24 files changed, 1649 insertions, 59 deletions
diff --git a/Jenkinsfile b/Jenkinsfile index 63e7c34..1ab3e47 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -118,22 +118,31 @@ spec: rpmdev-setuptree - # The published file name is whatever the spec + # The published file names are whatever the spec # resolves to under the tag's versions, so the two - # cannot drift. A kernel build is expensive; if this - # exact NEVRA is already in the bucket, skip - # straight to the metadata. - rpm_file=$(rpmspec -q \\ + # cannot drift. Note the plural: kernel-surface-dtb + # is a separate package because the main one is + # installonly and cannot own a path that carries no + # kernel version. Publishing only the first would + # leave the kernel unresolvable. + prefix="s3://${RPM_BUCKET}/fedora/${fedora_version}/aarch64" + rpm_files=$(rpmspec -q \\ --define "upstream_ver ${UPSTREAM_VER}" \\ --define "patchset_ver ${PATCHSET_VER}" \\ --queryformat '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}.rpm\\n' \\ - kernel-surface.spec | head -n1) - dest="s3://${RPM_BUCKET}/fedora/${fedora_version}/aarch64/${rpm_file}" + kernel-surface.spec) - skip_build=false - if aws s3 ls --endpoint-url "${B2_ENDPOINT}" "${dest}"; then - echo "${rpm_file} already published, skipping build" - skip_build=true + # A kernel build is expensive; skip it only when + # every one of those is already in the bucket. + skip_build=true + for rpm_name in ${rpm_files}; do + if ! aws s3 ls --endpoint-url "${B2_ENDPOINT}" \\ + "${prefix}/${rpm_name}"; then + skip_build=false + fi + done + if [ "${skip_build}" = true ]; then + echo "${TAG_NAME} is already published in full, skipping build" fi if [ "${skip_build}" = false ]; then @@ -146,29 +155,34 @@ spec: --define '_smp_mflags -j4' \\ kernel-surface.spec - built="${HOME}/rpmbuild/RPMS/aarch64/${rpm_file}" - test -f "${built}" + # kernel-surface-dtb is noarch, so it lands + # in RPMS/noarch rather than RPMS/aarch64; ask + # where each one actually is. + for rpm_name in ${rpm_files}; do + built=$(find "${HOME}/rpmbuild/RPMS" -type f \\ + -name "${rpm_name}" -print -quit) + test -n "${built}" - aws s3 cp --endpoint-url "${B2_ENDPOINT}" \\ - "${built}" "${dest}" + aws s3 cp --endpoint-url "${B2_ENDPOINT}" \\ + "${built}" "${prefix}/${rpm_name}" + done fi - repo_url="s3://${RPM_BUCKET}/fedora/${fedora_version}/aarch64" repo="${WORKSPACE}/repo" mkdir -p "${repo}" aws s3 sync --endpoint-url "${B2_ENDPOINT}" \\ --exclude '*' --include '*.rpm' \\ - "${repo_url}/" "${repo}/" + "${prefix}/" "${repo}/" createrepo_c --update "${repo}" aws s3 sync --endpoint-url "${B2_ENDPOINT}" \\ --exclude 'repomd.xml*' \\ - "${repo}/repodata/" "${repo_url}/repodata/" + "${repo}/repodata/" "${prefix}/repodata/" aws s3 cp --endpoint-url "${B2_ENDPOINT}" \\ "${repo}/repodata/repomd.xml" \\ - "${repo_url}/repodata/repomd.xml" + "${prefix}/repodata/repomd.xml" # Served next to the repository so that consumers # can `dnf config-manager --add-repo` the URL. @@ -13,6 +13,26 @@ Used in [Fedora KIWI descriptions, modified by me for Surface Pro 12"](https://s `vanilla-kernel-*.ebuild` applies them, minus `gpu` (does not exist) and `rockchip` (irrelevant). +An entry prefixed with `local:` is not the overlay's, it is `patches/<name>/` +in this repository. Those carry fixes the overlay has not picked up, and they +live outside the submodule so that `git submodule update` cannot silently drop +them. They are listed right after the overlay directory they extend, so the +same numbering that orders the overlay's series orders these too. + +- `patches/camera/0027-media-i2c-ov13858-fix-bayer-order-when-mirrored.patch` + the rear camera advertises GRBG while the horizontal mirror, which + `rotation = <180>` turns on, makes it deliver RGGB. Debayering with the wrong + pattern puts both greens into the red and blue channels, so the picture comes + out close to monochrome. +- `patches/surface/0016-arm64-dts-qcom-purwa-Microsoft-Surface-Pro-12in-iris-firmware-name.patch` + the video codec firmware in linux-firmware is signed with Qualcomm's SecTools + test key, which this device's TrustZone rejects with `error -22 initializing + firmware`. Points the iris node at the production-signed build shipped in the + Windows driver package instead. + +Send them upstream to the overlay when they are ready; drop the `local:` entry +and the directory once the overlay carries them. + ## Configuration The starting point is `config/base-aarch64.config`: Fedora's own aarch64 @@ -31,7 +51,7 @@ rpm2archive -n - < kernel-core-*.aarch64.rpm | If the extraction comes up empty, `rpm -qlp kernel-core-*.aarch64.rpm | grep config` says whether the package still carries the file at all. -Three fragments are merged on top with `scripts/kconfig/merge_config.sh`: +Four fragments are merged on top with `scripts/kconfig/merge_config.sh`: * `config/surface.config` – the drivers the patch set enables (SAM stack and its new RTC, CAMSS and the CSI-2 D-PHY, fastrpc, ath12k, AudioReach). @@ -39,6 +59,9 @@ Three fragments are merged on top with `scripts/kconfig/merge_config.sh`: and dm-snapshot/overlayfs built in for `dracut`'s `dmsquash-live`, the EFI stub because GRUB's aarch64 `linux` command loads the kernel as an EFI application, and xz module compression. +* `config/foreign-socs.config` – the ARM64 platforms this machine is not. + Fedora's config enables every platform it supports because a distribution + kernel has to boot on all of them; this one boots on `qcom,x1p42100` alone. * `config/no-debug-info.config` – DWARF and BTF off. The package produces no `-debuginfo` subpackage (`%global debug_package %{nil}`) and strips modules at install time, so the DWARF was compiled only to be discarded, and it is @@ -62,7 +85,7 @@ matches the ISO (the project README notes Secure Boot is not available for it). ```bash dnf config-manager addrepo --from-repofile=\ - https://f003.backblazeb2.com/file/dist-sayagit-fedora-rpm/fedora/45/kernel-sp12in.repo + https://rpm.sayag.it/kernel-sp12in/fedora/45/kernel-sp12in.repo ``` ## Building diff --git a/config/base-aarch64.config b/config/base-aarch64.config index 8ccb3a9..c2abfef 100644 --- a/config/base-aarch64.config +++ b/config/base-aarch64.config @@ -1,10 +1,10 @@ # Fedora's own aarch64 kernel configuration, used as the starting point for -# this package. Taken verbatim from the config shipped inside -# kernel-core-7.2.0-61.fc45.aarch64.rpm: +# this package. Taken verbatim from the config shipped inside kernel-core rpm: # # dnf download kernel-core --arch aarch64 -# rpm2cpio kernel-core-*.aarch64.rpm | -# cpio -idm './usr/lib/modules/*/config' +# rpm2archive -n - < kernel-core-*.aarch64.rpm | +# tar -xO --wildcards '*/modules/*/config' | +# wl-copy # # It is vendored rather than downloaded so the build has no dependency on a # third-party host, and so the base config is reviewable in a diff when it is @@ -12,18 +12,18 @@ # top of it in %prep; do not edit this file by hand. # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 7.2.0-61.fc45.aarch64 Kernel Configuration +# Linux/arm64 7.2.8-300.fc45.aarch64 Kernel Configuration # -CONFIG_CC_VERSION_TEXT="gcc (GCC) 16.1.1 20260703 (Red Hat 16.1.1-4)" +CONFIG_CC_VERSION_TEXT="gcc (GCC) 16.2.1 20260819 (Red Hat 16.2.1-2)" CONFIG_CC_IS_GCC=y -CONFIG_GCC_VERSION=160101 +CONFIG_GCC_VERSION=160201 CONFIG_CLANG_VERSION=0 CONFIG_AS_IS_GNU=y CONFIG_AS_VERSION=20285426 CONFIG_LD_IS_BFD=y CONFIG_LD_VERSION=20285426 CONFIG_LLD_VERSION=0 -CONFIG_RUSTC_VERSION=109701 +CONFIG_RUSTC_VERSION=109801 CONFIG_RUST_IS_AVAILABLE=y CONFIG_RUSTC_LLVM_VERSION=220108 CONFIG_RUSTC_LLVM_MAJOR_VERSION=22 @@ -42,7 +42,8 @@ CONFIG_RUSTC_HAS_SPAN_FILE=y CONFIG_RUSTC_HAS_UNNECESSARY_TRANSMUTES=y CONFIG_RUSTC_HAS_FILE_WITH_NUL=y CONFIG_RUSTC_HAS_FILE_AS_C_STR=y -CONFIG_PAHOLE_VERSION=130 +CONFIG_RUSTC_HAS_SUSPICIOUS_RUNTIME_SYMBOL_DEFINITIONS=y +CONFIG_PAHOLE_VERSION=132 CONFIG_IRQ_WORK=y CONFIG_BUILDTIME_TABLE_SORT=y CONFIG_THREAD_INFO_IN_TASK=y @@ -56,7 +57,7 @@ CONFIG_INIT_ENV_ARG_LIMIT=32 CONFIG_UAPI_HEADER_TEST=y CONFIG_LOCALVERSION="" # CONFIG_LOCALVERSION_AUTO is not set -CONFIG_BUILD_SALT="7.2.0-61.fc45.aarch64" +CONFIG_BUILD_SALT="7.2.8-300.fc45.aarch64" CONFIG_HAVE_KERNEL_GZIP=y CONFIG_HAVE_KERNEL_ZSTD=y # CONFIG_KERNEL_GZIP is not set @@ -340,7 +341,7 @@ CONFIG_RUST_KUNIT_SELFTEST=y CONFIG_RUST_STR_KUNIT_TEST=y CONFIG_RUST_ATOMICS_KUNIT_TEST=y CONFIG_RUST_BITFIELD_KUNIT_TEST=y -CONFIG_RUSTC_VERSION_TEXT="rustc 1.97.1 (8bab26f4f 2026-07-14) (Fedora 1.97.1-2.fc45)" +CONFIG_RUSTC_VERSION_TEXT="rustc 1.98.1 (48a229cea 2026-09-01) (Fedora 1.98.1-1.fc45)" CONFIG_BINDGEN_VERSION_TEXT="bindgen 0.72.1" CONFIG_TRACEPOINTS=y @@ -7066,6 +7067,7 @@ CONFIG_VIDEO_IMX335=m CONFIG_VIDEO_IMX355=m CONFIG_VIDEO_IMX412=m CONFIG_VIDEO_IMX415=m +# CONFIG_VIDEO_IMX471 is not set CONFIG_VIDEO_MAX9271_LIB=m CONFIG_VIDEO_MT9M001=m # CONFIG_VIDEO_MT9M111 is not set @@ -12617,7 +12619,9 @@ CONFIG_FAT_DEFAULT_IOCHARSET="ascii" CONFIG_FAT_KUNIT_TEST=m CONFIG_EXFAT_FS=m CONFIG_EXFAT_DEFAULT_IOCHARSET="utf8" -# CONFIG_NTFS_FS is not set +CONFIG_NTFS_FS=m +# CONFIG_NTFS_DEBUG is not set +CONFIG_NTFS_FS_POSIX_ACL=y CONFIG_NTFS3_FS=m # CONFIG_NTFS3_64BIT_CLUSTER is not set CONFIG_NTFS3_LZX_XPRESS=y @@ -13229,11 +13233,9 @@ CONFIG_CRYPTO_DEV_SUN4I_SS=m CONFIG_CRYPTO_DEV_SUN8I_CE=m # CONFIG_CRYPTO_DEV_SUN8I_CE_DEBUG is not set CONFIG_CRYPTO_DEV_SUN8I_CE_HASH=y -CONFIG_CRYPTO_DEV_SUN8I_CE_PRNG=y CONFIG_CRYPTO_DEV_SUN8I_CE_TRNG=y CONFIG_CRYPTO_DEV_SUN8I_SS=m # CONFIG_CRYPTO_DEV_SUN8I_SS_DEBUG is not set -CONFIG_CRYPTO_DEV_SUN8I_SS_PRNG=y CONFIG_CRYPTO_DEV_SUN8I_SS_HASH=y CONFIG_CRYPTO_DEV_FSL_CAAM_COMMON=m CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API_DESC=m @@ -14083,9 +14085,3 @@ CONFIG_RUST_OVERFLOW_CHECKS=y CONFIG_IO_URING_ZCRX=y CONFIG_IO_URING_BPF=y CONFIG_IO_URING_BPF_OPS=y - -# -# Red Hat options -# -# CONFIG_RHEL_DIFFERENCES is not set -# end of Red Hat options diff --git a/config/foreign-socs.config b/config/foreign-socs.config new file mode 100644 index 0000000..5926d06 --- /dev/null +++ b/config/foreign-socs.config @@ -0,0 +1,68 @@ +# Config fragment turning off the ARM64 platforms this machine is not. +# +# Two platforms are deliberately kept: +# +# ARCH_QCOM what this machine is. +# ARCH_VEXPRESS cheap, and it is the ARM reference/model platform that pulls +# in the AMBA PrimeCell parts a QEMU `virt` guest expects, +# which is how an image built from this kernel can be smoke +# tested without the hardware in hand. + +# Allwinner +# CONFIG_ARCH_SUNXI is not set + +# Apple M-series +# CONFIG_ARCH_APPLE is not set + +# Broadcom, including Raspberry Pi +# CONFIG_ARCH_BCM is not set +# CONFIG_ARCH_BCM2835 is not set + +# Black Sesame +# CONFIG_ARCH_BST is not set + +# CIX +# CONFIG_ARCH_CIX is not set + +# Texas Instruments K3 +# CONFIG_ARCH_K3 is not set + +# HiSilicon +# CONFIG_ARCH_HISI is not set + +# Amlogic +# CONFIG_ARCH_MESON is not set + +# Marvell EBU +# CONFIG_ARCH_MVEBU is not set + +# NXP: i.MX, Layerscape and S32 +# CONFIG_ARCH_NXP is not set +# CONFIG_ARCH_LAYERSCAPE is not set +# CONFIG_ARCH_MXC is not set +# CONFIG_ARCH_S32 is not set + +# Renesas +# CONFIG_ARCH_RENESAS is not set + +# Rockchip +# CONFIG_ARCH_ROCKCHIP is not set + +# AMD Seattle +# CONFIG_ARCH_SEATTLE is not set + +# Socionext SynQuacer +# CONFIG_ARCH_SYNQUACER is not set + +# NVIDIA Tegra +# CONFIG_ARCH_TEGRA is not set + +# Cavium ThunderX and ThunderX2 servers +# CONFIG_ARCH_THUNDER is not set +# CONFIG_ARCH_THUNDER2 is not set + +# AppliedMicro X-Gene +# CONFIG_ARCH_XGENE is not set + +# Xilinx ZynqMP +# CONFIG_ARCH_ZYNQMP is not set diff --git a/kernel-sp12in.repo b/kernel-sp12in.repo index 226108c..fa257a2 100644 --- a/kernel-sp12in.repo +++ b/kernel-sp12in.repo @@ -1,5 +1,5 @@ [kernel-sp12in] name=kernel-sp12in for Fedora $releasever - $basearch -baseurl=https://f003.backblazeb2.com/file/dist-sayagit-fedora-rpm/fedora/$releasever/$basearch/ +baseurl=https://rpm.sayag.it/kernel-sp12in/fedora/$releasever/$basearch/ enabled=1 gpgcheck=0 diff --git a/kernel-surface.spec b/kernel-surface.spec index 5acf949..fae8dd7 100644 --- a/kernel-surface.spec +++ b/kernel-surface.spec @@ -12,7 +12,7 @@ # passes them in with --define, which takes precedence -- so keep the plain # `%%global <name> <value>` shape, which make-sources.sh reads with awk. %if %{undefined upstream_ver} -%global upstream_ver 7.2.3 +%global upstream_ver 7.2.8 %endif # Bumped whenever the patch tarball changes without the upstream version moving. @@ -56,6 +56,7 @@ Source2: base-aarch64.config Source3: surface.config Source4: live-image.config Source5: no-debug-info.config +Source6: foreign-socs.config BuildRequires: bc BuildRequires: binutils @@ -143,6 +144,18 @@ for patchdir in patches/*/; do done rm -rf patches +# The camera series calls devm_phy_get_by_of_node(), which only the phy series +# adds -- and the overlay's own 7.2.3 ebuild left phy out of its loop while +# shipping the camera patch that needs it. Applying one without the other +# compiles for twenty-odd minutes before failing in camss-csiphy.c, so assert +# the declaration is here while it is still cheap to say so. +grep -q 'devm_phy_get_by_of_node' include/linux/phy/phy.h || { + echo "ERROR: include/linux/phy/phy.h does not declare devm_phy_get_by_of_node." + echo "The camera patches need the phy ones; check phy is in patch-order.txt" + echo "and that it exists at the pinned overlay commit." + exit 1 +} + # Fold the -rcN suffix into the package release instead of carrying it in # uname -r, so the module directory is named the way Fedora names it. sed -i 's/^EXTRAVERSION[[:space:]]*=.*/EXTRAVERSION =/' Makefile @@ -158,7 +171,7 @@ CONFIG_BUILD_SALT="%{kverrel}" EOF ARCH=arm64 scripts/kconfig/merge_config.sh -m -O . \ - .config .release.config %{SOURCE3} %{SOURCE4} %{SOURCE5} + .config .release.config %{SOURCE3} %{SOURCE4} %{SOURCE5} %{SOURCE6} make ARCH=arm64 olddefconfig # merge_config.sh is only advisory about symbols it could not set, so check the @@ -180,6 +193,7 @@ test "${kernelrelease}" = "%{kverrel}" || { } %build +export KCFLAGS="-mcpu=oryon-1+nopauth" %make_build ARCH=arm64 Image modules dtbs %install @@ -205,7 +219,7 @@ install -Dm644 System.map \ install -Dm644 .config \ %{buildroot}/usr/lib/modules/%{kverrel}/config install -Dm644 arch/arm64/boot/dts/qcom/x1p42100-microsoft-sp12in.dtb \ - %{buildroot}/usr/lib/surface-dtb/x1p42100-microsoft-sp12in.dtb + %{buildroot}/usr/lib/surface-dtb/%{kverrel}/x1p42100-microsoft-sp12in.dtb %post /usr/sbin/depmod -a %{kverrel} || : @@ -227,12 +241,44 @@ fi %files %license COPYING /usr/lib/modules/%{kverrel}/ -/usr/lib/surface-dtb/x1p42100-microsoft-sp12in.dtb +/usr/lib/surface-dtb/%{kverrel}/ %ghost %attr(0644,root,root) /boot/config-%{kverrel} %ghost %attr(0644,root,root) /boot/initramfs-%{kverrel}.img %ghost %attr(0600,root,root) /boot/System.map-%{kverrel} %ghost %attr(0644,root,root) /boot/vmlinuz-%{kverrel} %changelog +* Sun Sep 27 2026 Saya Andy 7.2.8-1 +- Update Linux kernel from 7.2.6 to 7.2.8 + +* Fri Sep 18 2026 Saya Andy 7.2.6-1 +- Update Linux kernel from 7.2.4 to 7.2.6 +- Vendor the overlay master remoteproc series locally: 7.2.6 backported the + upstream attach_work rework the pinned overlay series predates +- Drop the usb femto-v2 NULL-deref patch, superseded by the runtime-PM + rework in 7.2.6 + +* Wed Sep 09 2026 Saya Andy 7.2.4-2 +- Compile kernel specifically for Oryon v1 instruction set (Snapdragon X1 cpu) + +* Tue Sep 08 2026 Saya Andy 7.2.4-1 +- Update Linux kernel from 7.2.3 to 7.2.4 + +* Mon Sep 07 2026 Saya Andy 7.2.3-4 +- Turn off all the ARM64 platform kernel modules besides qcom and vexpress + (used in qemu) +- Fix Bayer order in rear camera resulting in color space shift + +* Mon Sep 07 2026 Saya Andy 7.2.3-3 +- Key the /usr/lib/surface-dtb copy of the device tree by kernel version. This + package is installonly, so an unqualified path there conflicts between two + installed releases as soon as the device tree they build differs. + +* Sun Sep 06 2026 Saya Andy 7.2.3-2 +- Local camera patch: report the right bayer order when mirrored (fixes the + black-green monochrome output issue) +- Local surface patch: point iris at the OEM video firmware (fixes error -22 + for video encoding/decoding) + * Sun Sep 06 2026 Saya Andy 7.2.3-1 - Initial package: vanilla 7.2.3 with the overlay's Surface Pro 12" patch set diff --git a/make-sources.sh b/make-sources.sh index b4abb4b..5c11ee2 100755 --- a/make-sources.sh +++ b/make-sources.sh @@ -3,8 +3,9 @@ # Assemble the rpmbuild sources for kernel-surface.spec: # # * kernel-surface-patches-<upstream_ver>-<patchset_ver>.tar.gz, built from the -# overlay submodule's sys-kernel/vanilla-kernel/files directories listed in -# patch-order.txt +# directories listed in patch-order.txt: bare names come from the overlay +# submodule's sys-kernel/vanilla-kernel/files, "local:" ones from this +# repository's patches/ # * the upstream kernel tarball # * the base kernel config and the fragments from config/ # @@ -32,6 +33,7 @@ spec="${script_dir}/kernel-surface.spec" order_file="${script_dir}/patch-order.txt" overlay_dir=${OVERLAY_DIR:-${script_dir}/overlay} patch_root="${overlay_dir}/sys-kernel/vanilla-kernel/files" +local_patch_root="${script_dir}/patches" output_dir="" skip_download=false @@ -95,7 +97,19 @@ while read -r dir; do dir=${dir//[[:space:]]/} [[ -n ${dir} ]] || continue - src="${patch_root}/${dir}" + # "local:foo" is patches/foo in this repository, "foo" is the overlay's + # files/foo. The staging name keeps the prefix so the tarball, and the + # spec's "Applying ..." log, say where each patch came from. + if [[ ${dir} == local:* ]]; then + name=${dir#local:} + src="${local_patch_root}/${name}" + label="local-${name}" + else + name=${dir} + src="${patch_root}/${name}" + label=${name} + fi + if [[ ! -d ${src} ]]; then echo "ERROR: ${src} does not exist (listed in patch-order.txt)" >&2 exit 1 @@ -107,11 +121,11 @@ while read -r dir; do exit 1 fi - dest=$(printf '%s/patches/%02d-%s' "${staging}" "${index}" "${dir}") + dest=$(printf '%s/patches/%02d-%s' "${staging}" "${index}" "${label}") mkdir -p "${dest}" cp "${src}"/*.patch "${dest}/" - printf ' %02d %-12s %2d patches\n' "${index}" "${dir}" "${count}" + printf ' %02d %-18s %2d patches\n' "${index}" "${label}" "${count}" index=$((index + 1)) total=$((total + count)) done < "${order_file}" @@ -125,10 +139,10 @@ echo "${tarball} (${index} directories, ${total} patches)" #-------------------------------------- # Base config and fragments #-------------------------------------- -for cfg in base-aarch64 surface live-image no-debug-info; do +for cfg in base-aarch64 surface live-image no-debug-info foreign-socs; do cp "${script_dir}/config/${cfg}.config" "${output_dir}/${cfg}.config" done -echo "${output_dir}/{base-aarch64,surface,live-image,no-debug-info}.config" +echo "${output_dir}/{base-aarch64,surface,live-image,no-debug-info,foreign-socs}.config" if [[ ${skip_download} == true ]]; then exit 0 diff --git a/patch-order.txt b/patch-order.txt index 334f847..484a5df 100644 --- a/patch-order.txt +++ b/patch-order.txt @@ -1,20 +1,38 @@ -# Patch directories under the Gentoo overlay's sys-kernel/vanilla-kernel/files, -# in application order. +# Patch directories in application order. +# +# A bare name is a directory under the Gentoo overlay's +# sys-kernel/vanilla-kernel/files. A "local:" prefix means patches/<name> in +# this repository, for fixes the overlay does not carry yet -- or, for +# remoteproc and usb below, a newer copy of the overlay's own series: the +# pinned overlay commit predates the upstream attach_work (remoteproc) and +# runtime-PM (femto phy) reworks that stable backported into 7.2.6, and its +# patches no longer apply. The local copies come from overlay master +# (089d5857), which is rebased onto that world, with three adjustments: +# - 0011 qcom_q6v5_pas adapted to the qcom_pas_shutdown -> +# qcom_scm_pas_shutdown rename in 7.2.6 +# - the qrtr smd race fix dropped here; the pinned overlay's wifi/0004 +# carries the identical patch and applies it at its usual position +# - usb/0019 (femto NULL deref) dropped, superseded by the runtime-PM +# rework already in 7.2.6 # # This mirrors the loop in vanilla-kernel-7.2.3.ebuild's src_prepare(), minus -# rockchip (irrelevant). There is no phy directory at this overlay commit; the -# CSI-2 D-PHY driver is part of the camera series here. +# rockchip (irrelevant), plus phy -- which that ebuild leaves out even though it +# ships the camera patch that calls devm_phy_get_by_of_node(). Without phy the +# build dies in camss-csiphy.c; only the 7.3_rc1 ebuild wired phy into its loop. other audio clk pci -remoteproc +local:remoteproc gpu -usb +local:usb video wifi input el2 +phy camera +local:camera irq surface +local:surface diff --git a/patches/camera/0027-media-i2c-ov13858-fix-bayer-order-when-mirrored.patch b/patches/camera/0027-media-i2c-ov13858-fix-bayer-order-when-mirrored.patch new file mode 100644 index 0000000..d465f8d --- /dev/null +++ b/patches/camera/0027-media-i2c-ov13858-fix-bayer-order-when-mirrored.patch @@ -0,0 +1,142 @@ +media: i2c: ov13858: report the right bayer order + +The driver advertises MEDIA_BUS_FMT_SGRBG10_1X10 unconditionally, but that is +not what the sensor delivers in any flip state on the Surface Pro 12in. The +horizontal mirror moves the Bayer phase by one column, and the native order is +GBRG rather than GRBG, so the two correct codes are GBRG unmirrored and BGGR +mirrored. + +The rear ov13858 is mounted upside down (rotation = <180> in DT), so userspace +enables both flips to compensate and every frame is then debayered as RGGB +while the sensor emits BGGR. Red and blue are exchanged: an orange object comes +out cyan, warm wood comes out blue, while neutrals are unaffected, which is +what makes it easy to mistake for a white balance problem. + +Two measurements on a Surface Pro 12in, from raw frames captured off the CAMSS +RDI video node. The first locates the green pair by comparing the mean absolute +difference of the diagonal against the antidiagonal samples of each 2x2 quad, +the two greens correlating far better than red against blue: + + hflip=0 vflip=0 diagonal 8.65 antidiagonal 56.82 -> greens diagonal + hflip=1 vflip=0 diagonal 56.25 antidiagonal 8.34 -> greens antidiagonal + hflip=0 vflip=1 diagonal 13.21 antidiagonal 55.94 -> greens diagonal + hflip=1 vflip=1 diagonal 56.04 antidiagonal 13.16 -> greens antidiagonal + +So only the horizontal mirror moves the phase; the ISP Y window offset written +for VFLIP compensates the vertical one. + +That test cannot tell red from blue, because GBRG and GRBG share a green +diagonal just as BGGR and RGGB share a green antidiagonal. Resolving the +remaining ambiguity needs colour: a scene of objects with known colour was +captured in all four states, and the red channel identified as the one whose +ratio to blue matches the scene. The rejected assignment is the reciprocal, so +the margin is large: + + hflip=0 vflip=0 R/B 1.651 (reciprocal 0.606) -> GBRG + hflip=0 vflip=1 R/B 1.622 (reciprocal 0.616) -> GBRG + hflip=1 vflip=0 R/B 1.651 (reciprocal 0.606) -> BGGR + hflip=1 vflip=1 R/B 1.625 (reciprocal 0.615) -> BGGR + +Derive the media bus code from HFLIP and tag the control with +V4L2_CTRL_FLAG_MODIFY_LAYOUT so userspace knows to renegotiate the format after +toggling it. + +The native order disagreeing with upstream is suspicious in itself. The removal +of the per-mode {0x3811, 0x04} and {0x3813, 0x05} ISP window offsets in +"media: i2c: ov13858: add rotate control support", which now writes 1 or 2 into +those registers from the flip handlers, changes the X parity, and that patch +also sets BIT(3) of ROTATE_CONTROL when HFLIP is clear while VFLIP sets BIT(4) +when set. Whether the phase should instead be corrected there is left alone +here: this patch only reports what the sensor is measured to emit. + +--- a/drivers/media/i2c/ov13858.c ++++ b/drivers/media/i2c/ov13858.c +@@ -1032,6 +1032,7 @@ + struct v4l2_ctrl *vblank; + struct v4l2_ctrl *hblank; + struct v4l2_ctrl *exposure; ++ struct v4l2_ctrl *hflip; + + struct clk *img_clk; + struct gpio_desc *reset_gpio; +@@ -1222,8 +1223,10 @@ + OV13858_DGTL_GAIN_MIN, OV13858_DGTL_GAIN_MAX, + OV13858_DGTL_GAIN_STEP, OV13858_DGTL_GAIN_DEFAULT); + +- v4l2_ctrl_new_std(ctrl_hdlr, &ov13858_ctrl_ops, V4L2_CID_HFLIP, +- 0, 1, 1, 0); ++ ov13858->hflip = v4l2_ctrl_new_std(ctrl_hdlr, &ov13858_ctrl_ops, ++ V4L2_CID_HFLIP, 0, 1, 1, 0); ++ if (ov13858->hflip) ++ ov13858->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT; + + v4l2_ctrl_new_std(ctrl_hdlr, &ov13858_ctrl_ops, V4L2_CID_VFLIP, + 0, 1, 1, 0); +@@ -1258,12 +1261,24 @@ + return ret; + } + +-static void ov13858_update_pad_format(const struct ov13858_mode *mode, ++/* ++ * Mirroring shifts the Bayer phase by one column, so the native GBRG order ++ * becomes BGGR. The vertical flip is compensated by the ISP Y window offset ++ * and leaves the order alone. ++ */ ++static u32 ov13858_get_format_code(struct ov13858 *ov13858) ++{ ++ return ov13858->hflip->val ? MEDIA_BUS_FMT_SBGGR10_1X10 ++ : MEDIA_BUS_FMT_SGBRG10_1X10; ++} ++ ++static void ov13858_update_pad_format(struct ov13858 *ov13858, ++ const struct ov13858_mode *mode, + struct v4l2_mbus_framefmt *fmt) + { + fmt->width = mode->width; + fmt->height = mode->height; +- fmt->code = MEDIA_BUS_FMT_SGRBG10_1X10; ++ fmt->code = ov13858_get_format_code(ov13858); + fmt->field = V4L2_FIELD_NONE; + } + +@@ -1418,7 +1433,7 @@ + ARRAY_SIZE(supported_modes), + width, height, + fmt->format.width, fmt->format.height); +- ov13858_update_pad_format(mode, &fmt->format); ++ ov13858_update_pad_format(ov13858, mode, &fmt->format); + *v4l2_subdev_state_get_format(sd_state, fmt->pad) = fmt->format; + + if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) +@@ -1453,11 +1468,11 @@ + struct v4l2_subdev_state *sd_state, + struct v4l2_subdev_mbus_code_enum *code) + { +- /* Only one bayer order(GRBG) is supported */ ++ /* Only one bayer order is supported, which one depends on the mirror */ + if (code->index > 0) + return -EINVAL; + +- code->code = MEDIA_BUS_FMT_SGRBG10_1X10; ++ code->code = ov13858_get_format_code(to_ov13858(sd)); + + return 0; + } +@@ -1469,7 +1484,7 @@ + if (fse->index >= ARRAY_SIZE(supported_modes)) + return -EINVAL; + +- if (fse->code != MEDIA_BUS_FMT_SGRBG10_1X10) ++ if (fse->code != ov13858_get_format_code(to_ov13858(sd))) + return -EINVAL; + + fse->min_width = supported_modes[fse->index].width; +@@ -1520,7 +1535,7 @@ + { + struct ov13858 *ov13858 = to_ov13858(sd); + +- ov13858_update_pad_format(ov13858->cur_mode, ++ ov13858_update_pad_format(ov13858, ov13858->cur_mode, + v4l2_subdev_state_get_format(sd_state, 0)); + + return 0; diff --git a/patches/remoteproc/0002-soc-qcom-smp2p-Ensure-there-is-enough-space-for-outb.patch b/patches/remoteproc/0002-soc-qcom-smp2p-Ensure-there-is-enough-space-for-outb.patch new file mode 100644 index 0000000..49e7de3 --- /dev/null +++ b/patches/remoteproc/0002-soc-qcom-smp2p-Ensure-there-is-enough-space-for-outb.patch @@ -0,0 +1,25 @@ +The SMP2P SMEM item has limited space for outbound entries, but the DT can +specify any number of entries. Add a check to prevent out of bounds writes +when an invalid DT specifies more entries than expected. + +Fixes: 50e99641413e ("soc: qcom: smp2p: Qualcomm Shared Memory Point to Point") +Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org> +Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com> +--- + drivers/soc/qcom/smp2p.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/soc/qcom/smp2p.c b/drivers/soc/qcom/smp2p.c +index 1ea4d35c6..876648d0b 100644 +--- a/drivers/soc/qcom/smp2p.c ++++ b/drivers/soc/qcom/smp2p.c +@@ -441,6 +441,9 @@ static int qcom_smp2p_outbound_entry(struct qcom_smp2p *smp2p, + struct smp2p_smem_item *out = smp2p->out; + char buf[SMP2P_MAX_ENTRY_NAME] = {}; + ++ if (out->valid_entries == out->total_entries) ++ return -ENOMEM; ++ + /* Allocate an entry from the smem item */ + strscpy(buf, entry->name, SMP2P_MAX_ENTRY_NAME); + memcpy(out->entries[out->valid_entries].name, buf, SMP2P_MAX_ENTRY_NAME); diff --git a/patches/remoteproc/0003-soc-qcom-smp2p-Use-length-limited-strncmp-for-compar.patch b/patches/remoteproc/0003-soc-qcom-smp2p-Use-length-limited-strncmp-for-compar.patch new file mode 100644 index 0000000..7bbb199 --- /dev/null +++ b/patches/remoteproc/0003-soc-qcom-smp2p-Use-length-limited-strncmp-for-compar.patch @@ -0,0 +1,24 @@ +A rogue (or broken) remoteproc might not null-terminate its entry names. +Use strncmp() instead of strcmp() to avoid making out of bounds accesses in +that situation. + +Fixes: 50e99641413e ("soc: qcom: smp2p: Qualcomm Shared Memory Point to Point") +Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org> +Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com> +--- + drivers/soc/qcom/smp2p.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/qcom/smp2p.c b/drivers/soc/qcom/smp2p.c +index 876648d0b..dcf222b19 100644 +--- a/drivers/soc/qcom/smp2p.c ++++ b/drivers/soc/qcom/smp2p.c +@@ -238,7 +238,7 @@ static void qcom_smp2p_notify_in(struct qcom_smp2p *smp2p) + for (i = smp2p->valid_entries; i < in->valid_entries; i++) { + list_for_each_entry(entry, &smp2p->inbound, node) { + memcpy(buf, in->entries[i].name, sizeof(buf)); +- if (!strcmp(buf, entry->name)) { ++ if (!strncmp(buf, entry->name, SMP2P_MAX_ENTRY_NAME)) { + entry->value = &in->entries[i].value; + break; + } diff --git a/patches/remoteproc/0004-soc-qcom-smp2p-Drop-redundant-stack-copies-of-entry-.patch b/patches/remoteproc/0004-soc-qcom-smp2p-Drop-redundant-stack-copies-of-entry-.patch new file mode 100644 index 0000000..a672ad3 --- /dev/null +++ b/patches/remoteproc/0004-soc-qcom-smp2p-Drop-redundant-stack-copies-of-entry-.patch @@ -0,0 +1,58 @@ +For the purposes of this driver, a char is always going to be the same size +as an u8, so we can access the entry names directly instead of making a +copy on the stack. Several other Qualcomm-related drivers use char directly +in such binary structs as well (e.g. qcom_battmgr). + +Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org> +Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com> +--- + drivers/soc/qcom/smp2p.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/soc/qcom/smp2p.c b/drivers/soc/qcom/smp2p.c +index dcf222b19..176fce4cf 100644 +--- a/drivers/soc/qcom/smp2p.c ++++ b/drivers/soc/qcom/smp2p.c +@@ -73,7 +73,7 @@ struct smp2p_smem_item { + u32 flags; + + struct { +- u8 name[SMP2P_MAX_ENTRY_NAME]; ++ char name[SMP2P_MAX_ENTRY_NAME]; + u32 value; + } entries[SMP2P_MAX_ENTRY]; + } __packed; +@@ -228,7 +228,6 @@ static void qcom_smp2p_notify_in(struct qcom_smp2p *smp2p) + struct smp2p_entry *entry; + int irq_pin; + u32 status; +- char buf[SMP2P_MAX_ENTRY_NAME]; + u32 val; + int i; + +@@ -237,8 +236,7 @@ static void qcom_smp2p_notify_in(struct qcom_smp2p *smp2p) + /* Match newly created entries */ + for (i = smp2p->valid_entries; i < in->valid_entries; i++) { + list_for_each_entry(entry, &smp2p->inbound, node) { +- memcpy(buf, in->entries[i].name, sizeof(buf)); +- if (!strncmp(buf, entry->name, SMP2P_MAX_ENTRY_NAME)) { ++ if (!strncmp(in->entries[i].name, entry->name, SMP2P_MAX_ENTRY_NAME)) { + entry->value = &in->entries[i].value; + break; + } +@@ -439,14 +437,12 @@ static int qcom_smp2p_outbound_entry(struct qcom_smp2p *smp2p, + struct device_node *node) + { + struct smp2p_smem_item *out = smp2p->out; +- char buf[SMP2P_MAX_ENTRY_NAME] = {}; + + if (out->valid_entries == out->total_entries) + return -ENOMEM; + + /* Allocate an entry from the smem item */ +- strscpy(buf, entry->name, SMP2P_MAX_ENTRY_NAME); +- memcpy(out->entries[out->valid_entries].name, buf, SMP2P_MAX_ENTRY_NAME); ++ strscpy(out->entries[out->valid_entries].name, entry->name, SMP2P_MAX_ENTRY_NAME); + + /* Make the logical entry reference the physical value */ + entry->value = &out->entries[out->valid_entries].value; diff --git a/patches/remoteproc/0005-rpmsg-core-Call-announce_destroy-only-after-announce.patch b/patches/remoteproc/0005-rpmsg-core-Call-announce_destroy-only-after-announce.patch new file mode 100644 index 0000000..94bfd26 --- /dev/null +++ b/patches/remoteproc/0005-rpmsg-core-Call-announce_destroy-only-after-announce.patch @@ -0,0 +1,26 @@ +rpmsg_dev_probe() calls rpdev->ops->announce_create() only when the driver +specifies a callback and an endpoint was opened, but rpmsg_dev_remove() +calls announce_destroy() unconditionally. Fix this by adding the missing +check. + +Cc: stable@vger.kernel.org +Fixes: 7586516ca043 ("rpmsg: Only invoke announce_create for rpdev with endpoints") +Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org> +Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com> +--- + drivers/rpmsg/rpmsg_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c +index 5d661681a..fb444dc2f 100644 +--- a/drivers/rpmsg/rpmsg_core.c ++++ b/drivers/rpmsg/rpmsg_core.c +@@ -533,7 +533,7 @@ static void rpmsg_dev_remove(struct device *dev) + struct rpmsg_device *rpdev = to_rpmsg_device(dev); + struct rpmsg_driver *rpdrv = to_rpmsg_driver(rpdev->dev.driver); + +- if (rpdev->ops->announce_destroy) ++ if (rpdev->ept && rpdev->ops->announce_destroy) + rpdev->ops->announce_destroy(rpdev); + + if (rpdrv->remove) diff --git a/patches/remoteproc/0006-rpmsg-core-Make-it-easier-to-manually-create-endpoin.patch b/patches/remoteproc/0006-rpmsg-core-Make-it-easier-to-manually-create-endpoin.patch new file mode 100644 index 0000000..9aac845 --- /dev/null +++ b/patches/remoteproc/0006-rpmsg-core-Make-it-easier-to-manually-create-endpoin.patch @@ -0,0 +1,166 @@ +Currently, the rpmsg core automatically creates an endpoint for rpmsg +drivers that specify a receive callback. This works "somewhat" in most +simple cases, but it is often prone to race conditions: The receive +callback can be called as soon and as long as the endpoint is open, so +drivers must be prepared to handle calls to the receive callback: + + - Before their probe() function is called + (after the endpoint was created) + - In parallel to their probe() function + - In parallel to their remove() function + - After their remove() function is called + (before the endpoint is destroyed) + +It is difficult for drivers to handle this without being able to run code +before endpoint creation and after endpoint destruction. Also, they may +need to hold locks while creating/destroying the endpoint to handle edge +cases reliably. + +Drivers can already create endpoints manually by omitting the receive +callback in rpmsg_driver, but for most simple cases where there is only +a single channel, the boilerplate required for that is a bit cumbersome. + +Add a rpmsg_dev_open_ept() function that can be called by drivers during +the probe() function. It results in effectively the same that the rpmsg +core would normally do if the receive callback is specified. +announce_create() and announce_destroy() are still handled by the rpmsg +core. During remove(), the drivers can directly call rpmsg_destroy_ept(). + +Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org> +Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com> +--- + drivers/rpmsg/rpmsg_core.c | 51 +++++++++++++++++++++++++++----------- + include/linux/rpmsg.h | 12 +++++++++ + 2 files changed, 49 insertions(+), 14 deletions(-) + +diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c +index 6783d04b591dd1..896fb8a3a4f5f4 100644 +--- a/drivers/rpmsg/rpmsg_core.c ++++ b/drivers/rpmsg/rpmsg_core.c +@@ -95,6 +95,14 @@ EXPORT_SYMBOL(rpmsg_release_channel); + * equals to the src address of their rpmsg channel), the driver's handler + * is invoked to process it. + * ++ * Note that the endpoint for simple rpmsg drivers is created before calling ++ * probe() and closed after calling remove(), so special care must be taken ++ * to handle calls to the rx callback before/in parallel of probe() and ++ * after/in parallel of remove(). If more control over the endpoint creation ++ * is required to avoid race conditions, drivers can omit the callback and ++ * explicitly call rpmsg_dev_open_ept() in probe() and rpmsg_destroy_ept() in ++ * remove(), together with locks as needed. ++ * + * That said, more complicated drivers might need to allocate + * additional rpmsg addresses, and bind them to different rx callbacks. + * To accomplish that, those drivers need to call this function. +@@ -451,6 +459,32 @@ static int rpmsg_uevent(const struct device *dev, struct kobj_uevent_env *env) + rpdev->id.name); + } + ++struct rpmsg_endpoint *rpmsg_dev_open_ept(struct rpmsg_device *rpdev, ++ rpmsg_rx_cb_t cb, void *priv) ++{ ++ struct rpmsg_driver *rpdrv = to_rpmsg_driver(rpdev->dev.driver); ++ struct rpmsg_channel_info chinfo = { ++ .src = rpdev->src, ++ .dst = RPMSG_ADDR_ANY, ++ }; ++ struct rpmsg_endpoint *ept; ++ ++ strscpy(chinfo.name, rpdev->id.name, sizeof(chinfo.name)); ++ ++ ept = rpmsg_create_ept(rpdev, cb, priv, chinfo); ++ if (!ept) { ++ dev_err(&rpdev->dev, "failed to create endpoint\n"); ++ return NULL; ++ } ++ ++ rpdev->ept = ept; ++ rpdev->src = ept->addr; ++ ++ ept->flow_cb = rpdrv->flowcontrol; ++ return ept; ++} ++EXPORT_SYMBOL(rpmsg_dev_open_ept); ++ + /* + * when an rpmsg driver is probed with a channel, we seamlessly create + * it an endpoint, binding its rx callback to a unique local rpmsg +@@ -463,7 +497,6 @@ static int rpmsg_dev_probe(struct device *dev) + { + struct rpmsg_device *rpdev = to_rpmsg_device(dev); + struct rpmsg_driver *rpdrv = to_rpmsg_driver(rpdev->dev.driver); +- struct rpmsg_channel_info chinfo = {}; + struct rpmsg_endpoint *ept = NULL; + int err; + +@@ -473,21 +506,11 @@ static int rpmsg_dev_probe(struct device *dev) + goto out; + + if (rpdrv->callback) { +- strscpy(chinfo.name, rpdev->id.name, sizeof(chinfo.name)); +- chinfo.src = rpdev->src; +- chinfo.dst = RPMSG_ADDR_ANY; +- +- ept = rpmsg_create_ept(rpdev, rpdrv->callback, NULL, chinfo); ++ ept = rpmsg_dev_open_ept(rpdev, rpdrv->callback, NULL); + if (!ept) { +- dev_err(dev, "failed to create endpoint\n"); + err = -ENOMEM; + goto out; + } +- +- rpdev->ept = ept; +- rpdev->src = ept->addr; +- +- ept->flow_cb = rpdrv->flowcontrol; + } + + err = rpdrv->probe(rpdev); +@@ -496,7 +519,7 @@ static int rpmsg_dev_probe(struct device *dev) + goto destroy_ept; + } + +- if (ept && rpdev->ops->announce_create) { ++ if (rpdev->ept && rpdev->ops->announce_create) { + err = rpdev->ops->announce_create(rpdev); + if (err) { + dev_err(dev, "failed to announce creation\n"); +@@ -527,7 +550,7 @@ static void rpmsg_dev_remove(struct device *dev) + if (rpdrv->remove) + rpdrv->remove(rpdev); + +- if (rpdev->ept) ++ if (rpdrv->callback && rpdev->ept) + rpmsg_destroy_ept(rpdev->ept); + } + +diff --git a/include/linux/rpmsg.h b/include/linux/rpmsg.h +index 83266ce1464204..c3719703553c0a 100644 +--- a/include/linux/rpmsg.h ++++ b/include/linux/rpmsg.h +@@ -181,6 +181,8 @@ void rpmsg_destroy_ept(struct rpmsg_endpoint *); + struct rpmsg_endpoint *rpmsg_create_ept(struct rpmsg_device *, + rpmsg_rx_cb_t cb, void *priv, + struct rpmsg_channel_info chinfo); ++struct rpmsg_endpoint *rpmsg_dev_open_ept(struct rpmsg_device *rpdev, ++ rpmsg_rx_cb_t cb, void *priv); + + int rpmsg_send(struct rpmsg_endpoint *ept, const void *data, int len); + int rpmsg_sendto(struct rpmsg_endpoint *ept, const void *data, int len, u32 dst); +@@ -249,6 +251,16 @@ static inline struct rpmsg_endpoint *rpmsg_create_ept(struct rpmsg_device *rpdev + return NULL; + } + ++static inline struct rpmsg_endpoint *rpmsg_dev_open_ept(struct rpmsg_device *rpdev, ++ rpmsg_rx_cb_t cb, ++ void *priv) ++{ ++ /* This shouldn't be possible */ ++ WARN_ON(1); ++ ++ return NULL; ++} ++ + static inline int rpmsg_send(struct rpmsg_endpoint *ept, const void *data, int len) + { + /* This shouldn't be possible */ diff --git a/patches/remoteproc/0007-soc-qcom-smp2p-Take-over-outgoing-SMEM-items-from-bo.patch b/patches/remoteproc/0007-soc-qcom-smp2p-Take-over-outgoing-SMEM-items-from-bo.patch new file mode 100644 index 0000000..7e236fc --- /dev/null +++ b/patches/remoteproc/0007-soc-qcom-smp2p-Take-over-outgoing-SMEM-items-from-bo.patch @@ -0,0 +1,223 @@ +On some platforms (e.g. X1E), the boot firmware already starts some of the +remoteprocs with a "lite" firmware. This firmware is left running when +Linux gets started. In this situation, the smp2p driver currently fully +reinitializes the outgoing SMEM item and ignores the incoming SMEM state +until the first incoming interrupt. This has worked fine so far, but has +also has limitations: + + - The initial state of the incoming SMEM item is not captured, so we + might miss falling edges reported by the first incoming interrupt. + + - If the SMP2P driver of the remoteproc is implemented similar to the + Linux driver, it might cache addresses of the incoming SMP2P entries, + but there is no guarantee that we allocate them in the same order as the + boot firmware. + + - We may inadvertently send an unexpected SSR ACK, if the boot firmware + had the restart ack bit set before. + +Implement a more smoother form of handover by reusing the existing outgoing +SMP2P item if it matches our expectation. Reuse outgoing entries if they +already exist. Read the initial incoming state and take over the SSR state. + +Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org> +Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com> +--- + drivers/soc/qcom/smp2p.c | 102 +++++++++++++++++++++++++++------------ + 1 file changed, 71 insertions(+), 31 deletions(-) + +diff --git a/drivers/soc/qcom/smp2p.c b/drivers/soc/qcom/smp2p.c +index 9b1074c8c8065c..e94388f7aded6b 100644 +--- a/drivers/soc/qcom/smp2p.c ++++ b/drivers/soc/qcom/smp2p.c +@@ -36,10 +36,6 @@ + * The driver uses the Linux GPIO and interrupt framework to expose a virtual + * GPIO for each outbound entry and a virtual interrupt controller for each + * inbound entry. +- * +- * V2 of SMP2P allows remote processors to write to outbound smp2p items before +- * the full smp2p connection is negotiated. This is important for processors +- * started before linux runs. + */ + + #define SMP2P_MAX_ENTRY 16 +@@ -215,8 +211,6 @@ static void qcom_smp2p_do_ssr_ack(struct qcom_smp2p *smp2p) + if (smp2p->ssr_ack) + val |= BIT(SMP2P_FLAGS_RESTART_ACK_BIT); + out->flags = val; +- +- qcom_smp2p_kick(smp2p); + } + + static void qcom_smp2p_negotiate(struct qcom_smp2p *smp2p) +@@ -227,8 +221,10 @@ static void qcom_smp2p_negotiate(struct qcom_smp2p *smp2p) + if (in->version == out->version) { + out->features &= in->features; + +- if (out->features & SMP2P_FEATURE_SSR_ACK) ++ if (out->features & SMP2P_FEATURE_SSR_ACK) { + smp2p->ssr_ack_enabled = true; ++ smp2p->ssr_ack = !!(out->flags & BIT(SMP2P_FLAGS_RESTART_ACK_BIT)); ++ } + + smp2p->negotiation_done = true; + trace_smp2p_negotiate(smp2p->dev, out->features); +@@ -337,6 +333,24 @@ static void qcom_smp2p_notify_in(struct qcom_smp2p *smp2p) + } + } + ++static bool qcom_smp2p_scan(struct qcom_smp2p *smp2p) ++{ ++ bool ack_restart = false; ++ ++ if (!smp2p->negotiation_done) ++ qcom_smp2p_negotiate(smp2p); ++ ++ if (smp2p->negotiation_done) { ++ ack_restart = qcom_smp2p_check_ssr(smp2p); ++ qcom_smp2p_notify_in(smp2p); ++ ++ if (ack_restart) ++ qcom_smp2p_do_ssr_ack(smp2p); ++ } ++ ++ return ack_restart; ++} ++ + /** + * qcom_smp2p_intr() - interrupt handler for incoming notifications + * @irq: unused +@@ -370,16 +384,8 @@ static irqreturn_t qcom_smp2p_intr(int irq, void *data) + smp2p->in = in; + } + +- if (!smp2p->negotiation_done) +- qcom_smp2p_negotiate(smp2p); +- +- if (smp2p->negotiation_done) { +- ack_restart = qcom_smp2p_check_ssr(smp2p); +- qcom_smp2p_notify_in(smp2p); +- +- if (ack_restart) +- qcom_smp2p_do_ssr_ack(smp2p); +- } ++ if (qcom_smp2p_scan(smp2p)) ++ qcom_smp2p_kick(smp2p); + + out: + return IRQ_HANDLED; +@@ -519,17 +525,24 @@ static int qcom_smp2p_outbound_entry(struct qcom_smp2p *smp2p, + struct device_node *node) + { + struct smp2p_smem_item *out = smp2p->out; ++ int i; + +- if (out->valid_entries == out->total_entries) +- return -ENOMEM; ++ /* Check if we have an entry already (e.g. allocated by boot firmware) */ ++ for (i = 0; i < out->valid_entries; i++) ++ if (!strncmp(out->entries[i].name, entry->name, SMP2P_MAX_ENTRY_NAME)) ++ break; + +- /* Allocate an entry from the smem item */ +- strscpy(out->entries[out->valid_entries].name, entry->name, SMP2P_MAX_ENTRY_NAME); ++ if (i == out->valid_entries) { ++ /* Allocate an entry from the smem item */ ++ if (i == out->total_entries) ++ return -ENOMEM; + +- /* Make the logical entry reference the physical value */ +- entry->value = &out->entries[out->valid_entries].value; ++ strscpy(out->entries[i].name, entry->name, SMP2P_MAX_ENTRY_NAME); ++ out->valid_entries++; ++ } + +- out->valid_entries++; ++ /* Make the logical entry reference the physical value */ ++ entry->value = &out->entries[i].value; + + entry->state = qcom_smem_state_register(node, &smp2p_state_ops, entry); + if (IS_ERR(entry->state)) { +@@ -559,6 +572,29 @@ static int qcom_smp2p_alloc_outbound_item(struct qcom_smp2p *smp2p) + return PTR_ERR(out); + } + ++ smp2p->out = out; ++ ++ if (ret == -EEXIST && smp2p->in) { ++ if (out->magic == SMP2P_MAGIC && ++ out->version == 1 && ++ out->local_pid == smp2p->local_pid && ++ out->remote_pid == smp2p->remote_pid && ++ out->total_entries >= SMP2P_MAX_ENTRY && ++ out->valid_entries <= out->total_entries) { ++ /* ++ * Reuse existing smem item, but adjust features to ++ * what we support. This will be updated later when we ++ * negotiate with the features of the remote side. ++ */ ++ out->features = SMP2P_ALL_FEATURES; ++ return 0; ++ } else { ++ dev_warn(smp2p->dev, "Unexpected local smp2p item allocated by firmware, resetting. " ++ "(magic: %#x, version: %d, local_pid: %d, remote_pid: %d, total_entries: %d, valid_entries: %d)\n", ++ out->magic, out->version, out->local_pid, out->remote_pid, out->total_entries, out->valid_entries); ++ } ++ } ++ + memset(out, 0, sizeof(*out)); + out->magic = SMP2P_MAGIC; + out->local_pid = smp2p->local_pid; +@@ -585,8 +621,6 @@ static int qcom_smp2p_alloc_outbound_item(struct qcom_smp2p *smp2p) + + qcom_smp2p_kick(smp2p); + +- smp2p->out = out; +- + return 0; + } + +@@ -626,6 +660,7 @@ static int smp2p_parse_ipc(struct qcom_smp2p *smp2p) + + static int qcom_smp2p_probe(struct platform_device *pdev) + { ++ struct smp2p_smem_item *in; + struct smp2p_entry *entry; + struct qcom_smp2p *smp2p; + const char *key; +@@ -676,6 +711,10 @@ static int qcom_smp2p_probe(struct platform_device *pdev) + return ret; + } + ++ in = qcom_smem_get(smp2p->remote_pid, smp2p->smem_items[SMP2P_INBOUND], NULL); ++ if (!IS_ERR(in)) ++ smp2p->in = in; ++ + ret = qcom_smp2p_alloc_outbound_item(smp2p); + if (ret < 0) + goto release_mbox; +@@ -709,11 +748,9 @@ static int qcom_smp2p_probe(struct platform_device *pdev) + } + } + +- /* Check inbound entries in the case of early boot processor */ +- qcom_smp2p_start_in(smp2p); +- +- /* Kick the outgoing edge after allocating entries */ +- qcom_smp2p_kick(smp2p); ++ if (smp2p->in) ++ /* Ignore return status since we kick unconditionally below */ ++ qcom_smp2p_scan(smp2p); + + ret = devm_request_threaded_irq(&pdev->dev, irq, + NULL, qcom_smp2p_intr, +@@ -724,6 +761,9 @@ static int qcom_smp2p_probe(struct platform_device *pdev) + goto unwind_interfaces; + } + ++ /* Kick the outgoing edge after allocating entries */ ++ qcom_smp2p_kick(smp2p); ++ + /* + * Treat smp2p interrupt as wakeup source, but keep it disabled + * by default. User space can decide enabling it depending on its diff --git a/patches/remoteproc/0008-remoteproc-qcom_q6v5_pas-Add-early_boot-to-x1e80100-cdsp-adsp.patch b/patches/remoteproc/0008-remoteproc-qcom_q6v5_pas-Add-early_boot-to-x1e80100-cdsp-adsp.patch new file mode 100644 index 0000000..950687e --- /dev/null +++ b/patches/remoteproc/0008-remoteproc-qcom_q6v5_pas-Add-early_boot-to-x1e80100-cdsp-adsp.patch @@ -0,0 +1,18 @@ +--- a/drivers/remoteproc/qcom_q6v5_pas.c 2026-09-07 00:07:20.000000000 +0200 ++++ b/drivers/remoteproc/qcom_q6v5_pas.c 2026-09-11 17:05:48.858145807 +0200 +@@ -1249,6 +1249,7 @@ + .lite_dtb_pas_id = 0x29, + .minidump_id = 5, + .auto_boot = true, ++ .early_boot = true, + .proxy_pd_names = (char*[]){ + "lcx", + "lmx", +@@ -1268,6 +1269,7 @@ + .dtb_pas_id = 0x25, + .minidump_id = 7, + .auto_boot = true, ++ .early_boot = true, + .proxy_pd_names = (char*[]){ + "cx", + "mxc", diff --git a/patches/remoteproc/0009-remoteproc-core-Allow-restarting-detached-remoteproc.patch b/patches/remoteproc/0009-remoteproc-core-Allow-restarting-detached-remoteproc.patch new file mode 100644 index 0000000..47f81de --- /dev/null +++ b/patches/remoteproc/0009-remoteproc-core-Allow-restarting-detached-remoteproc.patch @@ -0,0 +1,349 @@ +At the moment, the remoteproc core supports only one auto boot "strategy": +A remoteproc that is already running during boot ("detached") is attached, +a remoteproc that is offline is started after loading the firmware. This +works if the firmware loaded during boot is the same that we would start +later, but it could also be outdated or a reduced size version that is +missing some functionality. In this case, the best option is to try +restarting it with new firmware - assuming that it is available while +booting. + +Add support for this alternative behavior by replacing the "auto_boot" bool +with a more explicit enum rproc_auto_boot. + +For RPROC_AUTO_BOOT_RESTART_IF_FW_AVAILABLE, try requesting the firmware +early and - if successful - perform a clean stop of the remoteproc so that +it can be restarted with the new firmware afterwards. A remoteproc driver +making use of this functionality must handle the stop() callback being +called during the initial detached state. + +Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org> +Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com> +--- + drivers/remoteproc/imx_rproc.c | 8 +++-- + drivers/remoteproc/ingenic_rproc.c | 5 ++- + drivers/remoteproc/pru_rproc.c | 2 +- + drivers/remoteproc/qcom_q6v5_adsp.c | 5 ++- + drivers/remoteproc/qcom_q6v5_mss.c | 2 +- + drivers/remoteproc/qcom_q6v5_pas.c | 5 ++- + drivers/remoteproc/rcar_rproc.c | 2 +- + drivers/remoteproc/remoteproc_core.c | 47 ++++++++++++++++++------- + drivers/remoteproc/stm32_rproc.c | 8 +++-- + drivers/remoteproc/wkup_m3_rproc.c | 2 +- + drivers/remoteproc/xlnx_r5_remoteproc.c | 2 +- + include/linux/remoteproc.h | 23 +++++++++++- + 12 files changed, 85 insertions(+), 26 deletions(-) + +diff --git a/drivers/remoteproc/imx_rproc.c b/drivers/remoteproc/imx_rproc.c +index 0dd80e688b0ea3..d5758207d155b6 100644 +--- a/drivers/remoteproc/imx_rproc.c ++++ b/drivers/remoteproc/imx_rproc.c +@@ -1288,8 +1288,12 @@ static int imx_rproc_probe(struct platform_device *pdev) + return dev_err_probe(dev, PTR_ERR(priv->clk), "Failed to enable clock\n"); + } + +- if (rproc->state != RPROC_DETACHED) +- rproc->auto_boot = of_property_read_bool(np, "fsl,auto-boot"); ++ if (rproc->state != RPROC_DETACHED) { ++ if (of_property_read_bool(np, "fsl,auto-boot")) ++ rproc->auto_boot = RPROC_AUTO_BOOT_ATTACH_OR_START; ++ else ++ rproc->auto_boot = RPROC_AUTO_BOOT_DISABLED; ++ } + + if (dcfg->flags & IMX_RPROC_NEED_SYSTEM_OFF) { + /* +diff --git a/drivers/remoteproc/ingenic_rproc.c b/drivers/remoteproc/ingenic_rproc.c +index 1b78d8ddeacfd5..351b9529713790 100644 +--- a/drivers/remoteproc/ingenic_rproc.c ++++ b/drivers/remoteproc/ingenic_rproc.c +@@ -177,7 +177,10 @@ static int ingenic_rproc_probe(struct platform_device *pdev) + if (!rproc) + return -ENOMEM; + +- rproc->auto_boot = auto_boot; ++ if (auto_boot) ++ rproc->auto_boot = RPROC_AUTO_BOOT_ATTACH_OR_START; ++ else ++ rproc->auto_boot = RPROC_AUTO_BOOT_DISABLED; + + vpu = rproc->priv; + vpu->dev = &pdev->dev; +diff --git a/drivers/remoteproc/pru_rproc.c b/drivers/remoteproc/pru_rproc.c +index a4636c7bc6b7be..0928a75916f352 100644 +--- a/drivers/remoteproc/pru_rproc.c ++++ b/drivers/remoteproc/pru_rproc.c +@@ -1029,7 +1029,7 @@ static int pru_rproc_probe(struct platform_device *pdev) + * remote-processor as part of its state machine either through the + * remoteproc sysfs interface or through the equivalent kernel API. + */ +- rproc->auto_boot = false; ++ rproc->auto_boot = RPROC_AUTO_BOOT_DISABLED; + + pru = rproc->priv; + pru->dev = dev; +diff --git a/drivers/remoteproc/qcom_q6v5_adsp.c b/drivers/remoteproc/qcom_q6v5_adsp.c +index b5c8d6d38c9cbc..7184f73be69105 100644 +--- a/drivers/remoteproc/qcom_q6v5_adsp.c ++++ b/drivers/remoteproc/qcom_q6v5_adsp.c +@@ -673,7 +673,10 @@ static int adsp_probe(struct platform_device *pdev) + return -ENOMEM; + } + +- rproc->auto_boot = desc->auto_boot; ++ if (desc->auto_boot) ++ rproc->auto_boot = RPROC_AUTO_BOOT_ATTACH_OR_START; ++ else ++ rproc->auto_boot = RPROC_AUTO_BOOT_DISABLED; + rproc->has_iommu = desc->has_iommu; + rproc_coredump_set_elf_info(rproc, ELFCLASS32, EM_NONE); + +diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c +index ae78f5c7c1b69e..606896500ec310 100644 +--- a/drivers/remoteproc/qcom_q6v5_mss.c ++++ b/drivers/remoteproc/qcom_q6v5_mss.c +@@ -2095,7 +2095,7 @@ static int q6v5_probe(struct platform_device *pdev) + return -ENOMEM; + } + +- rproc->auto_boot = false; ++ rproc->auto_boot = RPROC_AUTO_BOOT_DISABLED; + rproc_coredump_set_elf_info(rproc, ELFCLASS32, EM_NONE); + + qproc = rproc->priv; +diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c +index da27d1d3c9da64..1327e187514821 100644 +--- a/drivers/remoteproc/qcom_q6v5_pas.c ++++ b/drivers/remoteproc/qcom_q6v5_pas.c +@@ -774,7 +774,10 @@ static int qcom_pas_probe(struct platform_device *pdev) + } + + rproc->has_iommu = of_property_present(pdev->dev.of_node, "iommus"); +- rproc->auto_boot = desc->auto_boot; ++ if (desc->auto_boot) ++ rproc->auto_boot = RPROC_AUTO_BOOT_ATTACH_OR_START; ++ else ++ rproc->auto_boot = RPROC_AUTO_BOOT_DISABLED; + rproc_coredump_set_elf_info(rproc, ELFCLASS32, EM_NONE); + + pas = rproc->priv; +diff --git a/drivers/remoteproc/rcar_rproc.c b/drivers/remoteproc/rcar_rproc.c +index 3c25625f966dcb..99a26a05165883 100644 +--- a/drivers/remoteproc/rcar_rproc.c ++++ b/drivers/remoteproc/rcar_rproc.c +@@ -172,7 +172,7 @@ static int rcar_rproc_probe(struct platform_device *pdev) + dev_set_drvdata(dev, rproc); + + /* Manually start the rproc */ +- rproc->auto_boot = false; ++ rproc->auto_boot = RPROC_AUTO_BOOT_DISABLED; + + ret = devm_rproc_add(dev, rproc); + if (ret) { +diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c +index b087ed21858a8c..ec75659957033b 100644 +--- a/drivers/remoteproc/remoteproc_core.c ++++ b/drivers/remoteproc/remoteproc_core.c +@@ -1683,7 +1683,8 @@ static int rproc_trigger_auto_boot(struct rproc *rproc) + { + int ret; + +- if (rproc->state == RPROC_DETACHED) { ++ if (rproc->state == RPROC_DETACHED && ++ rproc->auto_boot != RPROC_AUTO_BOOT_RESTART_IF_FW_AVAILABLE) { + schedule_work(&rproc->attach_work); + return 0; + } +@@ -1708,8 +1709,9 @@ static int rproc_stop(struct rproc *rproc, bool crashed) + if (!rproc->ops->stop) + return -EINVAL; + +- /* Stop any subdevices for the remote processor */ +- rproc_stop_subdevices(rproc, crashed); ++ /* Stop any subdevices for the remote processor if it was attached */ ++ if (rproc->state != RPROC_DETACHED) ++ rproc_stop_subdevices(rproc, crashed); + + /* the installed resource table is no longer accessible */ + ret = rproc_reset_rsc_table_on_stop(rproc); +@@ -1726,7 +1728,8 @@ static int rproc_stop(struct rproc *rproc, bool crashed) + return ret; + } + +- rproc_unprepare_subdevices(rproc); ++ if (rproc->state != RPROC_DETACHED) ++ rproc_unprepare_subdevices(rproc); + + rproc->state = RPROC_OFFLINE; + +@@ -1903,9 +1906,9 @@ static void rproc_crash_handler_work(struct work_struct *work) + */ + int rproc_boot(struct rproc *rproc) + { +- const struct firmware *firmware_p; ++ const struct firmware *firmware_p = NULL; + struct device *dev; +- int ret; ++ int ret, fw_ret = 1; + + if (!rproc) { + pr_err("invalid rproc handle\n"); +@@ -1932,6 +1935,19 @@ int rproc_boot(struct rproc *rproc) + goto unlock_mutex; + } + ++ /* Check early if we have firmware avilable if needed */ ++ if (rproc->auto_boot == RPROC_AUTO_BOOT_RESTART_IF_FW_AVAILABLE && ++ rproc->state == RPROC_DETACHED) { ++ fw_ret = request_firmware(&firmware_p, rproc->firmware, dev); ++ if (fw_ret == 0) { ++ dev_info(dev, "restarting %s with new firmware\n", rproc->name); ++ ++ ret = rproc_stop(rproc, false); ++ if (ret) ++ goto downref_rproc; ++ } ++ } ++ + if (rproc->state == RPROC_DETACHED) { + dev_info(dev, "attaching to %s\n", rproc->name); + +@@ -1939,19 +1955,20 @@ int rproc_boot(struct rproc *rproc) + } else { + dev_info(dev, "powering up %s\n", rproc->name); + +- /* load firmware */ +- ret = request_firmware(&firmware_p, rproc->firmware, dev); +- if (ret < 0) { +- dev_err(dev, "request_firmware failed: %d\n", ret); ++ /* load firmware (if not already happened above) */ ++ if (fw_ret == 1) ++ fw_ret = request_firmware(&firmware_p, rproc->firmware, dev); ++ if (fw_ret < 0) { ++ dev_err(dev, "request_firmware failed: %d\n", fw_ret); ++ ret = fw_ret; + goto downref_rproc; + } + + ret = rproc_fw_boot(rproc, firmware_p); +- +- release_firmware(firmware_p); + } + + downref_rproc: ++ release_firmware(firmware_p); + if (ret) + atomic_dec(&rproc->power); + unlock_mutex: +@@ -2259,6 +2276,10 @@ static int rproc_validate(struct rproc *rproc) + return -EINVAL; + } + ++ if (rproc->auto_boot == RPROC_AUTO_BOOT_RESTART_IF_FW_AVAILABLE && ++ (!rproc->ops->stop || !rproc->ops->start || !rproc->ops->attach)) ++ return -EINVAL; ++ + return 0; + } + +@@ -2470,7 +2491,7 @@ struct rproc *rproc_alloc(struct device *dev, const char *name, + return NULL; + + rproc->priv = &rproc[1]; +- rproc->auto_boot = true; ++ rproc->auto_boot = RPROC_AUTO_BOOT_ATTACH_OR_START; + rproc->elf_class = ELFCLASSNONE; + rproc->elf_machine = EM_NONE; + +diff --git a/drivers/remoteproc/stm32_rproc.c b/drivers/remoteproc/stm32_rproc.c +index 632614013dc652..891fc17f8a63eb 100644 +--- a/drivers/remoteproc/stm32_rproc.c ++++ b/drivers/remoteproc/stm32_rproc.c +@@ -696,7 +696,8 @@ static int stm32_rproc_get_syscon(struct device_node *np, const char *prop, + } + + static int stm32_rproc_parse_dt(struct platform_device *pdev, +- struct stm32_rproc *ddata, bool *auto_boot) ++ struct stm32_rproc *ddata, ++ enum rproc_auto_boot *auto_boot) + { + struct device *dev = &pdev->dev; + struct device_node *np = dev->of_node; +@@ -777,7 +778,10 @@ static int stm32_rproc_parse_dt(struct platform_device *pdev, + if (err) + dev_info(dev, "failed to get pdds\n"); + +- *auto_boot = of_property_read_bool(np, "st,auto-boot"); ++ if (of_property_read_bool(np, "st,auto-boot")) ++ *auto_boot = RPROC_AUTO_BOOT_ATTACH_OR_START; ++ else ++ *auto_boot = RPROC_AUTO_BOOT_DISABLED; + + /* + * See if we can check the M4 status, i.e if it was started +diff --git a/drivers/remoteproc/wkup_m3_rproc.c b/drivers/remoteproc/wkup_m3_rproc.c +index 2d5bfbefcacc5b..8815648295c892 100644 +--- a/drivers/remoteproc/wkup_m3_rproc.c ++++ b/drivers/remoteproc/wkup_m3_rproc.c +@@ -170,7 +170,7 @@ static int wkup_m3_rproc_probe(struct platform_device *pdev) + if (!rproc) + return -ENOMEM; + +- rproc->auto_boot = false; ++ rproc->auto_boot = RPROC_AUTO_BOOT_DISABLED; + rproc->sysfs_read_only = true; + + wkupm3 = rproc->priv; +diff --git a/drivers/remoteproc/xlnx_r5_remoteproc.c b/drivers/remoteproc/xlnx_r5_remoteproc.c +index 50a9974f3202e6..4e230838a24abd 100644 +--- a/drivers/remoteproc/xlnx_r5_remoteproc.c ++++ b/drivers/remoteproc/xlnx_r5_remoteproc.c +@@ -931,7 +931,7 @@ static struct zynqmp_r5_core *zynqmp_r5_add_rproc_core(struct device *cdev) + + r5_rproc->recovery_disabled = true; + r5_rproc->has_iommu = false; +- r5_rproc->auto_boot = false; ++ r5_rproc->auto_boot = RPROC_AUTO_BOOT_DISABLED; + + /* attempt to boot automatically if the firmware-name is provided */ + if (fw_name) +diff --git a/include/linux/remoteproc.h b/include/linux/remoteproc.h +index b4795698d8c2a4..c40b18d120ab46 100644 +--- a/include/linux/remoteproc.h ++++ b/include/linux/remoteproc.h +@@ -503,6 +503,27 @@ enum rproc_features { + RPROC_MAX_FEATURES, + }; + ++/** ++ * enum rproc_auto_boot - auto boot strategy for remoteproc during initial boot ++ * ++ * @RPROC_AUTO_BOOT_DISABLED: The remoteproc will be left offline (or detached). ++ * @RPROC_AUTO_BOOT_ATTACH_OR_START: The remoteproc will be attached (if it is ++ * already running). Otherwise, it will be ++ * started with new loaded firmware. ++ * @RPROC_FEAT_REBOOT_IF_FW_AVAILABLE: The remoteproc will be restarted if ++ * requesting new firmware succeeds. If ++ * the firmware is missing and the ++ * remoteproc is already running, it will ++ * be attached instead. A remoteproc ++ * implementing this must handle stop() ++ * being called in detached state. ++ */ ++enum rproc_auto_boot { ++ RPROC_AUTO_BOOT_DISABLED, ++ RPROC_AUTO_BOOT_ATTACH_OR_START, ++ RPROC_AUTO_BOOT_RESTART_IF_FW_AVAILABLE, ++}; ++ + /** + * struct rproc - represents a physical remote processor device + * @node: list node of this rproc object +@@ -577,7 +598,7 @@ struct rproc { + struct resource_table *cached_table; + size_t table_sz; + bool has_iommu; +- bool auto_boot; ++ enum rproc_auto_boot auto_boot; + bool sysfs_read_only; + struct list_head dump_segments; + int nb_vdev; diff --git a/patches/remoteproc/0010-remoteproc-qcom_q6v5-Send-SMP2P-stop-signal-in-attac.patch b/patches/remoteproc/0010-remoteproc-qcom_q6v5-Send-SMP2P-stop-signal-in-attac.patch new file mode 100644 index 0000000..4f04538 --- /dev/null +++ b/patches/remoteproc/0010-remoteproc-qcom_q6v5-Send-SMP2P-stop-signal-in-attac.patch @@ -0,0 +1,31 @@ +If we stop the q6v5 remoteproc while it is in RPROC_ATTACHED or +RPROC_DETACHED state, we still want to send the stop signal to shut it down +cleanly. + +The main goal of the check in qcom_q6v5_request_stop() is to avoid sending +duplicate shutdown/stop signals during crash or shutdown via sysmon, so +check for RPROC_CRASHED to handle all of RPROC_RUNNING, RPROC_ATTACHED and +RPROC_DETACHED. It does not make sense to call the function while in +RPROC_OFFLINE state. + +Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org> +Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com> +--- + drivers/remoteproc/qcom_q6v5.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c +index 94c75d9cc..ed1b578a8 100644 +--- a/drivers/remoteproc/qcom_q6v5.c ++++ b/drivers/remoteproc/qcom_q6v5.c +@@ -231,8 +231,8 @@ int qcom_q6v5_request_stop(struct qcom_q6v5 *q6v5, struct qcom_sysmon *sysmon) + + q6v5->running = false; + +- /* A watchdog/fatal IRQ clears running; logical crashes still need a stop. */ +- if (!was_running || qcom_sysmon_shutdown_acked(sysmon)) ++ /* A watchdog/fatal IRQ clears running; logical crashes still need a stop. */ ++ if (q6v5->rproc->state == RPROC_CRASHED || qcom_sysmon_shutdown_acked(sysmon)) + return 0; + + qcom_smem_state_update_bits(q6v5->state, diff --git a/patches/remoteproc/0011-remoteproc-qcom_q6v5_pas-Attach-running-remoteproc-i.patch b/patches/remoteproc/0011-remoteproc-qcom_q6v5_pas-Attach-running-remoteproc-i.patch new file mode 100644 index 0000000..66ecc0f --- /dev/null +++ b/patches/remoteproc/0011-remoteproc-qcom_q6v5_pas-Attach-running-remoteproc-i.patch @@ -0,0 +1,106 @@ +A remoteproc might be already running during boot, e.g. because it was +already started by the boot firmware. This is the case for example on X1E, +where the boot firmware starts a "lite" ADSP firmware that supports +charging and USB-CC detection, but is missing audio functionality. This +firmware uses the same interfaces as the full firmware and can be reused in +case the device-specific firmware is missing (e.g. in generic distro +installers). + +The running remoteproc is currently not modelled at all - it is just killed +through qcom_pas_shutdown() without even using the SMP2P stop signal +beforehand. If the firmware is present the "lite" firmware is now stopped more +gracefully with the SMP2P stop signal. + +diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c +index 672af7336..3cf24f202 100644 +--- a/drivers/remoteproc/qcom_q6v5_pas.c ++++ b/drivers/remoteproc/qcom_q6v5_pas.c +@@ -236,10 +237,13 @@ + /* Store firmware handle to be used in qcom_pas_start() */ + pas->firmware = fw; + +- if (pas->lite_pas_id) +- qcom_scm_pas_shutdown(pas->lite_pas_id); +- if (pas->lite_dtb_pas_id) +- qcom_scm_pas_shutdown(pas->lite_dtb_pas_id); ++ /* ++ * We don't support loading the "lite" firmware, so we don't need to ++ * keep trying to shut it down. If it was running, it should have ++ * already been stopped by adsp_stop(). ++ */ ++ pas->lite_pas_id = 0; ++ pas->lite_dtb_pas_id = 0; + + if (pas->dtb_pas_id) { + ret = request_firmware(&pas->dtb_firmware, pas->dtb_firmware_name, pas->dev); +@@ -401,6 +405,28 @@ + qcom_pas_pds_disable(pas, pas->proxy_pds, pas->proxy_pd_count); + } + ++static int qcom_q6v5_pas_shutdown(int pas_id, int lite_pas_id) ++{ ++ int ret, lite_ret = -ENODEV; ++ ++ /* ++ * We don't know if the boot firmware started the "full" or "lite" ++ * firmware, so we don't know if we need to shutdown the lite_pas_id or ++ * the normal pas_id. Unfortunately, the return codes of the SCM calls ++ * are also not helpful to figure that out. Since shutting down a ++ * stopped remoteproc is a no-op, we just shutdown both and if one of ++ * the calls succeeds, we assume it's okay. ++ */ ++ if (lite_pas_id) ++ lite_ret = qcom_scm_pas_shutdown(lite_pas_id); ++ ++ ret = qcom_scm_pas_shutdown(pas_id); ++ if (ret && lite_ret) ++ return ret; ++ ++ return 0; ++} ++ + static int qcom_pas_stop(struct rproc *rproc) + { + struct qcom_pas *pas = rproc->priv; +@@ -411,7 +437,7 @@ + if (ret == -ETIMEDOUT) + dev_err(pas->dev, "timed out on wait\n"); + +- ret = qcom_scm_pas_shutdown(pas->pas_id); ++ ret = qcom_q6v5_pas_shutdown(pas->pas_id, pas->lite_pas_id); + if (ret && pas->decrypt_shutdown) + ret = qcom_pas_shutdown_poll_decrypt(pas); + +@@ -419,7 +445,7 @@ + dev_err(pas->dev, "failed to shutdown: %d\n", ret); + + if (pas->dtb_pas_id) { +- ret = qcom_scm_pas_shutdown(pas->dtb_pas_id); ++ ret = qcom_q6v5_pas_shutdown(pas->dtb_pas_id, pas->lite_dtb_pas_id); + if (ret) + dev_err(pas->dev, "failed to shutdown dtb: %d\n", ret); + +@@ -428,9 +454,11 @@ + + qcom_pas_unmap_carveout(rproc, pas->mem_phys, pas->mem_size); + +- handover = qcom_q6v5_unprepare(&pas->q6v5); +- if (handover) +- qcom_pas_handover(&pas->q6v5); ++ if (rproc->state != RPROC_DETACHED) { ++ handover = qcom_q6v5_unprepare(&pas->q6v5); ++ if (handover) ++ qcom_pas_handover(&pas->q6v5); ++ } + + if (pas->smem_host_id) + ret = qcom_smem_bust_hwspin_lock_by_host(pas->smem_host_id); +@@ -859,7 +890,7 @@ + + rproc->has_iommu = of_property_present(pdev->dev.of_node, "iommus"); + if (desc->auto_boot) +- rproc->auto_boot = RPROC_AUTO_BOOT_ATTACH_OR_START; ++ rproc->auto_boot = RPROC_AUTO_BOOT_RESTART_IF_FW_AVAILABLE; + else + rproc->auto_boot = RPROC_AUTO_BOOT_DISABLED; + rproc_coredump_set_elf_info(rproc, ELFCLASS32, EM_NONE); diff --git a/patches/remoteproc/0012-remoteproc-qcom_q6v5_pas-Avoid-using-broken-reset.patch b/patches/remoteproc/0012-remoteproc-qcom_q6v5_pas-Avoid-using-broken-reset.patch new file mode 100644 index 0000000..f580ea5 --- /dev/null +++ b/patches/remoteproc/0012-remoteproc-qcom_q6v5_pas-Avoid-using-broken-reset.patch @@ -0,0 +1,101 @@ +Some firmware versions have a split design where firmware authentication is +implemented in the TZ firmware, but the remoteproc reset sequence appears +to be triggered by the hypervisor firmware. When running bare-metal without +the hypervisor only the firmware authentication functionality is present. +Without knowledge of the exact hardware reset register sequence, we cannot +(re)start the remoteproc from Linux. + +This does not make the qcom_q6v5_pas driver useless. In case the remoteproc +is already running during boot, we can attach to it as usual and keep using +it until it crashes or is manually stopped. Not being able to restart it is +not ideal, but not a big loss: A remoteproc should rarely (if ever) crash +during normal use. Also, currently most drivers upstream cannot properly +handle a remoteproc crash anyway (without full system restart). + +Detecting this case automatically is tricky since all the PAS related calls +still succeed, it will just not release the remoteproc from reset. Also, on +SC7180, MPSS does always work correctly, only ADSP and CDSP are broken. +Look for a new "qcom,broken-reset" property so we can check which of the +remoteprocs are affected. + +Signed-off-by: Stephan Gerhold <stephan@gerhold.net> +Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com> +--- + drivers/remoteproc/qcom_q6v5_pas.c | 32 +++++++++++++++++++++++++++--- + 1 file changed, 29 insertions(+), 3 deletions(-) + +diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c +index 3cf24f202..c80af9654 100644 +--- a/drivers/remoteproc/qcom_q6v5_pas.c ++++ b/drivers/remoteproc/qcom_q6v5_pas.c +@@ -455,6 +455,13 @@ static const struct rproc_ops qcom_pas_minidump_ops = { + .coredump = qcom_pas_minidump, + }; + ++static const struct rproc_ops qcom_pas_ops_no_reset = { ++ .attach = qcom_pas_attach, ++ .da_to_va = qcom_pas_da_to_va, ++ .stop = qcom_pas_stop, ++ .panic = qcom_pas_panic, ++}; ++ + static int qcom_pas_init_clock(struct qcom_pas *pas) + { + pas->xo = devm_clk_get(pas->dev, "xo"); +@@ -664,6 +671,7 @@ + struct rproc *rproc; + const char *fw_name, *dtb_fw_name = NULL; + const struct rproc_ops *ops = &qcom_pas_ops; ++ bool recovery_disabled = false; + int ret; + + desc = of_device_get_match_data(&pdev->dev); +@@ -690,6 +698,11 @@ + if (desc->minidump_id) + ops = &qcom_pas_minidump_ops; + ++ if (device_property_read_bool(&pdev->dev, "qcom,broken-reset")) { ++ ops = &qcom_pas_ops_no_reset; ++ recovery_disabled = true; ++ } ++ + rproc = devm_rproc_alloc(&pdev->dev, desc->sysmon_name, ops, fw_name, sizeof(*pas)); + + if (!rproc) { +@@ -752,10 +762,15 @@ static int qcom_pas_probe(struct platform_device *pdev) + } + + rproc->has_iommu = of_property_present(pdev->dev.of_node, "iommus"); +- if (desc->auto_boot) +- rproc->auto_boot = RPROC_AUTO_BOOT_RESTART_IF_FW_AVAILABLE; +- else ++ rproc->recovery_disabled = recovery_disabled; ++ if (desc->auto_boot) { ++ if (ops->start) ++ rproc->auto_boot = RPROC_AUTO_BOOT_RESTART_IF_FW_AVAILABLE; ++ else ++ rproc->auto_boot = RPROC_AUTO_BOOT_ATTACH_OR_START; ++ } else { + rproc->auto_boot = RPROC_AUTO_BOOT_DISABLED; ++ } + rproc_coredump_set_elf_info(rproc, ELFCLASS32, EM_NONE); + + pas = rproc->priv; +@@ -846,6 +868,7 @@ static int qcom_pas_probe(struct platform_device *pdev) + qcom_pas_unassign_memory_region(pas); + free_rproc: + device_init_wakeup(pas->dev, false); ++ pas->rproc = NULL; + + return ret; + } +@@ -854,6 +877,9 @@ static void qcom_pas_remove(struct platform_device *pdev) + { + struct qcom_pas *pas = platform_get_drvdata(pdev); + ++ if (!pas->rproc) ++ return; ++ + rproc_del(pas->rproc); + + qcom_q6v5_deinit(&pas->q6v5); diff --git a/patches/surface/0016-arm64-dts-qcom-purwa-Microsoft-Surface-Pro-12in-iris-firmware-name.patch b/patches/surface/0016-arm64-dts-qcom-purwa-Microsoft-Surface-Pro-12in-iris-firmware-name.patch new file mode 100644 index 0000000..b182b0b --- /dev/null +++ b/patches/surface/0016-arm64-dts-qcom-purwa-Microsoft-Surface-Pro-12in-iris-firmware-name.patch @@ -0,0 +1,32 @@ +arm64: dts: qcom: purwa: Microsoft Surface Pro 12in: point iris at the OEM video firmware + +The generic qcom/vpu/vpu30_p1_s7.mbn shipped by linux-firmware is signed with +the Qualcomm SecTools test key chain ("SECTOOLS SECP384R1 CURVE TEST ROOT" / +"General Use Test Key (for testing only)"), which the TrustZone on a retail +Surface Pro 12in refuses: + + qcom-iris aa00000.video-codec: error -22 initializing firmware qcom/vpu/vpu30_p1_s7.mbn + qcom-iris aa00000.video-codec: firmware download failed + qcom-iris aa00000.video-codec: core init failed + +The -22 comes straight out of qcom_scm_pas_init_image() in +__qcom_mdt_pas_init(), i.e. the image metadata is rejected before anything is +loaded. + +The Windows driver package for this machine carries the same firmware signed +with the production chain ("QMC Attestation Root CA 6"), in two builds: +qcvss8380.mbn and qcvss8380_pa.mbn. The _pa one is what loads here. It has an +identical 7 MiB load span, so it fits the existing video_mem reservation +unchanged. Point the iris node at it, the same way the board already does for +the aDSP, cDSP and GPU firmware. + +--- a/arch/arm64/boot/dts/qcom/x1p42100-microsoft-sp12in.dts ++++ b/arch/arm64/boot/dts/qcom/x1p42100-microsoft-sp12in.dts +@@ -1098,6 +1098,7 @@ + }; + + &iris { ++ firmware-name = "qcom/x1p42100/Microsoft/Surface12/qcvss8380_pa.mbn"; + status = "okay"; + }; + diff --git a/patches/usb/0003-7.3-arm64-dts-qcom-hamoa-add-interconnects-to-primary-USB3-controller.patch b/patches/usb/0003-7.3-arm64-dts-qcom-hamoa-add-interconnects-to-primary-USB3-controller.patch new file mode 100644 index 0000000..423b9aa --- /dev/null +++ b/patches/usb/0003-7.3-arm64-dts-qcom-hamoa-add-interconnects-to-primary-USB3-controller.patch @@ -0,0 +1,30 @@ +Add the interconnect paths to enable drivers to vote on them, ensuring +the necessary NoC bandwidth is available. + +This hasn't been done before, as prior to commit 05566ebcc0cd +("clk: qcom: gcc-x1e80100: Keep GCC USB QTB clock always ON"), this +would cause an inexplicable crash upon resume from system suspend. + +Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> +--- + arch/arm64/boot/dts/qcom/hamoa.dtsi | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/hamoa.dtsi b/arch/arm64/boot/dts/qcom/hamoa.dtsi +index 051dee076416..233c7ab4c52c 100644 +--- a/arch/arm64/boot/dts/qcom/hamoa.dtsi ++++ b/arch/arm64/boot/dts/qcom/hamoa.dtsi +@@ -5318,6 +5318,13 @@ usb_1_ss0: usb@a600000 { + + resets = <&gcc GCC_USB30_PRIM_BCR>; + ++ interconnects = <&usb_south_anoc MASTER_USB3_0 QCOM_ICC_TAG_ALWAYS ++ &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>, ++ <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY ++ &config_noc SLAVE_USB3_0 QCOM_ICC_TAG_ACTIVE_ONLY>; ++ interconnect-names = "usb-ddr", ++ "apps-usb"; ++ + wakeup-source; + + iommus = <&apps_smmu 0x1420 0x0>; diff --git a/patches/usb/0015-phy-qcom-qmp-combo-Prevent-unnecessary-PM-runtime-suspend-at-boot.patch b/patches/usb/0015-phy-qcom-qmp-combo-Prevent-unnecessary-PM-runtime-suspend-at-boot.patch new file mode 100644 index 0000000..03ed8e7 --- /dev/null +++ b/patches/usb/0015-phy-qcom-qmp-combo-Prevent-unnecessary-PM-runtime-suspend-at-boot.patch @@ -0,0 +1,40 @@ +There is a small window where the device can suspend after +pm_runtime_enable() and before pm_runtime_forbid(), causing an +unnecessary suspend/resume cycle while the PHY is not yet registered. + +Move pm_runtime_forbid() before pm_runtime_enable() to eliminate +this race. + +Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> +Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com> +Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> +Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com> +--- + drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c +index 93f1aa10d400..c3661872bb7a 100644 +--- a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c ++++ b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c +@@ -4932,15 +4932,15 @@ static int qmp_combo_probe(struct platform_device *pdev) + if (ret) + goto err_node_put; + ++ /* ++ * Enable runtime PM support, but forbid it by default. ++ * Users can allow it again via the power/control attribute in sysfs. ++ */ + pm_runtime_set_active(dev); ++ pm_runtime_forbid(dev); + ret = devm_pm_runtime_enable(dev); + if (ret) + goto err_node_put; +- /* +- * Prevent runtime pm from being ON by default. Users can enable +- * it using power/control in sysfs. +- */ +- pm_runtime_forbid(dev); + + ret = qmp_combo_register_clocks(qmp, usb_np, dp_np); + if (ret) diff --git a/patches/usb/0016-phy-qcom-qmp-usbc-Prevent-unnecessary-PM-runtime-suspend-at-boot.patch b/patches/usb/0016-phy-qcom-qmp-usbc-Prevent-unnecessary-PM-runtime-suspend-at-boot.patch new file mode 100644 index 0000000..65fba1f --- /dev/null +++ b/patches/usb/0016-phy-qcom-qmp-usbc-Prevent-unnecessary-PM-runtime-suspend-at-boot.patch @@ -0,0 +1,40 @@ +There is a small window where the device can suspend after +pm_runtime_enable() and before pm_runtime_forbid(), causing an +unnecessary suspend/resume cycle while the PHY is not yet registered. + +Move pm_runtime_forbid() before pm_runtime_enable() to eliminate +this race. + +Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com> +Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> +Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com> +Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> +--- + drivers/phy/qualcomm/phy-qcom-qmp-usbc.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-usbc.c b/drivers/phy/qualcomm/phy-qcom-qmp-usbc.c +index 14feb77789b3..90ea6ca64026 100644 +--- a/drivers/phy/qualcomm/phy-qcom-qmp-usbc.c ++++ b/drivers/phy/qualcomm/phy-qcom-qmp-usbc.c +@@ -1959,15 +1959,15 @@ static int qmp_usbc_probe(struct platform_device *pdev) + if (ret) + goto err_node_put; + ++ /* ++ * Enable runtime PM support, but forbid it by default. ++ * Users can allow it again via the power/control attribute in sysfs. ++ */ + pm_runtime_set_active(dev); ++ pm_runtime_forbid(dev); + ret = devm_pm_runtime_enable(dev); + if (ret) + goto err_node_put; +- /* +- * Prevent runtime pm from being ON by default. Users can enable +- * it using power/control in sysfs. +- */ +- pm_runtime_forbid(dev); + + ret = qmp_usbc_register_clocks(qmp, np); + if (ret) |