; ++ }; ++ ++ usb: usb@7e980000 { + compatible = "brcm,bcm2835-usb"; + reg = <0x7e980000 0x10000>; + interrupts = <1 9>; + }; ++ ++ v3d: v3d@7ec00000 { ++ compatible = "brcm,bcm2835-v3d"; ++ reg = <0x7ec00000 0x1000>; ++ interrupts = <1 10>; ++ }; ++ ++ vc4: gpu { ++ compatible = "brcm,bcm2835-vc4"; ++ }; + }; + + clocks { +diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c +index 015e687..9f4df8f 100644 +--- a/drivers/clk/bcm/clk-bcm2835.c ++++ b/drivers/clk/bcm/clk-bcm2835.c +@@ -1107,13 +1107,15 @@ static int bcm2835_pll_divider_set_rate(struct clk_hw *hw, + struct bcm2835_pll_divider *divider = bcm2835_pll_divider_from_hw(hw); + struct bcm2835_cprman *cprman = divider->cprman; + const struct bcm2835_pll_divider_data *data = divider->data; +- u32 cm; +- int ret; ++ u32 cm, div, max_div = 1 << A2W_PLL_DIV_BITS; + +- ret = clk_divider_ops.set_rate(hw, rate, parent_rate); +- if (ret) +- return ret; ++ div = DIV_ROUND_UP_ULL(parent_rate, rate); ++ ++ div = min(div, max_div); ++ if (div == max_div) ++ div = 0; + ++ cprman_write(cprman, data->a2w_reg, div); + cm = cprman_read(cprman, data->cm_reg); + cprman_write(cprman, data->cm_reg, cm | data->load_mask); + cprman_write(cprman, data->cm_reg, cm & ~data->load_mask); +diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c +index 22278bc..ac8eafe 100644 +--- a/drivers/gpu/drm/vc4/vc4_bo.c ++++ b/drivers/gpu/drm/vc4/vc4_bo.c +@@ -499,11 +499,12 @@ vc4_create_shader_bo_ioctl(struct drm_device *dev, void *data, + if (IS_ERR(bo)) + return PTR_ERR(bo); + +- ret = copy_from_user(bo->base.vaddr, ++ if (copy_from_user(bo->base.vaddr, + (void __user *)(uintptr_t)args->data, +- args->size); +- if (ret != 0) ++ args->size)) { ++ ret = -EFAULT; + goto fail; ++ } + /* Clear the rest of the memory from allocating from the BO + * cache. + */ +diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c +index 018145e..9032c06 100644 +--- a/drivers/gpu/drm/vc4/vc4_crtc.c ++++ b/drivers/gpu/drm/vc4/vc4_crtc.c +@@ -49,22 +49,27 @@ struct vc4_crtc { + /* Which HVS channel we're using for our CRTC. */ + int channel; + +- /* Pointer to the actual hardware display list memory for the +- * crtc. +- */ +- u32 __iomem *dlist; +- +- u32 dlist_size; /* in dwords */ +- + struct drm_pending_vblank_event *event; + }; + ++struct vc4_crtc_state { ++ struct drm_crtc_state base; ++ /* Dlist area for this CRTC configuration. */ ++ struct drm_mm_node mm; ++}; ++ + static inline struct vc4_crtc * + to_vc4_crtc(struct drm_crtc *crtc) + { + return (struct vc4_crtc *)crtc; + } + ++static inline struct vc4_crtc_state * ++to_vc4_crtc_state(struct drm_crtc_state *crtc_state) ++{ ++ return (struct vc4_crtc_state *)crtc_state; ++} ++ + struct vc4_crtc_data { + /* Which channel of the HVS this pixelvalve sources from. */ + int hvs_channel; +@@ -83,7 +88,7 @@ static const struct { + } crtc_regs[] = { + CRTC_REG(PV_CONTROL), + CRTC_REG(PV_V_CONTROL), +- CRTC_REG(PV_VSYNCD), ++ CRTC_REG(PV_VSYNCD_EVEN), + CRTC_REG(PV_HORZA), + CRTC_REG(PV_HORZB), + CRTC_REG(PV_VERTA), +@@ -183,6 +188,8 @@ static int vc4_get_clock_select(struct drm_crtc *crtc) + + static void vc4_crtc_mode_set_nofb(struct drm_crtc *crtc) + { ++ struct drm_device *dev = crtc->dev; ++ struct vc4_dev *vc4 = to_vc4_dev(dev); + struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc); + struct drm_crtc_state *state = crtc->state; + struct drm_display_mode *mode = &state->adjusted_mode; +@@ -212,6 +219,16 @@ static void vc4_crtc_mode_set_nofb(struct drm_crtc *crtc) + PV_HORZB_HFP) | + VC4_SET_FIELD(mode->hdisplay, PV_HORZB_HACTIVE)); + ++ CRTC_WRITE(PV_VERTA, ++ VC4_SET_FIELD(mode->vtotal - mode->vsync_end, ++ PV_VERTA_VBP) | ++ VC4_SET_FIELD(mode->vsync_end - mode->vsync_start, ++ PV_VERTA_VSYNC)); ++ CRTC_WRITE(PV_VERTB, ++ VC4_SET_FIELD(mode->vsync_start - mode->vdisplay, ++ PV_VERTB_VFP) | ++ VC4_SET_FIELD(vactive, PV_VERTB_VACTIVE)); ++ + if (interlace) { + CRTC_WRITE(PV_VERTA_EVEN, + VC4_SET_FIELD(mode->vtotal - mode->vsync_end - 1, +@@ -241,6 +258,10 @@ static void vc4_crtc_mode_set_nofb(struct drm_crtc *crtc) + PV_CONTROL_FIFO_CLR | + PV_CONTROL_EN); + ++ HVS_WRITE(SCALER_DISPBKGNDX(vc4_crtc->channel), ++ SCALER_DISPBKGND_AUTOHS | ++ (interlace ? SCALER_DISPBKGND_INTERLACE : 0)); ++ + if (debug_dump_regs) { + DRM_INFO("CRTC %d regs after:\n", drm_crtc_index(crtc)); + vc4_crtc_dump_regs(vc4_crtc); +@@ -319,11 +340,13 @@ static void vc4_crtc_enable(struct drm_crtc *crtc) + static int vc4_crtc_atomic_check(struct drm_crtc *crtc, + struct drm_crtc_state *state) + { ++ struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(state); + struct drm_device *dev = crtc->dev; + struct vc4_dev *vc4 = to_vc4_dev(dev); + struct drm_plane *plane; +- struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc); ++ unsigned long flags; + u32 dlist_count = 0; ++ int ret; + + /* The pixelvalve can only feed one encoder (and encoders are + * 1:1 with connectors.) +@@ -346,18 +369,12 @@ static int vc4_crtc_atomic_check(struct drm_crtc *crtc, + + dlist_count++; /* Account for SCALER_CTL0_END. */ + +- if (!vc4_crtc->dlist || dlist_count > vc4_crtc->dlist_size) { +- vc4_crtc->dlist = ((u32 __iomem *)vc4->hvs->dlist + +- HVS_BOOTLOADER_DLIST_END); +- vc4_crtc->dlist_size = ((SCALER_DLIST_SIZE >> 2) - +- HVS_BOOTLOADER_DLIST_END); +- +- if (dlist_count > vc4_crtc->dlist_size) { +- DRM_DEBUG_KMS("dlist too large for CRTC (%d > %d).\n", +- dlist_count, vc4_crtc->dlist_size); +- return -EINVAL; +- } +- } ++ spin_lock_irqsave(&vc4->hvs->mm_lock, flags); ++ ret = drm_mm_insert_node(&vc4->hvs->dlist_mm, &vc4_state->mm, ++ dlist_count, 1, 0); ++ spin_unlock_irqrestore(&vc4->hvs->mm_lock, flags); ++ if (ret) ++ return ret; + + return 0; + } +@@ -368,47 +385,29 @@ static void vc4_crtc_atomic_flush(struct drm_crtc *crtc, + struct drm_device *dev = crtc->dev; + struct vc4_dev *vc4 = to_vc4_dev(dev); + struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc); ++ struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(crtc->state); + struct drm_plane *plane; + bool debug_dump_regs = false; +- u32 __iomem *dlist_next = vc4_crtc->dlist; ++ u32 __iomem *dlist_start = vc4->hvs->dlist + vc4_state->mm.start; ++ u32 __iomem *dlist_next = dlist_start; + + if (debug_dump_regs) { + DRM_INFO("CRTC %d HVS before:\n", drm_crtc_index(crtc)); + vc4_hvs_dump_state(dev); + } + +- /* Copy all the active planes' dlist contents to the hardware dlist. +- * +- * XXX: If the new display list was large enough that it +- * overlapped a currently-read display list, we need to do +- * something like disable scanout before putting in the new +- * list. For now, we're safe because we only have the two +- * planes. +- */ ++ /* Copy all the active planes' dlist contents to the hardware dlist. */ + drm_atomic_crtc_for_each_plane(plane, crtc) { + dlist_next += vc4_plane_write_dlist(plane, dlist_next); + } + +- if (dlist_next == vc4_crtc->dlist) { +- /* If no planes were enabled, use the SCALER_CTL0_END +- * at the start of the display list memory (in the +- * bootloader section). We'll rewrite that +- * SCALER_CTL0_END, just in case, though. +- */ +- writel(SCALER_CTL0_END, vc4->hvs->dlist); +- HVS_WRITE(SCALER_DISPLISTX(vc4_crtc->channel), 0); +- } else { +- writel(SCALER_CTL0_END, dlist_next); +- dlist_next++; +- +- HVS_WRITE(SCALER_DISPLISTX(vc4_crtc->channel), +- (u32 __iomem *)vc4_crtc->dlist - +- (u32 __iomem *)vc4->hvs->dlist); +- +- /* Make the next display list start after ours. */ +- vc4_crtc->dlist_size -= (dlist_next - vc4_crtc->dlist); +- vc4_crtc->dlist = dlist_next; +- } ++ writel(SCALER_CTL0_END, dlist_next); ++ dlist_next++; ++ ++ WARN_ON_ONCE(dlist_next - dlist_start != vc4_state->mm.size); ++ ++ HVS_WRITE(SCALER_DISPLISTX(vc4_crtc->channel), ++ vc4_state->mm.start); + + if (debug_dump_regs) { + DRM_INFO("CRTC %d HVS after:\n", drm_crtc_index(crtc)); +@@ -544,6 +543,7 @@ static int vc4_async_page_flip(struct drm_crtc *crtc, + /* Make sure all other async modesetes have landed. */ + ret = down_interruptible(&vc4->async_modeset); + if (ret) { ++ drm_framebuffer_unreference(fb); + kfree(flip_state); + return ret; + } +@@ -573,6 +573,36 @@ static int vc4_page_flip(struct drm_crtc *crtc, + return drm_atomic_helper_page_flip(crtc, fb, event, flags); + } + ++static struct drm_crtc_state *vc4_crtc_duplicate_state(struct drm_crtc *crtc) ++{ ++ struct vc4_crtc_state *vc4_state; ++ ++ vc4_state = kzalloc(sizeof(*vc4_state), GFP_KERNEL); ++ if (!vc4_state) ++ return NULL; ++ ++ __drm_atomic_helper_crtc_duplicate_state(crtc, &vc4_state->base); ++ return &vc4_state->base; ++} ++ ++static void vc4_crtc_destroy_state(struct drm_crtc *crtc, ++ struct drm_crtc_state *state) ++{ ++ struct vc4_dev *vc4 = to_vc4_dev(crtc->dev); ++ struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(state); ++ ++ if (vc4_state->mm.allocated) { ++ unsigned long flags; ++ ++ spin_lock_irqsave(&vc4->hvs->mm_lock, flags); ++ drm_mm_remove_node(&vc4_state->mm); ++ spin_unlock_irqrestore(&vc4->hvs->mm_lock, flags); ++ ++ } ++ ++ __drm_atomic_helper_crtc_destroy_state(crtc, state); ++} ++ + static const struct drm_crtc_funcs vc4_crtc_funcs = { + .set_config = drm_atomic_helper_set_config, + .destroy = vc4_crtc_destroy, +@@ -581,8 +611,8 @@ static const struct drm_crtc_funcs vc4_crtc_funcs = { + .cursor_set = NULL, /* handled by drm_mode_cursor_universal */ + .cursor_move = NULL, /* handled by drm_mode_cursor_universal */ + .reset = drm_atomic_helper_crtc_reset, +- .atomic_duplicate_state = drm_atomic_helper_crtc_duplicate_state, +- .atomic_destroy_state = drm_atomic_helper_crtc_destroy_state, ++ .atomic_duplicate_state = vc4_crtc_duplicate_state, ++ .atomic_destroy_state = vc4_crtc_destroy_state, + }; + + static const struct drm_crtc_helper_funcs vc4_crtc_helper_funcs = { +diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h +index 51a6333..83db0b7 100644 +--- a/drivers/gpu/drm/vc4/vc4_drv.h ++++ b/drivers/gpu/drm/vc4/vc4_drv.h +@@ -154,7 +154,17 @@ struct vc4_v3d { + struct vc4_hvs { + struct platform_device *pdev; + void __iomem *regs; +- void __iomem *dlist; ++ u32 __iomem *dlist; ++ ++ /* Memory manager for CRTCs to allocate space in the display ++ * list. Units are dwords. ++ */ ++ struct drm_mm dlist_mm; ++ /* Memory manager for the LBM memory used by HVS scaling. */ ++ struct drm_mm lbm_mm; ++ spinlock_t mm_lock; ++ ++ struct drm_mm_node mitchell_netravali_filter; + }; + + struct vc4_plane { +diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c +index c69c046..d8b8649 100644 +--- a/drivers/gpu/drm/vc4/vc4_hdmi.c ++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c +@@ -47,6 +47,7 @@ struct vc4_hdmi { + void __iomem *hdmicore_regs; + void __iomem *hd_regs; + int hpd_gpio; ++ bool hpd_active_low; + + struct clk *pixel_clock; + struct clk *hsm_clock; +@@ -95,6 +96,7 @@ static const struct { + HDMI_REG(VC4_HDMI_SW_RESET_CONTROL), + HDMI_REG(VC4_HDMI_HOTPLUG_INT), + HDMI_REG(VC4_HDMI_HOTPLUG), ++ HDMI_REG(VC4_HDMI_RAM_PACKET_CONFIG), + HDMI_REG(VC4_HDMI_HORZA), + HDMI_REG(VC4_HDMI_HORZB), + HDMI_REG(VC4_HDMI_FIFO_CTL), +@@ -165,7 +167,8 @@ vc4_hdmi_connector_detect(struct drm_connector *connector, bool force) + struct vc4_dev *vc4 = to_vc4_dev(dev); + + if (vc4->hdmi->hpd_gpio) { +- if (gpio_get_value(vc4->hdmi->hpd_gpio)) ++ if (gpio_get_value_cansleep(vc4->hdmi->hpd_gpio) ^ ++ vc4->hdmi->hpd_active_low) + return connector_status_connected; + else + return connector_status_disconnected; +@@ -495,6 +498,16 @@ static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data) + goto err_put_i2c; + } + ++ /* This is the rate that is set by the firmware. The number ++ * needs to be a bit higher than the pixel clock rate ++ * (generally 148.5Mhz). ++ */ ++ ret = clk_set_rate(hdmi->hsm_clock, 163682864); ++ if (ret) { ++ DRM_ERROR("Failed to set HSM clock rate: %d\n", ret); ++ goto err_unprepare_pix; ++ } ++ + ret = clk_prepare_enable(hdmi->hsm_clock); + if (ret) { + DRM_ERROR("Failed to turn on HDMI state machine clock: %d\n", +@@ -506,17 +519,40 @@ static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data) + * we'll use the HDMI core's register. + */ + if (of_find_property(dev->of_node, "hpd-gpios", &value)) { +- hdmi->hpd_gpio = of_get_named_gpio(dev->of_node, "hpd-gpios", 0); ++ enum of_gpio_flags hpd_gpio_flags; ++ ++ hdmi->hpd_gpio = of_get_named_gpio_flags(dev->of_node, ++ "hpd-gpios", 0, ++ &hpd_gpio_flags); + if (hdmi->hpd_gpio < 0) { + ret = hdmi->hpd_gpio; + goto err_unprepare_hsm; + } ++ ++ hdmi->hpd_active_low = hpd_gpio_flags & OF_GPIO_ACTIVE_LOW; + } + + vc4->hdmi = hdmi; + + /* HDMI core must be enabled. */ +- WARN_ON_ONCE((HD_READ(VC4_HD_M_CTL) & VC4_HD_M_ENABLE) == 0); ++ if (!(HD_READ(VC4_HD_M_CTL) & VC4_HD_M_ENABLE)) { ++ HD_WRITE(VC4_HD_M_CTL, VC4_HD_M_SW_RST); ++ udelay(1); ++ HD_WRITE(VC4_HD_M_CTL, 0); ++ ++ HD_WRITE(VC4_HD_M_CTL, VC4_HD_M_ENABLE); ++ ++ HDMI_WRITE(VC4_HDMI_SW_RESET_CONTROL, ++ VC4_HDMI_SW_RESET_HDMI | ++ VC4_HDMI_SW_RESET_FORMAT_DETECT); ++ ++ HDMI_WRITE(VC4_HDMI_SW_RESET_CONTROL, 0); ++ ++ /* PHY should be in reset, like ++ * vc4_hdmi_encoder_disable() does. ++ */ ++ HDMI_WRITE(VC4_HDMI_TX_PHY_RESET_CTL, 0xf << 16); ++ } + + drm_encoder_init(drm, hdmi->encoder, &vc4_hdmi_encoder_funcs, + DRM_MODE_ENCODER_TMDS, NULL); +diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c +index 8098c5b..6fbab1c 100644 +--- a/drivers/gpu/drm/vc4/vc4_hvs.c ++++ b/drivers/gpu/drm/vc4/vc4_hvs.c +@@ -100,12 +100,76 @@ int vc4_hvs_debugfs_regs(struct seq_file *m, void *unused) + } + #endif + ++/* The filter kernel is composed of dwords each containing 3 9-bit ++ * signed integers packed next to each other. ++ */ ++#define VC4_INT_TO_COEFF(coeff) (coeff & 0x1ff) ++#define VC4_PPF_FILTER_WORD(c0, c1, c2) \ ++ ((((c0) & 0x1ff) << 0) | \ ++ (((c1) & 0x1ff) << 9) | \ ++ (((c2) & 0x1ff) << 18)) ++ ++/* The whole filter kernel is arranged as the coefficients 0-16 going ++ * up, then a pad, then 17-31 going down and reversed within the ++ * dwords. This means that a linear phase kernel (where it's ++ * symmetrical at the boundary between 15 and 16) has the last 5 ++ * dwords matching the first 5, but reversed. ++ */ ++#define VC4_LINEAR_PHASE_KERNEL(c0, c1, c2, c3, c4, c5, c6, c7, c8, \ ++ c9, c10, c11, c12, c13, c14, c15) \ ++ {VC4_PPF_FILTER_WORD(c0, c1, c2), \ ++ VC4_PPF_FILTER_WORD(c3, c4, c5), \ ++ VC4_PPF_FILTER_WORD(c6, c7, c8), \ ++ VC4_PPF_FILTER_WORD(c9, c10, c11), \ ++ VC4_PPF_FILTER_WORD(c12, c13, c14), \ ++ VC4_PPF_FILTER_WORD(c15, c15, 0)} ++ ++#define VC4_LINEAR_PHASE_KERNEL_DWORDS 6 ++#define VC4_KERNEL_DWORDS (VC4_LINEAR_PHASE_KERNEL_DWORDS * 2 - 1) ++ ++/* Recommended B=1/3, C=1/3 filter choice from Mitchell/Netravali. ++ * http://www.cs.utexas.edu/~fussell/courses/cs384g/lectures/mitchell/Mitchell.pdf ++ */ ++static const u32 mitchell_netravali_1_3_1_3_kernel[] = ++ VC4_LINEAR_PHASE_KERNEL(0, -2, -6, -8, -10, -8, -3, 2, 18, ++ 50, 82, 119, 155, 187, 213, 227); ++ ++static int vc4_hvs_upload_linear_kernel(struct vc4_hvs *hvs, ++ struct drm_mm_node *space, ++ const u32 *kernel) ++{ ++ int ret, i; ++ u32 __iomem *dst_kernel; ++ ++ ret = drm_mm_insert_node(&hvs->dlist_mm, space, VC4_KERNEL_DWORDS, 1, ++ 0); ++ if (ret) { ++ DRM_ERROR("Failed to allocate space for filter kernel: %d\n", ++ ret); ++ return ret; ++ } ++ ++ dst_kernel = hvs->dlist + space->start; ++ ++ for (i = 0; i < VC4_KERNEL_DWORDS; i++) { ++ if (i < VC4_LINEAR_PHASE_KERNEL_DWORDS) ++ writel(kernel[i], &dst_kernel[i]); ++ else { ++ writel(kernel[VC4_KERNEL_DWORDS - i - 1], ++ &dst_kernel[i]); ++ } ++ } ++ ++ return 0; ++} ++ + static int vc4_hvs_bind(struct device *dev, struct device *master, void *data) + { + struct platform_device *pdev = to_platform_device(dev); + struct drm_device *drm = dev_get_drvdata(master); + struct vc4_dev *vc4 = drm->dev_private; + struct vc4_hvs *hvs = NULL; ++ int ret; + + hvs = devm_kzalloc(&pdev->dev, sizeof(*hvs), GFP_KERNEL); + if (!hvs) +@@ -119,6 +183,33 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data) + + hvs->dlist = hvs->regs + SCALER_DLIST_START; + ++ spin_lock_init(&hvs->mm_lock); ++ ++ /* Set up the HVS display list memory manager. We never ++ * overwrite the setup from the bootloader (just 128b out of ++ * our 16K), since we don't want to scramble the screen when ++ * transitioning from the firmware's boot setup to runtime. ++ */ ++ drm_mm_init(&hvs->dlist_mm, ++ HVS_BOOTLOADER_DLIST_END, ++ (SCALER_DLIST_SIZE >> 2) - HVS_BOOTLOADER_DLIST_END); ++ ++ /* Set up the HVS LBM memory manager. We could have some more ++ * complicated data structure that allowed reuse of LBM areas ++ * between planes when they don't overlap on the screen, but ++ * for now we just allocate globally. ++ */ ++ drm_mm_init(&hvs->lbm_mm, 0, 96 * 1024); ++ ++ /* Upload filter kernels. We only have the one for now, so we ++ * keep it around for the lifetime of the driver. ++ */ ++ ret = vc4_hvs_upload_linear_kernel(hvs, ++ &hvs->mitchell_netravali_filter, ++ mitchell_netravali_1_3_1_3_kernel); ++ if (ret) ++ return ret; ++ + vc4->hvs = hvs; + return 0; + } +@@ -129,6 +220,12 @@ static void vc4_hvs_unbind(struct device *dev, struct device *master, + struct drm_device *drm = dev_get_drvdata(master); + struct vc4_dev *vc4 = drm->dev_private; + ++ if (vc4->hvs->mitchell_netravali_filter.allocated) ++ drm_mm_remove_node(&vc4->hvs->mitchell_netravali_filter); ++ ++ drm_mm_takedown(&vc4->hvs->dlist_mm); ++ drm_mm_takedown(&vc4->hvs->lbm_mm); ++ + vc4->hvs = NULL; + } + +diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c +index f95f2df..4718ae5 100644 +--- a/drivers/gpu/drm/vc4/vc4_kms.c ++++ b/drivers/gpu/drm/vc4/vc4_kms.c +@@ -49,6 +49,15 @@ vc4_atomic_complete_commit(struct vc4_commit *c) + + drm_atomic_helper_commit_modeset_enables(dev, state); + ++ /* Make sure that drm_atomic_helper_wait_for_vblanks() ++ * actually waits for vblank. If we're doing a full atomic ++ * modeset (as opposed to a vc4_update_plane() short circuit), ++ * then we need to wait for scanout to be done with our ++ * display lists before we free it and potentially reallocate ++ * and overwrite the dlist memory with a new modeset. ++ */ ++ state->legacy_cursor_update = false; ++ + drm_atomic_helper_wait_for_vblanks(dev, state); + + drm_atomic_helper_cleanup_planes(dev, state); +diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c +index 0addbad..7b0c72a 100644 +--- a/drivers/gpu/drm/vc4/vc4_plane.c ++++ b/drivers/gpu/drm/vc4/vc4_plane.c +@@ -24,19 +24,52 @@ + #include "drm_fb_cma_helper.h" + #include "drm_plane_helper.h" + ++enum vc4_scaling_mode { ++ VC4_SCALING_NONE, ++ VC4_SCALING_TPZ, ++ VC4_SCALING_PPF, ++}; ++ + struct vc4_plane_state { + struct drm_plane_state base; ++ /* System memory copy of the display list for this element, computed ++ * at atomic_check time. ++ */ + u32 *dlist; +- u32 dlist_size; /* Number of dwords in allocated for the display list */ ++ u32 dlist_size; /* Number of dwords allocated for the display list */ + u32 dlist_count; /* Number of used dwords in the display list. */ + +- /* Offset in the dlist to pointer word 0. */ +- u32 pw0_offset; ++ /* Offset in the dlist to various words, for pageflip or ++ * cursor updates. ++ */ ++ u32 pos0_offset; ++ u32 pos2_offset; ++ u32 ptr0_offset; + + /* Offset where the plane's dlist was last stored in the +- hardware at vc4_crtc_atomic_flush() time. +- */ +- u32 *hw_dlist; ++ * hardware at vc4_crtc_atomic_flush() time. ++ */ ++ u32 __iomem *hw_dlist; ++ ++ /* Clipped coordinates of the plane on the display. */ ++ int crtc_x, crtc_y, crtc_w, crtc_h; ++ /* Clipped area being scanned from in the FB. */ ++ u32 src_x, src_y; ++ ++ u32 src_w[2], src_h[2]; ++ ++ /* Scaling selection for the RGB/Y plane and the Cb/Cr planes. */ ++ enum vc4_scaling_mode x_scaling[2], y_scaling[2]; ++ bool is_unity; ++ bool is_yuv; ++ ++ /* Offset to start scanning out from the start of the plane's ++ * BO. ++ */ ++ u32 offsets[3]; ++ ++ /* Our allocation in LBM for temporary storage during scaling. */ ++ struct drm_mm_node lbm; + }; + + static inline struct vc4_plane_state * +@@ -50,6 +83,7 @@ static const struct hvs_format { + u32 hvs; /* HVS_FORMAT_* */ + u32 pixel_order; + bool has_alpha; ++ bool flip_cbcr; + } hvs_formats[] = { + { + .drm = DRM_FORMAT_XRGB8888, .hvs = HVS_PIXEL_FORMAT_RGBA8888, +@@ -59,6 +93,48 @@ static const struct hvs_format { + .drm = DRM_FORMAT_ARGB8888, .hvs = HVS_PIXEL_FORMAT_RGBA8888, + .pixel_order = HVS_PIXEL_ORDER_ABGR, .has_alpha = true, + }, ++ { ++ .drm = DRM_FORMAT_RGB565, .hvs = HVS_PIXEL_FORMAT_RGB565, ++ .pixel_order = HVS_PIXEL_ORDER_XRGB, .has_alpha = false, ++ }, ++ { ++ .drm = DRM_FORMAT_BGR565, .hvs = HVS_PIXEL_FORMAT_RGB565, ++ .pixel_order = HVS_PIXEL_ORDER_XBGR, .has_alpha = false, ++ }, ++ { ++ .drm = DRM_FORMAT_ARGB1555, .hvs = HVS_PIXEL_FORMAT_RGBA5551, ++ .pixel_order = HVS_PIXEL_ORDER_ABGR, .has_alpha = true, ++ }, ++ { ++ .drm = DRM_FORMAT_XRGB1555, .hvs = HVS_PIXEL_FORMAT_RGBA5551, ++ .pixel_order = HVS_PIXEL_ORDER_ABGR, .has_alpha = false, ++ }, ++ { ++ .drm = DRM_FORMAT_YUV422, ++ .hvs = HVS_PIXEL_FORMAT_YCBCR_YUV422_3PLANE, ++ }, ++ { ++ .drm = DRM_FORMAT_YVU422, ++ .hvs = HVS_PIXEL_FORMAT_YCBCR_YUV422_3PLANE, ++ .flip_cbcr = true, ++ }, ++ { ++ .drm = DRM_FORMAT_YUV420, ++ .hvs = HVS_PIXEL_FORMAT_YCBCR_YUV420_3PLANE, ++ }, ++ { ++ .drm = DRM_FORMAT_YVU420, ++ .hvs = HVS_PIXEL_FORMAT_YCBCR_YUV420_3PLANE, ++ .flip_cbcr = true, ++ }, ++ { ++ .drm = DRM_FORMAT_NV12, ++ .hvs = HVS_PIXEL_FORMAT_YCBCR_YUV420_2PLANE, ++ }, ++ { ++ .drm = DRM_FORMAT_NV16, ++ .hvs = HVS_PIXEL_FORMAT_YCBCR_YUV422_2PLANE, ++ }, + }; + + static const struct hvs_format *vc4_get_hvs_format(u32 drm_format) +@@ -73,6 +149,16 @@ static const struct hvs_format *vc4_get_hvs_format(u32 drm_format) + return NULL; + } + ++static enum vc4_scaling_mode vc4_get_scaling_mode(u32 src, u32 dst) ++{ ++ if (dst > src) ++ return VC4_SCALING_PPF; ++ else if (dst < src) ++ return VC4_SCALING_TPZ; ++ else ++ return VC4_SCALING_NONE; ++} ++ + static bool plane_enabled(struct drm_plane_state *state) + { + return state->fb && state->crtc; +@@ -89,6 +175,8 @@ static struct drm_plane_state *vc4_plane_duplicate_state(struct drm_plane *plane + if (!vc4_state) + return NULL; + ++ memset(&vc4_state->lbm, 0, sizeof(vc4_state->lbm)); ++ + __drm_atomic_helper_plane_duplicate_state(plane, &vc4_state->base); + + if (vc4_state->dlist) { +@@ -108,8 +196,17 @@ static struct drm_plane_state *vc4_plane_duplicate_state(struct drm_plane *plane + static void vc4_plane_destroy_state(struct drm_plane *plane, + struct drm_plane_state *state) + { ++ struct vc4_dev *vc4 = to_vc4_dev(plane->dev); + struct vc4_plane_state *vc4_state = to_vc4_plane_state(state); + ++ if (vc4_state->lbm.allocated) { ++ unsigned long irqflags; ++ ++ spin_lock_irqsave(&vc4->hvs->mm_lock, irqflags); ++ drm_mm_remove_node(&vc4_state->lbm); ++ spin_unlock_irqrestore(&vc4->hvs->mm_lock, irqflags); ++ } ++ + kfree(vc4_state->dlist); + __drm_atomic_helper_plane_destroy_state(plane, &vc4_state->base); + kfree(state); +@@ -148,84 +245,400 @@ static void vc4_dlist_write(struct vc4_plane_state *vc4_state, u32 val) + vc4_state->dlist[vc4_state->dlist_count++] = val; + } + ++/* Returns the scl0/scl1 field based on whether the dimensions need to ++ * be up/down/non-scaled. ++ * ++ * This is a replication of a table from the spec. ++ */ ++static u32 vc4_get_scl_field(struct drm_plane_state *state, int plane) ++{ ++ struct vc4_plane_state *vc4_state = to_vc4_plane_state(state); ++ ++ switch (vc4_state->x_scaling[plane] << 2 | vc4_state->y_scaling[plane]) { ++ case VC4_SCALING_PPF << 2 | VC4_SCALING_PPF: ++ return SCALER_CTL0_SCL_H_PPF_V_PPF; ++ case VC4_SCALING_TPZ << 2 | VC4_SCALING_PPF: ++ return SCALER_CTL0_SCL_H_TPZ_V_PPF; ++ case VC4_SCALING_PPF << 2 | VC4_SCALING_TPZ: ++ return SCALER_CTL0_SCL_H_PPF_V_TPZ; ++ case VC4_SCALING_TPZ << 2 | VC4_SCALING_TPZ: ++ return SCALER_CTL0_SCL_H_TPZ_V_TPZ; ++ case VC4_SCALING_PPF << 2 | VC4_SCALING_NONE: ++ return SCALER_CTL0_SCL_H_PPF_V_NONE; ++ case VC4_SCALING_NONE << 2 | VC4_SCALING_PPF: ++ return SCALER_CTL0_SCL_H_NONE_V_PPF; ++ case VC4_SCALING_NONE << 2 | VC4_SCALING_TPZ: ++ return SCALER_CTL0_SCL_H_NONE_V_TPZ; ++ case VC4_SCALING_TPZ << 2 | VC4_SCALING_NONE: ++ return SCALER_CTL0_SCL_H_TPZ_V_NONE; ++ default: ++ case VC4_SCALING_NONE << 2 | VC4_SCALING_NONE: ++ /* The unity case is independently handled by ++ * SCALER_CTL0_UNITY. ++ */ ++ return 0; ++ } ++} ++ ++static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state) ++{ ++ struct drm_plane *plane = state->plane; ++ struct vc4_plane_state *vc4_state = to_vc4_plane_state(state); ++ struct drm_framebuffer *fb = state->fb; ++ struct drm_gem_cma_object *bo = drm_fb_cma_get_gem_obj(fb, 0); ++ u32 subpixel_src_mask = (1 << 16) - 1; ++ u32 format = fb->pixel_format; ++ int num_planes = drm_format_num_planes(format); ++ u32 h_subsample = 1; ++ u32 v_subsample = 1; ++ int i; ++ ++ for (i = 0; i < num_planes; i++) ++ vc4_state->offsets[i] = bo->paddr + fb->offsets[i]; ++ ++ /* We don't support subpixel source positioning for scaling. */ ++ if ((state->src_x & subpixel_src_mask) || ++ (state->src_y & subpixel_src_mask) || ++ (state->src_w & subpixel_src_mask) || ++ (state->src_h & subpixel_src_mask)) { ++ return -EINVAL; ++ } ++ ++ vc4_state->src_x = state->src_x >> 16; ++ vc4_state->src_y = state->src_y >> 16; ++ vc4_state->src_w[0] = state->src_w >> 16; ++ vc4_state->src_h[0] = state->src_h >> 16; ++ ++ vc4_state->crtc_x = state->crtc_x; ++ vc4_state->crtc_y = state->crtc_y; ++ vc4_state->crtc_w = state->crtc_w; ++ vc4_state->crtc_h = state->crtc_h; ++ ++ vc4_state->x_scaling[0] = vc4_get_scaling_mode(vc4_state->src_w[0], ++ vc4_state->crtc_w); ++ vc4_state->y_scaling[0] = vc4_get_scaling_mode(vc4_state->src_h[0], ++ vc4_state->crtc_h); ++ ++ if (num_planes > 1) { ++ vc4_state->is_yuv = true; ++ ++ h_subsample = drm_format_horz_chroma_subsampling(format); ++ v_subsample = drm_format_vert_chroma_subsampling(format); ++ vc4_state->src_w[1] = vc4_state->src_w[0] / h_subsample; ++ vc4_state->src_h[1] = vc4_state->src_h[0] / v_subsample; ++ ++ vc4_state->x_scaling[1] = ++ vc4_get_scaling_mode(vc4_state->src_w[1], ++ vc4_state->crtc_w); ++ vc4_state->y_scaling[1] = ++ vc4_get_scaling_mode(vc4_state->src_h[1], ++ vc4_state->crtc_h); ++ ++ /* YUV conversion requires that scaling be enabled, ++ * even on a plane that's otherwise 1:1. Choose TPZ ++ * for simplicity. ++ */ ++ if (vc4_state->x_scaling[0] == VC4_SCALING_NONE) ++ vc4_state->x_scaling[0] = VC4_SCALING_TPZ; ++ if (vc4_state->y_scaling[0] == VC4_SCALING_NONE) ++ vc4_state->y_scaling[0] = VC4_SCALING_TPZ; ++ } ++ ++ vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE && ++ vc4_state->y_scaling[0] == VC4_SCALING_NONE && ++ vc4_state->x_scaling[1] == VC4_SCALING_NONE && ++ vc4_state->y_scaling[1] == VC4_SCALING_NONE); ++ ++ /* No configuring scaling on the cursor plane, since it gets ++ non-vblank-synced updates, and scaling requires requires ++ LBM changes which have to be vblank-synced. ++ */ ++ if (plane->type == DRM_PLANE_TYPE_CURSOR && !vc4_state->is_unity) ++ return -EINVAL; ++ ++ /* Clamp the on-screen start x/y to 0. The hardware doesn't ++ * support negative y, and negative x wastes bandwidth. ++ */ ++ if (vc4_state->crtc_x < 0) { ++ for (i = 0; i < num_planes; i++) { ++ u32 cpp = drm_format_plane_cpp(fb->pixel_format, i); ++ u32 subs = ((i == 0) ? 1 : h_subsample); ++ ++ vc4_state->offsets[i] += (cpp * ++ (-vc4_state->crtc_x) / subs); ++ } ++ vc4_state->src_w[0] += vc4_state->crtc_x; ++ vc4_state->src_w[1] += vc4_state->crtc_x / h_subsample; ++ vc4_state->crtc_x = 0; ++ } ++ ++ if (vc4_state->crtc_y < 0) { ++ for (i = 0; i < num_planes; i++) { ++ u32 subs = ((i == 0) ? 1 : v_subsample); ++ ++ vc4_state->offsets[i] += (fb->pitches[i] * ++ (-vc4_state->crtc_y) / subs); ++ } ++ vc4_state->src_h[0] += vc4_state->crtc_y; ++ vc4_state->src_h[1] += vc4_state->crtc_y / v_subsample; ++ vc4_state->crtc_y = 0; ++ } ++ ++ return 0; ++} ++ ++static void vc4_write_tpz(struct vc4_plane_state *vc4_state, u32 src, u32 dst) ++{ ++ u32 scale, recip; ++ ++ scale = (1 << 16) * src / dst; ++ ++ /* The specs note that while the reciprocal would be defined ++ * as (1<<32)/scale, ~0 is close enough. ++ */ ++ recip = ~0 / scale; ++ ++ vc4_dlist_write(vc4_state, ++ VC4_SET_FIELD(scale, SCALER_TPZ0_SCALE) | ++ VC4_SET_FIELD(0, SCALER_TPZ0_IPHASE)); ++ vc4_dlist_write(vc4_state, ++ VC4_SET_FIELD(recip, SCALER_TPZ1_RECIP)); ++} ++ ++static void vc4_write_ppf(struct vc4_plane_state *vc4_state, u32 src, u32 dst) ++{ ++ u32 scale = (1 << 16) * src / dst; ++ ++ vc4_dlist_write(vc4_state, ++ SCALER_PPF_AGC | ++ VC4_SET_FIELD(scale, SCALER_PPF_SCALE) | ++ VC4_SET_FIELD(0, SCALER_PPF_IPHASE)); ++} ++ ++static u32 vc4_lbm_size(struct drm_plane_state *state) ++{ ++ struct vc4_plane_state *vc4_state = to_vc4_plane_state(state); ++ /* This is the worst case number. One of the two sizes will ++ * be used depending on the scaling configuration. ++ */ ++ u32 pix_per_line = max(vc4_state->src_w[0], (u32)vc4_state->crtc_w); ++ u32 lbm; ++ ++ if (!vc4_state->is_yuv) { ++ if (vc4_state->is_unity) ++ return 0; ++ else if (vc4_state->y_scaling[0] == VC4_SCALING_TPZ) ++ lbm = pix_per_line * 8; ++ else { ++ /* In special cases, this multiplier might be 12. */ ++ lbm = pix_per_line * 16; ++ } ++ } else { ++ /* There are cases for this going down to a multiplier ++ * of 2, but according to the firmware source, the ++ * table in the docs is somewhat wrong. ++ */ ++ lbm = pix_per_line * 16; ++ } ++ ++ lbm = roundup(lbm, 32); ++ ++ return lbm; ++} ++ ++static void vc4_write_scaling_parameters(struct drm_plane_state *state, ++ int channel) ++{ ++ struct vc4_plane_state *vc4_state = to_vc4_plane_state(state); ++ ++ /* Ch0 H-PPF Word 0: Scaling Parameters */ ++ if (vc4_state->x_scaling[channel] == VC4_SCALING_PPF) { ++ vc4_write_ppf(vc4_state, ++ vc4_state->src_w[channel], vc4_state->crtc_w); ++ } ++ ++ /* Ch0 V-PPF Words 0-1: Scaling Parameters, Context */ ++ if (vc4_state->y_scaling[channel] == VC4_SCALING_PPF) { ++ vc4_write_ppf(vc4_state, ++ vc4_state->src_h[channel], vc4_state->crtc_h); ++ vc4_dlist_write(vc4_state, 0xc0c0c0c0); ++ } ++ ++ /* Ch0 H-TPZ Words 0-1: Scaling Parameters, Recip */ ++ if (vc4_state->x_scaling[channel] == VC4_SCALING_TPZ) { ++ vc4_write_tpz(vc4_state, ++ vc4_state->src_w[channel], vc4_state->crtc_w); ++ } ++ ++ /* Ch0 V-TPZ Words 0-2: Scaling Parameters, Recip, Context */ ++ if (vc4_state->y_scaling[channel] == VC4_SCALING_TPZ) { ++ vc4_write_tpz(vc4_state, ++ vc4_state->src_h[channel], vc4_state->crtc_h); ++ vc4_dlist_write(vc4_state, 0xc0c0c0c0); ++ } ++} ++ + /* Writes out a full display list for an active plane to the plane's + * private dlist state. + */ + static int vc4_plane_mode_set(struct drm_plane *plane, + struct drm_plane_state *state) + { ++ struct vc4_dev *vc4 = to_vc4_dev(plane->dev); + struct vc4_plane_state *vc4_state = to_vc4_plane_state(state); + struct drm_framebuffer *fb = state->fb; +- struct drm_gem_cma_object *bo = drm_fb_cma_get_gem_obj(fb, 0); + u32 ctl0_offset = vc4_state->dlist_count; + const struct hvs_format *format = vc4_get_hvs_format(fb->pixel_format); +- uint32_t offset = fb->offsets[0]; +- int crtc_x = state->crtc_x; +- int crtc_y = state->crtc_y; +- int crtc_w = state->crtc_w; +- int crtc_h = state->crtc_h; +- +- if (state->crtc_w << 16 != state->src_w || +- state->crtc_h << 16 != state->src_h) { +- /* We don't support scaling yet, which involves +- * allocating the LBM memory for scaling temporary +- * storage, and putting filter kernels in the HVS +- * context. +- */ +- return -EINVAL; ++ int num_planes = drm_format_num_planes(format->drm); ++ u32 scl0, scl1; ++ u32 lbm_size; ++ unsigned long irqflags; ++ int ret, i; ++ ++ ret = vc4_plane_setup_clipping_and_scaling(state); ++ if (ret) ++ return ret; ++ ++ /* Allocate the LBM memory that the HVS will use for temporary ++ * storage due to our scaling/format conversion. ++ */ ++ lbm_size = vc4_lbm_size(state); ++ if (lbm_size) { ++ if (!vc4_state->lbm.allocated) { ++ spin_lock_irqsave(&vc4->hvs->mm_lock, irqflags); ++ ret = drm_mm_insert_node(&vc4->hvs->lbm_mm, ++ &vc4_state->lbm, ++ lbm_size, 32, 0); ++ spin_unlock_irqrestore(&vc4->hvs->mm_lock, irqflags); ++ } else { ++ WARN_ON_ONCE(lbm_size != vc4_state->lbm.size); ++ } + } + +- if (crtc_x < 0) { +- offset += drm_format_plane_cpp(fb->pixel_format, 0) * -crtc_x; +- crtc_w += crtc_x; +- crtc_x = 0; +- } ++ if (ret) ++ return ret; + +- if (crtc_y < 0) { +- offset += fb->pitches[0] * -crtc_y; +- crtc_h += crtc_y; +- crtc_y = 0; ++ /* SCL1 is used for Cb/Cr scaling of planar formats. For RGB ++ * and 4:4:4, scl1 should be set to scl0 so both channels of ++ * the scaler do the same thing. For YUV, the Y plane needs ++ * to be put in channel 1 and Cb/Cr in channel 0, so we swap ++ * the scl fields here. ++ */ ++ if (num_planes == 1) { ++ scl0 = vc4_get_scl_field(state, 1); ++ scl1 = scl0; ++ } else { ++ scl0 = vc4_get_scl_field(state, 1); ++ scl1 = vc4_get_scl_field(state, 0); + } + ++ /* Control word */ + vc4_dlist_write(vc4_state, + SCALER_CTL0_VALID | + (format->pixel_order << SCALER_CTL0_ORDER_SHIFT) | + (format->hvs << SCALER_CTL0_PIXEL_FORMAT_SHIFT) | +- SCALER_CTL0_UNITY); ++ (vc4_state->is_unity ? SCALER_CTL0_UNITY : 0) | ++ VC4_SET_FIELD(scl0, SCALER_CTL0_SCL0) | ++ VC4_SET_FIELD(scl1, SCALER_CTL0_SCL1)); + + /* Position Word 0: Image Positions and Alpha Value */ ++ vc4_state->pos0_offset = vc4_state->dlist_count; + vc4_dlist_write(vc4_state, + VC4_SET_FIELD(0xff, SCALER_POS0_FIXED_ALPHA) | +- VC4_SET_FIELD(crtc_x, SCALER_POS0_START_X) | +- VC4_SET_FIELD(crtc_y, SCALER_POS0_START_Y)); +- +- /* Position Word 1: Scaled Image Dimensions. +- * Skipped due to SCALER_CTL0_UNITY scaling. +- */ ++ VC4_SET_FIELD(vc4_state->crtc_x, SCALER_POS0_START_X) | ++ VC4_SET_FIELD(vc4_state->crtc_y, SCALER_POS0_START_Y)); ++ ++ /* Position Word 1: Scaled Image Dimensions. */ ++ if (!vc4_state->is_unity) { ++ vc4_dlist_write(vc4_state, ++ VC4_SET_FIELD(vc4_state->crtc_w, ++ SCALER_POS1_SCL_WIDTH) | ++ VC4_SET_FIELD(vc4_state->crtc_h, ++ SCALER_POS1_SCL_HEIGHT)); ++ } + + /* Position Word 2: Source Image Size, Alpha Mode */ ++ vc4_state->pos2_offset = vc4_state->dlist_count; + vc4_dlist_write(vc4_state, + VC4_SET_FIELD(format->has_alpha ? + SCALER_POS2_ALPHA_MODE_PIPELINE : + SCALER_POS2_ALPHA_MODE_FIXED, + SCALER_POS2_ALPHA_MODE) | +- VC4_SET_FIELD(crtc_w, SCALER_POS2_WIDTH) | +- VC4_SET_FIELD(crtc_h, SCALER_POS2_HEIGHT)); ++ VC4_SET_FIELD(vc4_state->src_w[0], SCALER_POS2_WIDTH) | ++ VC4_SET_FIELD(vc4_state->src_h[0], SCALER_POS2_HEIGHT)); + + /* Position Word 3: Context. Written by the HVS. */ + vc4_dlist_write(vc4_state, 0xc0c0c0c0); + +- vc4_state->pw0_offset = vc4_state->dlist_count; + +- /* Pointer Word 0: RGB / Y Pointer */ +- vc4_dlist_write(vc4_state, bo->paddr + offset); ++ /* Pointer Word 0/1/2: RGB / Y / Cb / Cr Pointers ++ * ++ * The pointers may be any byte address. ++ */ ++ vc4_state->ptr0_offset = vc4_state->dlist_count; ++ if (!format->flip_cbcr) { ++ for (i = 0; i < num_planes; i++) ++ vc4_dlist_write(vc4_state, vc4_state->offsets[i]); ++ } else { ++ WARN_ON_ONCE(num_planes != 3); ++ vc4_dlist_write(vc4_state, vc4_state->offsets[0]); ++ vc4_dlist_write(vc4_state, vc4_state->offsets[2]); ++ vc4_dlist_write(vc4_state, vc4_state->offsets[1]); ++ } + +- /* Pointer Context Word 0: Written by the HVS */ +- vc4_dlist_write(vc4_state, 0xc0c0c0c0); ++ /* Pointer Context Word 0/1/2: Written by the HVS */ ++ for (i = 0; i < num_planes; i++) ++ vc4_dlist_write(vc4_state, 0xc0c0c0c0); + +- /* Pitch word 0: Pointer 0 Pitch */ +- vc4_dlist_write(vc4_state, +- VC4_SET_FIELD(fb->pitches[0], SCALER_SRC_PITCH)); ++ /* Pitch word 0/1/2 */ ++ for (i = 0; i < num_planes; i++) { ++ vc4_dlist_write(vc4_state, ++ VC4_SET_FIELD(fb->pitches[i], SCALER_SRC_PITCH)); ++ } ++ ++ /* Colorspace conversion words */ ++ if (vc4_state->is_yuv) { ++ vc4_dlist_write(vc4_state, SCALER_CSC0_ITR_R_601_5); ++ vc4_dlist_write(vc4_state, SCALER_CSC1_ITR_R_601_5); ++ vc4_dlist_write(vc4_state, SCALER_CSC2_ITR_R_601_5); ++ } ++ ++ if (!vc4_state->is_unity) { ++ /* LBM Base Address. */ ++ if (vc4_state->y_scaling[0] != VC4_SCALING_NONE || ++ vc4_state->y_scaling[1] != VC4_SCALING_NONE) { ++ vc4_dlist_write(vc4_state, vc4_state->lbm.start); ++ } ++ ++ if (num_planes > 1) { ++ /* Emit Cb/Cr as channel 0 and Y as channel ++ * 1. This matches how we set up scl0/scl1 ++ * above. ++ */ ++ vc4_write_scaling_parameters(state, 1); ++ } ++ vc4_write_scaling_parameters(state, 0); ++ ++ /* If any PPF setup was done, then all the kernel ++ * pointers get uploaded. ++ */ ++ if (vc4_state->x_scaling[0] == VC4_SCALING_PPF || ++ vc4_state->y_scaling[0] == VC4_SCALING_PPF || ++ vc4_state->x_scaling[1] == VC4_SCALING_PPF || ++ vc4_state->y_scaling[1] == VC4_SCALING_PPF) { ++ u32 kernel = VC4_SET_FIELD(vc4->hvs->mitchell_netravali_filter.start, ++ SCALER_PPF_KERNEL_OFFSET); ++ ++ /* HPPF plane 0 */ ++ vc4_dlist_write(vc4_state, kernel); ++ /* VPPF plane 0 */ ++ vc4_dlist_write(vc4_state, kernel); ++ /* HPPF plane 1 */ ++ vc4_dlist_write(vc4_state, kernel); ++ /* VPPF plane 1 */ ++ vc4_dlist_write(vc4_state, kernel); ++ } ++ } + + vc4_state->dlist[ctl0_offset] |= + VC4_SET_FIELD(vc4_state->dlist_count, SCALER_CTL0_SIZE); +@@ -303,13 +716,13 @@ void vc4_plane_async_set_fb(struct drm_plane *plane, struct drm_framebuffer *fb) + * scanout will start from this address as soon as the FIFO + * needs to refill with pixels. + */ +- writel(addr, &vc4_state->hw_dlist[vc4_state->pw0_offset]); ++ writel(addr, &vc4_state->hw_dlist[vc4_state->ptr0_offset]); + + /* Also update the CPU-side dlist copy, so that any later + * atomic updates that don't do a new modeset on our plane + * also use our updated address. + */ +- vc4_state->dlist[vc4_state->pw0_offset] = addr; ++ vc4_state->dlist[vc4_state->ptr0_offset] = addr; + } + + static const struct drm_plane_helper_funcs vc4_plane_helper_funcs = { +@@ -325,8 +738,83 @@ static void vc4_plane_destroy(struct drm_plane *plane) + drm_plane_cleanup(plane); + } + ++/* Implements immediate (non-vblank-synced) updates of the cursor ++ * position, or falls back to the atomic helper otherwise. ++ */ ++static int ++vc4_update_plane(struct drm_plane *plane, ++ struct drm_crtc *crtc, ++ struct drm_framebuffer *fb, ++ int crtc_x, int crtc_y, ++ unsigned int crtc_w, unsigned int crtc_h, ++ uint32_t src_x, uint32_t src_y, ++ uint32_t src_w, uint32_t src_h) ++{ ++ struct drm_plane_state *plane_state; ++ struct vc4_plane_state *vc4_state; ++ ++ if (plane != crtc->cursor) ++ goto out; ++ ++ plane_state = plane->state; ++ vc4_state = to_vc4_plane_state(plane_state); ++ ++ if (!plane_state) ++ goto out; ++ ++ /* If we're changing the cursor contents, do that in the ++ * normal vblank-synced atomic path. ++ */ ++ if (fb != plane_state->fb) ++ goto out; ++ ++ /* No configuring new scaling in the fast path. */ ++ if (crtc_w != plane_state->crtc_w || ++ crtc_h != plane_state->crtc_h || ++ src_w != plane_state->src_w || ++ src_h != plane_state->src_h) { ++ goto out; ++ } ++ ++ /* Set the cursor's position on the screen. This is the ++ * expected change from the drm_mode_cursor_universal() ++ * helper. ++ */ ++ plane_state->crtc_x = crtc_x; ++ plane_state->crtc_y = crtc_y; ++ ++ /* Allow changing the start position within the cursor BO, if ++ * that matters. ++ */ ++ plane_state->src_x = src_x; ++ plane_state->src_y = src_y; ++ ++ /* Update the display list based on the new crtc_x/y. */ ++ vc4_plane_atomic_check(plane, plane_state); ++ ++ /* Note that we can't just call vc4_plane_write_dlist() ++ * because that would smash the context data that the HVS is ++ * currently using. ++ */ ++ writel(vc4_state->dlist[vc4_state->pos0_offset], ++ &vc4_state->hw_dlist[vc4_state->pos0_offset]); ++ writel(vc4_state->dlist[vc4_state->pos2_offset], ++ &vc4_state->hw_dlist[vc4_state->pos2_offset]); ++ writel(vc4_state->dlist[vc4_state->ptr0_offset], ++ &vc4_state->hw_dlist[vc4_state->ptr0_offset]); ++ ++ return 0; ++ ++out: ++ return drm_atomic_helper_update_plane(plane, crtc, fb, ++ crtc_x, crtc_y, ++ crtc_w, crtc_h, ++ src_x, src_y, ++ src_w, src_h); ++} ++ + static const struct drm_plane_funcs vc4_plane_funcs = { +- .update_plane = drm_atomic_helper_update_plane, ++ .update_plane = vc4_update_plane, + .disable_plane = drm_atomic_helper_disable_plane, + .destroy = vc4_plane_destroy, + .set_property = NULL, +@@ -341,6 +829,7 @@ struct drm_plane *vc4_plane_init(struct drm_device *dev, + struct drm_plane *plane = NULL; + struct vc4_plane *vc4_plane; + u32 formats[ARRAY_SIZE(hvs_formats)]; ++ u32 num_formats = 0; + int ret = 0; + unsigned i; + +@@ -351,12 +840,20 @@ struct drm_plane *vc4_plane_init(struct drm_device *dev, + goto fail; + } + +- for (i = 0; i < ARRAY_SIZE(hvs_formats); i++) +- formats[i] = hvs_formats[i].drm; ++ for (i = 0; i < ARRAY_SIZE(hvs_formats); i++) { ++ /* Don't allow YUV in cursor planes, since that means ++ * tuning on the scaler, which we don't allow for the ++ * cursor. ++ */ ++ if (type != DRM_PLANE_TYPE_CURSOR || ++ hvs_formats[i].hvs < HVS_PIXEL_FORMAT_YCBCR_YUV420_3PLANE) { ++ formats[num_formats++] = hvs_formats[i].drm; ++ } ++ } + plane = &vc4_plane->base; + ret = drm_universal_plane_init(dev, plane, 0xff, + &vc4_plane_funcs, +- formats, ARRAY_SIZE(formats), ++ formats, num_formats, + type, NULL); + + drm_plane_helper_add(plane, &vc4_plane_helper_funcs); +diff --git a/drivers/gpu/drm/vc4/vc4_regs.h b/drivers/gpu/drm/vc4/vc4_regs.h +index 4e52a0a..bf42a8e 100644 +--- a/drivers/gpu/drm/vc4/vc4_regs.h ++++ b/drivers/gpu/drm/vc4/vc4_regs.h +@@ -187,7 +187,7 @@ + # define PV_VCONTROL_CONTINUOUS BIT(1) + # define PV_VCONTROL_VIDEN BIT(0) + +-#define PV_VSYNCD 0x08 ++#define PV_VSYNCD_EVEN 0x08 + + #define PV_HORZA 0x0c + # define PV_HORZA_HBP_MASK VC4_MASK(31, 16) +@@ -350,6 +350,17 @@ + # define SCALER_DISPCTRLX_HEIGHT_SHIFT 0 + + #define SCALER_DISPBKGND0 0x00000044 ++# define SCALER_DISPBKGND_AUTOHS BIT(31) ++# define SCALER_DISPBKGND_INTERLACE BIT(30) ++# define SCALER_DISPBKGND_GAMMA BIT(29) ++# define SCALER_DISPBKGND_TESTMODE_MASK VC4_MASK(28, 25) ++# define SCALER_DISPBKGND_TESTMODE_SHIFT 25 ++/* Enables filling the scaler line with the RGB value in the low 24 ++ * bits before compositing. Costs cycles, so should be skipped if ++ * opaque display planes will cover everything. ++ */ ++# define SCALER_DISPBKGND_FILL BIT(24) ++ + #define SCALER_DISPSTAT0 0x00000048 + #define SCALER_DISPBASE0 0x0000004c + # define SCALER_DISPSTATX_MODE_MASK VC4_MASK(31, 30) +@@ -362,6 +373,9 @@ + # define SCALER_DISPSTATX_EMPTY BIT(28) + #define SCALER_DISPCTRL1 0x00000050 + #define SCALER_DISPBKGND1 0x00000054 ++#define SCALER_DISPBKGNDX(x) (SCALER_DISPBKGND0 + \ ++ (x) * (SCALER_DISPBKGND1 - \ ++ SCALER_DISPBKGND0)) + #define SCALER_DISPSTAT1 0x00000058 + #define SCALER_DISPSTATX(x) (SCALER_DISPSTAT0 + \ + (x) * (SCALER_DISPSTAT1 - \ +@@ -456,6 +470,8 @@ + #define VC4_HDMI_TX_PHY_RESET_CTL 0x2c0 + + #define VC4_HD_M_CTL 0x00c ++# define VC4_HD_M_REGISTER_FILE_STANDBY (3 << 6) ++# define VC4_HD_M_RAM_STANDBY (3 << 4) + # define VC4_HD_M_SW_RST BIT(2) + # define VC4_HD_M_ENABLE BIT(0) + +@@ -503,7 +519,12 @@ enum hvs_pixel_format { + HVS_PIXEL_FORMAT_RGB888 = 5, + HVS_PIXEL_FORMAT_RGBA6666 = 6, + /* 32bpp */ +- HVS_PIXEL_FORMAT_RGBA8888 = 7 ++ HVS_PIXEL_FORMAT_RGBA8888 = 7, ++ ++ HVS_PIXEL_FORMAT_YCBCR_YUV420_3PLANE = 8, ++ HVS_PIXEL_FORMAT_YCBCR_YUV420_2PLANE = 9, ++ HVS_PIXEL_FORMAT_YCBCR_YUV422_3PLANE = 10, ++ HVS_PIXEL_FORMAT_YCBCR_YUV422_2PLANE = 11, + }; + + /* Note: the LSB is the rightmost character shown. Only valid for +@@ -536,6 +557,21 @@ enum hvs_pixel_format { + #define SCALER_CTL0_ORDER_MASK VC4_MASK(14, 13) + #define SCALER_CTL0_ORDER_SHIFT 13 + ++#define SCALER_CTL0_SCL1_MASK VC4_MASK(10, 8) ++#define SCALER_CTL0_SCL1_SHIFT 8 ++ ++#define SCALER_CTL0_SCL0_MASK VC4_MASK(7, 5) ++#define SCALER_CTL0_SCL0_SHIFT 5 ++ ++#define SCALER_CTL0_SCL_H_PPF_V_PPF 0 ++#define SCALER_CTL0_SCL_H_TPZ_V_PPF 1 ++#define SCALER_CTL0_SCL_H_PPF_V_TPZ 2 ++#define SCALER_CTL0_SCL_H_TPZ_V_TPZ 3 ++#define SCALER_CTL0_SCL_H_PPF_V_NONE 4 ++#define SCALER_CTL0_SCL_H_NONE_V_PPF 5 ++#define SCALER_CTL0_SCL_H_NONE_V_TPZ 6 ++#define SCALER_CTL0_SCL_H_TPZ_V_NONE 7 ++ + /* Set to indicate no scaling. */ + #define SCALER_CTL0_UNITY BIT(4) + +@@ -551,6 +587,12 @@ enum hvs_pixel_format { + #define SCALER_POS0_START_X_MASK VC4_MASK(11, 0) + #define SCALER_POS0_START_X_SHIFT 0 + ++#define SCALER_POS1_SCL_HEIGHT_MASK VC4_MASK(27, 16) ++#define SCALER_POS1_SCL_HEIGHT_SHIFT 16 ++ ++#define SCALER_POS1_SCL_WIDTH_MASK VC4_MASK(11, 0) ++#define SCALER_POS1_SCL_WIDTH_SHIFT 0 ++ + #define SCALER_POS2_ALPHA_MODE_MASK VC4_MASK(31, 30) + #define SCALER_POS2_ALPHA_MODE_SHIFT 30 + #define SCALER_POS2_ALPHA_MODE_PIPELINE 0 +@@ -564,6 +606,80 @@ enum hvs_pixel_format { + #define SCALER_POS2_WIDTH_MASK VC4_MASK(11, 0) + #define SCALER_POS2_WIDTH_SHIFT 0 + ++/* Color Space Conversion words. Some values are S2.8 signed ++ * integers, except that the 2 integer bits map as {0x0: 0, 0x1: 1, ++ * 0x2: 2, 0x3: -1} ++ */ ++/* bottom 8 bits of S2.8 contribution of Cr to Blue */ ++#define SCALER_CSC0_COEF_CR_BLU_MASK VC4_MASK(31, 24) ++#define SCALER_CSC0_COEF_CR_BLU_SHIFT 24 ++/* Signed offset to apply to Y before CSC. (Y' = Y + YY_OFS) */ ++#define SCALER_CSC0_COEF_YY_OFS_MASK VC4_MASK(23, 16) ++#define SCALER_CSC0_COEF_YY_OFS_SHIFT 16 ++/* Signed offset to apply to CB before CSC (Cb' = Cb - 128 + CB_OFS). */ ++#define SCALER_CSC0_COEF_CB_OFS_MASK VC4_MASK(15, 8) ++#define SCALER_CSC0_COEF_CB_OFS_SHIFT 8 ++/* Signed offset to apply to CB before CSC (Cr' = Cr - 128 + CR_OFS). */ ++#define SCALER_CSC0_COEF_CR_OFS_MASK VC4_MASK(7, 0) ++#define SCALER_CSC0_COEF_CR_OFS_SHIFT 0 ++#define SCALER_CSC0_ITR_R_601_5 0x00f00000 ++#define SCALER_CSC0_ITR_R_709_3 0x00f00000 ++#define SCALER_CSC0_JPEG_JFIF 0x00000000 ++ ++/* S2.8 contribution of Cb to Green */ ++#define SCALER_CSC1_COEF_CB_GRN_MASK VC4_MASK(31, 22) ++#define SCALER_CSC1_COEF_CB_GRN_SHIFT 22 ++/* S2.8 contribution of Cr to Green */ ++#define SCALER_CSC1_COEF_CR_GRN_MASK VC4_MASK(21, 12) ++#define SCALER_CSC1_COEF_CR_GRN_SHIFT 12 ++/* S2.8 contribution of Y to all of RGB */ ++#define SCALER_CSC1_COEF_YY_ALL_MASK VC4_MASK(11, 2) ++#define SCALER_CSC1_COEF_YY_ALL_SHIFT 2 ++/* top 2 bits of S2.8 contribution of Cr to Blue */ ++#define SCALER_CSC1_COEF_CR_BLU_MASK VC4_MASK(1, 0) ++#define SCALER_CSC1_COEF_CR_BLU_SHIFT 0 ++#define SCALER_CSC1_ITR_R_601_5 0xe73304a8 ++#define SCALER_CSC1_ITR_R_709_3 0xf2b784a8 ++#define SCALER_CSC1_JPEG_JFIF 0xea34a400 ++ ++/* S2.8 contribution of Cb to Red */ ++#define SCALER_CSC2_COEF_CB_RED_MASK VC4_MASK(29, 20) ++#define SCALER_CSC2_COEF_CB_RED_SHIFT 20 ++/* S2.8 contribution of Cr to Red */ ++#define SCALER_CSC2_COEF_CR_RED_MASK VC4_MASK(19, 10) ++#define SCALER_CSC2_COEF_CR_RED_SHIFT 10 ++/* S2.8 contribution of Cb to Blue */ ++#define SCALER_CSC2_COEF_CB_BLU_MASK VC4_MASK(19, 10) ++#define SCALER_CSC2_COEF_CB_BLU_SHIFT 10 ++#define SCALER_CSC2_ITR_R_601_5 0x00066204 ++#define SCALER_CSC2_ITR_R_709_3 0x00072a1c ++#define SCALER_CSC2_JPEG_JFIF 0x000599c5 ++ ++#define SCALER_TPZ0_VERT_RECALC BIT(31) ++#define SCALER_TPZ0_SCALE_MASK VC4_MASK(28, 8) ++#define SCALER_TPZ0_SCALE_SHIFT 8 ++#define SCALER_TPZ0_IPHASE_MASK VC4_MASK(7, 0) ++#define SCALER_TPZ0_IPHASE_SHIFT 0 ++#define SCALER_TPZ1_RECIP_MASK VC4_MASK(15, 0) ++#define SCALER_TPZ1_RECIP_SHIFT 0 ++ ++/* Skips interpolating coefficients to 64 phases, so just 8 are used. ++ * Required for nearest neighbor. ++ */ ++#define SCALER_PPF_NOINTERP BIT(31) ++/* Replaes the highest valued coefficient with one that makes all 4 ++ * sum to unity. ++ */ ++#define SCALER_PPF_AGC BIT(30) ++#define SCALER_PPF_SCALE_MASK VC4_MASK(24, 8) ++#define SCALER_PPF_SCALE_SHIFT 8 ++#define SCALER_PPF_IPHASE_MASK VC4_MASK(6, 0) ++#define SCALER_PPF_IPHASE_SHIFT 0 ++ ++#define SCALER_PPF_KERNEL_OFFSET_MASK VC4_MASK(13, 0) ++#define SCALER_PPF_KERNEL_OFFSET_SHIFT 0 ++#define SCALER_PPF_KERNEL_UNCACHED BIT(31) ++ + #define SCALER_SRC_PITCH_MASK VC4_MASK(15, 0) + #define SCALER_SRC_PITCH_SHIFT 0 + +diff --git a/drivers/gpu/drm/vc4/vc4_v3d.c b/drivers/gpu/drm/vc4/vc4_v3d.c +index 31de5d1..e6d3c60 100644 +--- a/drivers/gpu/drm/vc4/vc4_v3d.c ++++ b/drivers/gpu/drm/vc4/vc4_v3d.c +@@ -268,6 +268,7 @@ static int vc4_v3d_dev_remove(struct platform_device *pdev) + } + + static const struct of_device_id vc4_v3d_dt_match[] = { ++ { .compatible = "brcm,bcm2835-v3d" }, + { .compatible = "brcm,vc4-v3d" }, + {} + }; +diff --git a/drivers/tty/serial/8250/8250_bcm2835aux.c b/drivers/tty/serial/8250/8250_bcm2835aux.c +new file mode 100644 +index 0000000..ecf89f1 +--- /dev/null ++++ b/drivers/tty/serial/8250/8250_bcm2835aux.c +@@ -0,0 +1,146 @@ ++/* ++ * Serial port driver for BCM2835AUX UART ++ * ++ * Copyright (C) 2016 Martin Sperl <kernel@martin.sperl.org> ++ * ++ * Based on 8250_lpc18xx.c: ++ * Copyright (C) 2015 Joachim Eastwood <manabian@gmail.com> ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License version 2 as ++ * published by the Free Software Foundation. ++ * ++ */ ++ ++#include <linux/clk.h> ++#include <linux/io.h> ++#include <linux/module.h> ++#include <linux/of.h> ++#include <linux/platform_device.h> ++ ++#include "8250.h" ++ ++struct bcm2835aux_data { ++ struct uart_8250_port uart; ++ struct clk *clk; ++ int line; ++}; ++ ++static int bcm2835aux_serial_probe(struct platform_device *pdev) ++{ ++ struct bcm2835aux_data *data; ++ struct resource *res; ++ int ret; ++ ++ /* allocate the custom structure */ ++ data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL); ++ if (!data) ++ return -ENOMEM; ++ ++ /* initialize data */ ++ spin_lock_init(&data->uart.port.lock); ++ data->uart.capabilities = UART_CAP_FIFO; ++ data->uart.port.dev = &pdev->dev; ++ data->uart.port.regshift = 2; ++ data->uart.port.type = PORT_16550; ++ data->uart.port.iotype = UPIO_MEM; ++ data->uart.port.fifosize = 8; ++ data->uart.port.flags = UPF_SHARE_IRQ | ++ UPF_FIXED_PORT | ++ UPF_FIXED_TYPE | ++ UPF_SKIP_TEST; ++ ++ /* get the clock - this also enables the HW */ ++ data->clk = devm_clk_get(&pdev->dev, NULL); ++ ret = PTR_ERR_OR_ZERO(data->clk); ++ if (ret) { ++ dev_err(&pdev->dev, "could not get clk: %d\n", ret); ++ return ret; ++ } ++ ++ /* get the interrupt */ ++ data->uart.port.irq = platform_get_irq(pdev, 0); ++ if (data->uart.port.irq < 0) { ++ dev_err(&pdev->dev, "irq not found - %i", ++ data->uart.port.irq); ++ return data->uart.port.irq; ++ } ++ ++ /* map the main registers */ ++ res = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!res) { ++ dev_err(&pdev->dev, "memory resource not found"); ++ return -EINVAL; ++ } ++ data->uart.port.membase = devm_ioremap_resource(&pdev->dev, res); ++ ret = PTR_ERR_OR_ZERO(data->uart.port.membase); ++ if (ret) ++ return ret; ++ ++ /* Check for a fixed line number */ ++ ret = of_alias_get_id(pdev->dev.of_node, "serial"); ++ if (ret >= 0) ++ data->uart.port.line = ret; ++ ++ /* enable the clock as a last step */ ++ ret = clk_prepare_enable(data->clk); ++ if (ret) { ++ dev_err(&pdev->dev, "unable to enable uart clock - %d\n", ++ ret); ++ return ret; ++ } ++ ++ /* the HW-clock divider for bcm2835aux is 8, ++ * but 8250 expects a divider of 16, ++ * so we have to multiply the actual clock by 2 ++ * to get identical baudrates. ++ */ ++ data->uart.port.uartclk = clk_get_rate(data->clk) * 2; ++ ++ /* register the port */ ++ ret = serial8250_register_8250_port(&data->uart); ++ if (ret < 0) { ++ dev_err(&pdev->dev, "unable to register 8250 port - %d\n", ++ ret); ++ goto dis_clk; ++ } ++ data->line = ret; ++ ++ platform_set_drvdata(pdev, data); ++ ++ return 0; ++ ++dis_clk: ++ clk_disable_unprepare(data->clk); ++ return ret; ++} ++ ++static int bcm2835aux_serial_remove(struct platform_device *pdev) ++{ ++ struct bcm2835aux_data *data = platform_get_drvdata(pdev); ++ ++ serial8250_unregister_port(data->uart.port.line); ++ clk_disable_unprepare(data->clk); ++ ++ return 0; ++} ++ ++static const struct of_device_id bcm2835aux_serial_match[] = { ++ { .compatible = "brcm,bcm2835-aux-uart" }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(of, bcm2835aux_serial_match); ++ ++static struct platform_driver bcm2835aux_serial_driver = { ++ .driver = { ++ .name = "bcm2835-aux-uart", ++ .of_match_table = bcm2835aux_serial_match, ++ }, ++ .probe = bcm2835aux_serial_probe, ++ .remove = bcm2835aux_serial_remove, ++}; ++module_platform_driver(bcm2835aux_serial_driver); ++ ++MODULE_DESCRIPTION("BCM2835 auxiliar UART driver"); ++MODULE_AUTHOR("Martin Sperl <kernel@martin.sperl.org>"); ++MODULE_LICENSE("GPL v2"); +diff --git a/drivers/tty/serial/8250/Kconfig b/drivers/tty/serial/8250/Kconfig +index b03cb517..67ad6b0 100644 +--- a/drivers/tty/serial/8250/Kconfig ++++ b/drivers/tty/serial/8250/Kconfig +@@ -272,6 +272,30 @@ config SERIAL_8250_ACORN + system, say Y to this option. The driver can handle 1, 2, or 3 port + cards. If unsure, say N. + ++config SERIAL_8250_BCM2835AUX ++ tristate "BCM2835 auxiliar mini UART support" ++ depends on ARCH_BCM2835 || COMPILE_TEST ++ depends on SERIAL_8250 && SERIAL_8250_SHARE_IRQ ++ help ++ Support for the BCM2835 auxiliar mini UART. ++ ++ Features and limitations of the UART are ++ Registers are similar to 16650 registers, ++ set bits in the control registers that are unsupported ++ are ignored and read back as 0 ++ 7/8 bit operation with 1 start and 1 stop bit ++ 8 symbols deep fifo for rx and tx ++ SW controlled RTS and SW readable CTS ++ Clock rate derived from system clock ++ Uses 8 times oversampling (compared to 16 times for 16650) ++ Missing break detection (but break generation) ++ Missing framing error detection ++ Missing parity bit ++ Missing receive time-out interrupt ++ Missing DCD, DSR, DTR and RI signals ++ ++ If unsure, say N. ++ + config SERIAL_8250_FSL + bool + depends on SERIAL_8250_CONSOLE +diff --git a/drivers/tty/serial/8250/Makefile b/drivers/tty/serial/8250/Makefile +index b9b9bca..5c1869f 100644 +--- a/drivers/tty/serial/8250/Makefile ++++ b/drivers/tty/serial/8250/Makefile +@@ -12,6 +12,7 @@ obj-$(CONFIG_SERIAL_8250_PCI) += 8250_pci.o + obj-$(CONFIG_SERIAL_8250_HP300) += 8250_hp300.o + obj-$(CONFIG_SERIAL_8250_CS) += serial_cs.o + obj-$(CONFIG_SERIAL_8250_ACORN) += 8250_acorn.o ++obj-$(CONFIG_SERIAL_8250_BCM2835AUX) += 8250_bcm2835aux.o + obj-$(CONFIG_SERIAL_8250_CONSOLE) += 8250_early.o + obj-$(CONFIG_SERIAL_8250_FOURPORT) += 8250_fourport.o + obj-$(CONFIG_SERIAL_8250_ACCENT) += 8250_accent.o +-- +2.5.0 + diff --git a/freed-ora/current/f24/cdc-acm-more-sanity-checking.patch b/freed-ora/current/f24/cdc-acm-more-sanity-checking.patch new file mode 100644 index 000000000..99ad43416 --- /dev/null +++ b/freed-ora/current/f24/cdc-acm-more-sanity-checking.patch @@ -0,0 +1,33 @@ +From e6a87f147002fa16adcbafebbc458ff90a463474 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum <oneukum@suse.com> +Date: Tue, 15 Mar 2016 10:14:04 +0100 +Subject: [PATCH] cdc-acm: more sanity checking + +An attack has become available which pretends to be a quirky +device circumventing normal sanity checks and crashes the kernel +by an insufficient number of interfaces. This patch adds a check +to the code path for quirky devices. + +Signed-off-by: Oliver Neukum <ONeukum@suse.com> +CC: stable@vger.kernel.org +--- + drivers/usb/class/cdc-acm.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 26ca4f910cb0..a7732f80a912 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1113,6 +1113,9 @@ static int acm_probe(struct usb_interface *intf, + if (quirks == NO_UNION_NORMAL) { + data_interface = usb_ifnum_to_if(usb_dev, 1); + control_interface = usb_ifnum_to_if(usb_dev, 0); ++ /* we would crash */ ++ if (!data_interface || !control_interface) ++ return -ENODEV; + goto skip_normal_probe; + } + +-- +2.5.0 + diff --git a/freed-ora/current/f24/config-armv7 b/freed-ora/current/f24/config-armv7 index 0cce9bc04..1a040d692 100644 --- a/freed-ora/current/f24/config-armv7 +++ b/freed-ora/current/f24/config-armv7 @@ -8,7 +8,6 @@ CONFIG_ARCH_OMAP3=y CONFIG_ARCH_OMAP4=y CONFIG_ARCH_QCOM=y CONFIG_ARCH_TEGRA=y -CONFIG_ARCH_U8500=y CONFIG_ARCH_ZYNQ=y # These are supported in the LPAE kernel @@ -259,6 +258,7 @@ CONFIG_INPUT_TPS65218_PWRBUTTON=m CONFIG_VIDEO_AM437X_VPFE=m CONFIG_UIO_PRUSS=m CONFIG_WKUP_M3_RPROC=m +CONFIG_WKUP_M3_IPC=m # Builtin needed for BBone White CONFIG_MFD_TPS65217=y @@ -538,46 +538,6 @@ CONFIG_AK8975=m CONFIG_CM36651=m CONFIG_KEYBOARD_SAMSUNG=m -# ST Ericsson -CONFIG_MACH_HREFV60=y -CONFIG_MACH_SNOWBALL=y - -CONFIG_ABX500_CORE=y -# CONFIG_ARM_U8500_CPUIDLE is not set -CONFIG_UX500_DEBUG_UART=2 -CONFIG_AB8500_CORE=y -CONFIG_STE_DMA40=y -CONFIG_HSEM_U8500=m -CONFIG_PINCTRL_ABX500=y -CONFIG_PINCTRL_AB8500=y -CONFIG_I2C_NOMADIK=m -CONFIG_KEYBOARD_NOMADIK=m -CONFIG_DB8500_CPUFREQ_COOLING=m -CONFIG_DB8500_THERMAL=y -CONFIG_UX500_WATCHDOG=m -CONFIG_AHCI_ST=m -CONFIG_INPUT_AB8500_PONKEY=m -CONFIG_REGULATOR_AB8500=y -CONFIG_AB8500_USB=m -CONFIG_USB_MUSB_UX500=m -# CONFIG_USB_UX500_DMA is not set -CONFIG_RTC_DRV_AB8500=m -CONFIG_PWM_AB8500=m -CONFIG_SND_SOC_UX500=m -CONFIG_SND_SOC_UX500_PLAT_DMA=m -CONFIG_SND_SOC_UX500_MACH_MOP500=m -CONFIG_CLKSRC_DBX500_PRCMU=y -CONFIG_CLKSRC_DBX500_PRCMU_SCHED_CLOCK=y -CONFIG_CRYPTO_DEV_UX500=m -CONFIG_CRYPTO_DEV_UX500_CRYP=m -CONFIG_CRYPTO_DEV_UX500_HASH=m -CONFIG_SENSORS_LIS3_I2C=m -CONFIG_AB8500_BM=y -CONFIG_AB8500_GPADC=y -CONFIG_SENSORS_AB8500=m -CONFIG_STE_MODEM_RPROC=m -CONFIG_STIH415_RESET=y - # Allwinner CONFIG_MACH_SUN4I=y CONFIG_MACH_SUN5I=y diff --git a/freed-ora/current/f24/config-armv7-generic b/freed-ora/current/f24/config-armv7-generic index 563811d20..e5d10e198 100644 --- a/freed-ora/current/f24/config-armv7-generic +++ b/freed-ora/current/f24/config-armv7-generic @@ -50,6 +50,7 @@ CONFIG_CPU_SW_DOMAIN_PAN=y # CONFIG_ARM_VIRT_EXT is not set # Platforms enabled/disabled globally on ARMv7 +CONFIG_ARCH_BCM=y CONFIG_ARCH_BCM2835=y CONFIG_ARCH_EXYNOS=y CONFIG_ARCH_HIGHBANK=y @@ -57,7 +58,13 @@ CONFIG_ARCH_SUNXI=y CONFIG_ARCH_TEGRA=y CONFIG_ARCH_VEXPRESS_CORTEX_A5_A9_ERRATA=y CONFIG_ARCH_VIRT=y -# CONFIG_ARCH_BCM is not set +# CONFIG_ARCH_BCM_CYGNUS is not set +# CONFIG_ARCH_BCM_NSP is not set +# CONFIG_ARCH_BCM_5301X is not set +# CONFIG_ARCH_BCM_281XX is not set +# CONFIG_ARCH_BCM_21664 is not set +# CONFIG_ARCH_BCM_63XX is not set +# CONFIG_ARCH_BRCMSTB is not set # CONFIG_ARCH_BERLIN is not set # CONFIG_ARCH_HI3xxx is not set # CONFIG_ARCH_HISI is not set @@ -233,6 +240,7 @@ CONFIG_NVMEM_SUNXI_SID=m # BCM 283x CONFIG_SERIAL_AMBA_PL011=y CONFIG_SERIAL_AMBA_PL011_CONSOLE=y +CONFIG_SERIAL_8250_BCM2835AUX=y CONFIG_DMA_BCM2835=m CONFIG_MMC_SDHCI_BCM2835=m CONFIG_BCM2835_MBOX=m @@ -244,7 +252,8 @@ CONFIG_SPI_BCM2835AUX=m CONFIG_BCM2835_WDT=m CONFIG_SND_BCM2835_SOC_I2S=m CONFIG_DRM_VC4=m -CONFIG_RASPBERRYPI_FIRMWARE=m +CONFIG_RASPBERRYPI_FIRMWARE=y +CONFIG_RASPBERRYPI_POWER=y # Exynos CONFIG_ARCH_EXYNOS3=y diff --git a/freed-ora/current/f24/cypress_m8-add-sanity-checking.patch b/freed-ora/current/f24/cypress_m8-add-sanity-checking.patch new file mode 100644 index 000000000..fa8513f94 --- /dev/null +++ b/freed-ora/current/f24/cypress_m8-add-sanity-checking.patch @@ -0,0 +1,50 @@ +From f7a3aa353011e38e119adebd845b38551587a26a Mon Sep 17 00:00:00 2001 +From: Oliver Neukum <oneukum@suse.com> +Date: Thu, 17 Mar 2016 16:25:33 +0100 +Subject: [PATCH] cypress_m8: add sanity checking + +An attack using missing endpoints exists. +CVE-2016-3137 + +Signed-off-by: Oliver Neukum <ONeukum@suse.com> +CC: stable@vger.kernel.org + +v1 - add sanity check +v2 - add error logging +v3 - correct error message +--- + drivers/usb/serial/cypress_m8.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c +index 01bf53392819..5e25443fe4ef 100644 +--- a/drivers/usb/serial/cypress_m8.c ++++ b/drivers/usb/serial/cypress_m8.c +@@ -447,6 +447,11 @@ static int cypress_generic_port_probe(struct usb_serial_port *port) + struct usb_serial *serial = port->serial; + struct cypress_private *priv; + ++ if (!port->interrupt_out_urb || !port->interrupt_in_urb) { ++ dev_err(&port->dev, "A required endpoint is missing\n"); ++ return -ENODEV; ++ } ++ + priv = kzalloc(sizeof(struct cypress_private), GFP_KERNEL); + if (!priv) + return -ENOMEM; +@@ -606,12 +611,6 @@ static int cypress_open(struct tty_struct *tty, struct usb_serial_port *port) + cypress_set_termios(tty, port, &priv->tmp_termios); + + /* setup the port and start reading from the device */ +- if (!port->interrupt_in_urb) { +- dev_err(&port->dev, "%s - interrupt_in_urb is empty!\n", +- __func__); +- return -1; +- } +- + usb_fill_int_urb(port->interrupt_in_urb, serial->dev, + usb_rcvintpipe(serial->dev, port->interrupt_in_endpointAddress), + port->interrupt_in_urb->transfer_buffer, +-- +2.5.0 + diff --git a/freed-ora/current/f24/digi_acceleport-do-sanity-checking-for-the-number-of.patch b/freed-ora/current/f24/digi_acceleport-do-sanity-checking-for-the-number-of.patch new file mode 100644 index 000000000..2bbae94b7 --- /dev/null +++ b/freed-ora/current/f24/digi_acceleport-do-sanity-checking-for-the-number-of.patch @@ -0,0 +1,34 @@ +From e9c2a3972496927631a1a98fef43e9538e9fd5d5 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum <oneukum@suse.com> +Date: Mon, 14 Mar 2016 15:53:38 +0100 +Subject: [PATCH] digi_acceleport: do sanity checking for the number of ports + +The driver can be crashed with devices that expose crafted +descriptors with too few endpoints. +See: +http://seclists.org/bugtraq/2016/Mar/61 + +Signed-off-by: Oliver Neukum <ONeukum@suse.com> +--- + drivers/usb/serial/digi_acceleport.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c +index 12b0e67473ba..c4d4d4547d40 100644 +--- a/drivers/usb/serial/digi_acceleport.c ++++ b/drivers/usb/serial/digi_acceleport.c +@@ -1260,6 +1260,11 @@ static int digi_startup(struct usb_serial *serial) + + spin_lock_init(&serial_priv->ds_serial_lock); + serial_priv->ds_oob_port_num = serial->type->num_ports; ++ if (!(serial_priv->ds_oob_port_num == 2 && serial->type == &digi_acceleport_2_device) ++ && !(serial_priv->ds_oob_port_num == 4 && serial->type == &digi_acceleport_4_device)) { ++ kfree(serial_priv); ++ return -EINVAL; ++ } + serial_priv->ds_oob_port = serial->port[serial_priv->ds_oob_port_num]; + + ret = digi_port_init(serial_priv->ds_oob_port, +-- +2.5.0 + diff --git a/freed-ora/current/f24/Geekbox-device-tree-support.patch b/freed-ora/current/f24/geekbox-v4-device-tree-support.patch index 51caf8aaf..77c1e5c28 100644 --- a/freed-ora/current/f24/Geekbox-device-tree-support.patch +++ b/freed-ora/current/f24/geekbox-v4-device-tree-support.patch @@ -1,19 +1,21 @@ -From a516bbf04744817e49e173b2a217a2a6366b5f9c Mon Sep 17 00:00:00 2001 +From 4d321bf15d2d5e5b1b674f2a26a1c5202090a800 Mon Sep 17 00:00:00 2001 From: Peter Robinson <pbrobinson@gmail.com> -Date: Wed, 2 Mar 2016 18:12:09 +0000 -Subject: [PATCH] Geekbox device tree support +Date: Thu, 17 Mar 2016 15:19:04 +0000 +Subject: [PATCH] geekbox v4 patchset --- Documentation/devicetree/bindings/arm/rockchip.txt | 9 + arch/arm64/boot/dts/rockchip/Makefile | 2 + - .../dts/rockchip/rk3368-geekbox-landingship.dts | 56 ++++ - arch/arm64/boot/dts/rockchip/rk3368-geekbox.dts | 321 +++++++++++++++++++++ - 4 files changed, 388 insertions(+) + arch/arm64/boot/dts/rockchip/rk3368-evb.dtsi | 2 +- + .../dts/rockchip/rk3368-geekbox-landingship.dts | 57 ++++ + arch/arm64/boot/dts/rockchip/rk3368-geekbox.dts | 319 +++++++++++++++++++++ + arch/arm64/boot/dts/rockchip/rk3368-r88.dts | 2 +- + 6 files changed, 389 insertions(+), 2 deletions(-) create mode 100644 arch/arm64/boot/dts/rockchip/rk3368-geekbox-landingship.dts create mode 100644 arch/arm64/boot/dts/rockchip/rk3368-geekbox.dts diff --git a/Documentation/devicetree/bindings/arm/rockchip.txt b/Documentation/devicetree/bindings/arm/rockchip.txt -index 078c14f..c6d95f2 100644 +index 078c14f..ae84f4e 100644 --- a/Documentation/devicetree/bindings/arm/rockchip.txt +++ b/Documentation/devicetree/bindings/arm/rockchip.txt @@ -87,6 +87,15 @@ Rockchip platforms device tree bindings @@ -24,9 +26,9 @@ index 078c14f..c6d95f2 100644 + Required root node properties: + - compatible = "geekbuying,geekbox", "rockchip,rk3368"; + -+- GeekBuying Landingship: ++- GeekBuying Landingship with GeekBox module: + Required root node properties: -+ - compatible = "geekbuying,landingship", ++ - compatible = "geekbuying,geekbox-landingship", + "geekbuying,geekbox", "rockchip,rk3368"; + - Rockchip RK3368 evb: @@ -43,12 +45,25 @@ index e3f0b5f..201bcd9 100644 dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3368-r88.dtb always := $(dtb-y) +diff --git a/arch/arm64/boot/dts/rockchip/rk3368-evb.dtsi b/arch/arm64/boot/dts/rockchip/rk3368-evb.dtsi +index 8c219cc..e4ceb53 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3368-evb.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3368-evb.dtsi +@@ -48,7 +48,7 @@ + stdout-path = "serial2:115200n8"; + }; + +- memory { ++ memory@0 { + device_type = "memory"; + reg = <0x0 0x0 0x0 0x40000000>; + }; diff --git a/arch/arm64/boot/dts/rockchip/rk3368-geekbox-landingship.dts b/arch/arm64/boot/dts/rockchip/rk3368-geekbox-landingship.dts new file mode 100644 -index 0000000..e4a1175 +index 0000000..a28ace9 --- /dev/null +++ b/arch/arm64/boot/dts/rockchip/rk3368-geekbox-landingship.dts -@@ -0,0 +1,56 @@ +@@ -0,0 +1,57 @@ +/* + * Copyright (c) 2016 Andreas Färber + * @@ -95,11 +110,12 @@ index 0000000..e4a1175 + +/ { + model = "GeekBox on Landingship"; -+ compatible = "geekbuying,landingship", "geekbuying,geekbox", "rockchip,rk3368"; ++ compatible = "geekbuying,geekbox-landingship", ++ "geekbuying,geekbox", "rockchip,rk3368"; +}; + +&i2c1 { -+ status = "okay"; ++ status = "disabled"; +}; + +&i2c2 { @@ -107,10 +123,10 @@ index 0000000..e4a1175 +}; diff --git a/arch/arm64/boot/dts/rockchip/rk3368-geekbox.dts b/arch/arm64/boot/dts/rockchip/rk3368-geekbox.dts new file mode 100644 -index 0000000..7e51876 +index 0000000..46cdddf --- /dev/null +++ b/arch/arm64/boot/dts/rockchip/rk3368-geekbox.dts -@@ -0,0 +1,321 @@ +@@ -0,0 +1,319 @@ +/* + * Copyright (c) 2016 Andreas Färber + * @@ -155,6 +171,7 @@ index 0000000..7e51876 + +/dts-v1/; +#include "rk3368.dtsi" ++#include <dt-bindings/input/input.h> + +/ { + model = "GeekBox"; @@ -164,7 +181,7 @@ index 0000000..7e51876 + stdout-path = "serial2:115200n8"; + }; + -+ memory { ++ memory@0 { + device_type = "memory"; + reg = <0x0 0x0 0x0 0x80000000>; + }; @@ -187,15 +204,12 @@ index 0000000..7e51876 + compatible = "gpio-keys"; + pinctrl-names = "default"; + pinctrl-0 = <&pwr_key>; -+ #address-cells = <1>; -+ #size-cells = <0>; + -+ button@0 { -+ reg = <0>; -+ gpio-key,wakeup = <1>; ++ power { + gpios = <&gpio0 2 GPIO_ACTIVE_LOW>; + label = "GPIO Power"; -+ linux,code = <116>; ++ linux,code = <KEY_POWER>; ++ wakeup-source; + }; + }; + @@ -390,13 +404,13 @@ index 0000000..7e51876 +&pinctrl { + ir { + ir_int: ir-int { -+ rockchip,pins = <3 30 RK_FUNC_GPIO &pcfg_pull_up>; ++ rockchip,pins = <3 30 RK_FUNC_GPIO &pcfg_pull_none>; + }; + }; + + keys { + pwr_key: pwr-key { -+ rockchip,pins = <0 2 RK_FUNC_GPIO &pcfg_pull_up>; ++ rockchip,pins = <0 2 RK_FUNC_GPIO &pcfg_pull_none>; + }; + }; + @@ -414,7 +428,7 @@ index 0000000..7e51876 +&tsadc { + status = "okay"; + rockchip,hw-tshut-mode = <0>; /* CRU */ -+ rockchip,hw-tshut-polarity = <0>; /* low */ ++ rockchip,hw-tshut-polarity = <1>; /* high */ +}; + +&uart2 { @@ -432,6 +446,19 @@ index 0000000..7e51876 +&wdt { + status = "okay"; +}; +diff --git a/arch/arm64/boot/dts/rockchip/rk3368-r88.dts b/arch/arm64/boot/dts/rockchip/rk3368-r88.dts +index 104cbee..9548129 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3368-r88.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3368-r88.dts +@@ -51,7 +51,7 @@ + stdout-path = "serial2:115200n8"; + }; + +- memory { ++ memory@0 { + device_type = "memory"; + reg = <0x0 0x0 0x0 0x40000000>; + }; -- 2.5.0 diff --git a/freed-ora/current/f24/ims-pcu-sanity-check-against-missing-interfaces.patch b/freed-ora/current/f24/ims-pcu-sanity-check-against-missing-interfaces.patch new file mode 100644 index 000000000..827a2b7ee --- /dev/null +++ b/freed-ora/current/f24/ims-pcu-sanity-check-against-missing-interfaces.patch @@ -0,0 +1,39 @@ +From a4200b7eb26271108586d3a7cf34a2f16d460e48 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum <oneukum@suse.com> +Date: Thu, 17 Mar 2016 15:10:47 +0100 +Subject: [PATCH] ims-pcu: sanity check against missing interfaces + +A malicious device missing interface can make the driver oops. +Add sanity checking. + +Signed-off-by: Oliver Neukum <ONeukum@suse.com> +CC: stable@vger.kernel.org +--- + drivers/input/misc/ims-pcu.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c +index ac1fa5f44580..9c0ea36913b4 100644 +--- a/drivers/input/misc/ims-pcu.c ++++ b/drivers/input/misc/ims-pcu.c +@@ -1663,6 +1663,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc + + pcu->ctrl_intf = usb_ifnum_to_if(pcu->udev, + union_desc->bMasterInterface0); ++ if (!pcu->ctrl_intf) ++ return -EINVAL; + + alt = pcu->ctrl_intf->cur_altsetting; + pcu->ep_ctrl = &alt->endpoint[0].desc; +@@ -1670,6 +1672,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc + + pcu->data_intf = usb_ifnum_to_if(pcu->udev, + union_desc->bSlaveInterface0); ++ if (!pcu->data_intf) ++ return -EINVAL; + + alt = pcu->data_intf->cur_altsetting; + if (alt->desc.bNumEndpoints != 2) { +-- +2.5.0 + diff --git a/freed-ora/current/f24/ipv4-Dont-do-expensive-useless-work-during-inetdev-des.patch b/freed-ora/current/f24/ipv4-Dont-do-expensive-useless-work-during-inetdev-des.patch new file mode 100644 index 000000000..48e4762e3 --- /dev/null +++ b/freed-ora/current/f24/ipv4-Dont-do-expensive-useless-work-during-inetdev-des.patch @@ -0,0 +1,97 @@ +From fbd40ea0180a2d328c5adc61414dc8bab9335ce2 Mon Sep 17 00:00:00 2001 +From: "David S. Miller" <davem@davemloft.net> +Date: Sun, 13 Mar 2016 23:28:00 -0400 +Subject: ipv4: Don't do expensive useless work during inetdev destroy. + +When an inetdev is destroyed, every address assigned to the interface +is removed. And in this scenerio we do two pointless things which can +be very expensive if the number of assigned interfaces is large: + +1) Address promotion. We are deleting all addresses, so there is no + point in doing this. + +2) A full nf conntrack table purge for every address. We only need to + do this once, as is already caught by the existing + masq_dev_notifier so masq_inet_event() can skip this. + +Reported-by: Solar Designer <solar@openwall.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Tested-by: Cyrill Gorcunov <gorcunov@openvz.org> +--- + net/ipv4/devinet.c | 4 ++++ + net/ipv4/fib_frontend.c | 4 ++++ + net/ipv4/netfilter/nf_nat_masquerade_ipv4.c | 12 ++++++++++-- + 3 files changed, 18 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c +index 65e76a4..e333bc8 100644 +--- a/net/ipv4/devinet.c ++++ b/net/ipv4/devinet.c +@@ -334,6 +334,9 @@ static void __inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap, + + ASSERT_RTNL(); + ++ if (in_dev->dead) ++ goto no_promotions; ++ + /* 1. Deleting primary ifaddr forces deletion all secondaries + * unless alias promotion is set + **/ +@@ -380,6 +383,7 @@ static void __inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap, + fib_del_ifaddr(ifa, ifa1); + } + ++no_promotions: + /* 2. Unlink it */ + + *ifap = ifa1->ifa_next; +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index 4734475..21add55 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -922,6 +922,9 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim) + subnet = 1; + } + ++ if (in_dev->dead) ++ goto no_promotions; ++ + /* Deletion is more complicated than add. + * We should take care of not to delete too much :-) + * +@@ -997,6 +1000,7 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim) + } + } + ++no_promotions: + if (!(ok & BRD_OK)) + fib_magic(RTM_DELROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32, prim); + if (subnet && ifa->ifa_prefixlen < 31) { +diff --git a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c +index c6eb421..ea91058 100644 +--- a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c ++++ b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c +@@ -108,10 +108,18 @@ static int masq_inet_event(struct notifier_block *this, + unsigned long event, + void *ptr) + { +- struct net_device *dev = ((struct in_ifaddr *)ptr)->ifa_dev->dev; ++ struct in_device *idev = ((struct in_ifaddr *)ptr)->ifa_dev; + struct netdev_notifier_info info; + +- netdev_notifier_info_init(&info, dev); ++ /* The masq_dev_notifier will catch the case of the device going ++ * down. So if the inetdev is dead and being destroyed we have ++ * no work to do. Otherwise this is an individual address removal ++ * and we have to perform the flush. ++ */ ++ if (idev->dead) ++ return NOTIFY_DONE; ++ ++ netdev_notifier_info_init(&info, idev->dev); + return masq_device_event(this, event, &info); + } + +-- +cgit v0.12 + diff --git a/freed-ora/current/f24/kernel.spec b/freed-ora/current/f24/kernel.spec index f50307aab..5a88d1210 100644 --- a/freed-ora/current/f24/kernel.spec +++ b/freed-ora/current/f24/kernel.spec @@ -42,7 +42,7 @@ Summary: The Linux kernel # For non-released -rc kernels, this will be appended after the rcX and # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3" # -%global baserelease 300 +%global baserelease 301 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -545,9 +545,13 @@ Patch07: freedo.patch # Standalone patches -Patch451: lib-cpumask-Make-CPUMASK_OFFSTACK-usable-without-deb.patch +# http://www.spinics.net/lists/netdev/msg369442.html +Patch452: revert-stmmac-Fix-eth0-No-PHY-found-regression.patch +Patch453: stmmac-fix-MDIO-settings.patch -Patch454: arm64-avoid-needing-console-to-enable-serial-console.patch +Patch454: bcm283x-add-aux-uart-support-extra-DT-bits-initial-r.patch + +Patch455: arm64-avoid-needing-console-to-enable-serial-console.patch Patch456: arm64-acpi-drop-expert-patch.patch @@ -556,8 +560,8 @@ Patch457: ARM-tegra-usb-no-reset.patch Patch458: ARM-mvebu-change-order-of-ethernet-DT-nodes-on-Armada-38x.patch -# http://www.spinics.net/lists/arm-kernel/msg480703.html -Patch459: Geekbox-device-tree-support.patch +# http://www.spinics.net/lists/arm-kernel/msg490981.html +Patch459: geekbox-v4-device-tree-support.patch # http://www.spinics.net/lists/arm-kernel/msg483898.html Patch460: Initial-AllWinner-A64-and-PINE64-support.patch @@ -567,6 +571,8 @@ Patch461: Fix-tegra-to-use-stdout-path-for-serial-console.patch Patch463: arm-i.MX6-Utilite-device-dtb.patch +Patch465: lib-cpumask-Make-CPUMASK_OFFSTACK-usable-without-deb.patch + Patch466: input-kill-stupid-messages.patch Patch467: die-floppy-die.patch @@ -670,6 +676,33 @@ Patch664: netfilter-x_tables-check-for-size-overflow.patch #CVE-2016-3134 rhbz 1317383 1317384 Patch665: netfilter-x_tables-deal-with-bogus-nextoffset-values.patch +#CVE-2016-3135 rhbz 1318172 1318270 +Patch666: ipv4-Dont-do-expensive-useless-work-during-inetdev-des.patch + +#CVE-2016-2184 rhbz 1317012 1317470 +Patch670: ALSA-usb-audio-Fix-NULL-dereference-in-create_fixed_.patch +Patch671: ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch + +#CVE-2016-3137 rhbz 1317010 1316996 +Patch672: cypress_m8-add-sanity-checking.patch + +#CVE-2016-2186 rhbz 1317015 1317464 +Patch673: USB-input-powermate-fix-oops-with-malicious-USB-desc.patch + +#CVE-2016-2188 rhbz 1317018 1317467 +Patch674: USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch + +#CVE-2016-2185 rhbz 1317014 1317471 +Patch675: usb_driver_claim_interface-add-sanity-checking.patch + +#CVE-2016-3138 rhbz 1317010 1316204 +Patch676: cdc-acm-more-sanity-checking.patch + +#CVE-2016-3140 rhbz 1317010 1316995 +Patch677: digi_acceleport-do-sanity-checking-for-the-number-of.patch + +Patch678: ims-pcu-sanity-check-against-missing-interfaces.patch + # END OF PATCH DEFINITIONS %endif @@ -2289,10 +2322,28 @@ fi # # %changelog +* Sat Mar 19 2016 Peter Robinson <pbrobinson@fedoraproject.org> 4.5.0-301 +- Upstream fix for stmmac driver regressions (AllWinner Gb NICs) +- Update various ARM device support patches +- General ARM updates + +* Fri Mar 18 2016 Josh Boyer <jwboyer@fedoraproject.org> +- ims-pcu: sanity checking on missing interfaces +- CVE-2016-3140 digi_acceleport: oops on invalid USB descriptors (rhbz 1317010 1316995) +- CVE-2016-3138 cdc_acm: oops on invalid USB descriptors (rhbz 1317010 1316204) +- CVE-2016-2185 ati_remote2: oops on invalid USB descriptors (rhbz 1317014 1317471) +- CVE-2016-2188 iowarrior: oops on invalid USB descriptors (rhbz 1317018 1317467) +- CVE-2016-2186 powermate: oops on invalid USB descriptors (rhbz 1317015 1317464) +- CVE-2016-3137 cypress_m8: oops on invalid USB descriptors (rhbz 1317010 1316996) +- CVE-2016-2184 alsa: panic on invalid USB descriptors (rhbz 1317012 1317470) + +* Wed Mar 16 2016 Josh Boyer <jwboyer@fedoraproject.org> +- CVE-2016-3135 ipv4: DoS when destroying a network interface (rhbz 1318172 1318270) + * Mon Mar 14 2016 Alexandre Oliva <lxoliva@fsfla.org> -libre - GNU Linux-libre 4.5-gnu. -* Mon Mar 14 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.5.0-1 +* Mon Mar 14 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.5.0-300 - Linux v4.5 - Disable debugging options. diff --git a/freed-ora/current/f24/revert-stmmac-Fix-eth0-No-PHY-found-regression.patch b/freed-ora/current/f24/revert-stmmac-Fix-eth0-No-PHY-found-regression.patch new file mode 100644 index 000000000..68b9cd3ab --- /dev/null +++ b/freed-ora/current/f24/revert-stmmac-Fix-eth0-No-PHY-found-regression.patch @@ -0,0 +1,87 @@ +From 44f947bb8ef5f4add9f2d84e1ff53afd8f2f5537 Mon Sep 17 00:00:00 2001 +From: Peter Robinson <pbrobinson@gmail.com> +Date: Wed, 16 Mar 2016 15:21:44 +0000 +Subject: [PATCH 1/2] Revert "stmmac: Fix 'eth0: No PHY found' regression" + +This reverts commit 88f8b1bb41c6208f81b6a480244533ded7b59493. +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c | 11 ++++++++++- + drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 9 +-------- + include/linux/stmmac.h | 1 - + 3 files changed, 11 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c +index efb54f3..0faf163 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c +@@ -199,12 +199,21 @@ int stmmac_mdio_register(struct net_device *ndev) + struct stmmac_priv *priv = netdev_priv(ndev); + struct stmmac_mdio_bus_data *mdio_bus_data = priv->plat->mdio_bus_data; + int addr, found; +- struct device_node *mdio_node = priv->plat->mdio_node; ++ struct device_node *mdio_node = NULL; ++ struct device_node *child_node = NULL; + + if (!mdio_bus_data) + return 0; + + if (IS_ENABLED(CONFIG_OF)) { ++ for_each_child_of_node(priv->device->of_node, child_node) { ++ if (of_device_is_compatible(child_node, ++ "snps,dwmac-mdio")) { ++ mdio_node = child_node; ++ break; ++ } ++ } ++ + if (mdio_node) { + netdev_dbg(ndev, "FOUND MDIO subnode\n"); + } else { +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +index 4514ba7..6a52fa1 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +@@ -110,7 +110,6 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac) + struct device_node *np = pdev->dev.of_node; + struct plat_stmmacenet_data *plat; + struct stmmac_dma_cfg *dma_cfg; +- struct device_node *child_node = NULL; + + plat = devm_kzalloc(&pdev->dev, sizeof(*plat), GFP_KERNEL); + if (!plat) +@@ -141,19 +140,13 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac) + plat->phy_node = of_node_get(np); + } + +- for_each_child_of_node(np, child_node) +- if (of_device_is_compatible(child_node, "snps,dwmac-mdio")) { +- plat->mdio_node = child_node; +- break; +- } +- + /* "snps,phy-addr" is not a standard property. Mark it as deprecated + * and warn of its use. Remove this when phy node support is added. + */ + if (of_property_read_u32(np, "snps,phy-addr", &plat->phy_addr) == 0) + dev_warn(&pdev->dev, "snps,phy-addr property is deprecated\n"); + +- if ((plat->phy_node && !of_phy_is_fixed_link(np)) || !plat->mdio_node) ++ if ((plat->phy_node && !of_phy_is_fixed_link(np)) || plat->phy_bus_name) + plat->mdio_bus_data = NULL; + else + plat->mdio_bus_data = +diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h +index 881a79d..eead8ab 100644 +--- a/include/linux/stmmac.h ++++ b/include/linux/stmmac.h +@@ -100,7 +100,6 @@ struct plat_stmmacenet_data { + int interface; + struct stmmac_mdio_bus_data *mdio_bus_data; + struct device_node *phy_node; +- struct device_node *mdio_node; + struct stmmac_dma_cfg *dma_cfg; + int clk_csr; + int has_gmac; +-- +2.5.0 + diff --git a/freed-ora/current/f24/stmmac-fix-MDIO-settings.patch b/freed-ora/current/f24/stmmac-fix-MDIO-settings.patch new file mode 100644 index 000000000..41fa928a4 --- /dev/null +++ b/freed-ora/current/f24/stmmac-fix-MDIO-settings.patch @@ -0,0 +1,235 @@ +From d55a02f460ffd64a5ba7f331489af87edeebf8da Mon Sep 17 00:00:00 2001 +From: Giuseppe CAVALLARO <peppe.cavallaro@st.com> +Date: Wed, 16 Mar 2016 10:38:49 +0100 +Subject: [PATCH 2/2] stmmac: fix MDIO settings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Initially the phy_bus_name was added to manipulate the +driver name but it was recently just used to manage the +fixed-link and then to take some decision at run-time. +So the patch uses the is_pseudo_fixed_link and removes +the phy_bus_name variable not necessary anymore. + +The driver can manage the mdio registration by using phy-handle, +dwmac-mdio and own parameter e.g. snps,phy-addr. +This patch takes care about all these possible configurations +and fixes the mdio registration in case of there is a real +transceiver or a switch (that needs to be managed by using +fixed-link). + +Signed-off-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> +Reviewed-by: Andreas Färber <afaerber@suse.de> +Tested-by: Frank Schäfer <fschaefer.oss@googlemail.com> +Cc: Gabriel Fernandez <gabriel.fernandez@linaro.org> +Cc: Dinh Nguyen <dinh.linux@gmail.com> +Cc: David S. Miller <davem@davemloft.net> +Cc: Phil Reid <preid@electromag.com.au> +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 11 +-- + drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c | 19 +---- + .../net/ethernet/stmicro/stmmac/stmmac_platform.c | 84 +++++++++++++++++----- + include/linux/stmmac.h | 2 +- + 4 files changed, 71 insertions(+), 45 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index c21015b..389d7d0 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -271,7 +271,6 @@ static void stmmac_eee_ctrl_timer(unsigned long arg) + */ + bool stmmac_eee_init(struct stmmac_priv *priv) + { +- char *phy_bus_name = priv->plat->phy_bus_name; + unsigned long flags; + bool ret = false; + +@@ -283,7 +282,7 @@ bool stmmac_eee_init(struct stmmac_priv *priv) + goto out; + + /* Never init EEE in case of a switch is attached */ +- if (phy_bus_name && (!strcmp(phy_bus_name, "fixed"))) ++ if (priv->phydev->is_pseudo_fixed_link) + goto out; + + /* MAC core supports the EEE feature. */ +@@ -820,12 +819,8 @@ static int stmmac_init_phy(struct net_device *dev) + phydev = of_phy_connect(dev, priv->plat->phy_node, + &stmmac_adjust_link, 0, interface); + } else { +- if (priv->plat->phy_bus_name) +- snprintf(bus_id, MII_BUS_ID_SIZE, "%s-%x", +- priv->plat->phy_bus_name, priv->plat->bus_id); +- else +- snprintf(bus_id, MII_BUS_ID_SIZE, "stmmac-%x", +- priv->plat->bus_id); ++ snprintf(bus_id, MII_BUS_ID_SIZE, "stmmac-%x", ++ priv->plat->bus_id); + + snprintf(phy_id_fmt, MII_BUS_ID_SIZE + 3, PHY_ID_FMT, bus_id, + priv->plat->phy_addr); +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c +index 0faf163..3f5512f 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c +@@ -198,29 +198,12 @@ int stmmac_mdio_register(struct net_device *ndev) + struct mii_bus *new_bus; + struct stmmac_priv *priv = netdev_priv(ndev); + struct stmmac_mdio_bus_data *mdio_bus_data = priv->plat->mdio_bus_data; ++ struct device_node *mdio_node = priv->plat->mdio_node; + int addr, found; +- struct device_node *mdio_node = NULL; +- struct device_node *child_node = NULL; + + if (!mdio_bus_data) + return 0; + +- if (IS_ENABLED(CONFIG_OF)) { +- for_each_child_of_node(priv->device->of_node, child_node) { +- if (of_device_is_compatible(child_node, +- "snps,dwmac-mdio")) { +- mdio_node = child_node; +- break; +- } +- } +- +- if (mdio_node) { +- netdev_dbg(ndev, "FOUND MDIO subnode\n"); +- } else { +- netdev_warn(ndev, "No MDIO subnode found\n"); +- } +- } +- + new_bus = mdiobus_alloc(); + if (new_bus == NULL) + return -ENOMEM; +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +index 6a52fa1..190fb6d 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +@@ -96,6 +96,69 @@ static int dwmac1000_validate_ucast_entries(int ucast_entries) + } + + /** ++ * stmmac_dt_phy - parse device-tree driver parameters to allocate PHY resources ++ * @plat: driver data platform structure ++ * @np: device tree node ++ * @dev: device pointer ++ * Description: ++ * The mdio bus will be allocated in case of a phy transceiver is on board; ++ * it will be NULL if the fixed-link is configured. ++ * If there is the "snps,dwmac-mdio" sub-node the mdio will be allocated ++ * in any case (for DSA, mdio must be registered even if fixed-link). ++ * The table below sums the supported configurations: ++ * ------------------------------- ++ * snps,phy-addr | Y ++ * ------------------------------- ++ * phy-handle | Y ++ * ------------------------------- ++ * fixed-link | N ++ * ------------------------------- ++ * snps,dwmac-mdio | ++ * even if | Y ++ * fixed-link | ++ * ------------------------------- ++ * ++ * It returns 0 in case of success otherwise -ENODEV. ++ */ ++static int stmmac_dt_phy(struct plat_stmmacenet_data *plat, ++ struct device_node *np, struct device *dev) ++{ ++ bool mdio = true; ++ ++ /* If phy-handle property is passed from DT, use it as the PHY */ ++ plat->phy_node = of_parse_phandle(np, "phy-handle", 0); ++ if (plat->phy_node) ++ dev_dbg(dev, "Found phy-handle subnode\n"); ++ ++ /* If phy-handle is not specified, check if we have a fixed-phy */ ++ if (!plat->phy_node && of_phy_is_fixed_link(np)) { ++ if ((of_phy_register_fixed_link(np) < 0)) ++ return -ENODEV; ++ ++ dev_dbg(dev, "Found fixed-link subnode\n"); ++ plat->phy_node = of_node_get(np); ++ mdio = false; ++ } ++ ++ /* If snps,dwmac-mdio is passed from DT, always register the MDIO */ ++ for_each_child_of_node(np, plat->mdio_node) { ++ if (of_device_is_compatible(plat->mdio_node, "snps,dwmac-mdio")) ++ break; ++ } ++ ++ if (plat->mdio_node) { ++ dev_dbg(dev, "Found MDIO subnode\n"); ++ mdio = true; ++ } ++ ++ if (mdio) ++ plat->mdio_bus_data = ++ devm_kzalloc(dev, sizeof(struct stmmac_mdio_bus_data), ++ GFP_KERNEL); ++ return 0; ++} ++ ++/** + * stmmac_probe_config_dt - parse device-tree driver parameters + * @pdev: platform_device structure + * @plat: driver data platform structure +@@ -129,30 +192,15 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac) + /* Default to phy auto-detection */ + plat->phy_addr = -1; + +- /* If we find a phy-handle property, use it as the PHY */ +- plat->phy_node = of_parse_phandle(np, "phy-handle", 0); +- +- /* If phy-handle is not specified, check if we have a fixed-phy */ +- if (!plat->phy_node && of_phy_is_fixed_link(np)) { +- if ((of_phy_register_fixed_link(np) < 0)) +- return ERR_PTR(-ENODEV); +- +- plat->phy_node = of_node_get(np); +- } +- + /* "snps,phy-addr" is not a standard property. Mark it as deprecated + * and warn of its use. Remove this when phy node support is added. + */ + if (of_property_read_u32(np, "snps,phy-addr", &plat->phy_addr) == 0) + dev_warn(&pdev->dev, "snps,phy-addr property is deprecated\n"); + +- if ((plat->phy_node && !of_phy_is_fixed_link(np)) || plat->phy_bus_name) +- plat->mdio_bus_data = NULL; +- else +- plat->mdio_bus_data = +- devm_kzalloc(&pdev->dev, +- sizeof(struct stmmac_mdio_bus_data), +- GFP_KERNEL); ++ /* To Configure PHY by using all device-tree supported properties */ ++ if (stmmac_dt_phy(plat, np, &pdev->dev)) ++ return ERR_PTR(-ENODEV); + + of_property_read_u32(np, "tx-fifo-depth", &plat->tx_fifo_size); + +diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h +index eead8ab..8b1ff2b 100644 +--- a/include/linux/stmmac.h ++++ b/include/linux/stmmac.h +@@ -94,12 +94,12 @@ struct stmmac_dma_cfg { + }; + + struct plat_stmmacenet_data { +- char *phy_bus_name; + int bus_id; + int phy_addr; + int interface; + struct stmmac_mdio_bus_data *mdio_bus_data; + struct device_node *phy_node; ++ struct device_node *mdio_node; + struct stmmac_dma_cfg *dma_cfg; + int clk_csr; + int has_gmac; +-- +2.5.0 + diff --git a/freed-ora/current/f24/usb_driver_claim_interface-add-sanity-checking.patch b/freed-ora/current/f24/usb_driver_claim_interface-add-sanity-checking.patch new file mode 100644 index 000000000..079ff03fd --- /dev/null +++ b/freed-ora/current/f24/usb_driver_claim_interface-add-sanity-checking.patch @@ -0,0 +1,39 @@ +From de0784bdf6314b70c69416d8c576eb83237d5b1e Mon Sep 17 00:00:00 2001 +From: Oliver Neukum <oneukum@suse.com> +Date: Wed, 16 Mar 2016 12:26:17 -0400 +Subject: [PATCH] usb_driver_claim_interface: add sanity checking + +Attacks that trick drivers into passing a NULL pointer +to usb_driver_claim_interface() using forged descriptors are +known. This thwarts them by sanity checking. + +Signed-off-by: Oliver Neukum <ONeukum@suse.com> +CC: stable@vger.kernel.org +--- + drivers/usb/core/driver.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c +index 6b5063e7943f..e2d242b68d4b 100644 +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -500,11 +500,15 @@ static int usb_unbind_interface(struct device *dev) + int usb_driver_claim_interface(struct usb_driver *driver, + struct usb_interface *iface, void *priv) + { +- struct device *dev = &iface->dev; ++ struct device *dev; + struct usb_device *udev; + int retval = 0; + int lpm_disable_error; + ++ if (!iface) ++ return -ENODEV; ++ ++ dev = &iface->dev; + if (dev->driver) + return -EBUSY; + +-- +2.5.0 + |
