From 642ca39c9846343dd7990bce3459bd8365f944eb Mon Sep 17 00:00:00 2001 From: Yousaf Kaukab Date: May 25 2023 14:21:39 +0000 Subject: Merge remote-tracking branch 'origin/SLE15-SP4' into SLE15-SP5 Keep SLE15-SP5 version of following patches: patches.suse/dmaengine-idxd-Do-not-enable-user-type-Work-Queue-wi.patch patches.suse/dmaengine-idxd-Only-call-idxd_enable_system_pasid-if.patch patches.suse/dmaengine-idxd-Separate-user-and-kernel-pasid-enabli.patch patches.suse/drm-i915-dg2-Add-additional-HDMI-pixel-clock-frequen.patch patches.suse/s390-uaccess-add-missing-earlyclobber-annotations-to-__clear_user.patch patches.suse/thunderbolt-Clear-registers-properly-when-auto-clear.patch patches.suse/usb-dwc3-drd-use-helper-to-get-role-switch-default-m.patch patches.suse/vdpa-fix-use-after-free-on-vp_vdpa_remove.patch Refresh: patches.suse/usb-dwc3-Align-DWC3_EP_-flag-macros.patch patches.suse/s390-ctcm-Fix-return-type-of-ctc-mp-m_tx.patch patches.suse/s390-netiucv-Fix-return-type-of-netiucv_tx.patch patches.suse/s390-lcs-Fix-return-type-of-lcs_start_xmit.patch patches.suse/ata-pata_octeon_cf-drop-kernel-doc-notation.patch patches.suse/drivers-base-component-fix-memory-leak-with-using-de.patch patches.suse/drm-msm-dp-Clean-up-handling-of-DP-AUX-interrupts.patch patches.suse/RDMA-rxe-Remove-tasklet-call-from-rxe_cq.c.patch patches.suse/drm-amdgpu-disable-sdma-ecc-irq-only-when-sdma-RAS-i.patch patches.suse/drm-msm-dp-unregister-audio-driver-during-unbind.patch patches.suse/drm-msm-dpu-Move-non-MDP_TOP-INTF_INTR-offsets-out-o.patch patches.suse/drm-msm-dpu-Remove-duplicate-register-defines-from-I.patch Ignore commit 118de8c67df9 from SLE15-SP4 as it was not intended for SLE15-SP5. Signed-off-by: Yousaf Kaukab --- diff --git a/blacklist.conf b/blacklist.conf index 57f9346..e7e4058 100644 --- a/blacklist.conf +++ b/blacklist.conf @@ -670,3 +670,6 @@ f81fead027ecbb525c29d681eb95a222e76306a3 # correction in a comment only 2355370cd941cbb20882cc3f34460f9f2b8f9a18 # already have it as part of a different commit 7fce8d6eccbc31a561d07c79f359ad09f0424347 # already have it as part of a different commit c798304470cab88723d895726d17fcb96472e0e9 # fixes code not present in mpi3mr driver +9dba4d24cbb5524dd39ab1e08886373b17f07ff2 # breaks KABI +d43b020b0f82c088ef8ff3196ef00575a97d200e # bug introduced by 4831967640916 not present +838d6d3461db0fdbf33fc5f8a69c27b50b4a46da # breaks KABI diff --git a/patches.kabi/media-dvb_frontend-kabi-workaround.patch b/patches.kabi/media-dvb_frontend-kabi-workaround.patch new file mode 100644 index 0000000..9e6f69d --- /dev/null +++ b/patches.kabi/media-dvb_frontend-kabi-workaround.patch @@ -0,0 +1,133 @@ +From: Takashi Iwai +Subject: media: dvb_frontend: kABI workaround +Patch-mainline: Never, kABI workaround +References: CVE-2022-45885 bsc#1205758 + +For keeping the kABI workaround, the newly introduced remove_mutex +of dvb_frontend to be a global one. It's not urgent for performance, +so we can live with that. + +Signed-off-by: Takashi Iwai + +--- + drivers/media/dvb-core/dvb_frontend.c | 23 ++++++++++++----------- + include/media/dvb_frontend.h | 4 ---- + 2 files changed, 12 insertions(+), 15 deletions(-) + +--- a/drivers/media/dvb-core/dvb_frontend.c ++++ b/drivers/media/dvb-core/dvb_frontend.c +@@ -90,6 +90,8 @@ MODULE_PARM_DESC(dvb_mfe_wait_time, "Wai + + static DEFINE_MUTEX(frontend_mutex); + ++static DEFINE_MUTEX(remove_mutex); ++ + struct dvb_frontend_private { + /* thread/frontend values */ + struct dvb_device *dvbdev; +@@ -817,20 +819,20 @@ static void dvb_frontend_stop(struct dvb + + dev_dbg(fe->dvb->device, "%s:\n", __func__); + +- mutex_lock(&fe->remove_mutex); ++ mutex_lock(&remove_mutex); + + if (fe->exit != DVB_FE_DEVICE_REMOVED) + fe->exit = DVB_FE_NORMAL_EXIT; + mb(); + + if (!fepriv->thread) { +- mutex_unlock(&fe->remove_mutex); ++ mutex_unlock(&remove_mutex); + return; + } + + kthread_stop(fepriv->thread); + +- mutex_unlock(&fe->remove_mutex); ++ mutex_unlock(&remove_mutex); + + if (fepriv->dvbdev->users < -1) { + wait_event(fepriv->dvbdev->wait_queue, +@@ -2772,7 +2774,7 @@ static int dvb_frontend_open(struct inod + struct dvb_adapter *adapter = fe->dvb; + int ret; + +- mutex_lock(&fe->remove_mutex); ++ mutex_lock(&remove_mutex); + + dev_dbg(fe->dvb->device, "%s:\n", __func__); + if (fe->exit == DVB_FE_DEVICE_REMOVED) { +@@ -2875,7 +2877,7 @@ static int dvb_frontend_open(struct inod + if (adapter->mfe_shared) + mutex_unlock(&adapter->mfe_lock); + +- mutex_unlock(&fe->remove_mutex); ++ mutex_unlock(&remove_mutex); + return ret; + + err3: +@@ -2899,7 +2901,7 @@ err0: + mutex_unlock(&adapter->mfe_lock); + + err_remove_mutex: +- mutex_unlock(&fe->remove_mutex); ++ mutex_unlock(&remove_mutex); + return ret; + } + +@@ -2910,7 +2912,7 @@ static int dvb_frontend_release(struct i + struct dvb_frontend_private *fepriv = fe->frontend_priv; + int ret; + +- mutex_lock(&fe->remove_mutex); ++ mutex_lock(&remove_mutex); + + dev_dbg(fe->dvb->device, "%s:\n", __func__); + +@@ -2937,14 +2939,14 @@ static int dvb_frontend_release(struct i + fe->ops.ts_bus_ctrl(fe, 0); + + if (fe->exit != DVB_FE_NO_EXIT) { +- mutex_unlock(&fe->remove_mutex); ++ mutex_unlock(&remove_mutex); + wake_up(&dvbdev->wait_queue); + } else { +- mutex_unlock(&fe->remove_mutex); ++ mutex_unlock(&remove_mutex); + } + + } else { +- mutex_unlock(&fe->remove_mutex); ++ mutex_unlock(&remove_mutex); + } + + dvb_frontend_put(fe); +@@ -3041,7 +3043,6 @@ int dvb_register_frontend(struct dvb_ada + fepriv = fe->frontend_priv; + + kref_init(&fe->refcount); +- mutex_init(&fe->remove_mutex); + + /* + * After initialization, there need to be two references: one +--- a/include/media/dvb_frontend.h ++++ b/include/media/dvb_frontend.h +@@ -681,9 +681,6 @@ struct dtv_frontend_properties { + * @exit: Used to inform the DVB core that the frontend + * thread should exit (usually, means that the hardware + * got disconnected). +- * @remove_mutex: mutex that avoids a race condition between a callback +- * called when the hardware is disconnected and the +- * file_operations of dvb_frontend. + */ + + struct dvb_frontend { +@@ -701,7 +698,6 @@ struct dvb_frontend { + int (*callback)(void *adapter_priv, int component, int cmd, int arg); + int id; + unsigned int exit; +- struct mutex remove_mutex; + }; + + /** diff --git a/patches.kabi/media-dvb_net-kabi-workaround.patch b/patches.kabi/media-dvb_net-kabi-workaround.patch new file mode 100644 index 0000000..6d2f2a8 --- /dev/null +++ b/patches.kabi/media-dvb_net-kabi-workaround.patch @@ -0,0 +1,107 @@ +From: Takashi Iwai +Subject: media: dvb_net: kABI workaround +Patch-mainline: Never, kABI workaround +References: CVE-2022-45886 bsc#1205760 + +For keeping the kABI workaround, the newly introduced remove_mutex +of dvb_net to be a global one. It's not urgent for performance, +so we can live with that. + +Signed-off-by: Takashi Iwai + +--- + drivers/media/dvb-core/dvb_net.c | 19 ++++++++++--------- + include/media/dvb_net.h | 4 ---- + 2 files changed, 10 insertions(+), 13 deletions(-) + +--- a/drivers/media/dvb-core/dvb_net.c ++++ b/drivers/media/dvb-core/dvb_net.c +@@ -57,6 +57,8 @@ + #include + #include + ++static DEFINE_MUTEX(remove_mutex); ++ + static inline __u32 iov_crc32( __u32 c, struct kvec *iov, unsigned int cnt ) + { + unsigned int j; +@@ -1570,17 +1572,17 @@ static int locked_dvb_net_open(struct in + struct dvb_net *dvbnet = dvbdev->priv; + int ret; + +- if (mutex_lock_interruptible(&dvbnet->remove_mutex)) ++ if (mutex_lock_interruptible(&remove_mutex)) + return -ERESTARTSYS; + + if (dvbnet->exit) { +- mutex_unlock(&dvbnet->remove_mutex); ++ mutex_unlock(&remove_mutex); + return -ENODEV; + } + + ret = dvb_generic_open(inode, file); + +- mutex_unlock(&dvbnet->remove_mutex); ++ mutex_unlock(&remove_mutex); + + return ret; + } +@@ -1590,15 +1592,15 @@ static int dvb_net_close(struct inode *i + struct dvb_device *dvbdev = file->private_data; + struct dvb_net *dvbnet = dvbdev->priv; + +- mutex_lock(&dvbnet->remove_mutex); ++ mutex_lock(&remove_mutex); + + dvb_generic_release(inode, file); + + if (dvbdev->users == 1 && dvbnet->exit == 1) { +- mutex_unlock(&dvbnet->remove_mutex); ++ mutex_unlock(&remove_mutex); + wake_up(&dvbdev->wait_queue); + } else { +- mutex_unlock(&dvbnet->remove_mutex); ++ mutex_unlock(&remove_mutex); + } + + return 0; +@@ -1627,9 +1629,9 @@ void dvb_net_release (struct dvb_net *dv + { + int i; + +- mutex_lock(&dvbnet->remove_mutex); ++ mutex_lock(&remove_mutex); + dvbnet->exit = 1; +- mutex_unlock(&dvbnet->remove_mutex); ++ mutex_unlock(&remove_mutex); + + if (dvbnet->dvbdev->users < 1) + wait_event(dvbnet->dvbdev->wait_queue, +@@ -1652,7 +1654,6 @@ int dvb_net_init (struct dvb_adapter *ad + int i; + + mutex_init(&dvbnet->ioctl_mutex); +- mutex_init(&dvbnet->remove_mutex); + dvbnet->demux = dmx; + + for (i=0; i +Subject: kABI workaround for mt76_poll_msec() +Patch-mainline: Never, kABI workaround +References: git-fixes + +Re-create a dummy function __mt76_poll_msec() and re-export for kABI +compatibility, which was converted to a macro in +wifi-mt76-add-flexible-polling-wait-interval-support.patch. + +Signed-off-by: Takashi Iwai + +--- + drivers/net/wireless/mediatek/mt76/util.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/net/wireless/mediatek/mt76/util.c ++++ b/drivers/net/wireless/mediatek/mt76/util.c +@@ -138,4 +138,13 @@ int __mt76_worker_fn(void *ptr) + } + EXPORT_SYMBOL_GPL(__mt76_worker_fn); + ++/* FIXME: re-added for SLE kABI compatibility */ ++#undef __mt76_poll_msec ++bool __mt76_poll_msec(struct mt76_dev *dev, u32 offset, u32 mask, u32 val, ++ int timeout) ++{ ++ return ____mt76_poll_msec(dev, offset, mask, val, timeout, 10); ++} ++EXPORT_SYMBOL_GPL(__mt76_poll_msec); ++ + MODULE_LICENSE("Dual BSD/GPL"); diff --git a/patches.suse/ACPI-EC-Fix-oops-when-removing-custom-query-handlers.patch b/patches.suse/ACPI-EC-Fix-oops-when-removing-custom-query-handlers.patch new file mode 100644 index 0000000..e826862 --- /dev/null +++ b/patches.suse/ACPI-EC-Fix-oops-when-removing-custom-query-handlers.patch @@ -0,0 +1,40 @@ +From e5b492c6bb900fcf9722e05f4a10924410e170c1 Mon Sep 17 00:00:00 2001 +From: Armin Wolf +Date: Fri, 24 Mar 2023 21:26:27 +0100 +Subject: [PATCH] ACPI: EC: Fix oops when removing custom query handlers +Git-commit: e5b492c6bb900fcf9722e05f4a10924410e170c1 +Patch-mainline: v6.4-rc1 +References: git-fixes + +When removing custom query handlers, the handler might still +be used inside the EC query workqueue, causing a kernel oops +if the module holding the callback function was already unloaded. + +Fix this by flushing the EC query workqueue when removing +custom query handlers. + +Tested on a Acer Travelmate 4002WLMi + +Signed-off-by: Armin Wolf +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/acpi/ec.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index 5ef72287d1be..928899ab9502 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -1133,6 +1133,7 @@ static void acpi_ec_remove_query_handlers(struct acpi_ec *ec, + void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit) + { + acpi_ec_remove_query_handlers(ec, false, query_bit); ++ flush_workqueue(ec_query_wq); + } + EXPORT_SYMBOL_GPL(acpi_ec_remove_query_handler); + +-- +2.35.3 + diff --git a/patches.suse/ACPI-bus-Ensure-that-notify-handlers-are-not-running.patch b/patches.suse/ACPI-bus-Ensure-that-notify-handlers-are-not-running.patch new file mode 100644 index 0000000..4469c51 --- /dev/null +++ b/patches.suse/ACPI-bus-Ensure-that-notify-handlers-are-not-running.patch @@ -0,0 +1,34 @@ +From faae443738c6f0dac9b0d3d11d108f6911a989a9 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Fri, 14 Apr 2023 16:00:48 +0200 +Subject: [PATCH] ACPI: bus: Ensure that notify handlers are not running after removal +Git-commit: faae443738c6f0dac9b0d3d11d108f6911a989a9 +Patch-mainline: v6.4-rc1 +References: git-fixes + +Currently, acpi_device_remove_notify_handler() may return while the +notify handler being removed is still running which may allow the +module holding that handler to be torn down prematurely. + +Address this issue by making acpi_device_remove_notify_handler() wait +for the handling of all the ACPI events in progress to complete before +returning. + +Fixes: 5894b0c46e49 ("ACPI / scan: Move bus operations and notification routines to bus.c") +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/acpi/bus.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -572,6 +572,7 @@ static void acpi_device_remove_notify_ha + else + acpi_remove_notify_handler(device->handle, ACPI_DEVICE_NOTIFY, + acpi_notify_device); ++ acpi_os_wait_events_complete(); + } + + /* Handle events targeting \_SB device (at present only graceful shutdown) */ diff --git a/patches.suse/ACPICA-ACPICA-check-null-return-of-ACPI_ALLOCATE_ZER.patch b/patches.suse/ACPICA-ACPICA-check-null-return-of-ACPI_ALLOCATE_ZER.patch new file mode 100644 index 0000000..5f6ad76 --- /dev/null +++ b/patches.suse/ACPICA-ACPICA-check-null-return-of-ACPI_ALLOCATE_ZER.patch @@ -0,0 +1,39 @@ +From ae5a0eccc85fc960834dd66e3befc2728284b86c Mon Sep 17 00:00:00 2001 +From: void0red <30990023+void0red@users.noreply.github.com> +Date: Wed, 5 Apr 2023 15:57:57 +0200 +Subject: [PATCH] ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects +Git-commit: ae5a0eccc85fc960834dd66e3befc2728284b86c +Patch-mainline: v6.4-rc1 +References: git-fixes + +ACPICA commit 0d5f467d6a0ba852ea3aad68663cbcbd43300fd4 + +ACPI_ALLOCATE_ZEROED may fails, object_info might be null and will cause +null pointer dereference later. + +Link: https://github.com/acpica/acpica/commit/0d5f467d +Signed-off-by: Bob Moore +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/acpi/acpica/dbnames.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/acpi/acpica/dbnames.c b/drivers/acpi/acpica/dbnames.c +index 3615e1a6efd8..b91155ea9c34 100644 +--- a/drivers/acpi/acpica/dbnames.c ++++ b/drivers/acpi/acpica/dbnames.c +@@ -652,6 +652,9 @@ acpi_status acpi_db_display_objects(char *obj_type_arg, char *display_count_arg) + object_info = + ACPI_ALLOCATE_ZEROED(sizeof(struct acpi_object_info)); + ++ if (!object_info) ++ return (AE_NO_MEMORY); ++ + /* Walk the namespace from the root */ + + (void)acpi_walk_namespace(ACPI_TYPE_ANY, ACPI_ROOT_OBJECT, +-- +2.35.3 + diff --git a/patches.suse/ACPICA-Avoid-undefined-behavior-applying-zero-offset.patch b/patches.suse/ACPICA-Avoid-undefined-behavior-applying-zero-offset.patch new file mode 100644 index 0000000..1f10b7b --- /dev/null +++ b/patches.suse/ACPICA-Avoid-undefined-behavior-applying-zero-offset.patch @@ -0,0 +1,67 @@ +From 05bb0167c80b8f93c6a4e0451b7da9b96db990c2 Mon Sep 17 00:00:00 2001 +From: Tamir Duberstein +Date: Wed, 5 Apr 2023 15:42:43 +0200 +Subject: [PATCH] ACPICA: Avoid undefined behavior: applying zero offset to null pointer +Git-commit: 05bb0167c80b8f93c6a4e0451b7da9b96db990c2 +Patch-mainline: v6.4-rc1 +References: git-fixes + +ACPICA commit 770653e3ba67c30a629ca7d12e352d83c2541b1e + +Before this change we see the following UBSAN stack trace in Fuchsia: + + #0 0x000021e4213b3302 in acpi_ds_init_aml_walk(struct acpi_walk_state*, union acpi_parse_object*, struct acpi_namespace_node*, u8*, u32, struct acpi_evaluate_info*, u8) ../../third_party/acpica/source/components/dispatcher/dswstate.c:682 +0x233302 + #1.2 0x000020d0f660777f in ubsan_get_stack_trace() compiler-rt/lib/ubsan/ubsan_diag.cpp:41 +0x3d77f + #1.1 0x000020d0f660777f in maybe_print_stack_trace() compiler-rt/lib/ubsan/ubsan_diag.cpp:51 +0x3d77f + #1 0x000020d0f660777f in ~scoped_report() compiler-rt/lib/ubsan/ubsan_diag.cpp:387 +0x3d77f + #2 0x000020d0f660b96d in handlepointer_overflow_impl() compiler-rt/lib/ubsan/ubsan_handlers.cpp:809 +0x4196d + #3 0x000020d0f660b50d in compiler-rt/lib/ubsan/ubsan_handlers.cpp:815 +0x4150d + #4 0x000021e4213b3302 in acpi_ds_init_aml_walk(struct acpi_walk_state*, union acpi_parse_object*, struct acpi_namespace_node*, u8*, u32, struct acpi_evaluate_info*, u8) ../../third_party/acpica/source/components/dispatcher/dswstate.c:682 +0x233302 + #5 0x000021e4213e2369 in acpi_ds_call_control_method(struct acpi_thread_state*, struct acpi_walk_state*, union acpi_parse_object*) ../../third_party/acpica/source/components/dispatcher/dsmethod.c:605 +0x262369 + #6 0x000021e421437fac in acpi_ps_parse_aml(struct acpi_walk_state*) ../../third_party/acpica/source/components/parser/psparse.c:550 +0x2b7fac + #7 0x000021e4214464d2 in acpi_ps_execute_method(struct acpi_evaluate_info*) ../../third_party/acpica/source/components/parser/psxface.c:244 +0x2c64d2 + #8 0x000021e4213aa052 in acpi_ns_evaluate(struct acpi_evaluate_info*) ../../third_party/acpica/source/components/namespace/nseval.c:250 +0x22a052 + #9 0x000021e421413dd8 in acpi_ns_init_one_device(acpi_handle, u32, void*, void**) ../../third_party/acpica/source/components/namespace/nsinit.c:735 +0x293dd8 + #10 0x000021e421429e98 in acpi_ns_walk_namespace(acpi_object_type, acpi_handle, u32, u32, acpi_walk_callback, acpi_walk_callback, void*, void**) ../../third_party/acpica/source/components/namespace/nswalk.c:298 +0x2a9e98 + #11 0x000021e4214131ac in acpi_ns_initialize_devices(u32) ../../third_party/acpica/source/components/namespace/nsinit.c:268 +0x2931ac + #12 0x000021e42147c40d in acpi_initialize_objects(u32) ../../third_party/acpica/source/components/utilities/utxfinit.c:304 +0x2fc40d + #13 0x000021e42126d603 in acpi::acpi_impl::initialize_acpi(acpi::acpi_impl*) ../../src/devices/board/lib/acpi/acpi-impl.cc:224 +0xed603 + +Add a simple check that avoids incrementing a pointer by zero, but +otherwise behaves as before. Note that our findings are against ACPICA +20221020, but the same code exists on master. + +Link: https://github.com/acpica/acpica/commit/770653e3 +Signed-off-by: Bob Moore +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/acpi/acpica/dswstate.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/acpi/acpica/dswstate.c b/drivers/acpi/acpica/dswstate.c +index 95af370a7dce..d3841ded3a81 100644 +--- a/drivers/acpi/acpica/dswstate.c ++++ b/drivers/acpi/acpica/dswstate.c +@@ -576,9 +576,14 @@ acpi_ds_init_aml_walk(struct acpi_walk_state *walk_state, + ACPI_FUNCTION_TRACE(ds_init_aml_walk); + + walk_state->parser_state.aml = +- walk_state->parser_state.aml_start = aml_start; +- walk_state->parser_state.aml_end = +- walk_state->parser_state.pkg_end = aml_start + aml_length; ++ walk_state->parser_state.aml_start = ++ walk_state->parser_state.aml_end = ++ walk_state->parser_state.pkg_end = aml_start; ++ /* Avoid undefined behavior: applying zero offset to null pointer */ ++ if (aml_length != 0) { ++ walk_state->parser_state.aml_end += aml_length; ++ walk_state->parser_state.pkg_end += aml_length; ++ } + + /* The next_op of the next_walk will be the beginning of the method */ + +-- +2.35.3 + diff --git a/patches.suse/ALSA-cs46xx-mark-snd_cs46xx_download_image-as-static.patch b/patches.suse/ALSA-cs46xx-mark-snd_cs46xx_download_image-as-static.patch new file mode 100644 index 0000000..7c491c0 --- /dev/null +++ b/patches.suse/ALSA-cs46xx-mark-snd_cs46xx_download_image-as-static.patch @@ -0,0 +1,40 @@ +From ccecefa4f89971e34745abbffdaf4d2c3fb2f457 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Tue, 16 May 2023 21:50:41 +0200 +Subject: [PATCH] ALSA: cs46xx: mark snd_cs46xx_download_image as static +Git-commit: ccecefa4f89971e34745abbffdaf4d2c3fb2f457 +Patch-mainline: v6.4-rc3 +References: git-fixes + +snd_cs46xx_download_image() was originally called from dsp_spos.c, but +is now local to cs46xx_lib.c. Mark it as 'static' to avoid a warning +about it lacking a declaration, and '__maybe_unused' to avoid a warning +about it being unused when CONFIG_SND_CS46XX_NEW_DSP is disabled: + +sound/pci/cs46xx/cs46xx_lib.c:534:5: error: no previous prototype for 'snd_cs46xx_download_image' + +Fixes: 89f157d9e6bf ("[ALSA] cs46xx - Fix PM resume") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20230516195046.550584-1-arnd@kernel.org +Signed-off-by: Takashi Iwai + +--- + sound/pci/cs46xx/cs46xx_lib.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/cs46xx/cs46xx_lib.c b/sound/pci/cs46xx/cs46xx_lib.c +index 62f45847b351..7d882b33d45e 100644 +--- a/sound/pci/cs46xx/cs46xx_lib.c ++++ b/sound/pci/cs46xx/cs46xx_lib.c +@@ -531,7 +531,7 @@ static int load_firmware(struct snd_cs46xx *chip) + return err; + } + +-int snd_cs46xx_download_image(struct snd_cs46xx *chip) ++static __maybe_unused int snd_cs46xx_download_image(struct snd_cs46xx *chip) + { + int idx, err; + unsigned int offset = 0; +-- +2.35.3 + diff --git a/patches.suse/ALSA-firewire-digi00x-prevent-potential-use-after-fr.patch b/patches.suse/ALSA-firewire-digi00x-prevent-potential-use-after-fr.patch new file mode 100644 index 0000000..1b4ea24 --- /dev/null +++ b/patches.suse/ALSA-firewire-digi00x-prevent-potential-use-after-fr.patch @@ -0,0 +1,40 @@ +From c0e72058d5e21982e61a29de6b098f7c1f0db498 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 9 May 2023 12:07:11 +0300 +Subject: [PATCH] ALSA: firewire-digi00x: prevent potential use after free +Git-commit: c0e72058d5e21982e61a29de6b098f7c1f0db498 +Patch-mainline: v6.4-rc3 +References: git-fixes + +This code was supposed to return an error code if init_stream() +failed, but it instead freed dg00x->rx_stream and returned success. +This potentially leads to a use after free. + +Fixes: 9a08067ec318 ("ALSA: firewire-digi00x: support AMDTP domain") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/c224cbd5-d9e2-4cd4-9bcf-2138eb1d35c6@kili.mountain +Signed-off-by: Takashi Iwai + +--- + sound/firewire/digi00x/digi00x-stream.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/firewire/digi00x/digi00x-stream.c b/sound/firewire/digi00x/digi00x-stream.c +index a15f55b0dce3..295163bb8abb 100644 +--- a/sound/firewire/digi00x/digi00x-stream.c ++++ b/sound/firewire/digi00x/digi00x-stream.c +@@ -259,8 +259,10 @@ int snd_dg00x_stream_init_duplex(struct snd_dg00x *dg00x) + return err; + + err = init_stream(dg00x, &dg00x->tx_stream); +- if (err < 0) ++ if (err < 0) { + destroy_stream(dg00x, &dg00x->rx_stream); ++ return err; ++ } + + err = amdtp_domain_init(&dg00x->domain); + if (err < 0) { +-- +2.35.3 + diff --git a/patches.suse/ALSA-hda-Add-NVIDIA-codec-IDs-a3-through-a7-to-patch.patch b/patches.suse/ALSA-hda-Add-NVIDIA-codec-IDs-a3-through-a7-to-patch.patch new file mode 100644 index 0000000..a17e34f --- /dev/null +++ b/patches.suse/ALSA-hda-Add-NVIDIA-codec-IDs-a3-through-a7-to-patch.patch @@ -0,0 +1,37 @@ +From dc4f2ccaedddb489a83e7b12ebbdc347272aacc9 Mon Sep 17 00:00:00 2001 +From: Nikhil Mahale +Date: Wed, 17 May 2023 14:37:36 +0530 +Subject: [PATCH] ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table +Git-commit: dc4f2ccaedddb489a83e7b12ebbdc347272aacc9 +Patch-mainline: v6.4-rc3 +References: git-fixes + +These IDs are for AD102, AD103, AD104, AD106, and AD107 gpus with +audio functions that are largely similar to the existing ones. + +Tested audio using gnome-settings, over HDMI, DP-SST and DP-MST +connections on AD106 gpu. + +Signed-off-by: Nikhil Mahale +Cc: +Link: https://lore.kernel.org/r/20230517090736.15088-1-nmahale@nvidia.com +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_hdmi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -4463,6 +4463,11 @@ HDA_CODEC_ENTRY(0x10de009d, "GPU 9d HDMI + HDA_CODEC_ENTRY(0x10de009e, "GPU 9e HDMI/DP", patch_nvhdmi), + HDA_CODEC_ENTRY(0x10de009f, "GPU 9f HDMI/DP", patch_nvhdmi), + HDA_CODEC_ENTRY(0x10de00a0, "GPU a0 HDMI/DP", patch_nvhdmi), ++HDA_CODEC_ENTRY(0x10de00a3, "GPU a3 HDMI/DP", patch_nvhdmi), ++HDA_CODEC_ENTRY(0x10de00a4, "GPU a4 HDMI/DP", patch_nvhdmi), ++HDA_CODEC_ENTRY(0x10de00a5, "GPU a5 HDMI/DP", patch_nvhdmi), ++HDA_CODEC_ENTRY(0x10de00a6, "GPU a6 HDMI/DP", patch_nvhdmi), ++HDA_CODEC_ENTRY(0x10de00a7, "GPU a7 HDMI/DP", patch_nvhdmi), + HDA_CODEC_ENTRY(0x10de8001, "MCP73 HDMI", patch_nvhdmi_2ch), + HDA_CODEC_ENTRY(0x10de8067, "MCP67/68 HDMI", patch_nvhdmi_2ch), + HDA_CODEC_ENTRY(0x11069f80, "VX900 HDMI/DP", patch_via_hdmi), diff --git a/patches.suse/ALSA-hda-Fix-Oops-by-9.1-surround-channel-names.patch b/patches.suse/ALSA-hda-Fix-Oops-by-9.1-surround-channel-names.patch new file mode 100644 index 0000000..0e876cf --- /dev/null +++ b/patches.suse/ALSA-hda-Fix-Oops-by-9.1-surround-channel-names.patch @@ -0,0 +1,61 @@ +From 3b44ec8c5c44790a82f07e90db45643c762878c6 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 16 May 2023 20:44:12 +0200 +Subject: [PATCH] ALSA: hda: Fix Oops by 9.1 surround channel names +Git-commit: 3b44ec8c5c44790a82f07e90db45643c762878c6 +Patch-mainline: v6.4-rc3 +References: git-fixes + +get_line_out_pfx() may trigger an Oops by overflowing the static array +with more than 8 channels. This was reported for MacBookPro 12,1 with +Cirrus codec. + +As a workaround, extend for the 9.1 channels and also fix the +potential Oops by unifying the code paths accessing the same array +with the proper size check. + +Reported-by: Olliver Schinagl +Cc: +Link: https://lore.kernel.org/r/64d95eb0-dbdb-cff8-a8b1-988dc22b24cd@schinagl.nl +Link: https://lore.kernel.org/r/20230516184412.24078-1-tiwai@suse.de +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/hda_generic.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c +index fc114e522480..dbf7aa88e0e3 100644 +--- a/sound/pci/hda/hda_generic.c ++++ b/sound/pci/hda/hda_generic.c +@@ -1155,8 +1155,8 @@ static bool path_has_mixer(struct hda_codec *codec, int path_idx, int ctl_type) + return path && path->ctls[ctl_type]; + } + +-static const char * const channel_name[4] = { +- "Front", "Surround", "CLFE", "Side" ++static const char * const channel_name[] = { ++ "Front", "Surround", "CLFE", "Side", "Back", + }; + + /* give some appropriate ctl name prefix for the given line out channel */ +@@ -1182,7 +1182,7 @@ static const char *get_line_out_pfx(struct hda_codec *codec, int ch, + + /* multi-io channels */ + if (ch >= cfg->line_outs) +- return channel_name[ch]; ++ goto fixed_name; + + switch (cfg->line_out_type) { + case AUTO_PIN_SPEAKER_OUT: +@@ -1234,6 +1234,7 @@ static const char *get_line_out_pfx(struct hda_codec *codec, int ch, + if (cfg->line_outs == 1 && !spec->multi_ios) + return "Line Out"; + ++ fixed_name: + if (ch >= ARRAY_SIZE(channel_name)) { + snd_BUG(); + return "PCM"; +-- +2.35.3 + diff --git a/patches.suse/ALSA-hda-realtek-Add-a-quirk-for-HP-EliteDesk-805.patch b/patches.suse/ALSA-hda-realtek-Add-a-quirk-for-HP-EliteDesk-805.patch new file mode 100644 index 0000000..d2e9046 --- /dev/null +++ b/patches.suse/ALSA-hda-realtek-Add-a-quirk-for-HP-EliteDesk-805.patch @@ -0,0 +1,34 @@ +From 90670ef774a8b6700c38ce1222e6aa263be54d5f Mon Sep 17 00:00:00 2001 +From: Ai Chao +Date: Sat, 6 May 2023 10:26:53 +0800 +Subject: [PATCH] ALSA: hda/realtek: Add a quirk for HP EliteDesk 805 +Git-commit: 90670ef774a8b6700c38ce1222e6aa263be54d5f +Patch-mainline: v6.4-rc3 +References: git-fixes + +Add a quirk for HP EliteDesk 805 to fixup ALC3867 headset MIC no sound. + +Signed-off-by: Ai Chao +Cc: +Link: https://lore.kernel.org/r/20230506022653.2074343-1-aichao@kylinos.cn +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 7082b1d220c5..bc062c0a1916 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -11665,6 +11665,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800), + SND_PCI_QUIRK(0x103c, 0x870c, "HP", ALC897_FIXUP_HP_HSMIC_VERB), + SND_PCI_QUIRK(0x103c, 0x8719, "HP", ALC897_FIXUP_HP_HSMIC_VERB), ++ SND_PCI_QUIRK(0x103c, 0x872b, "HP", ALC897_FIXUP_HP_HSMIC_VERB), + SND_PCI_QUIRK(0x103c, 0x873e, "HP", ALC671_FIXUP_HP_HEADSET_MIC2), + SND_PCI_QUIRK(0x103c, 0x877e, "HP 288 Pro G6", ALC671_FIXUP_HP_HEADSET_MIC2), + SND_PCI_QUIRK(0x103c, 0x885f, "HP 288 Pro G8", ALC671_FIXUP_HP_HEADSET_MIC2), +-- +2.35.3 + diff --git a/patches.suse/ALSA-hda-realtek-Add-quirk-for-2nd-ASUS-GU603.patch b/patches.suse/ALSA-hda-realtek-Add-quirk-for-2nd-ASUS-GU603.patch new file mode 100644 index 0000000..66e3fe1 --- /dev/null +++ b/patches.suse/ALSA-hda-realtek-Add-quirk-for-2nd-ASUS-GU603.patch @@ -0,0 +1,34 @@ +From a4671b7fba59775845ee60cfbdfc4ba64300211b Mon Sep 17 00:00:00 2001 +From: "Luke D. Jones" +Date: Sat, 6 May 2023 11:58:24 +1200 +Subject: [PATCH] ALSA: hda/realtek: Add quirk for 2nd ASUS GU603 +Git-commit: a4671b7fba59775845ee60cfbdfc4ba64300211b +Patch-mainline: v6.4-rc3 +References: git-fixes + +Add quirk for GU603 with 0x1c62 variant of codec. + +Signed-off-by: Luke D. Jones +Cc: +Link: https://lore.kernel.org/r/20230505235824.49607-2-luke@ljones.dev +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index e7d2e20b91f5..7082b1d220c5 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9522,6 +9522,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC), + SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), ++ SND_PCI_QUIRK(0x1043, 0x1c62, "ASUS GU603", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1c92, "ASUS ROG Strix G15", ALC285_FIXUP_ASUS_G533Z_PINS), + SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x1d42, "ASUS Zephyrus G14 2022", ALC289_FIXUP_ASUS_GA401), +-- +2.35.3 + diff --git a/patches.suse/ALSA-hda-realtek-Add-quirk-for-Clevo-L140AU.patch b/patches.suse/ALSA-hda-realtek-Add-quirk-for-Clevo-L140AU.patch new file mode 100644 index 0000000..2a6d3c7 --- /dev/null +++ b/patches.suse/ALSA-hda-realtek-Add-quirk-for-Clevo-L140AU.patch @@ -0,0 +1,35 @@ +From 0a6b36c5dc3dda0196f4fb65bdb34c38b8d060c3 Mon Sep 17 00:00:00 2001 +From: Jeremy Soller +Date: Fri, 5 May 2023 10:36:51 -0600 +Subject: [PATCH] ALSA: hda/realtek: Add quirk for Clevo L140AU +Git-commit: 0a6b36c5dc3dda0196f4fb65bdb34c38b8d060c3 +Patch-mainline: v6.4-rc3 +References: git-fixes + +Fixes headset detection on Clevo L140AU. + +Signed-off-by: Jeremy Soller +Signed-off-by: Tim Crawford +Cc: +Link: https://lore.kernel.org/r/20230505163651.21257-1-tcrawford@system76.com +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 172ffc2c332b..e7d2e20b91f5 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9618,6 +9618,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1558, 0x7716, "Clevo NS50PU", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x7717, "Clevo NS70PU", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x7718, "Clevo L140PU", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x7724, "Clevo L140AU", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8228, "Clevo NR40BU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8520, "Clevo NH50D[CD]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8521, "Clevo NH77D[CD]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), +-- +2.35.3 + diff --git a/patches.suse/ALSA-hda-realtek-Add-quirk-for-HP-EliteBook-G10-lapt.patch b/patches.suse/ALSA-hda-realtek-Add-quirk-for-HP-EliteBook-G10-lapt.patch new file mode 100644 index 0000000..83752c6 --- /dev/null +++ b/patches.suse/ALSA-hda-realtek-Add-quirk-for-HP-EliteBook-G10-lapt.patch @@ -0,0 +1,58 @@ +From 3e10f6ca76c4d00019badebd235c9d7f0068261e Mon Sep 17 00:00:00 2001 +From: Vitaly Rodionov +Date: Wed, 10 May 2023 15:22:27 +0100 +Subject: [PATCH] ALSA: hda/realtek: Add quirk for HP EliteBook G10 laptops +Git-commit: 3e10f6ca76c4d00019badebd235c9d7f0068261e +Patch-mainline: v6.4-rc3 +References: git-fixes + +Add support for HP EliteBook 835/845/845W/865 G10 laptops +with CS35L41 amplifiers on I2C/SPI bus connected to Realtek codec. + +Signed-off-by: Vitaly Rodionov +Cc: +Link: https://lore.kernel.org/r/20230510142227.32945-1-vitalyr@opensource.cirrus.com +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_realtek.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index bc062c0a1916..5166f1eb510d 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9458,7 +9458,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x8aa3, "HP ProBook 450 G9 (MB 8AA1)", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8aa8, "HP EliteBook 640 G9 (MB 8AA6)", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8aab, "HP EliteBook 650 G9 (MB 8AA9)", ALC236_FIXUP_HP_GPIO_LED), +- SND_PCI_QUIRK(0x103c, 0x8abb, "HP ZBook Firefly 14 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), ++ SND_PCI_QUIRK(0x103c, 0x8abb, "HP ZBook Firefly 14 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8ad1, "HP EliteBook 840 14 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8ad2, "HP EliteBook 860 16 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8b42, "HP", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), +@@ -9469,8 +9469,13 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x8b47, "HP", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8b5d, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), + SND_PCI_QUIRK(0x103c, 0x8b5e, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), ++ SND_PCI_QUIRK(0x103c, 0x8b63, "HP Elite Dragonfly 13.5 inch G4", ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8b65, "HP ProBook 455 15.6 inch G10 Notebook PC", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), + SND_PCI_QUIRK(0x103c, 0x8b66, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), ++ SND_PCI_QUIRK(0x103c, 0x8b70, "HP EliteBook 835 G10", ALC287_FIXUP_CS35L41_I2C_2), ++ SND_PCI_QUIRK(0x103c, 0x8b72, "HP EliteBook 845 G10", ALC287_FIXUP_CS35L41_I2C_2), ++ SND_PCI_QUIRK(0x103c, 0x8b74, "HP EliteBook 845W G10", ALC287_FIXUP_CS35L41_I2C_2), ++ SND_PCI_QUIRK(0x103c, 0x8b77, "HP ElieBook 865 G10", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x103c, 0x8b7a, "HP", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8b7d, "HP", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8b87, "HP", ALC236_FIXUP_HP_GPIO_LED), +@@ -9481,6 +9486,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x8b92, "HP", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8b96, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), + SND_PCI_QUIRK(0x103c, 0x8bf0, "HP", ALC236_FIXUP_HP_GPIO_LED), ++ SND_PCI_QUIRK(0x103c, 0x8c26, "HP HP EliteBook 800G11", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300), + SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), +-- +2.35.3 + diff --git a/patches.suse/ALSA-hda-realtek-Apply-HP-B-O-top-speaker-profile-to.patch b/patches.suse/ALSA-hda-realtek-Apply-HP-B-O-top-speaker-profile-to.patch new file mode 100644 index 0000000..256e85f --- /dev/null +++ b/patches.suse/ALSA-hda-realtek-Apply-HP-B-O-top-speaker-profile-to.patch @@ -0,0 +1,38 @@ +From 92553ee03166ef8fa978e7683f9f4af30c9c4e6b Mon Sep 17 00:00:00 2001 +From: "Ryan C. Underwood" +Date: Thu, 11 May 2023 12:32:21 -0500 +Subject: [PATCH] ALSA: hda/realtek: Apply HP B&O top speaker profile to Pavilion 15 +Git-commit: 92553ee03166ef8fa978e7683f9f4af30c9c4e6b +Patch-mainline: v6.4-rc3 +References: git-fixes + +The Pavilion 15 line has B&O top speakers similar to the x360 and +applying the same profile produces good sound. Without this, the +sound would be tinny and underpowered without either applying +model=alc295-hp-x360 or booting another OS first. + +Signed-off-by: Ryan Underwood +Fixes: 563785edfcef ("ALSA: hda/realtek - Add quirk entry for HP Pavilion 15") +Link: https://lore.kernel.org/r/ZF0mpcMz3ezP9KQw@icequake.net +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_realtek.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 3df32eced8e4..92a920f46b7c 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9381,7 +9381,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x802f, "HP Z240", ALC221_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x8077, "HP", ALC256_FIXUP_HP_HEADSET_MIC), + SND_PCI_QUIRK(0x103c, 0x8158, "HP", ALC256_FIXUP_HP_HEADSET_MIC), +- SND_PCI_QUIRK(0x103c, 0x820d, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3), ++ SND_PCI_QUIRK(0x103c, 0x820d, "HP Pavilion 15", ALC295_FIXUP_HP_X360), + SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC), + SND_PCI_QUIRK(0x103c, 0x827e, "HP x360", ALC295_FIXUP_HP_X360), + SND_PCI_QUIRK(0x103c, 0x827f, "HP x360", ALC269_FIXUP_HP_MUTE_LED_MIC3), +-- +2.35.3 + diff --git a/patches.suse/ALSA-hda-realtek-Fix-mute-and-micmute-LEDs-for-yet-a.patch b/patches.suse/ALSA-hda-realtek-Fix-mute-and-micmute-LEDs-for-yet-a.patch new file mode 100644 index 0000000..ba0cddf --- /dev/null +++ b/patches.suse/ALSA-hda-realtek-Fix-mute-and-micmute-LEDs-for-yet-a.patch @@ -0,0 +1,35 @@ +From 9dc68a4fe70893b000fb3c92c68b9f72369cf448 Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Fri, 12 May 2023 16:34:16 +0800 +Subject: [PATCH] ALSA: hda/realtek: Fix mute and micmute LEDs for yet another HP laptop +Git-commit: 9dc68a4fe70893b000fb3c92c68b9f72369cf448 +Patch-mainline: v6.4-rc3 +References: git-fixes + +There's yet another laptop that needs the fixup to enable mute and +micmute LEDs. So do it accordingly. + +Signed-off-by: Kai-Heng Feng +Cc: +Link: https://lore.kernel.org/r/20230512083417.157127-1-kai.heng.feng@canonical.com +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 92a920f46b7c..a7e4765eff80 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9503,6 +9503,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x8b8f, "HP", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8b92, "HP", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8b96, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), ++ SND_PCI_QUIRK(0x103c, 0x8b97, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), + SND_PCI_QUIRK(0x103c, 0x8bf0, "HP", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8c26, "HP HP EliteBook 800G11", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), +-- +2.35.3 + diff --git a/patches.suse/ALSA-usb-audio-Add-a-sample-rate-workaround-for-Line.patch b/patches.suse/ALSA-usb-audio-Add-a-sample-rate-workaround-for-Line.patch new file mode 100644 index 0000000..c18ae94 --- /dev/null +++ b/patches.suse/ALSA-usb-audio-Add-a-sample-rate-workaround-for-Line.patch @@ -0,0 +1,36 @@ +From 359b4315471181f108723c61612d96e383e56179 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 12 May 2023 09:58:58 +0200 +Subject: [PATCH] ALSA: usb-audio: Add a sample rate workaround for Line6 Pod Go +Git-commit: 359b4315471181f108723c61612d96e383e56179 +Patch-mainline: v6.4-rc3 +References: git-fixes + +Line6 Pod Go (0e41:424b) requires the similar workaround for the fixed +48k sample rate like other Line6 models. This patch adds the +corresponding entry to line6_parse_audio_format_rate_quirk(). + +Reported-by: John Humlick +Cc: +Link: https://lore.kernel.org/r/20230512075858.22813-1-tiwai@suse.de +Signed-off-by: Takashi Iwai + +--- + sound/usb/format.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/usb/format.c b/sound/usb/format.c +index 4b1c5ba121f3..ab5fed9f55b6 100644 +--- a/sound/usb/format.c ++++ b/sound/usb/format.c +@@ -423,6 +423,7 @@ static int line6_parse_audio_format_rates_quirk(struct snd_usb_audio *chip, + case USB_ID(0x0e41, 0x4248): /* Line6 Helix >= fw 2.82 */ + case USB_ID(0x0e41, 0x4249): /* Line6 Helix Rack >= fw 2.82 */ + case USB_ID(0x0e41, 0x424a): /* Line6 Helix LT >= fw 2.82 */ ++ case USB_ID(0x0e41, 0x424b): /* Line6 Pod Go */ + case USB_ID(0x19f7, 0x0011): /* Rode Rodecaster Pro */ + return set_fixed_rate(fp, 48000, SNDRV_PCM_RATE_48000); + } +-- +2.35.3 + diff --git a/patches.suse/ARM-9296-1-HP-Jornada-7XX-fix-kernel-doc-warnings.patch b/patches.suse/ARM-9296-1-HP-Jornada-7XX-fix-kernel-doc-warnings.patch new file mode 100644 index 0000000..af57f44 --- /dev/null +++ b/patches.suse/ARM-9296-1-HP-Jornada-7XX-fix-kernel-doc-warnings.patch @@ -0,0 +1,69 @@ +From 46dd6078dbc7e363a8bb01209da67015a1538929 Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Sun, 23 Apr 2023 06:48:45 +0100 +Subject: [PATCH] ARM: 9296/1: HP Jornada 7XX: fix kernel-doc warnings +Git-commit: 46dd6078dbc7e363a8bb01209da67015a1538929 +Patch-mainline: v6.4-rc2 +References: git-fixes + +Fix kernel-doc warnings from the kernel test robot: + +jornada720_ssp.c:24: warning: Function parameter or member 'jornada_ssp_lock' not described in 'DEFINE_SPINLOCK' +jornada720_ssp.c:24: warning: expecting prototype for arch/arm/mac(). Prototype was for DEFINE_SPINLOCK() instead +jornada720_ssp.c:34: warning: Function parameter or member 'byte' not described in 'jornada_ssp_reverse' +jornada720_ssp.c:57: warning: Function parameter or member 'byte' not described in 'jornada_ssp_byte' +jornada720_ssp.c:85: warning: Function parameter or member 'byte' not described in 'jornada_ssp_inout' + +Link: lore.kernel.org/r/202304210535.tWby3jWF-lkp@intel.com + +Fixes: 69ebb22277a5 ("[ARM] 4506/1: HP Jornada 7XX: Addition of SSP Platform Driver") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Cc: Arnd Bergmann +Cc: Kristoffer Ericson +Cc: patches@armlinux.org.uk +Signed-off-by: Russell King (Oracle) +Acked-by: Takashi Iwai + +--- + arch/arm/mach-sa1100/jornada720_ssp.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-sa1100/jornada720_ssp.c b/arch/arm/mach-sa1100/jornada720_ssp.c +index 1dbe98948ce3..9627c4cf3e41 100644 +--- a/arch/arm/mach-sa1100/jornada720_ssp.c ++++ b/arch/arm/mach-sa1100/jornada720_ssp.c +@@ -1,5 +1,5 @@ + // SPDX-License-Identifier: GPL-2.0-only +-/** ++/* + * arch/arm/mac-sa1100/jornada720_ssp.c + * + * Copyright (C) 2006/2007 Kristoffer Ericson +@@ -26,6 +26,7 @@ static unsigned long jornada_ssp_flags; + + /** + * jornada_ssp_reverse - reverses input byte ++ * @byte: input byte to reverse + * + * we need to reverse all data we receive from the mcu due to its physical location + * returns : 01110111 -> 11101110 +@@ -46,6 +47,7 @@ EXPORT_SYMBOL(jornada_ssp_reverse); + + /** + * jornada_ssp_byte - waits for ready ssp bus and sends byte ++ * @byte: input byte to transmit + * + * waits for fifo buffer to clear and then transmits, if it doesn't then we will + * timeout after rounds. Needs mcu running before its called. +@@ -77,6 +79,7 @@ EXPORT_SYMBOL(jornada_ssp_byte); + + /** + * jornada_ssp_inout - decide if input is command or trading byte ++ * @byte: input byte to send (may be %TXDUMMY) + * + * returns : (jornada_ssp_byte(byte)) on success + * : %-ETIMEDOUT on timeout failure +-- +2.35.3 + diff --git a/patches.suse/ASoC-fsl_micfil-Fix-error-handler-with-pm_runtime_en.patch b/patches.suse/ASoC-fsl_micfil-Fix-error-handler-with-pm_runtime_en.patch new file mode 100644 index 0000000..7355142 --- /dev/null +++ b/patches.suse/ASoC-fsl_micfil-Fix-error-handler-with-pm_runtime_en.patch @@ -0,0 +1,66 @@ +From 17955aba7877a4494d8093ae5498e19469b01d57 Mon Sep 17 00:00:00 2001 +From: Shengjiu Wang +Date: Mon, 8 May 2023 18:16:36 +0800 +Subject: [PATCH] ASoC: fsl_micfil: Fix error handler with pm_runtime_enable +Git-commit: 17955aba7877a4494d8093ae5498e19469b01d57 +Patch-mainline: v6.4-rc3 +References: git-fixes + +There is error message when defer probe happens: + +fsl-micfil-dai 30ca0000.micfil: Unbalanced pm_runtime_enable! + +Fix the error handler with pm_runtime_enable and add +fsl_micfil_remove() for pm_runtime_disable. + +Fixes: 47a70e6fc9a8 ("ASoC: Add MICFIL SoC Digital Audio Interface driver.") +Signed-off-by: Shengjiu Wang + +--- + sound/soc/fsl/fsl_micfil.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +--- a/sound/soc/fsl/fsl_micfil.c ++++ b/sound/soc/fsl/fsl_micfil.c +@@ -763,7 +763,7 @@ static int fsl_micfil_probe(struct platf + ret = devm_snd_dmaengine_pcm_register(&pdev->dev, NULL, 0); + if (ret) { + dev_err(&pdev->dev, "failed to pcm register\n"); +- return ret; ++ goto err_pm_disable; + } + + ret = devm_snd_soc_register_component(&pdev->dev, &fsl_micfil_component, +@@ -771,9 +771,21 @@ static int fsl_micfil_probe(struct platf + if (ret) { + dev_err(&pdev->dev, "failed to register component %s\n", + fsl_micfil_component.name); ++ goto err_pm_disable; + } + + return ret; ++ ++err_pm_disable: ++ pm_runtime_disable(&pdev->dev); ++ ++ return ret; ++} ++ ++static int fsl_micfil_remove(struct platform_device *pdev) ++{ ++ pm_runtime_disable(&pdev->dev); ++ return 0; + } + + static int __maybe_unused fsl_micfil_runtime_suspend(struct device *dev) +@@ -834,6 +846,7 @@ static const struct dev_pm_ops fsl_micfi + + static struct platform_driver fsl_micfil_driver = { + .probe = fsl_micfil_probe, ++ .remove = fsl_micfil_remove, + .driver = { + .name = "fsl-micfil-dai", + .pm = &fsl_micfil_pm_ops, diff --git a/patches.suse/Bluetooth-L2CAP-fix-bad-unlock-balance-in-l2cap_disc.patch b/patches.suse/Bluetooth-L2CAP-fix-bad-unlock-balance-in-l2cap_disc.patch new file mode 100644 index 0000000..a6e60b6 --- /dev/null +++ b/patches.suse/Bluetooth-L2CAP-fix-bad-unlock-balance-in-l2cap_disc.patch @@ -0,0 +1,37 @@ +From 25e97f7b1866e6b8503be349eeea44bb52d661ce Mon Sep 17 00:00:00 2001 +From: Min Li +Date: Mon, 17 Apr 2023 10:27:54 +0800 +Subject: [PATCH] Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp +Git-commit: 25e97f7b1866e6b8503be349eeea44bb52d661ce +Patch-mainline: v6.4-rc1 +References: git-fixes + +conn->chan_lock isn't acquired before l2cap_get_chan_by_scid, +if l2cap_get_chan_by_scid returns NULL, then 'bad unlock balance' +is triggered. + +Reported-by: syzbot+9519d6b5b79cf7787cf3@syzkaller.appspotmail.com +Link: https://lore.kernel.org/all/000000000000894f5f05f95e9f4d@google.com/ +Signed-off-by: Min Li +Signed-off-by: Luiz Augusto von Dentz +Acked-by: Takashi Iwai + +--- + net/bluetooth/l2cap_core.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index 5cc95fd17f7d..376b523c7b26 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -4693,7 +4693,6 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, + + chan = l2cap_get_chan_by_scid(conn, scid); + if (!chan) { +- mutex_unlock(&conn->chan_lock); + return 0; + } + +-- +2.35.3 + diff --git a/patches.suse/Bluetooth-btintel-Add-LE-States-quirk-support.patch b/patches.suse/Bluetooth-btintel-Add-LE-States-quirk-support.patch new file mode 100644 index 0000000..9b27b29 --- /dev/null +++ b/patches.suse/Bluetooth-btintel-Add-LE-States-quirk-support.patch @@ -0,0 +1,41 @@ +From 77f542b10c535c9a93bf8afdd2665524935807c2 Mon Sep 17 00:00:00 2001 +From: Chethan T N +Date: Tue, 21 Mar 2023 10:03:10 +0530 +Subject: [PATCH] Bluetooth: btintel: Add LE States quirk support +Git-commit: 77f542b10c535c9a93bf8afdd2665524935807c2 +Patch-mainline: v6.4-rc1 +References: git-fixes + +Basically all Intel controllers support both Central/Peripheral +LE states. + +This patch enables the LE States quirk by default on all +Solar and Magnertor Intel controllers. + +Signed-off-by: Chethan T N +Signed-off-by: Luiz Augusto von Dentz +Acked-by: Takashi Iwai + +--- + drivers/bluetooth/btintel.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c +index af774688f1c0..7a6dc05553f1 100644 +--- a/drivers/bluetooth/btintel.c ++++ b/drivers/bluetooth/btintel.c +@@ -2684,9 +2684,8 @@ static int btintel_setup_combined(struct hci_dev *hdev) + */ + set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks); + +- /* Valid LE States quirk for GfP */ +- if (INTEL_HW_VARIANT(ver_tlv.cnvi_bt) == 0x18) +- set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks); ++ /* Apply LE States quirk from solar onwards */ ++ set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks); + + /* Setup MSFT Extension support */ + btintel_set_msft_opcode(hdev, +-- +2.35.3 + diff --git a/patches.suse/Documentation-filesystems-ramfs-rootfs-initramfs-use.patch b/patches.suse/Documentation-filesystems-ramfs-rootfs-initramfs-use.patch new file mode 100644 index 0000000..f2ea991 --- /dev/null +++ b/patches.suse/Documentation-filesystems-ramfs-rootfs-initramfs-use.patch @@ -0,0 +1,40 @@ +From bd415b5c9552d44069d4e7c1e018b6d42f25af9e Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Sun, 7 May 2023 22:59:28 -0700 +Subject: [PATCH] Documentation/filesystems: ramfs-rootfs-initramfs: use :Author: +Git-commit: bd415b5c9552d44069d4e7c1e018b6d42f25af9e +Patch-mainline: v6.4-rc3 +References: git-fixes + +Use the :Author: markup instead of making it a chapter heading. +This cleans up the table of contents for this file. + +Fixes: 7f46a240b0a1 ("[PATCH] ramfs, rootfs, and initramfs docs") +Signed-off-by: Randy Dunlap +Cc: Rob Landley +Reviewed-by: Christian Brauner +Link: https://lore.kernel.org/r/20230508055928.3548-1-rdunlap@infradead.org +Signed-off-by: Jonathan Corbet +Acked-by: Takashi Iwai + +--- + Documentation/filesystems/ramfs-rootfs-initramfs.rst | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/Documentation/filesystems/ramfs-rootfs-initramfs.rst b/Documentation/filesystems/ramfs-rootfs-initramfs.rst +index 164960631925..447f767c6462 100644 +--- a/Documentation/filesystems/ramfs-rootfs-initramfs.rst ++++ b/Documentation/filesystems/ramfs-rootfs-initramfs.rst +@@ -6,8 +6,7 @@ Ramfs, rootfs and initramfs + + October 17, 2005 + +-Rob Landley +-============================= ++:Author: Rob Landley + + What is ramfs? + -------------- +-- +2.35.3 + diff --git a/patches.suse/Documentation-filesystems-sharedsubtree-add-section-.patch b/patches.suse/Documentation-filesystems-sharedsubtree-add-section-.patch new file mode 100644 index 0000000..6991865 --- /dev/null +++ b/patches.suse/Documentation-filesystems-sharedsubtree-add-section-.patch @@ -0,0 +1,62 @@ +From 7b38ecfdf9fbb133b4d2ea3738c02291a262abe2 Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Sun, 7 May 2023 22:59:38 -0700 +Subject: [PATCH] Documentation/filesystems: sharedsubtree: add section headings +Git-commit: 7b38ecfdf9fbb133b4d2ea3738c02291a262abe2 +Patch-mainline: v6.4-rc3 +References: git-fixes + +Several of the sections are missing underlines. This makes the +generated contents have missing entries, so add the underlines. + +Fixes: 16c01b20ae05 ("doc/filesystems: more mount cleanups") +Fixes: 9cfcceea8f7e ("[PATCH] Complete description of shared subtrees.") +Signed-off-by: Randy Dunlap +Reviewed-by: Christian Brauner +Link: https://lore.kernel.org/r/20230508055938.6550-1-rdunlap@infradead.org +Signed-off-by: Jonathan Corbet +Acked-by: Takashi Iwai + +--- + Documentation/filesystems/sharedsubtree.rst | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/Documentation/filesystems/sharedsubtree.rst b/Documentation/filesystems/sharedsubtree.rst +index d83395354250..1cf56489ed48 100644 +--- a/Documentation/filesystems/sharedsubtree.rst ++++ b/Documentation/filesystems/sharedsubtree.rst +@@ -147,6 +147,7 @@ replicas continue to be exactly same. + + + 3) Setting mount states ++----------------------- + + The mount command (util-linux package) can be used to set mount + states:: +@@ -612,6 +613,7 @@ replicas continue to be exactly same. + + + 6) Quiz ++------- + + A. What is the result of the following command sequence? + +@@ -673,6 +675,7 @@ replicas continue to be exactly same. + /mnt/1/test be? + + 7) FAQ ++------ + + Q1. Why is bind mount needed? How is it different from symbolic links? + symbolic links can get stale if the destination mount gets +@@ -841,6 +844,7 @@ replicas continue to be exactly same. + tmp usr tmp usr tmp usr + + 8) Implementation ++----------------- + + 8A) Datastructure + +-- +2.35.3 + diff --git a/patches.suse/HID-logitech-hidpp-Don-t-use-the-USB-serial-for-USB-.patch b/patches.suse/HID-logitech-hidpp-Don-t-use-the-USB-serial-for-USB-.patch new file mode 100644 index 0000000..6a89776 --- /dev/null +++ b/patches.suse/HID-logitech-hidpp-Don-t-use-the-USB-serial-for-USB-.patch @@ -0,0 +1,101 @@ +From 7ad1fe0da0fa91bf920b79ab05ae97bfabecc4f4 Mon Sep 17 00:00:00 2001 +From: Bastien Nocera +Date: Thu, 2 Mar 2023 14:01:16 +0100 +Subject: [PATCH] HID: logitech-hidpp: Don't use the USB serial for USB devices +Git-commit: 7ad1fe0da0fa91bf920b79ab05ae97bfabecc4f4 +Patch-mainline: v6.4-rc1 +References: git-fixes + +For devices that support the 0x0003 feature (Device Information) version 4, +set the serial based on the output of that feature, rather than relying +on the usbhid code setting the USB serial. + +This should allow the serial when connected through USB to (nearly) +match the one when connected through a unifying receiver. + +For example, on the serials on a G903 wired/wireless mouse: +- Unifying: 4067-e8-ce-cd-45 +- USB before patch: 017C385C3837 +- USB after patch: c086-e8-ce-cd-45 + +Signed-off-by: Bastien Nocera +Link: https://lore.kernel.org/r/20230302130117.3975-1-hadess@hadess.net +Signed-off-by: Benjamin Tissoires +Acked-by: Takashi Iwai + +--- + drivers/hid/hid-logitech-hidpp.c | 51 ++++++++++++++++++++++++++++++++ + 1 file changed, 51 insertions(+) + +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index 5fc88a063297..66380876937f 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -947,6 +947,55 @@ static int hidpp_root_get_protocol_version(struct hidpp_device *hidpp) + return 0; + } + ++/* -------------------------------------------------------------------------- */ ++/* 0x0003: Device Information */ ++/* -------------------------------------------------------------------------- */ ++ ++#define HIDPP_PAGE_DEVICE_INFORMATION 0x0003 ++ ++#define CMD_GET_DEVICE_INFO 0x00 ++ ++static int hidpp_get_serial(struct hidpp_device *hidpp, u32 *serial) ++{ ++ struct hidpp_report response; ++ u8 feature_type; ++ u8 feature_index; ++ int ret; ++ ++ ret = hidpp_root_get_feature(hidpp, HIDPP_PAGE_DEVICE_INFORMATION, ++ &feature_index, ++ &feature_type); ++ if (ret) ++ return ret; ++ ++ ret = hidpp_send_fap_command_sync(hidpp, feature_index, ++ CMD_GET_DEVICE_INFO, ++ NULL, 0, &response); ++ if (ret) ++ return ret; ++ ++ /* See hidpp_unifying_get_serial() */ ++ *serial = *((u32 *)&response.rap.params[1]); ++ return 0; ++} ++ ++static int hidpp_serial_init(struct hidpp_device *hidpp) ++{ ++ struct hid_device *hdev = hidpp->hid_dev; ++ u32 serial; ++ int ret; ++ ++ ret = hidpp_get_serial(hidpp, &serial); ++ if (ret) ++ return ret; ++ ++ snprintf(hdev->uniq, sizeof(hdev->uniq), "%04x-%4phD", ++ hdev->product, &serial); ++ dbg_hid("HID++ DeviceInformation: Got serial: %s\n", hdev->uniq); ++ ++ return 0; ++} ++ + /* -------------------------------------------------------------------------- */ + /* 0x0005: GetDeviceNameType */ + /* -------------------------------------------------------------------------- */ +@@ -4210,6 +4259,8 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) + + if (hidpp->quirks & HIDPP_QUIRK_UNIFYING) + hidpp_unifying_init(hidpp); ++ else if (hid_is_usb(hidpp->hid_dev)) ++ hidpp_serial_init(hidpp); + + connected = hidpp_root_get_protocol_version(hidpp) == 0; + atomic_set(&hidpp->connected, connected); +-- +2.35.3 + diff --git a/patches.suse/HID-logitech-hidpp-Reconcile-USB-and-Unifying-serial.patch b/patches.suse/HID-logitech-hidpp-Reconcile-USB-and-Unifying-serial.patch new file mode 100644 index 0000000..b03009a --- /dev/null +++ b/patches.suse/HID-logitech-hidpp-Reconcile-USB-and-Unifying-serial.patch @@ -0,0 +1,55 @@ +From 5b3691d15e04b6d5a32c915577b8dbc5cfb56382 Mon Sep 17 00:00:00 2001 +From: Bastien Nocera +Date: Thu, 2 Mar 2023 14:01:17 +0100 +Subject: [PATCH] HID: logitech-hidpp: Reconcile USB and Unifying serials +Git-commit: 5b3691d15e04b6d5a32c915577b8dbc5cfb56382 +Patch-mainline: v6.4-rc1 +References: git-fixes + +Now that USB HID++ devices can gather a serial number that matches the +one that would be gathered when connected through a Unifying receiver, +remove the last difference by dropping the product ID as devices +usually have different product IDs when connected through USB or +Unifying. + +For example, on the serials on a G903 wired/wireless mouse: +- Unifying before patch: 4067-e8-ce-cd-45 +- USB before patch: c086-e8-ce-cd-45 +- Unifying and USB after patch: e8-ce-cd-45 + +Signed-off-by: Bastien Nocera +Link: https://lore.kernel.org/r/20230302130117.3975-2-hadess@hadess.net +Signed-off-by: Benjamin Tissoires +Acked-by: Takashi Iwai + +--- + drivers/hid/hid-logitech-hidpp.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index 66380876937f..da89e84c9cbe 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -853,8 +853,7 @@ static int hidpp_unifying_init(struct hidpp_device *hidpp) + if (ret) + return ret; + +- snprintf(hdev->uniq, sizeof(hdev->uniq), "%04x-%4phD", +- hdev->product, &serial); ++ snprintf(hdev->uniq, sizeof(hdev->uniq), "%4phD", &serial); + dbg_hid("HID++ Unifying: Got serial: %s\n", hdev->uniq); + + name = hidpp_unifying_get_name(hidpp); +@@ -989,8 +988,7 @@ static int hidpp_serial_init(struct hidpp_device *hidpp) + if (ret) + return ret; + +- snprintf(hdev->uniq, sizeof(hdev->uniq), "%04x-%4phD", +- hdev->product, &serial); ++ snprintf(hdev->uniq, sizeof(hdev->uniq), "%4phD", &serial); + dbg_hid("HID++ DeviceInformation: Got serial: %s\n", hdev->uniq); + + return 0; +-- +2.35.3 + diff --git a/patches.suse/HID-wacom-Add-new-Intuos-Pro-Small-PTH-460-device-ID.patch b/patches.suse/HID-wacom-Add-new-Intuos-Pro-Small-PTH-460-device-ID.patch new file mode 100644 index 0000000..7050f46 --- /dev/null +++ b/patches.suse/HID-wacom-Add-new-Intuos-Pro-Small-PTH-460-device-ID.patch @@ -0,0 +1,45 @@ +From 0627f3df95e1609693f89e7ceb4156ac5db6e358 Mon Sep 17 00:00:00 2001 +From: Ping Cheng +Date: Fri, 26 Aug 2022 14:34:02 -0700 +Subject: [PATCH] HID: wacom: Add new Intuos Pro Small (PTH-460) device IDs +Git-commit: 0627f3df95e1609693f89e7ceb4156ac5db6e358 +Patch-mainline: v6.1-rc1 +References: git-fixes + +Add the new PIDs to wacom_wac.c to support the new model in the Intuos Pro series. + +Signed-off-by: Ping Cheng +Tested-by: Aaron Armstrong Skomra +Signed-off-by: Jiri Kosina +Acked-by: Takashi Iwai + +--- + drivers/hid/wacom_wac.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c +index d049239256a2..e4ae7fafe359 100644 +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -4875,6 +4875,10 @@ static const struct wacom_features wacom_features_0x3c6 = + static const struct wacom_features wacom_features_0x3c8 = + { "Wacom Intuos BT M", 21600, 13500, 4095, 63, + INTUOSHT3_BT, WACOM_INTUOS_RES, WACOM_INTUOS_RES, 4 }; ++static const struct wacom_features wacom_features_0x3dd = ++ { "Wacom Intuos Pro S", 31920, 19950, 8191, 63, ++ INTUOSP2S_BT, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 7, ++ .touch_max = 10 }; + + static const struct wacom_features wacom_features_HID_ANY_ID = + { "Wacom HID", .type = HID_GENERIC, .oVid = HID_ANY_ID, .oPid = HID_ANY_ID }; +@@ -5050,6 +5054,7 @@ const struct hid_device_id wacom_ids[] = { + { BT_DEVICE_WACOM(0x393) }, + { BT_DEVICE_WACOM(0x3c6) }, + { BT_DEVICE_WACOM(0x3c8) }, ++ { BT_DEVICE_WACOM(0x3dd) }, + { USB_DEVICE_WACOM(0x4001) }, + { USB_DEVICE_WACOM(0x4004) }, + { USB_DEVICE_WACOM(0x5000) }, +-- +2.35.3 + diff --git a/patches.suse/HID-wacom-Force-pen-out-of-prox-if-no-events-have-be.patch b/patches.suse/HID-wacom-Force-pen-out-of-prox-if-no-events-have-be.patch new file mode 100644 index 0000000..9f314cd --- /dev/null +++ b/patches.suse/HID-wacom-Force-pen-out-of-prox-if-no-events-have-be.patch @@ -0,0 +1,141 @@ +From 94b179052f95c294d83e9c9c34f7833cf3cd4305 Mon Sep 17 00:00:00 2001 +From: Jason Gerecke +Date: Fri, 15 Jul 2022 16:05:19 -0700 +Subject: [PATCH] HID: wacom: Force pen out of prox if no events have been received in a while +Git-commit: 94b179052f95c294d83e9c9c34f7833cf3cd4305 +Patch-mainline: v6.0-rc1 +References: git-fixes + +Prox-out events may not be reliably sent by some AES firmware. This can +cause problems for users, particularly due to arbitration logic disabling +touch input while the pen is in prox. + +This commit adds a timer which is reset every time a new prox event is +received. When the timer expires we check to see if the pen is still in +prox and force it out if necessary. This is patterend off of the same +solution used by 'hid-letsketch' driver which has a similar problem. + +Link: https://github.com/linuxwacom/input-wacom/issues/310 +Signed-off-by: Jason Gerecke +Signed-off-by: Jiri Kosina +Acked-by: Takashi Iwai + +--- + drivers/hid/wacom.h | 3 +++ + drivers/hid/wacom_sys.c | 2 ++ + drivers/hid/wacom_wac.c | 39 +++++++++++++++++++++++++++++++++++++++ + 3 files changed, 44 insertions(+) + +diff --git a/drivers/hid/wacom.h b/drivers/hid/wacom.h +index 203d27d198b8..3f8b24a57014 100644 +--- a/drivers/hid/wacom.h ++++ b/drivers/hid/wacom.h +@@ -91,6 +91,7 @@ + #include + #include + #include ++#include + #include + + /* +@@ -167,6 +168,7 @@ struct wacom { + struct delayed_work init_work; + struct wacom_remote *remote; + struct work_struct mode_change_work; ++ struct timer_list idleprox_timer; + bool generic_has_leds; + struct wacom_leds { + struct wacom_group_leds *groups; +@@ -239,4 +241,5 @@ struct wacom_led *wacom_led_find(struct wacom *wacom, unsigned int group, + struct wacom_led *wacom_led_next(struct wacom *wacom, struct wacom_led *cur); + int wacom_equivalent_usage(int usage); + int wacom_initialize_leds(struct wacom *wacom); ++void wacom_idleprox_timeout(struct timer_list *list); + #endif +diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c +index 98384b911288..194a2e327591 100644 +--- a/drivers/hid/wacom_sys.c ++++ b/drivers/hid/wacom_sys.c +@@ -2781,6 +2781,7 @@ static int wacom_probe(struct hid_device *hdev, + INIT_WORK(&wacom->battery_work, wacom_battery_work); + INIT_WORK(&wacom->remote_work, wacom_remote_work); + INIT_WORK(&wacom->mode_change_work, wacom_mode_change_work); ++ timer_setup(&wacom->idleprox_timer, &wacom_idleprox_timeout, TIMER_DEFERRABLE); + + /* ask for the report descriptor to be loaded by HID */ + error = hid_parse(hdev); +@@ -2821,6 +2822,7 @@ static void wacom_remove(struct hid_device *hdev) + cancel_work_sync(&wacom->battery_work); + cancel_work_sync(&wacom->remote_work); + cancel_work_sync(&wacom->mode_change_work); ++ del_timer_sync(&wacom->idleprox_timer); + if (hdev->bus == BUS_BLUETOOTH) + device_remove_file(&hdev->dev, &dev_attr_speed); + +diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c +index f8cc4bb3e3a7..d049239256a2 100644 +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -11,6 +11,7 @@ + #include "wacom_wac.h" + #include "wacom.h" + #include ++#include + + /* resolution for penabled devices */ + #define WACOM_PL_RES 20 +@@ -41,6 +42,43 @@ static int wacom_numbered_button_to_key(int n); + + static void wacom_update_led(struct wacom *wacom, int button_count, int mask, + int group); ++ ++static void wacom_force_proxout(struct wacom_wac *wacom_wac) ++{ ++ struct input_dev *input = wacom_wac->pen_input; ++ ++ wacom_wac->shared->stylus_in_proximity = 0; ++ ++ input_report_key(input, BTN_TOUCH, 0); ++ input_report_key(input, BTN_STYLUS, 0); ++ input_report_key(input, BTN_STYLUS2, 0); ++ input_report_key(input, BTN_STYLUS3, 0); ++ input_report_key(input, wacom_wac->tool[0], 0); ++ if (wacom_wac->serial[0]) { ++ input_report_abs(input, ABS_MISC, 0); ++ } ++ input_report_abs(input, ABS_PRESSURE, 0); ++ ++ wacom_wac->tool[0] = 0; ++ wacom_wac->id[0] = 0; ++ wacom_wac->serial[0] = 0; ++ ++ input_sync(input); ++} ++ ++void wacom_idleprox_timeout(struct timer_list *list) ++{ ++ struct wacom *wacom = from_timer(wacom, list, idleprox_timer); ++ struct wacom_wac *wacom_wac = &wacom->wacom_wac; ++ ++ if (!wacom_wac->hid_data.sense_state) { ++ return; ++ } ++ ++ hid_warn(wacom->hdev, "%s: tool appears to be hung in-prox. forcing it out.\n", __func__); ++ wacom_force_proxout(wacom_wac); ++} ++ + /* + * Percent of battery capacity for Graphire. + * 8th value means AC online and show 100% capacity. +@@ -2329,6 +2367,7 @@ static void wacom_wac_pen_event(struct hid_device *hdev, struct hid_field *field + value = field->logical_maximum - value; + break; + case HID_DG_INRANGE: ++ mod_timer(&wacom->idleprox_timer, jiffies + msecs_to_jiffies(100)); + wacom_wac->hid_data.inrange_state = value; + if (!(features->quirks & WACOM_QUIRK_SENSE)) + wacom_wac->hid_data.sense_state = value; +-- +2.35.3 + diff --git a/patches.suse/HID-wacom-Set-a-default-resolution-for-older-tablets.patch b/patches.suse/HID-wacom-Set-a-default-resolution-for-older-tablets.patch new file mode 100644 index 0000000..63003df --- /dev/null +++ b/patches.suse/HID-wacom-Set-a-default-resolution-for-older-tablets.patch @@ -0,0 +1,53 @@ +From 08a46b4190d345544d04ce4fe2e1844b772b8535 Mon Sep 17 00:00:00 2001 +From: Ping Cheng +Date: Sun, 9 Apr 2023 09:42:29 -0700 +Subject: [PATCH] HID: wacom: Set a default resolution for older tablets +Git-commit: 08a46b4190d345544d04ce4fe2e1844b772b8535 +Patch-mainline: v6.4-rc1 +References: git-fixes + +Some older tablets may not report physical maximum for X/Y +coordinates. Set a default to prevent undefined resolution. + +Signed-off-by: Ping Cheng +Link: https://lore.kernel.org/r/20230409164229.29777-1-ping.cheng@wacom.com +Signed-off-by: Benjamin Tissoires +Acked-by: Takashi Iwai + +--- + drivers/hid/wacom_wac.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c +index 4cfa51416dbc..0c6a82c665c1 100644 +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -1921,6 +1921,7 @@ static void wacom_map_usage(struct input_dev *input, struct hid_usage *usage, + int fmax = field->logical_maximum; + unsigned int equivalent_usage = wacom_equivalent_usage(usage->hid); + int resolution_code = code; ++ int resolution = hidinput_calc_abs_res(field, resolution_code); + + if (equivalent_usage == HID_DG_TWIST) { + resolution_code = ABS_RZ; +@@ -1941,8 +1942,15 @@ static void wacom_map_usage(struct input_dev *input, struct hid_usage *usage, + switch (type) { + case EV_ABS: + input_set_abs_params(input, code, fmin, fmax, fuzz, 0); +- input_abs_set_res(input, code, +- hidinput_calc_abs_res(field, resolution_code)); ++ ++ /* older tablet may miss physical usage */ ++ if ((code == ABS_X || code == ABS_Y) && !resolution) { ++ resolution = WACOM_INTUOS_RES; ++ hid_warn(input, ++ "Wacom usage (%d) missing resolution \n", ++ code); ++ } ++ input_abs_set_res(input, code, resolution); + break; + case EV_KEY: + case EV_MSC: +-- +2.35.3 + diff --git a/patches.suse/HID-wacom-add-three-styli-to-wacom_intuos_get_tool_t.patch b/patches.suse/HID-wacom-add-three-styli-to-wacom_intuos_get_tool_t.patch new file mode 100644 index 0000000..4fa304a --- /dev/null +++ b/patches.suse/HID-wacom-add-three-styli-to-wacom_intuos_get_tool_t.patch @@ -0,0 +1,41 @@ +From bfdc750c4cb2f3461b9b00a2755e2145ac195c9a Mon Sep 17 00:00:00 2001 +From: Ping Cheng +Date: Wed, 28 Sep 2022 13:49:29 -0700 +Subject: [PATCH] HID: wacom: add three styli to wacom_intuos_get_tool_type +Git-commit: bfdc750c4cb2f3461b9b00a2755e2145ac195c9a +Patch-mainline: v6.1-rc1 +References: git-fixes + +We forgot to add the 3D pen ID a year ago. There are two new pro pen +IDs to be added. + +Signed-off-by: Ping Cheng +Signed-off-by: Jiri Kosina +Acked-by: Takashi Iwai + +--- + drivers/hid/wacom_wac.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c +index e4ae7fafe359..9fc080e4e66f 100644 +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -713,11 +713,14 @@ static int wacom_intuos_get_tool_type(int tool_id) + case 0x802: /* Intuos4/5 13HD/24HD General Pen */ + case 0x8e2: /* IntuosHT2 pen */ + case 0x022: ++ case 0x200: /* Pro Pen 3 */ ++ case 0x04200: /* Pro Pen 3 */ + case 0x10842: /* MobileStudio Pro Pro Pen slim */ + case 0x14802: /* Intuos4/5 13HD/24HD Classic Pen */ + case 0x16802: /* Cintiq 13HD Pro Pen */ + case 0x18802: /* DTH2242 Pen */ + case 0x10802: /* Intuos4/5 13HD/24HD General Pen */ ++ case 0x80842: /* Intuos Pro and Cintiq Pro 3D Pen */ + tool_type = BTN_TOOL_PEN; + break; + +-- +2.35.3 + diff --git a/patches.suse/HID-wacom-generic-Set-battery-quirk-only-when-we-see.patch b/patches.suse/HID-wacom-generic-Set-battery-quirk-only-when-we-see.patch new file mode 100644 index 0000000..623380f --- /dev/null +++ b/patches.suse/HID-wacom-generic-Set-battery-quirk-only-when-we-see.patch @@ -0,0 +1,104 @@ +From bea407a427baa019758f29f4d31b26f008bb8cc6 Mon Sep 17 00:00:00 2001 +From: Jason Gerecke +Date: Thu, 13 Apr 2023 11:17:43 -0700 +Subject: [PATCH] HID: wacom: generic: Set battery quirk only when we see battery data +Git-commit: bea407a427baa019758f29f4d31b26f008bb8cc6 +Patch-mainline: v6.4-rc1 +References: git-fixes + +Some devices will include battery status usages in the HID descriptor +but we won't see that battery data for one reason or another. For example, +AES sensors won't send battery data unless an AES pen is in proximity. +If a user does not have an AES pen but instead only interacts with the +AES touchscreen with their fingers then there is no need for us to create +a battery object. Similarly, if a family of peripherals shares the same +HID descriptor between wired-only and wireless-capable SKUs, users of the +former may never see a battery event and will not want a power_supply +object created. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217062 +Link: https://gitlab.gnome.org/GNOME/gnome-control-center/-/issues/2354 +Signed-off-by: Jason Gerecke +Tested-by: Mario Limonciello +Signed-off-by: Jiri Kosina +Acked-by: Takashi Iwai + +--- + drivers/hid/wacom_wac.c | 33 +++++++++++---------------------- + 1 file changed, 11 insertions(+), 22 deletions(-) + +diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c +index 0351bce362d2..dc0f7d9a992c 100644 +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -1968,18 +1968,7 @@ static void wacom_map_usage(struct input_dev *input, struct hid_usage *usage, + static void wacom_wac_battery_usage_mapping(struct hid_device *hdev, + struct hid_field *field, struct hid_usage *usage) + { +- struct wacom *wacom = hid_get_drvdata(hdev); +- struct wacom_wac *wacom_wac = &wacom->wacom_wac; +- struct wacom_features *features = &wacom_wac->features; +- unsigned equivalent_usage = wacom_equivalent_usage(usage->hid); +- +- switch (equivalent_usage) { +- case HID_DG_BATTERYSTRENGTH: +- case WACOM_HID_WD_BATTERY_LEVEL: +- case WACOM_HID_WD_BATTERY_CHARGING: +- features->quirks |= WACOM_QUIRK_BATTERY; +- break; +- } ++ return; + } + + static void wacom_wac_battery_event(struct hid_device *hdev, struct hid_field *field, +@@ -2000,18 +1989,21 @@ static void wacom_wac_battery_event(struct hid_device *hdev, struct hid_field *f + wacom_wac->hid_data.bat_connected = 1; + wacom_wac->hid_data.bat_status = WACOM_POWER_SUPPLY_STATUS_AUTO; + } ++ wacom_wac->features.quirks |= WACOM_QUIRK_BATTERY; + break; + case WACOM_HID_WD_BATTERY_LEVEL: + value = value * 100 / (field->logical_maximum - field->logical_minimum); + wacom_wac->hid_data.battery_capacity = value; + wacom_wac->hid_data.bat_connected = 1; + wacom_wac->hid_data.bat_status = WACOM_POWER_SUPPLY_STATUS_AUTO; ++ wacom_wac->features.quirks |= WACOM_QUIRK_BATTERY; + break; + case WACOM_HID_WD_BATTERY_CHARGING: + wacom_wac->hid_data.bat_charging = value; + wacom_wac->hid_data.ps_connected = value; + wacom_wac->hid_data.bat_connected = 1; + wacom_wac->hid_data.bat_status = WACOM_POWER_SUPPLY_STATUS_AUTO; ++ wacom_wac->features.quirks |= WACOM_QUIRK_BATTERY; + break; + } + } +@@ -2027,18 +2019,15 @@ static void wacom_wac_battery_report(struct hid_device *hdev, + { + struct wacom *wacom = hid_get_drvdata(hdev); + struct wacom_wac *wacom_wac = &wacom->wacom_wac; +- struct wacom_features *features = &wacom_wac->features; + +- if (features->quirks & WACOM_QUIRK_BATTERY) { +- int status = wacom_wac->hid_data.bat_status; +- int capacity = wacom_wac->hid_data.battery_capacity; +- bool charging = wacom_wac->hid_data.bat_charging; +- bool connected = wacom_wac->hid_data.bat_connected; +- bool powered = wacom_wac->hid_data.ps_connected; ++ int status = wacom_wac->hid_data.bat_status; ++ int capacity = wacom_wac->hid_data.battery_capacity; ++ bool charging = wacom_wac->hid_data.bat_charging; ++ bool connected = wacom_wac->hid_data.bat_connected; ++ bool powered = wacom_wac->hid_data.ps_connected; + +- wacom_notify_battery(wacom_wac, status, capacity, charging, +- connected, powered); +- } ++ wacom_notify_battery(wacom_wac, status, capacity, charging, ++ connected, powered); + } + + static void wacom_wac_pad_usage_mapping(struct hid_device *hdev, +-- +2.35.3 + diff --git a/patches.suse/IB-hfi1-Fix-SDMA-mmu_rb_node-not-being-evicted-in-LR.patch b/patches.suse/IB-hfi1-Fix-SDMA-mmu_rb_node-not-being-evicted-in-LR.patch new file mode 100644 index 0000000..1daf92f --- /dev/null +++ b/patches.suse/IB-hfi1-Fix-SDMA-mmu_rb_node-not-being-evicted-in-LR.patch @@ -0,0 +1,93 @@ +From 9fe8fec5e43d5a80f43cbf61aaada1b047a1eb61 Mon Sep 17 00:00:00 2001 +From: Patrick Kelsey +Date: Fri, 7 Apr 2023 12:52:39 -0400 +Subject: [PATCH 1/1] IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU + order +Git-commit: 9fe8fec5e43d5a80f43cbf61aaada1b047a1eb61 +Patch-mainline: v6.4-rc1 +References: git-fixes + +hfi1_mmu_rb_remove_unless_exact() did not move mmu_rb_node objects in +mmu_rb_handler->lru_list after getting a cache hit on an mmu_rb_node. + +As a result, hfi1_mmu_rb_evict() was not guaranteed to evict truly +least-recently used nodes. + +This could be a performance issue for an application when that +application: +- Uses some long-lived buffers frequently. +- Uses a large number of buffers once. +- Hits the mmu_rb_handler cache size or pinned-page limits, forcing + mmu_rb_handler cache entries to be evicted. + +In this case, the one-time use buffers cause the long-lived buffer +entries to eventually filter to the end of the LRU list where +hfi1_mmu_rb_evict() will consider evicting a frequently-used long-lived +entry instead of evicting one of the one-time use entries. + +Fix this by inserting new mmu_rb_node at the tail of +mmu_rb_handler->lru_list and move mmu_rb_ndoe to the tail of +mmu_rb_handler->lru_list when the mmu_rb_node is a hit in +hfi1_mmu_rb_remove_unless_exact(). Change hfi1_mmu_rb_evict() to evict +from the head of mmu_rb_handler->lru_list instead of the tail. + +Fixes: 0636e9ab8355 ("IB/hfi1: Add cache evict LRU list") +Signed-off-by: Brendan Cunningham +Signed-off-by: Patrick Kelsey +Signed-off-by: Dennis Dalessandro +Link: https://lore.kernel.org/r/168088635931.3027109.10423156330761536044.stgit@252.162.96.66.static.eigbox.net +Signed-off-by: Leon Romanovsky +Acked-by: Nicolas Morey +--- + drivers/infiniband/hw/hfi1/mmu_rb.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c +index 7333646021bb..af46ff203342 100644 +--- a/drivers/infiniband/hw/hfi1/mmu_rb.c ++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c +@@ -130,7 +130,7 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler, + goto unlock; + } + __mmu_int_rb_insert(mnode, &handler->root); +- list_add(&mnode->list, &handler->lru_list); ++ list_add_tail(&mnode->list, &handler->lru_list); + + ret = handler->ops->insert(handler->ops_arg, mnode); + if (ret) { +@@ -181,8 +181,10 @@ bool hfi1_mmu_rb_remove_unless_exact(struct mmu_rb_handler *handler, + spin_lock_irqsave(&handler->lock, flags); + node = __mmu_rb_search(handler, addr, len); + if (node) { +- if (node->addr == addr && node->len == len) ++ if (node->addr == addr && node->len == len) { ++ list_move_tail(&node->list, &handler->lru_list); + goto unlock; ++ } + __mmu_int_rb_remove(node, &handler->root); + list_del(&node->list); /* remove from LRU list */ + ret = true; +@@ -206,8 +208,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg) + INIT_LIST_HEAD(&del_list); + + spin_lock_irqsave(&handler->lock, flags); +- list_for_each_entry_safe_reverse(rbnode, ptr, &handler->lru_list, +- list) { ++ list_for_each_entry_safe(rbnode, ptr, &handler->lru_list, list) { + if (handler->ops->evict(handler->ops_arg, rbnode, evict_arg, + &stop)) { + __mmu_int_rb_remove(rbnode, &handler->root); +@@ -219,9 +220,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg) + } + spin_unlock_irqrestore(&handler->lock, flags); + +- while (!list_empty(&del_list)) { +- rbnode = list_first_entry(&del_list, struct mmu_rb_node, list); +- list_del(&rbnode->list); ++ list_for_each_entry_safe(rbnode, ptr, &del_list, list) { + handler->ops->remove(handler->ops_arg, rbnode); + } + } +-- +2.39.1.1.gbe015eda0162 + diff --git a/patches.suse/IB-hfi1-Fix-bugs-with-non-PAGE_SIZE-end-multi-iovec-.patch b/patches.suse/IB-hfi1-Fix-bugs-with-non-PAGE_SIZE-end-multi-iovec-.patch new file mode 100644 index 0000000..7362d12 --- /dev/null +++ b/patches.suse/IB-hfi1-Fix-bugs-with-non-PAGE_SIZE-end-multi-iovec-.patch @@ -0,0 +1,1147 @@ +From 00cbce5cbf88459cd1aa1d60d0f1df15477df127 Mon Sep 17 00:00:00 2001 +From: Patrick Kelsey +Date: Fri, 7 Apr 2023 12:52:44 -0400 +Subject: [PATCH 1/1] IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user + SDMA requests +Git-commit: 00cbce5cbf88459cd1aa1d60d0f1df15477df127 +Patch-mainline: v6.4-rc1 +References: git-fixes + +hfi1 user SDMA request processing has two bugs that can cause data +corruption for user SDMA requests that have multiple payload iovecs +where an iovec other than the tail iovec does not run up to the page +boundary for the buffer pointed to by that iovec.a + +Here are the specific bugs: +1. user_sdma_txadd() does not use struct user_sdma_iovec->iov.iov_len. + Rather, user_sdma_txadd() will add up to PAGE_SIZE bytes from iovec + to the packet, even if some of those bytes are past + iovec->iov.iov_len and are thus not intended to be in the packet. +2. user_sdma_txadd() and user_sdma_send_pkts() fail to advance to the + next iovec in user_sdma_request->iovs when the current iovec + is not PAGE_SIZE and does not contain enough data to complete the + packet. The transmitted packet will contain the wrong data from the + iovec pages. + +This has not been an issue with SDMA packets from hfi1 Verbs or PSM2 +because they only produce iovecs that end short of PAGE_SIZE as the tail +iovec of an SDMA request. + +Fixing these bugs exposes other bugs with the SDMA pin cache +(struct mmu_rb_handler) that get in way of supporting user SDMA requests +with multiple payload iovecs whose buffers do not end at PAGE_SIZE. So +this commit fixes those issues as well. + +Here are the mmu_rb_handler bugs that non-PAGE_SIZE-end multi-iovec +payload user SDMA requests can hit: +1. Overlapping memory ranges in mmu_rb_handler will result in duplicate + pinnings. +2. When extending an existing mmu_rb_handler entry (struct mmu_rb_node), + the mmu_rb code (1) removes the existing entry under a lock, (2) + releases that lock, pins the new pages, (3) then reacquires the lock + to insert the extended mmu_rb_node. + + If someone else comes in and inserts an overlapping entry between (2) + and (3), insert in (3) will fail. + + The failure path code in this case unpins _all_ pages in either the + original mmu_rb_node or the new mmu_rb_node that was inserted between + (2) and (3). +3. In hfi1_mmu_rb_remove_unless_exact(), mmu_rb_node->refcount is + incremented outside of mmu_rb_handler->lock. As a result, mmu_rb_node + could be evicted by another thread that gets mmu_rb_handler->lock and + checks mmu_rb_node->refcount before mmu_rb_node->refcount is + incremented. +4. Related to #2 above, SDMA request submission failure path does not + check mmu_rb_node->refcount before freeing mmu_rb_node object. + + If there are other SDMA requests in progress whose iovecs have + pointers to the now-freed mmu_rb_node(s), those pointers to the + now-freed mmu_rb nodes will be dereferenced when those SDMA requests + complete. + +Fixes: 7be85676f1d1 ("IB/hfi1: Don't remove RB entry when not needed.") +Fixes: 7724105686e7 ("IB/hfi1: add driver files") +Signed-off-by: Brendan Cunningham +Signed-off-by: Patrick Kelsey +Signed-off-by: Dennis Dalessandro +Link: https://lore.kernel.org/r/168088636445.3027109.10054635277810177889.stgit@252.162.96.66.static.eigbox.net +Signed-off-by: Leon Romanovsky +Acked-by: Nicolas Morey +--- + drivers/infiniband/hw/hfi1/ipoib_tx.c | 1 + + drivers/infiniband/hw/hfi1/mmu_rb.c | 66 +-- + drivers/infiniband/hw/hfi1/mmu_rb.h | 8 +- + drivers/infiniband/hw/hfi1/sdma.c | 21 +- + drivers/infiniband/hw/hfi1/sdma.h | 16 +- + drivers/infiniband/hw/hfi1/sdma_txreq.h | 1 + + drivers/infiniband/hw/hfi1/trace_mmu.h | 4 - + drivers/infiniband/hw/hfi1/user_sdma.c | 600 +++++++++++++++--------- + drivers/infiniband/hw/hfi1/user_sdma.h | 5 - + drivers/infiniband/hw/hfi1/verbs.c | 4 +- + drivers/infiniband/hw/hfi1/vnic_sdma.c | 1 + + 11 files changed, 423 insertions(+), 304 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/ipoib_tx.c b/drivers/infiniband/hw/hfi1/ipoib_tx.c +index 349eb4139136..8973a081d641 100644 +--- a/drivers/infiniband/hw/hfi1/ipoib_tx.c ++++ b/drivers/infiniband/hw/hfi1/ipoib_tx.c +@@ -215,6 +215,7 @@ static int hfi1_ipoib_build_ulp_payload(struct ipoib_txreq *tx, + const skb_frag_t *frag = &skb_shinfo(skb)->frags[i]; + + ret = sdma_txadd_page(dd, ++ NULL, + txreq, + skb_frag_page(frag), + frag->bv_offset, +diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c +index af46ff203342..71b9ac018887 100644 +--- a/drivers/infiniband/hw/hfi1/mmu_rb.c ++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c +@@ -126,7 +126,7 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler, + spin_lock_irqsave(&handler->lock, flags); + node = __mmu_rb_search(handler, mnode->addr, mnode->len); + if (node) { +- ret = -EINVAL; ++ ret = -EEXIST; + goto unlock; + } + __mmu_int_rb_insert(mnode, &handler->root); +@@ -143,6 +143,19 @@ unlock: + return ret; + } + ++/* Caller must hold handler lock */ ++struct mmu_rb_node *hfi1_mmu_rb_get_first(struct mmu_rb_handler *handler, ++ unsigned long addr, unsigned long len) ++{ ++ struct mmu_rb_node *node; ++ ++ trace_hfi1_mmu_rb_search(addr, len); ++ node = __mmu_int_rb_iter_first(&handler->root, addr, (addr + len) - 1); ++ if (node) ++ list_move_tail(&node->list, &handler->lru_list); ++ return node; ++} ++ + /* Caller must hold handler lock */ + static struct mmu_rb_node *__mmu_rb_search(struct mmu_rb_handler *handler, + unsigned long addr, +@@ -167,34 +180,6 @@ static struct mmu_rb_node *__mmu_rb_search(struct mmu_rb_handler *handler, + return node; + } + +-bool hfi1_mmu_rb_remove_unless_exact(struct mmu_rb_handler *handler, +- unsigned long addr, unsigned long len, +- struct mmu_rb_node **rb_node) +-{ +- struct mmu_rb_node *node; +- unsigned long flags; +- bool ret = false; +- +- if (current->mm != handler->mn.mm) +- return ret; +- +- spin_lock_irqsave(&handler->lock, flags); +- node = __mmu_rb_search(handler, addr, len); +- if (node) { +- if (node->addr == addr && node->len == len) { +- list_move_tail(&node->list, &handler->lru_list); +- goto unlock; +- } +- __mmu_int_rb_remove(node, &handler->root); +- list_del(&node->list); /* remove from LRU list */ +- ret = true; +- } +-unlock: +- spin_unlock_irqrestore(&handler->lock, flags); +- *rb_node = node; +- return ret; +-} +- + void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg) + { + struct mmu_rb_node *rbnode, *ptr; +@@ -225,29 +210,6 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg) + } + } + +-/* +- * It is up to the caller to ensure that this function does not race with the +- * mmu invalidate notifier which may be calling the users remove callback on +- * 'node'. +- */ +-void hfi1_mmu_rb_remove(struct mmu_rb_handler *handler, +- struct mmu_rb_node *node) +-{ +- unsigned long flags; +- +- if (current->mm != handler->mn.mm) +- return; +- +- /* Validity of handler and node pointers has been checked by caller. */ +- trace_hfi1_mmu_rb_remove(node->addr, node->len); +- spin_lock_irqsave(&handler->lock, flags); +- __mmu_int_rb_remove(node, &handler->root); +- list_del(&node->list); /* remove from LRU list */ +- spin_unlock_irqrestore(&handler->lock, flags); +- +- handler->ops->remove(handler->ops_arg, node); +-} +- + static int mmu_notifier_range_start(struct mmu_notifier *mn, + const struct mmu_notifier_range *range) + { +diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.h b/drivers/infiniband/hw/hfi1/mmu_rb.h +index 7417be2b9dc8..ed75acdb7b83 100644 +--- a/drivers/infiniband/hw/hfi1/mmu_rb.h ++++ b/drivers/infiniband/hw/hfi1/mmu_rb.h +@@ -52,10 +52,8 @@ void hfi1_mmu_rb_unregister(struct mmu_rb_handler *handler); + int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler, + struct mmu_rb_node *mnode); + void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg); +-void hfi1_mmu_rb_remove(struct mmu_rb_handler *handler, +- struct mmu_rb_node *mnode); +-bool hfi1_mmu_rb_remove_unless_exact(struct mmu_rb_handler *handler, +- unsigned long addr, unsigned long len, +- struct mmu_rb_node **rb_node); ++struct mmu_rb_node *hfi1_mmu_rb_get_first(struct mmu_rb_handler *handler, ++ unsigned long addr, ++ unsigned long len); + + #endif /* _HFI1_MMU_RB_H */ +diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c +index 8ed20392e9f0..bb2552dd29c1 100644 +--- a/drivers/infiniband/hw/hfi1/sdma.c ++++ b/drivers/infiniband/hw/hfi1/sdma.c +@@ -1593,22 +1593,7 @@ static inline void sdma_unmap_desc( + struct hfi1_devdata *dd, + struct sdma_desc *descp) + { +- switch (sdma_mapping_type(descp)) { +- case SDMA_MAP_SINGLE: +- dma_unmap_single( +- &dd->pcidev->dev, +- sdma_mapping_addr(descp), +- sdma_mapping_len(descp), +- DMA_TO_DEVICE); +- break; +- case SDMA_MAP_PAGE: +- dma_unmap_page( +- &dd->pcidev->dev, +- sdma_mapping_addr(descp), +- sdma_mapping_len(descp), +- DMA_TO_DEVICE); +- break; +- } ++ system_descriptor_complete(dd, descp); + } + + /* +@@ -3128,7 +3113,7 @@ int ext_coal_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx, + + /* Add descriptor for coalesce buffer */ + tx->desc_limit = MAX_DESC; +- return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, tx, ++ return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, NULL, tx, + addr, tx->tlen); + } + +@@ -3167,10 +3152,12 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) + return rval; + } + } ++ + /* finish the one just added */ + make_tx_sdma_desc( + tx, + SDMA_MAP_NONE, ++ NULL, + dd->sdma_pad_phys, + sizeof(u32) - (tx->packet_len & (sizeof(u32) - 1))); + tx->num_desc++; +diff --git a/drivers/infiniband/hw/hfi1/sdma.h b/drivers/infiniband/hw/hfi1/sdma.h +index b023fc461bd5..95aaec14c6c2 100644 +--- a/drivers/infiniband/hw/hfi1/sdma.h ++++ b/drivers/infiniband/hw/hfi1/sdma.h +@@ -594,6 +594,7 @@ static inline dma_addr_t sdma_mapping_addr(struct sdma_desc *d) + static inline void make_tx_sdma_desc( + struct sdma_txreq *tx, + int type, ++ void *pinning_ctx, + dma_addr_t addr, + size_t len) + { +@@ -612,6 +613,7 @@ static inline void make_tx_sdma_desc( + << SDMA_DESC0_PHY_ADDR_SHIFT) | + (((u64)len & SDMA_DESC0_BYTE_COUNT_MASK) + << SDMA_DESC0_BYTE_COUNT_SHIFT); ++ desc->pinning_ctx = pinning_ctx; + } + + /* helper to extend txreq */ +@@ -643,6 +645,7 @@ static inline void _sdma_close_tx(struct hfi1_devdata *dd, + static inline int _sdma_txadd_daddr( + struct hfi1_devdata *dd, + int type, ++ void *pinning_ctx, + struct sdma_txreq *tx, + dma_addr_t addr, + u16 len) +@@ -652,6 +655,7 @@ static inline int _sdma_txadd_daddr( + make_tx_sdma_desc( + tx, + type, ++ pinning_ctx, + addr, len); + WARN_ON(len > tx->tlen); + tx->num_desc++; +@@ -672,6 +676,7 @@ static inline int _sdma_txadd_daddr( + /** + * sdma_txadd_page() - add a page to the sdma_txreq + * @dd: the device to use for mapping ++ * @pinning_ctx: context to be released at descriptor retirement + * @tx: tx request to which the page is added + * @page: page to map + * @offset: offset within the page +@@ -687,6 +692,7 @@ static inline int _sdma_txadd_daddr( + */ + static inline int sdma_txadd_page( + struct hfi1_devdata *dd, ++ void *pinning_ctx, + struct sdma_txreq *tx, + struct page *page, + unsigned long offset, +@@ -714,8 +720,7 @@ static inline int sdma_txadd_page( + return -ENOSPC; + } + +- return _sdma_txadd_daddr( +- dd, SDMA_MAP_PAGE, tx, addr, len); ++ return _sdma_txadd_daddr(dd, SDMA_MAP_PAGE, pinning_ctx, tx, addr, len); + } + + /** +@@ -749,7 +754,8 @@ static inline int sdma_txadd_daddr( + return rval; + } + +- return _sdma_txadd_daddr(dd, SDMA_MAP_NONE, tx, addr, len); ++ return _sdma_txadd_daddr(dd, SDMA_MAP_NONE, NULL, tx, ++ addr, len); + } + + /** +@@ -795,8 +801,7 @@ static inline int sdma_txadd_kvaddr( + return -ENOSPC; + } + +- return _sdma_txadd_daddr( +- dd, SDMA_MAP_SINGLE, tx, addr, len); ++ return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, NULL, tx, addr, len); + } + + struct iowait_work; +@@ -1030,4 +1035,5 @@ extern uint mod_num_sdma; + + void sdma_update_lmc(struct hfi1_devdata *dd, u64 mask, u32 lid); + ++void system_descriptor_complete(struct hfi1_devdata *dd, struct sdma_desc *descp); + #endif +diff --git a/drivers/infiniband/hw/hfi1/sdma_txreq.h b/drivers/infiniband/hw/hfi1/sdma_txreq.h +index e262fb5c5ec6..fad946cb5e0d 100644 +--- a/drivers/infiniband/hw/hfi1/sdma_txreq.h ++++ b/drivers/infiniband/hw/hfi1/sdma_txreq.h +@@ -19,6 +19,7 @@ + struct sdma_desc { + /* private: don't use directly */ + u64 qw[2]; ++ void *pinning_ctx; + }; + + /** +diff --git a/drivers/infiniband/hw/hfi1/trace_mmu.h b/drivers/infiniband/hw/hfi1/trace_mmu.h +index 187e9244fe5e..57900ebb7702 100644 +--- a/drivers/infiniband/hw/hfi1/trace_mmu.h ++++ b/drivers/infiniband/hw/hfi1/trace_mmu.h +@@ -37,10 +37,6 @@ DEFINE_EVENT(hfi1_mmu_rb_template, hfi1_mmu_rb_search, + TP_PROTO(unsigned long addr, unsigned long len), + TP_ARGS(addr, len)); + +-DEFINE_EVENT(hfi1_mmu_rb_template, hfi1_mmu_rb_remove, +- TP_PROTO(unsigned long addr, unsigned long len), +- TP_ARGS(addr, len)); +- + DEFINE_EVENT(hfi1_mmu_rb_template, hfi1_mmu_mem_invalidate, + TP_PROTO(unsigned long addr, unsigned long len), + TP_ARGS(addr, len)); +diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c +index a71c5a36ceba..ae58b48afe07 100644 +--- a/drivers/infiniband/hw/hfi1/user_sdma.c ++++ b/drivers/infiniband/hw/hfi1/user_sdma.c +@@ -24,7 +24,6 @@ + + #include "hfi.h" + #include "sdma.h" +-#include "mmu_rb.h" + #include "user_sdma.h" + #include "verbs.h" /* for the headers */ + #include "common.h" /* for struct hfi1_tid_info */ +@@ -39,11 +38,7 @@ static unsigned initial_pkt_count = 8; + static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts); + static void user_sdma_txreq_cb(struct sdma_txreq *txreq, int status); + static inline void pq_update(struct hfi1_user_sdma_pkt_q *pq); +-static void user_sdma_free_request(struct user_sdma_request *req, bool unpin); +-static int pin_vector_pages(struct user_sdma_request *req, +- struct user_sdma_iovec *iovec); +-static void unpin_vector_pages(struct mm_struct *mm, struct page **pages, +- unsigned start, unsigned npages); ++static void user_sdma_free_request(struct user_sdma_request *req); + static int check_header_template(struct user_sdma_request *req, + struct hfi1_pkt_header *hdr, u32 lrhlen, + u32 datalen); +@@ -81,6 +76,11 @@ static struct mmu_rb_ops sdma_rb_ops = { + .invalidate = sdma_rb_invalidate + }; + ++static int add_system_pages_to_sdma_packet(struct user_sdma_request *req, ++ struct user_sdma_txreq *tx, ++ struct user_sdma_iovec *iovec, ++ u32 *pkt_remaining); ++ + static int defer_packet_queue( + struct sdma_engine *sde, + struct iowait_work *wait, +@@ -410,6 +410,7 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd, + ret = -EINVAL; + goto free_req; + } ++ + /* Copy the header from the user buffer */ + ret = copy_from_user(&req->hdr, iovec[idx].iov_base + sizeof(info), + sizeof(req->hdr)); +@@ -484,9 +485,8 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd, + memcpy(&req->iovs[i].iov, + iovec + idx++, + sizeof(req->iovs[i].iov)); +- ret = pin_vector_pages(req, &req->iovs[i]); +- if (ret) { +- req->data_iovs = i; ++ if (req->iovs[i].iov.iov_len == 0) { ++ ret = -EINVAL; + goto free_req; + } + req->data_len += req->iovs[i].iov.iov_len; +@@ -584,7 +584,7 @@ free_req: + if (req->seqsubmitted) + wait_event(pq->busy.wait_dma, + (req->seqcomp == req->seqsubmitted - 1)); +- user_sdma_free_request(req, true); ++ user_sdma_free_request(req); + pq_update(pq); + set_comp_state(pq, cq, info.comp_idx, ERROR, ret); + } +@@ -696,48 +696,6 @@ static int user_sdma_txadd_ahg(struct user_sdma_request *req, + return ret; + } + +-static int user_sdma_txadd(struct user_sdma_request *req, +- struct user_sdma_txreq *tx, +- struct user_sdma_iovec *iovec, u32 datalen, +- u32 *queued_ptr, u32 *data_sent_ptr, +- u64 *iov_offset_ptr) +-{ +- int ret; +- unsigned int pageidx, len; +- unsigned long base, offset; +- u64 iov_offset = *iov_offset_ptr; +- u32 queued = *queued_ptr, data_sent = *data_sent_ptr; +- struct hfi1_user_sdma_pkt_q *pq = req->pq; +- +- base = (unsigned long)iovec->iov.iov_base; +- offset = offset_in_page(base + iovec->offset + iov_offset); +- pageidx = (((iovec->offset + iov_offset + base) - (base & PAGE_MASK)) >> +- PAGE_SHIFT); +- len = offset + req->info.fragsize > PAGE_SIZE ? +- PAGE_SIZE - offset : req->info.fragsize; +- len = min((datalen - queued), len); +- ret = sdma_txadd_page(pq->dd, &tx->txreq, iovec->pages[pageidx], +- offset, len); +- if (ret) { +- SDMA_DBG(req, "SDMA txreq add page failed %d\n", ret); +- return ret; +- } +- iov_offset += len; +- queued += len; +- data_sent += len; +- if (unlikely(queued < datalen && pageidx == iovec->npages && +- req->iov_idx < req->data_iovs - 1)) { +- iovec->offset += iov_offset; +- iovec = &req->iovs[++req->iov_idx]; +- iov_offset = 0; +- } +- +- *queued_ptr = queued; +- *data_sent_ptr = data_sent; +- *iov_offset_ptr = iov_offset; +- return ret; +-} +- + static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts) + { + int ret = 0; +@@ -769,8 +727,7 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts) + maxpkts = req->info.npkts - req->seqnum; + + while (npkts < maxpkts) { +- u32 datalen = 0, queued = 0, data_sent = 0; +- u64 iov_offset = 0; ++ u32 datalen = 0; + + /* + * Check whether any of the completions have come back +@@ -863,27 +820,17 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts) + goto free_txreq; + } + +- /* +- * If the request contains any data vectors, add up to +- * fragsize bytes to the descriptor. +- */ +- while (queued < datalen && +- (req->sent + data_sent) < req->data_len) { +- ret = user_sdma_txadd(req, tx, iovec, datalen, +- &queued, &data_sent, &iov_offset); +- if (ret) +- goto free_txreq; +- } +- /* +- * The txreq was submitted successfully so we can update +- * the counters. +- */ + req->koffset += datalen; + if (req_opcode(req->info.ctrl) == EXPECTED) + req->tidoffset += datalen; +- req->sent += data_sent; +- if (req->data_len) +- iovec->offset += iov_offset; ++ req->sent += datalen; ++ while (datalen) { ++ ret = add_system_pages_to_sdma_packet(req, tx, iovec, ++ &datalen); ++ if (ret) ++ goto free_txreq; ++ iovec = &req->iovs[req->iov_idx]; ++ } + list_add_tail(&tx->txreq.list, &req->txps); + /* + * It is important to increment this here as it is used to +@@ -920,133 +867,14 @@ free_tx: + static u32 sdma_cache_evict(struct hfi1_user_sdma_pkt_q *pq, u32 npages) + { + struct evict_data evict_data; ++ struct mmu_rb_handler *handler = pq->handler; + + evict_data.cleared = 0; + evict_data.target = npages; +- hfi1_mmu_rb_evict(pq->handler, &evict_data); ++ hfi1_mmu_rb_evict(handler, &evict_data); + return evict_data.cleared; + } + +-static int pin_sdma_pages(struct user_sdma_request *req, +- struct user_sdma_iovec *iovec, +- struct sdma_mmu_node *node, +- int npages) +-{ +- int pinned, cleared; +- struct page **pages; +- struct hfi1_user_sdma_pkt_q *pq = req->pq; +- +- pages = kcalloc(npages, sizeof(*pages), GFP_KERNEL); +- if (!pages) +- return -ENOMEM; +- memcpy(pages, node->pages, node->npages * sizeof(*pages)); +- +- npages -= node->npages; +-retry: +- if (!hfi1_can_pin_pages(pq->dd, current->mm, +- atomic_read(&pq->n_locked), npages)) { +- cleared = sdma_cache_evict(pq, npages); +- if (cleared >= npages) +- goto retry; +- } +- pinned = hfi1_acquire_user_pages(current->mm, +- ((unsigned long)iovec->iov.iov_base + +- (node->npages * PAGE_SIZE)), npages, 0, +- pages + node->npages); +- if (pinned < 0) { +- kfree(pages); +- return pinned; +- } +- if (pinned != npages) { +- unpin_vector_pages(current->mm, pages, node->npages, pinned); +- return -EFAULT; +- } +- kfree(node->pages); +- node->rb.len = iovec->iov.iov_len; +- node->pages = pages; +- atomic_add(pinned, &pq->n_locked); +- return pinned; +-} +- +-static void unpin_sdma_pages(struct sdma_mmu_node *node) +-{ +- if (node->npages) { +- unpin_vector_pages(mm_from_sdma_node(node), node->pages, 0, +- node->npages); +- atomic_sub(node->npages, &node->pq->n_locked); +- } +-} +- +-static int pin_vector_pages(struct user_sdma_request *req, +- struct user_sdma_iovec *iovec) +-{ +- int ret = 0, pinned, npages; +- struct hfi1_user_sdma_pkt_q *pq = req->pq; +- struct sdma_mmu_node *node = NULL; +- struct mmu_rb_node *rb_node; +- struct iovec *iov; +- bool extracted; +- +- extracted = +- hfi1_mmu_rb_remove_unless_exact(pq->handler, +- (unsigned long) +- iovec->iov.iov_base, +- iovec->iov.iov_len, &rb_node); +- if (rb_node) { +- node = container_of(rb_node, struct sdma_mmu_node, rb); +- if (!extracted) { +- atomic_inc(&node->refcount); +- iovec->pages = node->pages; +- iovec->npages = node->npages; +- iovec->node = node; +- return 0; +- } +- } +- +- if (!node) { +- node = kzalloc(sizeof(*node), GFP_KERNEL); +- if (!node) +- return -ENOMEM; +- +- node->rb.addr = (unsigned long)iovec->iov.iov_base; +- node->pq = pq; +- atomic_set(&node->refcount, 0); +- } +- +- iov = &iovec->iov; +- npages = num_user_pages((unsigned long)iov->iov_base, iov->iov_len); +- if (node->npages < npages) { +- pinned = pin_sdma_pages(req, iovec, node, npages); +- if (pinned < 0) { +- ret = pinned; +- goto bail; +- } +- node->npages += pinned; +- npages = node->npages; +- } +- iovec->pages = node->pages; +- iovec->npages = npages; +- iovec->node = node; +- +- ret = hfi1_mmu_rb_insert(req->pq->handler, &node->rb); +- if (ret) { +- iovec->node = NULL; +- goto bail; +- } +- return 0; +-bail: +- unpin_sdma_pages(node); +- kfree(node); +- return ret; +-} +- +-static void unpin_vector_pages(struct mm_struct *mm, struct page **pages, +- unsigned start, unsigned npages) +-{ +- hfi1_release_user_pages(mm, pages + start, npages, false); +- kfree(pages); +-} +- + static int check_header_template(struct user_sdma_request *req, + struct hfi1_pkt_header *hdr, u32 lrhlen, + u32 datalen) +@@ -1388,7 +1216,7 @@ static void user_sdma_txreq_cb(struct sdma_txreq *txreq, int status) + if (req->seqcomp != req->info.npkts - 1) + return; + +- user_sdma_free_request(req, false); ++ user_sdma_free_request(req); + set_comp_state(pq, cq, req->info.comp_idx, state, status); + pq_update(pq); + } +@@ -1399,10 +1227,8 @@ static inline void pq_update(struct hfi1_user_sdma_pkt_q *pq) + wake_up(&pq->wait); + } + +-static void user_sdma_free_request(struct user_sdma_request *req, bool unpin) ++static void user_sdma_free_request(struct user_sdma_request *req) + { +- int i; +- + if (!list_empty(&req->txps)) { + struct sdma_txreq *t, *p; + +@@ -1415,21 +1241,6 @@ static void user_sdma_free_request(struct user_sdma_request *req, bool unpin) + } + } + +- for (i = 0; i < req->data_iovs; i++) { +- struct sdma_mmu_node *node = req->iovs[i].node; +- +- if (!node) +- continue; +- +- req->iovs[i].node = NULL; +- +- if (unpin) +- hfi1_mmu_rb_remove(req->pq->handler, +- &node->rb); +- else +- atomic_dec(&node->refcount); +- } +- + kfree(req->tids); + clear_bit(req->info.comp_idx, req->pq->req_in_use); + } +@@ -1447,6 +1258,368 @@ static inline void set_comp_state(struct hfi1_user_sdma_pkt_q *pq, + idx, state, ret); + } + ++static void unpin_vector_pages(struct mm_struct *mm, struct page **pages, ++ unsigned int start, unsigned int npages) ++{ ++ hfi1_release_user_pages(mm, pages + start, npages, false); ++ kfree(pages); ++} ++ ++static void free_system_node(struct sdma_mmu_node *node) ++{ ++ if (node->npages) { ++ unpin_vector_pages(mm_from_sdma_node(node), node->pages, 0, ++ node->npages); ++ atomic_sub(node->npages, &node->pq->n_locked); ++ } ++ kfree(node); ++} ++ ++static inline void acquire_node(struct sdma_mmu_node *node) ++{ ++ atomic_inc(&node->refcount); ++ WARN_ON(atomic_read(&node->refcount) < 0); ++} ++ ++static inline void release_node(struct mmu_rb_handler *handler, ++ struct sdma_mmu_node *node) ++{ ++ atomic_dec(&node->refcount); ++ WARN_ON(atomic_read(&node->refcount) < 0); ++} ++ ++static struct sdma_mmu_node *find_system_node(struct mmu_rb_handler *handler, ++ unsigned long start, ++ unsigned long end) ++{ ++ struct mmu_rb_node *rb_node; ++ struct sdma_mmu_node *node; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&handler->lock, flags); ++ rb_node = hfi1_mmu_rb_get_first(handler, start, (end - start)); ++ if (!rb_node) { ++ spin_unlock_irqrestore(&handler->lock, flags); ++ return NULL; ++ } ++ node = container_of(rb_node, struct sdma_mmu_node, rb); ++ acquire_node(node); ++ spin_unlock_irqrestore(&handler->lock, flags); ++ ++ return node; ++} ++ ++static int pin_system_pages(struct user_sdma_request *req, ++ uintptr_t start_address, size_t length, ++ struct sdma_mmu_node *node, int npages) ++{ ++ struct hfi1_user_sdma_pkt_q *pq = req->pq; ++ int pinned, cleared; ++ struct page **pages; ++ ++ pages = kcalloc(npages, sizeof(*pages), GFP_KERNEL); ++ if (!pages) ++ return -ENOMEM; ++ ++retry: ++ if (!hfi1_can_pin_pages(pq->dd, current->mm, atomic_read(&pq->n_locked), ++ npages)) { ++ SDMA_DBG(req, "Evicting: nlocked %u npages %u", ++ atomic_read(&pq->n_locked), npages); ++ cleared = sdma_cache_evict(pq, npages); ++ if (cleared >= npages) ++ goto retry; ++ } ++ ++ SDMA_DBG(req, "Acquire user pages start_address %lx node->npages %u npages %u", ++ start_address, node->npages, npages); ++ pinned = hfi1_acquire_user_pages(current->mm, start_address, npages, 0, ++ pages); ++ ++ if (pinned < 0) { ++ kfree(pages); ++ SDMA_DBG(req, "pinned %d", pinned); ++ return pinned; ++ } ++ if (pinned != npages) { ++ unpin_vector_pages(current->mm, pages, node->npages, pinned); ++ SDMA_DBG(req, "npages %u pinned %d", npages, pinned); ++ return -EFAULT; ++ } ++ node->rb.addr = start_address; ++ node->rb.len = length; ++ node->pages = pages; ++ node->npages = npages; ++ atomic_add(pinned, &pq->n_locked); ++ SDMA_DBG(req, "done. pinned %d", pinned); ++ return 0; ++} ++ ++static int add_system_pinning(struct user_sdma_request *req, ++ struct sdma_mmu_node **node_p, ++ unsigned long start, unsigned long len) ++ ++{ ++ struct hfi1_user_sdma_pkt_q *pq = req->pq; ++ struct sdma_mmu_node *node; ++ int ret; ++ ++ node = kzalloc(sizeof(*node), GFP_KERNEL); ++ if (!node) ++ return -ENOMEM; ++ ++ node->pq = pq; ++ ret = pin_system_pages(req, start, len, node, PFN_DOWN(len)); ++ if (ret == 0) { ++ ret = hfi1_mmu_rb_insert(pq->handler, &node->rb); ++ if (ret) ++ free_system_node(node); ++ else ++ *node_p = node; ++ ++ return ret; ++ } ++ ++ kfree(node); ++ return ret; ++} ++ ++static int get_system_cache_entry(struct user_sdma_request *req, ++ struct sdma_mmu_node **node_p, ++ size_t req_start, size_t req_len) ++{ ++ struct hfi1_user_sdma_pkt_q *pq = req->pq; ++ u64 start = ALIGN_DOWN(req_start, PAGE_SIZE); ++ u64 end = PFN_ALIGN(req_start + req_len); ++ struct mmu_rb_handler *handler = pq->handler; ++ int ret; ++ ++ if ((end - start) == 0) { ++ SDMA_DBG(req, ++ "Request for empty cache entry req_start %lx req_len %lx start %llx end %llx", ++ req_start, req_len, start, end); ++ return -EINVAL; ++ } ++ ++ SDMA_DBG(req, "req_start %lx req_len %lu", req_start, req_len); ++ ++ while (1) { ++ struct sdma_mmu_node *node = ++ find_system_node(handler, start, end); ++ u64 prepend_len = 0; ++ ++ SDMA_DBG(req, "node %p start %llx end %llu", node, start, end); ++ if (!node) { ++ ret = add_system_pinning(req, node_p, start, ++ end - start); ++ if (ret == -EEXIST) { ++ /* ++ * Another execution context has inserted a ++ * conficting entry first. ++ */ ++ continue; ++ } ++ return ret; ++ } ++ ++ if (node->rb.addr <= start) { ++ /* ++ * This entry covers at least part of the region. If it doesn't extend ++ * to the end, then this will be called again for the next segment. ++ */ ++ *node_p = node; ++ return 0; ++ } ++ ++ SDMA_DBG(req, "prepend: node->rb.addr %lx, node->refcount %d", ++ node->rb.addr, atomic_read(&node->refcount)); ++ prepend_len = node->rb.addr - start; ++ ++ /* ++ * This node will not be returned, instead a new node ++ * will be. So release the reference. ++ */ ++ release_node(handler, node); ++ ++ /* Prepend a node to cover the beginning of the allocation */ ++ ret = add_system_pinning(req, node_p, start, prepend_len); ++ if (ret == -EEXIST) { ++ /* Another execution context has inserted a conficting entry first. */ ++ continue; ++ } ++ return ret; ++ } ++} ++ ++static int add_mapping_to_sdma_packet(struct user_sdma_request *req, ++ struct user_sdma_txreq *tx, ++ struct sdma_mmu_node *cache_entry, ++ size_t start, ++ size_t from_this_cache_entry) ++{ ++ struct hfi1_user_sdma_pkt_q *pq = req->pq; ++ unsigned int page_offset; ++ unsigned int from_this_page; ++ size_t page_index; ++ void *ctx; ++ int ret; ++ ++ /* ++ * Because the cache may be more fragmented than the memory that is being accessed, ++ * it's not strictly necessary to have a descriptor per cache entry. ++ */ ++ ++ while (from_this_cache_entry) { ++ page_index = PFN_DOWN(start - cache_entry->rb.addr); ++ ++ if (page_index >= cache_entry->npages) { ++ SDMA_DBG(req, ++ "Request for page_index %zu >= cache_entry->npages %u", ++ page_index, cache_entry->npages); ++ return -EINVAL; ++ } ++ ++ page_offset = start - ALIGN_DOWN(start, PAGE_SIZE); ++ from_this_page = PAGE_SIZE - page_offset; ++ ++ if (from_this_page < from_this_cache_entry) { ++ ctx = NULL; ++ } else { ++ /* ++ * In the case they are equal the next line has no practical effect, ++ * but it's better to do a register to register copy than a conditional ++ * branch. ++ */ ++ from_this_page = from_this_cache_entry; ++ ctx = cache_entry; ++ } ++ ++ ret = sdma_txadd_page(pq->dd, ctx, &tx->txreq, ++ cache_entry->pages[page_index], ++ page_offset, from_this_page); ++ if (ret) { ++ /* ++ * When there's a failure, the entire request is freed by ++ * user_sdma_send_pkts(). ++ */ ++ SDMA_DBG(req, ++ "sdma_txadd_page failed %d page_index %lu page_offset %u from_this_page %u", ++ ret, page_index, page_offset, from_this_page); ++ return ret; ++ } ++ start += from_this_page; ++ from_this_cache_entry -= from_this_page; ++ } ++ return 0; ++} ++ ++static int add_system_iovec_to_sdma_packet(struct user_sdma_request *req, ++ struct user_sdma_txreq *tx, ++ struct user_sdma_iovec *iovec, ++ size_t from_this_iovec) ++{ ++ struct mmu_rb_handler *handler = req->pq->handler; ++ ++ while (from_this_iovec > 0) { ++ struct sdma_mmu_node *cache_entry; ++ size_t from_this_cache_entry; ++ size_t start; ++ int ret; ++ ++ start = (uintptr_t)iovec->iov.iov_base + iovec->offset; ++ ret = get_system_cache_entry(req, &cache_entry, start, ++ from_this_iovec); ++ if (ret) { ++ SDMA_DBG(req, "pin system segment failed %d", ret); ++ return ret; ++ } ++ ++ from_this_cache_entry = cache_entry->rb.len - (start - cache_entry->rb.addr); ++ if (from_this_cache_entry > from_this_iovec) ++ from_this_cache_entry = from_this_iovec; ++ ++ ret = add_mapping_to_sdma_packet(req, tx, cache_entry, start, ++ from_this_cache_entry); ++ if (ret) { ++ /* ++ * We're guaranteed that there will be no descriptor ++ * completion callback that releases this node ++ * because only the last descriptor referencing it ++ * has a context attached, and a failure means the ++ * last descriptor was never added. ++ */ ++ release_node(handler, cache_entry); ++ SDMA_DBG(req, "add system segment failed %d", ret); ++ return ret; ++ } ++ ++ iovec->offset += from_this_cache_entry; ++ from_this_iovec -= from_this_cache_entry; ++ } ++ ++ return 0; ++} ++ ++static int add_system_pages_to_sdma_packet(struct user_sdma_request *req, ++ struct user_sdma_txreq *tx, ++ struct user_sdma_iovec *iovec, ++ u32 *pkt_data_remaining) ++{ ++ size_t remaining_to_add = *pkt_data_remaining; ++ /* ++ * Walk through iovec entries, ensure the associated pages ++ * are pinned and mapped, add data to the packet until no more ++ * data remains to be added. ++ */ ++ while (remaining_to_add > 0) { ++ struct user_sdma_iovec *cur_iovec; ++ size_t from_this_iovec; ++ int ret; ++ ++ cur_iovec = iovec; ++ from_this_iovec = iovec->iov.iov_len - iovec->offset; ++ ++ if (from_this_iovec > remaining_to_add) { ++ from_this_iovec = remaining_to_add; ++ } else { ++ /* The current iovec entry will be consumed by this pass. */ ++ req->iov_idx++; ++ iovec++; ++ } ++ ++ ret = add_system_iovec_to_sdma_packet(req, tx, cur_iovec, ++ from_this_iovec); ++ if (ret) ++ return ret; ++ ++ remaining_to_add -= from_this_iovec; ++ } ++ *pkt_data_remaining = remaining_to_add; ++ ++ return 0; ++} ++ ++void system_descriptor_complete(struct hfi1_devdata *dd, ++ struct sdma_desc *descp) ++{ ++ switch (sdma_mapping_type(descp)) { ++ case SDMA_MAP_SINGLE: ++ dma_unmap_single(&dd->pcidev->dev, sdma_mapping_addr(descp), ++ sdma_mapping_len(descp), DMA_TO_DEVICE); ++ break; ++ case SDMA_MAP_PAGE: ++ dma_unmap_page(&dd->pcidev->dev, sdma_mapping_addr(descp), ++ sdma_mapping_len(descp), DMA_TO_DEVICE); ++ break; ++ } ++ ++ if (descp->pinning_ctx) { ++ struct sdma_mmu_node *node = descp->pinning_ctx; ++ ++ release_node(node->rb.handler, node); ++ } ++} ++ + static bool sdma_rb_filter(struct mmu_rb_node *node, unsigned long addr, + unsigned long len) + { +@@ -1493,8 +1666,7 @@ static void sdma_rb_remove(void *arg, struct mmu_rb_node *mnode) + struct sdma_mmu_node *node = + container_of(mnode, struct sdma_mmu_node, rb); + +- unpin_sdma_pages(node); +- kfree(node); ++ free_system_node(node); + } + + static int sdma_rb_invalidate(void *arg, struct mmu_rb_node *mnode) +diff --git a/drivers/infiniband/hw/hfi1/user_sdma.h b/drivers/infiniband/hw/hfi1/user_sdma.h +index ea56eb57e656..a241836371dc 100644 +--- a/drivers/infiniband/hw/hfi1/user_sdma.h ++++ b/drivers/infiniband/hw/hfi1/user_sdma.h +@@ -112,16 +112,11 @@ struct sdma_mmu_node { + struct user_sdma_iovec { + struct list_head list; + struct iovec iov; +- /* number of pages in this vector */ +- unsigned int npages; +- /* array of pinned pages for this vector */ +- struct page **pages; + /* + * offset into the virtual address space of the vector at + * which we last left off. + */ + u64 offset; +- struct sdma_mmu_node *node; + }; + + /* evict operation argument */ +diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c +index 7f6d7fc7951d..fbdcfecb1768 100644 +--- a/drivers/infiniband/hw/hfi1/verbs.c ++++ b/drivers/infiniband/hw/hfi1/verbs.c +@@ -778,8 +778,8 @@ static int build_verbs_tx_desc( + + /* add icrc, lt byte, and padding to flit */ + if (extra_bytes) +- ret = sdma_txadd_daddr(sde->dd, &tx->txreq, +- sde->dd->sdma_pad_phys, extra_bytes); ++ ret = sdma_txadd_daddr(sde->dd, &tx->txreq, sde->dd->sdma_pad_phys, ++ extra_bytes); + + bail_txadd: + return ret; +diff --git a/drivers/infiniband/hw/hfi1/vnic_sdma.c b/drivers/infiniband/hw/hfi1/vnic_sdma.c +index c3f0f8d877c3..727eedfba332 100644 +--- a/drivers/infiniband/hw/hfi1/vnic_sdma.c ++++ b/drivers/infiniband/hw/hfi1/vnic_sdma.c +@@ -64,6 +64,7 @@ static noinline int build_vnic_ulp_payload(struct sdma_engine *sde, + + /* combine physically continuous fragments later? */ + ret = sdma_txadd_page(sde->dd, ++ NULL, + &tx->txreq, + skb_frag_page(frag), + skb_frag_off(frag), +-- +2.39.1.1.gbe015eda0162 + diff --git a/patches.suse/IB-hifi1-add-a-null-check-of-kzalloc_node-in-hfi1_ip.patch b/patches.suse/IB-hifi1-add-a-null-check-of-kzalloc_node-in-hfi1_ip.patch new file mode 100644 index 0000000..5c2df6b --- /dev/null +++ b/patches.suse/IB-hifi1-add-a-null-check-of-kzalloc_node-in-hfi1_ip.patch @@ -0,0 +1,42 @@ +From c874ad879c2f29ebe040a34b974389875c0d81eb Mon Sep 17 00:00:00 2001 +From: Kang Chen +Date: Mon, 27 Feb 2023 18:02:12 +0800 +Subject: [PATCH 1/1] IB/hifi1: add a null check of kzalloc_node in + hfi1_ipoib_txreq_init +Git-commit: c874ad879c2f29ebe040a34b974389875c0d81eb +Patch-mainline: v6.4-rc1 +References: git-fixes + +kzalloc_node may fails, check it and do the cleanup. + +Fixes: b1151b74ff68 ("IB/hfi1: Fix alloc failure with larger txqueuelen") +Signed-off-by: Kang Chen +Link: https://lore.kernel.org/r/20230227100212.910820-1-void0red@gmail.com +Signed-off-by: Leon Romanovsky +Acked-by: Nicolas Morey +--- + drivers/infiniband/hw/hfi1/ipoib_tx.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hfi1/ipoib_tx.c b/drivers/infiniband/hw/hfi1/ipoib_tx.c +index 5d9a7b09ca37..349eb4139136 100644 +--- a/drivers/infiniband/hw/hfi1/ipoib_tx.c ++++ b/drivers/infiniband/hw/hfi1/ipoib_tx.c +@@ -737,10 +737,13 @@ int hfi1_ipoib_txreq_init(struct hfi1_ipoib_dev_priv *priv) + txq->tx_ring.shift = ilog2(tx_item_size); + txq->tx_ring.avail = hfi1_ipoib_ring_hwat(txq); + tx_ring = &txq->tx_ring; +- for (j = 0; j < tx_ring_size; j++) ++ for (j = 0; j < tx_ring_size; j++) { + hfi1_txreq_from_idx(tx_ring, j)->sdma_hdr = + kzalloc_node(sizeof(*tx->sdma_hdr), + GFP_KERNEL, priv->dd->node); ++ if (!hfi1_txreq_from_idx(tx_ring, j)->sdma_hdr) ++ goto free_txqs; ++ } + + netif_tx_napi_add(dev, &txq->napi, + hfi1_ipoib_poll_tx_ring, +-- +2.39.1.1.gbe015eda0162 + diff --git a/patches.suse/Input-xpad-add-constants-for-GIP-interface-numbers.patch b/patches.suse/Input-xpad-add-constants-for-GIP-interface-numbers.patch new file mode 100644 index 0000000..3e9f819 --- /dev/null +++ b/patches.suse/Input-xpad-add-constants-for-GIP-interface-numbers.patch @@ -0,0 +1,42 @@ +From f9b2e603c6216824e34dc9a67205d98ccc9a41ca Mon Sep 17 00:00:00 2001 +From: Vicki Pfau +Date: Thu, 13 Apr 2023 23:57:42 -0700 +Subject: [PATCH] Input: xpad - add constants for GIP interface numbers +Git-commit: f9b2e603c6216824e34dc9a67205d98ccc9a41ca +Patch-mainline: v6.4-rc1 +References: git-fixes + +Wired GIP devices present multiple interfaces with the same USB identification +other than the interface number. This adds constants for differentiating two of +them and uses them where appropriate + +Signed-off-by: Vicki Pfau +Link: https://lore.kernel.org/r/20230411031650.960322-2-vi@endrift.com +Signed-off-by: Dmitry Torokhov +Acked-by: Takashi Iwai + +--- + drivers/input/joystick/xpad.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -493,6 +493,9 @@ struct xboxone_init_packet { + } + + ++#define GIP_WIRED_INTF_DATA 0 ++#define GIP_WIRED_INTF_AUDIO 1 ++ + /* + * This packet is required for all Xbox One pads with 2015 + * or later firmware installed (or present from the factory). +@@ -1821,7 +1824,7 @@ static int xpad_probe(struct usb_interfa + } + + if (xpad->xtype == XTYPE_XBOXONE && +- intf->cur_altsetting->desc.bInterfaceNumber != 0) { ++ intf->cur_altsetting->desc.bInterfaceNumber != GIP_WIRED_INTF_DATA) { + /* + * The Xbox One controller lists three interfaces all with the + * same interface class, subclass and protocol. Differentiate by diff --git a/patches.suse/KVM-LAPIC-Enable-timer-posted-interrupt-only-when-mw.patch b/patches.suse/KVM-LAPIC-Enable-timer-posted-interrupt-only-when-mw.patch new file mode 100644 index 0000000..69293f1 --- /dev/null +++ b/patches.suse/KVM-LAPIC-Enable-timer-posted-interrupt-only-when-mw.patch @@ -0,0 +1,52 @@ +Patch-mainline: v5.18-rc1 +Git-commit: 1714a4eb6fb0cb79f182873cd011a8ed60ac65e8 +References: git-fixes +From: Wanpeng Li +Date: Tue, 25 Jan 2022 04:08:58 -0800 +Subject: [PATCH] KVM: LAPIC: Enable timer posted-interrupt only when mwait/hlt + is advertised + +As commit 0c5f81dad46 ("KVM: LAPIC: Inject timer interrupt via posted +interrupt") mentioned that the host admin should well tune the guest +setup, so that vCPUs are placed on isolated pCPUs, and with several pCPUs +surplus for *busy* housekeeping. In this setup, it is preferrable to +disable mwait/hlt/pause vmexits to keep the vCPUs in non-root mode. + +However, if only some guests isolated and others not, they would not +have any benefit from posted timer interrupts, and at the same time lose +VMX preemption timer fast paths because kvm_can_post_timer_interrupt() +returns true and therefore forces kvm_can_use_hv_timer() to false. + +By guaranteeing that posted-interrupt timer is only used if MWAIT or +HLT are done without vmexit, KVM can make a better choice and use the +VMX preemption timer and the corresponding fast paths. + +Reported-by: Aili Yao +Reviewed-by: Sean Christopherson +Cc: Aili Yao +Cc: Sean Christopherson +Signed-off-by: Wanpeng Li +Message-Id: <1643112538-36743-1-git-send-email-wanpengli@tencent.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Juergen Gross +--- + arch/x86/kvm/lapic.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 5fe507242960..dd4e2888c244 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -113,7 +113,8 @@ static inline u32 kvm_x2apic_id(struct kvm_lapic *apic) + + static bool kvm_can_post_timer_interrupt(struct kvm_vcpu *vcpu) + { +- return pi_inject_timer && kvm_vcpu_apicv_active(vcpu); ++ return pi_inject_timer && kvm_vcpu_apicv_active(vcpu) && ++ (kvm_mwait_in_guest(vcpu->kvm) || kvm_hlt_in_guest(vcpu->kvm)); + } + + bool kvm_can_use_hv_timer(struct kvm_vcpu *vcpu) +-- +2.35.3 + diff --git a/patches.suse/KVM-SVM-Don-t-rewrite-guest-ICR-on-AVIC-IPI-virtuali.patch b/patches.suse/KVM-SVM-Don-t-rewrite-guest-ICR-on-AVIC-IPI-virtuali.patch new file mode 100644 index 0000000..0f1e71b --- /dev/null +++ b/patches.suse/KVM-SVM-Don-t-rewrite-guest-ICR-on-AVIC-IPI-virtuali.patch @@ -0,0 +1,73 @@ +Patch-mainline: v5.18-rc1 +Git-commit: b51818afdc1d3c7cc269e295953685558d3af71c +References: git-fixes +From: Sean Christopherson +Date: Fri, 4 Feb 2022 21:41:59 +0000 +Subject: [PATCH] KVM: SVM: Don't rewrite guest ICR on AVIC IPI virtualization + failure + +Don't bother rewriting the ICR value into the vAPIC page on an AVIC IPI +virtualization failure, the access is a trap, i.e. the value has already +been written to the vAPIC page. The one caveat is if hardware left the +BUSY flag set (which appears to happen somewhat arbitrarily), in which +case go through the "nodecode" APIC-write path in order to clear the BUSY +flag. + +Signed-off-by: Sean Christopherson +Message-Id: <20220204214205.3306634-6-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Juergen Gross +--- + arch/x86/kvm/lapic.c | 1 + + arch/x86/kvm/svm/avic.c | 22 +++++++++++----------- + 2 files changed, 12 insertions(+), 11 deletions(-) + +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 307f81635b6c..2b5db464c7aa 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -1291,6 +1291,7 @@ void kvm_apic_send_ipi(struct kvm_lapic *apic, u32 icr_low, u32 icr_high) + + kvm_irq_delivery_to_apic(apic->vcpu->kvm, apic, &irq, NULL); + } ++EXPORT_SYMBOL_GPL(kvm_apic_send_ipi); + + static u32 apic_get_tmcct(struct kvm_lapic *apic) + { +diff --git a/arch/x86/kvm/svm/avic.c b/arch/x86/kvm/svm/avic.c +index 45b4bc657f74..aea0b13773fd 100644 +--- a/arch/x86/kvm/svm/avic.c ++++ b/arch/x86/kvm/svm/avic.c +@@ -324,18 +324,18 @@ int avic_incomplete_ipi_interception(struct kvm_vcpu *vcpu) + switch (id) { + case AVIC_IPI_FAILURE_INVALID_INT_TYPE: + /* +- * AVIC hardware handles the generation of +- * IPIs when the specified Message Type is Fixed +- * (also known as fixed delivery mode) and +- * the Trigger Mode is edge-triggered. The hardware +- * also supports self and broadcast delivery modes +- * specified via the Destination Shorthand(DSH) +- * field of the ICRL. Logical and physical APIC ID +- * formats are supported. All other IPI types cause +- * a #VMEXIT, which needs to emulated. ++ * Emulate IPIs that are not handled by AVIC hardware, which ++ * only virtualizes Fixed, Edge-Triggered INTRs. The exit is ++ * a trap, e.g. ICR holds the correct value and RIP has been ++ * advanced, KVM is responsible only for emulating the IPI. ++ * Sadly, hardware may sometimes leave the BUSY flag set, in ++ * which case KVM needs to emulate the ICR write as well in ++ * order to clear the BUSY flag. + */ +- kvm_lapic_reg_write(apic, APIC_ICR2, icrh); +- kvm_lapic_reg_write(apic, APIC_ICR, icrl); ++ if (icrl & APIC_ICR_BUSY) ++ kvm_apic_write_nodecode(vcpu, APIC_ICR); ++ else ++ kvm_apic_send_ipi(apic, icrl, icrh); + break; + case AVIC_IPI_FAILURE_TARGET_NOT_RUNNING: + /* +-- +2.35.3 + diff --git a/patches.suse/KVM-VMX-Introduce-vmx_msr_bitmap_l01_changed-helper.patch b/patches.suse/KVM-VMX-Introduce-vmx_msr_bitmap_l01_changed-helper.patch new file mode 100644 index 0000000..85aca94 --- /dev/null +++ b/patches.suse/KVM-VMX-Introduce-vmx_msr_bitmap_l01_changed-helper.patch @@ -0,0 +1,72 @@ +Patch-mainline: v5.17-rc1 +Git-commit: b84155c38076b36d625043a06a2f1c90bde62903 +References: git-fixes +From: Vitaly Kuznetsov +Date: Mon, 29 Nov 2021 10:47:02 +0100 +Subject: [PATCH] KVM: VMX: Introduce vmx_msr_bitmap_l01_changed() helper + +In preparation to enabling 'Enlightened MSR Bitmap' feature for Hyper-V +guests move MSR bitmap update tracking to a dedicated helper. + +Note: vmx_msr_bitmap_l01_changed() is called when MSR bitmap might be +updated. KVM doesn't check if the bit we're trying to set is already set +(or the bit it's trying to clear is already cleared). Such situations +should not be common and a few false positives should not be a problem. + +No functional change intended. + +Signed-off-by: Vitaly Kuznetsov +Reviewed-by: Maxim Levitsky +Reviewed-by: Sean Christopherson +Message-Id: <20211129094704.326635-3-vkuznets@redhat.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Juergen Gross +--- + arch/x86/kvm/vmx/vmx.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c +index 9d7f26eaf05f..7ee50671191b 100644 +--- a/arch/x86/kvm/vmx/vmx.c ++++ b/arch/x86/kvm/vmx/vmx.c +@@ -3688,6 +3688,17 @@ void free_vpid(int vpid) + spin_unlock(&vmx_vpid_lock); + } + ++static void vmx_msr_bitmap_l01_changed(struct vcpu_vmx *vmx) ++{ ++ /* ++ * When KVM is a nested hypervisor on top of Hyper-V and uses ++ * 'Enlightened MSR Bitmap' feature L0 needs to know that MSR ++ * bitmap has changed. ++ */ ++ if (static_branch_unlikely(&enable_evmcs)) ++ evmcs_touch_msr_bitmap(); ++} ++ + void vmx_disable_intercept_for_msr(struct kvm_vcpu *vcpu, u32 msr, int type) + { + struct vcpu_vmx *vmx = to_vmx(vcpu); +@@ -3696,8 +3707,7 @@ void vmx_disable_intercept_for_msr(struct kvm_vcpu *vcpu, u32 msr, int type) + if (!cpu_has_vmx_msr_bitmap()) + return; + +- if (static_branch_unlikely(&enable_evmcs)) +- evmcs_touch_msr_bitmap(); ++ vmx_msr_bitmap_l01_changed(vmx); + + /* + * Mark the desired intercept state in shadow bitmap, this is needed +@@ -3741,8 +3751,7 @@ void vmx_enable_intercept_for_msr(struct kvm_vcpu *vcpu, u32 msr, int type) + if (!cpu_has_vmx_msr_bitmap()) + return; + +- if (static_branch_unlikely(&enable_evmcs)) +- evmcs_touch_msr_bitmap(); ++ vmx_msr_bitmap_l01_changed(vmx); + + /* + * Mark the desired intercept state in shadow bitmap, this is needed +-- +2.35.3 + diff --git a/patches.suse/KVM-VMX-Set-vmcs.PENDING_DBG.BS-on-DB-in-STI-MOVSS-b.patch b/patches.suse/KVM-VMX-Set-vmcs.PENDING_DBG.BS-on-DB-in-STI-MOVSS-b.patch new file mode 100644 index 0000000..4aad261 --- /dev/null +++ b/patches.suse/KVM-VMX-Set-vmcs.PENDING_DBG.BS-on-DB-in-STI-MOVSS-b.patch @@ -0,0 +1,100 @@ +Patch-mainline: v5.17-rc2 +Git-commit: b9bed78e2fa9571b7c983b20666efa0009030c71 +References: git-fixes +From: Sean Christopherson +Date: Thu, 20 Jan 2022 00:06:24 +0000 +Subject: [PATCH] KVM: VMX: Set vmcs.PENDING_DBG.BS on #DB in STI/MOVSS + blocking shadow + +Set vmcs.GUEST_PENDING_DBG_EXCEPTIONS.BS, a.k.a. the pending single-step +breakpoint flag, when re-injecting a #DB with RFLAGS.TF=1, and STI or +MOVSS blocking is active. Setting the flag is necessary to make VM-Entry +consistency checks happy, as VMX has an invariant that if RFLAGS.TF is +set and STI/MOVSS blocking is true, then the previous instruction must +have been STI or MOV/POP, and therefore a single-step #DB must be pending +since the RFLAGS.TF cannot have been set by the previous instruction, +i.e. the one instruction delay after setting RFLAGS.TF must have already +expired. + +Normally, the CPU sets vmcs.GUEST_PENDING_DBG_EXCEPTIONS.BS appropriately +when recording guest state as part of a VM-Exit, but #DB VM-Exits +intentionally do not treat the #DB as "guest state" as interception of +the #DB effectively makes the #DB host-owned, thus KVM needs to manually +set PENDING_DBG.BS when forwarding/re-injecting the #DB to the guest. + +Note, although this bug can be triggered by guest userspace, doing so +requires IOPL=3, and guest userspace running with IOPL=3 has full access +to all I/O ports (from the guest's perspective) and can crash/reboot the +guest any number of ways. IOPL=3 is required because STI blocking kicks +in if and only if RFLAGS.IF is toggled 0=>1, and if CPL>IOPL, STI either +takes a #GP or modifies RFLAGS.VIF, not RFLAGS.IF. + +MOVSS blocking can be initiated by userspace, but can be coincident with +a #DB if and only if DR7.GD=1 (General Detect enabled) and a MOV DR is +executed in the MOVSS shadow. MOV DR #GPs at CPL>0, thus MOVSS blocking +is problematic only for CPL0 (and only if the guest is crazy enough to +access a DR in a MOVSS shadow). All other sources of #DBs are either +suppressed by MOVSS blocking (single-step, code fetch, data, and I/O), +are mutually exclusive with MOVSS blocking (T-bit task switch), or are +already handled by KVM (ICEBP, a.k.a. INT1). + +This bug was originally found by running tests[1] created for XSA-308[2]. +Note that Xen's userspace test emits ICEBP in the MOVSS shadow, which is +presumably why the Xen bug was deemed to be an exploitable DOS from guest +userspace. KVM already handles ICEBP by skipping the ICEBP instruction +and thus clears MOVSS blocking as a side effect of its "emulation". + +[1] http://xenbits.xenproject.org/docs/xtf/xsa-308_2main_8c_source.html +[2] https://xenbits.xen.org/xsa/advisory-308.html + +Reported-by: David Woodhouse +Reported-by: Alexander Graf +Signed-off-by: Sean Christopherson +Message-Id: <20220120000624.655815-1-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Juergen Gross +--- + arch/x86/kvm/vmx/vmx.c | 25 +++++++++++++++++++++++++ + 1 file changed, 25 insertions(+) + +diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c +index 705e5c082738..2833b095a804 100644 +--- a/arch/x86/kvm/vmx/vmx.c ++++ b/arch/x86/kvm/vmx/vmx.c +@@ -4905,8 +4905,33 @@ static int handle_exception_nmi(struct kvm_vcpu *vcpu) + dr6 = vmx_get_exit_qual(vcpu); + if (!(vcpu->guest_debug & + (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))) { ++ /* ++ * If the #DB was due to ICEBP, a.k.a. INT1, skip the ++ * instruction. ICEBP generates a trap-like #DB, but ++ * despite its interception control being tied to #DB, ++ * is an instruction intercept, i.e. the VM-Exit occurs ++ * on the ICEBP itself. Note, skipping ICEBP also ++ * clears STI and MOVSS blocking. ++ * ++ * For all other #DBs, set vmcs.PENDING_DBG_EXCEPTIONS.BS ++ * if single-step is enabled in RFLAGS and STI or MOVSS ++ * blocking is active, as the CPU doesn't set the bit ++ * on VM-Exit due to #DB interception. VM-Entry has a ++ * consistency check that a single-step #DB is pending ++ * in this scenario as the previous instruction cannot ++ * have toggled RFLAGS.TF 0=>1 (because STI and POP/MOV ++ * don't modify RFLAGS), therefore the one instruction ++ * delay when activating single-step breakpoints must ++ * have already expired. Note, the CPU sets/clears BS ++ * as appropriate for all other VM-Exits types. ++ */ + if (is_icebp(intr_info)) + WARN_ON(!skip_emulated_instruction(vcpu)); ++ else if ((vmx_get_rflags(vcpu) & X86_EFLAGS_TF) && ++ (vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & ++ (GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS))) ++ vmcs_writel(GUEST_PENDING_DBG_EXCEPTIONS, ++ vmcs_readl(GUEST_PENDING_DBG_EXCEPTIONS) | DR6_BS); + + kvm_queue_exception_p(vcpu, DB_VECTOR, dr6); + return 1; +-- +2.35.3 + diff --git a/patches.suse/KVM-X86-Fix-tlb-flush-for-tdp-in-kvm_invalidate_pcid.patch b/patches.suse/KVM-X86-Fix-tlb-flush-for-tdp-in-kvm_invalidate_pcid.patch new file mode 100644 index 0000000..3d97aed --- /dev/null +++ b/patches.suse/KVM-X86-Fix-tlb-flush-for-tdp-in-kvm_invalidate_pcid.patch @@ -0,0 +1,49 @@ +Patch-mainline: v5.16-rc1 +Git-commit: e45e9e3998f0001079b09555db5bb3b4257f6746 +References: git-fixes +From: Lai Jiangshan +Date: Tue, 19 Oct 2021 19:01:51 +0800 +Subject: [PATCH] KVM: X86: Fix tlb flush for tdp in kvm_invalidate_pcid() + +The KVM doesn't know whether any TLB for a specific pcid is cached in +the CPU when tdp is enabled. So it is better to flush all the guest +TLB when invalidating any single PCID context. + +The case is very rare or even impossible since KVM generally doesn't +intercept CR3 write or INVPCID instructions when tdp is enabled, so the +fix is mostly for the sake of overall robustness. + +Signed-off-by: Lai Jiangshan +Message-Id: <20211019110154.4091-2-jiangshanlai@gmail.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Juergen Gross +--- + arch/x86/kvm/x86.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index f55654158836..f7806e3f3019 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -1073,6 +1073,18 @@ static void kvm_invalidate_pcid(struct kvm_vcpu *vcpu, unsigned long pcid) + unsigned long roots_to_free = 0; + int i; + ++ /* ++ * MOV CR3 and INVPCID are usually not intercepted when using TDP, but ++ * this is reachable when running EPT=1 and unrestricted_guest=0, and ++ * also via the emulator. KVM's TDP page tables are not in the scope of ++ * the invalidation, but the guest's TLB entries need to be flushed as ++ * the CPU may have cached entries in its TLB for the target PCID. ++ */ ++ if (unlikely(tdp_enabled)) { ++ kvm_make_request(KVM_REQ_TLB_FLUSH_GUEST, vcpu); ++ return; ++ } ++ + /* + * If neither the current CR3 nor any of the prev_roots use the given + * PCID, then nothing needs to be done here because a resync will +-- +2.35.3 + diff --git a/patches.suse/KVM-nVMX-Also-filter-MSR_IA32_VMX_TRUE_PINBASED_CTLS.patch b/patches.suse/KVM-nVMX-Also-filter-MSR_IA32_VMX_TRUE_PINBASED_CTLS.patch new file mode 100644 index 0000000..f778fc7 --- /dev/null +++ b/patches.suse/KVM-nVMX-Also-filter-MSR_IA32_VMX_TRUE_PINBASED_CTLS.patch @@ -0,0 +1,41 @@ +Patch-mainline: v5.17-rc2 +Git-commit: f80ae0ef089a09e8c18da43a382c3caac9a424a7 +References: git-fixes +From: Vitaly Kuznetsov +Date: Wed, 12 Jan 2022 18:01:30 +0100 +Subject: [PATCH] KVM: nVMX: Also filter MSR_IA32_VMX_TRUE_PINBASED_CTLS when + eVMCS + +Similar to MSR_IA32_VMX_EXIT_CTLS/MSR_IA32_VMX_TRUE_EXIT_CTLS, +MSR_IA32_VMX_ENTRY_CTLS/MSR_IA32_VMX_TRUE_ENTRY_CTLS pair, +MSR_IA32_VMX_TRUE_PINBASED_CTLS needs to be filtered the same way +MSR_IA32_VMX_PINBASED_CTLS is currently filtered as guests may solely rely +on 'true' MSR data. + +Note, none of the currently existing Windows/Hyper-V versions are known +to stumble upon the unfiltered MSR_IA32_VMX_TRUE_PINBASED_CTLS, the change +is aimed at making the filtering future proof. + +Signed-off-by: Vitaly Kuznetsov +Message-Id: <20220112170134.1904308-2-vkuznets@redhat.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Juergen Gross +--- + arch/x86/kvm/vmx/evmcs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/kvm/vmx/evmcs.c b/arch/x86/kvm/vmx/evmcs.c +index ba6f99f584ac..a7ed30d5647a 100644 +--- a/arch/x86/kvm/vmx/evmcs.c ++++ b/arch/x86/kvm/vmx/evmcs.c +@@ -362,6 +362,7 @@ void nested_evmcs_filter_control_msr(u32 msr_index, u64 *pdata) + case MSR_IA32_VMX_PROCBASED_CTLS2: + ctl_high &= ~EVMCS1_UNSUPPORTED_2NDEXEC; + break; ++ case MSR_IA32_VMX_TRUE_PINBASED_CTLS: + case MSR_IA32_VMX_PINBASED_CTLS: + ctl_high &= ~EVMCS1_UNSUPPORTED_PINCTRL; + break; +-- +2.35.3 + diff --git a/patches.suse/KVM-nVMX-Don-t-use-Enlightened-MSR-Bitmap-for-L3.patch b/patches.suse/KVM-nVMX-Don-t-use-Enlightened-MSR-Bitmap-for-L3.patch new file mode 100644 index 0000000..f0a9a8c --- /dev/null +++ b/patches.suse/KVM-nVMX-Don-t-use-Enlightened-MSR-Bitmap-for-L3.patch @@ -0,0 +1,79 @@ +Patch-mainline: v5.16-rc5 +Git-commit: 250552b925ce400c17d166422fde9bb215958481 +References: git-fixes +From: Vitaly Kuznetsov +Date: Mon, 29 Nov 2021 10:47:01 +0100 +Subject: [PATCH] KVM: nVMX: Don't use Enlightened MSR Bitmap for L3 + +When KVM runs as a nested hypervisor on top of Hyper-V it uses Enlightened +VMCS and enables Enlightened MSR Bitmap feature for its L1s and L2s (which +are actually L2s and L3s from Hyper-V's perspective). When MSR bitmap is +updated, KVM has to reset HV_VMX_ENLIGHTENED_CLEAN_FIELD_MSR_BITMAP from +clean fields to make Hyper-V aware of the change. For KVM's L1s, this is +done in vmx_disable_intercept_for_msr()/vmx_enable_intercept_for_msr(). +MSR bitmap for L2 is build in nested_vmx_prepare_msr_bitmap() by blending +MSR bitmap for L1 and L1's idea of MSR bitmap for L2. KVM, however, doesn't +check if the resulting bitmap is different and never cleans +HV_VMX_ENLIGHTENED_CLEAN_FIELD_MSR_BITMAP in eVMCS02. This is incorrect and +may result in Hyper-V missing the update. + +The issue could've been solved by calling evmcs_touch_msr_bitmap() for +eVMCS02 from nested_vmx_prepare_msr_bitmap() unconditionally but doing so +would not give any performance benefits (compared to not using Enlightened +MSR Bitmap at all). 3-level nesting is also not a very common setup +nowadays. + +Don't enable 'Enlightened MSR Bitmap' feature for KVM's L2s (real L3s) for +now. + +Signed-off-by: Vitaly Kuznetsov +Message-Id: <20211129094704.326635-2-vkuznets@redhat.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Juergen Gross +--- + arch/x86/kvm/vmx/vmx.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c +index 9453743ce0c4..5aadad3e7367 100644 +--- a/arch/x86/kvm/vmx/vmx.c ++++ b/arch/x86/kvm/vmx/vmx.c +@@ -2646,15 +2646,6 @@ int alloc_loaded_vmcs(struct loaded_vmcs *loaded_vmcs) + if (!loaded_vmcs->msr_bitmap) + goto out_vmcs; + memset(loaded_vmcs->msr_bitmap, 0xff, PAGE_SIZE); +- +- if (IS_ENABLED(CONFIG_HYPERV) && +- static_branch_unlikely(&enable_evmcs) && +- (ms_hyperv.nested_features & HV_X64_NESTED_MSR_BITMAP)) { +- struct hv_enlightened_vmcs *evmcs = +- (struct hv_enlightened_vmcs *)loaded_vmcs->vmcs; +- +- evmcs->hv_enlightenments_control.msr_bitmap = 1; +- } + } + + memset(&loaded_vmcs->host_state, 0, sizeof(struct vmcs_host_state)); +@@ -6842,6 +6833,19 @@ static int vmx_create_vcpu(struct kvm_vcpu *vcpu) + if (err < 0) + goto free_pml; + ++ /* ++ * Use Hyper-V 'Enlightened MSR Bitmap' feature when KVM runs as a ++ * nested (L1) hypervisor and Hyper-V in L0 supports it. Enable the ++ * feature only for vmcs01, KVM currently isn't equipped to realize any ++ * performance benefits from enabling it for vmcs02. ++ */ ++ if (IS_ENABLED(CONFIG_HYPERV) && static_branch_unlikely(&enable_evmcs) && ++ (ms_hyperv.nested_features & HV_X64_NESTED_MSR_BITMAP)) { ++ struct hv_enlightened_vmcs *evmcs = (void *)vmx->vmcs01.vmcs; ++ ++ evmcs->hv_enlightenments_control.msr_bitmap = 1; ++ } ++ + /* The MSR bitmap starts with all ones */ + bitmap_fill(vmx->shadow_msr_intercept.read, MAX_POSSIBLE_PASSTHROUGH_MSRS); + bitmap_fill(vmx->shadow_msr_intercept.write, MAX_POSSIBLE_PASSTHROUGH_MSRS); +-- +2.35.3 + diff --git a/patches.suse/KVM-nVMX-eVMCS-Filter-out-VM_EXIT_SAVE_VMX_PREEMPTIO.patch b/patches.suse/KVM-nVMX-eVMCS-Filter-out-VM_EXIT_SAVE_VMX_PREEMPTIO.patch new file mode 100644 index 0000000..60c7b3e --- /dev/null +++ b/patches.suse/KVM-nVMX-eVMCS-Filter-out-VM_EXIT_SAVE_VMX_PREEMPTIO.patch @@ -0,0 +1,42 @@ +Patch-mainline: v5.17-rc2 +Git-commit: 7a601e2cf61558dfd534a9ecaad09f5853ad8204 +References: git-fixes +From: Vitaly Kuznetsov +Date: Wed, 12 Jan 2022 18:01:31 +0100 +Subject: [PATCH] KVM: nVMX: eVMCS: Filter out + VM_EXIT_SAVE_VMX_PREEMPTION_TIMER + +Enlightened VMCS v1 doesn't have VMX_PREEMPTION_TIMER_VALUE field, +PIN_BASED_VMX_PREEMPTION_TIMER is also filtered out already so it makes +sense to filter out VM_EXIT_SAVE_VMX_PREEMPTION_TIMER too. + +Note, none of the currently existing Windows/Hyper-V versions are known +to enable 'save VMX-preemption timer value' when eVMCS is in use, the +change is aimed at making the filtering future proof. + +Signed-off-by: Vitaly Kuznetsov +Message-Id: <20220112170134.1904308-3-vkuznets@redhat.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Juergen Gross +--- + arch/x86/kvm/vmx/evmcs.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/kvm/vmx/evmcs.h b/arch/x86/kvm/vmx/evmcs.h +index 16731d2cf231..3a461a32128b 100644 +--- a/arch/x86/kvm/vmx/evmcs.h ++++ b/arch/x86/kvm/vmx/evmcs.h +@@ -59,7 +59,9 @@ DECLARE_STATIC_KEY_FALSE(enable_evmcs); + SECONDARY_EXEC_SHADOW_VMCS | \ + SECONDARY_EXEC_TSC_SCALING | \ + SECONDARY_EXEC_PAUSE_LOOP_EXITING) +-#define EVMCS1_UNSUPPORTED_VMEXIT_CTRL (VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL) ++#define EVMCS1_UNSUPPORTED_VMEXIT_CTRL \ ++ (VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL | \ ++ VM_EXIT_SAVE_VMX_PREEMPTION_TIMER) + #define EVMCS1_UNSUPPORTED_VMENTRY_CTRL (VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL) + #define EVMCS1_UNSUPPORTED_VMFUNC (VMX_VMFUNC_EPTP_SWITCHING) + +-- +2.35.3 + diff --git a/patches.suse/KVM-x86-Copy-filter-arg-outside-kvm_vm_ioctl_set_msr.patch b/patches.suse/KVM-x86-Copy-filter-arg-outside-kvm_vm_ioctl_set_msr.patch new file mode 100644 index 0000000..1c6f712 --- /dev/null +++ b/patches.suse/KVM-x86-Copy-filter-arg-outside-kvm_vm_ioctl_set_msr.patch @@ -0,0 +1,92 @@ +Patch-mainline: v6.1-rc2 +Git-commit: 2e3272bc1790825c43d2c39690bf2836b81c6d36 +References: git-fixes +From: Alexander Graf +Date: Mon, 17 Oct 2022 20:45:40 +0200 +Subject: [PATCH] KVM: x86: Copy filter arg outside + kvm_vm_ioctl_set_msr_filter() + +In the next patch we want to introduce a second caller to +set_msr_filter() which constructs its own filter list on the stack. +Refactor the original function so it takes it as argument instead of +reading it through copy_from_user(). + +Signed-off-by: Alexander Graf +Message-Id: <20221017184541.2658-3-graf@amazon.com> +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Bonzini +Signed-off-by: Juergen Gross +--- + arch/x86/kvm/x86.c | 31 +++++++++++++++++-------------- + 1 file changed, 17 insertions(+), 14 deletions(-) + +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 4bd5f8a751de..78f779f0264b 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -6442,26 +6442,22 @@ static int kvm_add_msr_filter(struct kvm_x86_msr_filter *msr_filter, + return 0; + } + +-static int kvm_vm_ioctl_set_msr_filter(struct kvm *kvm, void __user *argp) ++static int kvm_vm_ioctl_set_msr_filter(struct kvm *kvm, ++ struct kvm_msr_filter *filter) + { +- struct kvm_msr_filter __user *user_msr_filter = argp; + struct kvm_x86_msr_filter *new_filter, *old_filter; +- struct kvm_msr_filter filter; + bool default_allow; + bool empty = true; + int r = 0; + u32 i; + +- if (copy_from_user(&filter, user_msr_filter, sizeof(filter))) +- return -EFAULT; +- +- if (filter.flags & ~KVM_MSR_FILTER_DEFAULT_DENY) ++ if (filter->flags & ~KVM_MSR_FILTER_DEFAULT_DENY) + return -EINVAL; + +- for (i = 0; i < ARRAY_SIZE(filter.ranges); i++) +- empty &= !filter.ranges[i].nmsrs; ++ for (i = 0; i < ARRAY_SIZE(filter->ranges); i++) ++ empty &= !filter->ranges[i].nmsrs; + +- default_allow = !(filter.flags & KVM_MSR_FILTER_DEFAULT_DENY); ++ default_allow = !(filter->flags & KVM_MSR_FILTER_DEFAULT_DENY); + if (empty && !default_allow) + return -EINVAL; + +@@ -6469,8 +6465,8 @@ static int kvm_vm_ioctl_set_msr_filter(struct kvm *kvm, void __user *argp) + if (!new_filter) + return -ENOMEM; + +- for (i = 0; i < ARRAY_SIZE(filter.ranges); i++) { +- r = kvm_add_msr_filter(new_filter, &filter.ranges[i]); ++ for (i = 0; i < ARRAY_SIZE(filter->ranges); i++) { ++ r = kvm_add_msr_filter(new_filter, &filter->ranges[i]); + if (r) { + kvm_free_msr_filter(new_filter); + return r; +@@ -6915,9 +6911,16 @@ long kvm_arch_vm_ioctl(struct file *filp, + case KVM_SET_PMU_EVENT_FILTER: + r = kvm_vm_ioctl_set_pmu_event_filter(kvm, argp); + break; +- case KVM_X86_SET_MSR_FILTER: +- r = kvm_vm_ioctl_set_msr_filter(kvm, argp); ++ case KVM_X86_SET_MSR_FILTER: { ++ struct kvm_msr_filter __user *user_msr_filter = argp; ++ struct kvm_msr_filter filter; ++ ++ if (copy_from_user(&filter, user_msr_filter, sizeof(filter))) ++ return -EFAULT; ++ ++ r = kvm_vm_ioctl_set_msr_filter(kvm, &filter); + break; ++ } + default: + r = -ENOTTY; + } +-- +2.35.3 + diff --git a/patches.suse/KVM-x86-Do-not-change-ICR-on-write-to-APIC_SELF_IPI.patch b/patches.suse/KVM-x86-Do-not-change-ICR-on-write-to-APIC_SELF_IPI.patch new file mode 100644 index 0000000..2f23b24 --- /dev/null +++ b/patches.suse/KVM-x86-Do-not-change-ICR-on-write-to-APIC_SELF_IPI.patch @@ -0,0 +1,41 @@ +Patch-mainline: v5.18-rc1 +Git-commit: d22a81b304a27fca6124174a8e842e826c193466 +References: git-fixes +From: Paolo Bonzini +Date: Thu, 24 Feb 2022 09:53:36 -0500 +Subject: [PATCH] KVM: x86: Do not change ICR on write to APIC_SELF_IPI + +Emulating writes to SELF_IPI with a write to ICR has an unwanted side effect: +the value of ICR in vAPIC page gets changed. The lists SELF_IPI as write-only, +with no associated MMIO offset, so any write should have no visible side +effect in the vAPIC page. + +Reported-by: Chao Gao +Reviewed-by: Sean Christopherson +Signed-off-by: Paolo Bonzini +Signed-off-by: Juergen Gross +--- + arch/x86/kvm/lapic.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index ad8857359ad6..d5a33b6be7d5 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -2120,10 +2120,9 @@ int kvm_lapic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val) + break; + + case APIC_SELF_IPI: +- if (apic_x2apic_mode(apic)) { +- kvm_lapic_reg_write(apic, APIC_ICR, +- APIC_DEST_SELF | (val & APIC_VECTOR_MASK)); +- } else ++ if (apic_x2apic_mode(apic)) ++ kvm_apic_send_ipi(apic, APIC_DEST_SELF | (val & APIC_VECTOR_MASK), 0); ++ else + ret = 1; + break; + default: +-- +2.35.3 + diff --git a/patches.suse/KVM-x86-Inject-GP-if-WRMSR-sets-reserved-bits-in-API.patch b/patches.suse/KVM-x86-Inject-GP-if-WRMSR-sets-reserved-bits-in-API.patch new file mode 100644 index 0000000..2614466 --- /dev/null +++ b/patches.suse/KVM-x86-Inject-GP-if-WRMSR-sets-reserved-bits-in-API.patch @@ -0,0 +1,48 @@ +Patch-mainline: v6.3-rc1 +Git-commit: ba5838abb05334e4abfdff1490585c7f365e0424 +References: git-fixes +From: Sean Christopherson +Date: Sat, 7 Jan 2023 01:10:20 +0000 +Subject: [PATCH] KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC + Self-IPI + +Inject a #GP if the guest attempts to set reserved bits in the x2APIC-only +Self-IPI register. Bits 7:0 hold the vector, all other bits are reserved. + +Reported-by: Marc Orr +Cc: Ben Gardon +Cc: Venkatesh Srinivas +Cc: stable@vger.kernel.org +Reviewed-by: Maxim Levitsky +Link: https://lore.kernel.org/r/20230107011025.565472-2-seanjc@google.com +Signed-off-by: Sean Christopherson +Signed-off-by: Juergen Gross +--- + arch/x86/kvm/lapic.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 08450b3e7040..9aca006b2d22 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -2324,10 +2324,14 @@ static int kvm_lapic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val) + break; + + case APIC_SELF_IPI: +- if (apic_x2apic_mode(apic)) +- kvm_apic_send_ipi(apic, APIC_DEST_SELF | (val & APIC_VECTOR_MASK), 0); +- else ++ /* ++ * Self-IPI exists only when x2APIC is enabled. Bits 7:0 hold ++ * the vector, everything else is reserved. ++ */ ++ if (!apic_x2apic_mode(apic) || (val & ~APIC_VECTOR_MASK)) + ret = 1; ++ else ++ kvm_apic_send_ipi(apic, APIC_DEST_SELF | val, 0); + break; + default: + ret = 1; +-- +2.35.3 + diff --git a/patches.suse/KVM-x86-Protect-the-unused-bits-in-MSR-exiting-flags.patch b/patches.suse/KVM-x86-Protect-the-unused-bits-in-MSR-exiting-flags.patch new file mode 100644 index 0000000..3577297 --- /dev/null +++ b/patches.suse/KVM-x86-Protect-the-unused-bits-in-MSR-exiting-flags.patch @@ -0,0 +1,49 @@ +Patch-mainline: v5.19-rc8 +Git-commit: cf5029d5dd7cb0aaa53250fa9e389abd231606b3 +References: git-fixes +From: Aaron Lewis +Date: Thu, 14 Jul 2022 16:13:15 +0000 +Subject: [PATCH] KVM: x86: Protect the unused bits in MSR exiting flags + +The flags for KVM_CAP_X86_USER_SPACE_MSR and KVM_X86_SET_MSR_FILTER +have no protection for their unused bits. Without protection, future +development for these features will be difficult. Add the protection +needed to make it possible to extend these features in the future. + +Signed-off-by: Aaron Lewis +Message-Id: <20220714161314.1715227-1-aaronlewis@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Juergen Gross +--- + arch/x86/kvm/x86.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 143e37298d8a..e5fa335a4ea7 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -6029,6 +6029,11 @@ int kvm_vm_ioctl_enable_cap(struct kvm *kvm, + r = 0; + break; + case KVM_CAP_X86_USER_SPACE_MSR: ++ r = -EINVAL; ++ if (cap->args[0] & ~(KVM_MSR_EXIT_REASON_INVAL | ++ KVM_MSR_EXIT_REASON_UNKNOWN | ++ KVM_MSR_EXIT_REASON_FILTER)) ++ break; + kvm->arch.user_space_msr_mask = cap->args[0]; + r = 0; + break; +@@ -6183,6 +6188,9 @@ static int kvm_vm_ioctl_set_msr_filter(struct kvm *kvm, void __user *argp) + if (copy_from_user(&filter, user_msr_filter, sizeof(filter))) + return -EFAULT; + ++ if (filter.flags & ~KVM_MSR_FILTER_DEFAULT_DENY) ++ return -EINVAL; ++ + for (i = 0; i < ARRAY_SIZE(filter.ranges); i++) + empty &= !filter.ranges[i].nmsrs; + +-- +2.35.3 + diff --git a/patches.suse/KVM-x86-Report-deprecated-x87-features-in-supported-.patch b/patches.suse/KVM-x86-Report-deprecated-x87-features-in-supported-.patch new file mode 100644 index 0000000..ee1f838 --- /dev/null +++ b/patches.suse/KVM-x86-Report-deprecated-x87-features-in-supported-.patch @@ -0,0 +1,65 @@ +Patch-mainline: v5.17-rc3 +Git-commit: e3bcfda012edd3564e12551b212afbd2521a1f68 +References: git-fixes +From: Jim Mattson +Date: Thu, 3 Feb 2022 16:13:48 -0800 +Subject: [PATCH] KVM: x86: Report deprecated x87 features in supported CPUID + +CPUID.(EAX=7,ECX=0):EBX.FDP_EXCPTN_ONLY[bit 6] and +CPUID.(EAX=7,ECX=0):EBX.ZERO_FCS_FDS[bit 13] are "defeature" +bits. Unlike most of the other CPUID feature bits, these bits are +clear if the features are present and set if the features are not +present. These bits should be reported in KVM_GET_SUPPORTED_CPUID, +because if these bits are set on hardware, they cannot be cleared in +the guest CPUID. Doing so would claim guest support for a feature that +the hardware doesn't support and that can't be efficiently emulated. + +Of course, any software (e.g WIN87EM.DLL) expecting these features to +be present likely predates these CPUID feature bits and therefore +doesn't know to check for them anyway. + +Aaron Lewis added the corresponding X86_FEATURE macros in +commit cbb99c0f5887 ("x86/cpufeatures: Add FDP_EXCPTN_ONLY and +ZERO_FCS_FDS"), with the intention of reporting these bits in +KVM_GET_SUPPORTED_CPUID, but I was unable to find a proposed patch on +the kvm list. + +Opportunistically reordered the CPUID_7_0_EBX capability bits from +least to most significant. + +Cc: Aaron Lewis +Signed-off-by: Jim Mattson +Message-Id: <20220204001348.2844660-1-jmattson@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Juergen Gross +--- + arch/x86/kvm/cpuid.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c +index 28be02adc669..494d4d351859 100644 +--- a/arch/x86/kvm/cpuid.c ++++ b/arch/x86/kvm/cpuid.c +@@ -554,12 +554,13 @@ void kvm_set_cpu_caps(void) + ); + + kvm_cpu_cap_mask(CPUID_7_0_EBX, +- F(FSGSBASE) | F(SGX) | F(BMI1) | F(HLE) | F(AVX2) | F(SMEP) | +- F(BMI2) | F(ERMS) | F(INVPCID) | F(RTM) | 0 /*MPX*/ | F(RDSEED) | +- F(ADX) | F(SMAP) | F(AVX512IFMA) | F(AVX512F) | F(AVX512PF) | +- F(AVX512ER) | F(AVX512CD) | F(CLFLUSHOPT) | F(CLWB) | F(AVX512DQ) | +- F(SHA_NI) | F(AVX512BW) | F(AVX512VL) | 0 /*INTEL_PT*/ +- ); ++ F(FSGSBASE) | F(SGX) | F(BMI1) | F(HLE) | F(AVX2) | ++ F(FDP_EXCPTN_ONLY) | F(SMEP) | F(BMI2) | F(ERMS) | F(INVPCID) | ++ F(RTM) | F(ZERO_FCS_FDS) | 0 /*MPX*/ | F(AVX512F) | ++ F(AVX512DQ) | F(RDSEED) | F(ADX) | F(SMAP) | F(AVX512IFMA) | ++ F(CLFLUSHOPT) | F(CLWB) | 0 /*INTEL_PT*/ | F(AVX512PF) | ++ F(AVX512ER) | F(AVX512CD) | F(SHA_NI) | F(AVX512BW) | ++ F(AVX512VL)); + + kvm_cpu_cap_mask(CPUID_7_ECX, + F(AVX512VBMI) | F(LA57) | F(PKU) | 0 /*OSPKE*/ | F(RDPID) | +-- +2.35.3 + diff --git a/patches.suse/KVM-x86-do-not-set-st-preempted-when-going-back-to-u.patch b/patches.suse/KVM-x86-do-not-set-st-preempted-when-going-back-to-u.patch new file mode 100644 index 0000000..5308316 --- /dev/null +++ b/patches.suse/KVM-x86-do-not-set-st-preempted-when-going-back-to-u.patch @@ -0,0 +1,80 @@ +Patch-mainline: v5.19-rc2 +Git-commit: 54aa83c90198e68eee8b0850c749bc70efb548da +References: git-fixes +From: Paolo Bonzini +Date: Tue, 7 Jun 2022 10:07:11 -0400 +Subject: [PATCH] KVM: x86: do not set st->preempted when going back to user + space + +Similar to the Xen path, only change the vCPU's reported state if the vCPU +was actually preempted. The reason for KVM's behavior is that for example +optimistic spinning might not be a good idea if the guest is doing repeated +exits to userspace; however, it is confusing and unlikely to make a difference, +because well-tuned guests will hardly ever exit KVM_RUN in the first place. + +Suggested-by: Sean Christopherson +Signed-off-by: Paolo Bonzini +Signed-off-by: Juergen Gross +--- + arch/x86/kvm/x86.c | 26 ++++++++++++++------------ + arch/x86/kvm/xen.h | 6 ++++-- + 2 files changed, 18 insertions(+), 14 deletions(-) + +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index b81ef4f497f4..a8bb635cb76b 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -4654,19 +4654,21 @@ void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu) + { + int idx; + +- if (vcpu->preempted && !vcpu->arch.guest_state_protected) +- vcpu->arch.preempted_in_kernel = !static_call(kvm_x86_get_cpl)(vcpu); ++ if (vcpu->preempted) { ++ if (!vcpu->arch.guest_state_protected) ++ vcpu->arch.preempted_in_kernel = !static_call(kvm_x86_get_cpl)(vcpu); + +- /* +- * Take the srcu lock as memslots will be accessed to check the gfn +- * cache generation against the memslots generation. +- */ +- idx = srcu_read_lock(&vcpu->kvm->srcu); +- if (kvm_xen_msr_enabled(vcpu->kvm)) +- kvm_xen_runstate_set_preempted(vcpu); +- else +- kvm_steal_time_set_preempted(vcpu); +- srcu_read_unlock(&vcpu->kvm->srcu, idx); ++ /* ++ * Take the srcu lock as memslots will be accessed to check the gfn ++ * cache generation against the memslots generation. ++ */ ++ idx = srcu_read_lock(&vcpu->kvm->srcu); ++ if (kvm_xen_msr_enabled(vcpu->kvm)) ++ kvm_xen_runstate_set_preempted(vcpu); ++ else ++ kvm_steal_time_set_preempted(vcpu); ++ srcu_read_unlock(&vcpu->kvm->srcu, idx); ++ } + + static_call(kvm_x86_vcpu_put)(vcpu); + vcpu->arch.last_host_tsc = rdtsc(); +diff --git a/arch/x86/kvm/xen.h b/arch/x86/kvm/xen.h +index ee5c4ae0755c..532a535a9e99 100644 +--- a/arch/x86/kvm/xen.h ++++ b/arch/x86/kvm/xen.h +@@ -159,8 +159,10 @@ static inline void kvm_xen_runstate_set_preempted(struct kvm_vcpu *vcpu) + * behalf of the vCPU. Only if the VMM does actually block + * does it need to enter RUNSTATE_blocked. + */ +- if (vcpu->preempted) +- kvm_xen_update_runstate_guest(vcpu, RUNSTATE_runnable); ++ if (WARN_ON_ONCE(!vcpu->preempted)) ++ return; ++ ++ kvm_xen_update_runstate_guest(vcpu, RUNSTATE_runnable); + } + + /* 32-bit compatibility definitions, also used natively in 32-bit build */ +-- +2.35.3 + diff --git a/patches.suse/KVM-x86-mmu-avoid-NULL-pointer-dereference-on-page-f.patch b/patches.suse/KVM-x86-mmu-avoid-NULL-pointer-dereference-on-page-f.patch new file mode 100644 index 0000000..ba87c8b --- /dev/null +++ b/patches.suse/KVM-x86-mmu-avoid-NULL-pointer-dereference-on-page-f.patch @@ -0,0 +1,38 @@ +Patch-mainline: v5.18-rc1 +Git-commit: 9191b8f0745e63edf519e4a54a4aaae1d3d46fbd +References: git-fixes +From: Paolo Bonzini +Date: Tue, 8 Feb 2022 19:08:33 -0500 +Subject: [PATCH] KVM: x86/mmu: avoid NULL-pointer dereference on page freeing + bugs + +WARN and bail if KVM attempts to free a root that isn't backed by a shadow +page. KVM allocates a bare page for "special" roots, e.g. when using PAE +paging or shadowing 2/3/4-level page tables with 4/5-level, and so root_hpa +will be valid but won't be backed by a shadow page. It's all too easy to +blindly call mmu_free_root_page() on root_hpa, be nice and WARN instead of +crashing KVM and possibly the kernel. + +Reviewed-by: Sean Christopherson +Signed-off-by: Paolo Bonzini +Signed-off-by: Juergen Gross +--- + arch/x86/kvm/mmu/mmu.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c +index 0620480b99e0..28c4d658d2ac 100644 +--- a/arch/x86/kvm/mmu/mmu.c ++++ b/arch/x86/kvm/mmu/mmu.c +@@ -3206,6 +3206,8 @@ static void mmu_free_root_page(struct kvm *kvm, hpa_t *root_hpa, + return; + + sp = to_shadow_page(*root_hpa & PT64_BASE_ADDR_MASK); ++ if (WARN_ON(!sp)) ++ return; + + if (is_tdp_mmu_page(sp)) + kvm_tdp_mmu_put_root(kvm, sp, false); +-- +2.35.3 + diff --git a/patches.suse/KVM-x86-pmu-Ignore-pmu-global_ctrl-check-if-vPMU-doe.patch b/patches.suse/KVM-x86-pmu-Ignore-pmu-global_ctrl-check-if-vPMU-doe.patch new file mode 100644 index 0000000..087cb5a --- /dev/null +++ b/patches.suse/KVM-x86-pmu-Ignore-pmu-global_ctrl-check-if-vPMU-doe.patch @@ -0,0 +1,38 @@ +Patch-mainline: v6.0-rc1 +Git-commit: 98defd2e17803263f49548fea930cfc974d505aa +References: git-fixes +From: Like Xu +Date: Mon, 9 May 2022 18:22:02 +0800 +Subject: [PATCH] KVM: x86/pmu: Ignore pmu->global_ctrl check if vPMU doesn't + support global_ctrl + +MSR_CORE_PERF_GLOBAL_CTRL is introduced as part of Architecture PMU V2, +as indicated by Intel SDM 19.2.2 and the intel_is_valid_msr() function. + +So in the absence of global_ctrl support, all PMCs are enabled as AMD does. + +Signed-off-by: Like Xu +Message-Id: <20220509102204.62389-1-likexu@tencent.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Juergen Gross +--- + arch/x86/kvm/vmx/pmu_intel.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/x86/kvm/vmx/pmu_intel.c b/arch/x86/kvm/vmx/pmu_intel.c +index 1c6f2ca2beac..2fc90080dcce 100644 +--- a/arch/x86/kvm/vmx/pmu_intel.c ++++ b/arch/x86/kvm/vmx/pmu_intel.c +@@ -98,6 +98,9 @@ static bool intel_pmc_is_enabled(struct kvm_pmc *pmc) + { + struct kvm_pmu *pmu = pmc_to_pmu(pmc); + ++ if (pmu->version < 2) ++ return true; ++ + return test_bit(pmc->idx, (unsigned long *)&pmu->global_ctrl); + } + +-- +2.35.3 + diff --git a/patches.suse/KVM-x86-svm-add-__GFP_ACCOUNT-to-__sev_dbg_-en-de-cr.patch b/patches.suse/KVM-x86-svm-add-__GFP_ACCOUNT-to-__sev_dbg_-en-de-cr.patch new file mode 100644 index 0000000..9709550 --- /dev/null +++ b/patches.suse/KVM-x86-svm-add-__GFP_ACCOUNT-to-__sev_dbg_-en-de-cr.patch @@ -0,0 +1,46 @@ +Patch-mainline: v5.19-rc4 +Git-commit: ebdec859faa8cfbfef9f6c1f83d79dd6c8f4ab8c +References: git-fixes +From: Mingwei Zhang +Date: Thu, 23 Jun 2022 17:18:58 +0000 +Subject: [PATCH] KVM: x86/svm: add __GFP_ACCOUNT to + __sev_dbg_{en,de}crypt_user() + +Adding the accounting flag when allocating pages within the SEV function, +since these memory pages should belong to individual VM. + +No functional change intended. + +Signed-off-by: Mingwei Zhang +Message-Id: <20220623171858.2083637-1-mizhang@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Juergen Gross +--- + arch/x86/kvm/svm/sev.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c +index 51fd985cf21d..e2c7fada0b3d 100644 +--- a/arch/x86/kvm/svm/sev.c ++++ b/arch/x86/kvm/svm/sev.c +@@ -844,7 +844,7 @@ static int __sev_dbg_encrypt_user(struct kvm *kvm, unsigned long paddr, + + /* If source buffer is not aligned then use an intermediate buffer */ + if (!IS_ALIGNED((unsigned long)vaddr, 16)) { +- src_tpage = alloc_page(GFP_KERNEL); ++ src_tpage = alloc_page(GFP_KERNEL_ACCOUNT); + if (!src_tpage) + return -ENOMEM; + +@@ -865,7 +865,7 @@ static int __sev_dbg_encrypt_user(struct kvm *kvm, unsigned long paddr, + if (!IS_ALIGNED((unsigned long)dst_vaddr, 16) || !IS_ALIGNED(size, 16)) { + int dst_offset; + +- dst_tpage = alloc_page(GFP_KERNEL); ++ dst_tpage = alloc_page(GFP_KERNEL_ACCOUNT); + if (!dst_tpage) { + ret = -ENOMEM; + goto e_free; +-- +2.35.3 + diff --git a/patches.suse/KVM-x86-vmx-Do-not-skip-segment-attributes-if-unusab.patch b/patches.suse/KVM-x86-vmx-Do-not-skip-segment-attributes-if-unusab.patch new file mode 100644 index 0000000..7b8f2a3 --- /dev/null +++ b/patches.suse/KVM-x86-vmx-Do-not-skip-segment-attributes-if-unusab.patch @@ -0,0 +1,90 @@ +Patch-mainline: v6.2-rc6 +Git-commit: a44b331614e6f7e63902ed7dff7adc8c85edd8bc +References: git-fixes +From: Hendrik Borghorst +Date: Mon, 14 Nov 2022 16:48:23 +0000 +Subject: [PATCH] KVM: x86/vmx: Do not skip segment attributes if unusable bit + is set + +When serializing and deserializing kvm_sregs, attributes of the segment +descriptors are stored by user space. For unusable segments, +vmx_segment_access_rights skips all attributes and sets them to 0. + +This means we zero out the DPL (Descriptor Privilege Level) for unusable +entries. + +Unusable segments are - contrary to their name - usable in 64bit mode and +are used by guests to for example create a linear map through the +NULL selector. + +VMENTER checks if SS.DPL is correct depending on the CS segment type. +For types 9 (Execute Only) and 11 (Execute Read), CS.DPL must be equal to +SS.DPL [1]. + +We have seen real world guests setting CS to a usable segment with DPL=3 +and SS to an unusable segment with DPL=3. Once we go through an sregs +get/set cycle, SS.DPL turns to 0. This causes the virtual machine to crash +reproducibly. + +This commit changes the attribute logic to always preserve attributes for +unusable segments. According to [2] SS.DPL is always saved on VM exits, +regardless of the unusable bit so user space applications should have saved +the information on serialization correctly. + +[3] specifies that besides SS.DPL the rest of the attributes of the +descriptors are undefined after VM entry if unusable bit is set. So, there +should be no harm in setting them all to the previous state. + +[1] Intel SDM Vol 3C 26.3.1.2 Checks on Guest Segment Registers +[2] Intel SDM Vol 3C 27.3.2 Saving Segment Registers and Descriptor-Table +Registers +[3] Intel SDM Vol 3C 26.3.2.2 Loading Guest Segment Registers and +Descriptor-Table Registers + +Cc: Alexander Graf +Cc: stable@vger.kernel.org +Signed-off-by: Hendrik Borghorst +Reviewed-by: Jim Mattson +Reviewed-by: Alexander Graf +Message-Id: <20221114164823.69555-1-hborghor@amazon.de> +Signed-off-by: Paolo Bonzini +Signed-off-by: Juergen Gross +--- + arch/x86/kvm/vmx/vmx.c | 21 +++++++++------------ + 1 file changed, 9 insertions(+), 12 deletions(-) + +diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c +index fc9008dbed33..7eec0226d56a 100644 +--- a/arch/x86/kvm/vmx/vmx.c ++++ b/arch/x86/kvm/vmx/vmx.c +@@ -3440,18 +3440,15 @@ static u32 vmx_segment_access_rights(struct kvm_segment *var) + { + u32 ar; + +- if (var->unusable || !var->present) +- ar = 1 << 16; +- else { +- ar = var->type & 15; +- ar |= (var->s & 1) << 4; +- ar |= (var->dpl & 3) << 5; +- ar |= (var->present & 1) << 7; +- ar |= (var->avl & 1) << 12; +- ar |= (var->l & 1) << 13; +- ar |= (var->db & 1) << 14; +- ar |= (var->g & 1) << 15; +- } ++ ar = var->type & 15; ++ ar |= (var->s & 1) << 4; ++ ar |= (var->dpl & 3) << 5; ++ ar |= (var->present & 1) << 7; ++ ar |= (var->avl & 1) << 12; ++ ar |= (var->l & 1) << 13; ++ ar |= (var->db & 1) << 14; ++ ar |= (var->g & 1) << 15; ++ ar |= (var->unusable || !var->present) << 16; + + return ar; + } +-- +2.35.3 + diff --git a/patches.suse/PCI-ASPM-Remove-pcie_aspm_pm_state_change.patch b/patches.suse/PCI-ASPM-Remove-pcie_aspm_pm_state_change.patch new file mode 100644 index 0000000..13df837 --- /dev/null +++ b/patches.suse/PCI-ASPM-Remove-pcie_aspm_pm_state_change.patch @@ -0,0 +1,90 @@ +From: Kai-Heng Feng +Date: Mon, 11 Jul 2022 18:07:01 -0500 +Subject: PCI/ASPM: Remove pcie_aspm_pm_state_change() +Git-commit: 08d0cc5f34265d1a1e3031f319f594bd1970976c +Patch-mainline: 6.0-rc1 +References: git-fixes + +pcie_aspm_pm_state_change() was introduced at the inception of PCIe ASPM +code, but it can cause some issues. For instance, when ASPM config is +changed via sysfs, those changes won't persist across power state change +because pcie_aspm_pm_state_change() overwrites them. + +Also, if the driver restores L1SS [1] after system resume, the restored +state will also be overwritten by pcie_aspm_pm_state_change(). + +Remove pcie_aspm_pm_state_change(). If there's any hardware that really +needs it to function, a quirk can be used instead. + +[js] no pcie_aspm_pm_state_change() in pci_set_low_power_state(), see below. + +[1] https://lore.kernel.org/linux-pci/20220201123536.12962-1-vidyas@nvidia.com/ +Link: https://lore.kernel.org/r/20220509073639.2048236-1-kai.heng.feng@canonical.com +[bhelgaas: remove additional pcie_aspm_pm_state_change() call in +pci_set_low_power_state(), added by +10aa5377fc8a ("PCI/PM: Split pci_raw_set_power_state()") and moved by +7957d201456f ("PCI/PM: Relocate pci_set_low_power_state()")] +Signed-off-by: Kai-Heng Feng +Signed-off-by: Bjorn Helgaas +Signed-off-by: Jiri Slaby +--- + drivers/pci/pci.c | 3 --- + drivers/pci/pci.h | 2 -- + drivers/pci/pcie/aspm.c | 19 ------------------- + 3 files changed, 24 deletions(-) + +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -1160,9 +1160,6 @@ static int pci_raw_set_power_state(struc + if (need_restore) + pci_restore_bars(dev); + +- if (dev->bus->self) +- pcie_aspm_pm_state_change(dev->bus->self); +- + return 0; + } + +--- a/drivers/pci/pci.h ++++ b/drivers/pci/pci.h +@@ -598,12 +598,10 @@ bool pcie_wait_for_link(struct pci_dev * + #ifdef CONFIG_PCIEASPM + void pcie_aspm_init_link_state(struct pci_dev *pdev); + void pcie_aspm_exit_link_state(struct pci_dev *pdev); +-void pcie_aspm_pm_state_change(struct pci_dev *pdev); + void pcie_aspm_powersave_config_link(struct pci_dev *pdev); + #else + static inline void pcie_aspm_init_link_state(struct pci_dev *pdev) { } + static inline void pcie_aspm_exit_link_state(struct pci_dev *pdev) { } +-static inline void pcie_aspm_pm_state_change(struct pci_dev *pdev) { } + static inline void pcie_aspm_powersave_config_link(struct pci_dev *pdev) { } + #endif + +--- a/drivers/pci/pcie/aspm.c ++++ b/drivers/pci/pcie/aspm.c +@@ -1020,25 +1020,6 @@ out: + up_read(&pci_bus_sem); + } + +-/* @pdev: the root port or switch downstream port */ +-void pcie_aspm_pm_state_change(struct pci_dev *pdev) +-{ +- struct pcie_link_state *link = pdev->link_state; +- +- if (aspm_disabled || !link) +- return; +- /* +- * Devices changed PM state, we should recheck if latency +- * meets all functions' requirement +- */ +- down_read(&pci_bus_sem); +- mutex_lock(&aspm_lock); +- pcie_update_aspm_capable(link->root); +- pcie_config_aspm_path(link); +- mutex_unlock(&aspm_lock); +- up_read(&pci_bus_sem); +-} +- + void pcie_aspm_powersave_config_link(struct pci_dev *pdev) + { + struct pcie_link_state *link = pdev->link_state; diff --git a/patches.suse/RDMA-cm-Trace-icm_send_rej-event-before-the-cm-state.patch b/patches.suse/RDMA-cm-Trace-icm_send_rej-event-before-the-cm-state.patch new file mode 100644 index 0000000..89d4369 --- /dev/null +++ b/patches.suse/RDMA-cm-Trace-icm_send_rej-event-before-the-cm-state.patch @@ -0,0 +1,49 @@ +From bd9de1badac7e4ff6780365d4aa38983f5e2a436 Mon Sep 17 00:00:00 2001 +From: Mark Zhang +Date: Thu, 30 Mar 2023 10:23:51 +0300 +Subject: [PATCH 1/1] RDMA/cm: Trace icm_send_rej event before the cm state is + reset +Git-commit: bd9de1badac7e4ff6780365d4aa38983f5e2a436 +Patch-mainline: v6.4-rc1 +References: git-fixes + +Trace icm_send_rej event before the cm state is reset to idle, so that +correct cm state will be logged. For example when an incoming request is +rejected, the old trace log was: + icm_send_rej: local_id=961102742 remote_id=3829151631 state=IDLE reason=REJ_CONSUMER_DEFINED +With this patch: + icm_send_rej: local_id=312971016 remote_id=3778819983 state=MRA_REQ_SENT reason=REJ_CONSUMER_DEFINED + +Fixes: 8dc105befe16 ("RDMA/cm: Add tracepoints to track MAD send operations") +Signed-off-by: Mark Zhang +Link: https://lore.kernel.org/r/20230330072351.481200-1-markzhang@nvidia.com +Signed-off-by: Leon Romanovsky +Acked-by: Nicolas Morey +--- + drivers/infiniband/core/cm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index 603c0aecc361..ff58058aeadc 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -2912,6 +2912,8 @@ static int cm_send_rej_locked(struct cm_id_private *cm_id_priv, + (ari && ari_length > IB_CM_REJ_ARI_LENGTH)) + return -EINVAL; + ++ trace_icm_send_rej(&cm_id_priv->id, reason); ++ + switch (state) { + case IB_CM_REQ_SENT: + case IB_CM_MRA_REQ_RCVD: +@@ -2942,7 +2944,6 @@ static int cm_send_rej_locked(struct cm_id_private *cm_id_priv, + return -EINVAL; + } + +- trace_icm_send_rej(&cm_id_priv->id, reason); + ret = ib_post_send_mad(msg, NULL); + if (ret) { + cm_free_msg(msg); +-- +2.39.1.1.gbe015eda0162 + diff --git a/patches.suse/RDMA-mlx5-Fix-flow-counter-query-via-DEVX.patch b/patches.suse/RDMA-mlx5-Fix-flow-counter-query-via-DEVX.patch new file mode 100644 index 0000000..f1833fc --- /dev/null +++ b/patches.suse/RDMA-mlx5-Fix-flow-counter-query-via-DEVX.patch @@ -0,0 +1,92 @@ +From 3e358ea8614ddfbc59ca7a3f5dff5dde2b350b2c Mon Sep 17 00:00:00 2001 +From: Mark Bloch +Date: Thu, 13 Apr 2023 12:23:09 +0300 +Subject: [PATCH 1/1] RDMA/mlx5: Fix flow counter query via DEVX +Git-commit: 3e358ea8614ddfbc59ca7a3f5dff5dde2b350b2c +Patch-mainline: v6.4-rc1 +References: git-fixes + +Commit cited in "fixes" tag added bulk support for flow counters but it +didn't account that's also possible to query a counter using a non-base id +if the counter was allocated as bulk. + +When a user performs a query, validate the flow counter id given in the +mailbox is inside the valid range taking bulk value into account. + +Fixes: 208d70f562e5 ("IB/mlx5: Support flow counters offset for bulk counters") +Signed-off-by: Mark Bloch +Reviewed-by: Maor Gottlieb +Link: https://lore.kernel.org/r/79d7fbe291690128e44672418934256254d93115.1681377114.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Acked-by: Nicolas Morey +--- + drivers/infiniband/hw/mlx5/devx.c | 31 ++++++++++++++++++++++++++----- + include/linux/mlx5/mlx5_ifc.h | 3 ++- + 2 files changed, 28 insertions(+), 6 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c +index 07037b829c7e..db5fb196c728 100644 +--- a/drivers/infiniband/hw/mlx5/devx.c ++++ b/drivers/infiniband/hw/mlx5/devx.c +@@ -666,7 +666,21 @@ static bool devx_is_valid_obj_id(struct uverbs_attr_bundle *attrs, + obj_id; + + case MLX5_IB_OBJECT_DEVX_OBJ: +- return ((struct devx_obj *)uobj->object)->obj_id == obj_id; ++ { ++ u16 opcode = MLX5_GET(general_obj_in_cmd_hdr, in, opcode); ++ struct devx_obj *devx_uobj = uobj->object; ++ ++ if (opcode == MLX5_CMD_OP_QUERY_FLOW_COUNTER && ++ devx_uobj->flow_counter_bulk_size) { ++ u64 end; ++ ++ end = devx_uobj->obj_id + ++ devx_uobj->flow_counter_bulk_size; ++ return devx_uobj->obj_id <= obj_id && end > obj_id; ++ } ++ ++ return devx_uobj->obj_id == obj_id; ++ } + + default: + return false; +@@ -1517,10 +1531,17 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)( + goto obj_free; + + if (opcode == MLX5_CMD_OP_ALLOC_FLOW_COUNTER) { +- u8 bulk = MLX5_GET(alloc_flow_counter_in, +- cmd_in, +- flow_counter_bulk); +- obj->flow_counter_bulk_size = 128UL * bulk; ++ u32 bulk = MLX5_GET(alloc_flow_counter_in, ++ cmd_in, ++ flow_counter_bulk_log_size); ++ ++ if (bulk) ++ bulk = 1 << bulk; ++ else ++ bulk = 128UL * MLX5_GET(alloc_flow_counter_in, ++ cmd_in, ++ flow_counter_bulk); ++ obj->flow_counter_bulk_size = bulk; + } + + uobj->object = obj; +diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h +index b54339a1b1c6..3976e6266bcc 100644 +--- a/include/linux/mlx5/mlx5_ifc.h ++++ b/include/linux/mlx5/mlx5_ifc.h +@@ -9283,7 +9283,8 @@ struct mlx5_ifc_alloc_flow_counter_in_bits { + u8 reserved_at_20[0x10]; + u8 op_mod[0x10]; + +- u8 reserved_at_40[0x38]; ++ u8 reserved_at_40[0x33]; ++ u8 flow_counter_bulk_log_size[0x5]; + u8 flow_counter_bulk[0x8]; + }; + +-- +2.39.1.1.gbe015eda0162 + diff --git a/patches.suse/RDMA-mlx5-Use-correct-device-num_ports-when-modify-D.patch b/patches.suse/RDMA-mlx5-Use-correct-device-num_ports-when-modify-D.patch new file mode 100644 index 0000000..dea6025 --- /dev/null +++ b/patches.suse/RDMA-mlx5-Use-correct-device-num_ports-when-modify-D.patch @@ -0,0 +1,38 @@ +From 746aa3c8cb1a650ff2583497ac646e505831b9b9 Mon Sep 17 00:00:00 2001 +From: Mark Zhang +Date: Thu, 20 Apr 2023 04:39:06 +0300 +Subject: [PATCH 1/1] RDMA/mlx5: Use correct device num_ports when modify DC +Git-commit: 746aa3c8cb1a650ff2583497ac646e505831b9b9 +Patch-mainline: v6.4-rc1 +References: git-fixes + +Just like other QP types, when modify DC, the port_num should be compared +with dev->num_ports, instead of HCA_CAP.num_ports. Otherwise Multi-port +vHCA on DC may not work. + +Fixes: 776a3906b692 ("IB/mlx5: Add support for DC target QP") +Link: https://lore.kernel.org/r/20230420013906.1244185-1-markzhang@nvidia.com +Signed-off-by: Mark Zhang +Reviewed-by: Maor Gottlieb +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey +--- + drivers/infiniband/hw/mlx5/qp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c +index 1093d3a0ed43..70ca8ffa9256 100644 +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -4493,7 +4493,7 @@ static int mlx5_ib_modify_dct(struct ib_qp *ibqp, struct ib_qp_attr *attr, + return -EINVAL; + + if (attr->port_num == 0 || +- attr->port_num > MLX5_CAP_GEN(dev->mdev, num_ports)) { ++ attr->port_num > dev->num_ports) { + mlx5_ib_dbg(dev, "invalid port number %d. number of ports is %d\n", + attr->port_num, dev->num_ports); + return -EINVAL; +-- +2.39.1.1.gbe015eda0162 + diff --git a/patches.suse/RDMA-rdmavt-Delete-unnecessary-NULL-check.patch b/patches.suse/RDMA-rdmavt-Delete-unnecessary-NULL-check.patch new file mode 100644 index 0000000..084c601 --- /dev/null +++ b/patches.suse/RDMA-rdmavt-Delete-unnecessary-NULL-check.patch @@ -0,0 +1,40 @@ +From b73a0b80c69de77d8d4942abb37066531c0169b2 Mon Sep 17 00:00:00 2001 +From: Natalia Petrova +Date: Fri, 3 Mar 2023 15:44:08 +0300 +Subject: [PATCH 1/1] RDMA/rdmavt: Delete unnecessary NULL check +Git-commit: b73a0b80c69de77d8d4942abb37066531c0169b2 +Patch-mainline: v6.4-rc1 +References: git-fixes + +There is no need to check 'rdi->qp_dev' for NULL. The field 'qp_dev' +is created in rvt_register_device() which will fail if the 'qp_dev' +allocation fails in rvt_driver_qp_init(). Overwise this pointer +doesn't changed and passed to rvt_qp_exit() by the next step. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 0acb0cc7ecc1 ("IB/rdmavt: Initialize and teardown of qpn table") +Signed-off-by: Natalia Petrova +Link: https://lore.kernel.org/r/20230303124408.16685-1-n.petrova@fintech.ru +Signed-off-by: Leon Romanovsky +Acked-by: Nicolas Morey +--- + drivers/infiniband/sw/rdmavt/qp.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c +index 3f707e1fa517..2d143a9d2027 100644 +--- a/drivers/infiniband/sw/rdmavt/qp.c ++++ b/drivers/infiniband/sw/rdmavt/qp.c +@@ -464,8 +464,6 @@ void rvt_qp_exit(struct rvt_dev_info *rdi) + if (qps_inuse) + rvt_pr_err(rdi, "QP memory leak! %u still in use\n", + qps_inuse); +- if (!rdi->qp_dev) +- return; + + kfree(rdi->qp_dev->qp_table); + free_qpn_table(&rdi->qp_dev->qpn_table); +-- +2.39.1.1.gbe015eda0162 + diff --git a/patches.suse/RDMA-rxe-Remove-tasklet-call-from-rxe_cq.c.patch b/patches.suse/RDMA-rxe-Remove-tasklet-call-from-rxe_cq.c.patch new file mode 100644 index 0000000..a008495 --- /dev/null +++ b/patches.suse/RDMA-rxe-Remove-tasklet-call-from-rxe_cq.c.patch @@ -0,0 +1,120 @@ +From 78b26a335310a097d6b22581b706050db42f196c Mon Sep 17 00:00:00 2001 +From: Bob Pearson +Date: Mon, 27 Mar 2023 16:56:44 -0500 +Subject: [PATCH 1/1] RDMA/rxe: Remove tasklet call from rxe_cq.c +Git-commit: 78b26a335310a097d6b22581b706050db42f196c +Patch-mainline: v6.4-rc1 +References: git-fixes + +Remove the tasklet call in rxe_cq.c and also the is_dying in the +cq struct. There is no reason for the rxe driver to defer the call +to the cq completion handler by scheduling a tasklet. rxe_cq_post() +is not called in a hard irq context. + +The rxe driver currently is incorrect because the tasklet call is +made without protecting the cq pointer with a reference from having +the underlying memory freed before the deferred routine is called. +Executing the comp_handler inline fixes this problem. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Signed-off-by: Bob Pearson +Link: https://lore.kernel.org/r/20230327215643.10410-1-rpearsonhpe@gmail.com +Acked-by: Zhu Yanjun +Signed-off-by: Leon Romanovsky +Acked-by: Nicolas Morey +--- + drivers/infiniband/sw/rxe/rxe_cq.c | 32 +++----------------------------- + drivers/infiniband/sw/rxe/rxe_verbs.c | 2 -- + drivers/infiniband/sw/rxe/rxe_verbs.h | 2 -- + 3 files changed, 3 insertions(+), 33 deletions(-) + +--- a/drivers/infiniband/sw/rxe/rxe_cq.c ++++ b/drivers/infiniband/sw/rxe/rxe_cq.c +@@ -39,21 +39,6 @@ err1: + return -EINVAL; + } + +-static void rxe_send_complete(struct tasklet_struct *t) +-{ +- struct rxe_cq *cq = from_tasklet(cq, t, comp_task); +- unsigned long flags; +- +- spin_lock_irqsave(&cq->cq_lock, flags); +- if (cq->is_dying) { +- spin_unlock_irqrestore(&cq->cq_lock, flags); +- return; +- } +- spin_unlock_irqrestore(&cq->cq_lock, flags); +- +- cq->ibcq.comp_handler(&cq->ibcq, cq->ibcq.cq_context); +-} +- + int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe, + int comp_vector, struct ib_udata *udata, + struct rxe_create_cq_resp __user *uresp) +@@ -79,10 +64,6 @@ int rxe_cq_from_init(struct rxe_dev *rxe + + cq->is_user = uresp; + +- cq->is_dying = false; +- +- tasklet_setup(&cq->comp_task, rxe_send_complete); +- + spin_lock_init(&cq->cq_lock); + cq->ibcq.cqe = cqe; + return 0; +@@ -103,6 +84,7 @@ int rxe_cq_resize_queue(struct rxe_cq *c + return err; + } + ++/* caller holds reference to cq */ + int rxe_cq_post(struct rxe_cq *cq, struct rxe_cqe *cqe, int solicited) + { + struct ib_event ev; +@@ -135,21 +117,13 @@ int rxe_cq_post(struct rxe_cq *cq, struc + if ((cq->notify == IB_CQ_NEXT_COMP) || + (cq->notify == IB_CQ_SOLICITED && solicited)) { + cq->notify = 0; +- tasklet_schedule(&cq->comp_task); ++ ++ cq->ibcq.comp_handler(&cq->ibcq, cq->ibcq.cq_context); + } + + return 0; + } + +-void rxe_cq_disable(struct rxe_cq *cq) +-{ +- unsigned long flags; +- +- spin_lock_irqsave(&cq->cq_lock, flags); +- cq->is_dying = true; +- spin_unlock_irqrestore(&cq->cq_lock, flags); +-} +- + void rxe_cq_cleanup(struct rxe_pool_elem *elem) + { + struct rxe_cq *cq = container_of(elem, typeof(*cq), elem); +--- a/drivers/infiniband/sw/rxe/rxe_verbs.c ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c +@@ -805,8 +805,6 @@ static int rxe_destroy_cq(struct ib_cq * + if (atomic_read(&cq->num_wq)) + return -EINVAL; + +- rxe_cq_disable(cq); +- + rxe_cleanup(cq); + return 0; + } +--- a/drivers/infiniband/sw/rxe/rxe_verbs.h ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h +@@ -63,9 +63,7 @@ struct rxe_cq { + struct rxe_queue *queue; + spinlock_t cq_lock; + u8 notify; +- bool is_dying; + bool is_user; +- struct tasklet_struct comp_task; + atomic_t num_wq; + }; + diff --git a/patches.suse/RDMA-siw-Fix-potential-page_array-out-of-range-acces.patch b/patches.suse/RDMA-siw-Fix-potential-page_array-out-of-range-acces.patch new file mode 100644 index 0000000..4154a05 --- /dev/null +++ b/patches.suse/RDMA-siw-Fix-potential-page_array-out-of-range-acces.patch @@ -0,0 +1,38 @@ +From 271bfcfb83a9f77cbae3d6e1a16e3c14132922f0 Mon Sep 17 00:00:00 2001 +From: Daniil Dulov +Date: Mon, 27 Feb 2023 01:17:51 -0800 +Subject: [PATCH 1/1] RDMA/siw: Fix potential page_array out of range access +Git-commit: 271bfcfb83a9f77cbae3d6e1a16e3c14132922f0 +Patch-mainline: v6.4-rc1 +References: git-fixes + +When seg is equal to MAX_ARRAY, the loop should break, otherwise +it will result in out of range access. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: b9be6f18cf9e ("rdma/siw: transmit path") +Signed-off-by: Daniil Dulov +Link: https://lore.kernel.org/r/20230227091751.589612-1-d.dulov@aladdin.ru +Signed-off-by: Leon Romanovsky +Acked-by: Nicolas Morey +--- + drivers/infiniband/sw/siw/siw_qp_tx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/sw/siw/siw_qp_tx.c b/drivers/infiniband/sw/siw/siw_qp_tx.c +index 05052b49107f..6bb9e9e81ff4 100644 +--- a/drivers/infiniband/sw/siw/siw_qp_tx.c ++++ b/drivers/infiniband/sw/siw/siw_qp_tx.c +@@ -558,7 +558,7 @@ static int siw_tx_hdt(struct siw_iwarp_tx *c_tx, struct socket *s) + data_len -= plen; + fp_off = 0; + +- if (++seg > (int)MAX_ARRAY) { ++ if (++seg >= (int)MAX_ARRAY) { + siw_dbg_qp(tx_qp(c_tx), "to many fragments\n"); + siw_unmap_pages(iov, kmap_mask, seg-1); + wqe->processed -= c_tx->bytes_unsent; +-- +2.39.1.1.gbe015eda0162 + diff --git a/patches.suse/RDMA-siw-Remove-namespace-check-from-siw_netdev_even.patch b/patches.suse/RDMA-siw-Remove-namespace-check-from-siw_netdev_even.patch new file mode 100644 index 0000000..ffbbcc2 --- /dev/null +++ b/patches.suse/RDMA-siw-Remove-namespace-check-from-siw_netdev_even.patch @@ -0,0 +1,43 @@ +From 266e9b3475ba82212062771fdbc40be0e3c06ec8 Mon Sep 17 00:00:00 2001 +From: Tetsuo Handa +Date: Sun, 2 Apr 2023 14:10:13 +0900 +Subject: [PATCH 1/1] RDMA/siw: Remove namespace check from siw_netdev_event() +Git-commit: 266e9b3475ba82212062771fdbc40be0e3c06ec8 +Patch-mainline: v6.4-rc1 +References: git-fixes + +syzbot is reporting that siw_netdev_event(NETDEV_UNREGISTER) cannot destroy +siw_device created after unshare(CLONE_NEWNET) due to net namespace check. +It seems that this check was by error there and should be removed. + +Reported-by: syzbot +Link: https://syzkaller.appspot.com/bug?extid=5e70d01ee8985ae62a3b +Suggested-by: Jason Gunthorpe +Suggested-by: Leon Romanovsky +Fixes: bdcf26bf9b3a ("rdma/siw: network and RDMA core interface") +Signed-off-by: Tetsuo Handa +Link: https://lore.kernel.org/r/a44e9ac5-44e2-d575-9e30-02483cc7ffd1@I-love.SAKURA.ne.jp +Reviewed-by: Bernard Metzler +Signed-off-by: Leon Romanovsky +Acked-by: Nicolas Morey +--- + drivers/infiniband/sw/siw/siw_main.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/infiniband/sw/siw/siw_main.c b/drivers/infiniband/sw/siw/siw_main.c +index dacc174604bf..65b5cda5457b 100644 +--- a/drivers/infiniband/sw/siw/siw_main.c ++++ b/drivers/infiniband/sw/siw/siw_main.c +@@ -437,9 +437,6 @@ static int siw_netdev_event(struct notifier_block *nb, unsigned long event, + + dev_dbg(&netdev->dev, "siw: event %lu\n", event); + +- if (dev_net(netdev) != &init_net) +- return NOTIFY_OK; +- + base_dev = ib_device_get_by_netdev(netdev, RDMA_DRIVER_SIW); + if (!base_dev) + return NOTIFY_OK; +-- +2.39.1.1.gbe015eda0162 + diff --git a/patches.suse/RDMA-srpt-Add-a-check-for-valid-mad_agent-pointer.patch b/patches.suse/RDMA-srpt-Add-a-check-for-valid-mad_agent-pointer.patch new file mode 100644 index 0000000..a4553a4 --- /dev/null +++ b/patches.suse/RDMA-srpt-Add-a-check-for-valid-mad_agent-pointer.patch @@ -0,0 +1,111 @@ +From eca5cd9474cd26d62f9756f536e2e656d3f62f3a Mon Sep 17 00:00:00 2001 +From: Saravanan Vajravel +Date: Wed, 5 Apr 2023 21:25:49 -0700 +Subject: [PATCH 1/1] RDMA/srpt: Add a check for valid 'mad_agent' pointer +Git-commit: eca5cd9474cd26d62f9756f536e2e656d3f62f3a +Patch-mainline: v6.4-rc1 +References: git-fixes + +When unregistering MAD agent, srpt module has a non-null check +for 'mad_agent' pointer before invoking ib_unregister_mad_agent(). +This check can pass if 'mad_agent' variable holds an error value. +The 'mad_agent' can have an error value for a short window when +srpt_add_one() and srpt_remove_one() is executed simultaneously. + +In srpt module, added a valid pointer check for 'sport->mad_agent' +before unregistering MAD agent. + +This issue can hit when RoCE driver unregisters ib_device + +Stack Trace: +------------ +BUG: kernel NULL pointer dereference, address: 000000000000004d +PGD 145003067 P4D 145003067 PUD 2324fe067 PMD 0 +Oops: 0002 [#1] PREEMPT SMP NOPTI +CPU: 10 PID: 4459 Comm: kworker/u80:0 Kdump: loaded Tainted: P +Hardware name: Dell Inc. PowerEdge R640/06NR82, BIOS 2.5.4 01/13/2020 +Workqueue: bnxt_re bnxt_re_task [bnxt_re] +RIP: 0010:_raw_spin_lock_irqsave+0x19/0x40 +Call Trace: + ib_unregister_mad_agent+0x46/0x2f0 [ib_core] + IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready + ? __schedule+0x20b/0x560 + srpt_unregister_mad_agent+0x93/0xd0 [ib_srpt] + srpt_remove_one+0x20/0x150 [ib_srpt] + remove_client_context+0x88/0xd0 [ib_core] + bond0: (slave p2p1): link status definitely up, 100000 Mbps full duplex + disable_device+0x8a/0x160 [ib_core] + bond0: active interface up! + ? kernfs_name_hash+0x12/0x80 + (NULL device *): Bonding Info Received: rdev: 000000006c0b8247 + __ib_unregister_device+0x42/0xb0 [ib_core] + (NULL device *): Master: mode: 4 num_slaves:2 + ib_unregister_device+0x22/0x30 [ib_core] + (NULL device *): Slave: id: 105069936 name:p2p1 link:0 state:0 + bnxt_re_stopqps_and_ib_uninit+0x83/0x90 [bnxt_re] + bnxt_re_alloc_lag+0x12e/0x4e0 [bnxt_re] + +Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1") +Reviewed-by: Selvin Xavier +Reviewed-by: Kashyap Desai +Signed-off-by: Saravanan Vajravel +Link: https://lore.kernel.org/r/20230406042549.507328-1-saravanan.vajravel@broadcom.com +Reviewed-by: Bart Van Assche +Signed-off-by: Leon Romanovsky +Acked-by: Nicolas Morey +--- + drivers/infiniband/ulp/srpt/ib_srpt.c | 23 +++++++++++++---------- + 1 file changed, 13 insertions(+), 10 deletions(-) + +diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c +index 3c3fae738c3e..25e799dba999 100644 +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -549,6 +549,7 @@ static int srpt_format_guid(char *buf, unsigned int size, const __be64 *guid) + */ + static int srpt_refresh_port(struct srpt_port *sport) + { ++ struct ib_mad_agent *mad_agent; + struct ib_mad_reg_req reg_req; + struct ib_port_modify port_modify; + struct ib_port_attr port_attr; +@@ -593,24 +594,26 @@ static int srpt_refresh_port(struct srpt_port *sport) + set_bit(IB_MGMT_METHOD_GET, reg_req.method_mask); + set_bit(IB_MGMT_METHOD_SET, reg_req.method_mask); + +- sport->mad_agent = ib_register_mad_agent(sport->sdev->device, +- sport->port, +- IB_QPT_GSI, +- ®_req, 0, +- srpt_mad_send_handler, +- srpt_mad_recv_handler, +- sport, 0); +- if (IS_ERR(sport->mad_agent)) { ++ mad_agent = ib_register_mad_agent(sport->sdev->device, ++ sport->port, ++ IB_QPT_GSI, ++ ®_req, 0, ++ srpt_mad_send_handler, ++ srpt_mad_recv_handler, ++ sport, 0); ++ if (IS_ERR(mad_agent)) { + pr_err("%s-%d: MAD agent registration failed (%ld). Note: this is expected if SR-IOV is enabled.\n", + dev_name(&sport->sdev->device->dev), sport->port, +- PTR_ERR(sport->mad_agent)); ++ PTR_ERR(mad_agent)); + sport->mad_agent = NULL; + memset(&port_modify, 0, sizeof(port_modify)); + port_modify.clr_port_cap_mask = IB_PORT_DEVICE_MGMT_SUP; + ib_modify_port(sport->sdev->device, sport->port, 0, + &port_modify); +- ++ return 0; + } ++ ++ sport->mad_agent = mad_agent; + } + + return 0; +-- +2.39.1.1.gbe015eda0162 + diff --git a/patches.suse/USB-UHCI-adjust-zhaoxin-UHCI-controllers-OverCurrent.patch b/patches.suse/USB-UHCI-adjust-zhaoxin-UHCI-controllers-OverCurrent.patch new file mode 100644 index 0000000..72ee7f9 --- /dev/null +++ b/patches.suse/USB-UHCI-adjust-zhaoxin-UHCI-controllers-OverCurrent.patch @@ -0,0 +1,50 @@ +From dddb342b5b9e482bb213aecc08cbdb201ea4f8da Mon Sep 17 00:00:00 2001 +From: Weitao Wang +Date: Sun, 23 Apr 2023 18:59:52 +0800 +Subject: [PATCH] USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value +Git-commit: dddb342b5b9e482bb213aecc08cbdb201ea4f8da +Patch-mainline: v6.4-rc3 +References: git-fixes + +OverCurrent condition is not standardized in the UHCI spec. +Zhaoxin UHCI controllers report OverCurrent bit active off. +In order to handle OverCurrent condition correctly, the uhci-hcd +driver needs to be told to expect the active-off behavior. + +Suggested-by: Alan Stern +Cc: stable@vger.kernel.org +Signed-off-by: Weitao Wang +Acked-by: Alan Stern +Link: https://lore.kernel.org/r/20230423105952.4526-1-WeitaoWang-oc@zhaoxin.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/host/uhci-pci.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/usb/host/uhci-pci.c b/drivers/usb/host/uhci-pci.c +index 3592f757fe05..7bd2fddde770 100644 +--- a/drivers/usb/host/uhci-pci.c ++++ b/drivers/usb/host/uhci-pci.c +@@ -119,11 +119,13 @@ static int uhci_pci_init(struct usb_hcd *hcd) + + uhci->rh_numports = uhci_count_ports(hcd); + +- /* Intel controllers report the OverCurrent bit active on. +- * VIA controllers report it active off, so we'll adjust the +- * bit value. (It's not standardized in the UHCI spec.) ++ /* ++ * Intel controllers report the OverCurrent bit active on. VIA ++ * and ZHAOXIN controllers report it active off, so we'll adjust ++ * the bit value. (It's not standardized in the UHCI spec.) + */ +- if (to_pci_dev(uhci_dev(uhci))->vendor == PCI_VENDOR_ID_VIA) ++ if (to_pci_dev(uhci_dev(uhci))->vendor == PCI_VENDOR_ID_VIA || ++ to_pci_dev(uhci_dev(uhci))->vendor == PCI_VENDOR_ID_ZHAOXIN) + uhci->oc_low = 1; + + /* HP's server management chip requires a longer port reset delay. */ +-- +2.35.3 + diff --git a/patches.suse/USB-core-Add-routines-for-endpoint-checks-in-old-dri.patch b/patches.suse/USB-core-Add-routines-for-endpoint-checks-in-old-dri.patch new file mode 100644 index 0000000..c90bb11 --- /dev/null +++ b/patches.suse/USB-core-Add-routines-for-endpoint-checks-in-old-dri.patch @@ -0,0 +1,158 @@ +From 13890626501ffda22b18213ddaf7930473da5792 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Mon, 10 Apr 2023 15:37:07 -0400 +Subject: [PATCH] USB: core: Add routines for endpoint checks in old drivers +Git-commit: 13890626501ffda22b18213ddaf7930473da5792 +Patch-mainline: v6.4-rc1 +References: git-fixes + +Many of the older USB drivers in the Linux USB stack were written +based simply on a vendor's device specification. They use the +endpoint information in the spec and assume these endpoints will +always be present, with the properties listed, in any device matching +the given vendor and product IDs. + +While that may have been true back then, with spoofing and fuzzing it +is not true any more. More and more we are finding that those old +drivers need to perform at least a minimum of checking before they try +to use any endpoint other than ep0. + +To make this checking as simple as possible, we now add a couple of +utility routines to the USB core. usb_check_bulk_endpoints() and +usb_check_int_endpoints() take an interface pointer together with a +list of endpoint addresses (numbers and directions). They check that +the interface's current alternate setting includes endpoints with +those addresses and that each of these endpoints has the right type: +bulk or interrupt, respectively. + +Although we already have usb_find_common_endpoints() and related +routines meant for a similar purpose, they are not well suited for +this kind of checking. Those routines find endpoints of various +kinds, but only one (either the first or the last) of each kind, and +they don't verify that the endpoints' addresses agree with what the +caller expects. + +In theory the new routines could be more general: They could take a +particular altsetting as their argument instead of always using the +interface's current altsetting. In practice I think this won't matter +too much; multiple altsettings tend to be used for transferring media +(audio or visual) over isochronous endpoints, not bulk or interrupt. +Drivers for such devices will generally require more sophisticated +checking than these simplistic routines provide. + +Signed-off-by: Alan Stern +Link: https://lore.kernel.org/r/dd2c8e8c-2c87-44ea-ba17-c64b97e201c9@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/core/usb.c | 76 ++++++++++++++++++++++++++++++++++++++++++ + include/linux/usb.h | 5 +++ + 2 files changed, 81 insertions(+) + +diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c +index 34742fbbd84d..901ec732321c 100644 +--- a/drivers/usb/core/usb.c ++++ b/drivers/usb/core/usb.c +@@ -206,6 +206,82 @@ int usb_find_common_endpoints_reverse(struct usb_host_interface *alt, + } + EXPORT_SYMBOL_GPL(usb_find_common_endpoints_reverse); + ++/** ++ * usb_find_endpoint() - Given an endpoint address, search for the endpoint's ++ * usb_host_endpoint structure in an interface's current altsetting. ++ * @intf: the interface whose current altsetting should be searched ++ * @ep_addr: the endpoint address (number and direction) to find ++ * ++ * Search the altsetting's list of endpoints for one with the specified address. ++ * ++ * Return: Pointer to the usb_host_endpoint if found, %NULL otherwise. ++ */ ++static const struct usb_host_endpoint *usb_find_endpoint( ++ const struct usb_interface *intf, unsigned int ep_addr) ++{ ++ int n; ++ const struct usb_host_endpoint *ep; ++ ++ n = intf->cur_altsetting->desc.bNumEndpoints; ++ ep = intf->cur_altsetting->endpoint; ++ for (; n > 0; (--n, ++ep)) { ++ if (ep->desc.bEndpointAddress == ep_addr) ++ return ep; ++ } ++ return NULL; ++} ++ ++/** ++ * usb_check_bulk_endpoints - Check whether an interface's current altsetting ++ * contains a set of bulk endpoints with the given addresses. ++ * @intf: the interface whose current altsetting should be searched ++ * @ep_addrs: 0-terminated array of the endpoint addresses (number and ++ * direction) to look for ++ * ++ * Search for endpoints with the specified addresses and check their types. ++ * ++ * Return: %true if all the endpoints are found and are bulk, %false otherwise. ++ */ ++bool usb_check_bulk_endpoints( ++ const struct usb_interface *intf, const u8 *ep_addrs) ++{ ++ const struct usb_host_endpoint *ep; ++ ++ for (; *ep_addrs; ++ep_addrs) { ++ ep = usb_find_endpoint(intf, *ep_addrs); ++ if (!ep || !usb_endpoint_xfer_bulk(&ep->desc)) ++ return false; ++ } ++ return true; ++} ++EXPORT_SYMBOL_GPL(usb_check_bulk_endpoints); ++ ++/** ++ * usb_check_int_endpoints - Check whether an interface's current altsetting ++ * contains a set of interrupt endpoints with the given addresses. ++ * @intf: the interface whose current altsetting should be searched ++ * @ep_addrs: 0-terminated array of the endpoint addresses (number and ++ * direction) to look for ++ * ++ * Search for endpoints with the specified addresses and check their types. ++ * ++ * Return: %true if all the endpoints are found and are interrupt, ++ * %false otherwise. ++ */ ++bool usb_check_int_endpoints( ++ const struct usb_interface *intf, const u8 *ep_addrs) ++{ ++ const struct usb_host_endpoint *ep; ++ ++ for (; *ep_addrs; ++ep_addrs) { ++ ep = usb_find_endpoint(intf, *ep_addrs); ++ if (!ep || !usb_endpoint_xfer_int(&ep->desc)) ++ return false; ++ } ++ return true; ++} ++EXPORT_SYMBOL_GPL(usb_check_int_endpoints); ++ + /** + * usb_find_alt_setting() - Given a configuration, find the alternate setting + * for the given interface. +diff --git a/include/linux/usb.h b/include/linux/usb.h +index d510fabcafa2..4ae0466c846c 100644 +--- a/include/linux/usb.h ++++ b/include/linux/usb.h +@@ -291,6 +291,11 @@ void usb_put_intf(struct usb_interface *intf); + #define USB_MAXINTERFACES 32 + #define USB_MAXIADS (USB_MAXINTERFACES/2) + ++bool usb_check_bulk_endpoints( ++ const struct usb_interface *intf, const u8 *ep_addrs); ++bool usb_check_int_endpoints( ++ const struct usb_interface *intf, const u8 *ep_addrs); ++ + /* + * USB Resume Timer: Every Host controller driver should drive the resume + * signalling on the bus for the amount of time defined by this macro. +-- +2.35.3 + diff --git a/patches.suse/USB-dwc3-Fix-a-checkpatch-warning-in-core.c.patch b/patches.suse/USB-dwc3-Fix-a-checkpatch-warning-in-core.c.patch new file mode 100644 index 0000000..d14a3c6 --- /dev/null +++ b/patches.suse/USB-dwc3-Fix-a-checkpatch-warning-in-core.c.patch @@ -0,0 +1,75 @@ +From d090c7a2ab84663185e4abda21d7d83880937c8a Mon Sep 17 00:00:00 2001 +From: Kushagra Verma +Date: Wed, 11 May 2022 21:19:36 +0530 +Subject: [PATCH] USB / dwc3: Fix a checkpatch warning in core.c +Git-commit: d090c7a2ab84663185e4abda21d7d83880937c8a +References: git-fixes +Patch-mainline: v5.19-rc1 + +This patch fixes the following checkpatch.pl warning in core.c: + WARNING: braces {} are not necessary for any arm of this statement + +Signed-off-by: Kushagra Verma +Link: https://lore.kernel.org/r/TYZPR01MB39354534E2F9EE4E022DDAFFF8C89@TYZPR01MB3935.apcprd01.prod.exchangelabs.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Oliver Neukum +--- + drivers/usb/dwc3/core.c | 20 ++++++++------------ + 1 file changed, 8 insertions(+), 12 deletions(-) + +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index 7d023130e145..c78205c5e19f 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -1266,40 +1266,36 @@ static int dwc3_core_get_phy(struct dwc3 *dwc) + + if (IS_ERR(dwc->usb2_phy)) { + ret = PTR_ERR(dwc->usb2_phy); +- if (ret == -ENXIO || ret == -ENODEV) { ++ if (ret == -ENXIO || ret == -ENODEV) + dwc->usb2_phy = NULL; +- } else { ++ else + return dev_err_probe(dev, ret, "no usb2 phy configured\n"); +- } + } + + if (IS_ERR(dwc->usb3_phy)) { + ret = PTR_ERR(dwc->usb3_phy); +- if (ret == -ENXIO || ret == -ENODEV) { ++ if (ret == -ENXIO || ret == -ENODEV) + dwc->usb3_phy = NULL; +- } else { ++ else + return dev_err_probe(dev, ret, "no usb3 phy configured\n"); +- } + } + + dwc->usb2_generic_phy = devm_phy_get(dev, "usb2-phy"); + if (IS_ERR(dwc->usb2_generic_phy)) { + ret = PTR_ERR(dwc->usb2_generic_phy); +- if (ret == -ENOSYS || ret == -ENODEV) { ++ if (ret == -ENOSYS || ret == -ENODEV) + dwc->usb2_generic_phy = NULL; +- } else { ++ else + return dev_err_probe(dev, ret, "no usb2 phy configured\n"); +- } + } + + dwc->usb3_generic_phy = devm_phy_get(dev, "usb3-phy"); + if (IS_ERR(dwc->usb3_generic_phy)) { + ret = PTR_ERR(dwc->usb3_generic_phy); +- if (ret == -ENOSYS || ret == -ENODEV) { ++ if (ret == -ENOSYS || ret == -ENODEV) + dwc->usb3_generic_phy = NULL; +- } else { ++ else + return dev_err_probe(dev, ret, "no usb3 phy configured\n"); +- } + } + + return 0; +-- +2.40.1 + diff --git a/patches.suse/USB-usbtmc-Fix-direction-for-0-length-ioctl-control-.patch b/patches.suse/USB-usbtmc-Fix-direction-for-0-length-ioctl-control-.patch new file mode 100644 index 0000000..2a64a11 --- /dev/null +++ b/patches.suse/USB-usbtmc-Fix-direction-for-0-length-ioctl-control-.patch @@ -0,0 +1,70 @@ +From 94d25e9128988c6a1fc9070f6e98215a95795bd8 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Mon, 1 May 2023 14:22:35 -0400 +Subject: [PATCH] USB: usbtmc: Fix direction for 0-length ioctl control messages +Git-commit: 94d25e9128988c6a1fc9070f6e98215a95795bd8 +Patch-mainline: v6.4-rc3 +References: git-fixes + +The syzbot fuzzer found a problem in the usbtmc driver: When a user +submits an ioctl for a 0-length control transfer, the driver does not +check that the direction is set to OUT: + +Acked-by: Takashi Iwai + +------------[ cut here ]------------ +usb 3-1: BOGUS control dir, pipe 80000b80 doesn't match bRequestType fd +WARNING: CPU: 0 PID: 5100 at drivers/usb/core/urb.c:411 usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 +Modules linked in: +CPU: 0 PID: 5100 Comm: syz-executor428 Not tainted 6.3.0-syzkaller-12049-g58390c8ce1bd #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 +RIP: 0010:usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 +Code: 7c 24 40 e8 1b 13 5c fb 48 8b 7c 24 40 e8 21 1d f0 fe 45 89 e8 44 89 f1 4c 89 e2 48 89 c6 48 c7 c7 e0 b5 fc 8a e8 19 c8 23 fb <0f> 0b e9 9f ee ff ff e8 ed 12 5c fb 0f b6 1d 12 8a 3c 08 31 ff 41 +RSP: 0018:ffffc90003d2fb00 EFLAGS: 00010282 +RAX: 0000000000000000 RBX: ffff8880789e9058 RCX: 0000000000000000 +RDX: ffff888029593b80 RSI: ffffffff814c1447 RDI: 0000000000000001 +RBP: ffff88801ea742f8 R08: 0000000000000001 R09: 0000000000000000 +R10: 0000000000000001 R11: 0000000000000001 R12: ffff88802915e528 +R13: 00000000000000fd R14: 0000000080000b80 R15: ffff8880222b3100 +FS: 0000555556ca63c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f9ef4d18150 CR3: 0000000073e5b000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58 + usb_internal_control_msg drivers/usb/core/message.c:102 [inline] + usb_control_msg+0x320/0x4a0 drivers/usb/core/message.c:153 + usbtmc_ioctl_request drivers/usb/class/usbtmc.c:1954 [inline] + usbtmc_ioctl+0x1b3d/0x2840 drivers/usb/class/usbtmc.c:2097 + +To fix this, we must override the direction in the bRequestType field +of the control request structure when the length is 0. + +Reported-and-tested-by: syzbot+ce77725b89b7bd52425c@syzkaller.appspotmail.com +Signed-off-by: Alan Stern +Link: https://lore.kernel.org/linux-usb/000000000000716a3705f9adb8ee@google.com/ +CC: +Link: https://lore.kernel.org/r/ede1ee02-b718-49e7-a44c-51339fec706b@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/usbtmc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c +index 4bb6d304eb4b..311007b1d904 100644 +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -1928,6 +1928,8 @@ static int usbtmc_ioctl_request(struct usbtmc_device_data *data, + + if (request.req.wLength > USBTMC_BUFSIZE) + return -EMSGSIZE; ++ if (request.req.wLength == 0) /* Length-0 requests are never IN */ ++ request.req.bRequestType &= ~USB_DIR_IN; + + is_in = request.req.bRequestType & USB_DIR_IN; + +-- +2.35.3 + diff --git a/patches.suse/arm64-dts-qcom-msm8996-Add-missing-DWC3-quirks.patch b/patches.suse/arm64-dts-qcom-msm8996-Add-missing-DWC3-quirks.patch new file mode 100644 index 0000000..6b1a493 --- /dev/null +++ b/patches.suse/arm64-dts-qcom-msm8996-Add-missing-DWC3-quirks.patch @@ -0,0 +1,39 @@ +From d0af0537e28f6eace02deed63b585396de939213 Mon Sep 17 00:00:00 2001 +From: Konrad Dybcio +Date: Thu, 2 Mar 2023 02:18:49 +0100 +Subject: [PATCH] arm64: dts: qcom: msm8996: Add missing DWC3 quirks +Git-commit: d0af0537e28f6eace02deed63b585396de939213 +Patch-mainline: v6.4-rc1 +References: git-fixes + +Add missing dwc3 quirks from msm-3.18. Unfortunately, none of them +make `dwc3-qcom 6af8800.usb: HS-PHY not in L2` go away. + +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230302011849.1873056-1-konrad.dybcio@linaro.org +Acked-by: Takashi Iwai + +--- + arch/arm64/boot/dts/qcom/msm8996.dtsi | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index 293ed2e60691..a1e14e3540e6 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -3006,8 +3006,11 @@ usb3_dwc3: usb@6a00000 { + interrupts = <0 131 IRQ_TYPE_LEVEL_HIGH>; + phys = <&hsusb_phy1>, <&ssusb_phy_0>; + phy-names = "usb2-phy", "usb3-phy"; ++ snps,hird-threshold = /bits/ 8 <0>; + snps,dis_u2_susphy_quirk; + snps,dis_enblslpm_quirk; ++ snps,is-utmi-l1-suspend; ++ tx-fifo-resize; + }; + }; + +-- +2.35.3 + diff --git a/patches.suse/ata-pata_octeon_cf-drop-kernel-doc-notation.patch b/patches.suse/ata-pata_octeon_cf-drop-kernel-doc-notation.patch new file mode 100644 index 0000000..966c14e --- /dev/null +++ b/patches.suse/ata-pata_octeon_cf-drop-kernel-doc-notation.patch @@ -0,0 +1,104 @@ +From 1aff53b2fd903b300dfd71af0064c21fbca313c6 Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Mon, 13 Feb 2023 13:25:49 -0800 +Subject: [PATCH] ata: pata_octeon_cf: drop kernel-doc notation +Git-commit: 1aff53b2fd903b300dfd71af0064c21fbca313c6 +Patch-mainline: v6.2 +References: git-fixes + +Fix a slew of kernel-doc warnings in pata_octeon_cf.c by changing +all "/**" comments to "/*" since they are not in kernel-doc format. + +Fixes: 3c929c6f5aa7 ("libata: New driver for OCTEON SOC Compact Flash interface (v7).") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Link: https://lore.kernel.org/all/202302101722.5O56RClE-lkp@intel.com/ +Cc: David Daney +Cc: Damien Le Moal +Cc: Mauro Carvalho Chehab +Cc: linux-ide@vger.kernel.org +Signed-off-by: Damien Le Moal +Acked-by: Takashi Iwai +--- + drivers/ata/pata_octeon_cf.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/ata/pata_octeon_cf.c b/drivers/ata/pata_octeon_cf.c +index 35608a0cf552..4cbcdc5da038 100644 +--- a/drivers/ata/pata_octeon_cf.c ++++ b/drivers/ata/pata_octeon_cf.c +@@ -67,7 +67,7 @@ module_param(enable_dma, int, 0444); + MODULE_PARM_DESC(enable_dma, + "Enable use of DMA on interfaces that support it (0=no dma [default], 1=use dma)"); + +-/** ++/* + * Convert nanosecond based time to setting used in the + * boot bus timing register, based on timing multiple + */ +@@ -114,7 +114,7 @@ static void octeon_cf_set_boot_reg_cfg(int cs, unsigned int multiplier) + cvmx_write_csr(CVMX_MIO_BOOT_REG_CFGX(cs), reg_cfg.u64); + } + +-/** ++/* + * Called after libata determines the needed PIO mode. This + * function programs the Octeon bootbus regions to support the + * timing requirements of the PIO mode. +@@ -278,7 +278,7 @@ static void octeon_cf_set_dmamode(struct ata_port *ap, struct ata_device *dev) + cvmx_write_csr(cf_port->dma_base + DMA_TIM, dma_tim.u64); + } + +-/** ++/* + * Handle an 8 bit I/O request. + * + * @qc: Queued command +@@ -317,7 +317,7 @@ static unsigned int octeon_cf_data_xfer8(struct ata_queued_cmd *qc, + return buflen; + } + +-/** ++/* + * Handle a 16 bit I/O request. + * + * @qc: Queued command +@@ -372,7 +372,7 @@ static unsigned int octeon_cf_data_xfer16(struct ata_queued_cmd *qc, + return buflen; + } + +-/** ++/* + * Read the taskfile for 16bit non-True IDE only. + */ + static void octeon_cf_tf_read16(struct ata_port *ap, struct ata_taskfile *tf) +@@ -453,7 +453,7 @@ static int octeon_cf_softreset16(struct ata_link *link, unsigned int *classes, + return 0; + } + +-/** ++/* + * Load the taskfile for 16bit non-True IDE only. The device_addr is + * not loaded, we do this as part of octeon_cf_exec_command16. + */ +@@ -525,7 +525,7 @@ static void octeon_cf_dma_setup(struct ata_queued_cmd *qc) + ap->ops->sff_exec_command(ap, &qc->tf); + } + +-/** ++/* + * Start a DMA transfer that was already setup + * + * @qc: Information about the DMA +@@ -580,7 +580,7 @@ static void octeon_cf_dma_start(struct ata_queued_cmd *qc) + cvmx_write_csr(cf_port->dma_base + DMA_CFG, mio_boot_dma_cfg.u64); + } + +-/** ++/* + * + * LOCKING: + * spin_lock_irqsave(host lock) +-- +2.35.3 + diff --git a/patches.suse/can-isotp-recvmsg-allow-MSG_CMSG_COMPAT-flag.patch b/patches.suse/can-isotp-recvmsg-allow-MSG_CMSG_COMPAT-flag.patch new file mode 100644 index 0000000..8f5ee54 --- /dev/null +++ b/patches.suse/can-isotp-recvmsg-allow-MSG_CMSG_COMPAT-flag.patch @@ -0,0 +1,37 @@ +From db2773d65b02aed319a93efdfb958087771d4e19 Mon Sep 17 00:00:00 2001 +From: Oliver Hartkopp +Date: Thu, 6 Apr 2023 13:08:45 +0200 +Subject: [PATCH] can: isotp: recvmsg(): allow MSG_CMSG_COMPAT flag +Git-commit: db2773d65b02aed319a93efdfb958087771d4e19 +Patch-mainline: v6.4-rc3 +References: git-fixes + +The control message provided by isotp support MSG_CMSG_COMPAT but +blocked recvmsg() syscalls that have set this flag, i.e. on 32bit user +space on 64 bit kernels. + +Link: https://github.com/hartkopp/can-isotp/issues/59 +Cc: Oleksij Rempel +Suggested-by: Marc Kleine-Budde +Signed-off-by: Oliver Hartkopp +Fixes: 42bf50a1795a ("can: isotp: support MSG_TRUNC flag when reading from socket") +Link: https://lore.kernel.org/20230505110308.81087-2-mkl@pengutronix.de +Cc: stable@vger.kernel.org +Signed-off-by: Marc Kleine-Budde +Acked-by: Takashi Iwai + +--- + net/can/isotp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/can/isotp.c ++++ b/net/can/isotp.c +@@ -1018,7 +1018,7 @@ static int isotp_recvmsg(struct socket * + int noblock = flags & MSG_DONTWAIT; + int ret = 0; + +- if (flags & ~(MSG_DONTWAIT | MSG_TRUNC | MSG_PEEK)) ++ if (flags & ~(MSG_DONTWAIT | MSG_TRUNC | MSG_PEEK | MSG_CMSG_COMPAT)) + return -EINVAL; + + if (!so->bound) diff --git a/patches.suse/can-j1939-recvmsg-allow-MSG_CMSG_COMPAT-flag.patch b/patches.suse/can-j1939-recvmsg-allow-MSG_CMSG_COMPAT-flag.patch new file mode 100644 index 0000000..22ac19b --- /dev/null +++ b/patches.suse/can-j1939-recvmsg-allow-MSG_CMSG_COMPAT-flag.patch @@ -0,0 +1,44 @@ +From 1db080cbdbab28752bbb1c86d64daf96253a5da1 Mon Sep 17 00:00:00 2001 +From: Oliver Hartkopp +Date: Thu, 6 Apr 2023 13:08:45 +0200 +Subject: [PATCH] can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag +Git-commit: 1db080cbdbab28752bbb1c86d64daf96253a5da1 +Patch-mainline: v6.4-rc3 +References: git-fixes + +The control message provided by J1939 support MSG_CMSG_COMPAT but +blocked recvmsg() syscalls that have set this flag, i.e. on 32bit user +space on 64 bit kernels. + +Link: https://github.com/hartkopp/can-isotp/issues/59 +Cc: Oleksij Rempel +Suggested-by: Marc Kleine-Budde +Signed-off-by: Oliver Hartkopp +Tested-by: Oleksij Rempel +Acked-by: Oleksij Rempel +Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") +Link: https://lore.kernel.org/20230505110308.81087-3-mkl@pengutronix.de +Cc: stable@vger.kernel.org +Signed-off-by: Marc Kleine-Budde +Acked-by: Takashi Iwai + +--- + net/can/j1939/socket.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c +index 7e90f9e61d9b..1790469b2580 100644 +--- a/net/can/j1939/socket.c ++++ b/net/can/j1939/socket.c +@@ -798,7 +798,7 @@ static int j1939_sk_recvmsg(struct socket *sock, struct msghdr *msg, + struct j1939_sk_buff_cb *skcb; + int ret = 0; + +- if (flags & ~(MSG_DONTWAIT | MSG_ERRQUEUE)) ++ if (flags & ~(MSG_DONTWAIT | MSG_ERRQUEUE | MSG_CMSG_COMPAT)) + return -EINVAL; + + if (flags & MSG_ERRQUEUE) +-- +2.35.3 + diff --git a/patches.suse/can-kvaser_pciefd-Call-request_irq-before-enabling-i.patch b/patches.suse/can-kvaser_pciefd-Call-request_irq-before-enabling-i.patch new file mode 100644 index 0000000..7e4cd6e --- /dev/null +++ b/patches.suse/can-kvaser_pciefd-Call-request_irq-before-enabling-i.patch @@ -0,0 +1,52 @@ +From 84762d8da89d29ba842317eb842973e628c27391 Mon Sep 17 00:00:00 2001 +From: Jimmy Assarsson +Date: Tue, 16 May 2023 15:43:15 +0200 +Subject: [PATCH] can: kvaser_pciefd: Call request_irq() before enabling interrupts +Git-commit: 84762d8da89d29ba842317eb842973e628c27391 +Patch-mainline: v6.4-rc3 +References: git-fixes + +Make sure the interrupt handler is registered before enabling interrupts. + +Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices") +Cc: stable@vger.kernel.org +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/r/20230516134318.104279-4-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Acked-by: Takashi Iwai + +--- + drivers/net/can/kvaser_pciefd.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c +index cdc894d12885..4b8591d48735 100644 +--- a/drivers/net/can/kvaser_pciefd.c ++++ b/drivers/net/can/kvaser_pciefd.c +@@ -1827,6 +1827,11 @@ static int kvaser_pciefd_probe(struct pci_dev *pdev, + if (err) + goto err_teardown_can_ctrls; + ++ err = request_irq(pcie->pci->irq, kvaser_pciefd_irq_handler, ++ IRQF_SHARED, KVASER_PCIEFD_DRV_NAME, pcie); ++ if (err) ++ goto err_teardown_can_ctrls; ++ + iowrite32(KVASER_PCIEFD_SRB_IRQ_DPD0 | KVASER_PCIEFD_SRB_IRQ_DPD1, + pcie->reg_base + KVASER_PCIEFD_SRB_IRQ_REG); + +@@ -1847,11 +1852,6 @@ static int kvaser_pciefd_probe(struct pci_dev *pdev, + iowrite32(KVASER_PCIEFD_SRB_CMD_RDB1, + pcie->reg_base + KVASER_PCIEFD_SRB_CMD_REG); + +- err = request_irq(pcie->pci->irq, kvaser_pciefd_irq_handler, +- IRQF_SHARED, KVASER_PCIEFD_DRV_NAME, pcie); +- if (err) +- goto err_teardown_can_ctrls; +- + err = kvaser_pciefd_reg_candev(pcie); + if (err) + goto err_free_irq; +-- +2.35.3 + diff --git a/patches.suse/can-kvaser_pciefd-Clear-listen-only-bit-if-not-expli.patch b/patches.suse/can-kvaser_pciefd-Clear-listen-only-bit-if-not-expli.patch new file mode 100644 index 0000000..9fa2df1 --- /dev/null +++ b/patches.suse/can-kvaser_pciefd-Clear-listen-only-bit-if-not-expli.patch @@ -0,0 +1,38 @@ +From bf7ac55e991ca177f1ac16be51152f1ef291a4df Mon Sep 17 00:00:00 2001 +From: Jimmy Assarsson +Date: Tue, 16 May 2023 15:43:14 +0200 +Subject: [PATCH] can: kvaser_pciefd: Clear listen-only bit if not explicitly requested +Git-commit: bf7ac55e991ca177f1ac16be51152f1ef291a4df +Patch-mainline: v6.4-rc3 +References: git-fixes + +The listen-only bit was never cleared, causing the controller to +always use listen-only mode, if previously set. + +Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices") +Cc: stable@vger.kernel.org +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/r/20230516134318.104279-3-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Acked-by: Takashi Iwai + +--- + drivers/net/can/kvaser_pciefd.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c +index 867b421b9506..cdc894d12885 100644 +--- a/drivers/net/can/kvaser_pciefd.c ++++ b/drivers/net/can/kvaser_pciefd.c +@@ -554,6 +554,8 @@ static void kvaser_pciefd_setup_controller(struct kvaser_pciefd_can *can) + + if (can->can.ctrlmode & CAN_CTRLMODE_LISTENONLY) + mode |= KVASER_PCIEFD_KCAN_MODE_LOM; ++ else ++ mode &= ~KVASER_PCIEFD_KCAN_MODE_LOM; + + mode |= KVASER_PCIEFD_KCAN_MODE_EEN; + mode |= KVASER_PCIEFD_KCAN_MODE_EPEN; +-- +2.35.3 + diff --git a/patches.suse/can-kvaser_pciefd-Disable-interrupts-in-probe-error-.patch b/patches.suse/can-kvaser_pciefd-Disable-interrupts-in-probe-error-.patch new file mode 100644 index 0000000..1b63297 --- /dev/null +++ b/patches.suse/can-kvaser_pciefd-Disable-interrupts-in-probe-error-.patch @@ -0,0 +1,37 @@ +From 11164bc39459335ab93c6e99d53b7e4292fba38b Mon Sep 17 00:00:00 2001 +From: Jimmy Assarsson +Date: Tue, 16 May 2023 15:43:18 +0200 +Subject: [PATCH] can: kvaser_pciefd: Disable interrupts in probe error path +Git-commit: 11164bc39459335ab93c6e99d53b7e4292fba38b +Patch-mainline: v6.4-rc3 +References: git-fixes + +Disable interrupts in error path of probe function. + +Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices") +Cc: stable@vger.kernel.org +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/r/20230516134318.104279-7-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Acked-by: Takashi Iwai + +--- + drivers/net/can/kvaser_pciefd.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c +index 4fafb7658349..be189edb256c 100644 +--- a/drivers/net/can/kvaser_pciefd.c ++++ b/drivers/net/can/kvaser_pciefd.c +@@ -1861,6 +1861,8 @@ static int kvaser_pciefd_probe(struct pci_dev *pdev, + return 0; + + err_free_irq: ++ /* Disable PCI interrupts */ ++ iowrite32(0, pcie->reg_base + KVASER_PCIEFD_IEN_REG); + free_irq(pcie->pci->irq, pcie); + + err_teardown_can_ctrls: +-- +2.35.3 + diff --git a/patches.suse/can-kvaser_pciefd-Do-not-send-EFLUSH-command-on-TFD-.patch b/patches.suse/can-kvaser_pciefd-Do-not-send-EFLUSH-command-on-TFD-.patch new file mode 100644 index 0000000..8ca1520 --- /dev/null +++ b/patches.suse/can-kvaser_pciefd-Do-not-send-EFLUSH-command-on-TFD-.patch @@ -0,0 +1,98 @@ +From 262d7a52ba27525e3c1203230c9f0524e48bbb34 Mon Sep 17 00:00:00 2001 +From: Jimmy Assarsson +Date: Tue, 16 May 2023 15:43:17 +0200 +Subject: [PATCH] can: kvaser_pciefd: Do not send EFLUSH command on TFD interrupt +Git-commit: 262d7a52ba27525e3c1203230c9f0524e48bbb34 +Patch-mainline: v6.4-rc3 +References: git-fixes + +Under certain circumstances we send two EFLUSH commands, resulting in two +EFLUSH ack packets, while only expecting a single EFLUSH ack. +This can cause the driver Tx flush completion to get out of sync. + +To avoid this problem, don't enable the "Transmit buffer flush done" (TFD) +interrupt and remove the code handling it. +Now we only send EFLUSH command after receiving status packet with +"Init detected" (IDET) bit set. + +Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices") +Cc: stable@vger.kernel.org +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/r/20230516134318.104279-6-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Acked-by: Takashi Iwai + +--- + drivers/net/can/kvaser_pciefd.c | 21 ++++----------------- + 1 file changed, 4 insertions(+), 17 deletions(-) + +diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c +index 0e03c1cd47b3..4fafb7658349 100644 +--- a/drivers/net/can/kvaser_pciefd.c ++++ b/drivers/net/can/kvaser_pciefd.c +@@ -531,7 +531,7 @@ static int kvaser_pciefd_set_tx_irq(struct kvaser_pciefd_can *can) + KVASER_PCIEFD_KCAN_IRQ_TOF | KVASER_PCIEFD_KCAN_IRQ_ABD | + KVASER_PCIEFD_KCAN_IRQ_TAE | KVASER_PCIEFD_KCAN_IRQ_TAL | + KVASER_PCIEFD_KCAN_IRQ_FDIC | KVASER_PCIEFD_KCAN_IRQ_BPP | +- KVASER_PCIEFD_KCAN_IRQ_TAR | KVASER_PCIEFD_KCAN_IRQ_TFD; ++ KVASER_PCIEFD_KCAN_IRQ_TAR; + + iowrite32(msk, can->reg_base + KVASER_PCIEFD_KCAN_IEN_REG); + +@@ -579,7 +579,7 @@ static void kvaser_pciefd_start_controller_flush(struct kvaser_pciefd_can *can) + + spin_lock_irqsave(&can->lock, irq); + iowrite32(-1, can->reg_base + KVASER_PCIEFD_KCAN_IRQ_REG); +- iowrite32(KVASER_PCIEFD_KCAN_IRQ_ABD | KVASER_PCIEFD_KCAN_IRQ_TFD, ++ iowrite32(KVASER_PCIEFD_KCAN_IRQ_ABD, + can->reg_base + KVASER_PCIEFD_KCAN_IEN_REG); + + status = ioread32(can->reg_base + KVASER_PCIEFD_KCAN_STAT_REG); +@@ -622,7 +622,7 @@ static int kvaser_pciefd_bus_on(struct kvaser_pciefd_can *can) + iowrite32(0, can->reg_base + KVASER_PCIEFD_KCAN_IEN_REG); + iowrite32(-1, can->reg_base + KVASER_PCIEFD_KCAN_IRQ_REG); + +- iowrite32(KVASER_PCIEFD_KCAN_IRQ_ABD | KVASER_PCIEFD_KCAN_IRQ_TFD, ++ iowrite32(KVASER_PCIEFD_KCAN_IRQ_ABD, + can->reg_base + KVASER_PCIEFD_KCAN_IEN_REG); + + mode = ioread32(can->reg_base + KVASER_PCIEFD_KCAN_MODE_REG); +@@ -1015,8 +1015,7 @@ static int kvaser_pciefd_setup_can_ctrls(struct kvaser_pciefd *pcie) + SET_NETDEV_DEV(netdev, &pcie->pci->dev); + + iowrite32(-1, can->reg_base + KVASER_PCIEFD_KCAN_IRQ_REG); +- iowrite32(KVASER_PCIEFD_KCAN_IRQ_ABD | +- KVASER_PCIEFD_KCAN_IRQ_TFD, ++ iowrite32(KVASER_PCIEFD_KCAN_IRQ_ABD, + can->reg_base + KVASER_PCIEFD_KCAN_IEN_REG); + + pcie->can[i] = can; +@@ -1443,9 +1442,6 @@ static int kvaser_pciefd_handle_status_packet(struct kvaser_pciefd *pcie, + cmd = KVASER_PCIEFD_KCAN_CMD_AT; + cmd |= ++can->cmd_seq << KVASER_PCIEFD_KCAN_CMD_SEQ_SHIFT; + iowrite32(cmd, can->reg_base + KVASER_PCIEFD_KCAN_CMD_REG); +- +- iowrite32(KVASER_PCIEFD_KCAN_IRQ_TFD, +- can->reg_base + KVASER_PCIEFD_KCAN_IEN_REG); + } else if (p->header[0] & KVASER_PCIEFD_SPACK_IDET && + p->header[0] & KVASER_PCIEFD_SPACK_IRM && + cmdseq == (p->header[1] & KVASER_PCIEFD_PACKET_SEQ_MSK) && +@@ -1732,15 +1728,6 @@ static int kvaser_pciefd_transmit_irq(struct kvaser_pciefd_can *can) + if (irq & KVASER_PCIEFD_KCAN_IRQ_TOF) + netdev_err(can->can.dev, "Tx FIFO overflow\n"); + +- if (irq & KVASER_PCIEFD_KCAN_IRQ_TFD) { +- u8 count = ioread32(can->reg_base + +- KVASER_PCIEFD_KCAN_TX_NPACKETS_REG) & 0xff; +- +- if (count == 0) +- iowrite32(KVASER_PCIEFD_KCAN_CTRL_EFLUSH, +- can->reg_base + KVASER_PCIEFD_KCAN_CTRL_REG); +- } +- + if (irq & KVASER_PCIEFD_KCAN_IRQ_BPP) + netdev_err(can->can.dev, + "Fail to change bittiming, when not in reset mode\n"); +-- +2.35.3 + diff --git a/patches.suse/can-kvaser_pciefd-Empty-SRB-buffer-in-probe.patch b/patches.suse/can-kvaser_pciefd-Empty-SRB-buffer-in-probe.patch new file mode 100644 index 0000000..ae95602 --- /dev/null +++ b/patches.suse/can-kvaser_pciefd-Empty-SRB-buffer-in-probe.patch @@ -0,0 +1,76 @@ +From c589557dd1426f5adf90c7a919d4fde5a3e4ef64 Mon Sep 17 00:00:00 2001 +From: Jimmy Assarsson +Date: Tue, 16 May 2023 15:43:16 +0200 +Subject: [PATCH] can: kvaser_pciefd: Empty SRB buffer in probe +Git-commit: c589557dd1426f5adf90c7a919d4fde5a3e4ef64 +Patch-mainline: v6.4-rc3 +References: git-fixes + +Empty the "Shared receive buffer" (SRB) in probe, to assure we start in a +known state, and don't process any irrelevant packets. + +Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices") +Cc: stable@vger.kernel.org +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/r/20230516134318.104279-5-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Acked-by: Takashi Iwai + +--- + drivers/net/can/kvaser_pciefd.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c +index 4b8591d48735..0e03c1cd47b3 100644 +--- a/drivers/net/can/kvaser_pciefd.c ++++ b/drivers/net/can/kvaser_pciefd.c +@@ -71,10 +71,12 @@ MODULE_DESCRIPTION("CAN driver for Kvaser CAN/PCIe devices"); + #define KVASER_PCIEFD_SYSID_BUILD_REG (KVASER_PCIEFD_SYSID_BASE + 0x14) + /* Shared receive buffer registers */ + #define KVASER_PCIEFD_SRB_BASE 0x1f200 ++#define KVASER_PCIEFD_SRB_FIFO_LAST_REG (KVASER_PCIEFD_SRB_BASE + 0x1f4) + #define KVASER_PCIEFD_SRB_CMD_REG (KVASER_PCIEFD_SRB_BASE + 0x200) + #define KVASER_PCIEFD_SRB_IEN_REG (KVASER_PCIEFD_SRB_BASE + 0x204) + #define KVASER_PCIEFD_SRB_IRQ_REG (KVASER_PCIEFD_SRB_BASE + 0x20c) + #define KVASER_PCIEFD_SRB_STAT_REG (KVASER_PCIEFD_SRB_BASE + 0x210) ++#define KVASER_PCIEFD_SRB_RX_NR_PACKETS_REG (KVASER_PCIEFD_SRB_BASE + 0x214) + #define KVASER_PCIEFD_SRB_CTRL_REG (KVASER_PCIEFD_SRB_BASE + 0x218) + /* EPCS flash controller registers */ + #define KVASER_PCIEFD_SPI_BASE 0x1fc00 +@@ -111,6 +113,9 @@ MODULE_DESCRIPTION("CAN driver for Kvaser CAN/PCIe devices"); + /* DMA support */ + #define KVASER_PCIEFD_SRB_STAT_DMA BIT(24) + ++/* SRB current packet level */ ++#define KVASER_PCIEFD_SRB_RX_NR_PACKETS_MASK 0xff ++ + /* DMA Enable */ + #define KVASER_PCIEFD_SRB_CTRL_DMA_ENABLE BIT(0) + +@@ -1061,6 +1066,7 @@ static int kvaser_pciefd_setup_dma(struct kvaser_pciefd *pcie) + { + int i; + u32 srb_status; ++ u32 srb_packet_count; + dma_addr_t dma_addr[KVASER_PCIEFD_DMA_COUNT]; + + /* Disable the DMA */ +@@ -1088,6 +1094,15 @@ static int kvaser_pciefd_setup_dma(struct kvaser_pciefd *pcie) + KVASER_PCIEFD_SRB_CMD_RDB1, + pcie->reg_base + KVASER_PCIEFD_SRB_CMD_REG); + ++ /* Empty Rx FIFO */ ++ srb_packet_count = ioread32(pcie->reg_base + KVASER_PCIEFD_SRB_RX_NR_PACKETS_REG) & ++ KVASER_PCIEFD_SRB_RX_NR_PACKETS_MASK; ++ while (srb_packet_count) { ++ /* Drop current packet in FIFO */ ++ ioread32(pcie->reg_base + KVASER_PCIEFD_SRB_FIFO_LAST_REG); ++ srb_packet_count--; ++ } ++ + srb_status = ioread32(pcie->reg_base + KVASER_PCIEFD_SRB_STAT_REG); + if (!(srb_status & KVASER_PCIEFD_SRB_STAT_DI)) { + dev_err(&pcie->pci->dev, "DMA not idle before enabling\n"); +-- +2.35.3 + diff --git a/patches.suse/can-kvaser_pciefd-Set-CAN_STATE_STOPPED-in-kvaser_pc.patch b/patches.suse/can-kvaser_pciefd-Set-CAN_STATE_STOPPED-in-kvaser_pc.patch new file mode 100644 index 0000000..e7faef7 --- /dev/null +++ b/patches.suse/can-kvaser_pciefd-Set-CAN_STATE_STOPPED-in-kvaser_pc.patch @@ -0,0 +1,38 @@ +From aed0e6ca7dbb8fbea9bc69c9ac663d5533c8c5d8 Mon Sep 17 00:00:00 2001 +From: Jimmy Assarsson +Date: Tue, 16 May 2023 15:43:13 +0200 +Subject: [PATCH] can: kvaser_pciefd: Set CAN_STATE_STOPPED in kvaser_pciefd_stop() +Git-commit: aed0e6ca7dbb8fbea9bc69c9ac663d5533c8c5d8 +Patch-mainline: v6.4-rc3 +References: git-fixes + +Set can.state to CAN_STATE_STOPPED in kvaser_pciefd_stop(). +Without this fix, wrong CAN state was repported after the interface was +brought down. + +Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices") +Cc: stable@vger.kernel.org +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/r/20230516134318.104279-2-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Acked-by: Takashi Iwai + +--- + drivers/net/can/kvaser_pciefd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c +index 53e8a914c88b..867b421b9506 100644 +--- a/drivers/net/can/kvaser_pciefd.c ++++ b/drivers/net/can/kvaser_pciefd.c +@@ -719,6 +719,7 @@ static int kvaser_pciefd_stop(struct net_device *netdev) + iowrite32(0, can->reg_base + KVASER_PCIEFD_KCAN_IEN_REG); + del_timer(&can->bec_poll_timer); + } ++ can->can.state = CAN_STATE_STOPPED; + close_candev(netdev); + + return ret; +-- +2.35.3 + diff --git a/patches.suse/can-kvaser_usb-Add-struct-kvaser_usb_busparams.patch b/patches.suse/can-kvaser_usb-Add-struct-kvaser_usb_busparams.patch new file mode 100644 index 0000000..92f3043 --- /dev/null +++ b/patches.suse/can-kvaser_usb-Add-struct-kvaser_usb_busparams.patch @@ -0,0 +1,133 @@ +From 00e5786177649c1e3110f9454fdd34e336597265 Mon Sep 17 00:00:00 2001 +From: Jimmy Assarsson +Date: Mon, 10 Oct 2022 20:52:36 +0200 +Subject: [PATCH] can: kvaser_usb: Add struct kvaser_usb_busparams +Git-commit: 00e5786177649c1e3110f9454fdd34e336597265 +Patch-mainline: v6.2-rc1 +References: git-fixes + +Add struct kvaser_usb_busparams containing the busparameters used in +CMD_{SET,GET}_BUSPARAMS* commands. + +Tested-by: Anssi Hannula +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/all/20221010185237.319219-11-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Acked-by: Takashi Iwai + +--- + drivers/net/can/usb/kvaser_usb/kvaser_usb.h | 8 +++++ + drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 32 ++++++++-------------- + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 18 ++++-------- + 3 files changed, 27 insertions(+), 31 deletions(-) + +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb.h ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb.h +@@ -76,6 +76,14 @@ struct kvaser_usb_tx_urb_context { + int dlc; + }; + ++struct kvaser_usb_busparams { ++ __le32 bitrate; ++ u8 tseg1; ++ u8 tseg2; ++ u8 sjw; ++ u8 nsamples; ++} __packed; ++ + struct kvaser_usb { + struct usb_device *udev; + struct usb_interface *intf; +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +@@ -196,17 +196,9 @@ struct kvaser_cmd_chip_state_event { + #define KVASER_USB_HYDRA_BUS_MODE_CANFD_ISO 0x01 + #define KVASER_USB_HYDRA_BUS_MODE_NONISO 0x02 + struct kvaser_cmd_set_busparams { +- __le32 bitrate; +- u8 tseg1; +- u8 tseg2; +- u8 sjw; +- u8 nsamples; ++ struct kvaser_usb_busparams busparams_arb; + u8 reserved0[4]; +- __le32 bitrate_d; +- u8 tseg1_d; +- u8 tseg2_d; +- u8 sjw_d; +- u8 nsamples_d; ++ struct kvaser_usb_busparams busparams_data; + u8 canfd_mode; + u8 reserved1[7]; + } __packed; +@@ -1538,11 +1530,11 @@ static int kvaser_usb_hydra_set_bittimin + return -ENOMEM; + + cmd->header.cmd_no = CMD_SET_BUSPARAMS_REQ; +- cmd->set_busparams_req.bitrate = cpu_to_le32(bt->bitrate); +- cmd->set_busparams_req.sjw = (u8)sjw; +- cmd->set_busparams_req.tseg1 = (u8)tseg1; +- cmd->set_busparams_req.tseg2 = (u8)tseg2; +- cmd->set_busparams_req.nsamples = 1; ++ cmd->set_busparams_req.busparams_arb.bitrate = cpu_to_le32(bt->bitrate); ++ cmd->set_busparams_req.busparams_arb.sjw = (u8)sjw; ++ cmd->set_busparams_req.busparams_arb.tseg1 = (u8)tseg1; ++ cmd->set_busparams_req.busparams_arb.tseg2 = (u8)tseg2; ++ cmd->set_busparams_req.busparams_arb.nsamples = 1; + + kvaser_usb_hydra_set_cmd_dest_he + (cmd, dev->card_data.hydra.channel_to_he[priv->channel]); +@@ -1572,11 +1564,11 @@ static int kvaser_usb_hydra_set_data_bit + return -ENOMEM; + + cmd->header.cmd_no = CMD_SET_BUSPARAMS_FD_REQ; +- cmd->set_busparams_req.bitrate_d = cpu_to_le32(dbt->bitrate); +- cmd->set_busparams_req.sjw_d = (u8)sjw; +- cmd->set_busparams_req.tseg1_d = (u8)tseg1; +- cmd->set_busparams_req.tseg2_d = (u8)tseg2; +- cmd->set_busparams_req.nsamples_d = 1; ++ cmd->set_busparams_req.busparams_data.bitrate = cpu_to_le32(dbt->bitrate); ++ cmd->set_busparams_req.busparams_data.sjw = (u8)sjw; ++ cmd->set_busparams_req.busparams_data.tseg1 = (u8)tseg1; ++ cmd->set_busparams_req.busparams_data.tseg2 = (u8)tseg2; ++ cmd->set_busparams_req.busparams_data.nsamples = 1; + + if (priv->can.ctrlmode & CAN_CTRLMODE_FD) { + if (priv->can.ctrlmode & CAN_CTRLMODE_FD_NON_ISO) +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -162,11 +162,7 @@ struct usbcan_cmd_softinfo { + struct kvaser_cmd_busparams { + u8 tid; + u8 channel; +- __le32 bitrate; +- u8 tseg1; +- u8 tseg2; +- u8 sjw; +- u8 no_samp; ++ struct kvaser_usb_busparams busparams; + } __packed; + + struct kvaser_cmd_tx_can { +@@ -1645,15 +1641,15 @@ static int kvaser_usb_leaf_set_bittiming + cmd->len = CMD_HEADER_LEN + sizeof(struct kvaser_cmd_busparams); + cmd->u.busparams.channel = priv->channel; + cmd->u.busparams.tid = 0xff; +- cmd->u.busparams.bitrate = cpu_to_le32(bt->bitrate); +- cmd->u.busparams.sjw = bt->sjw; +- cmd->u.busparams.tseg1 = bt->prop_seg + bt->phase_seg1; +- cmd->u.busparams.tseg2 = bt->phase_seg2; ++ cmd->u.busparams.busparams.bitrate = cpu_to_le32(bt->bitrate); ++ cmd->u.busparams.busparams.sjw = bt->sjw; ++ cmd->u.busparams.busparams.tseg1 = bt->prop_seg + bt->phase_seg1; ++ cmd->u.busparams.busparams.tseg2 = bt->phase_seg2; + + if (priv->can.ctrlmode & CAN_CTRLMODE_3_SAMPLES) +- cmd->u.busparams.no_samp = 3; ++ cmd->u.busparams.busparams.nsamples = 3; + else +- cmd->u.busparams.no_samp = 1; ++ cmd->u.busparams.busparams.nsamples = 1; + + rc = kvaser_usb_send_cmd(dev, cmd, cmd->len); + diff --git a/patches.suse/can-kvaser_usb-kvaser_usb_leaf-Get-capabilities-from.patch b/patches.suse/can-kvaser_usb-kvaser_usb_leaf-Get-capabilities-from.patch new file mode 100644 index 0000000..fb27539 --- /dev/null +++ b/patches.suse/can-kvaser_usb-kvaser_usb_leaf-Get-capabilities-from.patch @@ -0,0 +1,231 @@ +From 35364f5b41a4917fe94a3f393d149b63ec583297 Mon Sep 17 00:00:00 2001 +From: Jimmy Assarsson +Date: Mon, 10 Oct 2022 20:52:28 +0200 +Subject: [PATCH] can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device +Git-commit: 35364f5b41a4917fe94a3f393d149b63ec583297 +Patch-mainline: v6.2-rc1 +References: git-fixes + +Use the CMD_GET_CAPABILITIES_REQ command to query the device for certain +capabilities. We are only interested in LISTENONLY mode and wither the +device reports CAN error counters. + +Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") +Reported-by: Anssi Hannula +Tested-by: Anssi Hannula +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/all/20221010185237.319219-3-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Acked-by: Takashi Iwai + +--- + .../net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 144 +++++++++++++++++- + 1 file changed, 143 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +index 50f2ac8319ff..c87b13dc1048 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -74,6 +74,8 @@ + #define CMD_TX_ACKNOWLEDGE 50 + #define CMD_CAN_ERROR_EVENT 51 + #define CMD_FLUSH_QUEUE_REPLY 68 ++#define CMD_GET_CAPABILITIES_REQ 95 ++#define CMD_GET_CAPABILITIES_RESP 96 + + #define CMD_LEAF_LOG_MESSAGE 106 + +@@ -83,6 +85,8 @@ + #define KVASER_USB_LEAF_SWOPTION_FREQ_32_MHZ_CLK BIT(5) + #define KVASER_USB_LEAF_SWOPTION_FREQ_24_MHZ_CLK BIT(6) + ++#define KVASER_USB_LEAF_SWOPTION_EXT_CAP BIT(12) ++ + /* error factors */ + #define M16C_EF_ACKE BIT(0) + #define M16C_EF_CRCE BIT(1) +@@ -278,6 +282,28 @@ struct leaf_cmd_log_message { + u8 data[8]; + } __packed; + ++/* Sub commands for cap_req and cap_res */ ++#define KVASER_USB_LEAF_CAP_CMD_LISTEN_MODE 0x02 ++#define KVASER_USB_LEAF_CAP_CMD_ERR_REPORT 0x05 ++struct kvaser_cmd_cap_req { ++ __le16 padding0; ++ __le16 cap_cmd; ++ __le16 padding1; ++ __le16 channel; ++} __packed; ++ ++/* Status codes for cap_res */ ++#define KVASER_USB_LEAF_CAP_STAT_OK 0x00 ++#define KVASER_USB_LEAF_CAP_STAT_NOT_IMPL 0x01 ++#define KVASER_USB_LEAF_CAP_STAT_UNAVAIL 0x02 ++struct kvaser_cmd_cap_res { ++ __le16 padding; ++ __le16 cap_cmd; ++ __le16 status; ++ __le32 mask; ++ __le32 value; ++} __packed; ++ + struct kvaser_cmd { + u8 len; + u8 id; +@@ -295,6 +321,8 @@ struct kvaser_cmd { + struct leaf_cmd_chip_state_event chip_state_event; + struct leaf_cmd_error_event error_event; + struct leaf_cmd_log_message log_message; ++ struct kvaser_cmd_cap_req cap_req; ++ struct kvaser_cmd_cap_res cap_res; + } __packed leaf; + + union { +@@ -324,6 +352,7 @@ static const u8 kvaser_usb_leaf_cmd_sizes_leaf[] = { + [CMD_LEAF_LOG_MESSAGE] = kvaser_fsize(u.leaf.log_message), + [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.leaf.chip_state_event), + [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.leaf.error_event), ++ [CMD_GET_CAPABILITIES_RESP] = kvaser_fsize(u.leaf.cap_res), + /* ignored events: */ + [CMD_FLUSH_QUEUE_REPLY] = CMD_SIZE_ANY, + }; +@@ -606,6 +635,9 @@ static void kvaser_usb_leaf_get_software_info_leaf(struct kvaser_usb *dev, + dev->fw_version = le32_to_cpu(softinfo->fw_version); + dev->max_tx_urbs = le16_to_cpu(softinfo->max_outstanding_tx); + ++ if (sw_options & KVASER_USB_LEAF_SWOPTION_EXT_CAP) ++ dev->card_data.capabilities |= KVASER_USB_CAP_EXT_CAP; ++ + if (dev->driver_info->quirks & KVASER_USB_QUIRK_IGNORE_CLK_FREQ) { + /* Firmware expects bittiming parameters calculated for 16MHz + * clock, regardless of the actual clock +@@ -693,6 +725,116 @@ static int kvaser_usb_leaf_get_card_info(struct kvaser_usb *dev) + return 0; + } + ++static int kvaser_usb_leaf_get_single_capability(struct kvaser_usb *dev, ++ u16 cap_cmd_req, u16 *status) ++{ ++ struct kvaser_usb_dev_card_data *card_data = &dev->card_data; ++ struct kvaser_cmd *cmd; ++ u32 value = 0; ++ u32 mask = 0; ++ u16 cap_cmd_res; ++ int err; ++ int i; ++ ++ cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); ++ if (!cmd) ++ return -ENOMEM; ++ ++ cmd->id = CMD_GET_CAPABILITIES_REQ; ++ cmd->u.leaf.cap_req.cap_cmd = cpu_to_le16(cap_cmd_req); ++ cmd->len = CMD_HEADER_LEN + sizeof(struct kvaser_cmd_cap_req); ++ ++ err = kvaser_usb_send_cmd(dev, cmd, cmd->len); ++ if (err) ++ goto end; ++ ++ err = kvaser_usb_leaf_wait_cmd(dev, CMD_GET_CAPABILITIES_RESP, cmd); ++ if (err) ++ goto end; ++ ++ *status = le16_to_cpu(cmd->u.leaf.cap_res.status); ++ ++ if (*status != KVASER_USB_LEAF_CAP_STAT_OK) ++ goto end; ++ ++ cap_cmd_res = le16_to_cpu(cmd->u.leaf.cap_res.cap_cmd); ++ switch (cap_cmd_res) { ++ case KVASER_USB_LEAF_CAP_CMD_LISTEN_MODE: ++ case KVASER_USB_LEAF_CAP_CMD_ERR_REPORT: ++ value = le32_to_cpu(cmd->u.leaf.cap_res.value); ++ mask = le32_to_cpu(cmd->u.leaf.cap_res.mask); ++ break; ++ default: ++ dev_warn(&dev->intf->dev, "Unknown capability command %u\n", ++ cap_cmd_res); ++ break; ++ } ++ ++ for (i = 0; i < dev->nchannels; i++) { ++ if (BIT(i) & (value & mask)) { ++ switch (cap_cmd_res) { ++ case KVASER_USB_LEAF_CAP_CMD_LISTEN_MODE: ++ card_data->ctrlmode_supported |= ++ CAN_CTRLMODE_LISTENONLY; ++ break; ++ case KVASER_USB_LEAF_CAP_CMD_ERR_REPORT: ++ card_data->capabilities |= ++ KVASER_USB_CAP_BERR_CAP; ++ break; ++ } ++ } ++ } ++ ++end: ++ kfree(cmd); ++ ++ return err; ++} ++ ++static int kvaser_usb_leaf_get_capabilities_leaf(struct kvaser_usb *dev) ++{ ++ int err; ++ u16 status; ++ ++ if (!(dev->card_data.capabilities & KVASER_USB_CAP_EXT_CAP)) { ++ dev_info(&dev->intf->dev, ++ "No extended capability support. Upgrade device firmware.\n"); ++ return 0; ++ } ++ ++ err = kvaser_usb_leaf_get_single_capability(dev, ++ KVASER_USB_LEAF_CAP_CMD_LISTEN_MODE, ++ &status); ++ if (err) ++ return err; ++ if (status) ++ dev_info(&dev->intf->dev, ++ "KVASER_USB_LEAF_CAP_CMD_LISTEN_MODE failed %u\n", ++ status); ++ ++ err = kvaser_usb_leaf_get_single_capability(dev, ++ KVASER_USB_LEAF_CAP_CMD_ERR_REPORT, ++ &status); ++ if (err) ++ return err; ++ if (status) ++ dev_info(&dev->intf->dev, ++ "KVASER_USB_LEAF_CAP_CMD_ERR_REPORT failed %u\n", ++ status); ++ ++ return 0; ++} ++ ++static int kvaser_usb_leaf_get_capabilities(struct kvaser_usb *dev) ++{ ++ int err = 0; ++ ++ if (dev->driver_info->family == KVASER_LEAF) ++ err = kvaser_usb_leaf_get_capabilities_leaf(dev); ++ ++ return err; ++} ++ + static void kvaser_usb_leaf_tx_acknowledge(const struct kvaser_usb *dev, + const struct kvaser_cmd *cmd) + { +@@ -1486,7 +1628,7 @@ const struct kvaser_usb_dev_ops kvaser_usb_leaf_dev_ops = { + .dev_get_software_info = kvaser_usb_leaf_get_software_info, + .dev_get_software_details = NULL, + .dev_get_card_info = kvaser_usb_leaf_get_card_info, +- .dev_get_capabilities = NULL, ++ .dev_get_capabilities = kvaser_usb_leaf_get_capabilities, + .dev_set_opt_mode = kvaser_usb_leaf_set_opt_mode, + .dev_start_chip = kvaser_usb_leaf_start_chip, + .dev_stop_chip = kvaser_usb_leaf_stop_chip, +-- +2.35.3 + diff --git a/patches.suse/can-kvaser_usb-kvaser_usb_leaf-Handle-CMD_ERROR_EVEN.patch b/patches.suse/can-kvaser_usb-kvaser_usb_leaf-Handle-CMD_ERROR_EVEN.patch new file mode 100644 index 0000000..e1a8c48 --- /dev/null +++ b/patches.suse/can-kvaser_usb-kvaser_usb_leaf-Handle-CMD_ERROR_EVEN.patch @@ -0,0 +1,186 @@ +From b24cb2d169e0c9dce664a959e1f2aa9781285dc9 Mon Sep 17 00:00:00 2001 +From: Jimmy Assarsson +Date: Mon, 10 Oct 2022 20:52:30 +0200 +Subject: [PATCH] can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT +Git-commit: b24cb2d169e0c9dce664a959e1f2aa9781285dc9 +Patch-mainline: v6.2-rc1 +References: git-fixes + +The device will send an error event command, to indicate certain errors. +This indicates a misbehaving driver, and should never occur. + +Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") +Tested-by: Anssi Hannula +Co-developed-by: Anssi Hannula +Signed-off-by: Anssi Hannula +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/all/20221010185237.319219-5-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Acked-by: Takashi Iwai + +--- + .../net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 99 +++++++++++++++++++ + 1 file changed, 99 insertions(+) + +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +index f34ca9a850aa..e391ec247f54 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -70,6 +70,7 @@ + #define CMD_GET_CARD_INFO_REPLY 35 + #define CMD_GET_SOFTWARE_INFO 38 + #define CMD_GET_SOFTWARE_INFO_REPLY 39 ++#define CMD_ERROR_EVENT 45 + #define CMD_FLUSH_QUEUE 48 + #define CMD_TX_ACKNOWLEDGE 50 + #define CMD_CAN_ERROR_EVENT 51 +@@ -258,6 +259,28 @@ struct usbcan_cmd_can_error_event { + __le16 time; + } __packed; + ++/* CMD_ERROR_EVENT error codes */ ++#define KVASER_USB_LEAF_ERROR_EVENT_TX_QUEUE_FULL 0x8 ++#define KVASER_USB_LEAF_ERROR_EVENT_PARAM 0x9 ++ ++struct leaf_cmd_error_event { ++ u8 tid; ++ u8 error_code; ++ __le16 timestamp[3]; ++ __le16 padding; ++ __le16 info1; ++ __le16 info2; ++} __packed; ++ ++struct usbcan_cmd_error_event { ++ u8 tid; ++ u8 error_code; ++ __le16 info1; ++ __le16 info2; ++ __le16 timestamp; ++ __le16 padding; ++} __packed; ++ + struct kvaser_cmd_ctrl_mode { + u8 tid; + u8 channel; +@@ -321,6 +344,7 @@ struct kvaser_cmd { + struct leaf_cmd_chip_state_event chip_state_event; + struct leaf_cmd_can_error_event can_error_event; + struct leaf_cmd_log_message log_message; ++ struct leaf_cmd_error_event error_event; + struct kvaser_cmd_cap_req cap_req; + struct kvaser_cmd_cap_res cap_res; + } __packed leaf; +@@ -330,6 +354,7 @@ struct kvaser_cmd { + struct usbcan_cmd_rx_can rx_can; + struct usbcan_cmd_chip_state_event chip_state_event; + struct usbcan_cmd_can_error_event can_error_event; ++ struct usbcan_cmd_error_event error_event; + } __packed usbcan; + + struct kvaser_cmd_tx_can tx_can; +@@ -353,6 +378,7 @@ static const u8 kvaser_usb_leaf_cmd_sizes_leaf[] = { + [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.leaf.chip_state_event), + [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.leaf.can_error_event), + [CMD_GET_CAPABILITIES_RESP] = kvaser_fsize(u.leaf.cap_res), ++ [CMD_ERROR_EVENT] = kvaser_fsize(u.leaf.error_event), + /* ignored events: */ + [CMD_FLUSH_QUEUE_REPLY] = CMD_SIZE_ANY, + }; +@@ -367,6 +393,7 @@ static const u8 kvaser_usb_leaf_cmd_sizes_usbcan[] = { + [CMD_RX_EXT_MESSAGE] = kvaser_fsize(u.usbcan.rx_can), + [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.usbcan.chip_state_event), + [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.usbcan.can_error_event), ++ [CMD_ERROR_EVENT] = kvaser_fsize(u.usbcan.error_event), + /* ignored events: */ + [CMD_USBCAN_CLOCK_OVERFLOW_EVENT] = CMD_SIZE_ANY, + }; +@@ -1304,6 +1331,74 @@ static void kvaser_usb_leaf_rx_can_msg(const struct kvaser_usb *dev, + netif_rx(skb); + } + ++static void kvaser_usb_leaf_error_event_parameter(const struct kvaser_usb *dev, ++ const struct kvaser_cmd *cmd) ++{ ++ u16 info1 = 0; ++ ++ switch (dev->driver_info->family) { ++ case KVASER_LEAF: ++ info1 = le16_to_cpu(cmd->u.leaf.error_event.info1); ++ break; ++ case KVASER_USBCAN: ++ info1 = le16_to_cpu(cmd->u.usbcan.error_event.info1); ++ break; ++ } ++ ++ /* info1 will contain the offending cmd_no */ ++ switch (info1) { ++ case CMD_SET_CTRL_MODE: ++ dev_warn(&dev->intf->dev, ++ "CMD_SET_CTRL_MODE error in parameter\n"); ++ break; ++ ++ case CMD_SET_BUS_PARAMS: ++ dev_warn(&dev->intf->dev, ++ "CMD_SET_BUS_PARAMS error in parameter\n"); ++ break; ++ ++ default: ++ dev_warn(&dev->intf->dev, ++ "Unhandled parameter error event cmd_no (%u)\n", ++ info1); ++ break; ++ } ++} ++ ++static void kvaser_usb_leaf_error_event(const struct kvaser_usb *dev, ++ const struct kvaser_cmd *cmd) ++{ ++ u8 error_code = 0; ++ ++ switch (dev->driver_info->family) { ++ case KVASER_LEAF: ++ error_code = cmd->u.leaf.error_event.error_code; ++ break; ++ case KVASER_USBCAN: ++ error_code = cmd->u.usbcan.error_event.error_code; ++ break; ++ } ++ ++ switch (error_code) { ++ case KVASER_USB_LEAF_ERROR_EVENT_TX_QUEUE_FULL: ++ /* Received additional CAN message, when firmware TX queue is ++ * already full. Something is wrong with the driver. ++ * This should never happen! ++ */ ++ dev_err(&dev->intf->dev, ++ "Received error event TX_QUEUE_FULL\n"); ++ break; ++ case KVASER_USB_LEAF_ERROR_EVENT_PARAM: ++ kvaser_usb_leaf_error_event_parameter(dev, cmd); ++ break; ++ ++ default: ++ dev_warn(&dev->intf->dev, ++ "Unhandled error event (%d)\n", error_code); ++ break; ++ } ++} ++ + static void kvaser_usb_leaf_start_chip_reply(const struct kvaser_usb *dev, + const struct kvaser_cmd *cmd) + { +@@ -1382,6 +1477,10 @@ static void kvaser_usb_leaf_handle_command(const struct kvaser_usb *dev, + kvaser_usb_leaf_tx_acknowledge(dev, cmd); + break; + ++ case CMD_ERROR_EVENT: ++ kvaser_usb_leaf_error_event(dev, cmd); ++ break; ++ + /* Ignored commands */ + case CMD_USBCAN_CLOCK_OVERFLOW_EVENT: + if (dev->driver_info->family != KVASER_USBCAN) +-- +2.35.3 + diff --git a/patches.suse/can-kvaser_usb-kvaser_usb_leaf-Rename-leaf-usbcan-_c.patch b/patches.suse/can-kvaser_usb-kvaser_usb_leaf-Rename-leaf-usbcan-_c.patch new file mode 100644 index 0000000..e4902c5 --- /dev/null +++ b/patches.suse/can-kvaser_usb-kvaser_usb_leaf-Rename-leaf-usbcan-_c.patch @@ -0,0 +1,135 @@ +From 7ea56128dbf904a3359bcf9289cccdfa3c85c7e8 Mon Sep 17 00:00:00 2001 +From: Jimmy Assarsson +Date: Mon, 10 Oct 2022 20:52:29 +0200 +Subject: [PATCH] can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event +Git-commit: 7ea56128dbf904a3359bcf9289cccdfa3c85c7e8 +Patch-mainline: v6.2-rc1 +References: git-fixes + +Prepare for handling CMD_ERROR_EVENT. Rename struct +{leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event. + +Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") +Reported-by: Anssi Hannula +Tested-by: Anssi Hannula +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/all/20221010185237.319219-4-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Acked-by: Takashi Iwai + +--- + .../net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 38 +++++++++---------- + 1 file changed, 19 insertions(+), 19 deletions(-) + +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +index c87b13dc1048..f34ca9a850aa 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -234,7 +234,7 @@ struct kvaser_cmd_tx_acknowledge_header { + u8 tid; + } __packed; + +-struct leaf_cmd_error_event { ++struct leaf_cmd_can_error_event { + u8 tid; + u8 flags; + __le16 time[3]; +@@ -246,7 +246,7 @@ struct leaf_cmd_error_event { + u8 error_factor; + } __packed; + +-struct usbcan_cmd_error_event { ++struct usbcan_cmd_can_error_event { + u8 tid; + u8 padding; + u8 tx_errors_count_ch0; +@@ -319,7 +319,7 @@ struct kvaser_cmd { + struct leaf_cmd_softinfo softinfo; + struct leaf_cmd_rx_can rx_can; + struct leaf_cmd_chip_state_event chip_state_event; +- struct leaf_cmd_error_event error_event; ++ struct leaf_cmd_can_error_event can_error_event; + struct leaf_cmd_log_message log_message; + struct kvaser_cmd_cap_req cap_req; + struct kvaser_cmd_cap_res cap_res; +@@ -329,7 +329,7 @@ struct kvaser_cmd { + struct usbcan_cmd_softinfo softinfo; + struct usbcan_cmd_rx_can rx_can; + struct usbcan_cmd_chip_state_event chip_state_event; +- struct usbcan_cmd_error_event error_event; ++ struct usbcan_cmd_can_error_event can_error_event; + } __packed usbcan; + + struct kvaser_cmd_tx_can tx_can; +@@ -351,7 +351,7 @@ static const u8 kvaser_usb_leaf_cmd_sizes_leaf[] = { + [CMD_RX_EXT_MESSAGE] = kvaser_fsize(u.leaf.rx_can), + [CMD_LEAF_LOG_MESSAGE] = kvaser_fsize(u.leaf.log_message), + [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.leaf.chip_state_event), +- [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.leaf.error_event), ++ [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.leaf.can_error_event), + [CMD_GET_CAPABILITIES_RESP] = kvaser_fsize(u.leaf.cap_res), + /* ignored events: */ + [CMD_FLUSH_QUEUE_REPLY] = CMD_SIZE_ANY, +@@ -366,7 +366,7 @@ static const u8 kvaser_usb_leaf_cmd_sizes_usbcan[] = { + [CMD_RX_STD_MESSAGE] = kvaser_fsize(u.usbcan.rx_can), + [CMD_RX_EXT_MESSAGE] = kvaser_fsize(u.usbcan.rx_can), + [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.usbcan.chip_state_event), +- [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.usbcan.error_event), ++ [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.usbcan.can_error_event), + /* ignored events: */ + [CMD_USBCAN_CLOCK_OVERFLOW_EVENT] = CMD_SIZE_ANY, + }; +@@ -1132,11 +1132,11 @@ static void kvaser_usb_leaf_usbcan_rx_error(const struct kvaser_usb *dev, + + case CMD_CAN_ERROR_EVENT: + es.channel = 0; +- es.status = cmd->u.usbcan.error_event.status_ch0; +- es.txerr = cmd->u.usbcan.error_event.tx_errors_count_ch0; +- es.rxerr = cmd->u.usbcan.error_event.rx_errors_count_ch0; ++ es.status = cmd->u.usbcan.can_error_event.status_ch0; ++ es.txerr = cmd->u.usbcan.can_error_event.tx_errors_count_ch0; ++ es.rxerr = cmd->u.usbcan.can_error_event.rx_errors_count_ch0; + es.usbcan.other_ch_status = +- cmd->u.usbcan.error_event.status_ch1; ++ cmd->u.usbcan.can_error_event.status_ch1; + kvaser_usb_leaf_usbcan_conditionally_rx_error(dev, &es); + + /* The USBCAN firmware supports up to 2 channels. +@@ -1144,13 +1144,13 @@ static void kvaser_usb_leaf_usbcan_rx_error(const struct kvaser_usb *dev, + */ + if (dev->nchannels == MAX_USBCAN_NET_DEVICES) { + es.channel = 1; +- es.status = cmd->u.usbcan.error_event.status_ch1; ++ es.status = cmd->u.usbcan.can_error_event.status_ch1; + es.txerr = +- cmd->u.usbcan.error_event.tx_errors_count_ch1; ++ cmd->u.usbcan.can_error_event.tx_errors_count_ch1; + es.rxerr = +- cmd->u.usbcan.error_event.rx_errors_count_ch1; ++ cmd->u.usbcan.can_error_event.rx_errors_count_ch1; + es.usbcan.other_ch_status = +- cmd->u.usbcan.error_event.status_ch0; ++ cmd->u.usbcan.can_error_event.status_ch0; + kvaser_usb_leaf_usbcan_conditionally_rx_error(dev, &es); + } + break; +@@ -1167,11 +1167,11 @@ static void kvaser_usb_leaf_leaf_rx_error(const struct kvaser_usb *dev, + + switch (cmd->id) { + case CMD_CAN_ERROR_EVENT: +- es.channel = cmd->u.leaf.error_event.channel; +- es.status = cmd->u.leaf.error_event.status; +- es.txerr = cmd->u.leaf.error_event.tx_errors_count; +- es.rxerr = cmd->u.leaf.error_event.rx_errors_count; +- es.leaf.error_factor = cmd->u.leaf.error_event.error_factor; ++ es.channel = cmd->u.leaf.can_error_event.channel; ++ es.status = cmd->u.leaf.can_error_event.status; ++ es.txerr = cmd->u.leaf.can_error_event.tx_errors_count; ++ es.rxerr = cmd->u.leaf.can_error_event.rx_errors_count; ++ es.leaf.error_factor = cmd->u.leaf.can_error_event.error_factor; + break; + case CMD_LEAF_LOG_MESSAGE: + es.channel = cmd->u.leaf.log_message.channel; +-- +2.35.3 + diff --git a/patches.suse/can-kvaser_usb_leaf-Fix-overread-with-an-invalid-com.patch b/patches.suse/can-kvaser_usb_leaf-Fix-overread-with-an-invalid-com.patch new file mode 100644 index 0000000..24cc802 --- /dev/null +++ b/patches.suse/can-kvaser_usb_leaf-Fix-overread-with-an-invalid-com.patch @@ -0,0 +1,143 @@ +From 1499ecaea9d2ba68d5e18d80573b4561a8dc4ee7 Mon Sep 17 00:00:00 2001 +From: Anssi Hannula +Date: Mon, 10 Oct 2022 17:08:26 +0200 +Subject: [PATCH] can: kvaser_usb_leaf: Fix overread with an invalid command +Git-commit: 1499ecaea9d2ba68d5e18d80573b4561a8dc4ee7 +Patch-mainline: v6.1-rc1 +References: git-fixes + +For command events read from the device, +kvaser_usb_leaf_read_bulk_callback() verifies that cmd->len does not +exceed the size of the received data, but the actual kvaser_cmd handlers +will happily read any kvaser_cmd fields without checking for cmd->len. + +This can cause an overread if the last cmd in the buffer is shorter than +expected for the command type (with cmd->len showing the actual short +size). + +Maximum overread seems to be 22 bytes (CMD_LEAF_LOG_MESSAGE), some of +which are delivered to userspace as-is. + +Fix that by verifying the length of command before handling it. + +This issue can only occur after RX URBs have been set up, i.e. the +interface has been opened at least once. + +Cc: stable@vger.kernel.org +Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") +Tested-by: Jimmy Assarsson +Signed-off-by: Anssi Hannula +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/all/20221010150829.199676-2-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Acked-by: Takashi Iwai + +--- + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 75 +++++++++++++++++++++++ + 1 file changed, 75 insertions(+) + +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -310,6 +310,38 @@ struct kvaser_cmd { + } u; + } __packed; + ++#define CMD_SIZE_ANY 0xff ++#define kvaser_fsize(field) sizeof_field(struct kvaser_cmd, field) ++ ++static const u8 kvaser_usb_leaf_cmd_sizes_leaf[] = { ++ [CMD_START_CHIP_REPLY] = kvaser_fsize(u.simple), ++ [CMD_STOP_CHIP_REPLY] = kvaser_fsize(u.simple), ++ [CMD_GET_CARD_INFO_REPLY] = kvaser_fsize(u.cardinfo), ++ [CMD_TX_ACKNOWLEDGE] = kvaser_fsize(u.tx_acknowledge_header), ++ [CMD_GET_SOFTWARE_INFO_REPLY] = kvaser_fsize(u.leaf.softinfo), ++ [CMD_RX_STD_MESSAGE] = kvaser_fsize(u.leaf.rx_can), ++ [CMD_RX_EXT_MESSAGE] = kvaser_fsize(u.leaf.rx_can), ++ [CMD_LEAF_LOG_MESSAGE] = kvaser_fsize(u.leaf.log_message), ++ [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.leaf.chip_state_event), ++ [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.leaf.error_event), ++ /* ignored events: */ ++ [CMD_FLUSH_QUEUE_REPLY] = CMD_SIZE_ANY, ++}; ++ ++static const u8 kvaser_usb_leaf_cmd_sizes_usbcan[] = { ++ [CMD_START_CHIP_REPLY] = kvaser_fsize(u.simple), ++ [CMD_STOP_CHIP_REPLY] = kvaser_fsize(u.simple), ++ [CMD_GET_CARD_INFO_REPLY] = kvaser_fsize(u.cardinfo), ++ [CMD_TX_ACKNOWLEDGE] = kvaser_fsize(u.tx_acknowledge_header), ++ [CMD_GET_SOFTWARE_INFO_REPLY] = kvaser_fsize(u.usbcan.softinfo), ++ [CMD_RX_STD_MESSAGE] = kvaser_fsize(u.usbcan.rx_can), ++ [CMD_RX_EXT_MESSAGE] = kvaser_fsize(u.usbcan.rx_can), ++ [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.usbcan.chip_state_event), ++ [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.usbcan.error_event), ++ /* ignored events: */ ++ [CMD_USBCAN_CLOCK_OVERFLOW_EVENT] = CMD_SIZE_ANY, ++}; ++ + /* Summary of a kvaser error event, for a unified Leaf/Usbcan error + * handling. Some discrepancies between the two families exist: + * +@@ -397,6 +429,43 @@ static const struct kvaser_usb_dev_cfg k + .bittiming_const = &kvaser_usb_flexc_bittiming_const, + }; + ++static int kvaser_usb_leaf_verify_size(const struct kvaser_usb *dev, ++ const struct kvaser_cmd *cmd) ++{ ++ /* buffer size >= cmd->len ensured by caller */ ++ u8 min_size = 0; ++ ++ switch (dev->driver_info->family) { ++ case KVASER_LEAF: ++ if (cmd->id < ARRAY_SIZE(kvaser_usb_leaf_cmd_sizes_leaf)) ++ min_size = kvaser_usb_leaf_cmd_sizes_leaf[cmd->id]; ++ break; ++ case KVASER_USBCAN: ++ if (cmd->id < ARRAY_SIZE(kvaser_usb_leaf_cmd_sizes_usbcan)) ++ min_size = kvaser_usb_leaf_cmd_sizes_usbcan[cmd->id]; ++ break; ++ } ++ ++ if (min_size == CMD_SIZE_ANY) ++ return 0; ++ ++ if (min_size) { ++ min_size += CMD_HEADER_LEN; ++ if (cmd->len >= min_size) ++ return 0; ++ ++ dev_err_ratelimited(&dev->intf->dev, ++ "Received command %u too short (size %u, needed %u)", ++ cmd->id, cmd->len, min_size); ++ return -EIO; ++ } ++ ++ dev_warn_ratelimited(&dev->intf->dev, ++ "Unhandled command (%d, size %d)\n", ++ cmd->id, cmd->len); ++ return -EINVAL; ++} ++ + static void * + kvaser_usb_leaf_frame_to_cmd(const struct kvaser_usb_net_priv *priv, + const struct sk_buff *skb, int *frame_len, +@@ -504,6 +573,9 @@ static int kvaser_usb_leaf_wait_cmd(cons + end: + kfree(buf); + ++ if (err == 0) ++ err = kvaser_usb_leaf_verify_size(dev, cmd); ++ + return err; + } + +@@ -1135,6 +1207,9 @@ static void kvaser_usb_leaf_stop_chip_re + static void kvaser_usb_leaf_handle_command(const struct kvaser_usb *dev, + const struct kvaser_cmd *cmd) + { ++ if (kvaser_usb_leaf_verify_size(dev, cmd) < 0) ++ return; ++ + switch (cmd->id) { + case CMD_START_CHIP_REPLY: + kvaser_usb_leaf_start_chip_reply(dev, cmd); diff --git a/patches.suse/cassini-Fix-a-memory-leak-in-the-error-handling-path.patch b/patches.suse/cassini-Fix-a-memory-leak-in-the-error-handling-path.patch new file mode 100644 index 0000000..a0c3d9e --- /dev/null +++ b/patches.suse/cassini-Fix-a-memory-leak-in-the-error-handling-path.patch @@ -0,0 +1,41 @@ +From 412cd77a2c24b191c65ea53025222418db09817c Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Mon, 15 May 2023 21:09:11 +0200 +Subject: [PATCH] cassini: Fix a memory leak in the error handling path of cas_init_one() +Git-commit: 412cd77a2c24b191c65ea53025222418db09817c +Patch-mainline: v6.4-rc3 +References: git-fixes + +cas_saturn_firmware_init() allocates some memory using vmalloc(). This +memory is freed in the .remove() function but not it the error handling +path of the probe. + +Add the missing vfree() to avoid a memory leak, should an error occur. + +Fixes: fcaa40669cd7 ("cassini: use request_firmware") +Signed-off-by: Christophe JAILLET +Reviewed-by: Pavan Chebbi +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Acked-by: Takashi Iwai + +--- + drivers/net/ethernet/sun/cassini.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/sun/cassini.c b/drivers/net/ethernet/sun/cassini.c +index 4ef05bad4613..d61dfa250feb 100644 +--- a/drivers/net/ethernet/sun/cassini.c ++++ b/drivers/net/ethernet/sun/cassini.c +@@ -5077,6 +5077,8 @@ static int cas_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + cas_shutdown(cp); + mutex_unlock(&cp->pm_mutex); + ++ vfree(cp->fw_data); ++ + pci_iounmap(pdev, cp->regs); + + +-- +2.35.3 + diff --git a/patches.suse/clk-tegra20-fix-gcc-7-constant-overflow-warning.patch b/patches.suse/clk-tegra20-fix-gcc-7-constant-overflow-warning.patch new file mode 100644 index 0000000..f6fa6cd --- /dev/null +++ b/patches.suse/clk-tegra20-fix-gcc-7-constant-overflow-warning.patch @@ -0,0 +1,74 @@ +From b4a2adbf3586efa12fe78b9dec047423e01f3010 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 27 Feb 2023 09:59:10 +0100 +Subject: [PATCH] clk: tegra20: fix gcc-7 constant overflow warning +Git-commit: b4a2adbf3586efa12fe78b9dec047423e01f3010 +Patch-mainline: v6.4-rc1 +References: git-fixes + +Older gcc versions get confused by comparing a u32 value to a negative +constant in a switch()/case block: + +Drivers/clk/tegra/clk-tegra20.c: In function 'tegra20_clk_measure_input_freq': +drivers/clk/tegra/clk-tegra20.c:581:2: error: case label does not reduce to an integer constant + case OSC_CTRL_OSC_FREQ_12MHZ: + ^~~~ +drivers/clk/tegra/clk-tegra20.c:593:2: error: case label does not reduce to an integer constant + case OSC_CTRL_OSC_FREQ_26MHZ: + +Make the constants unsigned instead. + +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20230227085914.2560984-1-arnd@kernel.org +Signed-off-by: Stephen Boyd +Acked-by: Takashi Iwai + +--- + drivers/clk/tegra/clk-tegra20.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +diff --git a/drivers/clk/tegra/clk-tegra20.c b/drivers/clk/tegra/clk-tegra20.c +index 422d78247553..dcacc5064d33 100644 +--- a/drivers/clk/tegra/clk-tegra20.c ++++ b/drivers/clk/tegra/clk-tegra20.c +@@ -21,24 +21,24 @@ + #define MISC_CLK_ENB 0x48 + + #define OSC_CTRL 0x50 +-#define OSC_CTRL_OSC_FREQ_MASK (3<<30) +-#define OSC_CTRL_OSC_FREQ_13MHZ (0<<30) +-#define OSC_CTRL_OSC_FREQ_19_2MHZ (1<<30) +-#define OSC_CTRL_OSC_FREQ_12MHZ (2<<30) +-#define OSC_CTRL_OSC_FREQ_26MHZ (3<<30) +-#define OSC_CTRL_MASK (0x3f2 | OSC_CTRL_OSC_FREQ_MASK) ++#define OSC_CTRL_OSC_FREQ_MASK (3u<<30) ++#define OSC_CTRL_OSC_FREQ_13MHZ (0u<<30) ++#define OSC_CTRL_OSC_FREQ_19_2MHZ (1u<<30) ++#define OSC_CTRL_OSC_FREQ_12MHZ (2u<<30) ++#define OSC_CTRL_OSC_FREQ_26MHZ (3u<<30) ++#define OSC_CTRL_MASK (0x3f2u | OSC_CTRL_OSC_FREQ_MASK) + +-#define OSC_CTRL_PLL_REF_DIV_MASK (3<<28) +-#define OSC_CTRL_PLL_REF_DIV_1 (0<<28) +-#define OSC_CTRL_PLL_REF_DIV_2 (1<<28) +-#define OSC_CTRL_PLL_REF_DIV_4 (2<<28) ++#define OSC_CTRL_PLL_REF_DIV_MASK (3u<<28) ++#define OSC_CTRL_PLL_REF_DIV_1 (0u<<28) ++#define OSC_CTRL_PLL_REF_DIV_2 (1u<<28) ++#define OSC_CTRL_PLL_REF_DIV_4 (2u<<28) + + #define OSC_FREQ_DET 0x58 +-#define OSC_FREQ_DET_TRIG (1<<31) ++#define OSC_FREQ_DET_TRIG (1u<<31) + + #define OSC_FREQ_DET_STATUS 0x5c +-#define OSC_FREQ_DET_BUSY (1<<31) +-#define OSC_FREQ_DET_CNT_MASK 0xFFFF ++#define OSC_FREQ_DET_BUSYu (1<<31) ++#define OSC_FREQ_DET_CNT_MASK 0xFFFFu + + #define TEGRA20_CLK_PERIPH_BANKS 3 + +-- +2.35.3 + diff --git a/patches.suse/configfs-fix-possible-memory-leak-in-configfs_create.patch b/patches.suse/configfs-fix-possible-memory-leak-in-configfs_create.patch new file mode 100644 index 0000000..c2bd1e7 --- /dev/null +++ b/patches.suse/configfs-fix-possible-memory-leak-in-configfs_create.patch @@ -0,0 +1,102 @@ +From c65234b283a65cfbfc94619655e820a5e55199eb Mon Sep 17 00:00:00 2001 +From: Chen Zhongjin +Date: Mon, 17 Oct 2022 09:42:30 +0800 +Subject: [PATCH] configfs: fix possible memory leak in configfs_create_dir() +Git-commit: c65234b283a65cfbfc94619655e820a5e55199eb +Patch-mainline: v6.2-rc1 +References: git-fixes + +kmemleak reported memory leaks in configfs_create_dir(): + +unreferenced object 0xffff888009f6af00 (size 192): + comm "modprobe", pid 3777, jiffies 4295537735 (age 233.784s) + backtrace: + kmem_cache_alloc (mm/slub.c:3250 mm/slub.c:3256 mm/slub.c:3263 mm/slub.c:3273) + new_fragment (./include/linux/slab.h:600 fs/configfs/dir.c:163) + configfs_register_subsystem (fs/configfs/dir.c:1857) + basic_write (drivers/hwtracing/stm/p_basic.c:14) stm_p_basic + do_one_initcall (init/main.c:1296) + do_init_module (kernel/module/main.c:2455) + ... + +unreferenced object 0xffff888003ba7180 (size 96): + comm "modprobe", pid 3777, jiffies 4295537735 (age 233.784s) + backtrace: + kmem_cache_alloc (mm/slub.c:3250 mm/slub.c:3256 mm/slub.c:3263 mm/slub.c:3273) + configfs_new_dirent (./include/linux/slab.h:723 fs/configfs/dir.c:194) + configfs_make_dirent (fs/configfs/dir.c:248) + configfs_create_dir (fs/configfs/dir.c:296) + configfs_attach_group.isra.28 (fs/configfs/dir.c:816 fs/configfs/dir.c:852) + configfs_register_subsystem (fs/configfs/dir.c:1881) + basic_write (drivers/hwtracing/stm/p_basic.c:14) stm_p_basic + do_one_initcall (init/main.c:1296) + do_init_module (kernel/module/main.c:2455) + ... + +This is because the refcount is not correct in configfs_make_dirent(). +For normal stage, the refcount is changing as: + +configfs_register_subsystem() + configfs_create_dir() + configfs_make_dirent() + configfs_new_dirent() # set s_count = 1 + dentry->d_fsdata = configfs_get(sd); # s_count = 2 +... +configfs_unregister_subsystem() + configfs_remove_dir() + remove_dir() + configfs_remove_dirent() # s_count = 1 + dput() ... + *dentry_unlink_inode()* + configfs_d_iput() # s_count = 0, release + +However, if we failed in configfs_create(): + +configfs_register_subsystem() + configfs_create_dir() + configfs_make_dirent() # s_count = 2 + ... + configfs_create() # fail + ->out_remove: + configfs_remove_dirent(dentry) + configfs_put(sd) # s_count = 1 + return PTR_ERR(inode); + +There is no inode in the error path, so the configfs_d_iput() is lost +and makes sd and fragment memory leaked. + +To fix this, when we failed in configfs_create(), manually call +configfs_put(sd) to keep the refcount correct. + +Fixes: 7063fbf22611 ("[PATCH] configfs: User-driven configuration filesystem") +Signed-off-by: Chen Zhongjin +Signed-off-by: Christoph Hellwig +Acked-by: Takashi Iwai + +--- + fs/configfs/dir.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c +index d1f9d2632202..ec6519e1ca3b 100644 +--- a/fs/configfs/dir.c ++++ b/fs/configfs/dir.c +@@ -316,6 +316,7 @@ static int configfs_create_dir(struct config_item *item, struct dentry *dentry, + return 0; + + out_remove: ++ configfs_put(dentry->d_fsdata); + configfs_remove_dirent(dentry); + return PTR_ERR(inode); + } +@@ -382,6 +383,7 @@ int configfs_create_link(struct configfs_dirent *target, struct dentry *parent, + return 0; + + out_remove: ++ configfs_put(dentry->d_fsdata); + configfs_remove_dirent(dentry); + return PTR_ERR(inode); + } +-- +2.35.3 + diff --git a/patches.suse/debugfs-fix-error-when-writing-negative-value-to-ato.patch b/patches.suse/debugfs-fix-error-when-writing-negative-value-to-ato.patch new file mode 100644 index 0000000..41fd9ff --- /dev/null +++ b/patches.suse/debugfs-fix-error-when-writing-negative-value-to-ato.patch @@ -0,0 +1,188 @@ +From d472cf797c4e268613dbce5ec9b95d0bcae19ecb Mon Sep 17 00:00:00 2001 +From: Akinobu Mita +Date: Tue, 20 Sep 2022 02:24:18 +0900 +Subject: [PATCH] debugfs: fix error when writing negative value to atomic_t debugfs file +Git-commit: d472cf797c4e268613dbce5ec9b95d0bcae19ecb +Patch-mainline: v6.2-rc1 +References: git-fixes + +The simple attribute files do not accept a negative value since the commit +488dac0c9237 ("libfs: fix error cast of negative value in +simple_attr_write()"), so we have to use a 64-bit value to write a +negative value for a debugfs file created by debugfs_create_atomic_t(). + +This restores the previous behaviour by introducing +DEFINE_DEBUGFS_ATTRIBUTE_SIGNED for a signed value. + +Link: https://lkml.kernel.org/r/20220919172418.45257-4-akinobu.mita@gmail.com +Fixes: 488dac0c9237 ("libfs: fix error cast of negative value in simple_attr_write()") +Signed-off-by: Akinobu Mita +Reported-by: Zhao Gongyi +Reviewed-by: David Hildenbrand +Reviewed-by: Greg Kroah-Hartman +Cc: Alexander Viro +Cc: Jonathan Corbet +Cc: Oscar Salvador +Cc: Rafael J. Wysocki +Cc: Shuah Khan +Cc: Wei Yongjun +Cc: Yicong Yang +Signed-off-by: Andrew Morton +Acked-by: Takashi Iwai + +--- + Documentation/fault-injection/fault-injection.rst | 10 +++---- + fs/debugfs/file.c | 28 +++++++++++++++++----- + include/linux/debugfs.h | 19 +++++++++++++- + 3 files changed, 43 insertions(+), 14 deletions(-) + +--- a/Documentation/fault-injection/fault-injection.rst ++++ b/Documentation/fault-injection/fault-injection.rst +@@ -79,9 +79,7 @@ configuration of fault-injection capabil + - /sys/kernel/debug/fail*/times: + + specifies how many times failures may happen at most. A value of -1 +- means "no limit". Note, though, that this file only accepts unsigned +- values. So, if you want to specify -1, you better use 'printf' instead +- of 'echo', e.g.: $ printf %#x -1 > times ++ means "no limit". + + - /sys/kernel/debug/fail*/space: + +@@ -259,7 +257,7 @@ Application Examples + echo Y > /sys/kernel/debug/$FAILTYPE/task-filter + echo 10 > /sys/kernel/debug/$FAILTYPE/probability + echo 100 > /sys/kernel/debug/$FAILTYPE/interval +- printf %#x -1 > /sys/kernel/debug/$FAILTYPE/times ++ echo -1 > /sys/kernel/debug/$FAILTYPE/times + echo 0 > /sys/kernel/debug/$FAILTYPE/space + echo 2 > /sys/kernel/debug/$FAILTYPE/verbose + echo 1 > /sys/kernel/debug/$FAILTYPE/ignore-gfp-wait +@@ -313,7 +311,7 @@ Application Examples + echo N > /sys/kernel/debug/$FAILTYPE/task-filter + echo 10 > /sys/kernel/debug/$FAILTYPE/probability + echo 100 > /sys/kernel/debug/$FAILTYPE/interval +- printf %#x -1 > /sys/kernel/debug/$FAILTYPE/times ++ echo -1 > /sys/kernel/debug/$FAILTYPE/times + echo 0 > /sys/kernel/debug/$FAILTYPE/space + echo 2 > /sys/kernel/debug/$FAILTYPE/verbose + echo 1 > /sys/kernel/debug/$FAILTYPE/ignore-gfp-wait +@@ -344,7 +342,7 @@ Application Examples + echo N > /sys/kernel/debug/$FAILTYPE/task-filter + echo 100 > /sys/kernel/debug/$FAILTYPE/probability + echo 0 > /sys/kernel/debug/$FAILTYPE/interval +- printf %#x -1 > /sys/kernel/debug/$FAILTYPE/times ++ echo -1 > /sys/kernel/debug/$FAILTYPE/times + echo 0 > /sys/kernel/debug/$FAILTYPE/space + echo 1 > /sys/kernel/debug/$FAILTYPE/verbose + +--- a/fs/debugfs/file.c ++++ b/fs/debugfs/file.c +@@ -378,8 +378,8 @@ ssize_t debugfs_attr_read(struct file *f + } + EXPORT_SYMBOL_GPL(debugfs_attr_read); + +-ssize_t debugfs_attr_write(struct file *file, const char __user *buf, +- size_t len, loff_t *ppos) ++static ssize_t debugfs_attr_write_xsigned(struct file *file, const char __user *buf, ++ size_t len, loff_t *ppos, bool is_signed) + { + struct dentry *dentry = F_DENTRY(file); + ssize_t ret; +@@ -387,12 +387,28 @@ ssize_t debugfs_attr_write(struct file * + ret = debugfs_file_get(dentry); + if (unlikely(ret)) + return ret; +- ret = simple_attr_write(file, buf, len, ppos); ++ if (is_signed) ++ ret = simple_attr_write_signed(file, buf, len, ppos); ++ else ++ ret = simple_attr_write(file, buf, len, ppos); + debugfs_file_put(dentry); + return ret; + } ++ ++ssize_t debugfs_attr_write(struct file *file, const char __user *buf, ++ size_t len, loff_t *ppos) ++{ ++ return debugfs_attr_write_xsigned(file, buf, len, ppos, false); ++} + EXPORT_SYMBOL_GPL(debugfs_attr_write); + ++ssize_t debugfs_attr_write_signed(struct file *file, const char __user *buf, ++ size_t len, loff_t *ppos) ++{ ++ return debugfs_attr_write_xsigned(file, buf, len, ppos, true); ++} ++EXPORT_SYMBOL_GPL(debugfs_attr_write_signed); ++ + static struct dentry *debugfs_create_mode_unsafe(const char *name, umode_t mode, + struct dentry *parent, void *value, + const struct file_operations *fops, +@@ -738,11 +754,11 @@ static int debugfs_atomic_t_get(void *da + *val = atomic_read((atomic_t *)data); + return 0; + } +-DEFINE_DEBUGFS_ATTRIBUTE(fops_atomic_t, debugfs_atomic_t_get, ++DEFINE_DEBUGFS_ATTRIBUTE_SIGNED(fops_atomic_t, debugfs_atomic_t_get, + debugfs_atomic_t_set, "%lld\n"); +-DEFINE_DEBUGFS_ATTRIBUTE(fops_atomic_t_ro, debugfs_atomic_t_get, NULL, ++DEFINE_DEBUGFS_ATTRIBUTE_SIGNED(fops_atomic_t_ro, debugfs_atomic_t_get, NULL, + "%lld\n"); +-DEFINE_DEBUGFS_ATTRIBUTE(fops_atomic_t_wo, NULL, debugfs_atomic_t_set, ++DEFINE_DEBUGFS_ATTRIBUTE_SIGNED(fops_atomic_t_wo, NULL, debugfs_atomic_t_set, + "%lld\n"); + + /** +--- a/include/linux/debugfs.h ++++ b/include/linux/debugfs.h +@@ -45,7 +45,7 @@ struct debugfs_u32_array { + + extern struct dentry *arch_debugfs_dir; + +-#define DEFINE_DEBUGFS_ATTRIBUTE(__fops, __get, __set, __fmt) \ ++#define DEFINE_DEBUGFS_ATTRIBUTE_XSIGNED(__fops, __get, __set, __fmt, __is_signed) \ + static int __fops ## _open(struct inode *inode, struct file *file) \ + { \ + __simple_attr_check_format(__fmt, 0ull); \ +@@ -56,10 +56,16 @@ static const struct file_operations __fo + .open = __fops ## _open, \ + .release = simple_attr_release, \ + .read = debugfs_attr_read, \ +- .write = debugfs_attr_write, \ ++ .write = (__is_signed) ? debugfs_attr_write_signed : debugfs_attr_write, \ + .llseek = no_llseek, \ + } + ++#define DEFINE_DEBUGFS_ATTRIBUTE(__fops, __get, __set, __fmt) \ ++ DEFINE_DEBUGFS_ATTRIBUTE_XSIGNED(__fops, __get, __set, __fmt, false) ++ ++#define DEFINE_DEBUGFS_ATTRIBUTE_SIGNED(__fops, __get, __set, __fmt) \ ++ DEFINE_DEBUGFS_ATTRIBUTE_XSIGNED(__fops, __get, __set, __fmt, true) ++ + typedef struct vfsmount *(*debugfs_automount_t)(struct dentry *, void *); + + #if defined(CONFIG_DEBUG_FS) +@@ -102,6 +108,8 @@ ssize_t debugfs_attr_read(struct file *f + size_t len, loff_t *ppos); + ssize_t debugfs_attr_write(struct file *file, const char __user *buf, + size_t len, loff_t *ppos); ++ssize_t debugfs_attr_write_signed(struct file *file, const char __user *buf, ++ size_t len, loff_t *ppos); + + struct dentry *debugfs_rename(struct dentry *old_dir, struct dentry *old_dentry, + struct dentry *new_dir, const char *new_name); +@@ -251,6 +259,13 @@ static inline ssize_t debugfs_attr_write + const char __user *buf, + size_t len, loff_t *ppos) + { ++ return -ENODEV; ++} ++ ++static inline ssize_t debugfs_attr_write_signed(struct file *file, ++ const char __user *buf, ++ size_t len, loff_t *ppos) ++{ + return -ENODEV; + } + diff --git a/patches.suse/drivers-base-component-fix-memory-leak-with-using-de.patch b/patches.suse/drivers-base-component-fix-memory-leak-with-using-de.patch new file mode 100644 index 0000000..64c6028 --- /dev/null +++ b/patches.suse/drivers-base-component-fix-memory-leak-with-using-de.patch @@ -0,0 +1,38 @@ +From 8deb87b1e810dd558371e88ffd44339fbef27870 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Thu, 2 Feb 2023 15:16:20 +0100 +Subject: [PATCH] drivers: base: component: fix memory leak with using debugfs_lookup() +Git-commit: 8deb87b1e810dd558371e88ffd44339fbef27870 +Patch-mainline: v6.3-rc1 +References: git-fixes + +When calling debugfs_lookup() the result must have dput() called on it, +otherwise the memory will leak over time. To make things simpler, just +call debugfs_lookup_and_remove() instead which handles all of the logic +at once. + +Cc: "Rafael J. Wysocki" +Link: https://lore.kernel.org/r/20230202141621.2296458-1-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/base/component.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/component.c b/drivers/base/component.c +index 5eadeac6c532..7dbf14a1d915 100644 +--- a/drivers/base/component.c ++++ b/drivers/base/component.c +@@ -125,7 +125,7 @@ static void component_debugfs_add(struct aggregate_device *m) + + static void component_debugfs_del(struct aggregate_device *m) + { +- debugfs_remove(debugfs_lookup(dev_name(m->parent), component_debugfs_dir)); ++ debugfs_lookup_and_remove(dev_name(m->parent), component_debugfs_dir); + } + + #else +-- +2.35.3 + diff --git a/patches.suse/drivers-base-dd-fix-memory-leak-with-using-debugfs_l.patch b/patches.suse/drivers-base-dd-fix-memory-leak-with-using-debugfs_l.patch new file mode 100644 index 0000000..10d79f2 --- /dev/null +++ b/patches.suse/drivers-base-dd-fix-memory-leak-with-using-debugfs_l.patch @@ -0,0 +1,38 @@ +From 36c893d3a759ae7c91ee7d4871ebfc7504f08c40 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Thu, 2 Feb 2023 15:16:21 +0100 +Subject: [PATCH] drivers: base: dd: fix memory leak with using debugfs_lookup() +Git-commit: 36c893d3a759ae7c91ee7d4871ebfc7504f08c40 +Patch-mainline: v6.3-rc1 +References: git-fixes + +When calling debugfs_lookup() the result must have dput() called on it, +otherwise the memory will leak over time. To make things simpler, just +call debugfs_lookup_and_remove() instead which handles all of the logic +at once. + +Cc: "Rafael J. Wysocki" +Link: https://lore.kernel.org/r/20230202141621.2296458-2-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/base/dd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/dd.c b/drivers/base/dd.c +index 817ef27a78f7..8def2ba08a82 100644 +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -370,7 +370,7 @@ late_initcall(deferred_probe_initcall); + + static void __exit deferred_probe_exit(void) + { +- debugfs_remove_recursive(debugfs_lookup("devices_deferred", NULL)); ++ debugfs_lookup_and_remove("devices_deferred", NULL); + } + __exitcall(deferred_probe_exit); + +-- +2.35.3 + diff --git a/patches.suse/drm-amd-Fix-an-out-of-bounds-error-in-BIOS-parser.patch b/patches.suse/drm-amd-Fix-an-out-of-bounds-error-in-BIOS-parser.patch new file mode 100644 index 0000000..ee51866 --- /dev/null +++ b/patches.suse/drm-amd-Fix-an-out-of-bounds-error-in-BIOS-parser.patch @@ -0,0 +1,49 @@ +From d116db180decec1b21bba31d2ff495ac4d8e1b83 Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Thu, 23 Mar 2023 14:07:06 -0500 +Subject: [PATCH] drm/amd: Fix an out of bounds error in BIOS parser +Git-commit: d116db180decec1b21bba31d2ff495ac4d8e1b83 +Patch-mainline: v6.4-rc1 +References: git-fixes + +The array is hardcoded to 8 in atomfirmware.h, but firmware provides +a bigger one sometimes. Deferencing the larger array causes an out +of bounds error. + +commit 4fc1ba4aa589 ("drm/amd/display: fix array index out of bound error +in bios parser") fixed some of this, but there are two other cases +not covered by it. Fix those as well. + +Reported-by: erhard_f@mailbox.org +Link: https://bugzilla.kernel.org/show_bug.cgi?id=214853 +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2473 +Signed-off-by: Mario Limonciello +Reviewed-by: Harry Wentland +Signed-off-by: Alex Deucher +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +index f0f948501e9a..cce47d3f1a13 100644 +--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c ++++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +@@ -515,11 +515,8 @@ static enum bp_result get_gpio_i2c_info( + info->i2c_slave_address = record->i2c_slave_addr; + + /* TODO: check how to get register offset for en, Y, etc. */ +- info->gpio_info.clk_a_register_index = +- le16_to_cpu( +- header->gpio_pin[table_index].data_a_reg_index); +- info->gpio_info.clk_a_shift = +- header->gpio_pin[table_index].gpio_bitshift; ++ info->gpio_info.clk_a_register_index = le16_to_cpu(pin->data_a_reg_index); ++ info->gpio_info.clk_a_shift = pin->gpio_bitshift; + + return BP_RESULT_OK; + } +-- +2.35.3 + diff --git a/patches.suse/drm-amd-display-Fix-hang-when-skipping-modeset.patch b/patches.suse/drm-amd-display-Fix-hang-when-skipping-modeset.patch new file mode 100644 index 0000000..99b426c --- /dev/null +++ b/patches.suse/drm-amd-display-Fix-hang-when-skipping-modeset.patch @@ -0,0 +1,67 @@ +From da5e14909776edea4462672fb4a3007802d262e7 Mon Sep 17 00:00:00 2001 +From: Aurabindo Pillai +Date: Fri, 24 Mar 2023 10:42:37 -0400 +Subject: [PATCH] drm/amd/display: Fix hang when skipping modeset +Git-commit: da5e14909776edea4462672fb4a3007802d262e7 +Patch-mainline: v6.4-rc1 +References: git-fixes + +[Why&How] + +When skipping full modeset since the only state change was a front porch +change, the DC commit sequence requires extra checks to handle non +existant plane states being asked to be removed from context. + +Reviewed-by: Alvin Lee +Acked-by: Qingqing Zhuo +Signed-off-by: Aurabindo Pillai +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 ++++- + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 +++ + 2 files changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 6cacb76f389e..c432436cd66d 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -7972,6 +7972,8 @@ static void amdgpu_dm_commit_planes(struct drm_atomic_state *state, + continue; + + dc_plane = dm_new_plane_state->dc_state; ++ if (!dc_plane) ++ continue; + + bundle->surface_updates[planes_count].surface = dc_plane; + if (new_pcrtc_state->color_mgmt_changed) { +@@ -9620,8 +9622,9 @@ static int dm_update_plane_state(struct dc *dc, + return -EINVAL; + } + ++ if (dm_old_plane_state->dc_state) ++ dc_plane_state_release(dm_old_plane_state->dc_state); + +- dc_plane_state_release(dm_old_plane_state->dc_state); + dm_new_plane_state->dc_state = NULL; + + *lock_and_validation_needed = true; +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +index 85d54bfb595c..117d80cb36fb 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +@@ -1707,6 +1707,9 @@ bool dc_remove_plane_from_context( + struct dc_stream_status *stream_status = NULL; + struct resource_pool *pool = dc->res_pool; + ++ if (!plane_state) ++ return true; ++ + for (i = 0; i < context->stream_count; i++) + if (context->streams[i] == stream) { + stream_status = &context->stream_status[i]; +-- +2.35.3 + diff --git a/patches.suse/drm-amd-display-Use-DC_LOG_DC-in-the-trasform-pixel-.patch b/patches.suse/drm-amd-display-Use-DC_LOG_DC-in-the-trasform-pixel-.patch new file mode 100644 index 0000000..9239aa4 --- /dev/null +++ b/patches.suse/drm-amd-display-Use-DC_LOG_DC-in-the-trasform-pixel-.patch @@ -0,0 +1,109 @@ +From 7222f5841ff49709ca666b05ff336776e0664a20 Mon Sep 17 00:00:00 2001 +From: Rodrigo Siqueira +Date: Tue, 1 Nov 2022 10:20:09 -0400 +Subject: [PATCH] drm/amd/display: Use DC_LOG_DC in the trasform pixel function +Git-commit: 7222f5841ff49709ca666b05ff336776e0664a20 +Patch-mainline: v6.4-rc1 +References: git-fixes + +[Why & How] +DC now uses a new commit sequence which is more robust since it +addresses cases where we need to reorganize pipes based on planes and +other parameters. As a result, this new commit sequence reset the DC +state by cleaning plane states and re-creating them accordingly with the +need. For this reason, the dce_transform_set_pixel_storage_depth can be +invoked after a plane state is destroyed and before its re-creation. In +this situation and on DCE devices, DC will hit a condition that will +trigger a dmesg log that looks like this: + +Console: switching to colour frame buffer device 240x67 +Acked-by: Takashi Iwai + +------------[ cut here ]------------ +[..] +Hardware name: System manufacturer System Product Name/PRIME X370-PRO, BIOS 5603 07/28/2020 +RIP: 0010:dce_transform_set_pixel_storage_depth+0x3f8/0x480 [amdgpu] +[..] +RSP: 0018:ffffc9000202b850 EFLAGS: 00010293 +RAX: ffffffffa081d100 RBX: ffff888110790000 RCX: 000000000000000c +RDX: ffff888100bedbf8 RSI: 0000000000001a50 RDI: ffff88810463c900 +RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000007 +R10: 0000000000000001 R11: 0000000000000f00 R12: ffff88810f500010 +R13: ffff888100bedbf8 R14: ffff88810f515688 R15: 0000000000000000 +FS: 00007ff0159249c0(0000) GS:ffff88840e940000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007ff01528e550 CR3: 0000000002a10000 CR4: 00000000003506e0 +Call Trace: + + ? dm_write_reg_func+0x21/0x80 [amdgpu 340dadd3f7c8cf4be11cf0bdc850245e99abe0e8] + dc_stream_set_dither_option+0xfb/0x130 [amdgpu 340dadd3f7c8cf4be11cf0bdc850245e99abe0e8] + amdgpu_dm_crtc_configure_crc_source+0x10b/0x190 [amdgpu 340dadd3f7c8cf4be11cf0bdc850245e99abe0e8] + amdgpu_dm_atomic_commit_tail+0x20a8/0x2a90 [amdgpu 340dadd3f7c8cf4be11cf0bdc850245e99abe0e8] + ? free_unref_page_commit+0x98/0x170 + ? free_unref_page+0xcc/0x150 + commit_tail+0x94/0x120 + drm_atomic_helper_commit+0x10f/0x140 + drm_atomic_commit+0x94/0xc0 + ? drm_plane_get_damage_clips.cold+0x1c/0x1c + drm_client_modeset_commit_atomic+0x203/0x250 + drm_client_modeset_commit_locked+0x56/0x150 + drm_client_modeset_commit+0x21/0x40 + drm_fb_helper_lastclose+0x42/0x70 + amdgpu_driver_lastclose_kms+0xa/0x10 [amdgpu 340dadd3f7c8cf4be11cf0bdc850245e99abe0e8] + drm_release+0xda/0x110 + __fput+0x89/0x240 + task_work_run+0x5c/0x90 + do_exit+0x333/0xae0 + do_group_exit+0x2d/0x90 + __x64_sys_exit_group+0x14/0x20 + do_syscall_64+0x5b/0x80 + ? exit_to_user_mode_prepare+0x1e/0x140 + entry_SYSCALL_64_after_hwframe+0x44/0xae +RIP: 0033:0x7ff016ceaca1 +Code: Unable to access opcode bytes at RIP 0x7ff016ceac77. +RSP: 002b:00007ffe7a2357e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 +RAX: ffffffffffffffda RBX: 00007ff016e15a00 RCX: 00007ff016ceaca1 +RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 +RBP: 0000000000000000 R08: ffffffffffffff78 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff016e15a00 +R13: 0000000000000000 R14: 00007ff016e1aee8 R15: 00007ff016e1af00 + + +Since this issue only happens in a transition state on DC, this commit +replace BREAK_TO_DEBUGGER with DC_LOG_DC. + +Reviewed-by: Harry Wentland +Acked-by: Qingqing Zhuo +Signed-off-by: Rodrigo Siqueira +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +--- + drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +index d9fd4ec60588..670d5ab9d998 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +@@ -1009,7 +1009,7 @@ static void dce_transform_set_pixel_storage_depth( + color_depth = COLOR_DEPTH_101010; + pixel_depth = 0; + expan_mode = 1; +- BREAK_TO_DEBUGGER(); ++ DC_LOG_DC("The pixel depth %d is not valid, set COLOR_DEPTH_101010 instead.", depth); + break; + } + +@@ -1023,8 +1023,7 @@ static void dce_transform_set_pixel_storage_depth( + if (!(xfm_dce->lb_pixel_depth_supported & depth)) { + /*we should use unsupported capabilities + * unless it is required by w/a*/ +- DC_LOG_WARNING("%s: Capability not supported", +- __func__); ++ DC_LOG_DC("%s: Capability not supported", __func__); + } + } + +-- +2.35.3 + diff --git a/patches.suse/drm-amdgpu-disable-sdma-ecc-irq-only-when-sdma-RAS-i.patch b/patches.suse/drm-amdgpu-disable-sdma-ecc-irq-only-when-sdma-RAS-i.patch new file mode 100644 index 0000000..44e390b --- /dev/null +++ b/patches.suse/drm-amdgpu-disable-sdma-ecc-irq-only-when-sdma-RAS-i.patch @@ -0,0 +1,65 @@ +From 8b229ada2669b74fdae06c83fbfda5a5a99fc253 Mon Sep 17 00:00:00 2001 +From: Guchun Chen +Date: Sat, 6 May 2023 16:52:59 +0800 +Subject: [PATCH] drm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspend +Git-commit: 8b229ada2669b74fdae06c83fbfda5a5a99fc253 +Patch-mainline: v6.4-rc2 +References: git-fixes + +sdma_v4_0_ip is shared on a few asics, but in sdma_v4_0_hw_fini, +driver unconditionally disables ecc_irq which is only enabled on +those asics enabling sdma ecc. This will introduce a warning in +suspend cycle on those chips with sdma ip v4.0, while without +sdma ecc. So this patch correct this. + +[ 7283.166354] RIP: 0010:amdgpu_irq_put+0x45/0x70 [amdgpu] +[ 7283.167001] RSP: 0018:ffff9a5fc3967d08 EFLAGS: 00010246 +[ 7283.167019] RAX: ffff98d88afd3770 RBX: 0000000000000001 RCX: 0000000000000000 +[ 7283.167023] RDX: 0000000000000000 RSI: ffff98d89da30390 RDI: ffff98d89da20000 +[ 7283.167025] RBP: ffff98d89da20000 R08: 0000000000036838 R09: 0000000000000006 +[ 7283.167028] R10: ffffd5764243c008 R11: 0000000000000000 R12: ffff98d89da30390 +[ 7283.167030] R13: ffff98d89da38978 R14: ffffffff999ae15a R15: ffff98d880130105 +[ 7283.167032] FS: 0000000000000000(0000) GS:ffff98d996f00000(0000) knlGS:0000000000000000 +[ 7283.167036] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 7283.167039] CR2: 00000000f7a9d178 CR3: 00000001c42ea000 CR4: 00000000003506e0 +[ 7283.167041] Call Trace: +[ 7283.167046] +[ 7283.167048] sdma_v4_0_hw_fini+0x38/0xa0 [amdgpu] +[ 7283.167704] amdgpu_device_ip_suspend_phase2+0x101/0x1a0 [amdgpu] +[ 7283.168296] amdgpu_device_suspend+0x103/0x180 [amdgpu] +[ 7283.168875] amdgpu_pmops_freeze+0x21/0x60 [amdgpu] +[ 7283.169464] pci_pm_freeze+0x54/0xc0 + +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2522 +Signed-off-by: Guchun Chen +Reviewed-by: Tao Zhou +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +index b3cc04dd8653..9295ac7edd56 100644 +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +@@ -1917,9 +1917,11 @@ static int sdma_v4_0_hw_fini(void *handle) + return 0; + } + +- for (i = 0; i < adev->sdma.num_instances; i++) { +- amdgpu_irq_put(adev, &adev->sdma.ecc_irq, +- AMDGPU_SDMA_IRQ_INSTANCE0 + i); ++ if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__SDMA)) { ++ for (i = 0; i < adev->sdma.num_instances; i++) { ++ amdgpu_irq_put(adev, &adev->sdma.ecc_irq, ++ AMDGPU_SDMA_IRQ_INSTANCE0 + i); ++ } + } + + sdma_v4_0_ctx_switch_enable(adev, false); +-- +2.35.3 + diff --git a/patches.suse/drm-amdgpu-gfx-disable-gfx9-cp_ecc_error_irq-only-wh.patch b/patches.suse/drm-amdgpu-gfx-disable-gfx9-cp_ecc_error_irq-only-wh.patch new file mode 100644 index 0000000..e8fc5d2 --- /dev/null +++ b/patches.suse/drm-amdgpu-gfx-disable-gfx9-cp_ecc_error_irq-only-wh.patch @@ -0,0 +1,64 @@ +From 4a76680311330aefe5074bed8f06afa354b85c48 Mon Sep 17 00:00:00 2001 +From: Guchun Chen +Date: Sat, 6 May 2023 20:06:45 +0800 +Subject: [PATCH] drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras +Git-commit: 4a76680311330aefe5074bed8f06afa354b85c48 +Patch-mainline: v6.4-rc2 +References: git-fixes + +gfx9 cp_ecc_error_irq is only enabled when legacy gfx ras is assert. +So in gfx_v9_0_hw_fini, interrupt disablement for cp_ecc_error_irq +should be executed under such condition, otherwise, an amdgpu_irq_put +calltrace will occur. + +[ 7283.170322] RIP: 0010:amdgpu_irq_put+0x45/0x70 [amdgpu] +[ 7283.170964] RSP: 0018:ffff9a5fc3967d00 EFLAGS: 00010246 +[ 7283.170967] RAX: ffff98d88afd3040 RBX: ffff98d89da20000 RCX: 0000000000000000 +[ 7283.170969] RDX: 0000000000000000 RSI: ffff98d89da2bef8 RDI: ffff98d89da20000 +[ 7283.170971] RBP: ffff98d89da20000 R08: ffff98d89da2ca18 R09: 0000000000000006 +[ 7283.170973] R10: ffffd5764243c008 R11: 0000000000000000 R12: 0000000000001050 +[ 7283.170975] R13: ffff98d89da38978 R14: ffffffff999ae15a R15: ffff98d880130105 +[ 7283.170978] FS: 0000000000000000(0000) GS:ffff98d996f00000(0000) knlGS:0000000000000000 +[ 7283.170981] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 7283.170983] CR2: 00000000f7a9d178 CR3: 00000001c42ea000 CR4: 00000000003506e0 +[ 7283.170986] Call Trace: +[ 7283.170988] +[ 7283.170989] gfx_v9_0_hw_fini+0x1c/0x6d0 [amdgpu] +[ 7283.171655] amdgpu_device_ip_suspend_phase2+0x101/0x1a0 [amdgpu] +[ 7283.172245] amdgpu_device_suspend+0x103/0x180 [amdgpu] +[ 7283.172823] amdgpu_pmops_freeze+0x21/0x60 [amdgpu] +[ 7283.173412] pci_pm_freeze+0x54/0xc0 +[ 7283.173419] ? __pfx_pci_pm_freeze+0x10/0x10 +[ 7283.173425] dpm_run_callback+0x98/0x200 +[ 7283.173430] __device_suspend+0x164/0x5f0 + +V2: drop gfx11 as it's fixed in a different solution by retiring cp_ecc_irq funcs(Hawking) + +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2522 +Signed-off-by: Guchun Chen +Reviewed-by: Tao Zhou +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +index adbcd8127c82..f46d4b18a3fa 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -3764,7 +3764,8 @@ static int gfx_v9_0_hw_fini(void *handle) + { + struct amdgpu_device *adev = (struct amdgpu_device *)handle; + +- amdgpu_irq_put(adev, &adev->gfx.cp_ecc_error_irq, 0); ++ if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__GFX)) ++ amdgpu_irq_put(adev, &adev->gfx.cp_ecc_error_irq, 0); + amdgpu_irq_put(adev, &adev->gfx.priv_reg_irq, 0); + amdgpu_irq_put(adev, &adev->gfx.priv_inst_irq, 0); + +-- +2.35.3 + diff --git a/patches.suse/drm-displayid-add-displayid_get_header-and-check-bou.patch b/patches.suse/drm-displayid-add-displayid_get_header-and-check-bou.patch new file mode 100644 index 0000000..5a4fe2d --- /dev/null +++ b/patches.suse/drm-displayid-add-displayid_get_header-and-check-bou.patch @@ -0,0 +1,62 @@ +From 5bacecc3c56131c31f18b23d366f2184328fd9cf Mon Sep 17 00:00:00 2001 +From: Jani Nikula +Date: Thu, 16 Feb 2023 22:44:58 +0200 +Subject: [PATCH] drm/displayid: add displayid_get_header() and check bounds better +Git-commit: 5bacecc3c56131c31f18b23d366f2184328fd9cf +Patch-mainline: v6.4-rc1 +References: git-fixes + +Add a helper to get a pointer to struct displayid_header. To be +pedantic, add buffer overflow checks to not touch the base if that +itself would overflow. + +Cc: Iaroslav Boliukin +Cc: Dmitry Osipenko +Signed-off-by: Jani Nikula +Tested-by: Dmitry Osipenko +Reviewed-by: Dmitry Osipenko +Signed-off-by: Dmitry Osipenko +Link: https://patchwork.freedesktop.org/patch/msgid/4a03b3a5132642d3cdb6d4c2641422955a917292.1676580180.git.jani.nikula@intel.com +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/drm_displayid.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_displayid.c b/drivers/gpu/drm/drm_displayid.c +index 38ea8203df45..7d03159dc146 100644 +--- a/drivers/gpu/drm/drm_displayid.c ++++ b/drivers/gpu/drm/drm_displayid.c +@@ -7,13 +7,28 @@ + #include + #include + ++static const struct displayid_header * ++displayid_get_header(const u8 *displayid, int length, int index) ++{ ++ const struct displayid_header *base; ++ ++ if (sizeof(*base) > length - index) ++ return ERR_PTR(-EINVAL); ++ ++ base = (const struct displayid_header *)&displayid[index]; ++ ++ return base; ++} ++ + static int validate_displayid(const u8 *displayid, int length, int idx) + { + int i, dispid_length; + u8 csum = 0; + const struct displayid_header *base; + +- base = (const struct displayid_header *)&displayid[idx]; ++ base = displayid_get_header(displayid, length, idx); ++ if (IS_ERR(base)) ++ return PTR_ERR(base); + + DRM_DEBUG_KMS("base revision 0x%x, length %d, %d %d\n", + base->rev, base->bytes, base->prod_id, base->ext_count); +-- +2.35.3 + diff --git a/patches.suse/drm-exynos-fix-g2d_open-close-helper-function-defini.patch b/patches.suse/drm-exynos-fix-g2d_open-close-helper-function-defini.patch new file mode 100644 index 0000000..24e61c4 --- /dev/null +++ b/patches.suse/drm-exynos-fix-g2d_open-close-helper-function-defini.patch @@ -0,0 +1,48 @@ +From 2ef0785b30bd6549ddbc124979f1b6596e065ae2 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 17 Apr 2023 23:04:11 +0200 +Subject: [PATCH] drm/exynos: fix g2d_open/close helper function definitions +Git-commit: 2ef0785b30bd6549ddbc124979f1b6596e065ae2 +Patch-mainline: v6.4-rc3 +References: git-fixes + +The empty stub functions are defined as global functions, which +causes a warning because of missing prototypes: + +drivers/gpu/drm/exynos/exynos_drm_g2d.h:37:5: error: no previous prototype for 'g2d_open' +drivers/gpu/drm/exynos/exynos_drm_g2d.h:42:5: error: no previous prototype for 'g2d_close' + +Mark them as 'static inline' to avoid the warning and to make +them behave as intended. + +Fixes: eb4d9796fa34 ("drm/exynos: g2d: Convert to driver component API") +Signed-off-by: Arnd Bergmann +Reviewed-by: Andi Shyti +Signed-off-by: Inki Dae +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/exynos/exynos_drm_g2d.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.h b/drivers/gpu/drm/exynos/exynos_drm_g2d.h +index 74ea3c26dead..1a5ae781b56c 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.h ++++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.h +@@ -34,11 +34,11 @@ static inline int exynos_g2d_exec_ioctl(struct drm_device *dev, void *data, + return -ENODEV; + } + +-int g2d_open(struct drm_device *drm_dev, struct drm_file *file) ++static inline int g2d_open(struct drm_device *drm_dev, struct drm_file *file) + { + return 0; + } + +-void g2d_close(struct drm_device *drm_dev, struct drm_file *file) ++static inline void g2d_close(struct drm_device *drm_dev, struct drm_file *file) + { } + #endif +-- +2.35.3 + diff --git a/patches.suse/drm-i915-dg2-Add-HDMI-pixel-clock-frequencies-267.30.patch b/patches.suse/drm-i915-dg2-Add-HDMI-pixel-clock-frequencies-267.30.patch new file mode 100644 index 0000000..1ee23bd --- /dev/null +++ b/patches.suse/drm-i915-dg2-Add-HDMI-pixel-clock-frequencies-267.30.patch @@ -0,0 +1,116 @@ +From d46746b8b13cbd377ffc733e465d25800459a31b Mon Sep 17 00:00:00 2001 +From: Ankit Nautiyal +Date: Thu, 23 Feb 2023 10:06:19 +0530 +Subject: [PATCH] drm/i915/dg2: Add HDMI pixel clock frequencies 267.30 and 319.89 MHz +Git-commit: d46746b8b13cbd377ffc733e465d25800459a31b +Patch-mainline: v6.4-rc1 +References: git-fixes + +Add snps phy table values for HDMI pixel clocks 267.30 MHz and +319.89 MHz. Values are based on the Bspec algorithm for +PLL programming for HDMI. + +Cc: stable@vger.kernel.org +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8008 +Signed-off-by: Ankit Nautiyal +Reviewed-by: Uma Shankar +Signed-off-by: Uma Shankar +Link: https://patchwork.freedesktop.org/patch/msgid/20230223043619.3941382-1-ankit.k.nautiyal@intel.com +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/i915/display/intel_snps_phy.c | 62 +++++++++++++++++++ + 1 file changed, 62 insertions(+) + +diff --git a/drivers/gpu/drm/i915/display/intel_snps_phy.c b/drivers/gpu/drm/i915/display/intel_snps_phy.c +index c65c771f5c46..1cfb94b5cedb 100644 +--- a/drivers/gpu/drm/i915/display/intel_snps_phy.c ++++ b/drivers/gpu/drm/i915/display/intel_snps_phy.c +@@ -1419,6 +1419,36 @@ static const struct intel_mpllb_state dg2_hdmi_262750 = { + REG_FIELD_PREP(SNPS_PHY_MPLLB_SSC_UP_SPREAD, 1), + }; + ++static const struct intel_mpllb_state dg2_hdmi_267300 = { ++ .clock = 267300, ++ .ref_control = ++ REG_FIELD_PREP(SNPS_PHY_REF_CONTROL_REF_RANGE, 3), ++ .mpllb_cp = ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_CP_INT, 7) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_CP_PROP, 14) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_CP_INT_GS, 64) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_CP_PROP_GS, 124), ++ .mpllb_div = ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_DIV5_CLK_EN, 1) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_TX_CLK_DIV, 1) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_PMIX_EN, 1) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_V2I, 2) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_FREQ_VCO, 3), ++ .mpllb_div2 = ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_REF_CLK_DIV, 1) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_MULTIPLIER, 74) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_HDMI_DIV, 1), ++ .mpllb_fracn1 = ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_FRACN_CGG_UPDATE_EN, 1) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_FRACN_EN, 1) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_FRACN_DEN, 65535), ++ .mpllb_fracn2 = ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_FRACN_QUOT, 30146) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_FRACN_REM, 36699), ++ .mpllb_sscen = ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_SSC_UP_SPREAD, 1), ++}; ++ + static const struct intel_mpllb_state dg2_hdmi_268500 = { + .clock = 268500, + .ref_control = +@@ -1509,6 +1539,36 @@ static const struct intel_mpllb_state dg2_hdmi_241500 = { + REG_FIELD_PREP(SNPS_PHY_MPLLB_SSC_UP_SPREAD, 1), + }; + ++static const struct intel_mpllb_state dg2_hdmi_319890 = { ++ .clock = 319890, ++ .ref_control = ++ REG_FIELD_PREP(SNPS_PHY_REF_CONTROL_REF_RANGE, 3), ++ .mpllb_cp = ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_CP_INT, 6) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_CP_PROP, 14) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_CP_INT_GS, 64) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_CP_PROP_GS, 124), ++ .mpllb_div = ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_DIV5_CLK_EN, 1) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_TX_CLK_DIV, 1) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_PMIX_EN, 1) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_V2I, 2) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_FREQ_VCO, 2), ++ .mpllb_div2 = ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_REF_CLK_DIV, 1) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_MULTIPLIER, 94) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_HDMI_DIV, 1), ++ .mpllb_fracn1 = ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_FRACN_CGG_UPDATE_EN, 1) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_FRACN_EN, 1) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_FRACN_DEN, 65535), ++ .mpllb_fracn2 = ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_FRACN_QUOT, 64094) | ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_FRACN_REM, 13631), ++ .mpllb_sscen = ++ REG_FIELD_PREP(SNPS_PHY_MPLLB_SSC_UP_SPREAD, 1), ++}; ++ + static const struct intel_mpllb_state dg2_hdmi_497750 = { + .clock = 497750, + .ref_control = +@@ -1696,8 +1756,10 @@ static const struct intel_mpllb_state * const dg2_hdmi_tables[] = { + &dg2_hdmi_209800, + &dg2_hdmi_241500, + &dg2_hdmi_262750, ++ &dg2_hdmi_267300, + &dg2_hdmi_268500, + &dg2_hdmi_296703, ++ &dg2_hdmi_319890, + &dg2_hdmi_497750, + &dg2_hdmi_592000, + &dg2_hdmi_593407, +-- +2.35.3 + diff --git a/patches.suse/drm-msm-dp-Clean-up-handling-of-DP-AUX-interrupts.patch b/patches.suse/drm-msm-dp-Clean-up-handling-of-DP-AUX-interrupts.patch new file mode 100644 index 0000000..5b0a74e --- /dev/null +++ b/patches.suse/drm-msm-dp-Clean-up-handling-of-DP-AUX-interrupts.patch @@ -0,0 +1,210 @@ +From b20566cdef05cd40d95f10869d2a7646f48b1bbe Mon Sep 17 00:00:00 2001 +From: Douglas Anderson +Date: Thu, 26 Jan 2023 17:09:12 -0800 +Subject: [PATCH] drm/msm/dp: Clean up handling of DP AUX interrupts +Git-commit: b20566cdef05cd40d95f10869d2a7646f48b1bbe +Patch-mainline: v6.4-rc1 +References: git-fixes + +The DP AUX interrupt handling was a bit of a mess. +* There were two functions (one for "native" transfers and one for + "i2c" transfers) that were quite similar. It was hard to say how + many of the differences between the two functions were on purpose + and how many of them were just an accident of how they were coded. +* Each function sometimes used "else if" to test for error bits and + sometimes didn't and again it was hard to say if this was on purpose + or just an accident. +* The two functions wouldn't notice whether "unknown" bits were + set. For instance, there seems to be a bit "DP_INTR_PLL_UNLOCKED" + and if it was set there would be no indication. +* The two functions wouldn't notice if more than one error was set. + +Let's fix this by being more consistent / explicit about what we're +doing. + +By design this could cause different handling for AUX transfers, +though I'm not actually aware of any bug fixed as a result of +this patch (this patch was created because we simply noticed how odd +the old code was by code inspection). Specific notes here: +1. In the old native transfer case if we got "done + wrong address" + we'd ignore the "wrong address" (because of the "else if"). Now we + won't. +2. In the old native transfer case if we got "done + timeout" we'd + ignore the "timeout" (because of the "else if"). Now we won't. +3. In the old native transfer case we'd see "nack_defer" and translate + it to the error number for "nack". This differed from the i2c + transfer case where "nack_defer" was given the error number for + "nack_defer". This 100% can't matter because the only user of this + error number treats "nack defer" the same as "nack", so it's clear + that the difference between the "native" and "i2c" was pointless + here. +4. In the old i2c transfer case if we got "done" plus any error + besides "nack" or "defer" then we'd ignore the error. Now we don't. +5. If there is more than one error signaled by the hardware it's + possible that we'll report a different one than we used to. I don't + know if this matters. If someone is aware of a case this matters we + should document it and change the code to make it explicit. +6. One quirk we keep (I don't know if this is important) is that in + the i2c transfer case if we see "done + defer" we report that as a + "nack". That seemed too intentional in the old code to just drop. + +After this change we will add extra logging, including: +* A warning if we see more than one error bit set. +* A warning if we see an unexpected interrupt. +* A warning if we get an AUX transfer interrupt when shouldn't. + +It actually turns out that as a result of this change then at boot we +sometimes see an error: + [drm:dp_aux_isr] *ERROR* Unexpected DP AUX IRQ 0x01000000 when not busy +That means that, during init, we are seeing DP_INTR_PLL_UNLOCKED. For +now I'm going to say that leaving this error reported in the logs is +OK-ish and hopefully it will encourage someone to track down what's +going on at init time. + +One last note here is that this change renames one of the interrupt +bits. The bit named "i2c done" clearly was used for native transfers +being done too, so I renamed it to indicate this. + +Signed-off-by: Douglas Anderson +Tested-by: Kuogee Hsieh +Reviewed-by: Kuogee Hsieh +Patchwork: https://patchwork.freedesktop.org/patch/520658/ +Link: https://lore.kernel.org/r/20230126170745.v2.1.I90ffed3ddd21e818ae534f820cb4d6d8638859ab@changeid +Signed-off-by: Dmitry Baryshkov +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/msm/dp/dp_aux.c | 80 ++++++++++++----------------- + drivers/gpu/drm/msm/dp/dp_catalog.c | 2 +- + drivers/gpu/drm/msm/dp/dp_catalog.h | 2 +- + 3 files changed, 36 insertions(+), 48 deletions(-) + +diff --git a/drivers/gpu/drm/msm/dp/dp_aux.c b/drivers/gpu/drm/msm/dp/dp_aux.c +index cc3efed593aa..84f9e3e5f964 100644 +--- a/drivers/gpu/drm/msm/dp/dp_aux.c ++++ b/drivers/gpu/drm/msm/dp/dp_aux.c +@@ -162,47 +162,6 @@ static ssize_t dp_aux_cmd_fifo_rx(struct dp_aux_private *aux, + return i; + } + +-static void dp_aux_native_handler(struct dp_aux_private *aux, u32 isr) +-{ +- if (isr & DP_INTR_AUX_I2C_DONE) +- aux->aux_error_num = DP_AUX_ERR_NONE; +- else if (isr & DP_INTR_WRONG_ADDR) +- aux->aux_error_num = DP_AUX_ERR_ADDR; +- else if (isr & DP_INTR_TIMEOUT) +- aux->aux_error_num = DP_AUX_ERR_TOUT; +- if (isr & DP_INTR_NACK_DEFER) +- aux->aux_error_num = DP_AUX_ERR_NACK; +- if (isr & DP_INTR_AUX_ERROR) { +- aux->aux_error_num = DP_AUX_ERR_PHY; +- dp_catalog_aux_clear_hw_interrupts(aux->catalog); +- } +-} +- +-static void dp_aux_i2c_handler(struct dp_aux_private *aux, u32 isr) +-{ +- if (isr & DP_INTR_AUX_I2C_DONE) { +- if (isr & (DP_INTR_I2C_NACK | DP_INTR_I2C_DEFER)) +- aux->aux_error_num = DP_AUX_ERR_NACK; +- else +- aux->aux_error_num = DP_AUX_ERR_NONE; +- } else { +- if (isr & DP_INTR_WRONG_ADDR) +- aux->aux_error_num = DP_AUX_ERR_ADDR; +- else if (isr & DP_INTR_TIMEOUT) +- aux->aux_error_num = DP_AUX_ERR_TOUT; +- if (isr & DP_INTR_NACK_DEFER) +- aux->aux_error_num = DP_AUX_ERR_NACK_DEFER; +- if (isr & DP_INTR_I2C_NACK) +- aux->aux_error_num = DP_AUX_ERR_NACK; +- if (isr & DP_INTR_I2C_DEFER) +- aux->aux_error_num = DP_AUX_ERR_DEFER; +- if (isr & DP_INTR_AUX_ERROR) { +- aux->aux_error_num = DP_AUX_ERR_PHY; +- dp_catalog_aux_clear_hw_interrupts(aux->catalog); +- } +- } +-} +- + static void dp_aux_update_offset_and_segment(struct dp_aux_private *aux, + struct drm_dp_aux_msg *input_msg) + { +@@ -427,13 +386,42 @@ void dp_aux_isr(struct drm_dp_aux *dp_aux) + if (!isr) + return; + +- if (!aux->cmd_busy) ++ if (!aux->cmd_busy) { ++ DRM_ERROR("Unexpected DP AUX IRQ %#010x when not busy\n", isr); + return; ++ } + +- if (aux->native) +- dp_aux_native_handler(aux, isr); +- else +- dp_aux_i2c_handler(aux, isr); ++ /* ++ * The logic below assumes only one error bit is set (other than "done" ++ * which can apparently be set at the same time as some of the other ++ * bits). Warn if more than one get set so we know we need to improve ++ * the logic. ++ */ ++ if (hweight32(isr & ~DP_INTR_AUX_XFER_DONE) > 1) ++ DRM_WARN("Some DP AUX interrupts unhandled: %#010x\n", isr); ++ ++ if (isr & DP_INTR_AUX_ERROR) { ++ aux->aux_error_num = DP_AUX_ERR_PHY; ++ dp_catalog_aux_clear_hw_interrupts(aux->catalog); ++ } else if (isr & DP_INTR_NACK_DEFER) { ++ aux->aux_error_num = DP_AUX_ERR_NACK_DEFER; ++ } else if (isr & DP_INTR_WRONG_ADDR) { ++ aux->aux_error_num = DP_AUX_ERR_ADDR; ++ } else if (isr & DP_INTR_TIMEOUT) { ++ aux->aux_error_num = DP_AUX_ERR_TOUT; ++ } else if (!aux->native && (isr & DP_INTR_I2C_NACK)) { ++ aux->aux_error_num = DP_AUX_ERR_NACK; ++ } else if (!aux->native && (isr & DP_INTR_I2C_DEFER)) { ++ if (isr & DP_INTR_AUX_XFER_DONE) ++ aux->aux_error_num = DP_AUX_ERR_NACK; ++ else ++ aux->aux_error_num = DP_AUX_ERR_DEFER; ++ } else if (isr & DP_INTR_AUX_XFER_DONE) { ++ aux->aux_error_num = DP_AUX_ERR_NONE; ++ } else { ++ DRM_WARN("Unexpected interrupt: %#010x\n", isr); ++ return; ++ } + + complete(&aux->comp); + } +diff --git a/drivers/gpu/drm/msm/dp/dp_catalog.c b/drivers/gpu/drm/msm/dp/dp_catalog.c +index c12a5d9647bb..7a8cf1c8233d 100644 +--- a/drivers/gpu/drm/msm/dp/dp_catalog.c ++++ b/drivers/gpu/drm/msm/dp/dp_catalog.c +@@ -27,7 +27,7 @@ + #define DP_INTF_CONFIG_DATABUS_WIDEN BIT(4) + + #define DP_INTERRUPT_STATUS1 \ +- (DP_INTR_AUX_I2C_DONE| \ ++ (DP_INTR_AUX_XFER_DONE| \ + DP_INTR_WRONG_ADDR | DP_INTR_TIMEOUT | \ + DP_INTR_NACK_DEFER | DP_INTR_WRONG_DATA_CNT | \ + DP_INTR_I2C_NACK | DP_INTR_I2C_DEFER | \ +diff --git a/drivers/gpu/drm/msm/dp/dp_catalog.h b/drivers/gpu/drm/msm/dp/dp_catalog.h +index 2174bb5f4e98..82376a2697ef 100644 +--- a/drivers/gpu/drm/msm/dp/dp_catalog.h ++++ b/drivers/gpu/drm/msm/dp/dp_catalog.h +@@ -13,7 +13,7 @@ + + /* interrupts */ + #define DP_INTR_HPD BIT(0) +-#define DP_INTR_AUX_I2C_DONE BIT(3) ++#define DP_INTR_AUX_XFER_DONE BIT(3) + #define DP_INTR_WRONG_ADDR BIT(6) + #define DP_INTR_TIMEOUT BIT(9) + #define DP_INTR_NACK_DEFER BIT(12) +-- +2.35.3 + diff --git a/patches.suse/drm-msm-dp-unregister-audio-driver-during-unbind.patch b/patches.suse/drm-msm-dp-unregister-audio-driver-during-unbind.patch new file mode 100644 index 0000000..7caee89 --- /dev/null +++ b/patches.suse/drm-msm-dp-unregister-audio-driver-during-unbind.patch @@ -0,0 +1,81 @@ +From 85c636284cb63b7740b4ae98881ace92158068d3 Mon Sep 17 00:00:00 2001 +From: Srinivas Kandagatla +Date: Fri, 21 Apr 2023 15:56:57 +0100 +Subject: [PATCH] drm/msm/dp: unregister audio driver during unbind +Git-commit: 85c636284cb63b7740b4ae98881ace92158068d3 +Patch-mainline: v6.4-rc3 +References: git-fixes + +while binding the code always registers a audio driver, however there +is no corresponding unregistration done in unbind. This leads to multiple +redundant audio platform devices if dp_display_bind and dp_display_unbind +happens multiple times during startup. On X13s platform this resulted in +6 to 9 audio codec device instead of just 3 codec devices for 3 dp ports. + +Fix this by unregistering codecs on unbind. + +Signed-off-by: Srinivas Kandagatla +Fixes: d13e36d7d222 ("drm/msm/dp: add audio support for Display Port on MSM") +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/533324/ +Link: https://lore.kernel.org/r/20230421145657.12186-1-srinivas.kandagatla@linaro.org +Signed-off-by: Abhinav Kumar +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/msm/dp/dp_audio.c | 12 ++++++++++++ + drivers/gpu/drm/msm/dp/dp_audio.h | 2 ++ + drivers/gpu/drm/msm/dp/dp_display.c | 1 + + 3 files changed, 15 insertions(+) + +diff --git a/drivers/gpu/drm/msm/dp/dp_audio.c b/drivers/gpu/drm/msm/dp/dp_audio.c +index 6666783e1468..1245c7aa49df 100644 +--- a/drivers/gpu/drm/msm/dp/dp_audio.c ++++ b/drivers/gpu/drm/msm/dp/dp_audio.c +@@ -593,6 +593,18 @@ static struct hdmi_codec_pdata codec_data = { + .i2s = 1, + }; + ++void dp_unregister_audio_driver(struct device *dev, struct dp_audio *dp_audio) ++{ ++ struct dp_audio_private *audio_priv; ++ ++ audio_priv = container_of(dp_audio, struct dp_audio_private, dp_audio); ++ ++ if (audio_priv->audio_pdev) { ++ platform_device_unregister(audio_priv->audio_pdev); ++ audio_priv->audio_pdev = NULL; ++ } ++} ++ + int dp_register_audio_driver(struct device *dev, + struct dp_audio *dp_audio) + { +diff --git a/drivers/gpu/drm/msm/dp/dp_audio.h b/drivers/gpu/drm/msm/dp/dp_audio.h +index 84e5f4a5d26b..4ab78880af82 100644 +--- a/drivers/gpu/drm/msm/dp/dp_audio.h ++++ b/drivers/gpu/drm/msm/dp/dp_audio.h +@@ -53,6 +53,8 @@ struct dp_audio *dp_audio_get(struct platform_device *pdev, + int dp_register_audio_driver(struct device *dev, + struct dp_audio *dp_audio); + ++void dp_unregister_audio_driver(struct device *dev, struct dp_audio *dp_audio); ++ + /** + * dp_audio_put() + * +diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c +index 3e13acdfa7e5..99a38dbe51c0 100644 +--- a/drivers/gpu/drm/msm/dp/dp_display.c ++++ b/drivers/gpu/drm/msm/dp/dp_display.c +@@ -326,6 +326,7 @@ static void dp_display_unbind(struct device *dev, struct device *master, + kthread_stop(dp->ev_tsk); + + dp_power_client_deinit(dp->power); ++ dp_unregister_audio_driver(dev, dp->audio); + dp_aux_unregister(dp->aux); + dp->drm_dev = NULL; + dp->aux->drm_dev = NULL; +-- +2.35.3 + diff --git a/patches.suse/drm-msm-dpu-Move-non-MDP_TOP-INTF_INTR-offsets-out-o.patch b/patches.suse/drm-msm-dpu-Move-non-MDP_TOP-INTF_INTR-offsets-out-o.patch new file mode 100644 index 0000000..61f5370 --- /dev/null +++ b/patches.suse/drm-msm-dpu-Move-non-MDP_TOP-INTF_INTR-offsets-out-o.patch @@ -0,0 +1,67 @@ +From e9d9ce5462fecdeefec87953de71df4d025cbc72 Mon Sep 17 00:00:00 2001 +From: Marijn Suijten +Date: Thu, 27 Apr 2023 00:37:17 +0200 +Subject: [PATCH] drm/msm/dpu: Move non-MDP_TOP INTF_INTR offsets out of hwio header +Git-commit: e9d9ce5462fecdeefec87953de71df4d025cbc72 +Patch-mainline: v6.4-rc3 +References: git-fixes + +These offsets do not fall under the MDP TOP block and do not fit the +comment right above. Move them to dpu_hw_interrupts.c next to the +repsective MDP_INTF_x_OFF interrupt block offsets. + +Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") +Signed-off-by: Marijn Suijten +Reviewed-by: Konrad Dybcio +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/534203/ +Link: https://lore.kernel.org/r/20230411-dpu-intf-te-v4-3-27ce1a5ab5c6@somainline.org +Signed-off-by: Abhinav Kumar +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c | 5 ++++- + drivers/gpu/drm/msm/disp/dpu1/dpu_hwio.h | 3 --- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c +index 53326f25e40e..85c0bda3ff90 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c +@@ -15,7 +15,7 @@ + + /* + * Register offsets in MDSS register file for the interrupt registers +- * w.r.t. to the MDP base ++ * w.r.t. the MDP base + */ + #define MDP_SSPP_TOP0_OFF 0x0 + #define MDP_INTF_0_OFF 0x6A000 +@@ -24,6 +24,9 @@ + #define MDP_INTF_3_OFF 0x6B800 + #define MDP_INTF_4_OFF 0x6C000 + #define MDP_INTF_5_OFF 0x6C800 ++#define INTF_INTR_EN 0x1c0 ++#define INTF_INTR_STATUS 0x1c4 ++#define INTF_INTR_CLEAR 0x1c8 + #define MDP_AD4_0_OFF 0x7C000 + #define MDP_AD4_1_OFF 0x7D000 + #define MDP_AD4_INTR_EN_OFF 0x41c +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hwio.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hwio.h +index feb9a729844a..5acd5683d25a 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hwio.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hwio.h +@@ -21,9 +21,6 @@ + #define HIST_INTR_EN 0x01c + #define HIST_INTR_STATUS 0x020 + #define HIST_INTR_CLEAR 0x024 +-#define INTF_INTR_EN 0x1C0 +-#define INTF_INTR_STATUS 0x1C4 +-#define INTF_INTR_CLEAR 0x1C8 + #define SPLIT_DISPLAY_EN 0x2F4 + #define SPLIT_DISPLAY_UPPER_PIPE_CTRL 0x2F8 + #define DSPP_IGC_COLOR0_RAM_LUTN 0x300 +-- +2.35.3 + diff --git a/patches.suse/drm-msm-dpu-Remove-duplicate-register-defines-from-I.patch b/patches.suse/drm-msm-dpu-Remove-duplicate-register-defines-from-I.patch new file mode 100644 index 0000000..685cfc4 --- /dev/null +++ b/patches.suse/drm-msm-dpu-Remove-duplicate-register-defines-from-I.patch @@ -0,0 +1,40 @@ +From 202c044203ac5860e3025169105368d99f9bc6a2 Mon Sep 17 00:00:00 2001 +From: Marijn Suijten +Date: Thu, 27 Apr 2023 00:37:22 +0200 +Subject: [PATCH] drm/msm/dpu: Remove duplicate register defines from INTF +Git-commit: 202c044203ac5860e3025169105368d99f9bc6a2 +Patch-mainline: v6.4-rc3 +References: git-fixes + +The INTF_FRAME_LINE_COUNT_EN, INTF_FRAME_COUNT and INTF_LINE_COUNT +registers are already defined higher up, in the right place when sorted +numerically. + +Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") +Signed-off-by: Marijn Suijten +Reviewed-by: Konrad Dybcio +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/534231/ +Link: https://lore.kernel.org/r/20230411-dpu-intf-te-v4-8-27ce1a5ab5c6@somainline.org +Signed-off-by: Abhinav Kumar +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c | 5 ----- + 1 file changed, 5 deletions(-) + +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c +@@ -56,11 +56,6 @@ + #define INTF_TPG_RGB_MAPPING 0x11C + #define INTF_PROG_FETCH_START 0x170 + #define INTF_PROG_ROT_START 0x174 +- +-#define INTF_FRAME_LINE_COUNT_EN 0x0A8 +-#define INTF_FRAME_COUNT 0x0AC +-#define INTF_LINE_COUNT 0x0B0 +- + #define INTF_MUX 0x25C + + #define INTF_CFG_ACTIVE_H_EN BIT(29) diff --git a/patches.suse/drm-tegra-Avoid-potential-32-bit-integer-overflow.patch b/patches.suse/drm-tegra-Avoid-potential-32-bit-integer-overflow.patch new file mode 100644 index 0000000..30c44f8 --- /dev/null +++ b/patches.suse/drm-tegra-Avoid-potential-32-bit-integer-overflow.patch @@ -0,0 +1,37 @@ +From 2429b3c529da29d4277d519bd66d034842dcd70c Mon Sep 17 00:00:00 2001 +From: Nur Hussein +Date: Thu, 6 Apr 2023 04:25:59 +0800 +Subject: [PATCH] drm/tegra: Avoid potential 32-bit integer overflow +Git-commit: 2429b3c529da29d4277d519bd66d034842dcd70c +Patch-mainline: v6.4-rc1 +References: git-fixes + +In tegra_sor_compute_config(), the 32-bit value mode->clock is +multiplied by 1000, and assigned to the u64 variable pclk. We can avoid +a potential 32-bit integer overflow by casting mode->clock to u64 before +we do the arithmetic and assignment. + +Signed-off-by: Nur Hussein +Signed-off-by: Thierry Reding +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/tegra/sor.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c +index cd25f409979c..8d910695775c 100644 +--- a/drivers/gpu/drm/tegra/sor.c ++++ b/drivers/gpu/drm/tegra/sor.c +@@ -1153,7 +1153,7 @@ static int tegra_sor_compute_config(struct tegra_sor *sor, + struct drm_dp_link *link) + { + const u64 f = 100000, link_rate = link->rate * 1000; +- const u64 pclk = mode->clock * 1000; ++ const u64 pclk = (u64)mode->clock * 1000; + u64 input, output, watermark, num; + struct tegra_sor_params params; + u32 num_syms_per_line; +-- +2.35.3 + diff --git a/patches.suse/f2fs-Fix-f2fs_truncate_partial_nodes-ftrace-event.patch b/patches.suse/f2fs-Fix-f2fs_truncate_partial_nodes-ftrace-event.patch new file mode 100644 index 0000000..811a135 --- /dev/null +++ b/patches.suse/f2fs-Fix-f2fs_truncate_partial_nodes-ftrace-event.patch @@ -0,0 +1,43 @@ +From: Douglas Raillard +Date: Mon, 6 Mar 2023 12:25:49 +0000 +Subject: f2fs: Fix f2fs_truncate_partial_nodes ftrace event +Git-commit: 0b04d4c0542e8573a837b1d81b94209e48723b25 +Patch-mainline: v6.3-rc5 +References: git-fixes + +Fix the nid_t field so that its size is correctly reported in the text +format embedded in trace.dat files. As it stands, it is reported as +being of size 4: + + field:nid_t nid[3]; offset:24; size:4; signed:0; + +Instead of 12: + + field:nid_t nid[3]; offset:24; size:12; signed:0; + +This also fixes the reported offset of subsequent fields so that they +match with the actual struct layout. + +Signed-off-by: Douglas Raillard +Reviewed-by: Mukesh Ojha +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Acked-by: Petr Pavlu +--- + include/trace/events/f2fs.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/trace/events/f2fs.h b/include/trace/events/f2fs.h +index 1322d34a5dfc..99cbc5949e3c 100644 +--- a/include/trace/events/f2fs.h ++++ b/include/trace/events/f2fs.h +@@ -512,7 +512,7 @@ TRACE_EVENT(f2fs_truncate_partial_nodes, + TP_STRUCT__entry( + __field(dev_t, dev) + __field(ino_t, ino) +- __field(nid_t, nid[3]) ++ __array(nid_t, nid, 3) + __field(int, depth) + __field(int, err) + ), + diff --git a/patches.suse/fbdev-arcfb-Fix-error-handling-in-arcfb_probe.patch b/patches.suse/fbdev-arcfb-Fix-error-handling-in-arcfb_probe.patch new file mode 100644 index 0000000..d09ad92 --- /dev/null +++ b/patches.suse/fbdev-arcfb-Fix-error-handling-in-arcfb_probe.patch @@ -0,0 +1,81 @@ +From 5a6bef734247c7a8c19511664ff77634ab86f45b Mon Sep 17 00:00:00 2001 +From: Zongjie Li +Date: Tue, 9 May 2023 19:27:26 +0800 +Subject: [PATCH] fbdev: arcfb: Fix error handling in arcfb_probe() +Git-commit: 5a6bef734247c7a8c19511664ff77634ab86f45b +Patch-mainline: v6.4-rc2 +References: git-fixes + +Smatch complains that: +arcfb_probe() warn: 'irq' from request_irq() not released on lines: 587. + +Fix error handling in the arcfb_probe() function. If IO addresses are +not provided or framebuffer registration fails, the code will jump to +the err_addr or err_register_fb label to release resources. +If IRQ request fails, previously allocated resources will be freed. + +Fixes: 1154ea7dcd8e ("[PATCH] Framebuffer driver for Arc LCD board") +Signed-off-by: Zongjie Li +Reviewed-by: Dongliang Mu +Signed-off-by: Helge Deller +Acked-by: Takashi Iwai + +--- + drivers/video/fbdev/arcfb.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/drivers/video/fbdev/arcfb.c b/drivers/video/fbdev/arcfb.c +index 45e64016db32..024d0ee4f04f 100644 +--- a/drivers/video/fbdev/arcfb.c ++++ b/drivers/video/fbdev/arcfb.c +@@ -523,7 +523,7 @@ static int arcfb_probe(struct platform_device *dev) + + info = framebuffer_alloc(sizeof(struct arcfb_par), &dev->dev); + if (!info) +- goto err; ++ goto err_fb_alloc; + + info->screen_base = (char __iomem *)videomemory; + info->fbops = &arcfb_ops; +@@ -535,7 +535,7 @@ static int arcfb_probe(struct platform_device *dev) + + if (!dio_addr || !cio_addr || !c2io_addr) { + printk(KERN_WARNING "no IO addresses supplied\n"); +- goto err1; ++ goto err_addr; + } + par->dio_addr = dio_addr; + par->cio_addr = cio_addr; +@@ -551,12 +551,12 @@ static int arcfb_probe(struct platform_device *dev) + printk(KERN_INFO + "arcfb: Failed req IRQ %d\n", par->irq); + retval = -EBUSY; +- goto err1; ++ goto err_addr; + } + } + retval = register_framebuffer(info); + if (retval < 0) +- goto err1; ++ goto err_register_fb; + platform_set_drvdata(dev, info); + fb_info(info, "Arc frame buffer device, using %dK of video memory\n", + videomemorysize >> 10); +@@ -580,9 +580,12 @@ static int arcfb_probe(struct platform_device *dev) + } + + return 0; +-err1: ++ ++err_register_fb: ++ free_irq(par->irq, info); ++err_addr: + framebuffer_release(info); +-err: ++err_fb_alloc: + vfree(videomemory); + return retval; + } +-- +2.35.3 + diff --git a/patches.suse/fbdev-ep93xx-fb-Add-missing-clk_disable_unprepare-in.patch b/patches.suse/fbdev-ep93xx-fb-Add-missing-clk_disable_unprepare-in.patch new file mode 100644 index 0000000..12e7388 --- /dev/null +++ b/patches.suse/fbdev-ep93xx-fb-Add-missing-clk_disable_unprepare-in.patch @@ -0,0 +1,43 @@ +From c84bf485a5aaf9aa0764a58832b7ef4375c29f03 Mon Sep 17 00:00:00 2001 +From: Gaosheng Cui +Date: Wed, 23 Nov 2022 17:29:43 +0800 +Subject: [PATCH] fbdev: ep93xx-fb: Add missing clk_disable_unprepare in ep93xxfb_probe() +Git-commit: c84bf485a5aaf9aa0764a58832b7ef4375c29f03 +Patch-mainline: v6.2-rc1 +References: git-fixes + +The clk_disable_unprepare() should be called in the error handling +of register_framebuffer(), fix it. + +Fixes: 0937a7b3625d ("video: ep93xx: Prepare clock before using it") +Signed-off-by: Gaosheng Cui +Signed-off-by: Helge Deller +Acked-by: Takashi Iwai + +--- + drivers/video/fbdev/ep93xx-fb.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/ep93xx-fb.c b/drivers/video/fbdev/ep93xx-fb.c +index 2398b3d48fed..305f1587bd89 100644 +--- a/drivers/video/fbdev/ep93xx-fb.c ++++ b/drivers/video/fbdev/ep93xx-fb.c +@@ -552,12 +552,14 @@ static int ep93xxfb_probe(struct platform_device *pdev) + + err = register_framebuffer(info); + if (err) +- goto failed_check; ++ goto failed_framebuffer; + + dev_info(info->dev, "registered. Mode = %dx%d-%d\n", + info->var.xres, info->var.yres, info->var.bits_per_pixel); + return 0; + ++failed_framebuffer: ++ clk_disable_unprepare(fbi->clk); + failed_check: + if (fbi->mach_info->teardown) + fbi->mach_info->teardown(pdev); +-- +2.35.3 + diff --git a/patches.suse/fbdev-stifb-Fall-back-to-cfb_fillrect-on-32-bit-HCRX.patch b/patches.suse/fbdev-stifb-Fall-back-to-cfb_fillrect-on-32-bit-HCRX.patch new file mode 100644 index 0000000..a7be6cb --- /dev/null +++ b/patches.suse/fbdev-stifb-Fall-back-to-cfb_fillrect-on-32-bit-HCRX.patch @@ -0,0 +1,39 @@ +From 776d875fd4cbb3884860ea7f63c3958f02b0c80e Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Fri, 14 Oct 2022 20:01:17 +0200 +Subject: [PATCH] fbdev: stifb: Fall back to cfb_fillrect() on 32-bit HCRX cards +Git-commit: 776d875fd4cbb3884860ea7f63c3958f02b0c80e +Patch-mainline: v6.1-rc3 +References: git-fixes + +When the text console is scrolling text upwards it calls the fillrect() +function to empty the new line. The current implementation doesn't seem +to work correctly on HCRX cards in 32-bit mode and leave garbage in that +line instead. Fix it by falling back to standard cfb_fillrect() in that +case. + +Signed-off-by: Helge Deller +Cc: +Acked-by: Takashi Iwai + +--- + drivers/video/fbdev/stifb.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/stifb.c b/drivers/video/fbdev/stifb.c +index 7753e586e65a..3feb6e40d56d 100644 +--- a/drivers/video/fbdev/stifb.c ++++ b/drivers/video/fbdev/stifb.c +@@ -1055,7 +1055,8 @@ stifb_fillrect(struct fb_info *info, const struct fb_fillrect *rect) + { + struct stifb_info *fb = container_of(info, struct stifb_info, info); + +- if (rect->rop != ROP_COPY) ++ if (rect->rop != ROP_COPY || ++ (fb->id == S9000_ID_HCRX && fb->info.var.bits_per_pixel == 32)) + return cfb_fillrect(info, rect); + + SETUP_HW(fb); +-- +2.35.3 + diff --git a/patches.suse/fbdev-udlfb-Fix-endpoint-check.patch b/patches.suse/fbdev-udlfb-Fix-endpoint-check.patch new file mode 100644 index 0000000..10e5a39 --- /dev/null +++ b/patches.suse/fbdev-udlfb-Fix-endpoint-check.patch @@ -0,0 +1,100 @@ +From ed9de4ed39875706607fb08118a58344ae6c5f42 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Fri, 19 May 2023 15:32:30 -0400 +Subject: [PATCH] fbdev: udlfb: Fix endpoint check +Git-commit: ed9de4ed39875706607fb08118a58344ae6c5f42 +Patch-mainline: v6.4-rc3 +References: git-fixes + +The syzbot fuzzer detected a problem in the udlfb driver, caused by an +endpoint not having the expected type: + +usb 1-1: Read EDID byte 0 failed: -71 +usb 1-1: Unable to get valid EDID from device/display + +Acked-by: Takashi Iwai + +------------[ cut here ]------------ +usb 1-1: BOGUS urb xfer, pipe 3 != type 1 +WARNING: CPU: 0 PID: 9 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 +drivers/usb/core/urb.c:504 +Modules linked in: +CPU: 0 PID: 9 Comm: kworker/0:1 Not tainted +6.4.0-rc1-syzkaller-00016-ga4422ff22142 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google +04/28/2023 +Workqueue: usb_hub_wq hub_event +RIP: 0010:usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 +... +Call Trace: + + dlfb_submit_urb+0x92/0x180 drivers/video/fbdev/udlfb.c:1980 + dlfb_set_video_mode+0x21f0/0x2950 drivers/video/fbdev/udlfb.c:315 + dlfb_ops_set_par+0x2a7/0x8d0 drivers/video/fbdev/udlfb.c:1111 + dlfb_usb_probe+0x149a/0x2710 drivers/video/fbdev/udlfb.c:1743 + +The current approach for this issue failed to catch the problem +because it only checks for the existence of a bulk-OUT endpoint; it +doesn't check whether this endpoint is the one that the driver will +actually use. + +We can fix the problem by instead checking that the endpoint used by +the driver does exist and is bulk-OUT. + +Reported-and-tested-by: syzbot+0e22d63dcebb802b9bc8@syzkaller.appspotmail.com +Signed-off-by: Alan Stern +CC: Pavel Skripkin +Fixes: aaf7dbe07385 ("video: fbdev: udlfb: properly check endpoint type") +Signed-off-by: Helge Deller +--- + drivers/video/fbdev/udlfb.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c +index 216d49c9d47e..256d9b61f4ea 100644 +--- a/drivers/video/fbdev/udlfb.c ++++ b/drivers/video/fbdev/udlfb.c +@@ -27,6 +27,8 @@ + #include