From afdfe58c19735aca68519bef65734f633da2b17b Mon Sep 17 00:00:00 2001 From: Kernel Build Daemon Date: May 26 2023 05:57:36 +0000 Subject: Merge branch 'SLE15-SP4' into SLE15-SP4-AZURE --- diff --git a/patches.suse/ACPI-EC-Fix-oops-when-removing-custom-query-handlers.patch b/patches.suse/ACPI-EC-Fix-oops-when-removing-custom-query-handlers.patch new file mode 100644 index 0000000..e826862 --- /dev/null +++ b/patches.suse/ACPI-EC-Fix-oops-when-removing-custom-query-handlers.patch @@ -0,0 +1,40 @@ +From e5b492c6bb900fcf9722e05f4a10924410e170c1 Mon Sep 17 00:00:00 2001 +From: Armin Wolf +Date: Fri, 24 Mar 2023 21:26:27 +0100 +Subject: [PATCH] ACPI: EC: Fix oops when removing custom query handlers +Git-commit: e5b492c6bb900fcf9722e05f4a10924410e170c1 +Patch-mainline: v6.4-rc1 +References: git-fixes + +When removing custom query handlers, the handler might still +be used inside the EC query workqueue, causing a kernel oops +if the module holding the callback function was already unloaded. + +Fix this by flushing the EC query workqueue when removing +custom query handlers. + +Tested on a Acer Travelmate 4002WLMi + +Signed-off-by: Armin Wolf +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/acpi/ec.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index 5ef72287d1be..928899ab9502 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -1133,6 +1133,7 @@ static void acpi_ec_remove_query_handlers(struct acpi_ec *ec, + void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit) + { + acpi_ec_remove_query_handlers(ec, false, query_bit); ++ flush_workqueue(ec_query_wq); + } + EXPORT_SYMBOL_GPL(acpi_ec_remove_query_handler); + +-- +2.35.3 + diff --git a/patches.suse/ACPICA-ACPICA-check-null-return-of-ACPI_ALLOCATE_ZER.patch b/patches.suse/ACPICA-ACPICA-check-null-return-of-ACPI_ALLOCATE_ZER.patch new file mode 100644 index 0000000..5f6ad76 --- /dev/null +++ b/patches.suse/ACPICA-ACPICA-check-null-return-of-ACPI_ALLOCATE_ZER.patch @@ -0,0 +1,39 @@ +From ae5a0eccc85fc960834dd66e3befc2728284b86c Mon Sep 17 00:00:00 2001 +From: void0red <30990023+void0red@users.noreply.github.com> +Date: Wed, 5 Apr 2023 15:57:57 +0200 +Subject: [PATCH] ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects +Git-commit: ae5a0eccc85fc960834dd66e3befc2728284b86c +Patch-mainline: v6.4-rc1 +References: git-fixes + +ACPICA commit 0d5f467d6a0ba852ea3aad68663cbcbd43300fd4 + +ACPI_ALLOCATE_ZEROED may fails, object_info might be null and will cause +null pointer dereference later. + +Link: https://github.com/acpica/acpica/commit/0d5f467d +Signed-off-by: Bob Moore +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/acpi/acpica/dbnames.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/acpi/acpica/dbnames.c b/drivers/acpi/acpica/dbnames.c +index 3615e1a6efd8..b91155ea9c34 100644 +--- a/drivers/acpi/acpica/dbnames.c ++++ b/drivers/acpi/acpica/dbnames.c +@@ -652,6 +652,9 @@ acpi_status acpi_db_display_objects(char *obj_type_arg, char *display_count_arg) + object_info = + ACPI_ALLOCATE_ZEROED(sizeof(struct acpi_object_info)); + ++ if (!object_info) ++ return (AE_NO_MEMORY); ++ + /* Walk the namespace from the root */ + + (void)acpi_walk_namespace(ACPI_TYPE_ANY, ACPI_ROOT_OBJECT, +-- +2.35.3 + diff --git a/patches.suse/ACPICA-Avoid-undefined-behavior-applying-zero-offset.patch b/patches.suse/ACPICA-Avoid-undefined-behavior-applying-zero-offset.patch new file mode 100644 index 0000000..1f10b7b --- /dev/null +++ b/patches.suse/ACPICA-Avoid-undefined-behavior-applying-zero-offset.patch @@ -0,0 +1,67 @@ +From 05bb0167c80b8f93c6a4e0451b7da9b96db990c2 Mon Sep 17 00:00:00 2001 +From: Tamir Duberstein +Date: Wed, 5 Apr 2023 15:42:43 +0200 +Subject: [PATCH] ACPICA: Avoid undefined behavior: applying zero offset to null pointer +Git-commit: 05bb0167c80b8f93c6a4e0451b7da9b96db990c2 +Patch-mainline: v6.4-rc1 +References: git-fixes + +ACPICA commit 770653e3ba67c30a629ca7d12e352d83c2541b1e + +Before this change we see the following UBSAN stack trace in Fuchsia: + + #0 0x000021e4213b3302 in acpi_ds_init_aml_walk(struct acpi_walk_state*, union acpi_parse_object*, struct acpi_namespace_node*, u8*, u32, struct acpi_evaluate_info*, u8) ../../third_party/acpica/source/components/dispatcher/dswstate.c:682 +0x233302 + #1.2 0x000020d0f660777f in ubsan_get_stack_trace() compiler-rt/lib/ubsan/ubsan_diag.cpp:41 +0x3d77f + #1.1 0x000020d0f660777f in maybe_print_stack_trace() compiler-rt/lib/ubsan/ubsan_diag.cpp:51 +0x3d77f + #1 0x000020d0f660777f in ~scoped_report() compiler-rt/lib/ubsan/ubsan_diag.cpp:387 +0x3d77f + #2 0x000020d0f660b96d in handlepointer_overflow_impl() compiler-rt/lib/ubsan/ubsan_handlers.cpp:809 +0x4196d + #3 0x000020d0f660b50d in compiler-rt/lib/ubsan/ubsan_handlers.cpp:815 +0x4150d + #4 0x000021e4213b3302 in acpi_ds_init_aml_walk(struct acpi_walk_state*, union acpi_parse_object*, struct acpi_namespace_node*, u8*, u32, struct acpi_evaluate_info*, u8) ../../third_party/acpica/source/components/dispatcher/dswstate.c:682 +0x233302 + #5 0x000021e4213e2369 in acpi_ds_call_control_method(struct acpi_thread_state*, struct acpi_walk_state*, union acpi_parse_object*) ../../third_party/acpica/source/components/dispatcher/dsmethod.c:605 +0x262369 + #6 0x000021e421437fac in acpi_ps_parse_aml(struct acpi_walk_state*) ../../third_party/acpica/source/components/parser/psparse.c:550 +0x2b7fac + #7 0x000021e4214464d2 in acpi_ps_execute_method(struct acpi_evaluate_info*) ../../third_party/acpica/source/components/parser/psxface.c:244 +0x2c64d2 + #8 0x000021e4213aa052 in acpi_ns_evaluate(struct acpi_evaluate_info*) ../../third_party/acpica/source/components/namespace/nseval.c:250 +0x22a052 + #9 0x000021e421413dd8 in acpi_ns_init_one_device(acpi_handle, u32, void*, void**) ../../third_party/acpica/source/components/namespace/nsinit.c:735 +0x293dd8 + #10 0x000021e421429e98 in acpi_ns_walk_namespace(acpi_object_type, acpi_handle, u32, u32, acpi_walk_callback, acpi_walk_callback, void*, void**) ../../third_party/acpica/source/components/namespace/nswalk.c:298 +0x2a9e98 + #11 0x000021e4214131ac in acpi_ns_initialize_devices(u32) ../../third_party/acpica/source/components/namespace/nsinit.c:268 +0x2931ac + #12 0x000021e42147c40d in acpi_initialize_objects(u32) ../../third_party/acpica/source/components/utilities/utxfinit.c:304 +0x2fc40d + #13 0x000021e42126d603 in acpi::acpi_impl::initialize_acpi(acpi::acpi_impl*) ../../src/devices/board/lib/acpi/acpi-impl.cc:224 +0xed603 + +Add a simple check that avoids incrementing a pointer by zero, but +otherwise behaves as before. Note that our findings are against ACPICA +20221020, but the same code exists on master. + +Link: https://github.com/acpica/acpica/commit/770653e3 +Signed-off-by: Bob Moore +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/acpi/acpica/dswstate.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/acpi/acpica/dswstate.c b/drivers/acpi/acpica/dswstate.c +index 95af370a7dce..d3841ded3a81 100644 +--- a/drivers/acpi/acpica/dswstate.c ++++ b/drivers/acpi/acpica/dswstate.c +@@ -576,9 +576,14 @@ acpi_ds_init_aml_walk(struct acpi_walk_state *walk_state, + ACPI_FUNCTION_TRACE(ds_init_aml_walk); + + walk_state->parser_state.aml = +- walk_state->parser_state.aml_start = aml_start; +- walk_state->parser_state.aml_end = +- walk_state->parser_state.pkg_end = aml_start + aml_length; ++ walk_state->parser_state.aml_start = ++ walk_state->parser_state.aml_end = ++ walk_state->parser_state.pkg_end = aml_start; ++ /* Avoid undefined behavior: applying zero offset to null pointer */ ++ if (aml_length != 0) { ++ walk_state->parser_state.aml_end += aml_length; ++ walk_state->parser_state.pkg_end += aml_length; ++ } + + /* The next_op of the next_walk will be the beginning of the method */ + +-- +2.35.3 + diff --git a/patches.suse/Bluetooth-L2CAP-fix-bad-unlock-balance-in-l2cap_disc.patch b/patches.suse/Bluetooth-L2CAP-fix-bad-unlock-balance-in-l2cap_disc.patch new file mode 100644 index 0000000..a6e60b6 --- /dev/null +++ b/patches.suse/Bluetooth-L2CAP-fix-bad-unlock-balance-in-l2cap_disc.patch @@ -0,0 +1,37 @@ +From 25e97f7b1866e6b8503be349eeea44bb52d661ce Mon Sep 17 00:00:00 2001 +From: Min Li +Date: Mon, 17 Apr 2023 10:27:54 +0800 +Subject: [PATCH] Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp +Git-commit: 25e97f7b1866e6b8503be349eeea44bb52d661ce +Patch-mainline: v6.4-rc1 +References: git-fixes + +conn->chan_lock isn't acquired before l2cap_get_chan_by_scid, +if l2cap_get_chan_by_scid returns NULL, then 'bad unlock balance' +is triggered. + +Reported-by: syzbot+9519d6b5b79cf7787cf3@syzkaller.appspotmail.com +Link: https://lore.kernel.org/all/000000000000894f5f05f95e9f4d@google.com/ +Signed-off-by: Min Li +Signed-off-by: Luiz Augusto von Dentz +Acked-by: Takashi Iwai + +--- + net/bluetooth/l2cap_core.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index 5cc95fd17f7d..376b523c7b26 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -4693,7 +4693,6 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, + + chan = l2cap_get_chan_by_scid(conn, scid); + if (!chan) { +- mutex_unlock(&conn->chan_lock); + return 0; + } + +-- +2.35.3 + diff --git a/patches.suse/Bluetooth-btintel-Add-LE-States-quirk-support.patch b/patches.suse/Bluetooth-btintel-Add-LE-States-quirk-support.patch new file mode 100644 index 0000000..9b27b29 --- /dev/null +++ b/patches.suse/Bluetooth-btintel-Add-LE-States-quirk-support.patch @@ -0,0 +1,41 @@ +From 77f542b10c535c9a93bf8afdd2665524935807c2 Mon Sep 17 00:00:00 2001 +From: Chethan T N +Date: Tue, 21 Mar 2023 10:03:10 +0530 +Subject: [PATCH] Bluetooth: btintel: Add LE States quirk support +Git-commit: 77f542b10c535c9a93bf8afdd2665524935807c2 +Patch-mainline: v6.4-rc1 +References: git-fixes + +Basically all Intel controllers support both Central/Peripheral +LE states. + +This patch enables the LE States quirk by default on all +Solar and Magnertor Intel controllers. + +Signed-off-by: Chethan T N +Signed-off-by: Luiz Augusto von Dentz +Acked-by: Takashi Iwai + +--- + drivers/bluetooth/btintel.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c +index af774688f1c0..7a6dc05553f1 100644 +--- a/drivers/bluetooth/btintel.c ++++ b/drivers/bluetooth/btintel.c +@@ -2684,9 +2684,8 @@ static int btintel_setup_combined(struct hci_dev *hdev) + */ + set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks); + +- /* Valid LE States quirk for GfP */ +- if (INTEL_HW_VARIANT(ver_tlv.cnvi_bt) == 0x18) +- set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks); ++ /* Apply LE States quirk from solar onwards */ ++ set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks); + + /* Setup MSFT Extension support */ + btintel_set_msft_opcode(hdev, +-- +2.35.3 + diff --git a/patches.suse/HID-logitech-hidpp-Don-t-use-the-USB-serial-for-USB-.patch b/patches.suse/HID-logitech-hidpp-Don-t-use-the-USB-serial-for-USB-.patch new file mode 100644 index 0000000..6a89776 --- /dev/null +++ b/patches.suse/HID-logitech-hidpp-Don-t-use-the-USB-serial-for-USB-.patch @@ -0,0 +1,101 @@ +From 7ad1fe0da0fa91bf920b79ab05ae97bfabecc4f4 Mon Sep 17 00:00:00 2001 +From: Bastien Nocera +Date: Thu, 2 Mar 2023 14:01:16 +0100 +Subject: [PATCH] HID: logitech-hidpp: Don't use the USB serial for USB devices +Git-commit: 7ad1fe0da0fa91bf920b79ab05ae97bfabecc4f4 +Patch-mainline: v6.4-rc1 +References: git-fixes + +For devices that support the 0x0003 feature (Device Information) version 4, +set the serial based on the output of that feature, rather than relying +on the usbhid code setting the USB serial. + +This should allow the serial when connected through USB to (nearly) +match the one when connected through a unifying receiver. + +For example, on the serials on a G903 wired/wireless mouse: +- Unifying: 4067-e8-ce-cd-45 +- USB before patch: 017C385C3837 +- USB after patch: c086-e8-ce-cd-45 + +Signed-off-by: Bastien Nocera +Link: https://lore.kernel.org/r/20230302130117.3975-1-hadess@hadess.net +Signed-off-by: Benjamin Tissoires +Acked-by: Takashi Iwai + +--- + drivers/hid/hid-logitech-hidpp.c | 51 ++++++++++++++++++++++++++++++++ + 1 file changed, 51 insertions(+) + +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index 5fc88a063297..66380876937f 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -947,6 +947,55 @@ static int hidpp_root_get_protocol_version(struct hidpp_device *hidpp) + return 0; + } + ++/* -------------------------------------------------------------------------- */ ++/* 0x0003: Device Information */ ++/* -------------------------------------------------------------------------- */ ++ ++#define HIDPP_PAGE_DEVICE_INFORMATION 0x0003 ++ ++#define CMD_GET_DEVICE_INFO 0x00 ++ ++static int hidpp_get_serial(struct hidpp_device *hidpp, u32 *serial) ++{ ++ struct hidpp_report response; ++ u8 feature_type; ++ u8 feature_index; ++ int ret; ++ ++ ret = hidpp_root_get_feature(hidpp, HIDPP_PAGE_DEVICE_INFORMATION, ++ &feature_index, ++ &feature_type); ++ if (ret) ++ return ret; ++ ++ ret = hidpp_send_fap_command_sync(hidpp, feature_index, ++ CMD_GET_DEVICE_INFO, ++ NULL, 0, &response); ++ if (ret) ++ return ret; ++ ++ /* See hidpp_unifying_get_serial() */ ++ *serial = *((u32 *)&response.rap.params[1]); ++ return 0; ++} ++ ++static int hidpp_serial_init(struct hidpp_device *hidpp) ++{ ++ struct hid_device *hdev = hidpp->hid_dev; ++ u32 serial; ++ int ret; ++ ++ ret = hidpp_get_serial(hidpp, &serial); ++ if (ret) ++ return ret; ++ ++ snprintf(hdev->uniq, sizeof(hdev->uniq), "%04x-%4phD", ++ hdev->product, &serial); ++ dbg_hid("HID++ DeviceInformation: Got serial: %s\n", hdev->uniq); ++ ++ return 0; ++} ++ + /* -------------------------------------------------------------------------- */ + /* 0x0005: GetDeviceNameType */ + /* -------------------------------------------------------------------------- */ +@@ -4210,6 +4259,8 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) + + if (hidpp->quirks & HIDPP_QUIRK_UNIFYING) + hidpp_unifying_init(hidpp); ++ else if (hid_is_usb(hidpp->hid_dev)) ++ hidpp_serial_init(hidpp); + + connected = hidpp_root_get_protocol_version(hidpp) == 0; + atomic_set(&hidpp->connected, connected); +-- +2.35.3 + diff --git a/patches.suse/HID-logitech-hidpp-Reconcile-USB-and-Unifying-serial.patch b/patches.suse/HID-logitech-hidpp-Reconcile-USB-and-Unifying-serial.patch new file mode 100644 index 0000000..b03009a --- /dev/null +++ b/patches.suse/HID-logitech-hidpp-Reconcile-USB-and-Unifying-serial.patch @@ -0,0 +1,55 @@ +From 5b3691d15e04b6d5a32c915577b8dbc5cfb56382 Mon Sep 17 00:00:00 2001 +From: Bastien Nocera +Date: Thu, 2 Mar 2023 14:01:17 +0100 +Subject: [PATCH] HID: logitech-hidpp: Reconcile USB and Unifying serials +Git-commit: 5b3691d15e04b6d5a32c915577b8dbc5cfb56382 +Patch-mainline: v6.4-rc1 +References: git-fixes + +Now that USB HID++ devices can gather a serial number that matches the +one that would be gathered when connected through a Unifying receiver, +remove the last difference by dropping the product ID as devices +usually have different product IDs when connected through USB or +Unifying. + +For example, on the serials on a G903 wired/wireless mouse: +- Unifying before patch: 4067-e8-ce-cd-45 +- USB before patch: c086-e8-ce-cd-45 +- Unifying and USB after patch: e8-ce-cd-45 + +Signed-off-by: Bastien Nocera +Link: https://lore.kernel.org/r/20230302130117.3975-2-hadess@hadess.net +Signed-off-by: Benjamin Tissoires +Acked-by: Takashi Iwai + +--- + drivers/hid/hid-logitech-hidpp.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index 66380876937f..da89e84c9cbe 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -853,8 +853,7 @@ static int hidpp_unifying_init(struct hidpp_device *hidpp) + if (ret) + return ret; + +- snprintf(hdev->uniq, sizeof(hdev->uniq), "%04x-%4phD", +- hdev->product, &serial); ++ snprintf(hdev->uniq, sizeof(hdev->uniq), "%4phD", &serial); + dbg_hid("HID++ Unifying: Got serial: %s\n", hdev->uniq); + + name = hidpp_unifying_get_name(hidpp); +@@ -989,8 +988,7 @@ static int hidpp_serial_init(struct hidpp_device *hidpp) + if (ret) + return ret; + +- snprintf(hdev->uniq, sizeof(hdev->uniq), "%04x-%4phD", +- hdev->product, &serial); ++ snprintf(hdev->uniq, sizeof(hdev->uniq), "%4phD", &serial); + dbg_hid("HID++ DeviceInformation: Got serial: %s\n", hdev->uniq); + + return 0; +-- +2.35.3 + diff --git a/patches.suse/HID-wacom-Add-new-Intuos-Pro-Small-PTH-460-device-ID.patch b/patches.suse/HID-wacom-Add-new-Intuos-Pro-Small-PTH-460-device-ID.patch new file mode 100644 index 0000000..7050f46 --- /dev/null +++ b/patches.suse/HID-wacom-Add-new-Intuos-Pro-Small-PTH-460-device-ID.patch @@ -0,0 +1,45 @@ +From 0627f3df95e1609693f89e7ceb4156ac5db6e358 Mon Sep 17 00:00:00 2001 +From: Ping Cheng +Date: Fri, 26 Aug 2022 14:34:02 -0700 +Subject: [PATCH] HID: wacom: Add new Intuos Pro Small (PTH-460) device IDs +Git-commit: 0627f3df95e1609693f89e7ceb4156ac5db6e358 +Patch-mainline: v6.1-rc1 +References: git-fixes + +Add the new PIDs to wacom_wac.c to support the new model in the Intuos Pro series. + +Signed-off-by: Ping Cheng +Tested-by: Aaron Armstrong Skomra +Signed-off-by: Jiri Kosina +Acked-by: Takashi Iwai + +--- + drivers/hid/wacom_wac.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c +index d049239256a2..e4ae7fafe359 100644 +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -4875,6 +4875,10 @@ static const struct wacom_features wacom_features_0x3c6 = + static const struct wacom_features wacom_features_0x3c8 = + { "Wacom Intuos BT M", 21600, 13500, 4095, 63, + INTUOSHT3_BT, WACOM_INTUOS_RES, WACOM_INTUOS_RES, 4 }; ++static const struct wacom_features wacom_features_0x3dd = ++ { "Wacom Intuos Pro S", 31920, 19950, 8191, 63, ++ INTUOSP2S_BT, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 7, ++ .touch_max = 10 }; + + static const struct wacom_features wacom_features_HID_ANY_ID = + { "Wacom HID", .type = HID_GENERIC, .oVid = HID_ANY_ID, .oPid = HID_ANY_ID }; +@@ -5050,6 +5054,7 @@ const struct hid_device_id wacom_ids[] = { + { BT_DEVICE_WACOM(0x393) }, + { BT_DEVICE_WACOM(0x3c6) }, + { BT_DEVICE_WACOM(0x3c8) }, ++ { BT_DEVICE_WACOM(0x3dd) }, + { USB_DEVICE_WACOM(0x4001) }, + { USB_DEVICE_WACOM(0x4004) }, + { USB_DEVICE_WACOM(0x5000) }, +-- +2.35.3 + diff --git a/patches.suse/HID-wacom-Force-pen-out-of-prox-if-no-events-have-be.patch b/patches.suse/HID-wacom-Force-pen-out-of-prox-if-no-events-have-be.patch new file mode 100644 index 0000000..9f314cd --- /dev/null +++ b/patches.suse/HID-wacom-Force-pen-out-of-prox-if-no-events-have-be.patch @@ -0,0 +1,141 @@ +From 94b179052f95c294d83e9c9c34f7833cf3cd4305 Mon Sep 17 00:00:00 2001 +From: Jason Gerecke +Date: Fri, 15 Jul 2022 16:05:19 -0700 +Subject: [PATCH] HID: wacom: Force pen out of prox if no events have been received in a while +Git-commit: 94b179052f95c294d83e9c9c34f7833cf3cd4305 +Patch-mainline: v6.0-rc1 +References: git-fixes + +Prox-out events may not be reliably sent by some AES firmware. This can +cause problems for users, particularly due to arbitration logic disabling +touch input while the pen is in prox. + +This commit adds a timer which is reset every time a new prox event is +received. When the timer expires we check to see if the pen is still in +prox and force it out if necessary. This is patterend off of the same +solution used by 'hid-letsketch' driver which has a similar problem. + +Link: https://github.com/linuxwacom/input-wacom/issues/310 +Signed-off-by: Jason Gerecke +Signed-off-by: Jiri Kosina +Acked-by: Takashi Iwai + +--- + drivers/hid/wacom.h | 3 +++ + drivers/hid/wacom_sys.c | 2 ++ + drivers/hid/wacom_wac.c | 39 +++++++++++++++++++++++++++++++++++++++ + 3 files changed, 44 insertions(+) + +diff --git a/drivers/hid/wacom.h b/drivers/hid/wacom.h +index 203d27d198b8..3f8b24a57014 100644 +--- a/drivers/hid/wacom.h ++++ b/drivers/hid/wacom.h +@@ -91,6 +91,7 @@ + #include + #include + #include ++#include + #include + + /* +@@ -167,6 +168,7 @@ struct wacom { + struct delayed_work init_work; + struct wacom_remote *remote; + struct work_struct mode_change_work; ++ struct timer_list idleprox_timer; + bool generic_has_leds; + struct wacom_leds { + struct wacom_group_leds *groups; +@@ -239,4 +241,5 @@ struct wacom_led *wacom_led_find(struct wacom *wacom, unsigned int group, + struct wacom_led *wacom_led_next(struct wacom *wacom, struct wacom_led *cur); + int wacom_equivalent_usage(int usage); + int wacom_initialize_leds(struct wacom *wacom); ++void wacom_idleprox_timeout(struct timer_list *list); + #endif +diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c +index 98384b911288..194a2e327591 100644 +--- a/drivers/hid/wacom_sys.c ++++ b/drivers/hid/wacom_sys.c +@@ -2781,6 +2781,7 @@ static int wacom_probe(struct hid_device *hdev, + INIT_WORK(&wacom->battery_work, wacom_battery_work); + INIT_WORK(&wacom->remote_work, wacom_remote_work); + INIT_WORK(&wacom->mode_change_work, wacom_mode_change_work); ++ timer_setup(&wacom->idleprox_timer, &wacom_idleprox_timeout, TIMER_DEFERRABLE); + + /* ask for the report descriptor to be loaded by HID */ + error = hid_parse(hdev); +@@ -2821,6 +2822,7 @@ static void wacom_remove(struct hid_device *hdev) + cancel_work_sync(&wacom->battery_work); + cancel_work_sync(&wacom->remote_work); + cancel_work_sync(&wacom->mode_change_work); ++ del_timer_sync(&wacom->idleprox_timer); + if (hdev->bus == BUS_BLUETOOTH) + device_remove_file(&hdev->dev, &dev_attr_speed); + +diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c +index f8cc4bb3e3a7..d049239256a2 100644 +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -11,6 +11,7 @@ + #include "wacom_wac.h" + #include "wacom.h" + #include ++#include + + /* resolution for penabled devices */ + #define WACOM_PL_RES 20 +@@ -41,6 +42,43 @@ static int wacom_numbered_button_to_key(int n); + + static void wacom_update_led(struct wacom *wacom, int button_count, int mask, + int group); ++ ++static void wacom_force_proxout(struct wacom_wac *wacom_wac) ++{ ++ struct input_dev *input = wacom_wac->pen_input; ++ ++ wacom_wac->shared->stylus_in_proximity = 0; ++ ++ input_report_key(input, BTN_TOUCH, 0); ++ input_report_key(input, BTN_STYLUS, 0); ++ input_report_key(input, BTN_STYLUS2, 0); ++ input_report_key(input, BTN_STYLUS3, 0); ++ input_report_key(input, wacom_wac->tool[0], 0); ++ if (wacom_wac->serial[0]) { ++ input_report_abs(input, ABS_MISC, 0); ++ } ++ input_report_abs(input, ABS_PRESSURE, 0); ++ ++ wacom_wac->tool[0] = 0; ++ wacom_wac->id[0] = 0; ++ wacom_wac->serial[0] = 0; ++ ++ input_sync(input); ++} ++ ++void wacom_idleprox_timeout(struct timer_list *list) ++{ ++ struct wacom *wacom = from_timer(wacom, list, idleprox_timer); ++ struct wacom_wac *wacom_wac = &wacom->wacom_wac; ++ ++ if (!wacom_wac->hid_data.sense_state) { ++ return; ++ } ++ ++ hid_warn(wacom->hdev, "%s: tool appears to be hung in-prox. forcing it out.\n", __func__); ++ wacom_force_proxout(wacom_wac); ++} ++ + /* + * Percent of battery capacity for Graphire. + * 8th value means AC online and show 100% capacity. +@@ -2329,6 +2367,7 @@ static void wacom_wac_pen_event(struct hid_device *hdev, struct hid_field *field + value = field->logical_maximum - value; + break; + case HID_DG_INRANGE: ++ mod_timer(&wacom->idleprox_timer, jiffies + msecs_to_jiffies(100)); + wacom_wac->hid_data.inrange_state = value; + if (!(features->quirks & WACOM_QUIRK_SENSE)) + wacom_wac->hid_data.sense_state = value; +-- +2.35.3 + diff --git a/patches.suse/HID-wacom-add-three-styli-to-wacom_intuos_get_tool_t.patch b/patches.suse/HID-wacom-add-three-styli-to-wacom_intuos_get_tool_t.patch new file mode 100644 index 0000000..4fa304a --- /dev/null +++ b/patches.suse/HID-wacom-add-three-styli-to-wacom_intuos_get_tool_t.patch @@ -0,0 +1,41 @@ +From bfdc750c4cb2f3461b9b00a2755e2145ac195c9a Mon Sep 17 00:00:00 2001 +From: Ping Cheng +Date: Wed, 28 Sep 2022 13:49:29 -0700 +Subject: [PATCH] HID: wacom: add three styli to wacom_intuos_get_tool_type +Git-commit: bfdc750c4cb2f3461b9b00a2755e2145ac195c9a +Patch-mainline: v6.1-rc1 +References: git-fixes + +We forgot to add the 3D pen ID a year ago. There are two new pro pen +IDs to be added. + +Signed-off-by: Ping Cheng +Signed-off-by: Jiri Kosina +Acked-by: Takashi Iwai + +--- + drivers/hid/wacom_wac.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c +index e4ae7fafe359..9fc080e4e66f 100644 +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -713,11 +713,14 @@ static int wacom_intuos_get_tool_type(int tool_id) + case 0x802: /* Intuos4/5 13HD/24HD General Pen */ + case 0x8e2: /* IntuosHT2 pen */ + case 0x022: ++ case 0x200: /* Pro Pen 3 */ ++ case 0x04200: /* Pro Pen 3 */ + case 0x10842: /* MobileStudio Pro Pro Pen slim */ + case 0x14802: /* Intuos4/5 13HD/24HD Classic Pen */ + case 0x16802: /* Cintiq 13HD Pro Pen */ + case 0x18802: /* DTH2242 Pen */ + case 0x10802: /* Intuos4/5 13HD/24HD General Pen */ ++ case 0x80842: /* Intuos Pro and Cintiq Pro 3D Pen */ + tool_type = BTN_TOOL_PEN; + break; + +-- +2.35.3 + diff --git a/patches.suse/HID-wacom-generic-Set-battery-quirk-only-when-we-see.patch b/patches.suse/HID-wacom-generic-Set-battery-quirk-only-when-we-see.patch new file mode 100644 index 0000000..623380f --- /dev/null +++ b/patches.suse/HID-wacom-generic-Set-battery-quirk-only-when-we-see.patch @@ -0,0 +1,104 @@ +From bea407a427baa019758f29f4d31b26f008bb8cc6 Mon Sep 17 00:00:00 2001 +From: Jason Gerecke +Date: Thu, 13 Apr 2023 11:17:43 -0700 +Subject: [PATCH] HID: wacom: generic: Set battery quirk only when we see battery data +Git-commit: bea407a427baa019758f29f4d31b26f008bb8cc6 +Patch-mainline: v6.4-rc1 +References: git-fixes + +Some devices will include battery status usages in the HID descriptor +but we won't see that battery data for one reason or another. For example, +AES sensors won't send battery data unless an AES pen is in proximity. +If a user does not have an AES pen but instead only interacts with the +AES touchscreen with their fingers then there is no need for us to create +a battery object. Similarly, if a family of peripherals shares the same +HID descriptor between wired-only and wireless-capable SKUs, users of the +former may never see a battery event and will not want a power_supply +object created. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217062 +Link: https://gitlab.gnome.org/GNOME/gnome-control-center/-/issues/2354 +Signed-off-by: Jason Gerecke +Tested-by: Mario Limonciello +Signed-off-by: Jiri Kosina +Acked-by: Takashi Iwai + +--- + drivers/hid/wacom_wac.c | 33 +++++++++++---------------------- + 1 file changed, 11 insertions(+), 22 deletions(-) + +diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c +index 0351bce362d2..dc0f7d9a992c 100644 +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -1968,18 +1968,7 @@ static void wacom_map_usage(struct input_dev *input, struct hid_usage *usage, + static void wacom_wac_battery_usage_mapping(struct hid_device *hdev, + struct hid_field *field, struct hid_usage *usage) + { +- struct wacom *wacom = hid_get_drvdata(hdev); +- struct wacom_wac *wacom_wac = &wacom->wacom_wac; +- struct wacom_features *features = &wacom_wac->features; +- unsigned equivalent_usage = wacom_equivalent_usage(usage->hid); +- +- switch (equivalent_usage) { +- case HID_DG_BATTERYSTRENGTH: +- case WACOM_HID_WD_BATTERY_LEVEL: +- case WACOM_HID_WD_BATTERY_CHARGING: +- features->quirks |= WACOM_QUIRK_BATTERY; +- break; +- } ++ return; + } + + static void wacom_wac_battery_event(struct hid_device *hdev, struct hid_field *field, +@@ -2000,18 +1989,21 @@ static void wacom_wac_battery_event(struct hid_device *hdev, struct hid_field *f + wacom_wac->hid_data.bat_connected = 1; + wacom_wac->hid_data.bat_status = WACOM_POWER_SUPPLY_STATUS_AUTO; + } ++ wacom_wac->features.quirks |= WACOM_QUIRK_BATTERY; + break; + case WACOM_HID_WD_BATTERY_LEVEL: + value = value * 100 / (field->logical_maximum - field->logical_minimum); + wacom_wac->hid_data.battery_capacity = value; + wacom_wac->hid_data.bat_connected = 1; + wacom_wac->hid_data.bat_status = WACOM_POWER_SUPPLY_STATUS_AUTO; ++ wacom_wac->features.quirks |= WACOM_QUIRK_BATTERY; + break; + case WACOM_HID_WD_BATTERY_CHARGING: + wacom_wac->hid_data.bat_charging = value; + wacom_wac->hid_data.ps_connected = value; + wacom_wac->hid_data.bat_connected = 1; + wacom_wac->hid_data.bat_status = WACOM_POWER_SUPPLY_STATUS_AUTO; ++ wacom_wac->features.quirks |= WACOM_QUIRK_BATTERY; + break; + } + } +@@ -2027,18 +2019,15 @@ static void wacom_wac_battery_report(struct hid_device *hdev, + { + struct wacom *wacom = hid_get_drvdata(hdev); + struct wacom_wac *wacom_wac = &wacom->wacom_wac; +- struct wacom_features *features = &wacom_wac->features; + +- if (features->quirks & WACOM_QUIRK_BATTERY) { +- int status = wacom_wac->hid_data.bat_status; +- int capacity = wacom_wac->hid_data.battery_capacity; +- bool charging = wacom_wac->hid_data.bat_charging; +- bool connected = wacom_wac->hid_data.bat_connected; +- bool powered = wacom_wac->hid_data.ps_connected; ++ int status = wacom_wac->hid_data.bat_status; ++ int capacity = wacom_wac->hid_data.battery_capacity; ++ bool charging = wacom_wac->hid_data.bat_charging; ++ bool connected = wacom_wac->hid_data.bat_connected; ++ bool powered = wacom_wac->hid_data.ps_connected; + +- wacom_notify_battery(wacom_wac, status, capacity, charging, +- connected, powered); +- } ++ wacom_notify_battery(wacom_wac, status, capacity, charging, ++ connected, powered); + } + + static void wacom_wac_pad_usage_mapping(struct hid_device *hdev, +-- +2.35.3 + diff --git a/patches.suse/Input-xpad-add-constants-for-GIP-interface-numbers.patch b/patches.suse/Input-xpad-add-constants-for-GIP-interface-numbers.patch new file mode 100644 index 0000000..3e9f819 --- /dev/null +++ b/patches.suse/Input-xpad-add-constants-for-GIP-interface-numbers.patch @@ -0,0 +1,42 @@ +From f9b2e603c6216824e34dc9a67205d98ccc9a41ca Mon Sep 17 00:00:00 2001 +From: Vicki Pfau +Date: Thu, 13 Apr 2023 23:57:42 -0700 +Subject: [PATCH] Input: xpad - add constants for GIP interface numbers +Git-commit: f9b2e603c6216824e34dc9a67205d98ccc9a41ca +Patch-mainline: v6.4-rc1 +References: git-fixes + +Wired GIP devices present multiple interfaces with the same USB identification +other than the interface number. This adds constants for differentiating two of +them and uses them where appropriate + +Signed-off-by: Vicki Pfau +Link: https://lore.kernel.org/r/20230411031650.960322-2-vi@endrift.com +Signed-off-by: Dmitry Torokhov +Acked-by: Takashi Iwai + +--- + drivers/input/joystick/xpad.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -493,6 +493,9 @@ struct xboxone_init_packet { + } + + ++#define GIP_WIRED_INTF_DATA 0 ++#define GIP_WIRED_INTF_AUDIO 1 ++ + /* + * This packet is required for all Xbox One pads with 2015 + * or later firmware installed (or present from the factory). +@@ -1821,7 +1824,7 @@ static int xpad_probe(struct usb_interfa + } + + if (xpad->xtype == XTYPE_XBOXONE && +- intf->cur_altsetting->desc.bInterfaceNumber != 0) { ++ intf->cur_altsetting->desc.bInterfaceNumber != GIP_WIRED_INTF_DATA) { + /* + * The Xbox One controller lists three interfaces all with the + * same interface class, subclass and protocol. Differentiate by diff --git a/patches.suse/USB-UHCI-adjust-zhaoxin-UHCI-controllers-OverCurrent.patch b/patches.suse/USB-UHCI-adjust-zhaoxin-UHCI-controllers-OverCurrent.patch new file mode 100644 index 0000000..72ee7f9 --- /dev/null +++ b/patches.suse/USB-UHCI-adjust-zhaoxin-UHCI-controllers-OverCurrent.patch @@ -0,0 +1,50 @@ +From dddb342b5b9e482bb213aecc08cbdb201ea4f8da Mon Sep 17 00:00:00 2001 +From: Weitao Wang +Date: Sun, 23 Apr 2023 18:59:52 +0800 +Subject: [PATCH] USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value +Git-commit: dddb342b5b9e482bb213aecc08cbdb201ea4f8da +Patch-mainline: v6.4-rc3 +References: git-fixes + +OverCurrent condition is not standardized in the UHCI spec. +Zhaoxin UHCI controllers report OverCurrent bit active off. +In order to handle OverCurrent condition correctly, the uhci-hcd +driver needs to be told to expect the active-off behavior. + +Suggested-by: Alan Stern +Cc: stable@vger.kernel.org +Signed-off-by: Weitao Wang +Acked-by: Alan Stern +Link: https://lore.kernel.org/r/20230423105952.4526-1-WeitaoWang-oc@zhaoxin.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/host/uhci-pci.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/usb/host/uhci-pci.c b/drivers/usb/host/uhci-pci.c +index 3592f757fe05..7bd2fddde770 100644 +--- a/drivers/usb/host/uhci-pci.c ++++ b/drivers/usb/host/uhci-pci.c +@@ -119,11 +119,13 @@ static int uhci_pci_init(struct usb_hcd *hcd) + + uhci->rh_numports = uhci_count_ports(hcd); + +- /* Intel controllers report the OverCurrent bit active on. +- * VIA controllers report it active off, so we'll adjust the +- * bit value. (It's not standardized in the UHCI spec.) ++ /* ++ * Intel controllers report the OverCurrent bit active on. VIA ++ * and ZHAOXIN controllers report it active off, so we'll adjust ++ * the bit value. (It's not standardized in the UHCI spec.) + */ +- if (to_pci_dev(uhci_dev(uhci))->vendor == PCI_VENDOR_ID_VIA) ++ if (to_pci_dev(uhci_dev(uhci))->vendor == PCI_VENDOR_ID_VIA || ++ to_pci_dev(uhci_dev(uhci))->vendor == PCI_VENDOR_ID_ZHAOXIN) + uhci->oc_low = 1; + + /* HP's server management chip requires a longer port reset delay. */ +-- +2.35.3 + diff --git a/patches.suse/USB-usbtmc-Fix-direction-for-0-length-ioctl-control-.patch b/patches.suse/USB-usbtmc-Fix-direction-for-0-length-ioctl-control-.patch new file mode 100644 index 0000000..2a64a11 --- /dev/null +++ b/patches.suse/USB-usbtmc-Fix-direction-for-0-length-ioctl-control-.patch @@ -0,0 +1,70 @@ +From 94d25e9128988c6a1fc9070f6e98215a95795bd8 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Mon, 1 May 2023 14:22:35 -0400 +Subject: [PATCH] USB: usbtmc: Fix direction for 0-length ioctl control messages +Git-commit: 94d25e9128988c6a1fc9070f6e98215a95795bd8 +Patch-mainline: v6.4-rc3 +References: git-fixes + +The syzbot fuzzer found a problem in the usbtmc driver: When a user +submits an ioctl for a 0-length control transfer, the driver does not +check that the direction is set to OUT: + +Acked-by: Takashi Iwai + +------------[ cut here ]------------ +usb 3-1: BOGUS control dir, pipe 80000b80 doesn't match bRequestType fd +WARNING: CPU: 0 PID: 5100 at drivers/usb/core/urb.c:411 usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 +Modules linked in: +CPU: 0 PID: 5100 Comm: syz-executor428 Not tainted 6.3.0-syzkaller-12049-g58390c8ce1bd #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 +RIP: 0010:usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 +Code: 7c 24 40 e8 1b 13 5c fb 48 8b 7c 24 40 e8 21 1d f0 fe 45 89 e8 44 89 f1 4c 89 e2 48 89 c6 48 c7 c7 e0 b5 fc 8a e8 19 c8 23 fb <0f> 0b e9 9f ee ff ff e8 ed 12 5c fb 0f b6 1d 12 8a 3c 08 31 ff 41 +RSP: 0018:ffffc90003d2fb00 EFLAGS: 00010282 +RAX: 0000000000000000 RBX: ffff8880789e9058 RCX: 0000000000000000 +RDX: ffff888029593b80 RSI: ffffffff814c1447 RDI: 0000000000000001 +RBP: ffff88801ea742f8 R08: 0000000000000001 R09: 0000000000000000 +R10: 0000000000000001 R11: 0000000000000001 R12: ffff88802915e528 +R13: 00000000000000fd R14: 0000000080000b80 R15: ffff8880222b3100 +FS: 0000555556ca63c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f9ef4d18150 CR3: 0000000073e5b000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58 + usb_internal_control_msg drivers/usb/core/message.c:102 [inline] + usb_control_msg+0x320/0x4a0 drivers/usb/core/message.c:153 + usbtmc_ioctl_request drivers/usb/class/usbtmc.c:1954 [inline] + usbtmc_ioctl+0x1b3d/0x2840 drivers/usb/class/usbtmc.c:2097 + +To fix this, we must override the direction in the bRequestType field +of the control request structure when the length is 0. + +Reported-and-tested-by: syzbot+ce77725b89b7bd52425c@syzkaller.appspotmail.com +Signed-off-by: Alan Stern +Link: https://lore.kernel.org/linux-usb/000000000000716a3705f9adb8ee@google.com/ +CC: +Link: https://lore.kernel.org/r/ede1ee02-b718-49e7-a44c-51339fec706b@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/usbtmc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c +index 4bb6d304eb4b..311007b1d904 100644 +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -1928,6 +1928,8 @@ static int usbtmc_ioctl_request(struct usbtmc_device_data *data, + + if (request.req.wLength > USBTMC_BUFSIZE) + return -EMSGSIZE; ++ if (request.req.wLength == 0) /* Length-0 requests are never IN */ ++ request.req.bRequestType &= ~USB_DIR_IN; + + is_in = request.req.bRequestType & USB_DIR_IN; + +-- +2.35.3 + diff --git a/patches.suse/arm64-dts-qcom-msm8996-Add-missing-DWC3-quirks.patch b/patches.suse/arm64-dts-qcom-msm8996-Add-missing-DWC3-quirks.patch new file mode 100644 index 0000000..6b1a493 --- /dev/null +++ b/patches.suse/arm64-dts-qcom-msm8996-Add-missing-DWC3-quirks.patch @@ -0,0 +1,39 @@ +From d0af0537e28f6eace02deed63b585396de939213 Mon Sep 17 00:00:00 2001 +From: Konrad Dybcio +Date: Thu, 2 Mar 2023 02:18:49 +0100 +Subject: [PATCH] arm64: dts: qcom: msm8996: Add missing DWC3 quirks +Git-commit: d0af0537e28f6eace02deed63b585396de939213 +Patch-mainline: v6.4-rc1 +References: git-fixes + +Add missing dwc3 quirks from msm-3.18. Unfortunately, none of them +make `dwc3-qcom 6af8800.usb: HS-PHY not in L2` go away. + +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230302011849.1873056-1-konrad.dybcio@linaro.org +Acked-by: Takashi Iwai + +--- + arch/arm64/boot/dts/qcom/msm8996.dtsi | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index 293ed2e60691..a1e14e3540e6 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -3006,8 +3006,11 @@ usb3_dwc3: usb@6a00000 { + interrupts = <0 131 IRQ_TYPE_LEVEL_HIGH>; + phys = <&hsusb_phy1>, <&ssusb_phy_0>; + phy-names = "usb2-phy", "usb3-phy"; ++ snps,hird-threshold = /bits/ 8 <0>; + snps,dis_u2_susphy_quirk; + snps,dis_enblslpm_quirk; ++ snps,is-utmi-l1-suspend; ++ tx-fifo-resize; + }; + }; + +-- +2.35.3 + diff --git a/patches.suse/clk-tegra20-fix-gcc-7-constant-overflow-warning.patch b/patches.suse/clk-tegra20-fix-gcc-7-constant-overflow-warning.patch new file mode 100644 index 0000000..f6fa6cd --- /dev/null +++ b/patches.suse/clk-tegra20-fix-gcc-7-constant-overflow-warning.patch @@ -0,0 +1,74 @@ +From b4a2adbf3586efa12fe78b9dec047423e01f3010 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 27 Feb 2023 09:59:10 +0100 +Subject: [PATCH] clk: tegra20: fix gcc-7 constant overflow warning +Git-commit: b4a2adbf3586efa12fe78b9dec047423e01f3010 +Patch-mainline: v6.4-rc1 +References: git-fixes + +Older gcc versions get confused by comparing a u32 value to a negative +constant in a switch()/case block: + +Drivers/clk/tegra/clk-tegra20.c: In function 'tegra20_clk_measure_input_freq': +drivers/clk/tegra/clk-tegra20.c:581:2: error: case label does not reduce to an integer constant + case OSC_CTRL_OSC_FREQ_12MHZ: + ^~~~ +drivers/clk/tegra/clk-tegra20.c:593:2: error: case label does not reduce to an integer constant + case OSC_CTRL_OSC_FREQ_26MHZ: + +Make the constants unsigned instead. + +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20230227085914.2560984-1-arnd@kernel.org +Signed-off-by: Stephen Boyd +Acked-by: Takashi Iwai + +--- + drivers/clk/tegra/clk-tegra20.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +diff --git a/drivers/clk/tegra/clk-tegra20.c b/drivers/clk/tegra/clk-tegra20.c +index 422d78247553..dcacc5064d33 100644 +--- a/drivers/clk/tegra/clk-tegra20.c ++++ b/drivers/clk/tegra/clk-tegra20.c +@@ -21,24 +21,24 @@ + #define MISC_CLK_ENB 0x48 + + #define OSC_CTRL 0x50 +-#define OSC_CTRL_OSC_FREQ_MASK (3<<30) +-#define OSC_CTRL_OSC_FREQ_13MHZ (0<<30) +-#define OSC_CTRL_OSC_FREQ_19_2MHZ (1<<30) +-#define OSC_CTRL_OSC_FREQ_12MHZ (2<<30) +-#define OSC_CTRL_OSC_FREQ_26MHZ (3<<30) +-#define OSC_CTRL_MASK (0x3f2 | OSC_CTRL_OSC_FREQ_MASK) ++#define OSC_CTRL_OSC_FREQ_MASK (3u<<30) ++#define OSC_CTRL_OSC_FREQ_13MHZ (0u<<30) ++#define OSC_CTRL_OSC_FREQ_19_2MHZ (1u<<30) ++#define OSC_CTRL_OSC_FREQ_12MHZ (2u<<30) ++#define OSC_CTRL_OSC_FREQ_26MHZ (3u<<30) ++#define OSC_CTRL_MASK (0x3f2u | OSC_CTRL_OSC_FREQ_MASK) + +-#define OSC_CTRL_PLL_REF_DIV_MASK (3<<28) +-#define OSC_CTRL_PLL_REF_DIV_1 (0<<28) +-#define OSC_CTRL_PLL_REF_DIV_2 (1<<28) +-#define OSC_CTRL_PLL_REF_DIV_4 (2<<28) ++#define OSC_CTRL_PLL_REF_DIV_MASK (3u<<28) ++#define OSC_CTRL_PLL_REF_DIV_1 (0u<<28) ++#define OSC_CTRL_PLL_REF_DIV_2 (1u<<28) ++#define OSC_CTRL_PLL_REF_DIV_4 (2u<<28) + + #define OSC_FREQ_DET 0x58 +-#define OSC_FREQ_DET_TRIG (1<<31) ++#define OSC_FREQ_DET_TRIG (1u<<31) + + #define OSC_FREQ_DET_STATUS 0x5c +-#define OSC_FREQ_DET_BUSY (1<<31) +-#define OSC_FREQ_DET_CNT_MASK 0xFFFF ++#define OSC_FREQ_DET_BUSYu (1<<31) ++#define OSC_FREQ_DET_CNT_MASK 0xFFFFu + + #define TEGRA20_CLK_PERIPH_BANKS 3 + +-- +2.35.3 + diff --git a/patches.suse/drm-amd-Fix-an-out-of-bounds-error-in-BIOS-parser.patch b/patches.suse/drm-amd-Fix-an-out-of-bounds-error-in-BIOS-parser.patch new file mode 100644 index 0000000..ee51866 --- /dev/null +++ b/patches.suse/drm-amd-Fix-an-out-of-bounds-error-in-BIOS-parser.patch @@ -0,0 +1,49 @@ +From d116db180decec1b21bba31d2ff495ac4d8e1b83 Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Thu, 23 Mar 2023 14:07:06 -0500 +Subject: [PATCH] drm/amd: Fix an out of bounds error in BIOS parser +Git-commit: d116db180decec1b21bba31d2ff495ac4d8e1b83 +Patch-mainline: v6.4-rc1 +References: git-fixes + +The array is hardcoded to 8 in atomfirmware.h, but firmware provides +a bigger one sometimes. Deferencing the larger array causes an out +of bounds error. + +commit 4fc1ba4aa589 ("drm/amd/display: fix array index out of bound error +in bios parser") fixed some of this, but there are two other cases +not covered by it. Fix those as well. + +Reported-by: erhard_f@mailbox.org +Link: https://bugzilla.kernel.org/show_bug.cgi?id=214853 +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2473 +Signed-off-by: Mario Limonciello +Reviewed-by: Harry Wentland +Signed-off-by: Alex Deucher +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +index f0f948501e9a..cce47d3f1a13 100644 +--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c ++++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +@@ -515,11 +515,8 @@ static enum bp_result get_gpio_i2c_info( + info->i2c_slave_address = record->i2c_slave_addr; + + /* TODO: check how to get register offset for en, Y, etc. */ +- info->gpio_info.clk_a_register_index = +- le16_to_cpu( +- header->gpio_pin[table_index].data_a_reg_index); +- info->gpio_info.clk_a_shift = +- header->gpio_pin[table_index].gpio_bitshift; ++ info->gpio_info.clk_a_register_index = le16_to_cpu(pin->data_a_reg_index); ++ info->gpio_info.clk_a_shift = pin->gpio_bitshift; + + return BP_RESULT_OK; + } +-- +2.35.3 + diff --git a/patches.suse/drm-amd-display-Use-DC_LOG_DC-in-the-trasform-pixel-.patch b/patches.suse/drm-amd-display-Use-DC_LOG_DC-in-the-trasform-pixel-.patch new file mode 100644 index 0000000..9239aa4 --- /dev/null +++ b/patches.suse/drm-amd-display-Use-DC_LOG_DC-in-the-trasform-pixel-.patch @@ -0,0 +1,109 @@ +From 7222f5841ff49709ca666b05ff336776e0664a20 Mon Sep 17 00:00:00 2001 +From: Rodrigo Siqueira +Date: Tue, 1 Nov 2022 10:20:09 -0400 +Subject: [PATCH] drm/amd/display: Use DC_LOG_DC in the trasform pixel function +Git-commit: 7222f5841ff49709ca666b05ff336776e0664a20 +Patch-mainline: v6.4-rc1 +References: git-fixes + +[Why & How] +DC now uses a new commit sequence which is more robust since it +addresses cases where we need to reorganize pipes based on planes and +other parameters. As a result, this new commit sequence reset the DC +state by cleaning plane states and re-creating them accordingly with the +need. For this reason, the dce_transform_set_pixel_storage_depth can be +invoked after a plane state is destroyed and before its re-creation. In +this situation and on DCE devices, DC will hit a condition that will +trigger a dmesg log that looks like this: + +Console: switching to colour frame buffer device 240x67 +Acked-by: Takashi Iwai + +------------[ cut here ]------------ +[..] +Hardware name: System manufacturer System Product Name/PRIME X370-PRO, BIOS 5603 07/28/2020 +RIP: 0010:dce_transform_set_pixel_storage_depth+0x3f8/0x480 [amdgpu] +[..] +RSP: 0018:ffffc9000202b850 EFLAGS: 00010293 +RAX: ffffffffa081d100 RBX: ffff888110790000 RCX: 000000000000000c +RDX: ffff888100bedbf8 RSI: 0000000000001a50 RDI: ffff88810463c900 +RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000007 +R10: 0000000000000001 R11: 0000000000000f00 R12: ffff88810f500010 +R13: ffff888100bedbf8 R14: ffff88810f515688 R15: 0000000000000000 +FS: 00007ff0159249c0(0000) GS:ffff88840e940000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007ff01528e550 CR3: 0000000002a10000 CR4: 00000000003506e0 +Call Trace: + + ? dm_write_reg_func+0x21/0x80 [amdgpu 340dadd3f7c8cf4be11cf0bdc850245e99abe0e8] + dc_stream_set_dither_option+0xfb/0x130 [amdgpu 340dadd3f7c8cf4be11cf0bdc850245e99abe0e8] + amdgpu_dm_crtc_configure_crc_source+0x10b/0x190 [amdgpu 340dadd3f7c8cf4be11cf0bdc850245e99abe0e8] + amdgpu_dm_atomic_commit_tail+0x20a8/0x2a90 [amdgpu 340dadd3f7c8cf4be11cf0bdc850245e99abe0e8] + ? free_unref_page_commit+0x98/0x170 + ? free_unref_page+0xcc/0x150 + commit_tail+0x94/0x120 + drm_atomic_helper_commit+0x10f/0x140 + drm_atomic_commit+0x94/0xc0 + ? drm_plane_get_damage_clips.cold+0x1c/0x1c + drm_client_modeset_commit_atomic+0x203/0x250 + drm_client_modeset_commit_locked+0x56/0x150 + drm_client_modeset_commit+0x21/0x40 + drm_fb_helper_lastclose+0x42/0x70 + amdgpu_driver_lastclose_kms+0xa/0x10 [amdgpu 340dadd3f7c8cf4be11cf0bdc850245e99abe0e8] + drm_release+0xda/0x110 + __fput+0x89/0x240 + task_work_run+0x5c/0x90 + do_exit+0x333/0xae0 + do_group_exit+0x2d/0x90 + __x64_sys_exit_group+0x14/0x20 + do_syscall_64+0x5b/0x80 + ? exit_to_user_mode_prepare+0x1e/0x140 + entry_SYSCALL_64_after_hwframe+0x44/0xae +RIP: 0033:0x7ff016ceaca1 +Code: Unable to access opcode bytes at RIP 0x7ff016ceac77. +RSP: 002b:00007ffe7a2357e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 +RAX: ffffffffffffffda RBX: 00007ff016e15a00 RCX: 00007ff016ceaca1 +RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 +RBP: 0000000000000000 R08: ffffffffffffff78 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff016e15a00 +R13: 0000000000000000 R14: 00007ff016e1aee8 R15: 00007ff016e1af00 + + +Since this issue only happens in a transition state on DC, this commit +replace BREAK_TO_DEBUGGER with DC_LOG_DC. + +Reviewed-by: Harry Wentland +Acked-by: Qingqing Zhuo +Signed-off-by: Rodrigo Siqueira +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +--- + drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +index d9fd4ec60588..670d5ab9d998 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +@@ -1009,7 +1009,7 @@ static void dce_transform_set_pixel_storage_depth( + color_depth = COLOR_DEPTH_101010; + pixel_depth = 0; + expan_mode = 1; +- BREAK_TO_DEBUGGER(); ++ DC_LOG_DC("The pixel depth %d is not valid, set COLOR_DEPTH_101010 instead.", depth); + break; + } + +@@ -1023,8 +1023,7 @@ static void dce_transform_set_pixel_storage_depth( + if (!(xfm_dce->lb_pixel_depth_supported & depth)) { + /*we should use unsupported capabilities + * unless it is required by w/a*/ +- DC_LOG_WARNING("%s: Capability not supported", +- __func__); ++ DC_LOG_DC("%s: Capability not supported", __func__); + } + } + +-- +2.35.3 + diff --git a/patches.suse/drm-displayid-add-displayid_get_header-and-check-bou.patch b/patches.suse/drm-displayid-add-displayid_get_header-and-check-bou.patch new file mode 100644 index 0000000..5a4fe2d --- /dev/null +++ b/patches.suse/drm-displayid-add-displayid_get_header-and-check-bou.patch @@ -0,0 +1,62 @@ +From 5bacecc3c56131c31f18b23d366f2184328fd9cf Mon Sep 17 00:00:00 2001 +From: Jani Nikula +Date: Thu, 16 Feb 2023 22:44:58 +0200 +Subject: [PATCH] drm/displayid: add displayid_get_header() and check bounds better +Git-commit: 5bacecc3c56131c31f18b23d366f2184328fd9cf +Patch-mainline: v6.4-rc1 +References: git-fixes + +Add a helper to get a pointer to struct displayid_header. To be +pedantic, add buffer overflow checks to not touch the base if that +itself would overflow. + +Cc: Iaroslav Boliukin +Cc: Dmitry Osipenko +Signed-off-by: Jani Nikula +Tested-by: Dmitry Osipenko +Reviewed-by: Dmitry Osipenko +Signed-off-by: Dmitry Osipenko +Link: https://patchwork.freedesktop.org/patch/msgid/4a03b3a5132642d3cdb6d4c2641422955a917292.1676580180.git.jani.nikula@intel.com +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/drm_displayid.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_displayid.c b/drivers/gpu/drm/drm_displayid.c +index 38ea8203df45..7d03159dc146 100644 +--- a/drivers/gpu/drm/drm_displayid.c ++++ b/drivers/gpu/drm/drm_displayid.c +@@ -7,13 +7,28 @@ + #include + #include + ++static const struct displayid_header * ++displayid_get_header(const u8 *displayid, int length, int index) ++{ ++ const struct displayid_header *base; ++ ++ if (sizeof(*base) > length - index) ++ return ERR_PTR(-EINVAL); ++ ++ base = (const struct displayid_header *)&displayid[index]; ++ ++ return base; ++} ++ + static int validate_displayid(const u8 *displayid, int length, int idx) + { + int i, dispid_length; + u8 csum = 0; + const struct displayid_header *base; + +- base = (const struct displayid_header *)&displayid[idx]; ++ base = displayid_get_header(displayid, length, idx); ++ if (IS_ERR(base)) ++ return PTR_ERR(base); + + DRM_DEBUG_KMS("base revision 0x%x, length %d, %d %d\n", + base->rev, base->bytes, base->prod_id, base->ext_count); +-- +2.35.3 + diff --git a/patches.suse/drm-msm-dp-Clean-up-handling-of-DP-AUX-interrupts.patch b/patches.suse/drm-msm-dp-Clean-up-handling-of-DP-AUX-interrupts.patch new file mode 100644 index 0000000..f6adbc8 --- /dev/null +++ b/patches.suse/drm-msm-dp-Clean-up-handling-of-DP-AUX-interrupts.patch @@ -0,0 +1,201 @@ +From b20566cdef05cd40d95f10869d2a7646f48b1bbe Mon Sep 17 00:00:00 2001 +From: Douglas Anderson +Date: Thu, 26 Jan 2023 17:09:12 -0800 +Subject: [PATCH] drm/msm/dp: Clean up handling of DP AUX interrupts +Git-commit: b20566cdef05cd40d95f10869d2a7646f48b1bbe +Patch-mainline: v6.4-rc1 +References: git-fixes + +The DP AUX interrupt handling was a bit of a mess. +* There were two functions (one for "native" transfers and one for + "i2c" transfers) that were quite similar. It was hard to say how + many of the differences between the two functions were on purpose + and how many of them were just an accident of how they were coded. +* Each function sometimes used "else if" to test for error bits and + sometimes didn't and again it was hard to say if this was on purpose + or just an accident. +* The two functions wouldn't notice whether "unknown" bits were + set. For instance, there seems to be a bit "DP_INTR_PLL_UNLOCKED" + and if it was set there would be no indication. +* The two functions wouldn't notice if more than one error was set. + +Let's fix this by being more consistent / explicit about what we're +doing. + +By design this could cause different handling for AUX transfers, +though I'm not actually aware of any bug fixed as a result of +this patch (this patch was created because we simply noticed how odd +the old code was by code inspection). Specific notes here: +1. In the old native transfer case if we got "done + wrong address" + we'd ignore the "wrong address" (because of the "else if"). Now we + won't. +2. In the old native transfer case if we got "done + timeout" we'd + ignore the "timeout" (because of the "else if"). Now we won't. +3. In the old native transfer case we'd see "nack_defer" and translate + it to the error number for "nack". This differed from the i2c + transfer case where "nack_defer" was given the error number for + "nack_defer". This 100% can't matter because the only user of this + error number treats "nack defer" the same as "nack", so it's clear + that the difference between the "native" and "i2c" was pointless + here. +4. In the old i2c transfer case if we got "done" plus any error + besides "nack" or "defer" then we'd ignore the error. Now we don't. +5. If there is more than one error signaled by the hardware it's + possible that we'll report a different one than we used to. I don't + know if this matters. If someone is aware of a case this matters we + should document it and change the code to make it explicit. +6. One quirk we keep (I don't know if this is important) is that in + the i2c transfer case if we see "done + defer" we report that as a + "nack". That seemed too intentional in the old code to just drop. + +After this change we will add extra logging, including: +* A warning if we see more than one error bit set. +* A warning if we see an unexpected interrupt. +* A warning if we get an AUX transfer interrupt when shouldn't. + +It actually turns out that as a result of this change then at boot we +sometimes see an error: + [drm:dp_aux_isr] *ERROR* Unexpected DP AUX IRQ 0x01000000 when not busy +That means that, during init, we are seeing DP_INTR_PLL_UNLOCKED. For +now I'm going to say that leaving this error reported in the logs is +OK-ish and hopefully it will encourage someone to track down what's +going on at init time. + +One last note here is that this change renames one of the interrupt +bits. The bit named "i2c done" clearly was used for native transfers +being done too, so I renamed it to indicate this. + +Signed-off-by: Douglas Anderson +Tested-by: Kuogee Hsieh +Reviewed-by: Kuogee Hsieh +Patchwork: https://patchwork.freedesktop.org/patch/520658/ +Link: https://lore.kernel.org/r/20230126170745.v2.1.I90ffed3ddd21e818ae534f820cb4d6d8638859ab@changeid +Signed-off-by: Dmitry Baryshkov +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/msm/dp/dp_aux.c | 80 +++++++++++++++--------------------- + drivers/gpu/drm/msm/dp/dp_catalog.c | 2 + drivers/gpu/drm/msm/dp/dp_catalog.h | 2 + 3 files changed, 36 insertions(+), 48 deletions(-) + +--- a/drivers/gpu/drm/msm/dp/dp_aux.c ++++ b/drivers/gpu/drm/msm/dp/dp_aux.c +@@ -161,47 +161,6 @@ static ssize_t dp_aux_cmd_fifo_rx(struct + return i; + } + +-static void dp_aux_native_handler(struct dp_aux_private *aux, u32 isr) +-{ +- if (isr & DP_INTR_AUX_I2C_DONE) +- aux->aux_error_num = DP_AUX_ERR_NONE; +- else if (isr & DP_INTR_WRONG_ADDR) +- aux->aux_error_num = DP_AUX_ERR_ADDR; +- else if (isr & DP_INTR_TIMEOUT) +- aux->aux_error_num = DP_AUX_ERR_TOUT; +- if (isr & DP_INTR_NACK_DEFER) +- aux->aux_error_num = DP_AUX_ERR_NACK; +- if (isr & DP_INTR_AUX_ERROR) { +- aux->aux_error_num = DP_AUX_ERR_PHY; +- dp_catalog_aux_clear_hw_interrupts(aux->catalog); +- } +-} +- +-static void dp_aux_i2c_handler(struct dp_aux_private *aux, u32 isr) +-{ +- if (isr & DP_INTR_AUX_I2C_DONE) { +- if (isr & (DP_INTR_I2C_NACK | DP_INTR_I2C_DEFER)) +- aux->aux_error_num = DP_AUX_ERR_NACK; +- else +- aux->aux_error_num = DP_AUX_ERR_NONE; +- } else { +- if (isr & DP_INTR_WRONG_ADDR) +- aux->aux_error_num = DP_AUX_ERR_ADDR; +- else if (isr & DP_INTR_TIMEOUT) +- aux->aux_error_num = DP_AUX_ERR_TOUT; +- if (isr & DP_INTR_NACK_DEFER) +- aux->aux_error_num = DP_AUX_ERR_NACK_DEFER; +- if (isr & DP_INTR_I2C_NACK) +- aux->aux_error_num = DP_AUX_ERR_NACK; +- if (isr & DP_INTR_I2C_DEFER) +- aux->aux_error_num = DP_AUX_ERR_DEFER; +- if (isr & DP_INTR_AUX_ERROR) { +- aux->aux_error_num = DP_AUX_ERR_PHY; +- dp_catalog_aux_clear_hw_interrupts(aux->catalog); +- } +- } +-} +- + static void dp_aux_update_offset_and_segment(struct dp_aux_private *aux, + struct drm_dp_aux_msg *input_msg) + { +@@ -410,13 +369,42 @@ void dp_aux_isr(struct drm_dp_aux *dp_au + if (!isr) + return; + +- if (!aux->cmd_busy) ++ if (!aux->cmd_busy) { ++ DRM_ERROR("Unexpected DP AUX IRQ %#010x when not busy\n", isr); + return; ++ } + +- if (aux->native) +- dp_aux_native_handler(aux, isr); +- else +- dp_aux_i2c_handler(aux, isr); ++ /* ++ * The logic below assumes only one error bit is set (other than "done" ++ * which can apparently be set at the same time as some of the other ++ * bits). Warn if more than one get set so we know we need to improve ++ * the logic. ++ */ ++ if (hweight32(isr & ~DP_INTR_AUX_XFER_DONE) > 1) ++ DRM_WARN("Some DP AUX interrupts unhandled: %#010x\n", isr); ++ ++ if (isr & DP_INTR_AUX_ERROR) { ++ aux->aux_error_num = DP_AUX_ERR_PHY; ++ dp_catalog_aux_clear_hw_interrupts(aux->catalog); ++ } else if (isr & DP_INTR_NACK_DEFER) { ++ aux->aux_error_num = DP_AUX_ERR_NACK_DEFER; ++ } else if (isr & DP_INTR_WRONG_ADDR) { ++ aux->aux_error_num = DP_AUX_ERR_ADDR; ++ } else if (isr & DP_INTR_TIMEOUT) { ++ aux->aux_error_num = DP_AUX_ERR_TOUT; ++ } else if (!aux->native && (isr & DP_INTR_I2C_NACK)) { ++ aux->aux_error_num = DP_AUX_ERR_NACK; ++ } else if (!aux->native && (isr & DP_INTR_I2C_DEFER)) { ++ if (isr & DP_INTR_AUX_XFER_DONE) ++ aux->aux_error_num = DP_AUX_ERR_NACK; ++ else ++ aux->aux_error_num = DP_AUX_ERR_DEFER; ++ } else if (isr & DP_INTR_AUX_XFER_DONE) { ++ aux->aux_error_num = DP_AUX_ERR_NONE; ++ } else { ++ DRM_WARN("Unexpected interrupt: %#010x\n", isr); ++ return; ++ } + + complete(&aux->comp); + } +--- a/drivers/gpu/drm/msm/dp/dp_catalog.c ++++ b/drivers/gpu/drm/msm/dp/dp_catalog.c +@@ -34,7 +34,7 @@ + #define MSM_DP_CONTROLLER_P0_SIZE 0x0400 + + #define DP_INTERRUPT_STATUS1 \ +- (DP_INTR_AUX_I2C_DONE| \ ++ (DP_INTR_AUX_XFER_DONE| \ + DP_INTR_WRONG_ADDR | DP_INTR_TIMEOUT | \ + DP_INTR_NACK_DEFER | DP_INTR_WRONG_DATA_CNT | \ + DP_INTR_I2C_NACK | DP_INTR_I2C_DEFER | \ +--- a/drivers/gpu/drm/msm/dp/dp_catalog.h ++++ b/drivers/gpu/drm/msm/dp/dp_catalog.h +@@ -13,7 +13,7 @@ + + /* interrupts */ + #define DP_INTR_HPD BIT(0) +-#define DP_INTR_AUX_I2C_DONE BIT(3) ++#define DP_INTR_AUX_XFER_DONE BIT(3) + #define DP_INTR_WRONG_ADDR BIT(6) + #define DP_INTR_TIMEOUT BIT(9) + #define DP_INTR_NACK_DEFER BIT(12) diff --git a/patches.suse/drm-msm-dpu-Add-INTF_5-interrupts.patch b/patches.suse/drm-msm-dpu-Add-INTF_5-interrupts.patch new file mode 100644 index 0000000..07cc34d --- /dev/null +++ b/patches.suse/drm-msm-dpu-Add-INTF_5-interrupts.patch @@ -0,0 +1,61 @@ +From 148e852f290fe8be9fa69953bee2f958befd65d4 Mon Sep 17 00:00:00 2001 +From: Bjorn Andersson +Date: Mon, 14 Feb 2022 20:33:52 -0800 +Subject: [PATCH] drm/msm/dpu: Add INTF_5 interrupts +Git-commit: 148e852f290fe8be9fa69953bee2f958befd65d4 +Patch-mainline: v5.18-rc1 +References: git-fixes + +SC8180x has the eDP controller wired up to INTF_5, so add the interrupt +register block for this interface to the list. + +Signed-off-by: Bjorn Andersson +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20220215043353.1256754-1-bjorn.andersson@linaro.org +Signed-off-by: Dmitry Baryshkov +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c | 6 ++++++ + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.h | 1 + + 2 files changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c +index 27073fd49fee..c515b7cf922c 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c +@@ -23,6 +23,7 @@ + #define MDP_INTF_2_OFF 0x6B000 + #define MDP_INTF_3_OFF 0x6B800 + #define MDP_INTF_4_OFF 0x6C000 ++#define MDP_INTF_5_OFF 0x6C800 + #define MDP_AD4_0_OFF 0x7C000 + #define MDP_AD4_1_OFF 0x7D000 + #define MDP_AD4_INTR_EN_OFF 0x41c +@@ -93,6 +94,11 @@ static const struct dpu_intr_reg dpu_intr_set[] = { + MDP_INTF_4_OFF+INTF_INTR_EN, + MDP_INTF_4_OFF+INTF_INTR_STATUS + }, ++ { ++ MDP_INTF_5_OFF+INTF_INTR_CLEAR, ++ MDP_INTF_5_OFF+INTF_INTR_EN, ++ MDP_INTF_5_OFF+INTF_INTR_STATUS ++ }, + { + MDP_AD4_0_OFF + MDP_AD4_INTR_CLEAR_OFF, + MDP_AD4_0_OFF + MDP_AD4_INTR_EN_OFF, +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.h +index 1ab75cccd145..37379966d8ec 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.h +@@ -22,6 +22,7 @@ enum dpu_hw_intr_reg { + MDP_INTF2_INTR, + MDP_INTF3_INTR, + MDP_INTF4_INTR, ++ MDP_INTF5_INTR, + MDP_AD4_0_INTR, + MDP_AD4_1_INTR, + MDP_INTF0_7xxx_INTR, +-- +2.35.3 + diff --git a/patches.suse/drm-msm-dpu-Move-non-MDP_TOP-INTF_INTR-offsets-out-o.patch b/patches.suse/drm-msm-dpu-Move-non-MDP_TOP-INTF_INTR-offsets-out-o.patch new file mode 100644 index 0000000..3e53b3f --- /dev/null +++ b/patches.suse/drm-msm-dpu-Move-non-MDP_TOP-INTF_INTR-offsets-out-o.patch @@ -0,0 +1,60 @@ +From e9d9ce5462fecdeefec87953de71df4d025cbc72 Mon Sep 17 00:00:00 2001 +From: Marijn Suijten +Date: Thu, 27 Apr 2023 00:37:17 +0200 +Subject: [PATCH] drm/msm/dpu: Move non-MDP_TOP INTF_INTR offsets out of hwio header +Git-commit: e9d9ce5462fecdeefec87953de71df4d025cbc72 +Patch-mainline: v6.4-rc3 +References: git-fixes + +These offsets do not fall under the MDP TOP block and do not fit the +comment right above. Move them to dpu_hw_interrupts.c next to the +repsective MDP_INTF_x_OFF interrupt block offsets. + +Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") +Signed-off-by: Marijn Suijten +Reviewed-by: Konrad Dybcio +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/534203/ +Link: https://lore.kernel.org/r/20230411-dpu-intf-te-v4-3-27ce1a5ab5c6@somainline.org +Signed-off-by: Abhinav Kumar +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c | 5 ++++- + drivers/gpu/drm/msm/disp/dpu1/dpu_hwio.h | 3 --- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c +@@ -12,7 +12,7 @@ + + /** + * Register offsets in MDSS register file for the interrupt registers +- * w.r.t. to the MDP base ++ * w.r.t. the MDP base + */ + #define MDP_SSPP_TOP0_OFF 0x0 + #define MDP_INTF_0_OFF 0x6A000 +@@ -21,6 +21,9 @@ + #define MDP_INTF_3_OFF 0x6B800 + #define MDP_INTF_4_OFF 0x6C000 + #define MDP_INTF_5_OFF 0x6C800 ++#define INTF_INTR_EN 0x1c0 ++#define INTF_INTR_STATUS 0x1c4 ++#define INTF_INTR_CLEAR 0x1c8 + #define MDP_AD4_0_OFF 0x7C000 + #define MDP_AD4_1_OFF 0x7D000 + #define MDP_AD4_INTR_EN_OFF 0x41c +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hwio.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hwio.h +@@ -20,9 +20,6 @@ + #define HIST_INTR_EN 0x01c + #define HIST_INTR_STATUS 0x020 + #define HIST_INTR_CLEAR 0x024 +-#define INTF_INTR_EN 0x1C0 +-#define INTF_INTR_STATUS 0x1C4 +-#define INTF_INTR_CLEAR 0x1C8 + #define SPLIT_DISPLAY_EN 0x2F4 + #define SPLIT_DISPLAY_UPPER_PIPE_CTRL 0x2F8 + #define DSPP_IGC_COLOR0_RAM_LUTN 0x300 diff --git a/patches.suse/drm-tegra-Avoid-potential-32-bit-integer-overflow.patch b/patches.suse/drm-tegra-Avoid-potential-32-bit-integer-overflow.patch new file mode 100644 index 0000000..30c44f8 --- /dev/null +++ b/patches.suse/drm-tegra-Avoid-potential-32-bit-integer-overflow.patch @@ -0,0 +1,37 @@ +From 2429b3c529da29d4277d519bd66d034842dcd70c Mon Sep 17 00:00:00 2001 +From: Nur Hussein +Date: Thu, 6 Apr 2023 04:25:59 +0800 +Subject: [PATCH] drm/tegra: Avoid potential 32-bit integer overflow +Git-commit: 2429b3c529da29d4277d519bd66d034842dcd70c +Patch-mainline: v6.4-rc1 +References: git-fixes + +In tegra_sor_compute_config(), the 32-bit value mode->clock is +multiplied by 1000, and assigned to the u64 variable pclk. We can avoid +a potential 32-bit integer overflow by casting mode->clock to u64 before +we do the arithmetic and assignment. + +Signed-off-by: Nur Hussein +Signed-off-by: Thierry Reding +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/tegra/sor.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c +index cd25f409979c..8d910695775c 100644 +--- a/drivers/gpu/drm/tegra/sor.c ++++ b/drivers/gpu/drm/tegra/sor.c +@@ -1153,7 +1153,7 @@ static int tegra_sor_compute_config(struct tegra_sor *sor, + struct drm_dp_link *link) + { + const u64 f = 100000, link_rate = link->rate * 1000; +- const u64 pclk = mode->clock * 1000; ++ const u64 pclk = (u64)mode->clock * 1000; + u64 input, output, watermark, num; + struct tegra_sor_params params; + u32 num_syms_per_line; +-- +2.35.3 + diff --git a/patches.suse/media-cx23885-Fix-a-null-ptr-deref-bug-in-buffer_pre.patch b/patches.suse/media-cx23885-Fix-a-null-ptr-deref-bug-in-buffer_pre.patch new file mode 100644 index 0000000..7ab994a --- /dev/null +++ b/patches.suse/media-cx23885-Fix-a-null-ptr-deref-bug-in-buffer_pre.patch @@ -0,0 +1,109 @@ +From 47e8b73bc35d7c54642f78e498697692f6358996 Mon Sep 17 00:00:00 2001 +From: harperchen +Date: Thu, 2 Mar 2023 13:39:05 +0100 +Subject: [PATCH] media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish() +Git-commit: 47e8b73bc35d7c54642f78e498697692f6358996 +Patch-mainline: v6.4-rc1 +References: git-fixes + +When the driver calls cx23885_risc_buffer() to prepare the buffer, the +function call dma_alloc_coherent may fail, resulting in a empty buffer +risc->cpu. Later when we free the buffer or access the buffer, null ptr +deref is triggered. + +This bug is similar to the following one: +https://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71. + +We believe the bug can be also dynamically triggered from user side. +Similarly, we fix this by checking the return value of cx23885_risc_buffer() +and the value of risc->cpu before buffer free. + +Signed-off-by: harperchen +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/pci/cx23885/cx23885-core.c | 4 +++- + drivers/media/pci/cx23885/cx23885-video.c | 13 +++++++------ + 2 files changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/media/pci/cx23885/cx23885-core.c b/drivers/media/pci/cx23885/cx23885-core.c +index 9232a966bcab..2ce2914576cf 100644 +--- a/drivers/media/pci/cx23885/cx23885-core.c ++++ b/drivers/media/pci/cx23885/cx23885-core.c +@@ -1325,7 +1325,9 @@ void cx23885_free_buffer(struct cx23885_dev *dev, struct cx23885_buffer *buf) + { + struct cx23885_riscmem *risc = &buf->risc; + +- dma_free_coherent(&dev->pci->dev, risc->size, risc->cpu, risc->dma); ++ if (risc->cpu) ++ dma_free_coherent(&dev->pci->dev, risc->size, risc->cpu, risc->dma); ++ memset(risc, 0, sizeof(*risc)); + } + + static void cx23885_tsport_reg_dump(struct cx23885_tsport *port) +diff --git a/drivers/media/pci/cx23885/cx23885-video.c b/drivers/media/pci/cx23885/cx23885-video.c +index 3d03f5e95786..671fc0588e43 100644 +--- a/drivers/media/pci/cx23885/cx23885-video.c ++++ b/drivers/media/pci/cx23885/cx23885-video.c +@@ -342,6 +342,7 @@ static int queue_setup(struct vb2_queue *q, + + static int buffer_prepare(struct vb2_buffer *vb) + { ++ int ret; + struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb); + struct cx23885_dev *dev = vb->vb2_queue->drv_priv; + struct cx23885_buffer *buf = +@@ -358,12 +359,12 @@ static int buffer_prepare(struct vb2_buffer *vb) + + switch (dev->field) { + case V4L2_FIELD_TOP: +- cx23885_risc_buffer(dev->pci, &buf->risc, ++ ret = cx23885_risc_buffer(dev->pci, &buf->risc, + sgt->sgl, 0, UNSET, + buf->bpl, 0, dev->height); + break; + case V4L2_FIELD_BOTTOM: +- cx23885_risc_buffer(dev->pci, &buf->risc, ++ ret = cx23885_risc_buffer(dev->pci, &buf->risc, + sgt->sgl, UNSET, 0, + buf->bpl, 0, dev->height); + break; +@@ -391,21 +392,21 @@ static int buffer_prepare(struct vb2_buffer *vb) + line0_offset = 0; + line1_offset = buf->bpl; + } +- cx23885_risc_buffer(dev->pci, &buf->risc, ++ ret = cx23885_risc_buffer(dev->pci, &buf->risc, + sgt->sgl, line0_offset, + line1_offset, + buf->bpl, buf->bpl, + dev->height >> 1); + break; + case V4L2_FIELD_SEQ_TB: +- cx23885_risc_buffer(dev->pci, &buf->risc, ++ ret = cx23885_risc_buffer(dev->pci, &buf->risc, + sgt->sgl, + 0, buf->bpl * (dev->height >> 1), + buf->bpl, 0, + dev->height >> 1); + break; + case V4L2_FIELD_SEQ_BT: +- cx23885_risc_buffer(dev->pci, &buf->risc, ++ ret = cx23885_risc_buffer(dev->pci, &buf->risc, + sgt->sgl, + buf->bpl * (dev->height >> 1), 0, + buf->bpl, 0, +@@ -418,7 +419,7 @@ static int buffer_prepare(struct vb2_buffer *vb) + buf, buf->vb.vb2_buf.index, + dev->width, dev->height, dev->fmt->depth, dev->fmt->fourcc, + (unsigned long)buf->risc.dma); +- return 0; ++ return ret; + } + + static void buffer_finish(struct vb2_buffer *vb) +-- +2.35.3 + diff --git a/patches.suse/media-pci-tw68-Fix-null-ptr-deref-bug-in-buf-prepare.patch b/patches.suse/media-pci-tw68-Fix-null-ptr-deref-bug-in-buf-prepare.patch new file mode 100644 index 0000000..5daabea --- /dev/null +++ b/patches.suse/media-pci-tw68-Fix-null-ptr-deref-bug-in-buf-prepare.patch @@ -0,0 +1,91 @@ +From 1634b7adcc5bef645b3666fdd564e5952a9e24e0 Mon Sep 17 00:00:00 2001 +From: harperchen +Date: Fri, 3 Mar 2023 16:30:11 +0100 +Subject: [PATCH] media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish +Git-commit: 1634b7adcc5bef645b3666fdd564e5952a9e24e0 +Patch-mainline: v6.4-rc1 +References: git-fixes + +When the driver calls tw68_risc_buffer() to prepare the buffer, the +function call dma_alloc_coherent may fail, resulting in a empty buffer +buf->cpu. Later when we free the buffer or access the buffer, null ptr +deref is triggered. + +This bug is similar to the following one: +https://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71. + +We believe the bug can be also dynamically triggered from user side. +Similarly, we fix this by checking the return value of tw68_risc_buffer() +and the value of buf->cpu before buffer free. + +Signed-off-by: harperchen +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/pci/tw68/tw68-video.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/media/pci/tw68/tw68-video.c b/drivers/media/pci/tw68/tw68-video.c +index 0cbc5b038073..773a18702d36 100644 +--- a/drivers/media/pci/tw68/tw68-video.c ++++ b/drivers/media/pci/tw68/tw68-video.c +@@ -437,6 +437,7 @@ static void tw68_buf_queue(struct vb2_buffer *vb) + */ + static int tw68_buf_prepare(struct vb2_buffer *vb) + { ++ int ret; + struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb); + struct vb2_queue *vq = vb->vb2_queue; + struct tw68_dev *dev = vb2_get_drv_priv(vq); +@@ -452,30 +453,30 @@ static int tw68_buf_prepare(struct vb2_buffer *vb) + bpl = (dev->width * dev->fmt->depth) >> 3; + switch (dev->field) { + case V4L2_FIELD_TOP: +- tw68_risc_buffer(dev->pci, buf, dma->sgl, ++ ret = tw68_risc_buffer(dev->pci, buf, dma->sgl, + 0, UNSET, bpl, 0, dev->height); + break; + case V4L2_FIELD_BOTTOM: +- tw68_risc_buffer(dev->pci, buf, dma->sgl, ++ ret = tw68_risc_buffer(dev->pci, buf, dma->sgl, + UNSET, 0, bpl, 0, dev->height); + break; + case V4L2_FIELD_SEQ_TB: +- tw68_risc_buffer(dev->pci, buf, dma->sgl, ++ ret = tw68_risc_buffer(dev->pci, buf, dma->sgl, + 0, bpl * (dev->height >> 1), + bpl, 0, dev->height >> 1); + break; + case V4L2_FIELD_SEQ_BT: +- tw68_risc_buffer(dev->pci, buf, dma->sgl, ++ ret = tw68_risc_buffer(dev->pci, buf, dma->sgl, + bpl * (dev->height >> 1), 0, + bpl, 0, dev->height >> 1); + break; + case V4L2_FIELD_INTERLACED: + default: +- tw68_risc_buffer(dev->pci, buf, dma->sgl, ++ ret = tw68_risc_buffer(dev->pci, buf, dma->sgl, + 0, bpl, bpl, bpl, dev->height >> 1); + break; + } +- return 0; ++ return ret; + } + + static void tw68_buf_finish(struct vb2_buffer *vb) +@@ -485,7 +486,8 @@ static void tw68_buf_finish(struct vb2_buffer *vb) + struct tw68_dev *dev = vb2_get_drv_priv(vq); + struct tw68_buf *buf = container_of(vbuf, struct tw68_buf, vb); + +- dma_free_coherent(&dev->pci->dev, buf->size, buf->cpu, buf->dma); ++ if (buf->cpu) ++ dma_free_coherent(&dev->pci->dev, buf->size, buf->cpu, buf->dma); + } + + static int tw68_start_streaming(struct vb2_queue *q, unsigned int count) +-- +2.35.3 + diff --git a/patches.suse/memstick-r592-Fix-UAF-bug-in-r592_remove-due-to-race.patch b/patches.suse/memstick-r592-Fix-UAF-bug-in-r592_remove-due-to-race.patch new file mode 100644 index 0000000..8f5bd85 --- /dev/null +++ b/patches.suse/memstick-r592-Fix-UAF-bug-in-r592_remove-due-to-race.patch @@ -0,0 +1,53 @@ +From 63264422785021704c39b38f65a78ab9e4a186d7 Mon Sep 17 00:00:00 2001 +From: Zheng Wang +Date: Wed, 8 Mar 2023 00:43:38 +0800 +Subject: [PATCH] memstick: r592: Fix UAF bug in r592_remove due to race condition +Git-commit: 63264422785021704c39b38f65a78ab9e4a186d7 +Patch-mainline: v6.4-rc1 +References: bsc#1211449 + +In r592_probe, dev->detect_timer was bound with r592_detect_timer. +In r592_irq function, the timer function will be invoked by mod_timer. + +If we remove the module which will call hantro_release to make cleanup, +there may be a unfinished work. The possible sequence is as follows, +which will cause a typical UAF bug. + +Fix it by canceling the work before cleanup in r592_remove. + +CPU0 CPU1 + + |r592_detect_timer +r592_remove | + memstick_free_host| + put_device; | + kfree(host); | + | + | queue_work + | &host->media_checker //use + +Signed-off-by: Zheng Wang +Link: https://lore.kernel.org/r/20230307164338.1246287-1-zyytlz.wz@163.com +Signed-off-by: Ulf Hansson +Acked-by: Takashi Iwai + +--- + drivers/memstick/host/r592.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c +index 1d35d147552d..42bfc46842b8 100644 +--- a/drivers/memstick/host/r592.c ++++ b/drivers/memstick/host/r592.c +@@ -829,7 +829,7 @@ static void r592_remove(struct pci_dev *pdev) + /* Stop the processing thread. + That ensures that we won't take any more requests */ + kthread_stop(dev->io_thread); +- ++ del_timer_sync(&dev->detect_timer); + r592_enable_device(dev, false); + + while (!error && dev->req) { +-- +2.35.3 + diff --git a/patches.suse/mfd-dln2-Fix-memory-leak-in-dln2_probe.patch b/patches.suse/mfd-dln2-Fix-memory-leak-in-dln2_probe.patch new file mode 100644 index 0000000..1aa658d --- /dev/null +++ b/patches.suse/mfd-dln2-Fix-memory-leak-in-dln2_probe.patch @@ -0,0 +1,38 @@ +From 96da8f148396329ba769246cb8ceaa35f1ddfc48 Mon Sep 17 00:00:00 2001 +From: Qiang Ning +Date: Thu, 30 Mar 2023 10:43:53 +0800 +Subject: [PATCH] mfd: dln2: Fix memory leak in dln2_probe() +Git-commit: 96da8f148396329ba769246cb8ceaa35f1ddfc48 +Patch-mainline: v6.4-rc1 +References: git-fixes + +When dln2_setup_rx_urbs() in dln2_probe() fails, error out_free forgets +to call usb_put_dev() to decrease the refcount of dln2->usb_dev. + +Fix this by adding usb_put_dev() in the error handling code of +dln2_probe(). + +Signed-off-by: Qiang Ning +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20230330024353.4503-1-qning0106@126.com +Acked-by: Takashi Iwai + +--- + drivers/mfd/dln2.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mfd/dln2.c b/drivers/mfd/dln2.c +index 6cd0b0c752d6..c3149729cec2 100644 +--- a/drivers/mfd/dln2.c ++++ b/drivers/mfd/dln2.c +@@ -827,6 +827,7 @@ static int dln2_probe(struct usb_interface *interface, + dln2_stop_rx_urbs(dln2); + + out_free: ++ usb_put_dev(dln2->usb_dev); + dln2_free(dln2); + + return ret; +-- +2.35.3 + diff --git a/patches.suse/mmc-sdhci-esdhc-imx-make-no-mmc-hs400-works.patch b/patches.suse/mmc-sdhci-esdhc-imx-make-no-mmc-hs400-works.patch new file mode 100644 index 0000000..4fdc4b9 --- /dev/null +++ b/patches.suse/mmc-sdhci-esdhc-imx-make-no-mmc-hs400-works.patch @@ -0,0 +1,79 @@ +From 81dce1490e28439c3cd8a8650b862a712f3061ba Mon Sep 17 00:00:00 2001 +From: Haibo Chen +Date: Thu, 4 May 2023 19:22:22 +0800 +Subject: [PATCH] mmc: sdhci-esdhc-imx: make "no-mmc-hs400" works +Git-commit: 81dce1490e28439c3cd8a8650b862a712f3061ba +Patch-mainline: v6.4-rc4 +References: git-fixes + +After commit 1ed5c3b22fc7 ("mmc: sdhci-esdhc-imx: Propagate +ESDHC_FLAG_HS400* only on 8bit bus"), the property "no-mmc-hs400" +from device tree file do not work any more. +This patch reorder the code, which can avoid the warning message +"drop HS400 support since no 8-bit bus" and also make the property +"no-mmc-hs400" from dts file works. + +Fixes: 1ed5c3b22fc7 ("mmc: sdhci-esdhc-imx: Propagate ESDHC_FLAG_HS400* only on 8bit bus") +Signed-off-by: Haibo Chen +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230504112222.3599602-1-haibo.chen@nxp.com +Signed-off-by: Ulf Hansson +Acked-by: Takashi Iwai + +--- + drivers/mmc/host/sdhci-esdhc-imx.c | 18 ++++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +--- a/drivers/mmc/host/sdhci-esdhc-imx.c ++++ b/drivers/mmc/host/sdhci-esdhc-imx.c +@@ -1581,6 +1581,10 @@ sdhci_esdhc_imx_probe_dt(struct platform + if (ret) + return ret; + ++ /* HS400/HS400ES require 8 bit bus */ ++ if (!(host->mmc->caps & MMC_CAP_8_BIT_DATA)) ++ host->mmc->caps2 &= ~(MMC_CAP2_HS400 | MMC_CAP2_HS400_ES); ++ + if (mmc_gpio_get_cd(host->mmc) >= 0) + host->quirks &= ~SDHCI_QUIRK_BROKEN_CARD_DETECTION; + +@@ -1665,10 +1669,6 @@ static int sdhci_esdhc_imx_probe(struct + host->mmc_host_ops.execute_tuning = usdhc_execute_tuning; + } + +- err = sdhci_esdhc_imx_probe_dt(pdev, host, imx_data); +- if (err) +- goto disable_ahb_clk; +- + if (imx_data->socdata->flags & ESDHC_FLAG_MAN_TUNING) + sdhci_esdhc_ops.platform_execute_tuning = + esdhc_executing_tuning; +@@ -1676,15 +1676,13 @@ static int sdhci_esdhc_imx_probe(struct + if (imx_data->socdata->flags & ESDHC_FLAG_ERR004536) + host->quirks |= SDHCI_QUIRK_BROKEN_ADMA; + +- if (host->mmc->caps & MMC_CAP_8_BIT_DATA && +- imx_data->socdata->flags & ESDHC_FLAG_HS400) ++ if (imx_data->socdata->flags & ESDHC_FLAG_HS400) + host->mmc->caps2 |= MMC_CAP2_HS400; + + if (imx_data->socdata->flags & ESDHC_FLAG_BROKEN_AUTO_CMD23) + host->quirks2 |= SDHCI_QUIRK2_ACMD23_BROKEN; + +- if (host->mmc->caps & MMC_CAP_8_BIT_DATA && +- imx_data->socdata->flags & ESDHC_FLAG_HS400_ES) { ++ if (imx_data->socdata->flags & ESDHC_FLAG_HS400_ES) { + host->mmc->caps2 |= MMC_CAP2_HS400_ES; + host->mmc_host_ops.hs400_enhanced_strobe = + esdhc_hs400_enhanced_strobe; +@@ -1706,6 +1704,10 @@ static int sdhci_esdhc_imx_probe(struct + goto disable_ahb_clk; + } + ++ err = sdhci_esdhc_imx_probe_dt(pdev, host, imx_data); ++ if (err) ++ goto disable_ahb_clk; ++ + sdhci_esdhc_imx_hwinit(host); + + err = sdhci_add_host(host); diff --git a/patches.suse/net-phy-dp83867-add-w-a-for-packet-errors-seen-with-.patch b/patches.suse/net-phy-dp83867-add-w-a-for-packet-errors-seen-with-.patch new file mode 100644 index 0000000..a4c0a74 --- /dev/null +++ b/patches.suse/net-phy-dp83867-add-w-a-for-packet-errors-seen-with-.patch @@ -0,0 +1,77 @@ +From 0b01db274028f5acd207332686ffc92ac77491ac Mon Sep 17 00:00:00 2001 +From: Grygorii Strashko +Date: Wed, 10 May 2023 18:21:39 +0530 +Subject: [PATCH] net: phy: dp83867: add w/a for packet errors seen with short cables +Git-commit: 0b01db274028f5acd207332686ffc92ac77491ac +Patch-mainline: v6.4-rc3 +References: git-fixes + +Introduce the W/A for packet errors seen with short cables (<1m) between +two DP83867 PHYs. + +The W/A recommended by DM requires FFE Equalizer Configuration tuning by +writing value 0x0E81 to DSP_FFE_CFG register (0x012C), surrounded by hard +and soft resets as follows: + +write_reg(0x001F, 0x8000); //hard reset +write_reg(DSP_FFE_CFG, 0x0E81); +write_reg(0x001F, 0x4000); //soft reset + +Since DP83867 PHY DM says "Changing this register to 0x0E81, will not +affect Long Cable performance.", enable the W/A by default. + +Fixes: 2a10154abcb7 ("net: phy: dp83867: Add TI dp83867 phy") +Signed-off-by: Grygorii Strashko +Signed-off-by: Siddharth Vadapalli +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Acked-by: Takashi Iwai + +--- + drivers/net/phy/dp83867.c | 22 +++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c +index d75f526a20a4..76f5a2402fb0 100644 +--- a/drivers/net/phy/dp83867.c ++++ b/drivers/net/phy/dp83867.c +@@ -44,6 +44,7 @@ + #define DP83867_STRAP_STS1 0x006E + #define DP83867_STRAP_STS2 0x006f + #define DP83867_RGMIIDCTL 0x0086 ++#define DP83867_DSP_FFE_CFG 0x012c + #define DP83867_RXFCFG 0x0134 + #define DP83867_RXFPMD1 0x0136 + #define DP83867_RXFPMD2 0x0137 +@@ -941,8 +942,27 @@ static int dp83867_phy_reset(struct phy_device *phydev) + + usleep_range(10, 20); + +- return phy_modify(phydev, MII_DP83867_PHYCTRL, ++ err = phy_modify(phydev, MII_DP83867_PHYCTRL, + DP83867_PHYCR_FORCE_LINK_GOOD, 0); ++ if (err < 0) ++ return err; ++ ++ /* Configure the DSP Feedforward Equalizer Configuration register to ++ * improve short cable (< 1 meter) performance. This will not affect ++ * long cable performance. ++ */ ++ err = phy_write_mmd(phydev, DP83867_DEVADDR, DP83867_DSP_FFE_CFG, ++ 0x0e81); ++ if (err < 0) ++ return err; ++ ++ err = phy_write(phydev, DP83867_CTRL, DP83867_SW_RESTART); ++ if (err < 0) ++ return err; ++ ++ usleep_range(10, 20); ++ ++ return 0; + } + + static void dp83867_link_change_notify(struct phy_device *phydev) +-- +2.35.3 + diff --git a/patches.suse/nilfs2-fix-use-after-free-bug-of-nilfs_root-in-nilfs.patch b/patches.suse/nilfs2-fix-use-after-free-bug-of-nilfs_root-in-nilfs.patch new file mode 100644 index 0000000..94bb2c9 --- /dev/null +++ b/patches.suse/nilfs2-fix-use-after-free-bug-of-nilfs_root-in-nilfs.patch @@ -0,0 +1,70 @@ +From 9b5a04ac3ad9898c4745cba46ea26de74ba56a8e Mon Sep 17 00:00:00 2001 +From: Ryusuke Konishi +Date: Wed, 10 May 2023 00:29:56 +0900 +Subject: [PATCH] nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() +Git-commit: 9b5a04ac3ad9898c4745cba46ea26de74ba56a8e +Patch-mainline: v6.4-rc3 +References: git-fixes + +During unmount process of nilfs2, nothing holds nilfs_root structure after +nilfs2 detaches its writer in nilfs_detach_log_writer(). However, since +nilfs_evict_inode() uses nilfs_root for some cleanup operations, it may +cause use-after-free read if inodes are left in "garbage_list" and +released by nilfs_dispose_list() at the end of nilfs_detach_log_writer(). + +Fix this issue by modifying nilfs_evict_inode() to only clear inode +without additional metadata changes that use nilfs_root if the file system +is degraded to read-only or the writer is detached. + +Link: https://lkml.kernel.org/r/20230509152956.8313-1-konishi.ryusuke@gmail.com +Signed-off-by: Ryusuke Konishi +Reported-by: syzbot+78d4495558999f55d1da@syzkaller.appspotmail.com +Closes: https://lkml.kernel.org/r/00000000000099e5ac05fb1c3b85@google.com +Tested-by: Ryusuke Konishi +Cc: +Signed-off-by: Andrew Morton +Acked-by: Takashi Iwai + +--- + fs/nilfs2/inode.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c +index 1310d2d5feb3..a8ce522ac747 100644 +--- a/fs/nilfs2/inode.c ++++ b/fs/nilfs2/inode.c +@@ -917,6 +917,7 @@ void nilfs_evict_inode(struct inode *inode) + struct nilfs_transaction_info ti; + struct super_block *sb = inode->i_sb; + struct nilfs_inode_info *ii = NILFS_I(inode); ++ struct the_nilfs *nilfs; + int ret; + + if (inode->i_nlink || !ii->i_root || unlikely(is_bad_inode(inode))) { +@@ -929,6 +930,23 @@ void nilfs_evict_inode(struct inode *inode) + + truncate_inode_pages_final(&inode->i_data); + ++ nilfs = sb->s_fs_info; ++ if (unlikely(sb_rdonly(sb) || !nilfs->ns_writer)) { ++ /* ++ * If this inode is about to be disposed after the file system ++ * has been degraded to read-only due to file system corruption ++ * or after the writer has been detached, do not make any ++ * changes that cause writes, just clear it. ++ * Do this check after read-locking ns_segctor_sem by ++ * nilfs_transaction_begin() in order to avoid a race with ++ * the writer detach operation. ++ */ ++ clear_inode(inode); ++ nilfs_clear_inode(inode); ++ nilfs_transaction_abort(sb); ++ return; ++ } ++ + /* TODO: some of the following operations may fail. */ + nilfs_truncate_bmap(ii, 0); + nilfs_mark_inode_dirty(inode); +-- +2.35.3 + diff --git a/patches.suse/phy-st-miphy28lp-use-_poll_timeout-functions-for-wai.patch b/patches.suse/phy-st-miphy28lp-use-_poll_timeout-functions-for-wai.patch new file mode 100644 index 0000000..4153624 --- /dev/null +++ b/patches.suse/phy-st-miphy28lp-use-_poll_timeout-functions-for-wai.patch @@ -0,0 +1,108 @@ +From e3be4dd2c8d8aabfd2c3127d0e2e5754d3ae82d6 Mon Sep 17 00:00:00 2001 +From: Alain Volmat +Date: Fri, 10 Feb 2023 23:43:08 +0100 +Subject: [PATCH] phy: st: miphy28lp: use _poll_timeout functions for waits +Git-commit: e3be4dd2c8d8aabfd2c3127d0e2e5754d3ae82d6 +Patch-mainline: v6.4-rc1 +References: git-fixes + +This commit introduces _poll_timeout functions usage instead of +wait loops waiting for a status bit. + +Signed-off-by: Alain Volmat +Reviewed-by: Patrice Chotard +Link: https://lore.kernel.org/r/20230210224309.98452-1-avolmat@me.com +Signed-off-by: Vinod Koul +Acked-by: Takashi Iwai + +--- + drivers/phy/st/phy-miphy28lp.c | 42 +++++++++-------------------------------- + 1 file changed, 10 insertions(+), 32 deletions(-) + +--- a/drivers/phy/st/phy-miphy28lp.c ++++ b/drivers/phy/st/phy-miphy28lp.c +@@ -9,6 +9,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -484,19 +485,11 @@ static inline void miphy28lp_pcie_config + + static inline int miphy28lp_wait_compensation(struct miphy28lp_phy *miphy_phy) + { +- unsigned long finish = jiffies + 5 * HZ; + u8 val; + + /* Waiting for Compensation to complete */ +- do { +- val = readb_relaxed(miphy_phy->base + MIPHY_COMP_FSM_6); +- +- if (time_after_eq(jiffies, finish)) +- return -EBUSY; +- cpu_relax(); +- } while (!(val & COMP_DONE)); +- +- return 0; ++ return readb_relaxed_poll_timeout(miphy_phy->base + MIPHY_COMP_FSM_6, ++ val, val & COMP_DONE, 1, 5 * USEC_PER_SEC); + } + + +@@ -805,7 +798,6 @@ static inline void miphy28lp_configure_u + + static inline int miphy_is_ready(struct miphy28lp_phy *miphy_phy) + { +- unsigned long finish = jiffies + 5 * HZ; + u8 mask = HFC_PLL | HFC_RDY; + u8 val; + +@@ -816,21 +808,14 @@ static inline int miphy_is_ready(struct + if (miphy_phy->type == PHY_TYPE_SATA) + mask |= PHY_RDY; + +- do { +- val = readb_relaxed(miphy_phy->base + MIPHY_STATUS_1); +- if ((val & mask) != mask) +- cpu_relax(); +- else +- return 0; +- } while (!time_after_eq(jiffies, finish)); +- +- return -EBUSY; ++ return readb_relaxed_poll_timeout(miphy_phy->base + MIPHY_STATUS_1, ++ val, (val & mask) == mask, 1, ++ 5 * USEC_PER_SEC); + } + + static int miphy_osc_is_ready(struct miphy28lp_phy *miphy_phy) + { + struct miphy28lp_dev *miphy_dev = miphy_phy->phydev; +- unsigned long finish = jiffies + 5 * HZ; + u32 val; + + if (!miphy_phy->osc_rdy) +@@ -839,17 +824,10 @@ static int miphy_osc_is_ready(struct mip + if (!miphy_phy->syscfg_reg[SYSCFG_STATUS]) + return -EINVAL; + +- do { +- regmap_read(miphy_dev->regmap, +- miphy_phy->syscfg_reg[SYSCFG_STATUS], &val); +- +- if ((val & MIPHY_OSC_RDY) != MIPHY_OSC_RDY) +- cpu_relax(); +- else +- return 0; +- } while (!time_after_eq(jiffies, finish)); +- +- return -EBUSY; ++ return regmap_read_poll_timeout(miphy_dev->regmap, ++ miphy_phy->syscfg_reg[SYSCFG_STATUS], ++ val, val & MIPHY_OSC_RDY, 1, ++ 5 * USEC_PER_SEC); + } + + static int miphy28lp_get_resource_byname(struct device_node *child, diff --git a/patches.suse/platform-x86-hp-wmi-Support-touchpad-on-off.patch b/patches.suse/platform-x86-hp-wmi-Support-touchpad-on-off.patch new file mode 100644 index 0000000..2a5f322 --- /dev/null +++ b/patches.suse/platform-x86-hp-wmi-Support-touchpad-on-off.patch @@ -0,0 +1,56 @@ +From 401199ffa9b69baf3fd1f9ad082aa65c10910585 Mon Sep 17 00:00:00 2001 +From: Daniel Houldsworth +Date: Thu, 22 Sep 2022 12:54:59 +0100 +Subject: [PATCH] platform/x86: hp-wmi: Support touchpad on/off +Git-commit: 401199ffa9b69baf3fd1f9ad082aa65c10910585 +Patch-mainline: v6.1-rc1 +References: git-fixes + +Add scancodes reported by the touchpad on/off button. The actual disabling +and enabling is done in hardware, and this just reports that change to +userspace. + +Signed-off-by: Daniel Houldsworth +Link: https://lore.kernel.org/r/20220922115459.6511-1-dhould3@gmail.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Acked-by: Takashi Iwai + +--- + drivers/platform/x86/hp-wmi.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c +index fc8dbbd6fc7c..da0d25c67e57 100644 +--- a/drivers/platform/x86/hp-wmi.c ++++ b/drivers/platform/x86/hp-wmi.c +@@ -207,15 +207,17 @@ struct bios_rfkill2_state { + }; + + static const struct key_entry hp_wmi_keymap[] = { +- { KE_KEY, 0x02, { KEY_BRIGHTNESSUP } }, +- { KE_KEY, 0x03, { KEY_BRIGHTNESSDOWN } }, +- { KE_KEY, 0x20e6, { KEY_PROG1 } }, +- { KE_KEY, 0x20e8, { KEY_MEDIA } }, +- { KE_KEY, 0x2142, { KEY_MEDIA } }, +- { KE_KEY, 0x213b, { KEY_INFO } }, +- { KE_KEY, 0x2169, { KEY_ROTATE_DISPLAY } }, +- { KE_KEY, 0x216a, { KEY_SETUP } }, +- { KE_KEY, 0x231b, { KEY_HELP } }, ++ { KE_KEY, 0x02, { KEY_BRIGHTNESSUP } }, ++ { KE_KEY, 0x03, { KEY_BRIGHTNESSDOWN } }, ++ { KE_KEY, 0x20e6, { KEY_PROG1 } }, ++ { KE_KEY, 0x20e8, { KEY_MEDIA } }, ++ { KE_KEY, 0x2142, { KEY_MEDIA } }, ++ { KE_KEY, 0x213b, { KEY_INFO } }, ++ { KE_KEY, 0x2169, { KEY_ROTATE_DISPLAY } }, ++ { KE_KEY, 0x216a, { KEY_SETUP } }, ++ { KE_KEY, 0x21a9, { KEY_TOUCHPAD_OFF } }, ++ { KE_KEY, 0x121a9, { KEY_TOUCHPAD_ON } }, ++ { KE_KEY, 0x231b, { KEY_HELP } }, + { KE_END, 0 } + }; + +-- +2.35.3 + diff --git a/patches.suse/regmap-cache-Return-error-in-cache-sync-operations-f.patch b/patches.suse/regmap-cache-Return-error-in-cache-sync-operations-f.patch new file mode 100644 index 0000000..5df8798 --- /dev/null +++ b/patches.suse/regmap-cache-Return-error-in-cache-sync-operations-f.patch @@ -0,0 +1,48 @@ +From fd883d79e4dcd2417c2b80756f22a2ff03b0f6e0 Mon Sep 17 00:00:00 2001 +From: Alexander Stein +Date: Mon, 13 Mar 2023 08:18:11 +0100 +Subject: [PATCH] regmap: cache: Return error in cache sync operations for REGCACHE_NONE +Git-commit: fd883d79e4dcd2417c2b80756f22a2ff03b0f6e0 +Patch-mainline: v6.4-rc1 +References: git-fixes + +There is no sense in doing a cache sync on REGCACHE_NONE regmaps. +Instead of panicking the kernel due to missing cache_ops, return an error +to client driver. + +Signed-off-by: Alexander Stein +Link: https://lore.kernel.org/r/20230313071812.13577-1-alexander.stein@ew.tq-group.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + drivers/base/regmap/regcache.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c +index 362e043e26d8..8031007b4887 100644 +--- a/drivers/base/regmap/regcache.c ++++ b/drivers/base/regmap/regcache.c +@@ -349,6 +349,9 @@ int regcache_sync(struct regmap *map) + const char *name; + bool bypass; + ++ if (WARN_ON(map->cache_type == REGCACHE_NONE)) ++ return -EINVAL; ++ + BUG_ON(!map->cache_ops); + + map->lock(map->lock_arg); +@@ -418,6 +421,9 @@ int regcache_sync_region(struct regmap *map, unsigned int min, + const char *name; + bool bypass; + ++ if (WARN_ON(map->cache_type == REGCACHE_NONE)) ++ return -EINVAL; ++ + BUG_ON(!map->cache_ops); + + map->lock(map->lock_arg); +-- +2.35.3 + diff --git a/patches.suse/regulator-mt6359-add-read-check-for-PMIC-MT6359.patch b/patches.suse/regulator-mt6359-add-read-check-for-PMIC-MT6359.patch new file mode 100644 index 0000000..b82ae28 --- /dev/null +++ b/patches.suse/regulator-mt6359-add-read-check-for-PMIC-MT6359.patch @@ -0,0 +1,43 @@ +From a511637502b1caa135046d0f8fdabd55a31af8ef Mon Sep 17 00:00:00 2001 +From: Sen Chu +Date: Thu, 18 May 2023 12:06:46 +0800 +Subject: [PATCH] regulator: mt6359: add read check for PMIC MT6359 +Git-commit: a511637502b1caa135046d0f8fdabd55a31af8ef +Patch-mainline: v6.4-rc4 +References: git-fixes + +Add hardware version read check for PMIC MT6359 + +Signed-off-by: Sen Chu + +--- + drivers/regulator/mt6359-regulator.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/regulator/mt6359-regulator.c b/drivers/regulator/mt6359-regulator.c +index 1849566784ab..3eb86ec21d08 100644 +--- a/drivers/regulator/mt6359-regulator.c ++++ b/drivers/regulator/mt6359-regulator.c +@@ -951,9 +951,12 @@ static int mt6359_regulator_probe(struct platform_device *pdev) + struct regulator_config config = {}; + struct regulator_dev *rdev; + struct mt6359_regulator_info *mt6359_info; +- int i, hw_ver; ++ int i, hw_ver, ret; ++ ++ ret = regmap_read(mt6397->regmap, MT6359P_HWCID, &hw_ver); ++ if (ret) ++ return ret; + +- regmap_read(mt6397->regmap, MT6359P_HWCID, &hw_ver); + if (hw_ver >= MT6359P_CHIP_VER) + mt6359_info = mt6359p_regulators; + else +-- +2.35.3 + diff --git a/patches.suse/regulator-pca9450-Fix-BUCK2-enable_mask.patch b/patches.suse/regulator-pca9450-Fix-BUCK2-enable_mask.patch new file mode 100644 index 0000000..01b9960 --- /dev/null +++ b/patches.suse/regulator-pca9450-Fix-BUCK2-enable_mask.patch @@ -0,0 +1,48 @@ +From d67dada3e2524514b09496b9ee1df22d4507a280 Mon Sep 17 00:00:00 2001 +From: Alexander Stein +Date: Fri, 12 May 2023 10:19:34 +0200 +Subject: [PATCH] regulator: pca9450: Fix BUCK2 enable_mask +Git-commit: d67dada3e2524514b09496b9ee1df22d4507a280 +Patch-mainline: v6.4-rc4 +References: git-fixes + +This fixes a copy & paste error. +No functional change intended, BUCK1_ENMODE_MASK equals BUCK2_ENMODE_MASK. + +Fixes: 0935ff5f1f0a ("regulator: pca9450: add pca9450 pmic driver") +Originally-from: Robin Gong + +--- + drivers/regulator/pca9450-regulator.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/regulator/pca9450-regulator.c b/drivers/regulator/pca9450-regulator.c +index 87a746dcb516..e75dd92f86ca 100644 +--- a/drivers/regulator/pca9450-regulator.c ++++ b/drivers/regulator/pca9450-regulator.c +@@ -264,7 +264,7 @@ static const struct pca9450_regulator_desc pca9450a_regulators[] = { + .vsel_reg = PCA9450_REG_BUCK2OUT_DVS0, + .vsel_mask = BUCK2OUT_DVS0_MASK, + .enable_reg = PCA9450_REG_BUCK2CTRL, +- .enable_mask = BUCK1_ENMODE_MASK, ++ .enable_mask = BUCK2_ENMODE_MASK, + .ramp_reg = PCA9450_REG_BUCK2CTRL, + .ramp_mask = BUCK2_RAMP_MASK, + .ramp_delay_table = pca9450_dvs_buck_ramp_table, +@@ -502,7 +502,7 @@ static const struct pca9450_regulator_desc pca9450bc_regulators[] = { + .vsel_reg = PCA9450_REG_BUCK2OUT_DVS0, + .vsel_mask = BUCK2OUT_DVS0_MASK, + .enable_reg = PCA9450_REG_BUCK2CTRL, +- .enable_mask = BUCK1_ENMODE_MASK, ++ .enable_mask = BUCK2_ENMODE_MASK, + .ramp_reg = PCA9450_REG_BUCK2CTRL, + .ramp_mask = BUCK2_RAMP_MASK, + .ramp_delay_table = pca9450_dvs_buck_ramp_table, +-- +2.35.3 + diff --git a/patches.suse/remoteproc-stm32_rproc-Add-mutex-protection-for-work.patch b/patches.suse/remoteproc-stm32_rproc-Add-mutex-protection-for-work.patch new file mode 100644 index 0000000..9af9831 --- /dev/null +++ b/patches.suse/remoteproc-stm32_rproc-Add-mutex-protection-for-work.patch @@ -0,0 +1,58 @@ +From 35bdafda40cc343ad2ba2cce105eba03a70241cc Mon Sep 17 00:00:00 2001 +From: Arnaud Pouliquen +Date: Fri, 31 Mar 2023 18:06:34 +0200 +Subject: [PATCH] remoteproc: stm32_rproc: Add mutex protection for workqueue +Git-commit: 35bdafda40cc343ad2ba2cce105eba03a70241cc +Patch-mainline: v6.4-rc1 +References: git-fixes + +The workqueue may execute late even after remoteproc is stopped or +stopping, some resources (rpmsg device and endpoint) have been +released in rproc_stop_subdevices(), then rproc_vq_interrupt() +accessing these resources will cause kernel dump. + +Call trace: +virtqueue_add_inbuf +virtqueue_add_inbuf +rpmsg_recv_single +rpmsg_recv_done +vring_interrupt +stm32_rproc_mb_vq_work +process_one_work +worker_thread +kthread + +Suggested-by: Mathieu Poirier +Signed-off-by: Arnaud Pouliquen +Link: https://lore.kernel.org/r/20230331160634.3113031-1-arnaud.pouliquen@foss.st.com +Signed-off-by: Mathieu Poirier +Acked-by: Takashi Iwai + +--- + drivers/remoteproc/stm32_rproc.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/remoteproc/stm32_rproc.c b/drivers/remoteproc/stm32_rproc.c +index 23c1690b8d73..8746cbb1f168 100644 +--- a/drivers/remoteproc/stm32_rproc.c ++++ b/drivers/remoteproc/stm32_rproc.c +@@ -291,8 +291,16 @@ static void stm32_rproc_mb_vq_work(struct work_struct *work) + struct stm32_mbox *mb = container_of(work, struct stm32_mbox, vq_work); + struct rproc *rproc = dev_get_drvdata(mb->client.dev); + ++ mutex_lock(&rproc->lock); ++ ++ if (rproc->state != RPROC_RUNNING) ++ goto unlock_mutex; ++ + if (rproc_vq_interrupt(rproc, mb->vq_id) == IRQ_NONE) + dev_dbg(&rproc->dev, "no message found in vq%d\n", mb->vq_id); ++ ++unlock_mutex: ++ mutex_unlock(&rproc->lock); + } + + static void stm32_rproc_mb_callback(struct mbox_client *cl, void *data) +-- +2.35.3 + diff --git a/patches.suse/serial-8250-Reinit-port-pm-on-port-specific-driver-u.patch b/patches.suse/serial-8250-Reinit-port-pm-on-port-specific-driver-u.patch new file mode 100644 index 0000000..2435a6d --- /dev/null +++ b/patches.suse/serial-8250-Reinit-port-pm-on-port-specific-driver-u.patch @@ -0,0 +1,56 @@ +From 04e82793f068d2f0ffe62fcea03d007a8cdc16a7 Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Tue, 18 Apr 2023 13:14:06 +0300 +Subject: [PATCH] serial: 8250: Reinit port->pm on port specific driver unbind +Git-commit: 04e82793f068d2f0ffe62fcea03d007a8cdc16a7 +Patch-mainline: v6.4-rc1 +References: git-fixes + +When we unbind a serial port hardware specific 8250 driver, the generic +serial8250 driver takes over the port. After that we see an oops about 10 +seconds later. This can produce the following at least on some TI SoCs: + +Unhandled fault: imprecise external abort (0x1406) +Internal error: : 1406 [#1] SMP ARM + +Turns out that we may still have the serial port hardware specific driver +port->pm in use, and serial8250_pm() tries to call it after the port +specific driver is gone: + +serial8250_pm [8250_base] from uart_change_pm+0x54/0x8c [serial_base] +uart_change_pm [serial_base] from uart_hangup+0x154/0x198 [serial_base] +uart_hangup [serial_base] from __tty_hangup.part.0+0x328/0x37c +__tty_hangup.part.0 from disassociate_ctty+0x154/0x20c +disassociate_ctty from do_exit+0x744/0xaac +do_exit from do_group_exit+0x40/0x8c +do_group_exit from __wake_up_parent+0x0/0x1c + +Let's fix the issue by calling serial8250_set_defaults() in +serial8250_unregister_port(). This will set the port back to using +the serial8250 default functions, and sets the port->pm to point to +serial8250_pm. + +Signed-off-by: Tony Lindgren +Link: https://lore.kernel.org/r/20230418101407.12403-1-tony@atomide.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/serial/8250/8250_core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c +index ab63c308be0a..13bf535eedcd 100644 +--- a/drivers/tty/serial/8250/8250_core.c ++++ b/drivers/tty/serial/8250/8250_core.c +@@ -1158,6 +1158,7 @@ void serial8250_unregister_port(int line) + uart->port.type = PORT_UNKNOWN; + uart->port.dev = &serial8250_isa_devs->dev; + uart->capabilities = 0; ++ serial8250_init_port(uart); + serial8250_apply_quirks(uart); + uart_add_one_port(&serial8250_reg, &uart->port); + } else { +-- +2.35.3 + diff --git a/patches.suse/serial-8250_exar-Add-support-for-USR298x-PCI-Modems.patch b/patches.suse/serial-8250_exar-Add-support-for-USR298x-PCI-Modems.patch new file mode 100644 index 0000000..4944279 --- /dev/null +++ b/patches.suse/serial-8250_exar-Add-support-for-USR298x-PCI-Modems.patch @@ -0,0 +1,79 @@ +From 95d698869b404772cc8b72560df71548491c10bc Mon Sep 17 00:00:00 2001 +From: Andrew Davis +Date: Thu, 20 Apr 2023 11:02:09 -0500 +Subject: [PATCH] serial: 8250_exar: Add support for USR298x PCI Modems +Git-commit: 95d698869b404772cc8b72560df71548491c10bc +Patch-mainline: v6.4-rc3 +References: git-fixes + +Possibly the last PCI controller-based (i.e. not a soft/winmodem) +dial-up modem one can still buy. + +Looks to have a stock XR17C154 PCI UART chip for communication, but for +some reason when provisioning the PCI IDs they swapped the vendor and +subvendor IDs. Otherwise this card would have worked out of the box. + +Searching online, some folks seem to not have this issue and others do, +so it is possible only some batches of cards have this error. + +Create a new macro to handle the switched IDs and add support here. + +Signed-off-by: Andrew Davis +Cc: stable +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20230420160209.28221-1-afd@ti.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/serial/8250/8250_exar.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c +index 64770c62bbec..b406cba10b0e 100644 +--- a/drivers/tty/serial/8250/8250_exar.c ++++ b/drivers/tty/serial/8250/8250_exar.c +@@ -40,9 +40,13 @@ + #define PCI_DEVICE_ID_COMMTECH_4224PCIE 0x0020 + #define PCI_DEVICE_ID_COMMTECH_4228PCIE 0x0021 + #define PCI_DEVICE_ID_COMMTECH_4222PCIE 0x0022 ++ + #define PCI_DEVICE_ID_EXAR_XR17V4358 0x4358 + #define PCI_DEVICE_ID_EXAR_XR17V8358 0x8358 + ++#define PCI_SUBDEVICE_ID_USR_2980 0x0128 ++#define PCI_SUBDEVICE_ID_USR_2981 0x0129 ++ + #define PCI_DEVICE_ID_SEALEVEL_710xC 0x1001 + #define PCI_DEVICE_ID_SEALEVEL_720xC 0x1002 + #define PCI_DEVICE_ID_SEALEVEL_740xC 0x1004 +@@ -829,6 +833,15 @@ static const struct exar8250_board pbn_exar_XR17V8358 = { + (kernel_ulong_t)&bd \ + } + ++#define USR_DEVICE(devid, sdevid, bd) { \ ++ PCI_DEVICE_SUB( \ ++ PCI_VENDOR_ID_USR, \ ++ PCI_DEVICE_ID_EXAR_##devid, \ ++ PCI_VENDOR_ID_EXAR, \ ++ PCI_SUBDEVICE_ID_USR_##sdevid), 0, 0, \ ++ (kernel_ulong_t)&bd \ ++ } ++ + static const struct pci_device_id exar_pci_tbl[] = { + EXAR_DEVICE(ACCESSIO, COM_2S, pbn_exar_XR17C15x), + EXAR_DEVICE(ACCESSIO, COM_4S, pbn_exar_XR17C15x), +@@ -853,6 +866,10 @@ static const struct pci_device_id exar_pci_tbl[] = { + + IBM_DEVICE(XR17C152, SATURN_SERIAL_ONE_PORT, pbn_exar_ibm_saturn), + ++ /* USRobotics USR298x-OEM PCI Modems */ ++ USR_DEVICE(XR17C152, 2980, pbn_exar_XR17C15x), ++ USR_DEVICE(XR17C152, 2981, pbn_exar_XR17C15x), ++ + /* Exar Corp. XR17C15[248] Dual/Quad/Octal UART */ + EXAR_DEVICE(EXAR, XR17C152, pbn_exar_XR17C15x), + EXAR_DEVICE(EXAR, XR17C154, pbn_exar_XR17C15x), +-- +2.35.3 + diff --git a/patches.suse/serial-Add-support-for-Advantech-PCI-1611U-card.patch b/patches.suse/serial-Add-support-for-Advantech-PCI-1611U-card.patch new file mode 100644 index 0000000..175b720 --- /dev/null +++ b/patches.suse/serial-Add-support-for-Advantech-PCI-1611U-card.patch @@ -0,0 +1,54 @@ +From d2b00516de0e1d696724247098f6733a6ea53908 Mon Sep 17 00:00:00 2001 +From: Vitaliy Tomin +Date: Sun, 23 Apr 2023 11:45:12 +0800 +Subject: [PATCH] serial: Add support for Advantech PCI-1611U card +Git-commit: d2b00516de0e1d696724247098f6733a6ea53908 +Patch-mainline: v6.4-rc3 +References: git-fixes + +Add support for Advantech PCI-1611U card + +Advantech provides opensource drivers for this and many others card +based on legacy copy of 8250_pci driver called adv950 + +https://www.advantech.com/emt/support/details/driver?id=1-TDOIMJ + +It is hard to maintain to run as out of tree module on newer kernels. +Just adding PCI ID to kernel 8250_pci works perfect. + +Signed-off-by: Vitaliy Tomin +Cc: stable +Link: https://lore.kernel.org/r/20230423034512.2671157-1-tomin@iszf.irk.ru +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/serial/8250/8250_pci.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c +index c55be6fda0ca..e80c4f6551a1 100644 +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -1920,6 +1920,8 @@ pci_moxa_setup(struct serial_private *priv, + #define PCI_SUBDEVICE_ID_SIIG_DUAL_30 0x2530 + #define PCI_VENDOR_ID_ADVANTECH 0x13fe + #define PCI_DEVICE_ID_INTEL_CE4100_UART 0x2e66 ++#define PCI_DEVICE_ID_ADVANTECH_PCI1600 0x1600 ++#define PCI_DEVICE_ID_ADVANTECH_PCI1600_1611 0x1611 + #define PCI_DEVICE_ID_ADVANTECH_PCI3620 0x3620 + #define PCI_DEVICE_ID_ADVANTECH_PCI3618 0x3618 + #define PCI_DEVICE_ID_ADVANTECH_PCIf618 0xf618 +@@ -4085,6 +4087,9 @@ static SIMPLE_DEV_PM_OPS(pciserial_pm_ops, pciserial_suspend_one, + pciserial_resume_one); + + static const struct pci_device_id serial_pci_tbl[] = { ++ { PCI_VENDOR_ID_ADVANTECH, PCI_DEVICE_ID_ADVANTECH_PCI1600, ++ PCI_DEVICE_ID_ADVANTECH_PCI1600_1611, PCI_ANY_ID, 0, 0, ++ pbn_b0_4_921600 }, + /* Advantech use PCI_DEVICE_ID_ADVANTECH_PCI3620 (0x3620) as 'PCI_SUBVENDOR_ID' */ + { PCI_VENDOR_ID_ADVANTECH, PCI_DEVICE_ID_ADVANTECH_PCI3620, + PCI_DEVICE_ID_ADVANTECH_PCI3620, 0x0001, 0, 0, +-- +2.35.3 + diff --git a/patches.suse/soundwire-qcom-gracefully-handle-too-many-ports-in-D.patch b/patches.suse/soundwire-qcom-gracefully-handle-too-many-ports-in-D.patch new file mode 100644 index 0000000..6689bbf --- /dev/null +++ b/patches.suse/soundwire-qcom-gracefully-handle-too-many-ports-in-D.patch @@ -0,0 +1,50 @@ +From 2367e0ecb498764e95cfda691ff0828f7d25f9a4 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Wed, 22 Feb 2023 15:44:12 +0100 +Subject: [PATCH] soundwire: qcom: gracefully handle too many ports in DT +Git-commit: 2367e0ecb498764e95cfda691ff0828f7d25f9a4 +Patch-mainline: v6.4-rc1 +References: git-fixes + +There are two issues related to the number of ports coming from +Devicetree when exceeding in total QCOM_SDW_MAX_PORTS. Both lead to +incorrect memory accesses: +1. With DTS having too big value of input or output ports, the driver, + when copying port parameters from local/stack arrays into 'pconfig' + array in 'struct qcom_swrm_ctrl', will iterate over their sizes. + +2. If DTS also has too many parameters for these ports (e.g. + qcom,ports-sinterval-low), the driver will overflow buffers on the + stack when reading these properties from DTS. + +Add a sanity check so incorrect DTS will not cause kernel memory +corruption. + +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Srinivas Kandagatla +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230222144412.237832-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Vinod Koul +Acked-by: Takashi Iwai + +--- + drivers/soundwire/qcom.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c +index 79bebcecde6d..c296e0bf897b 100644 +--- a/drivers/soundwire/qcom.c ++++ b/drivers/soundwire/qcom.c +@@ -1218,6 +1218,9 @@ static int qcom_swrm_get_port_config(struct qcom_swrm_ctrl *ctrl) + ctrl->num_dout_ports = val; + + nports = ctrl->num_dout_ports + ctrl->num_din_ports; ++ if (nports > QCOM_SDW_MAX_PORTS) ++ return -EINVAL; ++ + /* Valid port numbers are from 1-14, so mask out port 0 explicitly */ + set_bit(0, &ctrl->dout_port_mask); + set_bit(0, &ctrl->din_port_mask); +-- +2.35.3 + diff --git a/patches.suse/spi-spi-imx-fix-MX51_ECSPI_-macros-when-cs-3.patch b/patches.suse/spi-spi-imx-fix-MX51_ECSPI_-macros-when-cs-3.patch new file mode 100644 index 0000000..03d09cc --- /dev/null +++ b/patches.suse/spi-spi-imx-fix-MX51_ECSPI_-macros-when-cs-3.patch @@ -0,0 +1,80 @@ +From 87c614175bbf28d3fd076dc2d166bac759e41427 Mon Sep 17 00:00:00 2001 +From: Kevin Groeneveld +Date: Sat, 18 Mar 2023 18:21:32 -0400 +Subject: [PATCH] spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3 +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 87c614175bbf28d3fd076dc2d166bac759e41427 +Patch-mainline: v6.4-rc1 +References: git-fixes + +When using gpio based chip select the cs value can go outside the range +0 – 3. The various MX51_ECSPI_* macros did not take this into consideration +resulting in possible corruption of the configuration. + +For example for any cs value over 3 the SCLKPHA bits would not be set and +other values in the register possibly corrupted. + +One way to fix this is to just mask the cs bits to 2 bits. This still +allows all 4 native chip selects to work as well as gpio chip selects +(which can use any of the 4 chip select configurations). + +Signed-off-by: Kevin Groeneveld +Link: https://lore.kernel.org/r/20230318222132.3373-1-kgroeneveld@lenbrook.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + drivers/spi/spi-imx.c | 24 ++++++++++++++++++------ + 1 file changed, 18 insertions(+), 6 deletions(-) + +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index 1f2c7ad65ec8..24390c702c60 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -252,6 +252,18 @@ static bool spi_imx_can_dma(struct spi_controller *controller, struct spi_device + return true; + } + ++/* ++ * Note the number of natively supported chip selects for MX51 is 4. Some ++ * devices may have less actual SS pins but the register map supports 4. When ++ * using gpio chip selects the cs values passed into the macros below can go ++ * outside the range 0 - 3. We therefore need to limit the cs value to avoid ++ * corrupting bits outside the allocated locations. ++ * ++ * The simplest way to do this is to just mask the cs bits to 2 bits. This ++ * still allows all 4 native chip selects to work as well as gpio chip selects ++ * (which can use any of the 4 chip select configurations). ++ */ ++ + #define MX51_ECSPI_CTRL 0x08 + #define MX51_ECSPI_CTRL_ENABLE (1 << 0) + #define MX51_ECSPI_CTRL_XCH (1 << 2) +@@ -260,16 +272,16 @@ static bool spi_imx_can_dma(struct spi_controller *controller, struct spi_device + #define MX51_ECSPI_CTRL_DRCTL(drctl) ((drctl) << 16) + #define MX51_ECSPI_CTRL_POSTDIV_OFFSET 8 + #define MX51_ECSPI_CTRL_PREDIV_OFFSET 12 +-#define MX51_ECSPI_CTRL_CS(cs) ((cs) << 18) ++#define MX51_ECSPI_CTRL_CS(cs) ((cs & 3) << 18) + #define MX51_ECSPI_CTRL_BL_OFFSET 20 + #define MX51_ECSPI_CTRL_BL_MASK (0xfff << 20) + + #define MX51_ECSPI_CONFIG 0x0c +-#define MX51_ECSPI_CONFIG_SCLKPHA(cs) (1 << ((cs) + 0)) +-#define MX51_ECSPI_CONFIG_SCLKPOL(cs) (1 << ((cs) + 4)) +-#define MX51_ECSPI_CONFIG_SBBCTRL(cs) (1 << ((cs) + 8)) +-#define MX51_ECSPI_CONFIG_SSBPOL(cs) (1 << ((cs) + 12)) +-#define MX51_ECSPI_CONFIG_SCLKCTL(cs) (1 << ((cs) + 20)) ++#define MX51_ECSPI_CONFIG_SCLKPHA(cs) (1 << ((cs & 3) + 0)) ++#define MX51_ECSPI_CONFIG_SCLKPOL(cs) (1 << ((cs & 3) + 4)) ++#define MX51_ECSPI_CONFIG_SBBCTRL(cs) (1 << ((cs & 3) + 8)) ++#define MX51_ECSPI_CONFIG_SSBPOL(cs) (1 << ((cs & 3) + 12)) ++#define MX51_ECSPI_CONFIG_SCLKCTL(cs) (1 << ((cs & 3) + 20)) + + #define MX51_ECSPI_INT 0x10 + #define MX51_ECSPI_INT_TEEN (1 << 0) +-- +2.35.3 + diff --git a/patches.suse/staging-rtl8192e-Replace-macro-RTL_PCI_DEVICE-with-P.patch b/patches.suse/staging-rtl8192e-Replace-macro-RTL_PCI_DEVICE-with-P.patch new file mode 100644 index 0000000..6279473 --- /dev/null +++ b/patches.suse/staging-rtl8192e-Replace-macro-RTL_PCI_DEVICE-with-P.patch @@ -0,0 +1,57 @@ +From fda2093860df4812d69052a8cf4997e53853a340 Mon Sep 17 00:00:00 2001 +From: Philipp Hortmann +Date: Thu, 23 Feb 2023 07:47:21 +0100 +Subject: [PATCH] staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE +Git-commit: fda2093860df4812d69052a8cf4997e53853a340 +Patch-mainline: v6.4-rc1 +References: git-fixes + +Replace macro RTL_PCI_DEVICE with PCI_DEVICE to get rid of rtl819xp_ops +which is empty. + +Signed-off-by: Philipp Hortmann +Link: https://lore.kernel.org/r/8b45ee783fa91196b7c9d6fc840a189496afd2f4.1677133271.git.philipp.g.hortmann@gmail.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 6 +++--- + drivers/staging/rtl8192e/rtl8192e/rtl_core.h | 5 ----- + 2 files changed, 3 insertions(+), 8 deletions(-) + +diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +index 044cab649ff1..f5a155d1a81a 100644 +--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c ++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +@@ -29,9 +29,9 @@ static const struct rtl819x_ops rtl819xp_ops = { + }; + + static struct pci_device_id rtl8192_pci_id_tbl[] = { +- {RTL_PCI_DEVICE(0x10ec, 0x8192, rtl819xp_ops)}, +- {RTL_PCI_DEVICE(0x07aa, 0x0044, rtl819xp_ops)}, +- {RTL_PCI_DEVICE(0x07aa, 0x0047, rtl819xp_ops)}, ++ {PCI_DEVICE(0x10ec, 0x8192)}, ++ {PCI_DEVICE(0x07aa, 0x0044)}, ++ {PCI_DEVICE(0x07aa, 0x0047)}, + {} + }; + +diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.h b/drivers/staging/rtl8192e/rtl8192e/rtl_core.h +index f75cc96052d9..c2a4b2ae6a81 100644 +--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.h ++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.h +@@ -55,11 +55,6 @@ + #define IS_HARDWARE_TYPE_8192SE(_priv) \ + (((struct r8192_priv *)rtllib_priv(dev))->card_8192 == NIC_8192SE) + +-#define RTL_PCI_DEVICE(vend, dev, cfg) \ +- .vendor = (vend), .device = (dev), \ +- .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID, \ +- .driver_data = (kernel_ulong_t)&(cfg) +- + #define TOTAL_CAM_ENTRY 32 + #define CAM_CONTENT_COUNT 8 + +-- +2.35.3 + diff --git a/patches.suse/tpm-tpm_tis-Disable-interrupts-for-more-Lenovo-devic.patch b/patches.suse/tpm-tpm_tis-Disable-interrupts-for-more-Lenovo-devic.patch new file mode 100644 index 0000000..f3e70bd --- /dev/null +++ b/patches.suse/tpm-tpm_tis-Disable-interrupts-for-more-Lenovo-devic.patch @@ -0,0 +1,54 @@ +From e7d3e5c4b1dd50a70b31524c3228c62bb41bbab2 Mon Sep 17 00:00:00 2001 +From: Jerry Snitselaar +Date: Wed, 10 May 2023 17:54:03 -0700 +Subject: [PATCH] tpm/tpm_tis: Disable interrupts for more Lenovo devices +Git-commit: e7d3e5c4b1dd50a70b31524c3228c62bb41bbab2 +Patch-mainline: v6.4-rc3 +References: git-fixes + +The P360 Tiny suffers from an irq storm issue like the T490s, so add +an entry for it to tpm_tis_dmi_table, and force polling. There also +previously was a report from the previous attempt to enable interrupts +that involved a ThinkPad L490. So an entry is added for it as well. + +Cc: stable@vger.kernel.org +Reported-by: Peter Zijlstra # P360 Tiny +Closes: https://lore.kernel.org/linux-integrity/20230505130731.GO83892@hirez.programming.kicks-ass.net/ +Signed-off-by: Jerry Snitselaar +Signed-off-by: Jarkko Sakkinen +Acked-by: Takashi Iwai + +--- + drivers/char/tpm/tpm_tis.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c +index 7af389806643..709b4e13bd6e 100644 +--- a/drivers/char/tpm/tpm_tis.c ++++ b/drivers/char/tpm/tpm_tis.c +@@ -122,6 +122,22 @@ static const struct dmi_system_id tpm_tis_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T490s"), + }, + }, ++ { ++ .callback = tpm_tis_disable_irq, ++ .ident = "ThinkStation P360 Tiny", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkStation P360 Tiny"), ++ }, ++ }, ++ { ++ .callback = tpm_tis_disable_irq, ++ .ident = "ThinkPad L490", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L490"), ++ }, ++ }, + {} + }; + +-- +2.35.3 + diff --git a/patches.suse/usb-storage-fix-deadlock-when-a-scsi-command-timeout.patch b/patches.suse/usb-storage-fix-deadlock-when-a-scsi-command-timeout.patch new file mode 100644 index 0000000..0a41655 --- /dev/null +++ b/patches.suse/usb-storage-fix-deadlock-when-a-scsi-command-timeout.patch @@ -0,0 +1,114 @@ +From a398d5eac6984316e71474e25b975688f282379b Mon Sep 17 00:00:00 2001 +From: Maxime Bizon +Date: Fri, 5 May 2023 13:47:59 +0200 +Subject: [PATCH] usb-storage: fix deadlock when a scsi command timeouts more than once +Git-commit: a398d5eac6984316e71474e25b975688f282379b +Patch-mainline: v6.4-rc3 +References: git-fixes + +With faulty usb-storage devices, read/write can timeout, in that case +the SCSI layer will abort and re-issue the command. USB storage has no +internal timeout, it relies on SCSI layer aborting commands via +.eh_abort_handler() for non those responsive devices. + +After two consecutive timeouts of the same command, SCSI layer calls +.eh_device_reset_handler(), without calling .eh_abort_handler() first. + +With usb-storage, this causes a deadlock: + + -> .eh_device_reset_handler + -> device_reset + -> mutex_lock(&(us->dev_mutex)); + +mutex already by usb_stor_control_thread(), which is waiting for +command completion: + + -> usb_stor_control_thread (mutex taken here) + -> usb_stor_invoke_transport + -> usb_stor_Bulk_transport + -> usb_stor_bulk_srb + -> usb_stor_bulk_transfer_sglist + -> usb_sg_wait + +Make sure we cancel any pending command in .eh_device_reset_handler() +to avoid this. + +Signed-off-by: Maxime Bizon +Cc: linux-usb@vger.kernel.org +Cc: stable +Link: https://lore.kernel.org/all/ZEllnjMKT8ulZbJh@sakura/ +Reviewed-by: Alan Stern +Acked-by: Alan Stern +Link: https://lore.kernel.org/r/20230505114759.1189741-1-mbizon@freebox.fr +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/storage/scsiglue.c | 28 +++++++++++++++++++++------- + 1 file changed, 21 insertions(+), 7 deletions(-) + +diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c +index 8931df5a85fd..c54e9805da53 100644 +--- a/drivers/usb/storage/scsiglue.c ++++ b/drivers/usb/storage/scsiglue.c +@@ -406,22 +406,25 @@ static DEF_SCSI_QCMD(queuecommand) + ***********************************************************************/ + + /* Command timeout and abort */ +-static int command_abort(struct scsi_cmnd *srb) ++static int command_abort_matching(struct us_data *us, struct scsi_cmnd *srb_match) + { +- struct us_data *us = host_to_us(srb->device->host); +- +- usb_stor_dbg(us, "%s called\n", __func__); +- + /* + * us->srb together with the TIMED_OUT, RESETTING, and ABORTING + * bits are protected by the host lock. + */ + scsi_lock(us_to_host(us)); + +- /* Is this command still active? */ +- if (us->srb != srb) { ++ /* is there any active pending command to abort ? */ ++ if (!us->srb) { + scsi_unlock(us_to_host(us)); + usb_stor_dbg(us, "-- nothing to abort\n"); ++ return SUCCESS; ++ } ++ ++ /* Does the command match the passed srb if any ? */ ++ if (srb_match && us->srb != srb_match) { ++ scsi_unlock(us_to_host(us)); ++ usb_stor_dbg(us, "-- pending command mismatch\n"); + return FAILED; + } + +@@ -444,6 +447,14 @@ static int command_abort(struct scsi_cmnd *srb) + return SUCCESS; + } + ++static int command_abort(struct scsi_cmnd *srb) ++{ ++ struct us_data *us = host_to_us(srb->device->host); ++ ++ usb_stor_dbg(us, "%s called\n", __func__); ++ return command_abort_matching(us, srb); ++} ++ + /* + * This invokes the transport reset mechanism to reset the state of the + * device +@@ -455,6 +466,9 @@ static int device_reset(struct scsi_cmnd *srb) + + usb_stor_dbg(us, "%s called\n", __func__); + ++ /* abort any pending command before reset */ ++ command_abort_matching(us, NULL); ++ + /* lock the device pointers and do the reset */ + mutex_lock(&(us->dev_mutex)); + result = us->transport_reset(us); +-- +2.35.3 + diff --git a/patches.suse/wifi-ath-Silence-memcpy-run-time-false-positive-warn.patch b/patches.suse/wifi-ath-Silence-memcpy-run-time-false-positive-warn.patch new file mode 100644 index 0000000..a614972 --- /dev/null +++ b/patches.suse/wifi-ath-Silence-memcpy-run-time-false-positive-warn.patch @@ -0,0 +1,73 @@ +From bfcc8ba45eb87bfaaff900bbad2b87b204899d41 Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Wed, 15 Feb 2023 20:31:38 +0200 +Subject: [PATCH] wifi: ath: Silence memcpy run-time false positive warning +Git-commit: bfcc8ba45eb87bfaaff900bbad2b87b204899d41 +Patch-mainline: v6.4-rc1 +References: git-fixes + +The memcpy() in ath_key_config() was attempting to write across +neighboring struct members in struct ath_keyval. Introduce a wrapping +struct_group, kv_values, to be the addressable target of the memcpy +without overflowing an individual member. Silences the false positive +run-time warning: + + memcpy: detected field-spanning write (size 32) of single field "hk.kv_val" at drivers/net/wireless/ath/key.c:506 (size 16) + +Link: https://bbs.archlinux.org/viewtopic.php?id=282254 +Cc: Kalle Valo +Cc: "David S. Miller" +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Paolo Abeni +Cc: linux-wireless@vger.kernel.org +Cc: netdev@vger.kernel.org +Signed-off-by: Kees Cook +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230210054310.never.554-kees@kernel.org +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/ath/ath.h | 12 +++++++----- + drivers/net/wireless/ath/key.c | 2 +- + 2 files changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h +index f083fb9038c3..f02a308a9ffc 100644 +--- a/drivers/net/wireless/ath/ath.h ++++ b/drivers/net/wireless/ath/ath.h +@@ -96,11 +96,13 @@ struct ath_keyval { + u8 kv_type; + u8 kv_pad; + u16 kv_len; +- u8 kv_val[16]; /* TK */ +- u8 kv_mic[8]; /* Michael MIC key */ +- u8 kv_txmic[8]; /* Michael MIC TX key (used only if the hardware +- * supports both MIC keys in the same key cache entry; +- * in that case, kv_mic is the RX key) */ ++ struct_group(kv_values, ++ u8 kv_val[16]; /* TK */ ++ u8 kv_mic[8]; /* Michael MIC key */ ++ u8 kv_txmic[8]; /* Michael MIC TX key (used only if the hardware ++ * supports both MIC keys in the same key cache entry; ++ * in that case, kv_mic is the RX key) */ ++ ); + }; + + enum ath_cipher { +diff --git a/drivers/net/wireless/ath/key.c b/drivers/net/wireless/ath/key.c +index 61b59a804e30..b7b61d4f02ba 100644 +--- a/drivers/net/wireless/ath/key.c ++++ b/drivers/net/wireless/ath/key.c +@@ -503,7 +503,7 @@ int ath_key_config(struct ath_common *common, + + hk.kv_len = key->keylen; + if (key->keylen) +- memcpy(hk.kv_val, key->key, key->keylen); ++ memcpy(&hk.kv_values, key->key, key->keylen); + + if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) { + switch (vif->type) { +-- +2.35.3 + diff --git a/patches.suse/wifi-ath11k-Fix-SKB-corruption-in-REO-destination-ri.patch b/patches.suse/wifi-ath11k-Fix-SKB-corruption-in-REO-destination-ri.patch new file mode 100644 index 0000000..682ca5b --- /dev/null +++ b/patches.suse/wifi-ath11k-Fix-SKB-corruption-in-REO-destination-ri.patch @@ -0,0 +1,80 @@ +From f9fff67d2d7ca6fa8066132003a3deef654c55b1 Mon Sep 17 00:00:00 2001 +From: Nagarajan Maran +Date: Mon, 17 Apr 2023 13:35:02 +0300 +Subject: [PATCH] wifi: ath11k: Fix SKB corruption in REO destination ring +Git-commit: f9fff67d2d7ca6fa8066132003a3deef654c55b1 +Patch-mainline: v6.4-rc1 +References: git-fixes + +While running traffics for a long time, randomly an RX descriptor +filled with value "0" from REO destination ring is received. +This descriptor which is invalid causes the wrong SKB (SKB stored in +the IDR lookup with buffer id "0") to be fetched which in turn +causes SKB memory corruption issue and the same leads to crash +after some time. + +Changed the start id for idr allocation to "1" and the buffer id "0" +is reserved for error validation. Introduced Sanity check to validate +the descriptor, before processing the SKB. + +Crash Signature : + +Unable to handle kernel paging request at virtual address 3f004900 +PC points to "b15_dma_inv_range+0x30/0x50" +LR points to "dma_cache_maint_page+0x8c/0x128". +The Backtrace obtained is as follows: +[<8031716c>] (b15_dma_inv_range) from [<80313a4c>] (dma_cache_maint_page+0x8c/0x128) +[<80313a4c>] (dma_cache_maint_page) from [<80313b90>] (__dma_page_dev_to_cpu+0x28/0xcc) +[<80313b90>] (__dma_page_dev_to_cpu) from [<7fb5dd68>] (ath11k_dp_process_rx+0x1e8/0x4a4 [ath11k]) +[<7fb5dd68>] (ath11k_dp_process_rx [ath11k]) from [<7fb53c20>] (ath11k_dp_service_srng+0xb0/0x2ac [ath11k]) +[<7fb53c20>] (ath11k_dp_service_srng [ath11k]) from [<7f67bba4>] (ath11k_pci_ext_grp_napi_poll+0x1c/0x78 [ath11k_pci]) +[<7f67bba4>] (ath11k_pci_ext_grp_napi_poll [ath11k_pci]) from [<807d5cf4>] (__napi_poll+0x28/0xb8) +[<807d5cf4>] (__napi_poll) from [<807d5f28>] (net_rx_action+0xf0/0x280) +[<807d5f28>] (net_rx_action) from [<80302148>] (__do_softirq+0xd0/0x280) +[<80302148>] (__do_softirq) from [<80320408>] (irq_exit+0x74/0xd4) +[<80320408>] (irq_exit) from [<803638a4>] (__handle_domain_irq+0x90/0xb4) +[<803638a4>] (__handle_domain_irq) from [<805bedec>] (gic_handle_irq+0x58/0x90) +[<805bedec>] (gic_handle_irq) from [<80301a78>] (__irq_svc+0x58/0x8c) + +Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 + +Signed-off-by: Nagarajan Maran +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230403191533.28114-1-quic_nmaran@quicinc.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/ath/ath11k/dp_rx.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c +index a4934bd79969..f67ce62b2b48 100644 +--- a/drivers/net/wireless/ath/ath11k/dp_rx.c ++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c +@@ -389,10 +389,10 @@ int ath11k_dp_rxbufs_replenish(struct ath11k_base *ab, int mac_id, + goto fail_free_skb; + + spin_lock_bh(&rx_ring->idr_lock); +- buf_id = idr_alloc(&rx_ring->bufs_idr, skb, 0, +- rx_ring->bufs_max * 3, GFP_ATOMIC); ++ buf_id = idr_alloc(&rx_ring->bufs_idr, skb, 1, ++ (rx_ring->bufs_max * 3) + 1, GFP_ATOMIC); + spin_unlock_bh(&rx_ring->idr_lock); +- if (buf_id < 0) ++ if (buf_id <= 0) + goto fail_dma_unmap; + + desc = ath11k_hal_srng_src_get_next_entry(ab, srng); +@@ -2665,6 +2665,9 @@ int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id, + cookie); + mac_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_PDEV_ID, cookie); + ++ if (unlikely(buf_id == 0)) ++ continue; ++ + ar = ab->pdevs[mac_id].ar; + rx_ring = &ar->dp.rx_refill_buf_ring; + spin_lock_bh(&rx_ring->idr_lock); +-- +2.35.3 + diff --git a/patches.suse/wifi-brcmfmac-cfg80211-Pass-the-PMK-in-binary-instea.patch b/patches.suse/wifi-brcmfmac-cfg80211-Pass-the-PMK-in-binary-instea.patch new file mode 100644 index 0000000..78b1874 --- /dev/null +++ b/patches.suse/wifi-brcmfmac-cfg80211-Pass-the-PMK-in-binary-instea.patch @@ -0,0 +1,57 @@ +From 89b89e52153fda2733562776c7c9d9d3ebf8dd6d Mon Sep 17 00:00:00 2001 +From: Hector Martin +Date: Tue, 14 Feb 2023 18:24:19 +0900 +Subject: [PATCH] wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex +Git-commit: 89b89e52153fda2733562776c7c9d9d3ebf8dd6d +Patch-mainline: v6.4-rc1 +References: git-fixes + +Apparently the hex passphrase mechanism does not work on newer +chips/firmware (e.g. BCM4387). It seems there was a simple way of +passing it in binary all along, so use that and avoid the hexification. + +OpenBSD has been doing it like this from the beginning, so this should +work on all chips. + +Also clear the structure before setting the PMK. This was leaking +uninitialized stack contents to the device. + +Reviewed-by: Linus Walleij +Reviewed-by: Arend van Spriel +Signed-off-by: Hector Martin +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230214092423.15175-6-marcan@marcan.st +Acked-by: Takashi Iwai + +--- + .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +index b561ca6b467e..e0a70a671550 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -1686,13 +1686,14 @@ static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len) + { + struct brcmf_pub *drvr = ifp->drvr; + struct brcmf_wsec_pmk_le pmk; +- int i, err; ++ int err; + +- /* convert to firmware key format */ +- pmk.key_len = cpu_to_le16(pmk_len << 1); +- pmk.flags = cpu_to_le16(BRCMF_WSEC_PASSPHRASE); +- for (i = 0; i < pmk_len; i++) +- snprintf(&pmk.key[2 * i], 3, "%02x", pmk_data[i]); ++ memset(&pmk, 0, sizeof(pmk)); ++ ++ /* pass pmk directly */ ++ pmk.key_len = cpu_to_le16(pmk_len); ++ pmk.flags = cpu_to_le16(0); ++ memcpy(pmk.key, pmk_data, pmk_len); + + /* store psk in firmware */ + err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK, +-- +2.35.3 + diff --git a/patches.suse/wifi-iwlwifi-dvm-Fix-memcpy-detected-field-spanning-.patch b/patches.suse/wifi-iwlwifi-dvm-Fix-memcpy-detected-field-spanning-.patch new file mode 100644 index 0000000..1a26f18 --- /dev/null +++ b/patches.suse/wifi-iwlwifi-dvm-Fix-memcpy-detected-field-spanning-.patch @@ -0,0 +1,71 @@ +From ef16799640865f937719f0771c93be5dca18adc6 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Tue, 18 Apr 2023 15:25:46 +0200 +Subject: [PATCH] wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace +Git-commit: ef16799640865f937719f0771c93be5dca18adc6 +Patch-mainline: v6.4-rc1 +References: git-fixes + +A received TKIP key may be up to 32 bytes because it may contain +MIC rx/tx keys too. These are not used by iwl and copying these +over overflows the iwl_keyinfo.key field. + +Add a check to not copy more data to iwl_keyinfo.key then will fit. + +This fixes backtraces like this one: + + memcpy: detected field-spanning write (size 32) of single field "sta_cmd.key.key" at drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 (size 16) + WARNING: CPU: 1 PID: 946 at drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 iwlagn_send_sta_key+0x375/0x390 [iwldvm] + + Hardware name: Dell Inc. Latitude E6430/0H3MT5, BIOS A21 05/08/2017 + RIP: 0010:iwlagn_send_sta_key+0x375/0x390 [iwldvm] + + Call Trace: + + iwl_set_dynamic_key+0x1f0/0x220 [iwldvm] + iwlagn_mac_set_key+0x1e4/0x280 [iwldvm] + drv_set_key+0xa4/0x1b0 [mac80211] + ieee80211_key_enable_hw_accel+0xa8/0x2d0 [mac80211] + ieee80211_key_replace+0x22d/0x8e0 [mac80211] + + +Link: https://www.alionet.org/index.php?topic=1469.0 +Link: https://lore.kernel.org/linux-wireless/20230218191056.never.374-kees@kernel.org/ +Link: https://lore.kernel.org/linux-wireless/68760035-7f75-1b23-e355-bfb758a87d83@redhat.com/ +Cc: Kees Cook +Suggested-by: Johannes Berg +Signed-off-by: Hans de Goede +Reviewed-by: Kees Cook +Signed-off-by: Johannes Berg +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/intel/iwlwifi/dvm/sta.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/sta.c b/drivers/net/wireless/intel/iwlwifi/dvm/sta.c +index cef43cf80620..8b01ab986cb1 100644 +--- a/drivers/net/wireless/intel/iwlwifi/dvm/sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/dvm/sta.c +@@ -1081,6 +1081,7 @@ static int iwlagn_send_sta_key(struct iwl_priv *priv, + { + __le16 key_flags; + struct iwl_addsta_cmd sta_cmd; ++ size_t to_copy; + int i; + + spin_lock_bh(&priv->sta_lock); +@@ -1100,7 +1101,9 @@ static int iwlagn_send_sta_key(struct iwl_priv *priv, + sta_cmd.key.tkip_rx_tsc_byte2 = tkip_iv32; + for (i = 0; i < 5; i++) + sta_cmd.key.tkip_rx_ttak[i] = cpu_to_le16(tkip_p1k[i]); +- memcpy(sta_cmd.key.key, keyconf->key, keyconf->keylen); ++ /* keyconf may contain MIC rx/tx keys which iwl does not use */ ++ to_copy = min_t(size_t, sizeof(sta_cmd.key.key), keyconf->keylen); ++ memcpy(sta_cmd.key.key, keyconf->key, to_copy); + break; + case WLAN_CIPHER_SUITE_WEP104: + key_flags |= STA_KEY_FLG_KEY_SIZE_MSK; +-- +2.35.3 + diff --git a/patches.suse/wifi-iwlwifi-pcie-Fix-integer-overflow-in-iwl_write_.patch b/patches.suse/wifi-iwlwifi-pcie-Fix-integer-overflow-in-iwl_write_.patch new file mode 100644 index 0000000..0dc54c8 --- /dev/null +++ b/patches.suse/wifi-iwlwifi-pcie-Fix-integer-overflow-in-iwl_write_.patch @@ -0,0 +1,56 @@ +From 58d1b717879bfeabe09b35e41ad667c79933eb2e Mon Sep 17 00:00:00 2001 +From: Hyunwoo Kim +Date: Fri, 14 Apr 2023 13:11:59 +0300 +Subject: [PATCH] wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf +Git-commit: 58d1b717879bfeabe09b35e41ad667c79933eb2e +Patch-mainline: v6.4-rc1 +References: git-fixes + +An integer overflow occurs in the iwl_write_to_user_buf() function, +which is called by the iwl_dbgfs_monitor_data_read() function. + +static bool iwl_write_to_user_buf(char __user *user_buf, ssize_t count, + void *buf, ssize_t *size, + ssize_t *bytes_copied) +{ + int buf_size_left = count - *bytes_copied; + + buf_size_left = buf_size_left - (buf_size_left % sizeof(u32)); + if (*size > buf_size_left) + *size = buf_size_left; + +If the user passes a SIZE_MAX value to the "ssize_t count" parameter, +the ssize_t count parameter is assigned to "int buf_size_left". +Then compare "*size" with "buf_size_left" . Here, "buf_size_left" is a +negative number, so "*size" is assigned "buf_size_left" and goes into +the third argument of the copy_to_user function, causing a heap overflow. + +This is not a security vulnerability because iwl_dbgfs_monitor_data_read() +is a debugfs operation with 0400 privileges. + +Signed-off-by: Hyunwoo Kim +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230414130637.2d80ace81532.Iecfba549e0e0be21bbb0324675392e42e75bd5ad@changeid +Signed-off-by: Johannes Berg +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +index 40283fe622da..1b32a4035d88 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +@@ -2860,7 +2860,7 @@ static bool iwl_write_to_user_buf(char __user *user_buf, ssize_t count, + void *buf, ssize_t *size, + ssize_t *bytes_copied) + { +- int buf_size_left = count - *bytes_copied; ++ ssize_t buf_size_left = count - *bytes_copied; + + buf_size_left = buf_size_left - (buf_size_left % sizeof(u32)); + if (*size > buf_size_left) +-- +2.35.3 + diff --git a/patches.suse/wifi-iwlwifi-pcie-fix-possible-NULL-pointer-derefere.patch b/patches.suse/wifi-iwlwifi-pcie-fix-possible-NULL-pointer-derefere.patch new file mode 100644 index 0000000..72eba8f --- /dev/null +++ b/patches.suse/wifi-iwlwifi-pcie-fix-possible-NULL-pointer-derefere.patch @@ -0,0 +1,56 @@ +From b655b9a9f8467684cfa8906713d33b71ea8c8f54 Mon Sep 17 00:00:00 2001 +From: Daniel Gabay +Date: Thu, 13 Apr 2023 21:40:32 +0300 +Subject: [PATCH] wifi: iwlwifi: pcie: fix possible NULL pointer dereference +Git-commit: b655b9a9f8467684cfa8906713d33b71ea8c8f54 +Patch-mainline: v6.4-rc1 +References: git-fixes + +It is possible that iwl_pci_probe() will fail and free the trans, +then afterwards iwl_pci_remove() will be called and crash by trying +to access trans which is already freed, fix it. + +iwlwifi 0000:01:00.0: Detected crf-id 0xa5a5a5a2, cnv-id 0xa5a5a5a2 + wfpm id 0xa5a5a5a2 +iwlwifi 0000:01:00.0: Can't find a correct rfid for crf id 0x5a2 +... +Bug: kernel NULL pointer dereference, address: 0000000000000028 +... +Rip: 0010:iwl_pci_remove+0x12/0x30 [iwlwifi] +pci_device_remove+0x3e/0xb0 +device_release_driver_internal+0x103/0x1f0 +driver_detach+0x4c/0x90 +bus_remove_driver+0x5c/0xd0 +driver_unregister+0x31/0x50 +pci_unregister_driver+0x40/0x90 +iwl_pci_unregister_driver+0x15/0x20 [iwlwifi] +__exit_compat+0x9/0x98 [iwlwifi] +__x64_sys_delete_module+0x147/0x260 + +Signed-off-by: Daniel Gabay +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230413213309.082f6e21341b.I0db21d7fa9a828d571ca886713bd0b5d0b6e1e5c@changeid +Signed-off-by: Johannes Berg +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +index 70f6c59eec5d..a60329079167 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +@@ -1733,6 +1733,9 @@ static void iwl_pci_remove(struct pci_dev *pdev) + { + struct iwl_trans *trans = pci_get_drvdata(pdev); + ++ if (!trans) ++ return; ++ + iwl_drv_stop(trans->drv); + + iwl_trans_pcie_free(trans); +-- +2.35.3 + diff --git a/series.conf b/series.conf index 64d4955..af49588 100644 --- a/series.conf +++ b/series.conf @@ -11604,6 +11604,7 @@ patches.suse/0014-drm-dp-Fix-OOB-read-when-handling-Post-Cursor2-regis.patch patches.suse/drm-bridge-cdns-dsi-Make-sure-to-to-create-proper-al.patch patches.suse/drm-msm-dpu-add-DSPP-blocks-teardown.patch + patches.suse/drm-msm-dpu-Add-INTF_5-interrupts.patch patches.suse/drm-msm-dpu-fix-dp-audio-condition.patch patches.suse/0015-drm-msm-dp-do-not-initialize-phy-until-plugin-interr.patch patches.suse/drm-msm-dp-populate-connector-of-struct-dp_panel.patch @@ -15142,6 +15143,7 @@ patches.suse/HID-cp2112-prevent-a-buffer-overflow-in-cp2112_xfer.patch patches.suse/HID-multitouch-new-device-class-fix-Lenovo-X12-track.patch patches.suse/HID-mcp2221-prevent-a-buffer-overflow-in-mcp_smbus_w.patch + patches.suse/HID-wacom-Force-pen-out-of-prox-if-no-events-have-be.patch patches.suse/HID-alps-Declare-U1_UNICORN_LEGACY-support.patch patches.suse/HID-amd_sfh-Add-NULL-check-for-hid-device.patch patches.suse/HID-amd_sfh-Handle-condition-of-no-sensors.patch @@ -16295,6 +16297,7 @@ patches.suse/platform-x86-msi-laptop-Fix-resource-cleanup.patch patches.suse/ACPI-video-Make-backlight-class-device-registration-.patch patches.suse/platform-x86-msi-laptop-Change-DMI-match-alias-strin.patch + patches.suse/platform-x86-hp-wmi-Support-touchpad-on-off.patch patches.suse/drm-bridge-adv7511-fix-CEC-power-down-control-regist.patch patches.suse/drm-nouveau-fix-a-use-after-free-in-nouveau_gem_prim.patch patches.suse/drm-nouveau-nouveau_bo-fix-potential-memory-leak-in-.patch @@ -16472,7 +16475,9 @@ patches.suse/media-uvcvideo-Fix-memory-leak-in-uvc_gpio_parse.patch patches.suse/media-uvcvideo-Use-entity-get_cur-in-uvc_ctrl_set.patch patches.suse/media-xilinx-vipp-Fix-refcount-leak-in-xvip_graph_dm.patch + patches.suse/HID-wacom-Add-new-Intuos-Pro-Small-PTH-460-device-ID.patch patches.suse/HID-roccat-Fix-use-after-free-in-roccat_read.patch + patches.suse/HID-wacom-add-three-styli-to-wacom_intuos_get_tool_t.patch patches.suse/hid-hid-logitech-hidpp-avoid-unnecessary-assignments.patch patches.suse/HID-multitouch-Add-memory-barriers.patch patches.suse/mfd-intel_soc_pmic-Fix-an-error-handling-path-in-int.patch @@ -19808,6 +19813,7 @@ patches.suse/ARM-dts-qcom-ipq4019-Fix-the-PCI-I-O-port-range.patch patches.suse/ARM-dts-qcom-ipq8064-Fix-the-PCI-I-O-port-range.patch patches.suse/arm64-dts-qcom-msm8998-Fix-stm-stimulus-base-reg-nam.patch + patches.suse/arm64-dts-qcom-msm8996-Add-missing-DWC3-quirks.patch patches.suse/arm64-dts-qcom-sdm845-Fix-the-PCI-I-O-port-range.patch patches.suse/arm64-dts-qcom-msm8998-Fix-the-PCI-I-O-port-range.patch patches.suse/arm64-dts-qcom-ipq8074-Fix-the-PCI-I-O-port-range.patch @@ -19819,21 +19825,28 @@ patches.suse/arm64-kgdb-Set-PSTATE.SS-to-1-to-re-enable-single-st.patch patches.suse/drm-rockchip-Drop-unbalanced-obj-unref.patch patches.suse/drm-vgem-add-missing-mutex_destroy.patch + patches.suse/drm-displayid-add-displayid_get_header-and-check-bou.patch patches.suse/drm-probe-helper-Cancel-previous-job-before-starting.patch patches.suse/drm-bridge-adv7533-Fix-adv7533_mode_valid-for-adv753.patch patches.suse/drm-i915-dg2-Add-HDMI-pixel-clock-frequencies-267.30.patch + patches.suse/drm-amd-display-Use-DC_LOG_DC-in-the-trasform-pixel-.patch patches.suse/drm-rcar-du-Fix-a-NULL-vs-IS_ERR-bug.patch patches.suse/drm-amd-display-dc-dce60-Makefile-Fix-previous-attem.patch patches.suse/drm-lima-lima_drv-Add-missing-unwind-goto-in-lima_pd.patch patches.suse/drm-bridge-lt8912b-Fix-DSI-Video-Mode.patch patches.suse/drm-fb-helper-set-x-yres_virtual-in-drm_fb_helper_ch.patch patches.suse/drm-ttm-pool-Fix-ttm_pool_alloc-error-path.patch + patches.suse/drm-tegra-Avoid-potential-32-bit-integer-overflow.patch patches.suse/drm-msm-disp-dpu-check-for-crtc-enable-rather-than-c.patch patches.suse/drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch patches.suse/drm-msm-adreno-Disable-preemption-on-Adreno-510.patch patches.suse/drm-msm-fix-NULL-deref-on-snapshot-tear-down.patch + patches.suse/drm-msm-dp-Clean-up-handling-of-DP-AUX-interrupts.patch + patches.suse/drm-amd-Fix-an-out-of-bounds-error-in-BIOS-parser.patch patches.suse/drm-amd-display-Fix-potential-null-dereference.patch patches.suse/drm-i915-Make-intel_get_crtc_new_encoder-less-oopsy.patch + patches.suse/media-cx23885-Fix-a-null-ptr-deref-bug-in-buffer_pre.patch + patches.suse/media-pci-tw68-Fix-null-ptr-deref-bug-in-buf-prepare.patch patches.suse/media-av7110-prevent-underflow-in-write_ts_to_decode.patch patches.suse/media-max9286-Free-control-handler.patch patches.suse/media-rkvdec-fix-use-after-free-bug-in-rkvdec_remove.patch @@ -19841,6 +19854,7 @@ patches.suse/media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch patches.suse/media-rc-gpio-ir-recv-Fix-support-for-wake-up.patch patches.suse/media-venus-dec-Fix-handling-of-the-start-cmd.patch + patches.suse/regmap-cache-Return-error-in-cache-sync-operations-f.patch patches.suse/regulator-core-Shorten-off-on-delay-us-for-always-on.patch patches.suse/regulator-core-Consistently-set-mutex_owner-when-usi.patch patches.suse/regulator-core-Avoid-lockdep-reports-when-resolving-.patch @@ -19849,18 +19863,23 @@ patches.suse/mtd-core-fix-nvmem-error-reporting.patch patches.suse/mtd-core-fix-error-path-for-nvmem-provider.patch patches.suse/mtd-spi-nor-Fix-a-trivial-typo.patch + patches.suse/memstick-r592-Fix-UAF-bug-in-r592_remove-due-to-race.patch patches.suse/mmc-sdhci-of-esdhc-fix-quirk-to-ignore-command-inhib.patch patches.suse/mailbox-zynqmp-Fix-IPI-isr-handling.patch patches.suse/mailbox-zynqmp-Fix-typo-in-IPI-documentation.patch patches.suse/remoteproc-stm32-Call-of_node_put-on-iteration-error.patch patches.suse/remoteproc-st-Call-of_node_put-on-iteration-error.patch patches.suse/remoteproc-imx_rproc-Call-of_node_put-on-iteration-e.patch + patches.suse/remoteproc-stm32_rproc-Add-mutex-protection-for-work.patch patches.suse/dt-bindings-remoteproc-stm32-rproc-Typo-fix.patch patches.suse/hwmon-k10temp-Check-range-scale-when-CUR_TEMP-regist.patch patches.suse/hwmon-adt7475-Use-device_property-APIs-when-configur.patch patches.suse/hwmon-pmbus-fsp-3y-Fix-functionality-bitmask-in-FSP-.patch + patches.suse/ACPICA-Avoid-undefined-behavior-applying-zero-offset.patch + patches.suse/ACPICA-ACPICA-check-null-return-of-ACPI_ALLOCATE_ZER.patch patches.suse/ACPI-processor-Fix-evaluating-_PDC-method-when-runni.patch patches.suse/ACPI-VIOT-Initialize-the-correct-IOMMU-fwspec.patch + patches.suse/ACPI-EC-Fix-oops-when-removing-custom-query-handlers.patch patches.suse/ACPI-bus-Ensure-that-notify-handlers-are-not-running.patch patches.suse/crypto-safexcel-Cleanup-ring-IRQ-workqueues-on-load-.patch patches.suse/crypto-caam-Clear-some-memory-in-instantiate_rng.patch @@ -19887,12 +19906,14 @@ patches.suse/scsi-lpfc-Fix-ioremap-issues-in-lpfc_sli4_pci_mem_se.patch patches.suse/scsi-lpfc-Silence-an-incorrect-device-output.patch patches.suse/wifi-brcmfmac-support-CQM-RSSI-notification-with-old.patch + patches.suse/wifi-brcmfmac-cfg80211-Pass-the-PMK-in-binary-instea.patch patches.suse/wifi-rtw88-mac-Return-the-original-error-from-rtw_pw.patch patches.suse/wifi-rtw88-mac-Return-the-original-error-from-rtw_ma.patch patches.suse/wifi-mac80211-adjust-scan-cancel-comment-check.patch patches.suse/net-mana-Add-new-MANA-VF-performance-counters-for-ea.patch patches.suse/wifi-brcmfmac-slab-out-of-bounds-read-in-brcmf_get_a.patch patches.suse/wifi-ath6kl-minor-fix-for-allocation-size.patch + patches.suse/wifi-ath-Silence-memcpy-run-time-false-positive-warn.patch patches.suse/wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch patches.suse/wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch patches.suse/wifi-ath6kl-reduce-WARN-to-dev_dbg-in-callback.patch @@ -19911,12 +19932,15 @@ patches.suse/wifi-iwlwifi-debug-fix-crash-in-__iwl_err.patch patches.suse/wifi-iwlwifi-trans-don-t-trigger-d3-interrupt-twice.patch patches.suse/wifi-iwlwifi-mvm-don-t-set-CHECKSUM_COMPLETE-for-uns.patch + patches.suse/wifi-iwlwifi-pcie-fix-possible-NULL-pointer-derefere.patch patches.suse/wifi-iwlwifi-yoyo-skip-dump-correctly-on-hw-error.patch patches.suse/wifi-iwlwifi-yoyo-Fix-possible-division-by-zero.patch patches.suse/wifi-iwlwifi-mvm-initialize-seq-variable.patch patches.suse/wifi-iwlwifi-fw-move-memset-before-early-return.patch + patches.suse/wifi-iwlwifi-pcie-Fix-integer-overflow-in-iwl_write_.patch patches.suse/wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch patches.suse/wifi-iwlwifi-mvm-check-firmware-response-size.patch + patches.suse/wifi-iwlwifi-dvm-Fix-memcpy-detected-field-spanning-.patch patches.suse/wifi-iwlwifi-fw-fix-memory-leak-in-debugfs.patch patches.suse/wifi-mt76-handle-failure-of-vzalloc-in-mt7615_coredu.patch patches.suse/wifi-mt76-add-missing-locking-to-protect-against-con.patch @@ -19924,7 +19948,10 @@ patches.suse/wifi-mt76-mt7921e-fix-probe-timeout-after-reboot.patch patches.suse/wifi-mt76-fix-6GHz-high-channel-not-be-scanned.patch patches.suse/wifi-mt76-mt7921e-improve-reliability-of-dma-reset.patch + patches.suse/wifi-ath11k-Fix-SKB-corruption-in-REO-destination-ri.patch + patches.suse/Bluetooth-btintel-Add-LE-States-quirk-support.patch patches.suse/Revert-Bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch + patches.suse/Bluetooth-L2CAP-fix-bad-unlock-balance-in-l2cap_disc.patch patches.suse/bluetooth-Perform-careful-capability-checks-in-hci_s.patch patches.suse/net-mana-Rename-mana_refill_rxoob-and-remove-some-em.patch patches.suse/net-mana-Check-if-netdev-napi_alloc_frag-returns-sin.patch @@ -19938,13 +19965,17 @@ patches.suse/ASoC-cs35l41-Only-disable-internal-boost.patch patches.suse/ASoC-es8316-Handle-optional-IRQ-assignment.patch patches.suse/ASoC-fsl_mqs-move-of_node_put-to-the-correct-locatio.patch + patches.suse/spi-spi-imx-fix-MX51_ECSPI_-macros-when-cs-3.patch patches.suse/spi-qup-Don-t-skip-cleanup-in-remove-s-error-path.patch patches.suse/spi-fsl-spi-Fix-CPM-QE-mode-Litte-Endian.patch patches.suse/spi-cadence-quadspi-fix-suspend-resume-implementatio.patch patches.suse/ipmi-ssif-Add-send_retries-increment.patch patches.suse/ipmi-fix-SSIF-not-responding-under-certain-cond.patch patches.suse/i2c-cadence-cdns_i2c_master_xfer-Fix-runtime-PM-leak.patch + patches.suse/HID-logitech-hidpp-Don-t-use-the-USB-serial-for-USB-.patch + patches.suse/HID-logitech-hidpp-Reconcile-USB-and-Unifying-serial.patch patches.suse/HID-wacom-Set-a-default-resolution-for-older-tablets.patch + patches.suse/HID-wacom-generic-Set-battery-quirk-only-when-we-see.patch patches.suse/usb-host-xhci-rcar-remove-leftover-quirk-handling.patch patches.suse/usb-dwc3-gadget-Change-condition-for-processing-susp.patch patches.suse/usb-gadget-udc-renesas_usb3-Fix-use-after-free-bug-i.patch @@ -19962,6 +19993,8 @@ patches.suse/tty-Prevent-writing-chars-during-tcsetattr-TCSADRAIN.patch patches.suse/tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch patches.suse/serial-8250-Add-missing-wakeup-event-reporting.patch + patches.suse/serial-8250-Reinit-port-pm-on-port-specific-driver-u.patch + patches.suse/staging-rtl8192e-Replace-macro-RTL_PCI_DEVICE-with-P.patch patches.suse/drivers-staging-rtl8723bs-Fix-locking-in-_rtw_join_t.patch patches.suse/drivers-staging-rtl8723bs-Fix-locking-in-rtw_scan_ti.patch patches.suse/staging-iio-resolver-ads1210-fix-config-mode.patch @@ -20000,6 +20033,7 @@ patches.suse/RDMA-mlx5-Fix-flow-counter-query-via-DEVX.patch patches.suse/RDMA-mlx5-Use-correct-device-num_ports-when-modify-D.patch patches.suse/clk-at91-clk-sam9x60-pll-fix-return-value-check.patch + patches.suse/clk-tegra20-fix-gcc-7-constant-overflow-warning.patch patches.suse/clk-add-missing-of_node_put-in-assigned-clocks-prope.patch patches.suse/clk-rockchip-rk3399-allow-clk_cifout-to-force-clk_ci.patch patches.suse/dt-bindings-mailbox-qcom-apcs-kpss-global-fix-SDX55-.patch @@ -20014,11 +20048,13 @@ patches.suse/KVM-nVMX-Emulate-NOPs-in-L2-and-PAUSE-if-it-s-not-in.patch patches.suse/Input-hp_sdc_rtc-mark-an-unused-function-as-__maybe_.patch patches.suse/Input-raspberrypi-ts-fix-refcount-leak-in-rpi_ts_pro.patch + patches.suse/Input-xpad-add-constants-for-GIP-interface-numbers.patch patches.suse/leds-TI_LMU_COMMON-select-REGMAP-instead-of-dependin.patch patches.suse/leds-Fix-reference-to-led_set_brightness-in-doc.patch patches.suse/leds-tca6507-Fix-error-handling-of-using-fwnode_prop.patch patches.suse/mfd-tqmx86-Do-not-access-I2C_DETECT-register-through.patch patches.suse/mfd-tqmx86-Correct-board-names-for-TQMxE39x.patch + patches.suse/mfd-dln2-Fix-memory-leak-in-dln2_probe.patch patches.suse/pinctrl-qcom-lpass-lpi-set-output-value-before-enabl.patch patches.suse/pinctrl-renesas-r8a779a0-Remove-incorrect-AVB-01-pin.patch patches.suse/dmaengine-mv_xor_v2-Fix-an-error-code.patch @@ -20026,8 +20062,10 @@ patches.suse/dmaengine-dw-edma-Fix-to-change-for-continuous-trans.patch patches.suse/dmaengine-dw-edma-Fix-to-enable-to-issue-dma-request.patch patches.suse/dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch + patches.suse/phy-st-miphy28lp-use-_poll_timeout-functions-for-wai.patch patches.suse/phy-tegra-xusb-Add-missing-tegra_xusb_port_unregiste.patch patches.suse/soundwire-qcom-correct-setting-ignore-bit-on-v1.5.1.patch + patches.suse/soundwire-qcom-gracefully-handle-too-many-ports-in-D.patch patches.suse/pwm-meson-Fix-axg-ao-mux-parents.patch patches.suse/pwm-meson-Fix-g12a-ao-clk81-name.patch patches.suse/PM-hibernate-Turn-snapshot_test-into-global-variable.patch @@ -20069,6 +20107,7 @@ patches.suse/drm-amdgpu-gfx-disable-gfx9-cp_ecc_error_irq-only-wh.patch patches.suse/fbdev-arcfb-Fix-error-handling-in-arcfb_probe.patch patches.suse/ARM-9296-1-HP-Jornada-7XX-fix-kernel-doc-warnings.patch + patches.suse/tpm-tpm_tis-Disable-interrupts-for-more-Lenovo-devic.patch patches.suse/selftests-sgx-Add-test_encl.elf-to-TEST_FILES.patch patches.suse/media-netup_unidvb-fix-use-after-free-at-del_timer.patch patches.suse/media-ttusb-dec-fix-memory-leak-in-ttusb_dec_exit_dv.patch @@ -20079,6 +20118,7 @@ patches.suse/media-dvb-core-Fix-use-after-free-due-to-race-condit.patch patches.suse/selftests-seg6-disable-DAD-on-IPv6-router-cfg-for-sr.patch patches.suse/selftets-seg6-disable-rp_filter-by-default-in-srv6_e.patch + patches.suse/net-phy-dp83867-add-w-a-for-packet-errors-seen-with-.patch patches.suse/can-isotp-recvmsg-allow-MSG_CMSG_COMPAT-flag.patch patches.suse/can-j1939-recvmsg-allow-MSG_CMSG_COMPAT-flag.patch patches.suse/cassini-Fix-a-memory-leak-in-the-error-handling-path.patch @@ -20094,6 +20134,7 @@ patches.suse/can-kvaser_pciefd-Empty-SRB-buffer-in-probe.patch patches.suse/can-kvaser_pciefd-Do-not-send-EFLUSH-command-on-TFD-.patch patches.suse/can-kvaser_pciefd-Disable-interrupts-in-probe-error-.patch + patches.suse/nilfs2-fix-use-after-free-bug-of-nilfs_root-in-nilfs.patch patches.suse/ALSA-hda-realtek-Add-quirk-for-Clevo-L140AU.patch patches.suse/ALSA-hda-realtek-Add-quirk-for-2nd-ASUS-GU603.patch patches.suse/ALSA-hda-realtek-Add-a-quirk-for-HP-EliteDesk-805.patch @@ -20111,14 +20152,20 @@ patches.suse/Documentation-filesystems-ramfs-rootfs-initramfs-use.patch patches.suse/drm-exynos-fix-g2d_open-close-helper-function-defini.patch patches.suse/drm-msm-dp-unregister-audio-driver-during-unbind.patch + patches.suse/drm-msm-dpu-Move-non-MDP_TOP-INTF_INTR-offsets-out-o.patch patches.suse/drm-msm-dpu-Remove-duplicate-register-defines-from-I.patch + patches.suse/USB-usbtmc-Fix-direction-for-0-length-ioctl-control-.patch patches.suse/usb-dwc3-gadget-Improve-dwc3_gadget_suspend-and-dwc3.patch + patches.suse/USB-UHCI-adjust-zhaoxin-UHCI-controllers-OverCurrent.patch patches.suse/usb-dwc3-debugfs-Resume-dwc3-before-accessing-regist.patch patches.suse/usb-typec-altmodes-displayport-fix-pin_assignment_sh.patch patches.suse/usb-gadget-u_ether-Fix-host-MAC-address-case.patch + patches.suse/usb-storage-fix-deadlock-when-a-scsi-command-timeout.patch patches.suse/xhci-pci-Only-run-d3cold-avoidance-quirk-for-s2idle.patch patches.suse/xhci-Fix-incorrect-tracking-of-free-space-on-transfe.patch patches.suse/thunderbolt-Clear-registers-properly-when-auto-clear.patch + patches.suse/serial-8250_exar-Add-support-for-USR298x-PCI-Modems.patch + patches.suse/serial-Add-support-for-Advantech-PCI-1611U-card.patch patches.suse/serial-arc_uart-fix-of_iomap-leak-in-arc_serial_prob.patch patches.suse/serial-8250_bcm7271-balance-clk_enable-calls.patch patches.suse/serial-8250_bcm7271-fix-leak-in-brcmuart_probe.patch @@ -20126,6 +20173,9 @@ patches.suse/vc_screen-reload-load-of-struct-vc_data-pointer-in-v.patch patches.suse/fbdev-udlfb-Fix-endpoint-check.patch patches.suse/powerpc-iommu-DMA-address-offset-is-incorrectly-calc.patch + patches.suse/mmc-sdhci-esdhc-imx-make-no-mmc-hs400-works.patch + patches.suse/regulator-pca9450-Fix-BUCK2-enable_mask.patch + patches.suse/regulator-mt6359-add-read-check-for-PMIC-MT6359.patch ######################################################## # end of sorted patches