Linux 7.0.2 fix 6490

arch/arm64/boot/dts/qcom/qcs6490-radxa-cm-q64.dtsi

@@ -845,22 +845,6 @@
 			"AMIC2", "MIC BIAS2",
 			"TX SWR_ADC1", "ADC2_OUTPUT";
 
-	dp0-dai-link {
-		link-name = "DP0 Playback";
-
-		codec {
-			sound-dai = <&mdss_dp>;
-		};
-
-		cpu {
-			sound-dai = <&q6apmbedai DISPLAY_PORT_RX_0>;
-		};
-
-		platform {
-			sound-dai = <&q6apm>;
-		};
-	};
-
 	wcd-playback-dai-link {
 		link-name = "WCD Playback";
 
@@ -1142,6 +1126,7 @@
 /* For uart_dbg */
 &qup_uart5_tx {
 	bias-disable;
+	output-high;
 	drive-strength = <16>;
 };
 

drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c

@@ -1415,8 +1415,15 @@ static struct msm_display_topology dpu_crtc_get_topology(
 	else
 		topology.num_lm = 1;
 
-	if (crtc_state->ctm || crtc_state->gamma_lut)
-		topology.num_dspp = topology.num_lm;
+	if (crtc_state->ctm || crtc_state->gamma_lut) {
+		if (topology.num_lm <= (int)dpu_kms->catalog->dspp_count) {
+			topology.num_dspp = topology.num_lm;
+		} else {
+			DRM_WARN("CTM/gamma on %d LM(s) with %d DSPP(s), "
+				  "color management skipped\n",
+				  topology.num_lm, dpu_kms->catalog->dspp_count);
+		}
+	}
 
 	return topology;
 }

drivers/gpu/drm/msm/dp/dp_display.c

@@ -986,17 +986,21 @@ static irqreturn_t msm_dp_display_irq_thread(int irq, void *dev_id)
 	unsigned long flags;
 	u32 hpd_isr_status;
 	int rc;
+	bool was_plugged;
 
 	spin_lock_irqsave(&dp->irq_thread_lock, flags);
 	hpd_isr_status = dp->hpd_isr_status;
 	dp->hpd_isr_status = 0;
 	spin_unlock_irqrestore(&dp->irq_thread_lock, flags);
 
-	if (hpd_isr_status & DP_DP_HPD_UNPLUG_INT_MASK)
+	was_plugged = dp->plugged;
+
+	/* notify only on actual state transitions */
+	if (hpd_isr_status & DP_DP_HPD_UNPLUG_INT_MASK && was_plugged)
 		drm_bridge_hpd_notify(dp->msm_dp_display.bridge,
 				      connector_status_disconnected);
 
-	if (hpd_isr_status & DP_DP_HPD_PLUG_INT_MASK)
+	if (hpd_isr_status & DP_DP_HPD_PLUG_INT_MASK && !was_plugged)
 		drm_bridge_hpd_notify(dp->msm_dp_display.bridge,
 				      connector_status_connected);
 

drivers/misc/fastrpc.c

@@ -310,6 +310,8 @@ struct fastrpc_user {
 	spinlock_t lock;
 	/* lock for allocations */
 	struct mutex mutex;
+	/* Reference count */
+	struct kref refcount;
 };
 
 /* Extract SMMU PA from consolidated IOVA */
@@ -497,15 +499,57 @@ static void fastrpc_channel_ctx_put(struct fastrpc_channel_ctx *cctx)
 	kref_put(&cctx->refcount, fastrpc_channel_ctx_free);
 }
 
+static void fastrpc_context_put(struct fastrpc_invoke_ctx *ctx);
+
+static void fastrpc_user_free(struct kref *ref)
+{
+	struct fastrpc_user *fl = container_of(ref, struct fastrpc_user, refcount);
+	struct fastrpc_invoke_ctx *ctx, *n;
+	struct fastrpc_map *map, *m;
+	struct fastrpc_buf *buf, *b;
+
+	if (fl->init_mem)
+		fastrpc_buf_free(fl->init_mem);
+
+	list_for_each_entry_safe(ctx, n, &fl->pending, node) {
+		list_del(&ctx->node);
+		fastrpc_context_put(ctx);
+	}
+
+	list_for_each_entry_safe(map, m, &fl->maps, node)
+		fastrpc_map_put(map);
+
+	list_for_each_entry_safe(buf, b, &fl->mmaps, node) {
+		list_del(&buf->node);
+		fastrpc_buf_free(buf);
+	}
+
+	fastrpc_channel_ctx_put(fl->cctx);
+	mutex_destroy(&fl->mutex);
+	kfree(fl);
+}
+
+static void fastrpc_user_get(struct fastrpc_user *fl)
+{
+	kref_get(&fl->refcount);
+}
+
+static void fastrpc_user_put(struct fastrpc_user *fl)
+{
+	kref_put(&fl->refcount, fastrpc_user_free);
+}
+
 static void fastrpc_context_free(struct kref *ref)
 {
 	struct fastrpc_invoke_ctx *ctx;
 	struct fastrpc_channel_ctx *cctx;
+	struct fastrpc_user *fl;
 	unsigned long flags;
 	int i;
 
 	ctx = container_of(ref, struct fastrpc_invoke_ctx, refcount);
 	cctx = ctx->cctx;
+	fl = ctx->fl;
 
 	for (i = 0; i < ctx->nbufs; i++)
 		fastrpc_map_put(ctx->maps[i]);
@@ -521,6 +565,8 @@ static void fastrpc_context_free(struct kref *ref)
 	kfree(ctx->olaps);
 	kfree(ctx);
 
+	/* Release the reference taken in fastrpc_context_alloc() */
+	fastrpc_user_put(fl);
 	fastrpc_channel_ctx_put(cctx);
 }
 
@@ -628,6 +674,8 @@ static struct fastrpc_invoke_ctx *fastrpc_context_alloc(
 
 	/* Released in fastrpc_context_put() */
 	fastrpc_channel_ctx_get(cctx);
+	/* Take a reference to user, released in fastrpc_context_free() */
+	fastrpc_user_get(user);
 
 	ctx->sc = sc;
 	ctx->retval = -1;
@@ -658,6 +706,7 @@ static struct fastrpc_invoke_ctx *fastrpc_context_alloc(
 	spin_lock(&user->lock);
 	list_del(&ctx->node);
 	spin_unlock(&user->lock);
+	fastrpc_user_put(user);
 	fastrpc_channel_ctx_put(cctx);
 	kfree(ctx->maps);
 	kfree(ctx->olaps);
@@ -1579,9 +1628,6 @@ static int fastrpc_device_release(struct inode *inode, struct file *file)
 {
 	struct fastrpc_user *fl = (struct fastrpc_user *)file->private_data;
 	struct fastrpc_channel_ctx *cctx = fl->cctx;
-	struct fastrpc_invoke_ctx *ctx, *n;
-	struct fastrpc_map *map, *m;
-	struct fastrpc_buf *buf, *b;
 	unsigned long flags;
 
 	fastrpc_release_current_dsp_process(fl);
@@ -1590,28 +1636,10 @@ static int fastrpc_device_release(struct inode *inode, struct file *file)
 	list_del(&fl->user);
 	spin_unlock_irqrestore(&cctx->lock, flags);
 
-	if (fl->init_mem)
-		fastrpc_buf_free(fl->init_mem);
-
-	list_for_each_entry_safe(ctx, n, &fl->pending, node) {
-		list_del(&ctx->node);
-		fastrpc_context_put(ctx);
-	}
-
-	list_for_each_entry_safe(map, m, &fl->maps, node)
-		fastrpc_map_put(map);
-
-	list_for_each_entry_safe(buf, b, &fl->mmaps, node) {
-		list_del(&buf->node);
-		fastrpc_buf_free(buf);
-	}
-
 	fastrpc_session_free(cctx, fl->sctx);
-	fastrpc_channel_ctx_put(cctx);
-
-	mutex_destroy(&fl->mutex);
-	kfree(fl);
 	file->private_data = NULL;
+	/* Release the reference taken in fastrpc_device_open */
+	fastrpc_user_put(fl);
 
 	return 0;
 }
@@ -1655,6 +1683,7 @@ static int fastrpc_device_open(struct inode *inode, struct file *filp)
 	spin_lock_irqsave(&cctx->lock, flags);
 	list_add_tail(&fl->user, &cctx->users);
 	spin_unlock_irqrestore(&cctx->lock, flags);
+	kref_init(&fl->refcount);
 
 	return 0;
 }