From ebc4f0cb715d533804b3e9d66899a0470ba951f2 Mon Sep 17 00:00:00 2001 From: Davidlohr Bueso Date: Jun 01 2021 16:17:05 +0000 Subject: Merge branch 'SLE15-SP2' (bd78e289bef8) into 'SLE15-SP2-RT' No -rt specific changes this merge. --- diff --git a/blacklist.conf b/blacklist.conf index b8600db..b19ef09 100644 --- a/blacklist.conf +++ b/blacklist.conf @@ -580,3 +580,44 @@ d17d9227c332b7deca59b35fa9ff08e597666c2a # cosmetic fix de4ffc653f370e56d74994ae5247e39a100b4ff7 # kuap/uaccess fixes not applicable to SP2 code 8524e2e76441fc615a3b5c1415823e051cc79eae # kuap/uaccess fixes not applicable to SP2 code b166a20b07382b8bc1dcee2a448715c9c2c81b5b # reverted by 01bfe5e8e428, replaced by 34e5b0118685 +392a9f63058f2cdcec8363b849a25532ee40da9f # dt-bindings +4bc77b2d211e107fa54b1f39cd0d7dac5537b8cb # dt-bindings +a4dc1ca607e47e3ab342fb1a78b98bdc15088e7f # dt-bindings +a4dc1ca607e47e3ab342fb1a78b98bdc15088e7f # dt-bindings +d619a95693acbab64e0cdc76ddee5e214c4363f3 # dt-bindings +cb11a90e33c04623428eccb2c693a6b81947c686 # dt-bindings +9af865d95bd730c1d1035acd5dd6df105da98d0c # dt-bindings +3aa3c66aedef6a21ea1ad53f5b4491430ef0c84e # dt-bindings +512ec50a97d80f604f166da08258395c6f50a607 # dt-bindings +3ffce7b6100cbfc1dcbec8be2b824b2d75866455 # dt-bindings +956aa03b52e9c07e6ba769afd4e6f8c43436d02c # dt-bindings +9c3a16f88385e671b63a0de7b82b85e604a80f42 # device-tree fix +4fb3a074755b7737c4081cffe0ccfa08c2f2d29d # device-tree fix +ba8da03fa7dff59d9400250aebd38f94cde3cb0f # device-tree fix +5cfad4f45806f6f898b63b8c77cea7452c704cb3 # device-tree fix +1d88358a89dbac9c7d4559548b9a44840456e6fb # device-tree fix +dcabb06bf127b3e0d3fbc94a2b65dd56c2725851 # device-tree fix +e8b395b23643ca26e62a3081130d895e198c6154 # device-tree fix +686e0a0c8c61e0e3f55321d0181fece3efd92777 # device-tree fix +73bc7510ea0dafb4ff1ae6808759627a8ec51f5a # device-tree fix +e1e47fbca668507a81bb388fcae044b89d112ecc # device-tree fix +d0570a575aa83116bd0f6a99c4de548af773d950 # device-tree fix +4076a007bd0f6171434bdb119a0b8797749b0502 # device-tree fix +94dad6bed3c86c00050bf7c2b2ad6b630facae31 # device-tree fix +1653e3d470629d25c64cd8a2f84adb20a9348b0c # device-tree fix +656c648354e1561fa4f445b0b3252ec1d24e3951 # device-tree fix +aa880c6f3ee6dbd0d5ab02026a514ff8ea0a3328 # device-tree fix +e98e2367dfb4b6d7a80c8ce795c644124eff5f36 # device-tree fix +1fea2eb2f5bbd3fbbe2513d2386b5f6e6db17fd7 # device-tree fix +cc72570747e43335f4933a24dd74d5653639176a # device-tree fix +da2fb8457f71138d455cba82edec0d34f858e506 # device-tree fix +941432d007689f3774646e41a1439228b6c6ee0e # device-tree fix +cfe6c487b9a1abc6197714ec5605716a5428cf03 # device-tree fix +948c657cc45e8ce48cb533d4e2106145fa765759 # device-tree fix +c6433083f5930fdf52ad47c8c0459719c810dc89 # device-tree fix +3503376d6cc385b6266f93c24ead9a33d8dfe8cb # device-tree fix +1741e18737948c140ccc4cc643e8126d95ee6e79 # device-tree fix +1e0ca5467445bc1f41a9e403d6161a22f313dae7 # device-tree fix +2933bf3528007f834fb7f5eab033f9c5b0683f91 # device-tree fix +4bb1eb3cd4bd6241d5e5f99bbfd801ea5a007b6c # device-tree fix +b0fc70ce1f028e14a37c186d9f7a55e51439b83a # Berlin SOC not supported diff --git a/patches.kabi/nxp-i2c-restore-includes-for-kABI.patch b/patches.kabi/nxp-i2c-restore-includes-for-kABI.patch new file mode 100644 index 0000000..4b8982c --- /dev/null +++ b/patches.kabi/nxp-i2c-restore-includes-for-kABI.patch @@ -0,0 +1,45 @@ +From 70646feb533f2c2024e66bc0953a1f2220922392 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Tue, 1 Jun 2021 14:25:37 +0200 +Subject: [PATCH] nxp-i2c: restore includes for kABI +Patch-mainline: Never, kABI fix +References: bsc#1185589 + +They are no longer needed for compilation, but removing +them changes kABI computation. A false positive, but lets +restore them. + +Signed-off-by: Oliver Neukum +--- + drivers/nfc/nxp-nci/core.c | 1 + + drivers/nfc/nxp-nci/i2c.c | 2 ++ + 2 files changed, 3 insertions(+) + +diff --git a/drivers/nfc/nxp-nci/core.c b/drivers/nfc/nxp-nci/core.c +index a0ce95a28..aed18ca60 100644 +--- a/drivers/nfc/nxp-nci/core.c ++++ b/drivers/nfc/nxp-nci/core.c +@@ -11,6 +11,7 @@ + */ + + #include ++#include + #include + #include + +diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c +index a05410556..736b1a8dc 100644 +--- a/drivers/nfc/nxp-nci/i2c.c ++++ b/drivers/nfc/nxp-nci/i2c.c +@@ -21,6 +21,8 @@ + #include + #include + #include ++#include ++#include + #include + + #include +-- +2.26.2 + diff --git a/patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch b/patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch new file mode 100644 index 0000000..0d40a55 --- /dev/null +++ b/patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch @@ -0,0 +1,76 @@ +From 2253042d86f57d90a621ac2513a7a7a13afcf809 Mon Sep 17 00:00:00 2001 +From: Petr Pavlu +Date: Thu, 13 May 2021 14:26:36 +0200 +Subject: [PATCH] ipmi/watchdog: Stop watchdog timer when the current action is + 'none' +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://github.com/cminyard/linux-ipmi.git +Git-commit: 2253042d86f57d90a621ac2513a7a7a13afcf809 +References: bsc#1184855 + +When an IPMI watchdog timer is being stopped in ipmi_close() or +ipmi_ioctl(WDIOS_DISABLECARD), the current watchdog action is updated to +WDOG_TIMEOUT_NONE and _ipmi_set_timeout(IPMI_SET_TIMEOUT_NO_HB) is called +to install this action. The latter function ends up invoking +__ipmi_set_timeout() which makes the actual 'Set Watchdog Timer' IPMI +request. + +For IPMI 1.0, this operation results in fully stopping the watchdog timer. +For IPMI >= 1.5, function __ipmi_set_timeout() always specifies the "don't +stop" flag in the prepared 'Set Watchdog Timer' IPMI request. This causes +that the watchdog timer has its action correctly updated to 'none' but the +timer continues to run. A problem is that IPMI firmware can then still log +an expiration event when the configured timeout is reached, which is +unexpected because the watchdog timer was requested to be stopped. + +The patch fixes this problem by not setting the "don't stop" flag in +__ipmi_set_timeout() when the current action is WDOG_TIMEOUT_NONE which +results in stopping the watchdog timer. This makes the behaviour for +IPMI >= 1.5 consistent with IPMI 1.0. It also matches the logic in +__ipmi_heartbeat() which does not allow to reset the watchdog if the +current action is WDOG_TIMEOUT_NONE as that would start the timer. + +Signed-off-by: Petr Pavlu +Message-Id: <10a41bdc-9c99-089c-8d89-fa98ce5ea080@suse.com> +Cc: stable@vger.kernel.org +Signed-off-by: Corey Minyard +--- + drivers/char/ipmi/ipmi_watchdog.c | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c +index 32c334e34d55..e4ff3b50de7f 100644 +--- a/drivers/char/ipmi/ipmi_watchdog.c ++++ b/drivers/char/ipmi/ipmi_watchdog.c +@@ -371,16 +371,18 @@ static int __ipmi_set_timeout(struct ipmi_smi_msg *smi_msg, + data[0] = 0; + WDOG_SET_TIMER_USE(data[0], WDOG_TIMER_USE_SMS_OS); + +- if ((ipmi_version_major > 1) +- || ((ipmi_version_major == 1) && (ipmi_version_minor >= 5))) { +- /* This is an IPMI 1.5-only feature. */ +- data[0] |= WDOG_DONT_STOP_ON_SET; +- } else if (ipmi_watchdog_state != WDOG_TIMEOUT_NONE) { +- /* +- * In ipmi 1.0, setting the timer stops the watchdog, we +- * need to start it back up again. +- */ +- hbnow = 1; ++ if (ipmi_watchdog_state != WDOG_TIMEOUT_NONE) { ++ if ((ipmi_version_major > 1) || ++ ((ipmi_version_major == 1) && (ipmi_version_minor >= 5))) { ++ /* This is an IPMI 1.5-only feature. */ ++ data[0] |= WDOG_DONT_STOP_ON_SET; ++ } else { ++ /* ++ * In ipmi 1.0, setting the timer stops the watchdog, we ++ * need to start it back up again. ++ */ ++ hbnow = 1; ++ } + } + + data[1] = 0; +-- +2.26.2 + diff --git a/patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch b/patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch new file mode 100644 index 0000000..0998f16 --- /dev/null +++ b/patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch @@ -0,0 +1,120 @@ +From 04553e40a19178f50ff56470bc72313632fb9994 Mon Sep 17 00:00:00 2001 +From: Ali Abdallah +Date: Fri, 28 May 2021 12:49:24 +0200 +Subject: [PATCH] netfilter: conntrack: add new sysctl to disable RST check +Patch-mainline: Submitted - 2021-05-27 - https://patchwork.ozlabs.org/project/netfilter-devel/patch/20210527071906.s7z72s7wsene5lib@Fryzen495/ +References: bsc#1183947 bsc#1185950 + +This patch adds a new sysctl tcp_ignore_invalid_rst to disable marking +out of segments RSTs as INVALID. + +Signed-off-by: Ali Abdallah + +Acked-by: Ali Abdallah +--- + Documentation/networking/nf_conntrack-sysctl.txt | 6 ++++++ + include/net/netns/conntrack.h | 3 +++ + net/netfilter/nf_conntrack_proto_tcp.c | 6 +++++- + net/netfilter/nf_conntrack_standalone.c | 10 ++++++++++ + 4 files changed, 24 insertions(+), 1 deletion(-) + +diff --git a/Documentation/networking/nf_conntrack-sysctl.txt b/Documentation/networking/nf_conntrack-sysctl.txt +index f75c2ce6e..4d4925826 100644 +--- a/Documentation/networking/nf_conntrack-sysctl.txt ++++ b/Documentation/networking/nf_conntrack-sysctl.txt +@@ -103,6 +103,12 @@ nf_conntrack_tcp_be_liberal - BOOLEAN + Be conservative in what you do, be liberal in what you accept from others. + If it's non-zero, we mark only out of window RST segments as INVALID. + ++nf_conntrack_tcp_ignore_invalid_rst - BOOLEAN ++ - 0 - disabled (default) ++ - 1 - enabled ++ ++ If it's non-zero, we don't mark out of window RST segments as INVALID. ++ + nf_conntrack_tcp_loose - BOOLEAN + 0 - disabled + not 0 - enabled (default) +diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h +index 806454e76..cc8e97940 100644 +--- a/include/net/netns/conntrack.h ++++ b/include/net/netns/conntrack.h +@@ -27,6 +27,9 @@ struct nf_tcp_net { + int tcp_loose; + int tcp_be_liberal; + int tcp_max_retrans; ++#ifndef __GENKSYMS__ ++ int tcp_ignore_invalid_rst; ++#endif + }; + + enum udp_conntrack { +diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c +index 9d825992c..35ee0fa95 100644 +--- a/net/netfilter/nf_conntrack_proto_tcp.c ++++ b/net/netfilter/nf_conntrack_proto_tcp.c +@@ -36,6 +36,8 @@ + If it's non-zero, we mark only out of window RST segments as INVALID. */ + static int nf_ct_tcp_be_liberal __read_mostly = 0; + ++static int nf_ct_tcp_ignore_invalid_rst __read_mostly = 0; ++ + /* If it is set to zero, we disable picking up already established + connections. */ + static int nf_ct_tcp_loose __read_mostly = 1; +@@ -1078,7 +1080,8 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct, + if (seq == 0 && !nf_conntrack_tcp_established(ct)) + break; + +- if (before(seq, ct->proto.tcp.seen[!dir].td_maxack)) { ++ if (before(seq, ct->proto.tcp.seen[!dir].td_maxack) && ++ !tn->tcp_ignore_invalid_rst) { + /* Invalid RST */ + spin_unlock_bh(&ct->lock); + nf_ct_l4proto_log_invalid(skb, ct, "invalid rst"); +@@ -1452,6 +1455,7 @@ void nf_conntrack_tcp_init_net(struct net *net) + tn->tcp_loose = nf_ct_tcp_loose; + tn->tcp_be_liberal = nf_ct_tcp_be_liberal; + tn->tcp_max_retrans = nf_ct_tcp_max_retrans; ++ tn->tcp_ignore_invalid_rst = nf_ct_tcp_ignore_invalid_rst; + } + + const struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp = +diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c +index 0006503d2..638e49f57 100644 +--- a/net/netfilter/nf_conntrack_standalone.c ++++ b/net/netfilter/nf_conntrack_standalone.c +@@ -565,6 +565,7 @@ enum nf_ct_sysctl_index { + NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_UNACK, + NF_SYSCTL_CT_PROTO_TCP_LOOSE, + NF_SYSCTL_CT_PROTO_TCP_LIBERAL, ++ NF_SYSCTL_CT_PROTO_TCP_IGNORE_INVALID_RST, + NF_SYSCTL_CT_PROTO_TCP_MAX_RETRANS, + NF_SYSCTL_CT_PROTO_TIMEOUT_UDP, + NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_STREAM, +@@ -770,6 +771,14 @@ static struct ctl_table nf_ct_sysctl_table[] = { + .extra1 = &zero, + .extra2 = &one, + }, ++ [NF_SYSCTL_CT_PROTO_TCP_IGNORE_INVALID_RST] = { ++ .procname = "nf_conntrack_tcp_ignore_invalid_rst", ++ .maxlen = sizeof(int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec_minmax, ++ .extra1 = &zero, ++ .extra2 = &one, ++ }, + [NF_SYSCTL_CT_PROTO_TCP_MAX_RETRANS] = { + .procname = "nf_conntrack_tcp_max_retrans", + .maxlen = sizeof(unsigned int), +@@ -962,6 +971,7 @@ static void nf_conntrack_standalone_init_tcp_sysctl(struct net *net, + XASSIGN(LOOSE, &tn->tcp_loose); + XASSIGN(LIBERAL, &tn->tcp_be_liberal); + XASSIGN(MAX_RETRANS, &tn->tcp_max_retrans); ++ XASSIGN(IGNORE_INVALID_RST, &tn->tcp_ignore_invalid_rst); + #undef XASSIGN + } + +-- +2.26.2 + diff --git a/patches.suse/0001-netfilter-conntrack-avoid-misleading-invalid-in-log-.patch b/patches.suse/0001-netfilter-conntrack-avoid-misleading-invalid-in-log-.patch new file mode 100644 index 0000000..e61baf6 --- /dev/null +++ b/patches.suse/0001-netfilter-conntrack-avoid-misleading-invalid-in-log-.patch @@ -0,0 +1,42 @@ +From 8982e3edf5bc06ae95feb9e27f0708a4e192180c Mon Sep 17 00:00:00 2001 +From: Ali Abdallah +Date: Fri, 28 May 2021 11:13:18 +0200 +Subject: [PATCH] netfilter: conntrack: avoid misleading 'invalid' in log + message +Patch-mainline: v5.12-rc3 +Git-commit: 07b5a76e18925a595bfef44531dbf2f397bb5507 +References: bsc#1183947 bsc#1185950 + +The packet is not flagged as invalid: conntrack will accept it and +its associated with the conntrack entry. + +This happens e.g. when receiving a retransmitted SYN in SYN_RECV state. + +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso + +Acked-by: Ali Abdallah +--- + net/netfilter/nf_conntrack_proto_tcp.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c +index 85c1f8c21..0cf1b7805 100644 +--- a/net/netfilter/nf_conntrack_proto_tcp.c ++++ b/net/netfilter/nf_conntrack_proto_tcp.c +@@ -981,8 +981,10 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct, + IP_CT_EXP_CHALLENGE_ACK; + } + spin_unlock_bh(&ct->lock); +- nf_ct_l4proto_log_invalid(skb, ct, "invalid packet ignored in " +- "state %s ", tcp_conntrack_names[old_state]); ++ nf_ct_l4proto_log_invalid(skb, ct, ++ "packet (index %d) in dir %d ignored, state %s", ++ index, dir, ++ tcp_conntrack_names[old_state]); + return NF_ACCEPT; + case TCP_CONNTRACK_MAX: + /* Special case for SYN proxy: when the SYN to the server or +-- +2.26.2 + diff --git a/patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch b/patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch new file mode 100644 index 0000000..dbded56 --- /dev/null +++ b/patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch @@ -0,0 +1,124 @@ +From c9361ff3a94a4d8f58fef53e1a5c68df5c107e6e Mon Sep 17 00:00:00 2001 +From: Ali Abdallah +Date: Fri, 28 May 2021 11:14:28 +0200 +Subject: [PATCH] netfilter: conntrack: improve RST handling when tuple is + re-used +Patch-mainline: Submitted - 2021-05-20 - https://patchwork.ozlabs.org/project/netfilter-devel/patch/20210520105311.20745-1-fw@strlen.de/ +References: bsc#1183947 bsc#1185950 + +If we receive a SYN packet in original direction on an existing +connection tracking entry, we let this SYN through because conntrack +might be out-of-sync. + +Conntrack gets back in sync when server responds with SYN/ACK and state +gets updated accordingly. + +However, if server replies with RST, this packet might be marked as +INVALID because td_maxack value reflects the *old* conntrack state +and not the state of the originator of the RST. + +Avoid td_maxack-based checks if previous packet was a SYN. + +Unfortunately that is not be enough: an out of order ACK in original +direction updates last_index, so we still end up marking valid RST. + +Thus disable the sequence check when we are not in established state and +the received RST has a sequence of 0. + +Because marking RSTs as invalid usually leads to unwanted timeouts, +also skip RST sequence checks if a conntrack entry is already closing. + +Such entries can already be evicted via GC in case the table is full. + +Co-developed-by: Florian Westphal +Signed-off-by: Florian Westphal +Signed-off-by: Ali Abdallah + +Acked-by: Ali Abdallah +--- + net/netfilter/nf_conntrack_proto_tcp.c | 53 +++++++++++++++++--------- + 1 file changed, 36 insertions(+), 17 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c +index 0cf1b7805..9d825992c 100644 +--- a/net/netfilter/nf_conntrack_proto_tcp.c ++++ b/net/netfilter/nf_conntrack_proto_tcp.c +@@ -833,6 +833,22 @@ static bool nf_conntrack_tcp_established(const struct nf_conn *ct) + test_bit(IPS_ASSURED_BIT, &ct->status); + } + ++static bool tcp_can_early_drop(const struct nf_conn *ct) ++{ ++ switch (ct->proto.tcp.state) { ++ case TCP_CONNTRACK_FIN_WAIT: ++ case TCP_CONNTRACK_LAST_ACK: ++ case TCP_CONNTRACK_TIME_WAIT: ++ case TCP_CONNTRACK_CLOSE: ++ case TCP_CONNTRACK_CLOSE_WAIT: ++ return true; ++ default: ++ break; ++ } ++ ++ return false; ++} ++ + /* Returns verdict for packet, or -1 for invalid. */ + int nf_conntrack_tcp_packet(struct nf_conn *ct, + struct sk_buff *skb, +@@ -1040,9 +1056,28 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct, + if (index != TCP_RST_SET) + break; + +- if (ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET) { ++ /* If we are closing, tuple might have been re-used already. ++ * last_index, last_ack, and all other ct fields used for ++ * sequence/window validation are outdated in that case. ++ * ++ * As the conntrack can already be expired by GC under pressure, ++ * just skip validation checks. ++ */ ++ if (tcp_can_early_drop(ct)) ++ goto in_window; ++ ++ /* td_maxack might be outdated if we let a SYN through earlier */ ++ if ((ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET) && ++ ct->proto.tcp.last_index != TCP_SYN_SET) { + u32 seq = ntohl(th->seq); + ++ /* If we are not in established state and SEQ=0 this is most ++ * likely an answer to a SYN we let go through above (last_index ++ * can be updated due to out-of-order ACKs). ++ */ ++ if (seq == 0 && !nf_conntrack_tcp_established(ct)) ++ break; ++ + if (before(seq, ct->proto.tcp.seen[!dir].td_maxack)) { + /* Invalid RST */ + spin_unlock_bh(&ct->lock); +@@ -1165,22 +1200,6 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct, + return NF_ACCEPT; + } + +-static bool tcp_can_early_drop(const struct nf_conn *ct) +-{ +- switch (ct->proto.tcp.state) { +- case TCP_CONNTRACK_FIN_WAIT: +- case TCP_CONNTRACK_LAST_ACK: +- case TCP_CONNTRACK_TIME_WAIT: +- case TCP_CONNTRACK_CLOSE: +- case TCP_CONNTRACK_CLOSE_WAIT: +- return true; +- default: +- break; +- } +- +- return false; +-} +- + #if IS_ENABLED(CONFIG_NF_CT_NETLINK) + + #include +-- +2.26.2 + diff --git a/patches.suse/ACPI-hotplug-PCI-Fix-reference-count-leak-in-enable_.patch b/patches.suse/ACPI-hotplug-PCI-Fix-reference-count-leak-in-enable_.patch new file mode 100644 index 0000000..86cdf8c --- /dev/null +++ b/patches.suse/ACPI-hotplug-PCI-Fix-reference-count-leak-in-enable_.patch @@ -0,0 +1,43 @@ +From 3bbfd319034ddce59e023837a4aa11439460509b Mon Sep 17 00:00:00 2001 +From: Feilong Lin +Date: Thu, 25 Mar 2021 15:26:00 +0800 +Subject: [PATCH] ACPI / hotplug / PCI: Fix reference count leak in enable_slot() +Git-commit: 3bbfd319034ddce59e023837a4aa11439460509b +Patch-mainline: v5.13-rc1 +References: git-fixes + +In enable_slot(), if pci_get_slot() returns NULL, we clear the SLOT_ENABLED +flag. When pci_get_slot() finds a device, it increments the device's +reference count. In this case, we did not call pci_dev_put() to decrement +the reference count, so the memory of the device (struct pci_dev type) will +eventually leak. + +Call pci_dev_put() to decrement its reference count when pci_get_slot() +returns a PCI device. + +Link: https://lore.kernel.org/r/b411af88-5049-a1c6-83ac-d104a1f429be@huawei.com +Signed-off-by: Feilong Lin +Signed-off-by: Zhiqiang Liu +Signed-off-by: Bjorn Helgaas +Reviewed-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/pci/hotplug/acpiphp_glue.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c +index 3365c93abf0e..f031302ad401 100644 +--- a/drivers/pci/hotplug/acpiphp_glue.c ++++ b/drivers/pci/hotplug/acpiphp_glue.c +@@ -533,6 +533,7 @@ static void enable_slot(struct acpiphp_slot *slot, bool bridge) + slot->flags &= ~SLOT_ENABLED; + continue; + } ++ pci_dev_put(dev); + } + } + +-- +2.26.2 + diff --git a/patches.suse/ALSA-bebob-enable-to-deliver-MIDI-messages-for-multi.patch b/patches.suse/ALSA-bebob-enable-to-deliver-MIDI-messages-for-multi.patch new file mode 100644 index 0000000..ad4e072 --- /dev/null +++ b/patches.suse/ALSA-bebob-enable-to-deliver-MIDI-messages-for-multi.patch @@ -0,0 +1,57 @@ +From d2b6f15bc18ac8fbce25398290774c21f5b2cd44 Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Sun, 21 Mar 2021 12:28:31 +0900 +Subject: [PATCH] ALSA: bebob: enable to deliver MIDI messages for multiple ports +Git-commit: d2b6f15bc18ac8fbce25398290774c21f5b2cd44 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Current implementation of bebob driver doesn't correctly handle the case +that the device has multiple MIDI ports. The cause is the number of MIDI +conformant data channels is passed to AM824 data block processing layer. + +This commit fixes the bug. + +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20210321032831.340278-4-o-takashi@sakamocchi.jp +Signed-off-by: Takashi Iwai + +--- + sound/firewire/bebob/bebob_stream.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/sound/firewire/bebob/bebob_stream.c b/sound/firewire/bebob/bebob_stream.c +index 23579a73e038..b612ee3e33b6 100644 +--- a/sound/firewire/bebob/bebob_stream.c ++++ b/sound/firewire/bebob/bebob_stream.c +@@ -517,20 +517,22 @@ int snd_bebob_stream_init_duplex(struct snd_bebob *bebob) + static int keep_resources(struct snd_bebob *bebob, struct amdtp_stream *stream, + unsigned int rate, unsigned int index) + { +- struct snd_bebob_stream_formation *formation; ++ unsigned int pcm_channels; ++ unsigned int midi_ports; + struct cmp_connection *conn; + int err; + + if (stream == &bebob->tx_stream) { +- formation = bebob->tx_stream_formations + index; ++ pcm_channels = bebob->tx_stream_formations[index].pcm; ++ midi_ports = bebob->midi_input_ports; + conn = &bebob->out_conn; + } else { +- formation = bebob->rx_stream_formations + index; ++ pcm_channels = bebob->rx_stream_formations[index].pcm; ++ midi_ports = bebob->midi_output_ports; + conn = &bebob->in_conn; + } + +- err = amdtp_am824_set_parameters(stream, rate, formation->pcm, +- formation->midi, false); ++ err = amdtp_am824_set_parameters(stream, rate, pcm_channels, midi_ports, false); + if (err < 0) + return err; + +-- +2.26.2 + diff --git a/patches.suse/ALSA-bebob-oxfw-fix-Kconfig-entry-for-Mackie-d.2-Pro.patch b/patches.suse/ALSA-bebob-oxfw-fix-Kconfig-entry-for-Mackie-d.2-Pro.patch new file mode 100644 index 0000000..94f56eb --- /dev/null +++ b/patches.suse/ALSA-bebob-oxfw-fix-Kconfig-entry-for-Mackie-d.2-Pro.patch @@ -0,0 +1,81 @@ +From 0edabdfe89581669609eaac5f6a8d0ae6fe95e7f Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Thu, 13 May 2021 21:56:49 +0900 +Subject: [PATCH] ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro +Git-commit: 0edabdfe89581669609eaac5f6a8d0ae6fe95e7f +Patch-mainline: v5.13-rc3 +References: git-fixes + +Mackie d.2 has an extension card for IEEE 1394 communication, which uses +BridgeCo DM1000 ASIC. On the other hand, Mackie d.4 Pro has built-in +function for IEEE 1394 communication by Oxford Semiconductor OXFW971, +according to schematic diagram available in Mackie website. Although I +misunderstood that Mackie d.2 Pro would be also a model with OXFW971, +it's wrong. Mackie d.2 Pro is a model which includes the extension card +as factory settings. + +This commit fixes entries in Kconfig and comment in ALSA OXFW driver. + +Cc: +Fixes: fd6f4b0dc167 ("ALSA: bebob: Add skelton for BeBoB based devices") +Fixes: ec4dba5053e1 ("ALSA: oxfw: Add support for Behringer/Mackie devices") +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20210513125652.110249-3-o-takashi@sakamocchi.jp +Signed-off-by: Takashi Iwai + +--- + sound/firewire/Kconfig | 4 ++-- + sound/firewire/bebob/bebob.c | 2 +- + sound/firewire/oxfw/oxfw.c | 1 - + 3 files changed, 3 insertions(+), 4 deletions(-) + +diff --git a/sound/firewire/Kconfig b/sound/firewire/Kconfig +index 25778765cbfe..9897bd26a438 100644 +--- a/sound/firewire/Kconfig ++++ b/sound/firewire/Kconfig +@@ -38,7 +38,7 @@ config SND_OXFW + * Mackie(Loud) Onyx 1640i (former model) + * Mackie(Loud) Onyx Satellite + * Mackie(Loud) Tapco Link.Firewire +- * Mackie(Loud) d.2 pro/d.4 pro ++ * Mackie(Loud) d.4 pro + * Mackie(Loud) U.420/U.420d + * TASCAM FireOne + * Stanton Controllers & Systems 1 Deck/Mixer +@@ -84,7 +84,7 @@ config SND_BEBOB + * PreSonus FIREBOX/FIREPOD/FP10/Inspire1394 + * BridgeCo RDAudio1/Audio5 + * Mackie Onyx 1220/1620/1640 (FireWire I/O Card) +- * Mackie d.2 (FireWire Option) ++ * Mackie d.2 (FireWire Option) and d.2 Pro + * Stanton FinalScratch 2 (ScratchAmp) + * Tascam IF-FW/DM + * Behringer XENIX UFX 1204/1604 +diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c +index 2c8e3392a490..daeecfa8b9aa 100644 +--- a/sound/firewire/bebob/bebob.c ++++ b/sound/firewire/bebob/bebob.c +@@ -387,7 +387,7 @@ static const struct ieee1394_device_id bebob_id_table[] = { + SND_BEBOB_DEV_ENTRY(VEN_BRIDGECO, 0x00010049, &spec_normal), + /* Mackie, Onyx 1220/1620/1640 (Firewire I/O Card) */ + SND_BEBOB_DEV_ENTRY(VEN_MACKIE2, 0x00010065, &spec_normal), +- /* Mackie, d.2 (Firewire Option) */ ++ // Mackie, d.2 (Firewire option card) and d.2 Pro (the card is built-in). + SND_BEBOB_DEV_ENTRY(VEN_MACKIE1, 0x00010067, &spec_normal), + /* Stanton, ScratchAmp */ + SND_BEBOB_DEV_ENTRY(VEN_STANTON, 0x00000001, &spec_normal), +diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c +index 1f1e3236efb8..9eea25c46dc7 100644 +--- a/sound/firewire/oxfw/oxfw.c ++++ b/sound/firewire/oxfw/oxfw.c +@@ -355,7 +355,6 @@ static const struct ieee1394_device_id oxfw_id_table[] = { + * Onyx-i series (former models): 0x081216 + * Mackie Onyx Satellite: 0x00200f + * Tapco LINK.firewire 4x6: 0x000460 +- * d.2 pro: Unknown + * d.4 pro: Unknown + * U.420: Unknown + * U.420d: Unknown +-- +2.26.2 + diff --git a/patches.suse/ALSA-dice-fix-stream-format-at-middle-sampling-rate-.patch b/patches.suse/ALSA-dice-fix-stream-format-at-middle-sampling-rate-.patch new file mode 100644 index 0000000..55dba65 --- /dev/null +++ b/patches.suse/ALSA-dice-fix-stream-format-at-middle-sampling-rate-.patch @@ -0,0 +1,43 @@ +From 1b6604896e78969baffc1b6cc6bc175f95929ac4 Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Thu, 13 May 2021 21:56:48 +0900 +Subject: [PATCH] ALSA: dice: fix stream format at middle sampling rate for Alesis iO 26 +Git-commit: 1b6604896e78969baffc1b6cc6bc175f95929ac4 +Patch-mainline: v5.13-rc3 +References: git-fixes + +Alesis iO 26 FireWire has two pairs of digital optical interface. It +delivers PCM frames from the interfaces by second isochronous packet +streaming. Although both of the interfaces are available at 44.1/48.0 +kHz, first one of them is only available at 88.2/96.0 kHz. It reduces +the number of PCM samples to 4 in Multi Bit Linear Audio data channel +of data blocks on the second isochronous packet streaming. + +This commit fixes hardcoded stream formats. + +Cc: +Fixes: 28b208f600a3 ("ALSA: dice: add parameters of stream formats for models produced by Alesis") +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20210513125652.110249-2-o-takashi@sakamocchi.jp +Signed-off-by: Takashi Iwai + +--- + sound/firewire/dice/dice-alesis.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/firewire/dice/dice-alesis.c b/sound/firewire/dice/dice-alesis.c +index 0916864511d5..27c13b9cc9ef 100644 +--- a/sound/firewire/dice/dice-alesis.c ++++ b/sound/firewire/dice/dice-alesis.c +@@ -16,7 +16,7 @@ alesis_io14_tx_pcm_chs[MAX_STREAMS][SND_DICE_RATE_MODE_COUNT] = { + static const unsigned int + alesis_io26_tx_pcm_chs[MAX_STREAMS][SND_DICE_RATE_MODE_COUNT] = { + {10, 10, 4}, /* Tx0 = Analog + S/PDIF. */ +- {16, 8, 0}, /* Tx1 = ADAT1 + ADAT2. */ ++ {16, 4, 0}, /* Tx1 = ADAT1 + ADAT2 (available at low rate). */ + }; + + int snd_dice_detect_alesis_formats(struct snd_dice *dice) +-- +2.26.2 + diff --git a/patches.suse/ALSA-dice-fix-stream-format-for-TC-Electronic-Konnek.patch b/patches.suse/ALSA-dice-fix-stream-format-for-TC-Electronic-Konnek.patch new file mode 100644 index 0000000..25e0c4c --- /dev/null +++ b/patches.suse/ALSA-dice-fix-stream-format-for-TC-Electronic-Konnek.patch @@ -0,0 +1,41 @@ +From 4c6fe8c547e3c9e8c15dabdd23c569ee0df3adb1 Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Tue, 18 May 2021 10:26:12 +0900 +Subject: [PATCH] ALSA: dice: fix stream format for TC Electronic Konnekt Live at high sampling transfer frequency +Git-commit: 4c6fe8c547e3c9e8c15dabdd23c569ee0df3adb1 +Patch-mainline: v5.13-rc3 +References: git-fixes + +At high sampling transfer frequency, TC Electronic Konnekt Live +transfers/receives 6 audio data frames in multi bit linear audio data +channel of data block in CIP payload. Current hard-coded stream format +is wrong. + +Cc: +Fixes: f1f0f330b1d0 ("ALSA: dice: add parameters of stream formats for models produced by TC Electronic") +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20210518012612.37268-1-o-takashi@sakamocchi.jp +Signed-off-by: Takashi Iwai + +--- + sound/firewire/dice/dice-tcelectronic.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/firewire/dice/dice-tcelectronic.c b/sound/firewire/dice/dice-tcelectronic.c +index a8875d24ba2a..43a3bcb15b3d 100644 +--- a/sound/firewire/dice/dice-tcelectronic.c ++++ b/sound/firewire/dice/dice-tcelectronic.c +@@ -38,8 +38,8 @@ static const struct dice_tc_spec konnekt_24d = { + }; + + static const struct dice_tc_spec konnekt_live = { +- .tx_pcm_chs = {{16, 16, 16}, {0, 0, 0} }, +- .rx_pcm_chs = {{16, 16, 16}, {0, 0, 0} }, ++ .tx_pcm_chs = {{16, 16, 6}, {0, 0, 0} }, ++ .rx_pcm_chs = {{16, 16, 6}, {0, 0, 0} }, + .has_midi = true, + }; + +-- +2.26.2 + diff --git a/patches.suse/ALSA-firewire-lib-fix-calculation-for-size-of-IR-con.patch b/patches.suse/ALSA-firewire-lib-fix-calculation-for-size-of-IR-con.patch new file mode 100644 index 0000000..660e7ad --- /dev/null +++ b/patches.suse/ALSA-firewire-lib-fix-calculation-for-size-of-IR-con.patch @@ -0,0 +1,54 @@ +From 1be4f21d9984fa9835fae5411a29465dc5aece6f Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Thu, 13 May 2021 21:56:51 +0900 +Subject: [PATCH] ALSA: firewire-lib: fix calculation for size of IR context payload +Git-commit: 1be4f21d9984fa9835fae5411a29465dc5aece6f +Patch-mainline: v5.13-rc3 +References: git-fixes + +The quadlets for CIP header is handled as a part of IR context header, +thus it doesn't join in IR context payload. However current calculation +includes the quadlets in IR context payload. + +Cc: +Fixes: f11453c7cc01 ("ALSA: firewire-lib: use 16 bytes IR context header to separate CIP header") +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20210513125652.110249-5-o-takashi@sakamocchi.jp +Signed-off-by: Takashi Iwai + +--- + sound/firewire/amdtp-stream.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +--- a/sound/firewire/amdtp-stream.c ++++ b/sound/firewire/amdtp-stream.c +@@ -889,23 +889,22 @@ int amdtp_stream_start(struct amdtp_stre + s->ctx_data.rx.last_syt_offset = TICKS_PER_CYCLE; + } + +- /* initialize packet buffer */ ++ // initialize packet buffer. ++ max_ctx_payload_size = amdtp_stream_get_max_payload(s); + if (s->direction == AMDTP_IN_STREAM) { + dir = DMA_FROM_DEVICE; + type = FW_ISO_CONTEXT_RECEIVE; +- if (!(s->flags & CIP_NO_HEADER)) ++ if (!(s->flags & CIP_NO_HEADER)) { ++ max_ctx_payload_size -= 8; + ctx_header_size = IR_CTX_HEADER_SIZE_CIP; +- else ++ } else { + ctx_header_size = IR_CTX_HEADER_SIZE_NO_CIP; +- +- max_ctx_payload_size = amdtp_stream_get_max_payload(s) - +- ctx_header_size; ++ } + } else { + dir = DMA_TO_DEVICE; + type = FW_ISO_CONTEXT_TRANSMIT; + ctx_header_size = 0; // No effect for IT context. + +- max_ctx_payload_size = amdtp_stream_get_max_payload(s); + if (!(s->flags & CIP_NO_HEADER)) + max_ctx_payload_size -= IT_PKT_HEADER_SIZE_CIP; + } diff --git a/patches.suse/ALSA-firewire-lib-fix-check-for-the-size-of-isochron.patch b/patches.suse/ALSA-firewire-lib-fix-check-for-the-size-of-isochron.patch new file mode 100644 index 0000000..659a745 --- /dev/null +++ b/patches.suse/ALSA-firewire-lib-fix-check-for-the-size-of-isochron.patch @@ -0,0 +1,52 @@ +From 395f41e2cdac63e7581fb9574e5ac0f02556e34a Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Thu, 13 May 2021 21:56:50 +0900 +Subject: [PATCH] ALSA: firewire-lib: fix check for the size of isochronous packet payload +Git-commit: 395f41e2cdac63e7581fb9574e5ac0f02556e34a +Patch-mainline: v5.13-rc3 +References: git-fixes + +The check for size of isochronous packet payload just cares of the size of +IR context payload without the size of CIP header. + +Cc: +Fixes: f11453c7cc01 ("ALSA: firewire-lib: use 16 bytes IR context header to separate CIP header") +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20210513125652.110249-4-o-takashi@sakamocchi.jp +Signed-off-by: Takashi Iwai + +--- + sound/firewire/amdtp-stream.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/sound/firewire/amdtp-stream.c ++++ b/sound/firewire/amdtp-stream.c +@@ -621,18 +621,24 @@ static int parse_ir_ctx_header(struct am + { + unsigned int dbc; + const __be32 *cip_header; ++ unsigned int cip_header_size; + int err; + + *payload_length = be32_to_cpu(ctx_header[0]) >> ISO_DATA_LENGTH_SHIFT; +- if (*payload_length > s->ctx_data.tx.ctx_header_size + +- s->ctx_data.tx.max_ctx_payload_length) { ++ ++ if (!(s->flags & CIP_NO_HEADER)) ++ cip_header_size = 8; ++ else ++ cip_header_size = 0; ++ ++ if (*payload_length > cip_header_size + s->ctx_data.tx.max_ctx_payload_length) { + dev_err(&s->unit->device, + "Detect jumbo payload: %04x %04x\n", +- *payload_length, s->ctx_data.tx.max_ctx_payload_length); ++ *payload_length, cip_header_size + s->ctx_data.tx.max_ctx_payload_length); + return -EIO; + } + +- if (!(s->flags & CIP_NO_HEADER)) { ++ if (cip_header_size > 0) { + cip_header = ctx_header + 2; + err = check_cip_header(s, cip_header, *payload_length, + data_blocks, &dbc, syt); diff --git a/patches.suse/ALSA-hda-conexant-Re-order-CX5066-quirk-table-entrie.patch b/patches.suse/ALSA-hda-conexant-Re-order-CX5066-quirk-table-entrie.patch new file mode 100644 index 0000000..9a3ff88 --- /dev/null +++ b/patches.suse/ALSA-hda-conexant-Re-order-CX5066-quirk-table-entrie.patch @@ -0,0 +1,50 @@ +From 2e6a731296be9d356fdccee9fb6ae345dad96438 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 28 Apr 2021 13:27:04 +0200 +Subject: [PATCH] ALSA: hda/conexant: Re-order CX5066 quirk table entries +Git-commit: 2e6a731296be9d356fdccee9fb6ae345dad96438 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Just re-order the cx5066_fixups[] entries for HP devices for avoiding +the oversight of the duplicated or unapplied item in future. +No functional changes. + +Also Cc-to-stable for the further patch applications. + +Cc: +Link: https://lore.kernel.org/r/20210428112704.23967-14-tiwai@suse.de +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_conexant.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -898,18 +898,18 @@ static const struct snd_pci_quirk cxt506 + SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK), + SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK), + SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK), +- SND_PCI_QUIRK(0x103c, 0x828c, "HP EliteBook 840 G4", CXT_FIXUP_HP_DOCK), +- SND_PCI_QUIRK(0x103c, 0x83b2, "HP EliteBook 840 G5", CXT_FIXUP_HP_DOCK), +- SND_PCI_QUIRK(0x103c, 0x83b3, "HP EliteBook 830 G5", CXT_FIXUP_HP_DOCK), +- SND_PCI_QUIRK(0x103c, 0x83d3, "HP ProBook 640 G4", CXT_FIXUP_HP_DOCK), +- SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE), + SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC), + SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO), ++ SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE), + SND_PCI_QUIRK(0x103c, 0x822e, "HP ProBook 440 G4", CXT_FIXUP_MUTE_LED_GPIO), +- SND_PCI_QUIRK(0x103c, 0x836e, "HP ProBook 455 G5", CXT_FIXUP_MUTE_LED_GPIO), +- SND_PCI_QUIRK(0x103c, 0x837f, "HP ProBook 470 G5", CXT_FIXUP_MUTE_LED_GPIO), ++ SND_PCI_QUIRK(0x103c, 0x828c, "HP EliteBook 840 G4", CXT_FIXUP_HP_DOCK), + SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x103c, 0x836e, "HP ProBook 455 G5", CXT_FIXUP_MUTE_LED_GPIO), ++ SND_PCI_QUIRK(0x103c, 0x837f, "HP ProBook 470 G5", CXT_FIXUP_MUTE_LED_GPIO), ++ SND_PCI_QUIRK(0x103c, 0x83b2, "HP EliteBook 840 G5", CXT_FIXUP_HP_DOCK), ++ SND_PCI_QUIRK(0x103c, 0x83b3, "HP EliteBook 830 G5", CXT_FIXUP_HP_DOCK), ++ SND_PCI_QUIRK(0x103c, 0x83d3, "HP ProBook 640 G4", CXT_FIXUP_HP_DOCK), + SND_PCI_QUIRK(0x103c, 0x8402, "HP ProBook 645 G4", CXT_FIXUP_MUTE_LED_GPIO), + SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x8456, "HP Z2 G4 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE), diff --git a/patches.suse/ALSA-hda-fixup-headset-for-ASUS-GU502-laptop.patch b/patches.suse/ALSA-hda-fixup-headset-for-ASUS-GU502-laptop.patch new file mode 100644 index 0000000..e108dde --- /dev/null +++ b/patches.suse/ALSA-hda-fixup-headset-for-ASUS-GU502-laptop.patch @@ -0,0 +1,113 @@ +From c1b55029493879f5bd585ff79f326e71f0bc05e3 Mon Sep 17 00:00:00 2001 +From: Daniel Cordova A +Date: Fri, 7 May 2021 12:31:16 -0500 +Subject: [PATCH] ALSA: hda: fixup headset for ASUS GU502 laptop +Git-commit: c1b55029493879f5bd585ff79f326e71f0bc05e3 +Patch-mainline: v5.13-rc3 +References: git-fixes + +The GU502 requires a few steps to make headset i/o works properly: +pincfg, verbs to unmute headphone out and callback to toggle output +between speakers and headphone using jack. + +Signed-off-by: Daniel Cordova A +Cc: +Link: https://lore.kernel.org/r/20210507173116.12043-1-danesc87@gmail.com +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_realtek.c | 62 ++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 62 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6171,6 +6171,35 @@ static void alc294_fixup_gx502_hp(struct + } + } + ++static void alc294_gu502_toggle_output(struct hda_codec *codec, ++ struct hda_jack_callback *cb) ++{ ++ /* Windows sets 0x10 to 0x8420 for Node 0x20 which is ++ * responsible from changes between speakers and headphones ++ */ ++ if (snd_hda_jack_detect_state(codec, 0x21) == HDA_JACK_PRESENT) ++ alc_write_coef_idx(codec, 0x10, 0x8420); ++ else ++ alc_write_coef_idx(codec, 0x10, 0x0a20); ++} ++ ++static void alc294_fixup_gu502_hp(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ if (!is_jack_detectable(codec, 0x21)) ++ return; ++ ++ switch (action) { ++ case HDA_FIXUP_ACT_PRE_PROBE: ++ snd_hda_jack_detect_enable_callback(codec, 0x21, ++ alc294_gu502_toggle_output); ++ break; ++ case HDA_FIXUP_ACT_INIT: ++ alc294_gu502_toggle_output(codec, NULL); ++ break; ++ } ++} ++ + static void alc285_fixup_hp_gpio_amp_init(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -6384,6 +6413,9 @@ enum { + ALC294_FIXUP_ASUS_GX502_HP, + ALC294_FIXUP_ASUS_GX502_PINS, + ALC294_FIXUP_ASUS_GX502_VERBS, ++ ALC294_FIXUP_ASUS_GU502_HP, ++ ALC294_FIXUP_ASUS_GU502_PINS, ++ ALC294_FIXUP_ASUS_GU502_VERBS, + ALC285_FIXUP_HP_GPIO_LED, + ALC285_FIXUP_HP_MUTE_LED, + ALC236_FIXUP_HP_MUTE_LED, +@@ -7614,6 +7646,35 @@ static const struct hda_fixup alc269_fix + .type = HDA_FIXUP_FUNC, + .v.func = alc294_fixup_gx502_hp, + }, ++ [ALC294_FIXUP_ASUS_GU502_PINS] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x01a11050 }, /* rear HP mic */ ++ { 0x1a, 0x01a11830 }, /* rear external mic */ ++ { 0x21, 0x012110f0 }, /* rear HP out */ ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC294_FIXUP_ASUS_GU502_VERBS ++ }, ++ [ALC294_FIXUP_ASUS_GU502_VERBS] = { ++ .type = HDA_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ /* set 0x15 to HP-OUT ctrl */ ++ { 0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, 0xc0 }, ++ /* unmute the 0x15 amp */ ++ { 0x15, AC_VERB_SET_AMP_GAIN_MUTE, 0xb000 }, ++ /* set 0x1b to HP-OUT */ ++ { 0x1b, AC_VERB_SET_PIN_WIDGET_CONTROL, 0x24 }, ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC294_FIXUP_ASUS_GU502_HP ++ }, ++ [ALC294_FIXUP_ASUS_GU502_HP] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc294_fixup_gu502_hp, ++ }, + [ALC294_FIXUP_ASUS_COEF_1B] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb[]) { +@@ -8100,6 +8161,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE), + SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502), ++ SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS), + SND_PCI_QUIRK(0x1043, 0x1e8e, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2), diff --git a/patches.suse/ALSA-hda-realtek-Add-some-CLOVE-SSIDs-of-ALC293.patch b/patches.suse/ALSA-hda-realtek-Add-some-CLOVE-SSIDs-of-ALC293.patch new file mode 100644 index 0000000..823cb9d --- /dev/null +++ b/patches.suse/ALSA-hda-realtek-Add-some-CLOVE-SSIDs-of-ALC293.patch @@ -0,0 +1,64 @@ +From 1d5cfca286178ce81fb0c8a5f5777ef123cd69e4 Mon Sep 17 00:00:00 2001 +From: PeiSen Hou +Date: Fri, 14 May 2021 12:50:48 +0200 +Subject: [PATCH] ALSA: hda/realtek: Add some CLOVE SSIDs of ALC293 +Git-commit: 1d5cfca286178ce81fb0c8a5f5777ef123cd69e4 +Patch-mainline: v5.13-rc3 +References: git-fixes + +Fix "use as headset mic, without its own jack detect" problen. + +Signed-off-by: PeiSen Hou +Cc: +Link: https://lore.kernel.org/r/d0746eaf29f248a5acc30313e3ba4f99@realtek.com +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_realtek.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 3e269de84079..552e2cb73291 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8385,12 +8385,19 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1558, 0x50b8, "Clevo NK50SZ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x50d5, "Clevo NP50D5", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x50f0, "Clevo NH50A[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x50f2, "Clevo NH50E[PR]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x50f3, "Clevo NH58DPQ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x50f5, "Clevo NH55EPY", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x50f6, "Clevo NH55DPQ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x5101, "Clevo S510WU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x5157, "Clevo W517GU1", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x51a1, "Clevo NS50MU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x70a1, "Clevo NB70T[HJK]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x70b3, "Clevo NK70SB", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x70f2, "Clevo NH79EPY", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x70f3, "Clevo NH77DPQ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x70f4, "Clevo NH77EPY", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x70f6, "Clevo NH77DPQ-Y", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8228, "Clevo NR40BU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8520, "Clevo NH50D[CD]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8521, "Clevo NH77D[CD]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), +@@ -8408,9 +8415,17 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1558, 0x8a51, "Clevo NH70RCQ-Y", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8d50, "Clevo NH55RCQ-M", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x951d, "Clevo N950T[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x9600, "Clevo N960K[PR]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x961d, "Clevo N960S[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x971d, "Clevo N970T[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0xa500, "Clevo NL53RU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xa600, "Clevo NL5XNU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xb018, "Clevo NP50D[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xb019, "Clevo NH77D[BE]Q", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xb022, "Clevo NH77D[DC][QW]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xc018, "Clevo NP50D[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xc019, "Clevo NH77D[BE]Q", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xc022, "Clevo NH77[DC][QW]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC233_FIXUP_LENOVO_MULTI_CODECS), + SND_PCI_QUIRK(0x17aa, 0x1048, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE), +-- +2.26.2 + diff --git a/patches.suse/ALSA-hda-realtek-Headphone-volume-is-controlled-by-F.patch b/patches.suse/ALSA-hda-realtek-Headphone-volume-is-controlled-by-F.patch new file mode 100644 index 0000000..1abcedf --- /dev/null +++ b/patches.suse/ALSA-hda-realtek-Headphone-volume-is-controlled-by-F.patch @@ -0,0 +1,74 @@ +From 119b75c150773425a89033215eab4d15d4198f8b Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Sat, 22 May 2021 11:47:41 +0800 +Subject: [PATCH] ALSA: hda/realtek: Headphone volume is controlled by Front mixer +Git-commit: 119b75c150773425a89033215eab4d15d4198f8b +Patch-mainline: v5.13-rc4 +References: git-fixes + +On some ASUS and MSI machines, the audio codec is alc1220 and the +Headphone is connected to audio mixer 0xf and DAC 0x5, in theory +the Headphone volume is controlled by DAC 0x5 (Heapdhone Playback +Volume), but somehow it is controlled by DAC 0x2 (Front Playback +Volume), maybe this is a defect on the codec alc1220. + +Because of this issue, the PA couldn't switch the headphone and +Lineout correctly, If we apply the quirk CLEVO_P950 to those machines, +the Lineout and Headphone will share the audio mixer 0xc and DAC 0x2, +and generate Headphone+LO mixer, then PA could handle them when +switching between them. + +Buglink: https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/1206 +Cc: +Signed-off-by: Hui Wang +Link: https://lore.kernel.org/r/20210522034741.13415-1-hui.wang@canonical.com +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_realtek.c | 23 +++++++++++++++++++++++ + 1 file changed, 23 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 552e2cb73291..ffaeb8d3c316 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -2603,6 +2603,28 @@ static const struct hda_model_fixup alc882_fixup_models[] = { + {} + }; + ++static const struct snd_hda_pin_quirk alc882_pin_fixup_tbl[] = { ++ SND_HDA_PIN_QUIRK(0x10ec1220, 0x1043, "ASUS", ALC1220_FIXUP_CLEVO_P950, ++ {0x14, 0x01014010}, ++ {0x15, 0x01011012}, ++ {0x16, 0x01016011}, ++ {0x18, 0x01a19040}, ++ {0x19, 0x02a19050}, ++ {0x1a, 0x0181304f}, ++ {0x1b, 0x0221401f}, ++ {0x1e, 0x01456130}), ++ SND_HDA_PIN_QUIRK(0x10ec1220, 0x1462, "MS-7C35", ALC1220_FIXUP_CLEVO_P950, ++ {0x14, 0x01015010}, ++ {0x15, 0x01011012}, ++ {0x16, 0x01011011}, ++ {0x18, 0x01a11040}, ++ {0x19, 0x02a19050}, ++ {0x1a, 0x0181104f}, ++ {0x1b, 0x0221401f}, ++ {0x1e, 0x01451130}), ++ {} ++}; ++ + /* + * BIOS auto configuration + */ +@@ -2644,6 +2666,7 @@ static int patch_alc882(struct hda_codec *codec) + + snd_hda_pick_fixup(codec, alc882_fixup_models, alc882_fixup_tbl, + alc882_fixups); ++ snd_hda_pick_pin_fixup(codec, alc882_pin_fixup_tbl, alc882_fixups, true); + snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_PRE_PROBE); + + alc_auto_parse_customize_define(codec); +-- +2.26.2 + diff --git a/patches.suse/ALSA-hda-realtek-reset-eapd-coeff-to-default-value-f.patch b/patches.suse/ALSA-hda-realtek-reset-eapd-coeff-to-default-value-f.patch new file mode 100644 index 0000000..db90303 --- /dev/null +++ b/patches.suse/ALSA-hda-realtek-reset-eapd-coeff-to-default-value-f.patch @@ -0,0 +1,57 @@ +From 8822702f6e4c8917c83ba79e0ebf2c8c218910d4 Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Fri, 7 May 2021 10:44:52 +0800 +Subject: [PATCH] ALSA: hda/realtek: reset eapd coeff to default value for alc287 +Git-commit: 8822702f6e4c8917c83ba79e0ebf2c8c218910d4 +Patch-mainline: v5.13-rc3 +References: git-fixes + +Ubuntu users reported an audio bug on the Lenovo Yoga Slim 7 14IIL05, +he installed dual OS (Windows + Linux), if he booted to the Linux +from Windows, the Speaker can't work well, it has crackling noise, +if he poweroff the machine first after Windows, the Speaker worked +well. + +Before rebooting or shutdown from Windows, the Windows changes the +codec eapd coeff value, but the BIOS doesn't re-initialize its value, +when booting into the Linux from Windows, the eapd coeff value is not +correct. To fix it, set the codec default value to that coeff register +in the alsa driver. + +Buglink: http://bugs.launchpad.net/bugs/1925057 +Suggested-by: Kailang Yang +Cc: +Signed-off-by: Hui Wang +Link: https://lore.kernel.org/r/20210507024452.8300-1-hui.wang@canonical.com +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_realtek.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 6d58f24c9702..a5f3e78ec04e 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -395,7 +395,6 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + case 0x10ec0282: + case 0x10ec0283: + case 0x10ec0286: +- case 0x10ec0287: + case 0x10ec0288: + case 0x10ec0285: + case 0x10ec0298: +@@ -406,6 +405,10 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + case 0x10ec0275: + alc_update_coef_idx(codec, 0xe, 0, 1<<0); + break; ++ case 0x10ec0287: ++ alc_update_coef_idx(codec, 0x10, 1<<9, 0); ++ alc_write_coef_idx(codec, 0x8, 0x4ab7); ++ break; + case 0x10ec0293: + alc_update_coef_idx(codec, 0xa, 1<<13, 0); + break; +-- +2.26.2 + diff --git a/patches.suse/ALSA-hdsp-don-t-disable-if-not-enabled.patch b/patches.suse/ALSA-hdsp-don-t-disable-if-not-enabled.patch new file mode 100644 index 0000000..1008ec9 --- /dev/null +++ b/patches.suse/ALSA-hdsp-don-t-disable-if-not-enabled.patch @@ -0,0 +1,48 @@ +From 507cdb9adba006a7798c358456426e1aea3d9c4f Mon Sep 17 00:00:00 2001 +From: Tong Zhang +Date: Sun, 21 Mar 2021 11:38:38 -0400 +Subject: [PATCH] ALSA: hdsp: don't disable if not enabled +Git-commit: 507cdb9adba006a7798c358456426e1aea3d9c4f +Patch-mainline: v5.13-rc1 +References: git-fixes + +hdsp wants to disable a not enabled pci device, which makes kernel +throw a warning. Make sure the device is enabled before calling disable. + +[ 1.758292] snd_hdsp 0000:00:03.0: disabling already-disabled device +[ 1.758327] WARNING: CPU: 0 PID: 180 at drivers/pci/pci.c:2146 pci_disable_device+0x91/0xb0 +[ 1.766985] Call Trace: +[ 1.767121] snd_hdsp_card_free+0x94/0xf0 [snd_hdsp] +[ 1.767388] release_card_device+0x4b/0x80 [snd] +[ 1.767639] device_release+0x3b/0xa0 +[ 1.767838] kobject_put+0x94/0x1b0 +[ 1.768027] put_device+0x13/0x20 +[ 1.768207] snd_card_free+0x61/0x90 [snd] +[ 1.768430] snd_hdsp_probe+0x524/0x5e0 [snd_hdsp] + +Suggested-by: Takashi Iwai +Signed-off-by: Tong Zhang +Link: https://lore.kernel.org/r/20210321153840.378226-2-ztong0001@gmail.com +Signed-off-by: Takashi Iwai + +--- + sound/pci/rme9652/hdsp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/rme9652/hdsp.c b/sound/pci/rme9652/hdsp.c +index 6d9029333a12..ab9a32a2f5bb 100644 +--- a/sound/pci/rme9652/hdsp.c ++++ b/sound/pci/rme9652/hdsp.c +@@ -5393,7 +5393,8 @@ static int snd_hdsp_free(struct hdsp *hdsp) + if (hdsp->port) + pci_release_regions(hdsp->pci); + +- pci_disable_device(hdsp->pci); ++ if (pci_is_enabled(hdsp->pci)) ++ pci_disable_device(hdsp->pci); + return 0; + } + +-- +2.26.2 + diff --git a/patches.suse/ALSA-hdspm-don-t-disable-if-not-enabled.patch b/patches.suse/ALSA-hdspm-don-t-disable-if-not-enabled.patch new file mode 100644 index 0000000..ff7e23f --- /dev/null +++ b/patches.suse/ALSA-hdspm-don-t-disable-if-not-enabled.patch @@ -0,0 +1,48 @@ +From 790f5719b85e12e10c41753b864e74249585ed08 Mon Sep 17 00:00:00 2001 +From: Tong Zhang +Date: Sun, 21 Mar 2021 11:38:39 -0400 +Subject: [PATCH] ALSA: hdspm: don't disable if not enabled +Git-commit: 790f5719b85e12e10c41753b864e74249585ed08 +Patch-mainline: v5.13-rc1 +References: git-fixes + +hdspm wants to disable a not enabled pci device, which makes kernel +throw a warning. Make sure the device is enabled before calling disable. + +[ 1.786391] snd_hdspm 0000:00:03.0: disabling already-disabled device +[ 1.786400] WARNING: CPU: 0 PID: 182 at drivers/pci/pci.c:2146 pci_disable_device+0x91/0xb0 +[ 1.795181] Call Trace: +[ 1.795320] snd_hdspm_card_free+0x58/0xa0 [snd_hdspm] +[ 1.795595] release_card_device+0x4b/0x80 [snd] +[ 1.795860] device_release+0x3b/0xa0 +[ 1.796072] kobject_put+0x94/0x1b0 +[ 1.796260] put_device+0x13/0x20 +[ 1.796438] snd_card_free+0x61/0x90 [snd] +[ 1.796659] snd_hdspm_probe+0x97b/0x1440 [snd_hdspm] + +Suggested-by: Takashi Iwai +Signed-off-by: Tong Zhang +Link: https://lore.kernel.org/r/20210321153840.378226-3-ztong0001@gmail.com +Signed-off-by: Takashi Iwai + +--- + sound/pci/rme9652/hdspm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c +index b66711574b1a..6edc31b44b22 100644 +--- a/sound/pci/rme9652/hdspm.c ++++ b/sound/pci/rme9652/hdspm.c +@@ -6884,7 +6884,8 @@ static int snd_hdspm_free(struct hdspm * hdspm) + if (hdspm->port) + pci_release_regions(hdspm->pci); + +- pci_disable_device(hdspm->pci); ++ if (pci_is_enabled(hdspm->pci)) ++ pci_disable_device(hdspm->pci); + return 0; + } + +-- +2.26.2 + diff --git a/patches.suse/ALSA-intel8x0-Don-t-update-period-unless-prepared.patch b/patches.suse/ALSA-intel8x0-Don-t-update-period-unless-prepared.patch new file mode 100644 index 0000000..1585a0b --- /dev/null +++ b/patches.suse/ALSA-intel8x0-Don-t-update-period-unless-prepared.patch @@ -0,0 +1,71 @@ +From c1f0616124c455c5c762b6f123e40bba5df759e6 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sun, 16 May 2021 18:17:55 +0200 +Subject: [PATCH] ALSA: intel8x0: Don't update period unless prepared +Git-commit: c1f0616124c455c5c762b6f123e40bba5df759e6 +Patch-mainline: v5.13-rc3 +References: git-fixes + +The interrupt handler of intel8x0 calls snd_intel8x0_update() whenever +the hardware sets the corresponding status bit for each stream. This +works fine for most cases as long as the hardware behaves properly. +But when the hardware gives a wrong bit set, this leads to a zero- +division Oops, and reportedly, this seems what happened on a VM. + +For fixing the crash, this patch adds a internal flag indicating that +the stream is ready to be updated, and check it (as well as the flag +being in suspended) to ignore such spurious update. + +Cc: +Reported-and-tested-by: Sergey Senozhatsky +Link: https://lore.kernel.org/r/s5h5yzi7uh0.wl-tiwai@suse.de +Signed-off-by: Takashi Iwai + +--- + sound/pci/intel8x0.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/sound/pci/intel8x0.c ++++ b/sound/pci/intel8x0.c +@@ -354,6 +354,7 @@ struct ichdev { + unsigned int ali_slot; /* ALI DMA slot */ + struct ac97_pcm *pcm; + int pcm_open_flag; ++ unsigned int prepared:1; + unsigned int suspended: 1; + }; + +@@ -714,6 +715,9 @@ static inline void snd_intel8x0_update(s + int status, civ, i, step; + int ack = 0; + ++ if (!ichdev->prepared || ichdev->suspended) ++ return; ++ + spin_lock_irqsave(&chip->reg_lock, flags); + status = igetbyte(chip, port + ichdev->roff_sr); + civ = igetbyte(chip, port + ICH_REG_OFF_CIV); +@@ -907,6 +911,7 @@ static int snd_intel8x0_hw_params(struct + if (ichdev->pcm_open_flag) { + snd_ac97_pcm_close(ichdev->pcm); + ichdev->pcm_open_flag = 0; ++ ichdev->prepared = 0; + } + err = snd_ac97_pcm_open(ichdev->pcm, params_rate(hw_params), + params_channels(hw_params), +@@ -928,6 +933,7 @@ static int snd_intel8x0_hw_free(struct s + if (ichdev->pcm_open_flag) { + snd_ac97_pcm_close(ichdev->pcm); + ichdev->pcm_open_flag = 0; ++ ichdev->prepared = 0; + } + return snd_pcm_lib_free_pages(substream); + } +@@ -1002,6 +1008,7 @@ static int snd_intel8x0_pcm_prepare(stru + ichdev->pos_shift = (runtime->sample_bits > 16) ? 2 : 1; + } + snd_intel8x0_setup_periods(chip, ichdev); ++ ichdev->prepared = 1; + return 0; + } + diff --git a/patches.suse/ALSA-line6-Fix-racy-initialization-of-LINE6-MIDI.patch b/patches.suse/ALSA-line6-Fix-racy-initialization-of-LINE6-MIDI.patch new file mode 100644 index 0000000..a3890db --- /dev/null +++ b/patches.suse/ALSA-line6-Fix-racy-initialization-of-LINE6-MIDI.patch @@ -0,0 +1,93 @@ +From 05ca447630334c323c9e2b788b61133ab75d60d3 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 18 May 2021 10:39:39 +0200 +Subject: [PATCH] ALSA: line6: Fix racy initialization of LINE6 MIDI +Git-commit: 05ca447630334c323c9e2b788b61133ab75d60d3 +Patch-mainline: v5.13-rc3 +References: git-fixes + +The initialization of MIDI devices that are found on some LINE6 +drivers are currently done in a racy way; namely, the MIDI buffer +instance is allocated and initialized in each private_init callback +while the communication with the interface is already started via +line6_init_cap_control() call before that point. This may lead to +Oops in line6_data_received() when a spurious event is received, as +reported by syzkaller. + +This patch moves the MIDI initialization to line6_init_cap_control() +as well instead of the too-lately-called private_init for avoiding the +race. Also this reduces slightly more lines, so it's a win-win +change. + +Reported-by: syzbot+0d2b3feb0a2887862e06@syzkallerlkml..appspotmail.com +Link: https://lore.kernel.org/r/000000000000a4be9405c28520de@google.com +Link: https://lore.kernel.org/r/20210517132725.GA50495@hyeyoo +Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> +Cc: +Link: https://lore.kernel.org/r/20210518083939.1927-1-tiwai@suse.de +Signed-off-by: Takashi Iwai + +--- + sound/usb/line6/driver.c | 4 ++++ + sound/usb/line6/pod.c | 5 ----- + sound/usb/line6/variax.c | 6 ------ + 3 files changed, 4 insertions(+), 11 deletions(-) + +diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c +index a030dd65eb28..9602929b7de9 100644 +--- a/sound/usb/line6/driver.c ++++ b/sound/usb/line6/driver.c +@@ -699,6 +699,10 @@ static int line6_init_cap_control(struct usb_line6 *line6) + line6->buffer_message = kmalloc(LINE6_MIDI_MESSAGE_MAXLEN, GFP_KERNEL); + if (!line6->buffer_message) + return -ENOMEM; ++ ++ ret = line6_init_midi(line6); ++ if (ret < 0) ++ return ret; + } else { + ret = line6_hwdep_init(line6); + if (ret < 0) +diff --git a/sound/usb/line6/pod.c b/sound/usb/line6/pod.c +index cd44cb5f1310..16e644330c4d 100644 +--- a/sound/usb/line6/pod.c ++++ b/sound/usb/line6/pod.c +@@ -376,11 +376,6 @@ static int pod_init(struct usb_line6 *line6, + if (err < 0) + return err; + +- /* initialize MIDI subsystem: */ +- err = line6_init_midi(line6); +- if (err < 0) +- return err; +- + /* initialize PCM subsystem: */ + err = line6_init_pcm(line6, &pod_pcm_properties); + if (err < 0) +diff --git a/sound/usb/line6/variax.c b/sound/usb/line6/variax.c +index ed158f04de80..c2245aa93b08 100644 +--- a/sound/usb/line6/variax.c ++++ b/sound/usb/line6/variax.c +@@ -159,7 +159,6 @@ static int variax_init(struct usb_line6 *line6, + const struct usb_device_id *id) + { + struct usb_line6_variax *variax = line6_to_variax(line6); +- int err; + + line6->process_message = line6_variax_process_message; + line6->disconnect = line6_variax_disconnect; +@@ -172,11 +171,6 @@ static int variax_init(struct usb_line6 *line6, + if (variax->buffer_activate == NULL) + return -ENOMEM; + +- /* initialize MIDI subsystem: */ +- err = line6_init_midi(&variax->line6); +- if (err < 0) +- return err; +- + /* initiate startup procedure: */ + schedule_delayed_work(&line6->startup_work, + msecs_to_jiffies(VARIAX_STARTUP_DELAY1)); +-- +2.26.2 + diff --git a/patches.suse/ALSA-rme9652-don-t-disable-if-not-enabled.patch b/patches.suse/ALSA-rme9652-don-t-disable-if-not-enabled.patch new file mode 100644 index 0000000..dff601d --- /dev/null +++ b/patches.suse/ALSA-rme9652-don-t-disable-if-not-enabled.patch @@ -0,0 +1,48 @@ +From f57a741874bb6995089020e97a1dcdf9b165dcbe Mon Sep 17 00:00:00 2001 +From: Tong Zhang +Date: Sun, 21 Mar 2021 11:38:40 -0400 +Subject: [PATCH] ALSA: rme9652: don't disable if not enabled +Git-commit: f57a741874bb6995089020e97a1dcdf9b165dcbe +Patch-mainline: v5.13-rc1 +References: git-fixes + +rme9652 wants to disable a not enabled pci device, which makes kernel +throw a warning. Make sure the device is enabled before calling disable. + +[ 1.751595] snd_rme9652 0000:00:03.0: disabling already-disabled device +[ 1.751605] WARNING: CPU: 0 PID: 174 at drivers/pci/pci.c:2146 pci_disable_device+0x91/0xb0 +[ 1.759968] Call Trace: +[ 1.760145] snd_rme9652_card_free+0x76/0xa0 [snd_rme9652] +[ 1.760434] release_card_device+0x4b/0x80 [snd] +[ 1.760679] device_release+0x3b/0xa0 +[ 1.760874] kobject_put+0x94/0x1b0 +[ 1.761059] put_device+0x13/0x20 +[ 1.761235] snd_card_free+0x61/0x90 [snd] +[ 1.761454] snd_rme9652_probe+0x3be/0x700 [snd_rme9652] + +Suggested-by: Takashi Iwai +Signed-off-by: Tong Zhang +Link: https://lore.kernel.org/r/20210321153840.378226-4-ztong0001@gmail.com +Signed-off-by: Takashi Iwai + +--- + sound/pci/rme9652/rme9652.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/rme9652/rme9652.c b/sound/pci/rme9652/rme9652.c +index 012fbec5e6a7..0f4ab86a29f6 100644 +--- a/sound/pci/rme9652/rme9652.c ++++ b/sound/pci/rme9652/rme9652.c +@@ -1733,7 +1733,8 @@ static int snd_rme9652_free(struct snd_rme9652 *rme9652) + if (rme9652->port) + pci_release_regions(rme9652->pci); + +- pci_disable_device(rme9652->pci); ++ if (pci_is_enabled(rme9652->pci)) ++ pci_disable_device(rme9652->pci); + return 0; + } + +-- +2.26.2 + diff --git a/patches.suse/ALSA-usb-audio-Validate-MS-endpoint-descriptors.patch b/patches.suse/ALSA-usb-audio-Validate-MS-endpoint-descriptors.patch new file mode 100644 index 0000000..fa770e0 --- /dev/null +++ b/patches.suse/ALSA-usb-audio-Validate-MS-endpoint-descriptors.patch @@ -0,0 +1,41 @@ +From e84749a78dc82bc545f12ce009e3dbcc2c5a8a91 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 10 May 2021 17:06:59 +0200 +Subject: [PATCH] ALSA: usb-audio: Validate MS endpoint descriptors +Git-commit: e84749a78dc82bc545f12ce009e3dbcc2c5a8a91 +Patch-mainline: v5.13-rc3 +References: git-fixes + +snd_usbmidi_get_ms_info() may access beyond the border when a +malformed descriptor is passed. This patch adds the sanity checks of +the given MS endpoint descriptors, and skips invalid ones. + +Reported-by: syzbot+6bb23a5d5548b93c94aa@syzkaller.appspotmail.com +Cc: +Link: https://lore.kernel.org/r/20210510150659.17710-1-tiwai@suse.de +Signed-off-by: Takashi Iwai + +--- + sound/usb/midi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/usb/midi.c b/sound/usb/midi.c +index a10ac75969a8..649eb8d1ab7d 100644 +--- a/sound/usb/midi.c ++++ b/sound/usb/midi.c +@@ -1956,8 +1956,12 @@ static int snd_usbmidi_get_ms_info(struct snd_usb_midi *umidi, + ms_ep = find_usb_ms_endpoint_descriptor(hostep); + if (!ms_ep) + continue; ++ if (ms_ep->bLength <= sizeof(*ms_ep)) ++ continue; + if (ms_ep->bNumEmbMIDIJack > 0x10) + continue; ++ if (ms_ep->bLength < sizeof(*ms_ep) + ms_ep->bNumEmbMIDIJack) ++ continue; + if (usb_endpoint_dir_out(ep)) { + if (endpoints[epidx].out_ep) { + if (++epidx >= MIDI_MAX_ENDPOINTS) { +-- +2.26.2 + diff --git a/patches.suse/ALSA-usb-audio-fix-control-request-direction.patch b/patches.suse/ALSA-usb-audio-fix-control-request-direction.patch new file mode 100644 index 0000000..a451a19 --- /dev/null +++ b/patches.suse/ALSA-usb-audio-fix-control-request-direction.patch @@ -0,0 +1,40 @@ +From 51cb8e206afd463e66f16869e5ddc95bef107142 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 21 May 2021 15:37:42 +0200 +Subject: [PATCH] ALSA: usb-audio: fix control-request direction +Git-commit: 51cb8e206afd463e66f16869e5ddc95bef107142 +Patch-mainline: v5.13-rc4 +References: git-fixes + +The direction of the pipe argument must match the request-type direction +bit or control requests may fail depending on the host-controller-driver +implementation. + +Fix the UAC2_CS_CUR request which erroneously used usb_sndctrlpipe(). + +Fixes: 93db51d06b32 ("ALSA: usb-audio: Check valid altsetting at parsing rates for UAC2/3") +Cc: stable@vger.kernel.org # 5.10 +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210521133742.18098-1-johan@kernel.org +Signed-off-by: Takashi Iwai + +--- + sound/usb/format.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/usb/format.c b/sound/usb/format.c +index e6ff317a6785..2287f8c65315 100644 +--- a/sound/usb/format.c ++++ b/sound/usb/format.c +@@ -436,7 +436,7 @@ static bool check_valid_altsetting_v2v3(struct snd_usb_audio *chip, int iface, + if (snd_BUG_ON(altsetting >= 64 - 8)) + return false; + +- err = snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0), UAC2_CS_CUR, ++ err = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0), UAC2_CS_CUR, + USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_IN, + UAC2_AS_VAL_ALT_SETTINGS << 8, + iface, &raw_data, sizeof(raw_data)); +-- +2.26.2 + diff --git a/patches.suse/ALSA-usb-audio-scarlett2-Fix-device-hang-with-ehci-p.patch b/patches.suse/ALSA-usb-audio-scarlett2-Fix-device-hang-with-ehci-p.patch new file mode 100644 index 0000000..1857101 --- /dev/null +++ b/patches.suse/ALSA-usb-audio-scarlett2-Fix-device-hang-with-ehci-p.patch @@ -0,0 +1,38 @@ +From 764fa6e686e0107c0357a988d193de04cf047583 Mon Sep 17 00:00:00 2001 +From: "Geoffrey D. Bennett" +Date: Fri, 21 May 2021 17:50:12 +0930 +Subject: [PATCH] ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci +Git-commit: 764fa6e686e0107c0357a988d193de04cf047583 +Patch-mainline: v5.13-rc4 +References: git-fixes + +Use usb_rcvctrlpipe() not usb_sndctrlpipe() for USB control input in +the Scarlett Gen 2 mixer driver. This fixes the device hang during +initialisation when used with the ehci-pci host driver. + +Fixes: 9e4d5c1be21f ("ALSA: usb-audio: Scarlett Gen 2 mixer interface") +Signed-off-by: Geoffrey D. Bennett +Cc: +Link: https://lore.kernel.org/r/66a3d05dac325d5b53e4930578e143cef1f50dbe.1621584566.git.g@b4.vu +Signed-off-by: Takashi Iwai + +--- + sound/usb/mixer_scarlett_gen2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c +index 560c2ade829d..dcff3e3a49f3 100644 +--- a/sound/usb/mixer_scarlett_gen2.c ++++ b/sound/usb/mixer_scarlett_gen2.c +@@ -635,7 +635,7 @@ static int scarlett2_usb( + /* send a second message to get the response */ + + err = snd_usb_ctl_msg(mixer->chip->dev, +- usb_sndctrlpipe(mixer->chip->dev, 0), ++ usb_rcvctrlpipe(mixer->chip->dev, 0), + SCARLETT2_USB_VENDOR_SPECIFIC_CMD_RESP, + USB_RECIP_INTERFACE | USB_TYPE_CLASS | USB_DIR_IN, + 0, +-- +2.26.2 + diff --git a/patches.suse/ALSA-usb-audio-scarlett2-Improve-driver-startup-mess.patch b/patches.suse/ALSA-usb-audio-scarlett2-Improve-driver-startup-mess.patch new file mode 100644 index 0000000..2391240 --- /dev/null +++ b/patches.suse/ALSA-usb-audio-scarlett2-Improve-driver-startup-mess.patch @@ -0,0 +1,153 @@ +From 265d1a90e4fb6d3264d8122fbd10760e5e733be6 Mon Sep 17 00:00:00 2001 +From: "Geoffrey D. Bennett" +Date: Fri, 21 May 2021 17:50:13 +0930 +Subject: [PATCH] ALSA: usb-audio: scarlett2: Improve driver startup messages +Git-commit: 265d1a90e4fb6d3264d8122fbd10760e5e733be6 +Patch-mainline: v5.13-rc4 +References: git-fixes + +Add separate init function to call the existing controls_create +function so a custom error can be displayed if initialisation fails. + +Use info level instead of error for notifications. + +Display the VID/PID so device_setup is targeted to the right device. + +Display "enabled" message to easily confirm that the driver is loaded. + +Signed-off-by: Geoffrey D. Bennett +Cc: +Link: https://lore.kernel.org/r/b5d140c65f640faf2427e085fbbc0297b32e5fce.1621584566.git.g@b4.vu +Signed-off-by: Takashi Iwai + +--- + sound/usb/mixer_quirks.c | 2 +- + sound/usb/mixer_scarlett_gen2.c | 79 +++++++++++++++++++++------------ + sound/usb/mixer_scarlett_gen2.h | 2 +- + 3 files changed, 52 insertions(+), 31 deletions(-) + +diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c +index fda66b2dbb01..37ad77524c0b 100644 +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -3060,7 +3060,7 @@ int snd_usb_mixer_apply_create_quirk(struct usb_mixer_interface *mixer) + case USB_ID(0x1235, 0x8203): /* Focusrite Scarlett 6i6 2nd Gen */ + case USB_ID(0x1235, 0x8204): /* Focusrite Scarlett 18i8 2nd Gen */ + case USB_ID(0x1235, 0x8201): /* Focusrite Scarlett 18i20 2nd Gen */ +- err = snd_scarlett_gen2_controls_create(mixer); ++ err = snd_scarlett_gen2_init(mixer); + break; + + case USB_ID(0x041e, 0x323b): /* Creative Sound Blaster E1 */ +diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c +index dcff3e3a49f3..3ad8f61a2095 100644 +--- a/sound/usb/mixer_scarlett_gen2.c ++++ b/sound/usb/mixer_scarlett_gen2.c +@@ -1997,38 +1997,11 @@ static int scarlett2_mixer_status_create(struct usb_mixer_interface *mixer) + return usb_submit_urb(mixer->urb, GFP_KERNEL); + } + +-/* Entry point */ +-int snd_scarlett_gen2_controls_create(struct usb_mixer_interface *mixer) ++int snd_scarlett_gen2_controls_create(struct usb_mixer_interface *mixer, ++ const struct scarlett2_device_info *info) + { +- const struct scarlett2_device_info *info; + int err; + +- /* only use UAC_VERSION_2 */ +- if (!mixer->protocol) +- return 0; +- +- switch (mixer->chip->usb_id) { +- case USB_ID(0x1235, 0x8203): +- info = &s6i6_gen2_info; +- break; +- case USB_ID(0x1235, 0x8204): +- info = &s18i8_gen2_info; +- break; +- case USB_ID(0x1235, 0x8201): +- info = &s18i20_gen2_info; +- break; +- default: /* device not (yet) supported */ +- return -EINVAL; +- } +- +- if (!(mixer->chip->setup & SCARLETT2_ENABLE)) { +- usb_audio_err(mixer->chip, +- "Focusrite Scarlett Gen 2 Mixer Driver disabled; " +- "use options snd_usb_audio device_setup=1 " +- "to enable and report any issues to g@b4.vu"); +- return 0; +- } +- + /* Initialise private data, routing, sequence number */ + err = scarlett2_init_private(mixer, info); + if (err < 0) +@@ -2073,3 +2046,51 @@ int snd_scarlett_gen2_controls_create(struct usb_mixer_interface *mixer) + + return 0; + } ++ ++int snd_scarlett_gen2_init(struct usb_mixer_interface *mixer) ++{ ++ struct snd_usb_audio *chip = mixer->chip; ++ const struct scarlett2_device_info *info; ++ int err; ++ ++ /* only use UAC_VERSION_2 */ ++ if (!mixer->protocol) ++ return 0; ++ ++ switch (chip->usb_id) { ++ case USB_ID(0x1235, 0x8203): ++ info = &s6i6_gen2_info; ++ break; ++ case USB_ID(0x1235, 0x8204): ++ info = &s18i8_gen2_info; ++ break; ++ case USB_ID(0x1235, 0x8201): ++ info = &s18i20_gen2_info; ++ break; ++ default: /* device not (yet) supported */ ++ return -EINVAL; ++ } ++ ++ if (!(chip->setup & SCARLETT2_ENABLE)) { ++ usb_audio_info(chip, ++ "Focusrite Scarlett Gen 2 Mixer Driver disabled; " ++ "use options snd_usb_audio vid=0x%04x pid=0x%04x " ++ "device_setup=1 to enable and report any issues " ++ "to g@b4.vu", ++ USB_ID_VENDOR(chip->usb_id), ++ USB_ID_PRODUCT(chip->usb_id)); ++ return 0; ++ } ++ ++ usb_audio_info(chip, ++ "Focusrite Scarlett Gen 2 Mixer Driver enabled pid=0x%04x", ++ USB_ID_PRODUCT(chip->usb_id)); ++ ++ err = snd_scarlett_gen2_controls_create(mixer, info); ++ if (err < 0) ++ usb_audio_err(mixer->chip, ++ "Error initialising Scarlett Mixer Driver: %d", ++ err); ++ ++ return err; ++} +diff --git a/sound/usb/mixer_scarlett_gen2.h b/sound/usb/mixer_scarlett_gen2.h +index 52e1dad77afd..668c6b0cb50a 100644 +--- a/sound/usb/mixer_scarlett_gen2.h ++++ b/sound/usb/mixer_scarlett_gen2.h +@@ -2,6 +2,6 @@ + #ifndef __USB_MIXER_SCARLETT_GEN2_H + #define __USB_MIXER_SCARLETT_GEN2_H + +-int snd_scarlett_gen2_controls_create(struct usb_mixer_interface *mixer); ++int snd_scarlett_gen2_init(struct usb_mixer_interface *mixer); + + #endif /* __USB_MIXER_SCARLETT_GEN2_H */ +-- +2.26.2 + diff --git a/patches.suse/ALSA-usb-audio-scarlett2-snd_scarlett_gen2_controls_.patch b/patches.suse/ALSA-usb-audio-scarlett2-snd_scarlett_gen2_controls_.patch new file mode 100644 index 0000000..283d2b7 --- /dev/null +++ b/patches.suse/ALSA-usb-audio-scarlett2-snd_scarlett_gen2_controls_.patch @@ -0,0 +1,38 @@ +From 2b899f31f1a6db2db4608bac2ac04fe2c4ad89eb Mon Sep 17 00:00:00 2001 +From: kernel test robot +Date: Sun, 23 May 2021 02:09:00 +0800 +Subject: [PATCH] ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create() can be static +Git-commit: 2b899f31f1a6db2db4608bac2ac04fe2c4ad89eb +Patch-mainline: v5.13-rc4 +References: git-fixes + +sound/usb/mixer_scarlett_gen2.c:2000:5: warning: symbol 'snd_scarlett_gen2_controls_create' was not declared. Should it be static? + +Fixes: 265d1a90e4fb ("ALSA: usb-audio: scarlett2: Improve driver startup messages") +Reported-by: kernel test robot +Signed-off-by: kernel test robot +Link: https://lore.kernel.org/r/20210522180900.GA83915@f59a3af2f1d9 +Signed-off-by: Takashi Iwai + +--- + sound/usb/mixer_scarlett_gen2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c +index 3ad8f61a2095..4caf379d5b99 100644 +--- a/sound/usb/mixer_scarlett_gen2.c ++++ b/sound/usb/mixer_scarlett_gen2.c +@@ -1997,8 +1997,8 @@ static int scarlett2_mixer_status_create(struct usb_mixer_interface *mixer) + return usb_submit_urb(mixer->urb, GFP_KERNEL); + } + +-int snd_scarlett_gen2_controls_create(struct usb_mixer_interface *mixer, +- const struct scarlett2_device_info *info) ++static int snd_scarlett_gen2_controls_create(struct usb_mixer_interface *mixer, ++ const struct scarlett2_device_info *info) + { + int err; + +-- +2.26.2 + diff --git a/patches.suse/ARM64-vdso32-Install-vdso32-from-vdso_install.patch b/patches.suse/ARM64-vdso32-Install-vdso32-from-vdso_install.patch new file mode 100644 index 0000000..94a70c4 --- /dev/null +++ b/patches.suse/ARM64-vdso32-Install-vdso32-from-vdso_install.patch @@ -0,0 +1,52 @@ +From: Stephen Boyd +Date: Mon, 17 Aug 2020 18:49:50 -0700 +Subject: ARM64: vdso32: Install vdso32 from vdso_install + +Git-commit: 8d75785a814241587802655cc33e384230744f0c +Patch-mainline: v5.9-rc2 +References: git-fixes + +Add the 32-bit vdso Makefile to the vdso_install rule so that 'make +vdso_install' installs the 32-bit compat vdso when it is compiled. + +Fixes: a7f71a2c8903 ("arm64: compat: Add vDSO") +Signed-off-by: Stephen Boyd +Reviewed-by: Vincenzo Frascino +Acked-by: Will Deacon +Cc: Vincenzo Frascino +Link: https://lore.kernel.org/r/20200818014950.42492-1-swboyd@chromium.org +Signed-off-by: Catalin Marinas +Signed-off-by: Mian Yousaf Kaukab +--- + arch/arm64/Makefile | 1 + + arch/arm64/kernel/vdso32/Makefile | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile +index 55bc8546d9c7..b45f0124cc16 100644 +--- a/arch/arm64/Makefile ++++ b/arch/arm64/Makefile +@@ -165,6 +165,7 @@ zinstall install: + PHONY += vdso_install + vdso_install: + $(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso $@ ++ $(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso32 $@ + + # We use MRPROPER_FILES and CLEAN_FILES now + archclean: +diff --git a/arch/arm64/kernel/vdso32/Makefile b/arch/arm64/kernel/vdso32/Makefile +index 5139a5f19256..d6adb4677c25 100644 +--- a/arch/arm64/kernel/vdso32/Makefile ++++ b/arch/arm64/kernel/vdso32/Makefile +@@ -208,7 +208,7 @@ quiet_cmd_vdsosym = VDSOSYM $@ + cmd_vdsosym = $(NM) $< | $(gen-vdsosym) | LC_ALL=C sort > $@ + + # Install commands for the unstripped file +-quiet_cmd_vdso_install = INSTALL $@ ++quiet_cmd_vdso_install = INSTALL32 $@ + cmd_vdso_install = cp $(obj)/$@.dbg $(MODLIB)/vdso/vdso32.so + + vdso.so: $(obj)/vdso.so.dbg +-- +2.26.2 + diff --git a/patches.suse/ASoC-Intel-bytcr_rt5640-Add-quirk-for-the-Chuwi-Hi8-.patch b/patches.suse/ASoC-Intel-bytcr_rt5640-Add-quirk-for-the-Chuwi-Hi8-.patch new file mode 100644 index 0000000..7ced0ce --- /dev/null +++ b/patches.suse/ASoC-Intel-bytcr_rt5640-Add-quirk-for-the-Chuwi-Hi8-.patch @@ -0,0 +1,56 @@ +From 875c40eadf6ac6644c0f71842a4f30dd9968d281 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 25 Mar 2021 23:10:54 +0100 +Subject: [PATCH] ASoC: Intel: bytcr_rt5640: Add quirk for the Chuwi Hi8 tablet +Git-commit: 875c40eadf6ac6644c0f71842a4f30dd9968d281 +Patch-mainline: v5.13-rc1 +References: git-fixes + +The Chuwi Hi8 tablet is using an analog mic on IN1 and has its +jack-detect connected to JD2_IN4N, instead of using the default +IN3 for its internal mic and JD1_IN4P for jack-detect. + +It also only has 1 speaker. + +Add a quirk applying the correct settings for this configuration. + +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20210325221054.22714-1-hdegoede@redhat.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/intel/boards/bytcr_rt5640.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 59d6d47c8d82..df2f5d55e8ff 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -518,6 +518,23 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, ++ { ++ /* Chuwi Hi8 (CWI509) */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "Hampoo"), ++ DMI_MATCH(DMI_BOARD_NAME, "BYT-PA03C"), ++ DMI_MATCH(DMI_SYS_VENDOR, "ilife"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "S806"), ++ }, ++ .driver_data = (void *)(BYT_RT5640_IN1_MAP | ++ BYT_RT5640_JD_SRC_JD2_IN4N | ++ BYT_RT5640_OVCD_TH_2000UA | ++ BYT_RT5640_OVCD_SF_0P75 | ++ BYT_RT5640_MONO_SPEAKER | ++ BYT_RT5640_DIFF_MIC | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), ++ }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Circuitco"), +-- +2.26.2 + diff --git a/patches.suse/ASoC-Intel-bytcr_rt5640-Enable-jack-detect-support-o.patch b/patches.suse/ASoC-Intel-bytcr_rt5640-Enable-jack-detect-support-o.patch new file mode 100644 index 0000000..8c78f94 --- /dev/null +++ b/patches.suse/ASoC-Intel-bytcr_rt5640-Enable-jack-detect-support-o.patch @@ -0,0 +1,41 @@ +From b7c7203a1f751348f35fc4bcb157572d303f7573 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Fri, 12 Mar 2021 12:48:50 +0100 +Subject: [PATCH] ASoC: Intel: bytcr_rt5640: Enable jack-detect support on Asus T100TAF +Git-commit: b7c7203a1f751348f35fc4bcb157572d303f7573 +Patch-mainline: v5.13-rc1 +References: git-fixes + +The Asus T100TAF uses the same jack-detect settings as the T100TA, +this has been confirmed on actual hardware. + +Add these settings to the T100TAF quirks to enable jack-detect support +on the T100TAF. + +Signed-off-by: Hans de Goede +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210312114850.13832-1-hdegoede@redhat.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/intel/boards/bytcr_rt5640.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 5d48cc359c3d..19faababb78d 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -482,6 +482,9 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100TAF"), + }, + .driver_data = (void *)(BYT_RT5640_IN1_MAP | ++ BYT_RT5640_JD_SRC_JD2_IN4N | ++ BYT_RT5640_OVCD_TH_2000UA | ++ BYT_RT5640_OVCD_SF_0P75 | + BYT_RT5640_MONO_SPEAKER | + BYT_RT5640_DIFF_MIC | + BYT_RT5640_SSP0_AIF2 | +-- +2.26.2 + diff --git a/patches.suse/ASoC-cs35l33-fix-an-error-code-in-probe.patch b/patches.suse/ASoC-cs35l33-fix-an-error-code-in-probe.patch new file mode 100644 index 0000000..a8a7ea2 --- /dev/null +++ b/patches.suse/ASoC-cs35l33-fix-an-error-code-in-probe.patch @@ -0,0 +1,36 @@ +From 833bc4cf9754643acc69b3c6b65988ca78df4460 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 20 May 2021 08:08:24 +0300 +Subject: [PATCH] ASoC: cs35l33: fix an error code in probe() +Git-commit: 833bc4cf9754643acc69b3c6b65988ca78df4460 +Patch-mainline: v5.13-rc4 +References: git-fixes + +This error path returns zero (success) but it should return -EINVAL. + +Fixes: 3333cb7187b9 ("ASoC: cs35l33: Initial commit of the cs35l33 CODEC driver.") +Signed-off-by: Dan Carpenter +Reviewed-by: Charles Keepax +Link: https://lore.kernel.org/r/YKXuyGEzhPT35R3G@mwanda +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/codecs/cs35l33.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/cs35l33.c b/sound/soc/codecs/cs35l33.c +index 7ad7b733af9b..e8f3dcfd144d 100644 +--- a/sound/soc/codecs/cs35l33.c ++++ b/sound/soc/codecs/cs35l33.c +@@ -1201,6 +1201,7 @@ static int cs35l33_i2c_probe(struct i2c_client *i2c_client, + dev_err(&i2c_client->dev, + "CS35L33 Device ID (%X). Expected ID %X\n", + devid, CS35L33_CHIP_ID); ++ ret = -EINVAL; + goto err_enable; + } + +-- +2.26.2 + diff --git a/patches.suse/ASoC-cs42l42-Regmap-must-use_single_read-write.patch b/patches.suse/ASoC-cs42l42-Regmap-must-use_single_read-write.patch new file mode 100644 index 0000000..c8774e4 --- /dev/null +++ b/patches.suse/ASoC-cs42l42-Regmap-must-use_single_read-write.patch @@ -0,0 +1,49 @@ +From 0fad605fb0bdc00d8ad78696300ff2fbdee6e048 Mon Sep 17 00:00:00 2001 +From: Richard Fitzgerald +Date: Tue, 11 May 2021 14:28:55 +0100 +Subject: [PATCH] ASoC: cs42l42: Regmap must use_single_read/write +Git-commit: 0fad605fb0bdc00d8ad78696300ff2fbdee6e048 +Patch-mainline: v5.13-rc4 +References: git-fixes + +cs42l42 does not support standard burst transfers so the use_single_read +and use_single_write flags must be set in the regmap config. + +Because of this bug, the patch: + +commit 0a0eb567e1d4 ("ASoC: cs42l42: Minor error paths fixups") + +broke cs42l42 probe() because without the use_single_* flags it causes +regmap to issue a burst read. + +However, the missing use_single_* could cause problems anyway because the +regmap cache can attempt burst transfers if these flags are not set. + +Fixes: 2c394ca79604 ("ASoC: Add support for CS42L42 codec") +Signed-off-by: Richard Fitzgerald +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20210511132855.27159-1-rf@opensource.cirrus.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/codecs/cs42l42.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c +index bf982e145e94..77473c226f9e 100644 +--- a/sound/soc/codecs/cs42l42.c ++++ b/sound/soc/codecs/cs42l42.c +@@ -399,6 +399,9 @@ static const struct regmap_config cs42l42_regmap = { + .reg_defaults = cs42l42_reg_defaults, + .num_reg_defaults = ARRAY_SIZE(cs42l42_reg_defaults), + .cache_type = REGCACHE_RBTREE, ++ ++ .use_single_read = true, ++ .use_single_write = true, + }; + + static DECLARE_TLV_DB_SCALE(adc_tlv, -9600, 100, false); +-- +2.26.2 + diff --git a/patches.suse/ASoC-rsnd-call-rsnd_ssi_master_clk_start-from-rsnd_s.patch b/patches.suse/ASoC-rsnd-call-rsnd_ssi_master_clk_start-from-rsnd_s.patch new file mode 100644 index 0000000..1cfc86c --- /dev/null +++ b/patches.suse/ASoC-rsnd-call-rsnd_ssi_master_clk_start-from-rsnd_s.patch @@ -0,0 +1,116 @@ +From a122a116fc6d8fcf2f202dcd185173a54268f239 Mon Sep 17 00:00:00 2001 +From: Kuninori Morimoto +Date: Thu, 8 Apr 2021 13:28:38 +0900 +Subject: [PATCH] ASoC: rsnd: call rsnd_ssi_master_clk_start() from rsnd_ssi_init() +Git-commit: a122a116fc6d8fcf2f202dcd185173a54268f239 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Current rsnd needs to call .prepare (P) for clock settings, +.trigger for playback start (S) and stop (E). +It should be called as below from SSI point of view. + + P -> S -> E -> P -> S -> E -> ... + +But, if you used MIXer, below case might happen + + (2) + 1: P -> S ---> E -> ... + 2: P ----> S -> ... + (1) (3) + +P(1) setups clock, but E(2) resets it. and starts playback (3). +In such case, it will reports "SSI parent/child should use same rate". + +rsnd_ssi_master_clk_start() which is the main function at (P) +was called from rsnd_ssi_init() (= S) before, +but was moved by below patch to rsnd_soc_dai_prepare() (= P) to avoid +using clk_get_rate() which shouldn't be used under atomic context. + + commit 4d230d1271064 ("ASoC: rsnd: fixup not to call clk_get/set + under non-atomic") + +Because of above patch, rsnd_ssi_master_clk_start() is now called at (P) +which is for non atomic context. But (P) is assuming that spin lock is +*not* used. +One issue now is rsnd_ssi_master_clk_start() is checking ssi->xxx +which should be protected by spin lock. + +After above patch, adg.c had below patch for other reasons. + + commit 06e8f5c842f2d ("ASoC: rsnd: don't call clk_get_rate() + under atomic context") + +clk_get_rate() is used at probe() timing by this patch. +In other words, rsnd_ssi_master_clk_start() is no longer using +clk_get_rate() any more. + +This means we can call it from rsnd_ssi_init() (= S) again which is +protected by spin lock. +This patch re-move it to under spin lock, and solves +1. checking ssi->xxx without spin lock issue. +2. clk setting / device start / device stop race condition. + +Reported-by: Linh Phung T. Y. +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/875z0x1jt5.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/sh/rcar/ssi.c | 14 +++++--------- + 1 file changed, 5 insertions(+), 9 deletions(-) + +diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c +index d071cec25f71..048d53566127 100644 +--- a/sound/soc/sh/rcar/ssi.c ++++ b/sound/soc/sh/rcar/ssi.c +@@ -506,10 +506,15 @@ static int rsnd_ssi_init(struct rsnd_mod *mod, + struct rsnd_priv *priv) + { + struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod); ++ int ret; + + if (!rsnd_ssi_is_run_mods(mod, io)) + return 0; + ++ ret = rsnd_ssi_master_clk_start(mod, io); ++ if (ret < 0) ++ return ret; ++ + ssi->usrcnt++; + + rsnd_mod_power_on(mod); +@@ -1060,13 +1065,6 @@ static int rsnd_ssi_pio_pointer(struct rsnd_mod *mod, + return 0; + } + +-static int rsnd_ssi_prepare(struct rsnd_mod *mod, +- struct rsnd_dai_stream *io, +- struct rsnd_priv *priv) +-{ +- return rsnd_ssi_master_clk_start(mod, io); +-} +- + static struct rsnd_mod_ops rsnd_ssi_pio_ops = { + .name = SSI_NAME, + .probe = rsnd_ssi_common_probe, +@@ -1079,7 +1077,6 @@ static struct rsnd_mod_ops rsnd_ssi_pio_ops = { + .pointer = rsnd_ssi_pio_pointer, + .pcm_new = rsnd_ssi_pcm_new, + .hw_params = rsnd_ssi_hw_params, +- .prepare = rsnd_ssi_prepare, + .get_status = rsnd_ssi_get_status, + }; + +@@ -1166,7 +1163,6 @@ static struct rsnd_mod_ops rsnd_ssi_dma_ops = { + .pcm_new = rsnd_ssi_pcm_new, + .fallback = rsnd_ssi_fallback, + .hw_params = rsnd_ssi_hw_params, +- .prepare = rsnd_ssi_prepare, + .get_status = rsnd_ssi_get_status, + }; + +-- +2.26.2 + diff --git a/patches.suse/ASoC-rsnd-core-Check-convert-rate-in-rsnd_hw_params.patch b/patches.suse/ASoC-rsnd-core-Check-convert-rate-in-rsnd_hw_params.patch new file mode 100644 index 0000000..aecf3c6 --- /dev/null +++ b/patches.suse/ASoC-rsnd-core-Check-convert-rate-in-rsnd_hw_params.patch @@ -0,0 +1,108 @@ +From 19c6a63ced5e07e40f3a5255cb1f0fe0d3be7b14 Mon Sep 17 00:00:00 2001 +From: Mikhail Durnev +Date: Tue, 16 Mar 2021 14:47:35 +1000 +Subject: [PATCH] ASoC: rsnd: core: Check convert rate in rsnd_hw_params +Git-commit: 19c6a63ced5e07e40f3a5255cb1f0fe0d3be7b14 +Patch-mainline: v5.13-rc1 +References: git-fixes + +snd_pcm_hw_params_set_rate_near can return incorrect sample rate in +some cases, e.g. when the backend output rate is set to some value higher +than 48000 Hz and the input rate is 8000 Hz. So passing the value returned +by snd_pcm_hw_params_set_rate_near to snd_pcm_hw_params will result in +"FSO/FSI ratio error" and playing no audio at all while the userland +is not properly notified about the issue. + +If SRC is unable to convert the requested sample rate to the sample rate +the backend is using, then the requested sample rate should be adjusted in +rsnd_hw_params. The userland will be notified about that change in the +returned hw_params structure. + +Signed-off-by: Mikhail Durnev +Link: https://lore.kernel.org/r/1615870055-13954-1-git-send-email-mikhail_durnev@mentor.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/sh/rcar/core.c | 69 ++++++++++++++++++++++++++++++++++++++++++++++- + 1 file changed, 68 insertions(+), 1 deletion(-) + +--- a/sound/soc/sh/rcar/core.c ++++ b/sound/soc/sh/rcar/core.c +@@ -1426,8 +1426,75 @@ static int rsnd_hw_params(struct snd_pcm + } + if (io->converted_chan) + dev_dbg(dev, "convert channels = %d\n", io->converted_chan); +- if (io->converted_rate) ++ if (io->converted_rate) { ++ /* ++ * SRC supports convert rates from params_rate(hw_params)/k_down ++ * to params_rate(hw_params)*k_up, where k_up is always 6, and ++ * k_down depends on number of channels and SRC unit. ++ * So all SRC units can upsample audio up to 6 times regardless ++ * its number of channels. And all SRC units can downsample ++ * 2 channel audio up to 6 times too. ++ */ ++ int k_up = 6; ++ int k_down = 6; ++ int channel; ++ struct rsnd_mod *src_mod = rsnd_io_to_mod_src(io); ++ + dev_dbg(dev, "convert rate = %d\n", io->converted_rate); ++ ++ channel = io->converted_chan ? io->converted_chan : ++ params_channels(hw_params); ++ ++ switch (rsnd_mod_id(src_mod)) { ++ /* ++ * SRC0 can downsample 4, 6 and 8 channel audio up to 4 times. ++ * SRC1, SRC3 and SRC4 can downsample 4 channel audio ++ * up to 4 times. ++ * SRC1, SRC3 and SRC4 can downsample 6 and 8 channel audio ++ * no more than twice. ++ */ ++ case 1: ++ case 3: ++ case 4: ++ if (channel > 4) { ++ k_down = 2; ++ break; ++ } ++ fallthrough; ++ case 0: ++ if (channel > 2) ++ k_down = 4; ++ break; ++ ++ /* Other SRC units do not support more than 2 channels */ ++ default: ++ if (channel > 2) ++ return -EINVAL; ++ } ++ ++ if (params_rate(hw_params) > io->converted_rate * k_down) { ++ hw_param_interval(hw_params, SNDRV_PCM_HW_PARAM_RATE)->min = ++ io->converted_rate * k_down; ++ hw_param_interval(hw_params, SNDRV_PCM_HW_PARAM_RATE)->max = ++ io->converted_rate * k_down; ++ hw_params->cmask |= SNDRV_PCM_HW_PARAM_RATE; ++ } else if (params_rate(hw_params) * k_up < io->converted_rate) { ++ hw_param_interval(hw_params, SNDRV_PCM_HW_PARAM_RATE)->min = ++ (io->converted_rate + k_up - 1) / k_up; ++ hw_param_interval(hw_params, SNDRV_PCM_HW_PARAM_RATE)->max = ++ (io->converted_rate + k_up - 1) / k_up; ++ hw_params->cmask |= SNDRV_PCM_HW_PARAM_RATE; ++ } ++ ++ /* ++ * TBD: Max SRC input and output rates also depend on number ++ * of channels and SRC unit: ++ * SRC1, SRC3 and SRC4 do not support more than 128kHz ++ * for 6 channel and 96kHz for 8 channel audio. ++ * Perhaps this function should return EINVAL if the input or ++ * the output rate exceeds the limitation. ++ */ ++ } + } + + ret = rsnd_dai_call(hw_params, io, substream, hw_params); diff --git a/patches.suse/ASoC-rt286-Generalize-support-for-ALC3263-codec.patch b/patches.suse/ASoC-rt286-Generalize-support-for-ALC3263-codec.patch new file mode 100644 index 0000000..ee75eb4 --- /dev/null +++ b/patches.suse/ASoC-rt286-Generalize-support-for-ALC3263-codec.patch @@ -0,0 +1,99 @@ +From aa2f9c12821e6a4ba1df4fb34a3dbc6a2a1ee7fe Mon Sep 17 00:00:00 2001 +From: David Ward +Date: Sun, 18 Apr 2021 09:46:58 -0400 +Subject: [PATCH] ASoC: rt286: Generalize support for ALC3263 codec +Git-commit: aa2f9c12821e6a4ba1df4fb34a3dbc6a2a1ee7fe +Patch-mainline: v5.13-rc1 +References: git-fixes + +The ALC3263 codec on the XPS 13 9343 is also found on the Latitude 13 7350 +and Venue 11 Pro 7140. They require the same handling for the combo jack to +work with a headset: GPIO pin 6 must be set. + +The HDA driver always sets this pin on the ALC3263, which it distinguishes +by the codec vendor/device ID 0x10ec0288 and PCI subsystem vendor ID 0x1028 +(Dell). The ASoC driver does not use PCI, so adapt this check to use DMI to +determine if Dell is the system vendor. + +Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=150601 +Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=205961 +Signed-off-by: David Ward +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210418134658.4333-6-david.ward@gatech.edu +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/codecs/rt286.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/sound/soc/codecs/rt286.c b/sound/soc/codecs/rt286.c +index 45e4a48ef5bf..802f4851c3df 100644 +--- a/sound/soc/codecs/rt286.c ++++ b/sound/soc/codecs/rt286.c +@@ -1125,12 +1125,11 @@ static const struct dmi_system_id force_combo_jack_table[] = { + { } + }; + +-static const struct dmi_system_id dmi_dell_dino[] = { ++static const struct dmi_system_id dmi_dell[] = { + { +- .ident = "Dell Dino", ++ .ident = "Dell", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), +- DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9343") + } + }, + { } +@@ -1141,7 +1140,7 @@ static int rt286_i2c_probe(struct i2c_client *i2c, + { + struct rt286_platform_data *pdata = dev_get_platdata(&i2c->dev); + struct rt286_priv *rt286; +- int i, ret, val; ++ int i, ret, vendor_id; + + rt286 = devm_kzalloc(&i2c->dev, sizeof(*rt286), + GFP_KERNEL); +@@ -1157,14 +1156,15 @@ static int rt286_i2c_probe(struct i2c_client *i2c, + } + + ret = regmap_read(rt286->regmap, +- RT286_GET_PARAM(AC_NODE_ROOT, AC_PAR_VENDOR_ID), &val); ++ RT286_GET_PARAM(AC_NODE_ROOT, AC_PAR_VENDOR_ID), &vendor_id); + if (ret != 0) { + dev_err(&i2c->dev, "I2C error %d\n", ret); + return ret; + } +- if (val != RT286_VENDOR_ID && val != RT288_VENDOR_ID) { ++ if (vendor_id != RT286_VENDOR_ID && vendor_id != RT288_VENDOR_ID) { + dev_err(&i2c->dev, +- "Device with ID register %#x is not rt286\n", val); ++ "Device with ID register %#x is not rt286\n", ++ vendor_id); + return -ENODEV; + } + +@@ -1188,8 +1188,8 @@ static int rt286_i2c_probe(struct i2c_client *i2c, + if (pdata) + rt286->pdata = *pdata; + +- if (dmi_check_system(force_combo_jack_table) || +- dmi_check_system(dmi_dell_dino)) ++ if ((vendor_id == RT288_VENDOR_ID && dmi_check_system(dmi_dell)) || ++ dmi_check_system(force_combo_jack_table)) + rt286->pdata.cbj_en = true; + + regmap_write(rt286->regmap, RT286_SET_AUDIO_POWER, AC_PWRST_D3); +@@ -1228,7 +1228,7 @@ static int rt286_i2c_probe(struct i2c_client *i2c, + regmap_update_bits(rt286->regmap, RT286_DEPOP_CTRL3, 0xf777, 0x4737); + regmap_update_bits(rt286->regmap, RT286_DEPOP_CTRL4, 0x00ff, 0x003f); + +- if (dmi_check_system(dmi_dell_dino)) { ++ if (vendor_id == RT288_VENDOR_ID && dmi_check_system(dmi_dell)) { + regmap_update_bits(rt286->regmap, + RT286_SET_GPIO_MASK, 0x40, 0x40); + regmap_update_bits(rt286->regmap, +-- +2.26.2 + diff --git a/patches.suse/ASoC-rt286-Make-RT286_SET_GPIO_-readable-and-writabl.patch b/patches.suse/ASoC-rt286-Make-RT286_SET_GPIO_-readable-and-writabl.patch new file mode 100644 index 0000000..9900ad2 --- /dev/null +++ b/patches.suse/ASoC-rt286-Make-RT286_SET_GPIO_-readable-and-writabl.patch @@ -0,0 +1,39 @@ +From cd8499d5c03ba260e3191e90236d0e5f6b147563 Mon Sep 17 00:00:00 2001 +From: David Ward +Date: Sun, 18 Apr 2021 09:46:57 -0400 +Subject: [PATCH] ASoC: rt286: Make RT286_SET_GPIO_* readable and writable +Git-commit: cd8499d5c03ba260e3191e90236d0e5f6b147563 +Patch-mainline: v5.13-rc1 +References: git-fixes + +The GPIO configuration cannot be applied if the registers are inaccessible. +This prevented the headset mic from working on the Dell XPS 13 9343. + +Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=114171 +Signed-off-by: David Ward +Link: https://lore.kernel.org/r/20210418134658.4333-5-david.ward@gatech.edu +Reviewed-by: Pierre-Louis Bossart +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/codecs/rt286.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/codecs/rt286.c b/sound/soc/codecs/rt286.c +index f9b29782b62a..e16e7237156f 100644 +--- a/sound/soc/codecs/rt286.c ++++ b/sound/soc/codecs/rt286.c +@@ -171,6 +171,9 @@ static bool rt286_readable_register(struct device *dev, unsigned int reg) + case RT286_PROC_COEF: + case RT286_SET_AMP_GAIN_ADC_IN1: + case RT286_SET_AMP_GAIN_ADC_IN2: ++ case RT286_SET_GPIO_MASK: ++ case RT286_SET_GPIO_DIRECTION: ++ case RT286_SET_GPIO_DATA: + case RT286_SET_POWER(RT286_DAC_OUT1): + case RT286_SET_POWER(RT286_DAC_OUT2): + case RT286_SET_POWER(RT286_ADC_IN1): +-- +2.26.2 + diff --git a/patches.suse/Bluetooth-L2CAP-Fix-handling-LE-modes-by-L2CAP_OPTIO.patch b/patches.suse/Bluetooth-L2CAP-Fix-handling-LE-modes-by-L2CAP_OPTIO.patch new file mode 100644 index 0000000..6719632 --- /dev/null +++ b/patches.suse/Bluetooth-L2CAP-Fix-handling-LE-modes-by-L2CAP_OPTIO.patch @@ -0,0 +1,65 @@ +From b86b0b150fed840c376145383ef5105116c81b0c Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Fri, 27 Mar 2020 11:32:14 -0700 +Subject: [PATCH] Bluetooth: L2CAP: Fix handling LE modes by L2CAP_OPTIONS +Git-commit: b86b0b150fed840c376145383ef5105116c81b0c +References: git-fixes +Patch-mainline: v5.8-rc1 + +L2CAP_OPTIONS shall only be used with BR/EDR modes. + +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Signed-off-by: Oliver Neukum +--- + net/bluetooth/l2cap_sock.c | 25 +++++++++++++++++++++---- + 1 file changed, 21 insertions(+), 4 deletions(-) + +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -418,6 +418,20 @@ static int l2cap_sock_getsockopt_old(str + break; + } + ++ /* Only BR/EDR modes are supported here */ ++ switch (chan->mode) { ++ case L2CAP_MODE_BASIC: ++ case L2CAP_MODE_ERTM: ++ case L2CAP_MODE_STREAMING: ++ break; ++ default: ++ err = -EINVAL; ++ break; ++ } ++ ++ if (err < 0) ++ break; ++ + memset(&opts, 0, sizeof(opts)); + opts.imtu = chan->imtu; + opts.omtu = chan->omtu; +@@ -677,10 +691,8 @@ static int l2cap_sock_setsockopt_old(str + break; + } + +- chan->mode = opts.mode; +- switch (chan->mode) { +- case L2CAP_MODE_LE_FLOWCTL: +- break; ++ /* Only BR/EDR modes are supported here */ ++ switch (opts.mode) { + case L2CAP_MODE_BASIC: + clear_bit(CONF_STATE2_DEVICE, &chan->conf_state); + break; +@@ -694,6 +706,11 @@ static int l2cap_sock_setsockopt_old(str + break; + } + ++ if (err < 0) ++ break; ++ ++ chan->mode = opts.mode; ++ + chan->imtu = opts.imtu; + chan->omtu = opts.omtu; + chan->fcs = opts.fcs; diff --git a/patches.suse/Bluetooth-SMP-Fail-if-remote-and-local-public-keys-a.patch b/patches.suse/Bluetooth-SMP-Fail-if-remote-and-local-public-keys-a.patch new file mode 100644 index 0000000..e590397 --- /dev/null +++ b/patches.suse/Bluetooth-SMP-Fail-if-remote-and-local-public-keys-a.patch @@ -0,0 +1,42 @@ +From 6d19628f539fccf899298ff02ee4c73e4bf6df3f Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Wed, 10 Mar 2021 14:13:08 -0800 +Subject: [PATCH] Bluetooth: SMP: Fail if remote and local public keys are identical +Git-commit: 6d19628f539fccf899298ff02ee4c73e4bf6df3f +Patch-mainline: v5.13-rc1 +References: git-fixes + +This fails the pairing procedure when both remote and local non-debug +public keys are identical. + +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Acked-by: Takashi Iwai + +--- + net/bluetooth/smp.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c +index b0c1ee110eff..e03cc284161c 100644 +--- a/net/bluetooth/smp.c ++++ b/net/bluetooth/smp.c +@@ -2732,6 +2732,15 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb) + if (skb->len < sizeof(*key)) + return SMP_INVALID_PARAMS; + ++ /* Check if remote and local public keys are the same and debug key is ++ * not in use. ++ */ ++ if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) && ++ !crypto_memneq(key, smp->local_pk, 64)) { ++ bt_dev_err(hdev, "Remote and local public keys are identical"); ++ return SMP_UNSPECIFIED; ++ } ++ + memcpy(smp->remote_pk, key, 64); + + if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags)) { +-- +2.26.2 + diff --git a/patches.suse/Bluetooth-Set-CONF_NOT_COMPLETE-as-l2cap_chan-defaul.patch b/patches.suse/Bluetooth-Set-CONF_NOT_COMPLETE-as-l2cap_chan-defaul.patch new file mode 100644 index 0000000..736a98f --- /dev/null +++ b/patches.suse/Bluetooth-Set-CONF_NOT_COMPLETE-as-l2cap_chan-defaul.patch @@ -0,0 +1,77 @@ +From 3a9d54b1947ecea8eea9a902c0b7eb58a98add8a Mon Sep 17 00:00:00 2001 +From: Archie Pusaka +Date: Mon, 22 Mar 2021 14:02:15 +0800 +Subject: [PATCH] Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default +Git-commit: 3a9d54b1947ecea8eea9a902c0b7eb58a98add8a +Patch-mainline: v5.13-rc1 +References: git-fixes + +Currently l2cap_chan_set_defaults() reset chan->conf_state to zero. +However, there is a flag CONF_NOT_COMPLETE which is set when +creating the l2cap_chan. It is suggested that the flag should be +cleared when l2cap_chan is ready, but when l2cap_chan_set_defaults() +is called, l2cap_chan is not yet ready. Therefore, we must set this +flag as the default. + +Example crash call trace: +__dump_stack lib/dump_stack.c:15 [inline] +dump_stack+0xc4/0x118 lib/dump_stack.c:56 +panic+0x1c6/0x38b kernel/panic.c:117 +__warn+0x170/0x1b9 kernel/panic.c:471 +warn_slowpath_fmt+0xc7/0xf8 kernel/panic.c:494 +debug_print_object+0x175/0x193 lib/debugobjects.c:260 +debug_object_assert_init+0x171/0x1bf lib/debugobjects.c:614 +debug_timer_assert_init kernel/time/timer.c:629 [inline] +debug_assert_init kernel/time/timer.c:677 [inline] +del_timer+0x7c/0x179 kernel/time/timer.c:1034 +try_to_grab_pending+0x81/0x2e5 kernel/workqueue.c:1230 +cancel_delayed_work+0x7c/0x1c4 kernel/workqueue.c:2929 +l2cap_clear_timer+0x1e/0x41 include/net/bluetooth/l2cap.h:834 +l2cap_chan_del+0x2d8/0x37e net/bluetooth/l2cap_core.c:640 +l2cap_chan_close+0x532/0x5d8 net/bluetooth/l2cap_core.c:756 +l2cap_sock_shutdown+0x806/0x969 net/bluetooth/l2cap_sock.c:1174 +l2cap_sock_release+0x64/0x14d net/bluetooth/l2cap_sock.c:1217 +__sock_release+0xda/0x217 net/socket.c:580 +sock_close+0x1b/0x1f net/socket.c:1039 +__fput+0x322/0x55c fs/file_table.c:208 +____fput+0x17/0x19 fs/file_table.c:244 +task_work_run+0x19b/0x1d3 kernel/task_work.c:115 +exit_task_work include/linux/task_work.h:21 [inline] +do_exit+0xe4c/0x204a kernel/exit.c:766 +do_group_exit+0x291/0x291 kernel/exit.c:891 +get_signal+0x749/0x1093 kernel/signal.c:2396 +do_signal+0xa5/0xcdb arch/x86/kernel/signal.c:737 +exit_to_usermode_loop arch/x86/entry/common.c:243 [inline] +prepare_exit_to_usermode+0xed/0x235 arch/x86/entry/common.c:277 +syscall_return_slowpath+0x3a7/0x3b3 arch/x86/entry/common.c:348 +int_ret_from_sys_call+0x25/0xa3 + +Signed-off-by: Archie Pusaka +Reported-by: syzbot+338f014a98367a08a114@syzkaller.appspotmail.com +Reviewed-by: Alain Michaud +Reviewed-by: Abhishek Pandit-Subedi +Reviewed-by: Guenter Roeck +Signed-off-by: Marcel Holtmann +Acked-by: Takashi Iwai + +--- + net/bluetooth/l2cap_core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index 374cc32d7138..59ab9689b37d 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -516,7 +516,9 @@ void l2cap_chan_set_defaults(struct l2cap_chan *chan) + chan->flush_to = L2CAP_DEFAULT_FLUSH_TO; + chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO; + chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO; ++ + chan->conf_state = 0; ++ set_bit(CONF_NOT_COMPLETE, &chan->conf_state); + + set_bit(FLAG_FORCE_ACTIVE, &chan->flags); + } +-- +2.26.2 + diff --git a/patches.suse/Bluetooth-check-for-zapped-sk-before-connecting.patch b/patches.suse/Bluetooth-check-for-zapped-sk-before-connecting.patch new file mode 100644 index 0000000..2c271fe --- /dev/null +++ b/patches.suse/Bluetooth-check-for-zapped-sk-before-connecting.patch @@ -0,0 +1,69 @@ +From 3af70b39fa2d415dc86c370e5b24ddb9fdacbd6f Mon Sep 17 00:00:00 2001 +From: Archie Pusaka +Date: Tue, 23 Mar 2021 16:32:20 +0800 +Subject: [PATCH] Bluetooth: check for zapped sk before connecting +Git-commit: 3af70b39fa2d415dc86c370e5b24ddb9fdacbd6f +Patch-mainline: v5.13-rc1 +References: git-fixes + +There is a possibility of receiving a zapped sock on +l2cap_sock_connect(). This could lead to interesting crashes, one +such case is tearing down an already tore l2cap_sock as is happened +with this call trace: + +__dump_stack lib/dump_stack.c:15 [inline] +dump_stack+0xc4/0x118 lib/dump_stack.c:56 +register_lock_class kernel/locking/lockdep.c:792 [inline] +register_lock_class+0x239/0x6f6 kernel/locking/lockdep.c:742 +__lock_acquire+0x209/0x1e27 kernel/locking/lockdep.c:3105 +lock_acquire+0x29c/0x2fb kernel/locking/lockdep.c:3599 +__raw_spin_lock_bh include/linux/spinlock_api_smp.h:137 [inline] +_raw_spin_lock_bh+0x38/0x47 kernel/locking/spinlock.c:175 +spin_lock_bh include/linux/spinlock.h:307 [inline] +lock_sock_nested+0x44/0xfa net/core/sock.c:2518 +l2cap_sock_teardown_cb+0x88/0x2fb net/bluetooth/l2cap_sock.c:1345 +l2cap_chan_del+0xa3/0x383 net/bluetooth/l2cap_core.c:598 +l2cap_chan_close+0x537/0x5dd net/bluetooth/l2cap_core.c:756 +l2cap_chan_timeout+0x104/0x17e net/bluetooth/l2cap_core.c:429 +process_one_work+0x7e3/0xcb0 kernel/workqueue.c:2064 +worker_thread+0x5a5/0x773 kernel/workqueue.c:2196 +kthread+0x291/0x2a6 kernel/kthread.c:211 +ret_from_fork+0x4e/0x80 arch/x86/entry/entry_64.S:604 + +Signed-off-by: Archie Pusaka +Reported-by: syzbot+abfc0f5e668d4099af73@syzkaller.appspotmail.com +Reviewed-by: Alain Michaud +Reviewed-by: Abhishek Pandit-Subedi +Reviewed-by: Guenter Roeck +Signed-off-by: Marcel Holtmann +Acked-by: Takashi Iwai + +--- + net/bluetooth/l2cap_sock.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c +index f1b1edd0b697..c99d65ef13b1 100644 +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -179,9 +179,17 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, + struct l2cap_chan *chan = l2cap_pi(sk)->chan; + struct sockaddr_l2 la; + int len, err = 0; ++ bool zapped; + + BT_DBG("sk %p", sk); + ++ lock_sock(sk); ++ zapped = sock_flag(sk, SOCK_ZAPPED); ++ release_sock(sk); ++ ++ if (zapped) ++ return -EINVAL; ++ + if (!addr || alen < offsetofend(struct sockaddr, sa_family) || + addr->sa_family != AF_BLUETOOTH) + return -EINVAL; +-- +2.26.2 + diff --git a/patches.suse/Bluetooth-initialize-skb_queue_head-at-l2cap_chan_cr.patch b/patches.suse/Bluetooth-initialize-skb_queue_head-at-l2cap_chan_cr.patch new file mode 100644 index 0000000..5b9ff8c --- /dev/null +++ b/patches.suse/Bluetooth-initialize-skb_queue_head-at-l2cap_chan_cr.patch @@ -0,0 +1,43 @@ +From be8597239379f0f53c9710dd6ab551bbf535bec6 Mon Sep 17 00:00:00 2001 +From: Tetsuo Handa +Date: Mon, 22 Mar 2021 07:52:07 +0900 +Subject: [PATCH] Bluetooth: initialize skb_queue_head at l2cap_chan_create() +Git-commit: be8597239379f0f53c9710dd6ab551bbf535bec6 +Patch-mainline: v5.13-rc1 +References: git-fixes + +syzbot is hitting "INFO: trying to register non-static key." message [1], +for "struct l2cap_chan"->tx_q.lock spinlock is not yet initialized when +l2cap_chan_del() is called due to e.g. timeout. + +Since "struct l2cap_chan"->lock mutex is initialized at l2cap_chan_create() +immediately after "struct l2cap_chan" is allocated using kzalloc(), let's +as well initialize "struct l2cap_chan"->{tx_q,srej_q}.lock spinlocks there. + +[1] https://syzkaller.appspot.com/bug?extid=fadfba6a911f6bf71842 + +Reported-and-tested-by: syzbot +Signed-off-by: Tetsuo Handa +Signed-off-by: Marcel Holtmann +Acked-by: Takashi Iwai + +--- + net/bluetooth/l2cap_core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index 59ab9689b37d..56e1975cdef1 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -451,6 +451,8 @@ struct l2cap_chan *l2cap_chan_create(void) + if (!chan) + return NULL; + ++ skb_queue_head_init(&chan->tx_q); ++ skb_queue_head_init(&chan->srej_q); + mutex_init(&chan->lock); + + /* Set default lock nesting level */ +-- +2.26.2 + diff --git a/patches.suse/Input-elants_i2c-do-not-bind-to-i2c-hid-compatible-A.patch b/patches.suse/Input-elants_i2c-do-not-bind-to-i2c-hid-compatible-A.patch new file mode 100644 index 0000000..531d32d --- /dev/null +++ b/patches.suse/Input-elants_i2c-do-not-bind-to-i2c-hid-compatible-A.patch @@ -0,0 +1,131 @@ +From 65299e8bfb24774e6340e93ae49f6626598917c8 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Fri, 9 Apr 2021 22:29:07 -0700 +Subject: [PATCH] Input: elants_i2c - do not bind to i2c-hid compatible ACPI instantiated devices +Git-commit: 65299e8bfb24774e6340e93ae49f6626598917c8 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Several users have been reporting that elants_i2c gives several errors +during probe and that their touchscreen does not work on their Lenovo AMD +based laptops with a touchscreen with a ELAN0001 ACPI hardware-id: + +[ 0.550596] elants_i2c i2c-ELAN0001:00: i2c-ELAN0001:00 supply vcc33 not found, using dummy regulator +[ 0.551836] elants_i2c i2c-ELAN0001:00: i2c-ELAN0001:00 supply vccio not found, using dummy regulator +[ 0.560932] elants_i2c i2c-ELAN0001:00: elants_i2c_send failed (77 77 77 77): -121 +[ 0.562427] elants_i2c i2c-ELAN0001:00: software reset failed: -121 +[ 0.595925] elants_i2c i2c-ELAN0001:00: elants_i2c_send failed (77 77 77 77): -121 +[ 0.597974] elants_i2c i2c-ELAN0001:00: software reset failed: -121 +[ 0.621893] elants_i2c i2c-ELAN0001:00: elants_i2c_send failed (77 77 77 77): -121 +[ 0.622504] elants_i2c i2c-ELAN0001:00: software reset failed: -121 +[ 0.632650] elants_i2c i2c-ELAN0001:00: elants_i2c_send failed (4d 61 69 6e): -121 +[ 0.634256] elants_i2c i2c-ELAN0001:00: boot failed: -121 +[ 0.699212] elants_i2c i2c-ELAN0001:00: invalid 'hello' packet: 00 00 ff ff +[ 1.630506] elants_i2c i2c-ELAN0001:00: Failed to read fw id: -121 +[ 1.645508] elants_i2c i2c-ELAN0001:00: unknown packet 00 00 ff ff + +Despite these errors, the elants_i2c driver stays bound to the device +(it returns 0 from its probe method despite the errors), blocking the +i2c-hid driver from binding. + +Manually unbinding the elants_i2c driver and binding the i2c-hid driver +makes the touchscreen work. + +Check if the ACPI-fwnode for the touchscreen contains one of the i2c-hid +compatiblity-id strings and if it has the I2C-HID spec's DSM to get the +HID descriptor address, If it has both then make elants_i2c not bind, +so that the i2c-hid driver can bind. + +This assumes that non of the (older) elan touchscreens which actually +need the elants_i2c driver falsely advertise an i2c-hid compatiblity-id ++ DSM in their ACPI-fwnodes. If some of them actually do have this +false advertising, then this change may lead to regressions. + +While at it also drop the unnecessary DEVICE_NAME prefixing of the +"I2C check functionality error", dev_err already outputs the driver-name. + +Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=207759 +Acked-by: Benjamin Tissoires +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20210405202756.16830-1-hdegoede@redhat.com + +Signed-off-by: Dmitry Torokhov +Acked-by: Takashi Iwai + +--- + drivers/input/touchscreen/elants_i2c.c | 44 ++++++++++++++++++++++++-- + 1 file changed, 42 insertions(+), 2 deletions(-) + +diff --git a/drivers/input/touchscreen/elants_i2c.c b/drivers/input/touchscreen/elants_i2c.c +index 4c2b579f6c8b..36cf5694bfcc 100644 +--- a/drivers/input/touchscreen/elants_i2c.c ++++ b/drivers/input/touchscreen/elants_i2c.c +@@ -38,6 +38,7 @@ + #include + #include + #include ++#include + #include + + /* Device, Driver information */ +@@ -1334,6 +1335,40 @@ static void elants_i2c_power_off(void *_data) + } + } + ++#ifdef CONFIG_ACPI ++static const struct acpi_device_id i2c_hid_ids[] = { ++ {"ACPI0C50", 0 }, ++ {"PNP0C50", 0 }, ++ { }, ++}; ++ ++static const guid_t i2c_hid_guid = ++ GUID_INIT(0x3CDFF6F7, 0x4267, 0x4555, ++ 0xAD, 0x05, 0xB3, 0x0A, 0x3D, 0x89, 0x38, 0xDE); ++ ++static bool elants_acpi_is_hid_device(struct device *dev) ++{ ++ acpi_handle handle = ACPI_HANDLE(dev); ++ union acpi_object *obj; ++ ++ if (acpi_match_device_ids(ACPI_COMPANION(dev), i2c_hid_ids)) ++ return false; ++ ++ obj = acpi_evaluate_dsm_typed(handle, &i2c_hid_guid, 1, 1, NULL, ACPI_TYPE_INTEGER); ++ if (obj) { ++ ACPI_FREE(obj); ++ return true; ++ } ++ ++ return false; ++} ++#else ++static bool elants_acpi_is_hid_device(struct device *dev) ++{ ++ return false; ++} ++#endif ++ + static int elants_i2c_probe(struct i2c_client *client, + const struct i2c_device_id *id) + { +@@ -1342,9 +1377,14 @@ static int elants_i2c_probe(struct i2c_client *client, + unsigned long irqflags; + int error; + ++ /* Don't bind to i2c-hid compatible devices, these are handled by the i2c-hid drv. */ ++ if (elants_acpi_is_hid_device(&client->dev)) { ++ dev_warn(&client->dev, "This device appears to be an I2C-HID device, not binding\n"); ++ return -ENODEV; ++ } ++ + if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) { +- dev_err(&client->dev, +- "%s: i2c check functionality error\n", DEVICE_NAME); ++ dev_err(&client->dev, "I2C check functionality error\n"); + return -ENXIO; + } + +-- +2.26.2 + diff --git a/patches.suse/Input-silead-add-workaround-for-x86-BIOS-es-which-br.patch b/patches.suse/Input-silead-add-workaround-for-x86-BIOS-es-which-br.patch new file mode 100644 index 0000000..1829ce6 --- /dev/null +++ b/patches.suse/Input-silead-add-workaround-for-x86-BIOS-es-which-br.patch @@ -0,0 +1,127 @@ +From e479187748a8f151a85116a7091c599b121fdea5 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Fri, 9 Apr 2021 22:29:49 -0700 +Subject: [PATCH] Input: silead - add workaround for x86 BIOS-es which bring the chip up in a stuck state +Git-commit: e479187748a8f151a85116a7091c599b121fdea5 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Some buggy BIOS-es bring up the touchscreen-controller in a stuck +state where it blocks the I2C bus. Specifically this happens on +the Jumper EZpad 7 tablet model. + +After much poking at this problem I have found that the following steps +are necessary to unstuck the chip / bus: + +1. Turn off the Silead chip. +2. Try to do an I2C transfer with the chip, this will fail in response to + which the I2C-bus-driver will call: i2c_recover_bus() which will unstuck + the I2C-bus. Note the unstuck-ing of the I2C bus only works if we first + drop the chip of the bus by turning it off. +3. Turn the chip back on. + +On the x86/ACPI systems were this problem is seen, step 1. and 3. require +making ACPI calls and dealing with ACPI Power Resources. This commit adds +a workaround which runtime-suspends the chip to turn it off, leaving it up +to the ACPI subsystem to deal with all the ACPI specific details. + +There is no good way to detect this bug, so the workaround gets activated +by a new "silead,stuck-controller-bug" boolean device-property. Since this +is only used on x86/ACPI, this will be set by model specific device-props +set by drivers/platform/x86/touchscreen_dmi.c. Therefor this new +device-property is not documented in the DT-bindings. + +Dmesg will contain the following messages on systems where the workaround +is activated: + +[ 54.309029] silead_ts i2c-MSSL1680:00: [Firmware Bug]: Stuck I2C bus: please ignore the next 'controller timed out' error +[ 55.373593] i2c_designware 808622C1:04: controller timed out +[ 55.582186] silead_ts i2c-MSSL1680:00: Silead chip ID: 0x80360000 + +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20210405202745.16777-1-hdegoede@redhat.com +Signed-off-by: Dmitry Torokhov +Acked-by: Takashi Iwai + +--- + drivers/input/touchscreen/silead.c | 44 +++++++++++++++++++++++++++--- + 1 file changed, 40 insertions(+), 4 deletions(-) + +diff --git a/drivers/input/touchscreen/silead.c b/drivers/input/touchscreen/silead.c +index 32725d7422de..1ee760bac0cf 100644 +--- a/drivers/input/touchscreen/silead.c ++++ b/drivers/input/touchscreen/silead.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -335,10 +336,8 @@ static int silead_ts_get_id(struct i2c_client *client) + + error = i2c_smbus_read_i2c_block_data(client, SILEAD_REG_ID, + sizeof(chip_id), (u8 *)&chip_id); +- if (error < 0) { +- dev_err(&client->dev, "Chip ID read error %d\n", error); ++ if (error < 0) + return error; +- } + + data->chip_id = le32_to_cpu(chip_id); + dev_info(&client->dev, "Silead chip ID: 0x%8X", data->chip_id); +@@ -351,12 +350,49 @@ static int silead_ts_setup(struct i2c_client *client) + int error; + u32 status; + ++ /* ++ * Some buggy BIOS-es bring up the chip in a stuck state where it ++ * blocks the I2C bus. The following steps are necessary to ++ * unstuck the chip / bus: ++ * 1. Turn off the Silead chip. ++ * 2. Try to do an I2C transfer with the chip, this will fail in ++ * response to which the I2C-bus-driver will call: ++ * i2c_recover_bus() which will unstuck the I2C-bus. Note the ++ * unstuck-ing of the I2C bus only works if we first drop the ++ * chip off the bus by turning it off. ++ * 3. Turn the chip back on. ++ * ++ * On the x86/ACPI systems were this problem is seen, step 1. and ++ * 3. require making ACPI calls and dealing with ACPI Power ++ * Resources. The workaround below runtime-suspends the chip to ++ * turn it off, leaving it up to the ACPI subsystem to deal with ++ * this. ++ */ ++ ++ if (device_property_read_bool(&client->dev, ++ "silead,stuck-controller-bug")) { ++ pm_runtime_set_active(&client->dev); ++ pm_runtime_enable(&client->dev); ++ pm_runtime_allow(&client->dev); ++ ++ pm_runtime_suspend(&client->dev); ++ ++ dev_warn(&client->dev, FW_BUG "Stuck I2C bus: please ignore the next 'controller timed out' error\n"); ++ silead_ts_get_id(client); ++ ++ /* The forbid will also resume the device */ ++ pm_runtime_forbid(&client->dev); ++ pm_runtime_disable(&client->dev); ++ } ++ + silead_ts_set_power(client, SILEAD_POWER_OFF); + silead_ts_set_power(client, SILEAD_POWER_ON); + + error = silead_ts_get_id(client); +- if (error) ++ if (error) { ++ dev_err(&client->dev, "Chip ID read error %d\n", error); + return error; ++ } + + error = silead_ts_init(client); + if (error) +-- +2.26.2 + diff --git a/patches.suse/NFC-nci-fix-memory-leak-in-nci_allocate_device.patch b/patches.suse/NFC-nci-fix-memory-leak-in-nci_allocate_device.patch new file mode 100644 index 0000000..962fb8c --- /dev/null +++ b/patches.suse/NFC-nci-fix-memory-leak-in-nci_allocate_device.patch @@ -0,0 +1,90 @@ +From e0652f8bb44d6294eeeac06d703185357f25d50b Mon Sep 17 00:00:00 2001 +From: Dongliang Mu +Date: Sat, 15 May 2021 07:29:06 +0800 +Subject: [PATCH] NFC: nci: fix memory leak in nci_allocate_device +Git-commit: e0652f8bb44d6294eeeac06d703185357f25d50b +Patch-mainline: v5.13-rc4 +References: git-fixes + +nfcmrvl_disconnect fails to free the hci_dev field in struct nci_dev. +Fix this by freeing hci_dev in nci_free_device. + +Bug: memory leak +unreferenced object 0xffff888111ea6800 (size 1024): + comm "kworker/1:0", pid 19, jiffies 4294942308 (age 13.580s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 60 fd 0c 81 88 ff ff .........`...... + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<000000004bc25d43>] kmalloc include/linux/slab.h:552 [inline] + [<000000004bc25d43>] kzalloc include/linux/slab.h:682 [inline] + [<000000004bc25d43>] nci_hci_allocate+0x21/0xd0 net/nfc/nci/hci.c:784 + [<00000000c59cff92>] nci_allocate_device net/nfc/nci/core.c:1170 [inline] + [<00000000c59cff92>] nci_allocate_device+0x10b/0x160 net/nfc/nci/core.c:1132 + [<00000000006e0a8e>] nfcmrvl_nci_register_dev+0x10a/0x1c0 drivers/nfc/nfcmrvl/main.c:153 + [<000000004da1b57e>] nfcmrvl_probe+0x223/0x290 drivers/nfc/nfcmrvl/usb.c:345 + [<00000000d506aed9>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 + [<00000000bc632c92>] really_probe+0x159/0x4a0 drivers/base/dd.c:554 + [<00000000f5009125>] driver_probe_device+0x84/0x100 drivers/base/dd.c:740 + [<000000000ce658ca>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:846 + [<000000007067d05f>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431 + [<00000000f8e13372>] __device_attach+0x122/0x250 drivers/base/dd.c:914 + [<000000009cf68860>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491 + [<00000000359c965a>] device_add+0x5be/0xc30 drivers/base/core.c:3109 + [<00000000086e4bd3>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164 + [<00000000ca036872>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238 + [<00000000d40d36f6>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293 + [<00000000bc632c92>] really_probe+0x159/0x4a0 drivers/base/dd.c:554 + +Reported-by: syzbot+19bcfc64a8df1318d1c3@syzkaller.appspotmail.com +Fixes: 11f54f228643 ("NFC: nci: Add HCI over NCI protocol support") +Signed-off-by: Dongliang Mu +Signed-off-by: David S. Miller +Acked-by: Takashi Iwai + +--- + include/net/nfc/nci_core.h | 1 + + net/nfc/nci/core.c | 1 + + net/nfc/nci/hci.c | 5 +++++ + 3 files changed, 7 insertions(+) + +diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h +index bd76e8e082c0..1df0f8074c9d 100644 +--- a/include/net/nfc/nci_core.h ++++ b/include/net/nfc/nci_core.h +@@ -298,6 +298,7 @@ int nci_nfcc_loopback(struct nci_dev *ndev, void *data, size_t data_len, + struct sk_buff **resp); + + struct nci_hci_dev *nci_hci_allocate(struct nci_dev *ndev); ++void nci_hci_deallocate(struct nci_dev *ndev); + int nci_hci_send_event(struct nci_dev *ndev, u8 gate, u8 event, + const u8 *param, size_t param_len); + int nci_hci_send_cmd(struct nci_dev *ndev, u8 gate, +diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c +index 9a585332ea84..da7fe9db1b00 100644 +--- a/net/nfc/nci/core.c ++++ b/net/nfc/nci/core.c +@@ -1191,6 +1191,7 @@ EXPORT_SYMBOL(nci_allocate_device); + void nci_free_device(struct nci_dev *ndev) + { + nfc_free_device(ndev->nfc_dev); ++ nci_hci_deallocate(ndev); + kfree(ndev); + } + EXPORT_SYMBOL(nci_free_device); +diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c +index 6b275a387a92..96865142104f 100644 +--- a/net/nfc/nci/hci.c ++++ b/net/nfc/nci/hci.c +@@ -792,3 +792,8 @@ struct nci_hci_dev *nci_hci_allocate(struct nci_dev *ndev) + + return hdev; + } ++ ++void nci_hci_deallocate(struct nci_dev *ndev) ++{ ++ kfree(ndev->hci_dev); ++} +-- +2.26.2 + diff --git a/patches.suse/NFC-nxp-nci-Add-GPIO-ACPI-mapping-table.patch b/patches.suse/NFC-nxp-nci-Add-GPIO-ACPI-mapping-table.patch new file mode 100644 index 0000000..7f06582 --- /dev/null +++ b/patches.suse/NFC-nxp-nci-Add-GPIO-ACPI-mapping-table.patch @@ -0,0 +1,62 @@ +From 099d03f02dbffe1575d86063b2bf416502faa5e9 Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Mon, 29 Jul 2019 16:35:05 +0300 +Subject: [PATCH] NFC: nxp-nci: Add GPIO ACPI mapping table +Git-commit: 099d03f02dbffe1575d86063b2bf416502faa5e9 +References: bsc#1185589 +Patch-mainline: v5.4-rc1 + +In order to unify GPIO resource request prepare gpiod_get_index() +to behave correctly when there is no mapping provided by firmware. + +Here we add explicit mapping between _CRS GpioIo() resources and +their names used in the driver. + +Signed-off-by: Andy Shevchenko +Tested-by: Sedat Dilek +Signed-off-by: David S. Miller +Signed-off-by: Oliver Neukum +--- + drivers/nfc/nxp-nci/i2c.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c +index 713c267acf88..7344405feddf 100644 +--- a/drivers/nfc/nxp-nci/i2c.c ++++ b/drivers/nfc/nxp-nci/i2c.c +@@ -247,6 +247,15 @@ static irqreturn_t nxp_nci_i2c_irq_thread_fn(int irq, void *phy_id) + return IRQ_NONE; + } + ++static const struct acpi_gpio_params firmware_gpios = { 1, 0, false }; ++static const struct acpi_gpio_params enable_gpios = { 2, 0, false }; ++ ++static const struct acpi_gpio_mapping acpi_nxp_nci_gpios[] = { ++ { "enable-gpios", &enable_gpios, 1 }, ++ { "firmware-gpios", &firmware_gpios, 1 }, ++ { } ++}; ++ + static int nxp_nci_i2c_parse_devtree(struct i2c_client *client) + { + struct nxp_nci_i2c_phy *phy = i2c_get_clientdata(client); +@@ -269,9 +278,14 @@ static int nxp_nci_i2c_parse_devtree(struct i2c_client *client) + static int nxp_nci_i2c_acpi_config(struct nxp_nci_i2c_phy *phy) + { + struct i2c_client *client = phy->i2c_dev; ++ int r; + +- phy->gpiod_en = devm_gpiod_get_index(&client->dev, NULL, 2, GPIOD_OUT_LOW); +- phy->gpiod_fw = devm_gpiod_get_index(&client->dev, NULL, 1, GPIOD_OUT_LOW); ++ r = devm_acpi_dev_add_driver_gpios(&client->dev, acpi_nxp_nci_gpios); ++ if (r) ++ return r; ++ ++ phy->gpiod_en = devm_gpiod_get(&client->dev, "enable", GPIOD_OUT_LOW); ++ phy->gpiod_fw = devm_gpiod_get(&client->dev, "firmware", GPIOD_OUT_LOW); + + if (IS_ERR(phy->gpiod_en) || IS_ERR(phy->gpiod_fw)) { + nfc_err(&client->dev, "No GPIOs\n"); +-- +2.26.2 + diff --git a/patches.suse/NFC-nxp-nci-Add-NXP1001-to-the-ACPI-ID-table.patch b/patches.suse/NFC-nxp-nci-Add-NXP1001-to-the-ACPI-ID-table.patch new file mode 100644 index 0000000..d3b650b --- /dev/null +++ b/patches.suse/NFC-nxp-nci-Add-NXP1001-to-the-ACPI-ID-table.patch @@ -0,0 +1,37 @@ +From 1b14a37565d9e88b82b8a227690e5fbc0079b61b Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Mon, 29 Jul 2019 16:35:02 +0300 +Subject: [PATCH] NFC: nxp-nci: Add NXP1001 to the ACPI ID table +Patch-mainline: v5.4-rc1 +References: bsc#1185589 +Git-commit: 1b14a37565d9e88b82b8a227690e5fbc0079b61b + +It seems a lot of laptops are equipped with NXP NFC300 chip with +the ACPI ID NXP1001 as per DSDT. + +Append it to the driver's ACPI ID table. + +Reported-by: Sedat Dilek +Signed-off-by: Andy Shevchenko +Tested-by: Sedat Dilek +Signed-off-by: David S. Miller +Signed-off-by: Oliver Neukum +--- + drivers/nfc/nxp-nci/i2c.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c +index 4aeb3861b409..5db71869f04b 100644 +--- a/drivers/nfc/nxp-nci/i2c.c ++++ b/drivers/nfc/nxp-nci/i2c.c +@@ -396,6 +396,7 @@ MODULE_DEVICE_TABLE(of, of_nxp_nci_i2c_match); + + #ifdef CONFIG_ACPI + static struct acpi_device_id acpi_id[] = { ++ { "NXP1001" }, + { "NXP7471" }, + { }, + }; +-- +2.26.2 + diff --git a/patches.suse/NFC-nxp-nci-Convert-to-use-GPIO-descriptor.patch b/patches.suse/NFC-nxp-nci-Convert-to-use-GPIO-descriptor.patch new file mode 100644 index 0000000..fe07010 --- /dev/null +++ b/patches.suse/NFC-nxp-nci-Convert-to-use-GPIO-descriptor.patch @@ -0,0 +1,157 @@ +From 43201767b44cbd873c60dbd2acd370147588cb18 Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Mon, 29 Jul 2019 16:35:04 +0300 +Subject: [PATCH] NFC: nxp-nci: Convert to use GPIO descriptor +Git-commit: 43201767b44cbd873c60dbd2acd370147588cb18 +References: bsc#1185589 +Patch-mainline: v5.4-rc1 + +Since we got rid of platform data, the driver may use +GPIO descriptor directly. + +Signed-off-by: Andy Shevchenko +Tested-by: Sedat Dilek +Signed-off-by: David S. Miller +Signed-off-by: Oliver Neukum +--- + drivers/nfc/nxp-nci/core.c | 1 - + drivers/nfc/nxp-nci/i2c.c | 60 ++++++++++---------------------------- + 2 files changed, 15 insertions(+), 46 deletions(-) + +diff --git a/drivers/nfc/nxp-nci/core.c b/drivers/nfc/nxp-nci/core.c +index aed18ca60170..a0ce95a287c5 100644 +--- a/drivers/nfc/nxp-nci/core.c ++++ b/drivers/nfc/nxp-nci/core.c +@@ -11,7 +11,6 @@ + */ + + #include +-#include + #include + #include + +diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c +index 47b3b7e612e6..713c267acf88 100644 +--- a/drivers/nfc/nxp-nci/i2c.c ++++ b/drivers/nfc/nxp-nci/i2c.c +@@ -21,8 +21,6 @@ + #include + #include + #include +-#include +-#include + #include + + #include +@@ -37,8 +35,8 @@ struct nxp_nci_i2c_phy { + struct i2c_client *i2c_dev; + struct nci_dev *ndev; + +- unsigned int gpio_en; +- unsigned int gpio_fw; ++ struct gpio_desc *gpiod_en; ++ struct gpio_desc *gpiod_fw; + + int hard_fault; /* + * < 0 if hardware error occurred (e.g. i2c err) +@@ -51,8 +49,8 @@ static int nxp_nci_i2c_set_mode(void *phy_id, + { + struct nxp_nci_i2c_phy *phy = (struct nxp_nci_i2c_phy *) phy_id; + +- gpio_set_value(phy->gpio_fw, (mode == NXP_NCI_MODE_FW) ? 1 : 0); +- gpio_set_value(phy->gpio_en, (mode != NXP_NCI_MODE_COLD) ? 1 : 0); ++ gpiod_set_value(phy->gpiod_fw, (mode == NXP_NCI_MODE_FW) ? 1 : 0); ++ gpiod_set_value(phy->gpiod_en, (mode != NXP_NCI_MODE_COLD) ? 1 : 0); + usleep_range(10000, 15000); + + if (mode == NXP_NCI_MODE_COLD) +@@ -252,30 +250,18 @@ static irqreturn_t nxp_nci_i2c_irq_thread_fn(int irq, void *phy_id) + static int nxp_nci_i2c_parse_devtree(struct i2c_client *client) + { + struct nxp_nci_i2c_phy *phy = i2c_get_clientdata(client); +- struct device_node *pp; +- int r; +- +- pp = client->dev.of_node; +- if (!pp) +- return -ENODEV; + +- r = of_get_named_gpio(pp, "enable-gpios", 0); +- if (r == -EPROBE_DEFER) +- r = of_get_named_gpio(pp, "enable-gpios", 0); +- if (r < 0) { +- nfc_err(&client->dev, "Failed to get EN gpio, error: %d\n", r); +- return r; ++ phy->gpiod_en = devm_gpiod_get(&client->dev, "enable", GPIOD_OUT_LOW); ++ if (IS_ERR(phy->gpiod_en)) { ++ nfc_err(&client->dev, "Failed to get EN gpio\n"); ++ return PTR_ERR(phy->gpiod_en); + } +- phy->gpio_en = r; + +- r = of_get_named_gpio(pp, "firmware-gpios", 0); +- if (r == -EPROBE_DEFER) +- r = of_get_named_gpio(pp, "firmware-gpios", 0); +- if (r < 0) { +- nfc_err(&client->dev, "Failed to get FW gpio, error: %d\n", r); +- return r; ++ phy->gpiod_fw = devm_gpiod_get(&client->dev, "firmware", GPIOD_OUT_LOW); ++ if (IS_ERR(phy->gpiod_fw)) { ++ nfc_err(&client->dev, "Failed to get FW gpio\n"); ++ return PTR_ERR(phy->gpiod_fw); + } +- phy->gpio_fw = r; + + return 0; + } +@@ -283,19 +269,15 @@ static int nxp_nci_i2c_parse_devtree(struct i2c_client *client) + static int nxp_nci_i2c_acpi_config(struct nxp_nci_i2c_phy *phy) + { + struct i2c_client *client = phy->i2c_dev; +- struct gpio_desc *gpiod_en, *gpiod_fw; + +- gpiod_en = devm_gpiod_get_index(&client->dev, NULL, 2, GPIOD_OUT_LOW); +- gpiod_fw = devm_gpiod_get_index(&client->dev, NULL, 1, GPIOD_OUT_LOW); ++ phy->gpiod_en = devm_gpiod_get_index(&client->dev, NULL, 2, GPIOD_OUT_LOW); ++ phy->gpiod_fw = devm_gpiod_get_index(&client->dev, NULL, 1, GPIOD_OUT_LOW); + +- if (IS_ERR(gpiod_en) || IS_ERR(gpiod_fw)) { ++ if (IS_ERR(phy->gpiod_en) || IS_ERR(phy->gpiod_fw)) { + nfc_err(&client->dev, "No GPIOs\n"); + return -EINVAL; + } + +- phy->gpio_en = desc_to_gpio(gpiod_en); +- phy->gpio_fw = desc_to_gpio(gpiod_fw); +- + return 0; + } + +@@ -331,24 +313,12 @@ static int nxp_nci_i2c_probe(struct i2c_client *client, + r = nxp_nci_i2c_acpi_config(phy); + if (r < 0) + goto probe_exit; +- goto nci_probe; + } else { + nfc_err(&client->dev, "No platform data\n"); + r = -EINVAL; + goto probe_exit; + } + +- r = devm_gpio_request_one(&phy->i2c_dev->dev, phy->gpio_en, +- GPIOF_OUT_INIT_LOW, "nxp_nci_en"); +- if (r < 0) +- goto probe_exit; +- +- r = devm_gpio_request_one(&phy->i2c_dev->dev, phy->gpio_fw, +- GPIOF_OUT_INIT_LOW, "nxp_nci_fw"); +- if (r < 0) +- goto probe_exit; +- +-nci_probe: + r = nxp_nci_probe(phy, &client->dev, &i2c_phy_ops, + NXP_NCI_I2C_MAX_PAYLOAD, &phy->ndev); + if (r < 0) +-- +2.26.2 + diff --git a/patches.suse/NFC-nxp-nci-Get-rid-of-platform-data.patch b/patches.suse/NFC-nxp-nci-Get-rid-of-platform-data.patch new file mode 100644 index 0000000..6930755 --- /dev/null +++ b/patches.suse/NFC-nxp-nci-Get-rid-of-platform-data.patch @@ -0,0 +1,130 @@ +From 3b0b278312ba7d6c1eb8b2fb48d459fb7f341a20 Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Mon, 29 Jul 2019 16:35:03 +0300 +Subject: [PATCH] NFC: nxp-nci: Get rid of platform data +Git-commit: 3b0b278312ba7d6c1eb8b2fb48d459fb7f341a20 +References: bsc#1185589 +Patch-mainline: v5.4-rc1 + +Legacy platform data must go away. We are on the safe side here since +there are no users of it in the kernel. + +If anyone by any odd reason needs it the GPIO lookup tables and +built-in device properties at your service. + +Signed-off-by: Andy Shevchenko +Tested-by: Sedat Dilek +Signed-off-by: David S. Miller +Signed-off-by: Oliver Neukum +--- + MAINTAINERS | 1 - + drivers/nfc/nxp-nci/core.c | 1 - + drivers/nfc/nxp-nci/i2c.c | 9 +-------- + drivers/nfc/nxp-nci/nxp-nci.h | 1 - + include/linux/platform_data/nxp-nci.h | 19 ------------------- + 5 files changed, 1 insertion(+), 30 deletions(-) + delete mode 100644 include/linux/platform_data/nxp-nci.h + +diff --git a/MAINTAINERS b/MAINTAINERS +index 9cc156c58f0c..ee663e0e2f2e 100644 +--- a/MAINTAINERS ++++ b/MAINTAINERS +@@ -11327,7 +11327,6 @@ F: include/net/nfc/ + F: include/uapi/linux/nfc.h + F: drivers/nfc/ + F: include/linux/platform_data/nfcmrvl.h +-F: include/linux/platform_data/nxp-nci.h + F: Documentation/devicetree/bindings/net/nfc/ + + NFS, SUNRPC, AND LOCKD CLIENTS +diff --git a/drivers/nfc/nxp-nci/core.c b/drivers/nfc/nxp-nci/core.c +index 8dafc696719f..aed18ca60170 100644 +--- a/drivers/nfc/nxp-nci/core.c ++++ b/drivers/nfc/nxp-nci/core.c +@@ -14,7 +14,6 @@ + #include + #include + #include +-#include + + #include + +diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c +index 5db71869f04b..47b3b7e612e6 100644 +--- a/drivers/nfc/nxp-nci/i2c.c ++++ b/drivers/nfc/nxp-nci/i2c.c +@@ -23,7 +23,6 @@ + #include + #include + #include +-#include + #include + + #include +@@ -304,7 +303,6 @@ static int nxp_nci_i2c_probe(struct i2c_client *client, + const struct i2c_device_id *id) + { + struct nxp_nci_i2c_phy *phy; +- struct nxp_nci_nfc_platform_data *pdata; + int r; + + if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) { +@@ -323,17 +321,12 @@ static int nxp_nci_i2c_probe(struct i2c_client *client, + phy->i2c_dev = client; + i2c_set_clientdata(client, phy); + +- pdata = client->dev.platform_data; +- +- if (!pdata && client->dev.of_node) { ++ if (client->dev.of_node) { + r = nxp_nci_i2c_parse_devtree(client); + if (r < 0) { + nfc_err(&client->dev, "Failed to get DT data\n"); + goto probe_exit; + } +- } else if (pdata) { +- phy->gpio_en = pdata->gpio_en; +- phy->gpio_fw = pdata->gpio_fw; + } else if (ACPI_HANDLE(&client->dev)) { + r = nxp_nci_i2c_acpi_config(phy); + if (r < 0) +diff --git a/drivers/nfc/nxp-nci/nxp-nci.h b/drivers/nfc/nxp-nci/nxp-nci.h +index 6fe7c45544bf..ae3fb2735a4e 100644 +--- a/drivers/nfc/nxp-nci/nxp-nci.h ++++ b/drivers/nfc/nxp-nci/nxp-nci.h +@@ -14,7 +14,6 @@ + #include + #include + #include +-#include + + #include + +diff --git a/include/linux/platform_data/nxp-nci.h b/include/linux/platform_data/nxp-nci.h +deleted file mode 100644 +index 97827ad468e2..000000000000 +--- a/include/linux/platform_data/nxp-nci.h ++++ /dev/null +@@ -1,19 +0,0 @@ +-/* SPDX-License-Identifier: GPL-2.0-only */ +-/* +- * Generic platform data for the NXP NCI NFC chips. +- * +- * Copyright (C) 2014 NXP Semiconductors All rights reserved. +- * +- * Authors: Clément Perrochaud +- */ +- +-#ifndef _NXP_NCI_H_ +-#define _NXP_NCI_H_ +- +-struct nxp_nci_nfc_platform_data { +- unsigned int gpio_en; +- unsigned int gpio_fw; +- unsigned int irq; +-}; +- +-#endif /* _NXP_NCI_H_ */ +-- +2.26.2 + diff --git a/patches.suse/PCI-thunder-Fix-compile-testing.patch b/patches.suse/PCI-thunder-Fix-compile-testing.patch new file mode 100644 index 0000000..0007d0e --- /dev/null +++ b/patches.suse/PCI-thunder-Fix-compile-testing.patch @@ -0,0 +1,92 @@ +From 16f7ae5906dfbeff54f74ec75d0563bb3a87ab0b Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 8 Mar 2021 16:24:47 +0100 +Subject: [PATCH] PCI: thunder: Fix compile testing +Git-commit: 16f7ae5906dfbeff54f74ec75d0563bb3a87ab0b +Patch-mainline: v5.13-rc1 +References: git-fixes + +Compile-testing these drivers is currently broken. Enabling it causes a +couple of build failures though: + + drivers/pci/controller/pci-thunder-ecam.c:119:30: error: shift count >= width of type [-Werror,-Wshift-count-overflow] + drivers/pci/controller/pci-thunder-pem.c:54:2: error: implicit declaration of function 'writeq' [-Werror,-Wimplicit-function-declaration] + drivers/pci/controller/pci-thunder-pem.c:392:8: error: implicit declaration of function 'acpi_get_rc_resources' [-Werror,-Wimplicit-function-declaration] + +Fix them with the obvious one-line changes. + +Link: https://lore.kernel.org/r/20210308152501.2135937-2-arnd@kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Bjorn Helgaas +Reviewed-by: Kuppuswamy Sathyanarayanan +Reviewed-by: Robert Richter +Acked-by: Takashi Iwai + +--- + drivers/pci/controller/pci-thunder-ecam.c | 2 +- + drivers/pci/controller/pci-thunder-pem.c | 13 +++++++------ + drivers/pci/pci.h | 6 ++++++ + 3 files changed, 14 insertions(+), 7 deletions(-) + +--- a/drivers/pci/controller/pci-thunder-ecam.c ++++ b/drivers/pci/controller/pci-thunder-ecam.c +@@ -116,7 +116,7 @@ static int thunder_ecam_p2_config_read(s + * the config space access window. Since we are working with + * the high-order 32 bits, shift everything down by 32 bits. + */ +- node_bits = (cfg->res.start >> 32) & (1 << 12); ++ node_bits = upper_32_bits(cfg->res.start) & (1 << 12); + + v |= node_bits; + set_val(v, where, size, val); +--- a/drivers/pci/controller/pci-thunder-pem.c ++++ b/drivers/pci/controller/pci-thunder-pem.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + #include "../pci.h" + + #if defined(CONFIG_PCI_HOST_THUNDER_PEM) || (defined(CONFIG_ACPI) && defined(CONFIG_PCI_QUIRKS)) +@@ -314,9 +315,9 @@ static int thunder_pem_init(struct devic + * structure here for the BAR. + */ + bar4_start = res_pem->start + 0xf00000; +- pem_pci->ea_entry[0] = (u32)bar4_start | 2; +- pem_pci->ea_entry[1] = (u32)(res_pem->end - bar4_start) & ~3u; +- pem_pci->ea_entry[2] = (u32)(bar4_start >> 32); ++ pem_pci->ea_entry[0] = lower_32_bits(bar4_start) | 2; ++ pem_pci->ea_entry[1] = lower_32_bits(res_pem->end - bar4_start) & ~3u; ++ pem_pci->ea_entry[2] = upper_32_bits(bar4_start); + + cfg->priv = pem_pci; + return 0; +@@ -324,9 +325,9 @@ static int thunder_pem_init(struct devic + + #if defined(CONFIG_ACPI) && defined(CONFIG_PCI_QUIRKS) + +-#define PEM_RES_BASE 0x87e0c0000000UL +-#define PEM_NODE_MASK GENMASK(45, 44) +-#define PEM_INDX_MASK GENMASK(26, 24) ++#define PEM_RES_BASE 0x87e0c0000000ULL ++#define PEM_NODE_MASK GENMASK_ULL(45, 44) ++#define PEM_INDX_MASK GENMASK_ULL(26, 24) + #define PEM_MIN_DOM_IN_NODE 4 + #define PEM_MAX_DOM_IN_NODE 10 + +--- a/drivers/pci/pci.h ++++ b/drivers/pci/pci.h +@@ -575,6 +575,12 @@ static inline int pci_dev_specific_reset + #if defined(CONFIG_PCI_QUIRKS) && defined(CONFIG_ARM64) + int acpi_get_rc_resources(struct device *dev, const char *hid, u16 segment, + struct resource *res); ++#else ++static inline int acpi_get_rc_resources(struct device *dev, const char *hid, ++ u16 segment, struct resource *res) ++{ ++ return -ENODEV; ++} + #endif + + u32 pci_rebar_get_possible_sizes(struct pci_dev *pdev, int bar); diff --git a/patches.suse/Revert-arm64-vdso-Fix-compilation-with-clang-older-t.patch b/patches.suse/Revert-arm64-vdso-Fix-compilation-with-clang-older-t.patch new file mode 100644 index 0000000..5b0fb26 --- /dev/null +++ b/patches.suse/Revert-arm64-vdso-Fix-compilation-with-clang-older-t.patch @@ -0,0 +1,55 @@ +From: Nick Desaulniers +Date: Tue, 13 Oct 2020 16:47:44 -0700 +Subject: Revert "arm64: vdso: Fix compilation with clang older than 8" + +Git-commit: 3759da22e5c0dfc25ee5296ca470262204ba35a8 +Patch-mainline: v5.10-rc1 +References: git-fixes + +This reverts commit 3acf4be235280f14d838581a750532219d67facc. + +The minimum supported version of clang is clang 10.0.1. + +Suggested-by: Nathan Chancellor +Signed-off-by: Nick Desaulniers +Signed-off-by: Andrew Morton +Reviewed-by: Kees Cook +Reviewed-by: Nathan Chancellor +Cc: Andrey Konovalov +Cc: Fangrui Song +Cc: Marco Elver +Cc: Miguel Ojeda +Cc: Sedat Dilek +Cc: Alexei Starovoitov +Cc: Daniel Borkmann +Cc: Masahiro Yamada +Cc: Vincenzo Frascino +Cc: Will Deacon +Link: https://lkml.kernel.org/r/20200902225911.209899-5-ndesaulniers@google.com +Signed-off-by: Linus Torvalds +Signed-off-by: Mian Yousaf Kaukab +--- + arch/arm64/kernel/vdso/Makefile | 7 ------- + 1 file changed, 7 deletions(-) + +diff --git a/arch/arm64/kernel/vdso/Makefile b/arch/arm64/kernel/vdso/Makefile +index 45d5cfe46429..04021a93171c 100644 +--- a/arch/arm64/kernel/vdso/Makefile ++++ b/arch/arm64/kernel/vdso/Makefile +@@ -43,13 +43,6 @@ ifneq ($(c-gettimeofday-y),) + CFLAGS_vgettimeofday.o += -include $(c-gettimeofday-y) + endif + +-# Clang versions less than 8 do not support -mcmodel=tiny +-ifeq ($(CONFIG_CC_IS_CLANG), y) +- ifeq ($(shell test $(CONFIG_CLANG_VERSION) -lt 80000; echo $$?),0) +- CFLAGS_REMOVE_vgettimeofday.o += -mcmodel=tiny +- endif +-endif +- + # Disable gcov profiling for VDSO code + GCOV_PROFILE := n + +-- +2.26.2 + diff --git a/patches.suse/Revert-gdrom-fix-a-memory-leak-bug.patch b/patches.suse/Revert-gdrom-fix-a-memory-leak-bug.patch new file mode 100644 index 0000000..9e327b5 --- /dev/null +++ b/patches.suse/Revert-gdrom-fix-a-memory-leak-bug.patch @@ -0,0 +1,52 @@ +From 257343d3ed557f11d580d0b7c515dc154f64a42b Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Mon, 3 May 2021 13:56:53 +0200 +Subject: [PATCH] Revert "gdrom: fix a memory leak bug" +Git-commit: 257343d3ed557f11d580d0b7c515dc154f64a42b +Patch-mainline: v5.13-rc3 +References: git-fixes + +This reverts commit 093c48213ee37c3c3ff1cf5ac1aa2a9d8bc66017. + +Because of recent interactions with developers from @umn.edu, all +commits from them have been recently re-reviewed to ensure if they were +correct or not. + +Upon review, this commit was found to be incorrect for the reasons +below, so it must be reverted. It will be fixed up "correctly" in a +later kernel change. + +Because of this, all submissions from this group must be reverted from +the kernel tree and will need to be re-reviewed again to determine if +they actually are a valid fix. Until that work is complete, remove this +change to ensure that no problems are being introduced into the +codebase. + +Cc: Wenwen Wang +Cc: Peter Rosin +Cc: Jens Axboe +Fixes: 093c48213ee3 ("gdrom: fix a memory leak bug") +Cc: stable +Link: https://lore.kernel.org/r/20210503115736.2104747-27-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/cdrom/gdrom.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c +index 742b4a0932e3..7f681320c7d3 100644 +--- a/drivers/cdrom/gdrom.c ++++ b/drivers/cdrom/gdrom.c +@@ -862,7 +862,6 @@ static void __exit exit_gdrom(void) + platform_device_unregister(pd); + platform_driver_unregister(&gdrom_driver); + kfree(gd.toc); +- kfree(gd.cd_info); + } + + module_init(init_gdrom); +-- +2.26.2 + diff --git a/patches.suse/Revert-leds-lp5523-fix-a-missing-check-of-return-val.patch b/patches.suse/Revert-leds-lp5523-fix-a-missing-check-of-return-val.patch new file mode 100644 index 0000000..5dfebd8 --- /dev/null +++ b/patches.suse/Revert-leds-lp5523-fix-a-missing-check-of-return-val.patch @@ -0,0 +1,51 @@ +From 8d1beda5f11953ffe135a5213287f0b25b4da41b Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Mon, 3 May 2021 13:56:35 +0200 +Subject: [PATCH] Revert "leds: lp5523: fix a missing check of return value of lp55xx_read" +Git-commit: 8d1beda5f11953ffe135a5213287f0b25b4da41b +Patch-mainline: v5.13-rc3 +References: git-fixes + +This reverts commit 248b57015f35c94d4eae2fdd8c6febf5cd703900. + +Because of recent interactions with developers from @umn.edu, all +commits from them have been recently re-reviewed to ensure if they were +correct or not. + +Upon review, this commit was found to be incorrect for the reasons +below, so it must be reverted. It will be fixed up "correctly" in a +later kernel change. + +The original commit does not properly unwind if there is an error +condition so it needs to be reverted at this point in time. + +Cc: Kangjie Lu +Cc: Jacek Anaszewski +Cc: stable +Fixes: 248b57015f35 ("leds: lp5523: fix a missing check of return value of lp55xx_read") +Link: https://lore.kernel.org/r/20210503115736.2104747-9-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/leds/leds-lp5523.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c +index fc433e63b1dc..5036d7d5f3d4 100644 +--- a/drivers/leds/leds-lp5523.c ++++ b/drivers/leds/leds-lp5523.c +@@ -305,9 +305,7 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip) + + /* Let the programs run for couple of ms and check the engine status */ + usleep_range(3000, 6000); +- ret = lp55xx_read(chip, LP5523_REG_STATUS, &status); +- if (ret) +- return ret; ++ lp55xx_read(chip, LP5523_REG_STATUS, &status); + status &= LP5523_ENG_STATUS_MASK; + + if (status != LP5523_ENG_STATUS_MASK) { +-- +2.26.2 + diff --git a/patches.suse/SUNRPC-More-fixes-for-backlog-congestion.patch b/patches.suse/SUNRPC-More-fixes-for-backlog-congestion.patch new file mode 100644 index 0000000..3db8468 --- /dev/null +++ b/patches.suse/SUNRPC-More-fixes-for-backlog-congestion.patch @@ -0,0 +1,229 @@ +From: Trond Myklebust +Date: Tue, 25 May 2021 18:43:38 -0400 +Subject: [PATCH] SUNRPC: More fixes for backlog congestion +Git-commit: e86be3a04bc4aeaf12f93af35f08f8d4385bcd98 +Patch-mainline: v5.13-rc4 +References: bsc#1185428 + +Ensure that we fix the XPRT_CONGESTED starvation issue for RDMA as well +as socket based transports. +Ensure we always initialise the request after waking up from the backlog +list. + +Fixes: e877a88d1f06 ("SUNRPC in case of backlog, hand free slots directly to waiting task") +Signed-off-by: Trond Myklebust +Acked-by: NeilBrown + +--- + include/linux/sunrpc/xprt.h | 2 + + net/sunrpc/xprt.c | 60 +++++++++++++++++++--------------------- + net/sunrpc/xprtrdma/transport.c | 12 ++++---- + net/sunrpc/xprtrdma/verbs.c | 18 ++++++++++-- + net/sunrpc/xprtrdma/xprt_rdma.h | 1 + 5 files changed, 53 insertions(+), 40 deletions(-) + +--- a/include/linux/sunrpc/xprt.h ++++ b/include/linux/sunrpc/xprt.h +@@ -377,6 +377,8 @@ struct rpc_xprt * xprt_alloc(struct net + unsigned int num_prealloc, + unsigned int max_req); + void xprt_free(struct rpc_xprt *); ++void xprt_add_backlog(struct rpc_xprt *xprt, struct rpc_task *task); ++bool xprt_wake_up_backlog(struct rpc_xprt *xprt, struct rpc_rqst *req); + + static inline int + xprt_enable_swap(struct rpc_xprt *xprt) +--- a/net/sunrpc/xprt.c ++++ b/net/sunrpc/xprt.c +@@ -1542,11 +1542,18 @@ xprt_transmit(struct rpc_task *task) + spin_unlock(&xprt->queue_lock); + } + +-static void xprt_add_backlog(struct rpc_xprt *xprt, struct rpc_task *task) ++static void xprt_complete_request_init(struct rpc_task *task) ++{ ++ if (task->tk_rqstp) ++ xprt_request_init(task); ++} ++ ++void xprt_add_backlog(struct rpc_xprt *xprt, struct rpc_task *task) + { + set_bit(XPRT_CONGESTED, &xprt->state); +- rpc_sleep_on(&xprt->backlog, task, NULL); ++ rpc_sleep_on(&xprt->backlog, task, xprt_complete_request_init); + } ++EXPORT_SYMBOL_GPL(xprt_add_backlog); + + static bool __xprt_set_rq(struct rpc_task *task, void *data) + { +@@ -1554,14 +1561,13 @@ static bool __xprt_set_rq(struct rpc_tas + + if (task->tk_rqstp == NULL) { + memset(req, 0, sizeof(*req)); /* mark unused */ +- task->tk_status = -EAGAIN; + task->tk_rqstp = req; + return true; + } + return false; + } + +-static bool xprt_wake_up_backlog(struct rpc_xprt *xprt, struct rpc_rqst *req) ++bool xprt_wake_up_backlog(struct rpc_xprt *xprt, struct rpc_rqst *req) + { + if (rpc_wake_up_first(&xprt->backlog, __xprt_set_rq, req) == NULL) { + clear_bit(XPRT_CONGESTED, &xprt->state); +@@ -1569,6 +1575,7 @@ static bool xprt_wake_up_backlog(struct + } + return true; + } ++EXPORT_SYMBOL_GPL(xprt_wake_up_backlog); + + static bool xprt_throttle_congested(struct rpc_xprt *xprt, struct rpc_task *task) + { +@@ -1578,7 +1585,7 @@ static bool xprt_throttle_congested(stru + goto out; + spin_lock(&xprt->reserve_lock); + if (test_bit(XPRT_CONGESTED, &xprt->state)) { +- rpc_sleep_on(&xprt->backlog, task, NULL); ++ xprt_add_backlog(xprt, task); + ret = true; + } + spin_unlock(&xprt->reserve_lock); +@@ -1747,10 +1754,6 @@ xprt_request_init(struct rpc_task *task) + struct rpc_xprt *xprt = task->tk_xprt; + struct rpc_rqst *req = task->tk_rqstp; + +- if (req->rq_task) +- /* Already initialized */ +- return; +- + req->rq_task = task; + req->rq_xprt = xprt; + req->rq_buffer = NULL; +@@ -1811,10 +1814,8 @@ void xprt_retry_reserve(struct rpc_task + struct rpc_xprt *xprt = task->tk_xprt; + + task->tk_status = 0; +- if (task->tk_rqstp != NULL) { +- xprt_request_init(task); ++ if (task->tk_rqstp != NULL) + return; +- } + + task->tk_status = -EAGAIN; + xprt_do_reserve(xprt, task); +@@ -1839,25 +1840,22 @@ void xprt_release(struct rpc_task *task) + } + + xprt = req->rq_xprt; +- if (xprt) { +- xprt_request_dequeue_xprt(task); +- spin_lock(&xprt->transport_lock); +- xprt->ops->release_xprt(xprt, task); +- if (xprt->ops->release_request) +- xprt->ops->release_request(task); +- xprt_schedule_autodisconnect(xprt); +- spin_unlock(&xprt->transport_lock); +- if (req->rq_buffer) +- xprt->ops->buf_free(task); +- xprt_inject_disconnect(xprt); +- xdr_free_bvec(&req->rq_rcv_buf); +- xdr_free_bvec(&req->rq_snd_buf); +- if (req->rq_cred != NULL) +- put_rpccred(req->rq_cred); +- if (req->rq_release_snd_buf) +- req->rq_release_snd_buf(req); +- } else +- xprt = task->tk_xprt; ++ xprt_request_dequeue_xprt(task); ++ spin_lock(&xprt->transport_lock); ++ xprt->ops->release_xprt(xprt, task); ++ if (xprt->ops->release_request) ++ xprt->ops->release_request(task); ++ xprt_schedule_autodisconnect(xprt); ++ spin_unlock(&xprt->transport_lock); ++ if (req->rq_buffer) ++ xprt->ops->buf_free(task); ++ xprt_inject_disconnect(xprt); ++ xdr_free_bvec(&req->rq_rcv_buf); ++ xdr_free_bvec(&req->rq_snd_buf); ++ if (req->rq_cred != NULL) ++ put_rpccred(req->rq_cred); ++ if (req->rq_release_snd_buf) ++ req->rq_release_snd_buf(req); + + task->tk_rqstp = NULL; + dprintk("RPC: %5u release request %p\n", task->tk_pid, req); +--- a/net/sunrpc/xprtrdma/transport.c ++++ b/net/sunrpc/xprtrdma/transport.c +@@ -557,9 +557,8 @@ xprt_rdma_alloc_slot(struct rpc_xprt *xp + return; + + out_sleep: +- set_bit(XPRT_CONGESTED, &xprt->state); +- rpc_sleep_on(&xprt->backlog, task, NULL); + task->tk_status = -EAGAIN; ++ xprt_add_backlog(xprt, task); + } + + /** +@@ -574,10 +573,11 @@ xprt_rdma_free_slot(struct rpc_xprt *xpr + struct rpcrdma_xprt *r_xprt = + container_of(xprt, struct rpcrdma_xprt, rx_xprt); + +- memset(rqst, 0, sizeof(*rqst)); +- rpcrdma_buffer_put(&r_xprt->rx_buf, rpcr_to_rdmar(rqst)); +- if (unlikely(!rpc_wake_up_next(&xprt->backlog))) +- clear_bit(XPRT_CONGESTED, &xprt->state); ++ rpcrdma_reply_put(&r_xprt->rx_buf, rpcr_to_rdmar(rqst)); ++ if (!xprt_wake_up_backlog(xprt, rqst)) { ++ memset(rqst, 0, sizeof(*rqst)); ++ rpcrdma_buffer_put(&r_xprt->rx_buf, rpcr_to_rdmar(rqst)); ++ } + } + + static bool rpcrdma_check_regbuf(struct rpcrdma_xprt *r_xprt, +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -1308,6 +1308,20 @@ void rpcrdma_mr_put(struct rpcrdma_mr *m + } + + /** ++ * rpcrdma_reply_put - Put reply buffers back into pool ++ * @buffers: buffer pool ++ * @req: object to return ++ * ++ */ ++void rpcrdma_reply_put(struct rpcrdma_buffer *buffers, struct rpcrdma_req *req) ++{ ++ if (req->rl_reply) { ++ rpcrdma_rep_put(buffers, req->rl_reply); ++ req->rl_reply = NULL; ++ } ++} ++ ++/** + * rpcrdma_buffer_get - Get a request buffer + * @buffers: Buffer pool from which to obtain a buffer + * +@@ -1335,9 +1349,7 @@ rpcrdma_buffer_get(struct rpcrdma_buffer + */ + void rpcrdma_buffer_put(struct rpcrdma_buffer *buffers, struct rpcrdma_req *req) + { +- if (req->rl_reply) +- rpcrdma_rep_put(buffers, req->rl_reply); +- req->rl_reply = NULL; ++ rpcrdma_reply_put(buffers, req); + + spin_lock(&buffers->rb_lock); + list_add(&req->rl_list, &buffers->rb_send_bufs); +--- a/net/sunrpc/xprtrdma/xprt_rdma.h ++++ b/net/sunrpc/xprtrdma/xprt_rdma.h +@@ -492,6 +492,7 @@ struct rpcrdma_req *rpcrdma_buffer_get(s + void rpcrdma_buffer_put(struct rpcrdma_buffer *buffers, + struct rpcrdma_req *req); + void rpcrdma_recv_buffer_put(struct rpcrdma_rep *); ++void rpcrdma_reply_put(struct rpcrdma_buffer *buffers, struct rpcrdma_req *req); + + bool rpcrdma_regbuf_realloc(struct rpcrdma_regbuf *rb, size_t size, + gfp_t flags); diff --git a/patches.suse/SUNRPC-in-case-of-backlog-hand-free-slots-directly-t.patch b/patches.suse/SUNRPC-in-case-of-backlog-hand-free-slots-directly-t.patch new file mode 100644 index 0000000..8284419 --- /dev/null +++ b/patches.suse/SUNRPC-in-case-of-backlog-hand-free-slots-directly-t.patch @@ -0,0 +1,182 @@ +From: NeilBrown +Date: Mon, 17 May 2021 09:34:38 +1000 +Subject: [PATCH] SUNRPC in case of backlog, hand free slots directly to + waiting task +Git-commit: e877a88d1f069edced4160792f42c2a8e2dba942 +Patch-mainline: v5.13-rc4 +References: bsc#1185428 + +If sunrpc.tcp_max_slot_table_entries is small and there are tasks +on the backlog queue, then when a request completes it is freed and the +first task on the queue is woken. The expectation is that it will wake +and claim that request. However if it was a sync task and the waiting +process was killed at just that moment, it will wake and NOT claim the +request. + +As long as TASK_CONGESTED remains set, requests can only be claimed by +tasks woken from the backlog, and they are woken only as requests are +freed, so when a task doesn't claim a request, no other task can ever +get that request until TASK_CONGESTED is cleared. Each time this +happens the number of available requests is decreased by one. + +With a sufficiently high workload and sufficiently low setting of +max_slot (16 in the case where this was seen), TASK_CONGESTED can remain +set for an extended period, and the above scenario (of a process being +killed just as its task was woken) can repeat until no requests can be +allocated. Then traffic stops. + +This patch addresses the problem by introducing a positive handover of a +request from a completing task to a backlog task - the request is never +freed when there is a backlog. + +When a task is woken it might already have a request attached in which +case it is *not* freed (as with current code) but is initialised (if +needed) and used. If it isn't used it will eventually be freed by +rpc_exit_task(). xprt_release() is enhanced to be able to correctly +release an uninitialised request. + +Signed-off-by: NeilBrown +Acked-by: NeilBrown + +--- + net/sunrpc/clnt.c | 7 ----- + net/sunrpc/xprt.c | 70 +++++++++++++++++++++++++++++++++++++----------------- + 2 files changed, 48 insertions(+), 29 deletions(-) + +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -1677,13 +1677,6 @@ call_reserveresult(struct rpc_task *task + return; + } + +- /* +- * Even though there was an error, we may have acquired +- * a request slot somehow. Make sure not to leak it. +- */ +- if (task->tk_rqstp) +- xprt_release(task); +- + switch (status) { + case -ENOMEM: + rpc_delay(task, HZ >> 2); +--- a/net/sunrpc/xprt.c ++++ b/net/sunrpc/xprt.c +@@ -70,6 +70,7 @@ + static void xprt_init(struct rpc_xprt *xprt, struct net *net); + static __be32 xprt_alloc_xid(struct rpc_xprt *xprt); + static void xprt_destroy(struct rpc_xprt *xprt); ++static void xprt_request_init(struct rpc_task *task); + + static DEFINE_SPINLOCK(xprt_list_lock); + static LIST_HEAD(xprt_list); +@@ -1547,10 +1548,26 @@ static void xprt_add_backlog(struct rpc_ + rpc_sleep_on(&xprt->backlog, task, NULL); + } + +-static void xprt_wake_up_backlog(struct rpc_xprt *xprt) ++static bool __xprt_set_rq(struct rpc_task *task, void *data) + { +- if (rpc_wake_up_next(&xprt->backlog) == NULL) ++ struct rpc_rqst *req = data; ++ ++ if (task->tk_rqstp == NULL) { ++ memset(req, 0, sizeof(*req)); /* mark unused */ ++ task->tk_status = -EAGAIN; ++ task->tk_rqstp = req; ++ return true; ++ } ++ return false; ++} ++ ++static bool xprt_wake_up_backlog(struct rpc_xprt *xprt, struct rpc_rqst *req) ++{ ++ if (rpc_wake_up_first(&xprt->backlog, __xprt_set_rq, req) == NULL) { + clear_bit(XPRT_CONGESTED, &xprt->state); ++ return false; ++ } ++ return true; + } + + static bool xprt_throttle_congested(struct rpc_xprt *xprt, struct rpc_task *task) +@@ -1638,11 +1655,11 @@ EXPORT_SYMBOL_GPL(xprt_alloc_slot); + void xprt_free_slot(struct rpc_xprt *xprt, struct rpc_rqst *req) + { + spin_lock(&xprt->reserve_lock); +- if (!xprt_dynamic_free_slot(xprt, req)) { ++ if (!xprt_wake_up_backlog(xprt, req) && ++ !xprt_dynamic_free_slot(xprt, req)) { + memset(req, 0, sizeof(*req)); /* mark unused */ + list_add(&req->rq_list, &xprt->free); + } +- xprt_wake_up_backlog(xprt); + spin_unlock(&xprt->reserve_lock); + } + EXPORT_SYMBOL_GPL(xprt_free_slot); +@@ -1730,6 +1747,10 @@ xprt_request_init(struct rpc_task *task) + struct rpc_xprt *xprt = task->tk_xprt; + struct rpc_rqst *req = task->tk_rqstp; + ++ if (req->rq_task) ++ /* Already initialized */ ++ return; ++ + req->rq_task = task; + req->rq_xprt = xprt; + req->rq_buffer = NULL; +@@ -1790,8 +1811,10 @@ void xprt_retry_reserve(struct rpc_task + struct rpc_xprt *xprt = task->tk_xprt; + + task->tk_status = 0; +- if (task->tk_rqstp != NULL) ++ if (task->tk_rqstp != NULL) { ++ xprt_request_init(task); + return; ++ } + + task->tk_status = -EAGAIN; + xprt_do_reserve(xprt, task); +@@ -1816,24 +1839,27 @@ void xprt_release(struct rpc_task *task) + } + + xprt = req->rq_xprt; +- xprt_request_dequeue_xprt(task); +- spin_lock(&xprt->transport_lock); +- xprt->ops->release_xprt(xprt, task); +- if (xprt->ops->release_request) +- xprt->ops->release_request(task); +- xprt_schedule_autodisconnect(xprt); +- spin_unlock(&xprt->transport_lock); +- if (req->rq_buffer) +- xprt->ops->buf_free(task); +- xprt_inject_disconnect(xprt); +- xdr_free_bvec(&req->rq_rcv_buf); +- xdr_free_bvec(&req->rq_snd_buf); +- if (req->rq_cred != NULL) +- put_rpccred(req->rq_cred); +- task->tk_rqstp = NULL; +- if (req->rq_release_snd_buf) +- req->rq_release_snd_buf(req); ++ if (xprt) { ++ xprt_request_dequeue_xprt(task); ++ spin_lock(&xprt->transport_lock); ++ xprt->ops->release_xprt(xprt, task); ++ if (xprt->ops->release_request) ++ xprt->ops->release_request(task); ++ xprt_schedule_autodisconnect(xprt); ++ spin_unlock(&xprt->transport_lock); ++ if (req->rq_buffer) ++ xprt->ops->buf_free(task); ++ xprt_inject_disconnect(xprt); ++ xdr_free_bvec(&req->rq_rcv_buf); ++ xdr_free_bvec(&req->rq_snd_buf); ++ if (req->rq_cred != NULL) ++ put_rpccred(req->rq_cred); ++ if (req->rq_release_snd_buf) ++ req->rq_release_snd_buf(req); ++ } else ++ xprt = task->tk_xprt; + ++ task->tk_rqstp = NULL; + dprintk("RPC: %5u release request %p\n", task->tk_pid, req); + if (likely(!bc_prealloc(req))) + xprt->ops->free_slot(xprt, req); diff --git a/patches.suse/USB-serial-pl2303-add-support-for-PL2303HXN.patch b/patches.suse/USB-serial-pl2303-add-support-for-PL2303HXN.patch new file mode 100644 index 0000000..31be8e5 --- /dev/null +++ b/patches.suse/USB-serial-pl2303-add-support-for-PL2303HXN.patch @@ -0,0 +1,315 @@ +From ebd09f1cd417fce9c85de3abcabf51eadf907a2a Mon Sep 17 00:00:00 2001 +From: Charles Yeh +Date: Tue, 24 Sep 2019 20:14:00 +0800 +Subject: [PATCH] USB: serial: pl2303: add support for PL2303HXN +Git-commit: ebd09f1cd417fce9c85de3abcabf51eadf907a2a +Patch-mainline: v5.5-rc1 +References: bsc#1186320 + +Prolific has developed a new USB to UART chip: PL2303HXN +PL2303HXN : PL2303GC/PL2303GS/PL2303GT/PL2303GL/PL2303GE/PL2303GB +The Vendor request used by the PL2303HXN (TYPE_HXN) is different from +the existing PL2303 series (TYPE_HX & TYPE_01). +Therefore, different Vendor requests are used to issue related commands. + +1. Added a new TYPE_HXN type in pl2303_type_data, and then executes + new Vendor request,new flow control and other related instructions + if TYPE_HXN is recognized. + +2. Because the new PL2303HXN only accept the new Vendor request, + the old Vendor request cannot be accepted (the error message + will be returned) + So first determine the TYPE_HX or TYPE_HXN through + PL2303_READ_TYPE_HX_STATUS in pl2303_startup. + + 2.1 If the return message is "1", then the PL2303 is the existing + TYPE_HX/ TYPE_01 series. + The other settings in pl2303_startup are to continue execution. + 2.2 If the return message is "not 1", then the PL2303 is the new + TYPE_HXN series. + The other settings in pl2303_startup are ignored. + (PL2303HXN will directly use the default value in the hardware, + no need to add additional settings through the software) + +3. In pl2303_open: Because TYPE_HXN is different from the instruction of reset + down/up stream used by TYPE_HX. + Therefore, we will also execute different instructions here. + +4. In pl2303_set_termios: The UART flow control instructions used by + TYPE_HXN/TYPE_HX/TYPE_01 are different. + Therefore, we will also execute different instructions here. + +5. In pl2303_vendor_read & pl2303_vendor_write, since TYPE_HXN is different + from the vendor request instruction used by TYPE_HX/TYPE_01, + it will also execute different instructions here. + +6. In pl2303_update_reg: TYPE_HXN used different register for flow control. + Therefore, we will also execute different instructions here. + +Signed-off-by: Charles Yeh +Signed-off-by: Johan Hovold +Acked-by: Takashi Iwai + +--- + drivers/usb/serial/pl2303.c | 124 +++++++++++++++++++++++++++++------- + drivers/usb/serial/pl2303.h | 6 ++ + 2 files changed, 107 insertions(+), 23 deletions(-) + +diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c +index 9d27b76c5c6e..aab737e1e7b6 100644 +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -47,6 +47,12 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) }, + { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ZTEK) }, + { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_TB) }, ++ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GC) }, ++ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GB) }, ++ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GT) }, ++ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GL) }, ++ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GE) }, ++ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GS) }, + { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) }, + { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) }, + { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID), +@@ -130,9 +136,11 @@ MODULE_DEVICE_TABLE(usb, id_table); + + #define VENDOR_WRITE_REQUEST_TYPE 0x40 + #define VENDOR_WRITE_REQUEST 0x01 ++#define VENDOR_WRITE_NREQUEST 0x80 + + #define VENDOR_READ_REQUEST_TYPE 0xc0 + #define VENDOR_READ_REQUEST 0x01 ++#define VENDOR_READ_NREQUEST 0x81 + + #define UART_STATE_INDEX 8 + #define UART_STATE_MSR_MASK 0x8b +@@ -148,11 +156,24 @@ MODULE_DEVICE_TABLE(usb, id_table); + + #define PL2303_FLOWCTRL_MASK 0xf0 + ++#define PL2303_READ_TYPE_HX_STATUS 0x8080 ++ ++#define PL2303_HXN_RESET_REG 0x07 ++#define PL2303_HXN_RESET_UPSTREAM_PIPE 0x02 ++#define PL2303_HXN_RESET_DOWNSTREAM_PIPE 0x01 ++ ++#define PL2303_HXN_FLOWCTRL_REG 0x0a ++#define PL2303_HXN_FLOWCTRL_MASK 0x1c ++#define PL2303_HXN_FLOWCTRL_NONE 0x1c ++#define PL2303_HXN_FLOWCTRL_RTS_CTS 0x18 ++#define PL2303_HXN_FLOWCTRL_XON_XOFF 0x0c ++ + static void pl2303_set_break(struct usb_serial_port *port, bool enable); + + enum pl2303_type { + TYPE_01, /* Type 0 and 1 (difference unknown) */ + TYPE_HX, /* HX version of the pl2303 chip */ ++ TYPE_HXN, /* HXN version of the pl2303 chip */ + TYPE_COUNT + }; + +@@ -184,16 +205,26 @@ static const struct pl2303_type_data pl2303_type_data[TYPE_COUNT] = { + [TYPE_HX] = { + .max_baud_rate = 12000000, + }, ++ [TYPE_HXN] = { ++ .max_baud_rate = 12000000, ++ }, + }; + + static int pl2303_vendor_read(struct usb_serial *serial, u16 value, + unsigned char buf[1]) + { ++ struct pl2303_serial_private *spriv = usb_get_serial_data(serial); + struct device *dev = &serial->interface->dev; ++ u8 request; + int res; + ++ if (spriv->type == &pl2303_type_data[TYPE_HXN]) ++ request = VENDOR_READ_NREQUEST; ++ else ++ request = VENDOR_READ_REQUEST; ++ + res = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0), +- VENDOR_READ_REQUEST, VENDOR_READ_REQUEST_TYPE, ++ request, VENDOR_READ_REQUEST_TYPE, + value, 0, buf, 1, 100); + if (res != 1) { + dev_err(dev, "%s - failed to read [%04x]: %d\n", __func__, +@@ -211,13 +242,20 @@ static int pl2303_vendor_read(struct usb_serial *serial, u16 value, + + static int pl2303_vendor_write(struct usb_serial *serial, u16 value, u16 index) + { ++ struct pl2303_serial_private *spriv = usb_get_serial_data(serial); + struct device *dev = &serial->interface->dev; ++ u8 request; + int res; + + dev_dbg(dev, "%s - [%04x] = %02x\n", __func__, value, index); + ++ if (spriv->type == &pl2303_type_data[TYPE_HXN]) ++ request = VENDOR_WRITE_NREQUEST; ++ else ++ request = VENDOR_WRITE_REQUEST; ++ + res = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0), +- VENDOR_WRITE_REQUEST, VENDOR_WRITE_REQUEST_TYPE, ++ request, VENDOR_WRITE_REQUEST_TYPE, + value, index, NULL, 0, 100); + if (res) { + dev_err(dev, "%s - failed to write [%04x]: %d\n", __func__, +@@ -230,6 +268,7 @@ static int pl2303_vendor_write(struct usb_serial *serial, u16 value, u16 index) + + static int pl2303_update_reg(struct usb_serial *serial, u8 reg, u8 mask, u8 val) + { ++ struct pl2303_serial_private *spriv = usb_get_serial_data(serial); + int ret = 0; + u8 *buf; + +@@ -237,7 +276,11 @@ static int pl2303_update_reg(struct usb_serial *serial, u8 reg, u8 mask, u8 val) + if (!buf) + return -ENOMEM; + +- ret = pl2303_vendor_read(serial, reg | 0x80, buf); ++ if (spriv->type == &pl2303_type_data[TYPE_HXN]) ++ ret = pl2303_vendor_read(serial, reg, buf); ++ else ++ ret = pl2303_vendor_read(serial, reg | 0x80, buf); ++ + if (ret) + goto out_free; + +@@ -320,6 +363,7 @@ static int pl2303_startup(struct usb_serial *serial) + struct pl2303_serial_private *spriv; + enum pl2303_type type = TYPE_01; + unsigned char *buf; ++ int res; + + spriv = kzalloc(sizeof(*spriv), GFP_KERNEL); + if (!spriv) +@@ -341,26 +385,37 @@ static int pl2303_startup(struct usb_serial *serial) + type = TYPE_01; /* type 1 */ + dev_dbg(&serial->interface->dev, "device type: %d\n", type); + ++ if (type == TYPE_HX) { ++ res = usb_control_msg(serial->dev, ++ usb_rcvctrlpipe(serial->dev, 0), ++ VENDOR_READ_REQUEST, VENDOR_READ_REQUEST_TYPE, ++ PL2303_READ_TYPE_HX_STATUS, 0, buf, 1, 100); ++ if (res != 1) ++ type = TYPE_HXN; ++ } ++ + spriv->type = &pl2303_type_data[type]; + spriv->quirks = (unsigned long)usb_get_serial_data(serial); + spriv->quirks |= spriv->type->quirks; + + usb_set_serial_data(serial, spriv); + +- pl2303_vendor_read(serial, 0x8484, buf); +- pl2303_vendor_write(serial, 0x0404, 0); +- pl2303_vendor_read(serial, 0x8484, buf); +- pl2303_vendor_read(serial, 0x8383, buf); +- pl2303_vendor_read(serial, 0x8484, buf); +- pl2303_vendor_write(serial, 0x0404, 1); +- pl2303_vendor_read(serial, 0x8484, buf); +- pl2303_vendor_read(serial, 0x8383, buf); +- pl2303_vendor_write(serial, 0, 1); +- pl2303_vendor_write(serial, 1, 0); +- if (spriv->quirks & PL2303_QUIRK_LEGACY) +- pl2303_vendor_write(serial, 2, 0x24); +- else +- pl2303_vendor_write(serial, 2, 0x44); ++ if (type != TYPE_HXN) { ++ pl2303_vendor_read(serial, 0x8484, buf); ++ pl2303_vendor_write(serial, 0x0404, 0); ++ pl2303_vendor_read(serial, 0x8484, buf); ++ pl2303_vendor_read(serial, 0x8383, buf); ++ pl2303_vendor_read(serial, 0x8484, buf); ++ pl2303_vendor_write(serial, 0x0404, 1); ++ pl2303_vendor_read(serial, 0x8484, buf); ++ pl2303_vendor_read(serial, 0x8383, buf); ++ pl2303_vendor_write(serial, 0, 1); ++ pl2303_vendor_write(serial, 1, 0); ++ if (spriv->quirks & PL2303_QUIRK_LEGACY) ++ pl2303_vendor_write(serial, 2, 0x24); ++ else ++ pl2303_vendor_write(serial, 2, 0x44); ++ } + + kfree(buf); + +@@ -719,14 +774,31 @@ static void pl2303_set_termios(struct tty_struct *tty, + } + + if (C_CRTSCTS(tty)) { +- if (spriv->quirks & PL2303_QUIRK_LEGACY) ++ if (spriv->quirks & PL2303_QUIRK_LEGACY) { + pl2303_update_reg(serial, 0, PL2303_FLOWCTRL_MASK, 0x40); +- else ++ } else if (spriv->type == &pl2303_type_data[TYPE_HXN]) { ++ pl2303_update_reg(serial, PL2303_HXN_FLOWCTRL_REG, ++ PL2303_HXN_FLOWCTRL_MASK, ++ PL2303_HXN_FLOWCTRL_RTS_CTS); ++ } else { + pl2303_update_reg(serial, 0, PL2303_FLOWCTRL_MASK, 0x60); ++ } + } else if (pl2303_enable_xonxoff(tty, spriv->type)) { +- pl2303_update_reg(serial, 0, PL2303_FLOWCTRL_MASK, 0xc0); ++ if (spriv->type == &pl2303_type_data[TYPE_HXN]) { ++ pl2303_update_reg(serial, PL2303_HXN_FLOWCTRL_REG, ++ PL2303_HXN_FLOWCTRL_MASK, ++ PL2303_HXN_FLOWCTRL_XON_XOFF); ++ } else { ++ pl2303_update_reg(serial, 0, PL2303_FLOWCTRL_MASK, 0xc0); ++ } + } else { +- pl2303_update_reg(serial, 0, PL2303_FLOWCTRL_MASK, 0); ++ if (spriv->type == &pl2303_type_data[TYPE_HXN]) { ++ pl2303_update_reg(serial, PL2303_HXN_FLOWCTRL_REG, ++ PL2303_HXN_FLOWCTRL_MASK, ++ PL2303_HXN_FLOWCTRL_NONE); ++ } else { ++ pl2303_update_reg(serial, 0, PL2303_FLOWCTRL_MASK, 0); ++ } + } + + kfree(buf); +@@ -767,8 +839,14 @@ static int pl2303_open(struct tty_struct *tty, struct usb_serial_port *port) + usb_clear_halt(serial->dev, port->read_urb->pipe); + } else { + /* reset upstream data pipes */ +- pl2303_vendor_write(serial, 8, 0); +- pl2303_vendor_write(serial, 9, 0); ++ if (spriv->type == &pl2303_type_data[TYPE_HXN]) { ++ pl2303_vendor_write(serial, PL2303_HXN_RESET_REG, ++ PL2303_HXN_RESET_UPSTREAM_PIPE | ++ PL2303_HXN_RESET_DOWNSTREAM_PIPE); ++ } else { ++ pl2303_vendor_write(serial, 8, 0); ++ pl2303_vendor_write(serial, 9, 0); ++ } + } + + /* Setup termios */ +diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h +index b0175f17d1a2..a019ea7e6e0e 100644 +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -9,6 +9,12 @@ + #define PL2303_VENDOR_ID 0x067b + #define PL2303_PRODUCT_ID 0x2303 + #define PL2303_PRODUCT_ID_TB 0x2304 ++#define PL2303_PRODUCT_ID_GC 0x23a3 ++#define PL2303_PRODUCT_ID_GB 0x23b3 ++#define PL2303_PRODUCT_ID_GT 0x23c3 ++#define PL2303_PRODUCT_ID_GL 0x23d3 ++#define PL2303_PRODUCT_ID_GE 0x23e3 ++#define PL2303_PRODUCT_ID_GS 0x23f3 + #define PL2303_PRODUCT_ID_RSAQ2 0x04bb + #define PL2303_PRODUCT_ID_DCU11 0x1234 + #define PL2303_PRODUCT_ID_PHAROS 0xaaa0 +-- +2.26.2 + diff --git a/patches.suse/USB-serial-pl2303-fix-line-speed-handling-on-newer-c.patch b/patches.suse/USB-serial-pl2303-fix-line-speed-handling-on-newer-c.patch new file mode 100644 index 0000000..daa8ed6 --- /dev/null +++ b/patches.suse/USB-serial-pl2303-fix-line-speed-handling-on-newer-c.patch @@ -0,0 +1,62 @@ +From 979d9cbe75b922ab1695b8ad5576115774f72e62 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 11 Jan 2021 18:00:19 +0100 +Subject: [PATCH] USB: serial: pl2303: fix line-speed handling on newer chips +Git-commit: 979d9cbe75b922ab1695b8ad5576115774f72e62 +Patch-mainline: v5.12-rc1 +References: bsc#1186320 + +The latest chip family (HXN) apparently does not support setting the +line speed using divisors and instead needs to use the direct encoding +scheme for all rates. + +This specifically enables 50, 110, 134, 200 bps and other rates not +supported by the original chip type. + +Fixes: ebd09f1cd417 ("USB: serial: pl2303: add support for PL2303HXN") +Cc: stable@vger.kernel.org # 5.5 +Cc: Charles Yeh +Signed-off-by: Johan Hovold +Acked-by: Takashi Iwai + +--- + drivers/usb/serial/pl2303.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c +index be8067017eaa..29dda60e3bcd 100644 +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -183,6 +183,7 @@ struct pl2303_type_data { + speed_t max_baud_rate; + unsigned long quirks; + unsigned int no_autoxonxoff:1; ++ unsigned int no_divisors:1; + }; + + struct pl2303_serial_private { +@@ -209,6 +210,7 @@ static const struct pl2303_type_data pl2303_type_data[TYPE_COUNT] = { + }, + [TYPE_HXN] = { + .max_baud_rate = 12000000, ++ .no_divisors = true, + }, + }; + +@@ -571,8 +573,12 @@ static void pl2303_encode_baud_rate(struct tty_struct *tty, + baud = min_t(speed_t, baud, spriv->type->max_baud_rate); + /* + * Use direct method for supported baud rates, otherwise use divisors. ++ * Newer chip types do not support divisor encoding. + */ +- baud_sup = pl2303_get_supported_baud_rate(baud); ++ if (spriv->type->no_divisors) ++ baud_sup = baud; ++ else ++ baud_sup = pl2303_get_supported_baud_rate(baud); + + if (baud == baud_sup) + baud = pl2303_encode_baud_rate_direct(buf, baud); +-- +2.26.2 + diff --git a/patches.suse/USB-trancevibrator-fix-control-request-direction.patch b/patches.suse/USB-trancevibrator-fix-control-request-direction.patch new file mode 100644 index 0000000..2f15d90 --- /dev/null +++ b/patches.suse/USB-trancevibrator-fix-control-request-direction.patch @@ -0,0 +1,45 @@ +From 746e4acf87bcacf1406e05ef24a0b7139147c63e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 21 May 2021 15:31:09 +0200 +Subject: [PATCH] USB: trancevibrator: fix control-request direction +Git-commit: 746e4acf87bcacf1406e05ef24a0b7139147c63e +Patch-mainline: v5.13-rc4 +References: git-fixes + +The direction of the pipe argument must match the request-type direction +bit or control requests may fail depending on the host-controller-driver +implementation. + +Fix the set-speed request which erroneously used USB_DIR_IN and update +the default timeout argument to match (same value). + +Fixes: 5638e4d92e77 ("USB: add PlayStation 2 Trance Vibrator driver") +Cc: stable@vger.kernel.org # 2.6.19 +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210521133109.17396-1-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/misc/trancevibrator.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/misc/trancevibrator.c b/drivers/usb/misc/trancevibrator.c +index a3dfc77578ea..26baba3ab7d7 100644 +--- a/drivers/usb/misc/trancevibrator.c ++++ b/drivers/usb/misc/trancevibrator.c +@@ -61,9 +61,9 @@ static ssize_t speed_store(struct device *dev, struct device_attribute *attr, + /* Set speed */ + retval = usb_control_msg(tv->udev, usb_sndctrlpipe(tv->udev, 0), + 0x01, /* vendor request: set speed */ +- USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_OTHER, ++ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_OTHER, + tv->speed, /* speed value */ +- 0, NULL, 0, USB_CTRL_GET_TIMEOUT); ++ 0, NULL, 0, USB_CTRL_SET_TIMEOUT); + if (retval) { + tv->speed = old; + dev_dbg(&tv->udev->dev, "retval = %d\n", retval); +-- +2.26.2 + diff --git a/patches.suse/arm-mm-use-__pfn_to_section-to-get-mem_section.patch b/patches.suse/arm-mm-use-__pfn_to_section-to-get-mem_section.patch new file mode 100644 index 0000000..597a400 --- /dev/null +++ b/patches.suse/arm-mm-use-__pfn_to_section-to-get-mem_section.patch @@ -0,0 +1,37 @@ +From: Guixiong Wei +Date: Fri, 1 May 2020 06:18:58 +1400 +Subject: arm: mm: use __pfn_to_section() to get mem_section + +Git-commit: 037d9303a7e7bac622e299817c5dd288346db07c +Patch-mainline: v5.8-rc1 +References: git-fixes + +Replace the open-coded '__nr_to_section(pfn_to_section_nr(pfn))' in +pfn_valid() with a more concise call to '__pfn_to_section(pfn)'. + +No functional change. + +Signed-off-by: Guixiong Wei +Link: https://lore.kernel.org/r/20200430161858.11379-1-guixiongwei@gmail.com +Signed-off-by: Will Deacon +Signed-off-by: Mian Yousaf Kaukab +--- + arch/arm64/mm/init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c +index e42727e3568e..d2df416b840e 100644 +--- a/arch/arm64/mm/init.c ++++ b/arch/arm64/mm/init.c +@@ -272,7 +272,7 @@ int pfn_valid(unsigned long pfn) + if (pfn_to_section_nr(pfn) >= NR_MEM_SECTIONS) + return 0; + +- if (!valid_section(__nr_to_section(pfn_to_section_nr(pfn)))) ++ if (!valid_section(__pfn_to_section(pfn))) + return 0; + #endif + return memblock_is_map_memory(addr); +-- +2.26.2 + diff --git a/patches.suse/arm64-Add-missing-ISB-after-invalidating-TLB-in-__pr.patch b/patches.suse/arm64-Add-missing-ISB-after-invalidating-TLB-in-__pr.patch new file mode 100644 index 0000000..41e3270 --- /dev/null +++ b/patches.suse/arm64-Add-missing-ISB-after-invalidating-TLB-in-__pr.patch @@ -0,0 +1,43 @@ +From: Marc Zyngier +Date: Wed, 24 Feb 2021 09:37:37 +0000 +Subject: arm64: Add missing ISB after invalidating TLB in __primary_switch + +Git-commit: 9d41053e8dc115c92b8002c3db5f545d7602498b +Patch-mainline: v5.12-rc1 +References: git-fixes + +Although there has been a bit of back and forth on the subject, it +appears that invalidating TLBs requires an ISB instruction when FEAT_ETS +is not implemented by the CPU. + +From the bible: + + | In an implementation that does not implement FEAT_ETS, a TLB + | maintenance instruction executed by a PE, PEx, can complete at any + | time after it is issued, but is only guaranteed to be finished for a + | PE, PEx, after the execution of DSB by the PEx followed by a Context + | synchronization event + +Add the missing ISB in __primary_switch, just in case. + +Fixes: 3c5e9f238bc4 ("arm64: head.S: move KASLR processing out of __enable_mmu()") +Suggested-by: Will Deacon +Signed-off-by: Marc Zyngier +Acked-by: Mark Rutland +Link: https://lore.kernel.org/r/20210224093738.3629662-3-maz@kernel.org +Signed-off-by: Will Deacon +Signed-off-by: Mian Yousaf Kaukab +--- + arch/arm64/kernel/head.S | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm64/kernel/head.S ++++ b/arch/arm64/kernel/head.S +@@ -872,6 +872,7 @@ __primary_switch: + + tlbi vmalle1 // Remove any stale TLB entries + dsb nsh ++ isb + + msr sctlr_el1, x19 // re-enable the MMU + isb diff --git a/patches.suse/arm64-avoid-Woverride-init-warning.patch b/patches.suse/arm64-avoid-Woverride-init-warning.patch new file mode 100644 index 0000000..3fd7eaf --- /dev/null +++ b/patches.suse/arm64-avoid-Woverride-init-warning.patch @@ -0,0 +1,79 @@ +From: Arnd Bergmann +Date: Mon, 26 Oct 2020 20:37:46 +0100 +Subject: arm64: avoid -Woverride-init warning + +Git-commit: 332576e69a046b9b33f49bd0c3c071cc98215b60 +Patch-mainline: v5.10-rc2 +References: git-fixes + +The icache_policy_str[] definition causes a warning when extra +warning flags are enabled: + +arch/arm64/kernel/cpuinfo.c:38:26: warning: initialized field overwritten [-Woverride-init] + 38 | [ICACHE_POLICY_VIPT] = "VIPT", + | ^~~~~~ +arch/arm64/kernel/cpuinfo.c:38:26: note: (near initialization for 'icache_policy_str[2]') +arch/arm64/kernel/cpuinfo.c:39:26: warning: initialized field overwritten [-Woverride-init] + 39 | [ICACHE_POLICY_PIPT] = "PIPT", + | ^~~~~~ +arch/arm64/kernel/cpuinfo.c:39:26: note: (near initialization for 'icache_policy_str[3]') +arch/arm64/kernel/cpuinfo.c:40:27: warning: initialized field overwritten [-Woverride-init] + 40 | [ICACHE_POLICY_VPIPT] = "VPIPT", + | ^~~~~~~ +arch/arm64/kernel/cpuinfo.c:40:27: note: (near initialization for 'icache_policy_str[0]') + +There is no real need for the default initializer here, as printing a +NULL string is harmless. Rewrite the logic to have an explicit +reserved value for the only one that uses the default value. + +This partially reverts the commit that removed ICACHE_POLICY_AIVIVT. + +Fixes: 155433cb365e ("arm64: cache: Remove support for ASID-tagged VIVT I-caches") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20201026193807.3816388-1-arnd@kernel.org +Signed-off-by: Will Deacon +Signed-off-by: Mian Yousaf Kaukab +--- + arch/arm64/include/asm/cache.h | 1 + + arch/arm64/kernel/cpuinfo.c | 8 ++++---- + 2 files changed, 5 insertions(+), 4 deletions(-) + +--- a/arch/arm64/include/asm/cache.h ++++ b/arch/arm64/include/asm/cache.h +@@ -24,6 +24,7 @@ + #define CTR_L1IP(ctr) (((ctr) >> CTR_L1IP_SHIFT) & CTR_L1IP_MASK) + + #define ICACHE_POLICY_VPIPT 0 ++#define ICACHE_POLICY_RESERVED 1 + #define ICACHE_POLICY_VIPT 2 + #define ICACHE_POLICY_PIPT 3 + +--- a/arch/arm64/kernel/cpuinfo.c ++++ b/arch/arm64/kernel/cpuinfo.c +@@ -34,10 +34,10 @@ DEFINE_PER_CPU(struct cpuinfo_arm64, cpu + static struct cpuinfo_arm64 boot_cpu_data; + + static char *icache_policy_str[] = { +- [0 ... ICACHE_POLICY_PIPT] = "RESERVED/UNKNOWN", ++ [ICACHE_POLICY_VPIPT] = "VPIPT", ++ [ICACHE_POLICY_RESERVED] = "RESERVED/UNKNOWN", + [ICACHE_POLICY_VIPT] = "VIPT", + [ICACHE_POLICY_PIPT] = "PIPT", +- [ICACHE_POLICY_VPIPT] = "VPIPT", + }; + + unsigned long __icache_flags; +@@ -314,11 +314,11 @@ static void cpuinfo_detect_icache_policy + case ICACHE_POLICY_VPIPT: + set_bit(ICACHEF_VPIPT, &__icache_flags); + break; +- default: +- /* Fallthrough */ ++ case ICACHE_POLICY_RESERVED: + case ICACHE_POLICY_VIPT: + /* Assume aliasing */ + set_bit(ICACHEF_ALIASING, &__icache_flags); ++ break; + } + + pr_info("Detected %s I-cache on CPU%d\n", icache_policy_str[l1ip], cpu); diff --git a/patches.suse/arm64-kasan-fix-page_alloc-tagging-with-DEBUG_VIRTUA.patch b/patches.suse/arm64-kasan-fix-page_alloc-tagging-with-DEBUG_VIRTUA.patch new file mode 100644 index 0000000..949c1b1 --- /dev/null +++ b/patches.suse/arm64-kasan-fix-page_alloc-tagging-with-DEBUG_VIRTUA.patch @@ -0,0 +1,40 @@ +From: Andrey Konovalov +Date: Mon, 8 Mar 2021 17:10:23 +0100 +Subject: arm64: kasan: fix page_alloc tagging with DEBUG_VIRTUAL + +Git-commit: 86c83365ab76e4b43cedd3ce07a07d32a4dc79ba +Patch-mainline: v5.12-rc3 +References: git-fixes + +When CONFIG_DEBUG_VIRTUAL is enabled, the default page_to_virt() macro +implementation from include/linux/mm.h is used. That definition doesn't +account for KASAN tags, which leads to no tags on page_alloc allocations. + +Provide an arm64-specific definition for page_to_virt() when +CONFIG_DEBUG_VIRTUAL is enabled that takes care of KASAN tags. + +Fixes: 2813b9c02962 ("kasan, mm, arm64: tag non slab memory allocated via pagealloc") +Cc: +Signed-off-by: Andrey Konovalov +Reviewed-by: Catalin Marinas +Link: https://lore.kernel.org/r/4b55b35202706223d3118230701c6a59749d9b72.1615219501.git.andreyknvl@google.com +Signed-off-by: Will Deacon +Signed-off-by: Mian Yousaf Kaukab +--- + arch/arm64/include/asm/memory.h | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/arch/arm64/include/asm/memory.h ++++ b/arch/arm64/include/asm/memory.h +@@ -296,6 +296,11 @@ static inline void *phys_to_virt(phys_ad + #define ARCH_PFN_OFFSET ((unsigned long)PHYS_PFN_OFFSET) + + #if !defined(CONFIG_SPARSEMEM_VMEMMAP) || defined(CONFIG_DEBUG_VIRTUAL) ++#define page_to_virt(x) ({ \ ++ __typeof__(x) __page = x; \ ++ void *__addr = __va(page_to_phys(__page)); \ ++ (void *)__tag_set((const void *)__addr, page_kasan_tag(__page));\ ++}) + #define virt_to_page(kaddr) pfn_to_page(__pa(kaddr) >> PAGE_SHIFT) + #define _virt_addr_valid(kaddr) pfn_valid(__pa(kaddr) >> PAGE_SHIFT) + #else diff --git a/patches.suse/arm64-kdump-update-ppos-when-reading-elfcorehdr.patch b/patches.suse/arm64-kdump-update-ppos-when-reading-elfcorehdr.patch new file mode 100644 index 0000000..972456f --- /dev/null +++ b/patches.suse/arm64-kdump-update-ppos-when-reading-elfcorehdr.patch @@ -0,0 +1,39 @@ +From: Pavel Tatashin +Date: Fri, 19 Mar 2021 16:50:54 -0400 +Subject: arm64: kdump: update ppos when reading elfcorehdr + +Git-commit: 141f8202cfa4192c3af79b6cbd68e7760bb01b5a +Patch-mainline: v5.12-rc5 +References: git-fixes + +The ppos points to a position in the old kernel memory (and in case of +arm64 in the crash kernel since elfcorehdr is passed as a segment). The +function should update the ppos by the amount that was read. This bug is +not exposed by accident, but other platforms update this value properly. +So, fix it in ARM64 version of elfcorehdr_read() as well. + +Signed-off-by: Pavel Tatashin +Fixes: e62aaeac426a ("arm64: kdump: provide /proc/vmcore file") +Reviewed-by: Tyler Hicks +Link: https://lore.kernel.org/r/20210319205054.743368-1-pasha.tatashin@soleen.com +Signed-off-by: Will Deacon +Signed-off-by: Mian Yousaf Kaukab +--- + arch/arm64/kernel/crash_dump.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/kernel/crash_dump.c b/arch/arm64/kernel/crash_dump.c +index e6e284265f19..58303a9ec32c 100644 +--- a/arch/arm64/kernel/crash_dump.c ++++ b/arch/arm64/kernel/crash_dump.c +@@ -64,5 +64,7 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf, + ssize_t elfcorehdr_read(char *buf, size_t count, u64 *ppos) + { + memcpy(buf, phys_to_virt((phys_addr_t)*ppos), count); ++ *ppos += count; ++ + return count; + } +-- +2.26.2 + diff --git a/patches.suse/arm64-kexec_file-fix-memory-leakage-in-create_dtb-wh.patch b/patches.suse/arm64-kexec_file-fix-memory-leakage-in-create_dtb-wh.patch new file mode 100644 index 0000000..46f571e --- /dev/null +++ b/patches.suse/arm64-kexec_file-fix-memory-leakage-in-create_dtb-wh.patch @@ -0,0 +1,41 @@ +From: qiuguorui1 +Date: Thu, 18 Feb 2021 20:59:00 +0800 +Subject: arm64: kexec_file: fix memory leakage in create_dtb() when + fdt_open_into() fails + +Git-commit: 656d1d58d8e0958d372db86c24f0b2ea36f50888 +Patch-mainline: v5.12-rc1 +References: git-fixes + +in function create_dtb(), if fdt_open_into() fails, we need to vfree +buf before return. + +Fixes: 52b2a8af7436 ("arm64: kexec_file: load initrd and device-tree") +Cc: stable@vger.kernel.org # v5.0 +Signed-off-by: qiuguorui1 +Link: https://lore.kernel.org/r/20210218125900.6810-1-qiuguorui1@huawei.com +Signed-off-by: Will Deacon +Signed-off-by: Mian Yousaf Kaukab +--- + arch/arm64/kernel/machine_kexec_file.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/machine_kexec_file.c +index 03210f644790..0cde47a63beb 100644 +--- a/arch/arm64/kernel/machine_kexec_file.c ++++ b/arch/arm64/kernel/machine_kexec_file.c +@@ -182,8 +182,10 @@ static int create_dtb(struct kimage *image, + + /* duplicate a device tree blob */ + ret = fdt_open_into(initial_boot_params, buf, buf_size); +- if (ret) ++ if (ret) { ++ vfree(buf); + return -EINVAL; ++ } + + ret = setup_dtb(image, initrd_load_addr, initrd_len, + cmdline, buf); +-- +2.26.2 + diff --git a/patches.suse/arm64-link-with-z-norelro-for-LLD-or-aarch64-elf.patch b/patches.suse/arm64-link-with-z-norelro-for-LLD-or-aarch64-elf.patch new file mode 100644 index 0000000..fffa1f6 --- /dev/null +++ b/patches.suse/arm64-link-with-z-norelro-for-LLD-or-aarch64-elf.patch @@ -0,0 +1,84 @@ +From: Nick Desaulniers +Date: Thu, 17 Dec 2020 16:24:32 -0800 +Subject: arm64: link with -z norelro for LLD or aarch64-elf +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Git-commit: 311bea3cb9ee20ef150ca76fc60a592bf6b159f5 +Patch-mainline: v5.11-rc3 +References: git-fixes + +With GNU binutils 2.35+, linking with BFD produces warnings for vmlinux: +aarch64-linux-gnu-ld: warning: -z norelro ignored + +BFD can produce this warning when the target emulation mode does not +support RELRO program headers, and -z relro or -z norelro is passed. + +Alan Modra clarifies: + The default linker emulation for an aarch64-linux ld.bfd is + -maarch64linux, the default for an aarch64-elf linker is + -maarch64elf. They are not equivalent. If you choose -maarch64elf + you get an emulation that doesn't support -z relro. + +The ARCH=arm64 kernel prefers -maarch64elf, but may fall back to +-maarch64linux based on the toolchain configuration. + +LLD will always create RELRO program header regardless of target +emulation. + +To avoid the above warning when linking with BFD, pass -z norelro only +when linking with LLD or with -maarch64linux. + +Fixes: 3b92fa7485eb ("arm64: link with -z norelro regardless of CONFIG_RELOCATABLE") +Fixes: 3bbd3db86470 ("arm64: relocatable: fix inconsistencies in linker script and options") +Cc: # 5.0.x- +Reported-by: kernelci.org bot +Reported-by: Quentin Perret +Signed-off-by: Nick Desaulniers +Reviewed-by: Nathan Chancellor +Acked-by: Ard Biesheuvel +Cc: Alan Modra +Cc: Fāng-ruì Sòng +Link: https://lore.kernel.org/r/20201218002432.788499-1-ndesaulniers@google.com +Signed-off-by: Catalin Marinas +Signed-off-by: Mian Yousaf Kaukab +--- + arch/arm64/Makefile | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/arch/arm64/Makefile ++++ b/arch/arm64/Makefile +@@ -10,7 +10,7 @@ + # + # Copyright (C) 1995-2001 by Russell King + +-LDFLAGS_vmlinux :=--no-undefined -X -z norelro ++LDFLAGS_vmlinux :=--no-undefined -X + CPPFLAGS_vmlinux.lds = -DTEXT_OFFSET=$(TEXT_OFFSET) + GZFLAGS :=-9 + +@@ -83,17 +83,21 @@ CHECKFLAGS += -D__AARCH64EB__ + AS += -EB + # Prefer the baremetal ELF build target, but not all toolchains include + # it so fall back to the standard linux version if needed. +-KBUILD_LDFLAGS += -EB $(call ld-option, -maarch64elfb, -maarch64linuxb) ++KBUILD_LDFLAGS += -EB $(call ld-option, -maarch64elfb, -maarch64linuxb -z norelro) + UTS_MACHINE := aarch64_be + else + KBUILD_CPPFLAGS += -mlittle-endian + CHECKFLAGS += -D__AARCH64EL__ + AS += -EL + # Same as above, prefer ELF but fall back to linux target if needed. +-KBUILD_LDFLAGS += -EL $(call ld-option, -maarch64elf, -maarch64linux) ++KBUILD_LDFLAGS += -EL $(call ld-option, -maarch64elf, -maarch64linux -z norelro) + UTS_MACHINE := aarch64 + endif + ++ifeq ($(CONFIG_LD_IS_LLD), y) ++KBUILD_LDFLAGS += -z norelro ++endif ++ + CHECKFLAGS += -D__aarch64__ + + ifeq ($(CONFIG_ARM64_MODULE_PLTS),y) diff --git a/patches.suse/arm64-link-with-z-norelro-regardless-of-CONFIG_RELOC.patch b/patches.suse/arm64-link-with-z-norelro-regardless-of-CONFIG_RELOC.patch new file mode 100644 index 0000000..b88d530 --- /dev/null +++ b/patches.suse/arm64-link-with-z-norelro-regardless-of-CONFIG_RELOC.patch @@ -0,0 +1,47 @@ +From: Nick Desaulniers +Date: Fri, 16 Oct 2020 10:53:39 -0700 +Subject: arm64: link with -z norelro regardless of CONFIG_RELOCATABLE + +Git-commit: 3b92fa7485eba16b05166fddf38ab42f2ff6ab95 +Patch-mainline: v5.10-rc1 +References: git-fixes + +With CONFIG_EXPERT=y, CONFIG_KASAN=y, CONFIG_RANDOMIZE_BASE=n, +CONFIG_RELOCATABLE=n, we observe the following failure when trying to +link the kernel image with LD=ld.lld: + +error: section: .exit.data is not contiguous with other relro sections + +ld.lld defaults to -z relro while ld.bfd defaults to -z norelro. This +was previously fixed, but only for CONFIG_RELOCATABLE=y. + +Fixes: 3bbd3db86470 ("arm64: relocatable: fix inconsistencies in linker script and options") +Signed-off-by: Nick Desaulniers +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20201016175339.2429280-1-ndesaulniers@google.com +Signed-off-by: Will Deacon +Signed-off-by: Mian Yousaf Kaukab +--- + arch/arm64/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm64/Makefile ++++ b/arch/arm64/Makefile +@@ -10,7 +10,7 @@ + # + # Copyright (C) 1995-2001 by Russell King + +-LDFLAGS_vmlinux :=--no-undefined -X ++LDFLAGS_vmlinux :=--no-undefined -X -z norelro + CPPFLAGS_vmlinux.lds = -DTEXT_OFFSET=$(TEXT_OFFSET) + GZFLAGS :=-9 + +@@ -18,7 +18,7 @@ ifeq ($(CONFIG_RELOCATABLE), y) + # Pass --no-apply-dynamic-relocs to restore pre-binutils-2.27 behaviour + # for relative relocs, since this leads to better Image compression + # with the relocation offsets always being zero. +-LDFLAGS_vmlinux += -shared -Bsymbolic -z notext -z norelro \ ++LDFLAGS_vmlinux += -shared -Bsymbolic -z notext \ + $(call ld-option, --no-apply-dynamic-relocs) + endif + diff --git a/patches.suse/arm64-mm-Fix-pfn_valid-for-ZONE_DEVICE-based-memory.patch b/patches.suse/arm64-mm-Fix-pfn_valid-for-ZONE_DEVICE-based-memory.patch new file mode 100644 index 0000000..2cefec8 --- /dev/null +++ b/patches.suse/arm64-mm-Fix-pfn_valid-for-ZONE_DEVICE-based-memory.patch @@ -0,0 +1,76 @@ +From: Anshuman Khandual +Date: Fri, 5 Mar 2021 10:54:57 +0530 +Subject: arm64/mm: Fix pfn_valid() for ZONE_DEVICE based memory + +Git-commit: eeb0753ba27b26f609e61f9950b14f1b934fe429 +Patch-mainline: v5.12-rc3 +References: git-fixes + +pfn_valid() validates a pfn but basically it checks for a valid struct page +backing for that pfn. It should always return positive for memory ranges +backed with struct page mapping. But currently pfn_valid() fails for all +ZONE_DEVICE based memory types even though they have struct page mapping. + +pfn_valid() asserts that there is a memblock entry for a given pfn without +MEMBLOCK_NOMAP flag being set. The problem with ZONE_DEVICE based memory is +that they do not have memblock entries. Hence memblock_is_map_memory() will +invariably fail via memblock_search() for a ZONE_DEVICE based address. This +eventually fails pfn_valid() which is wrong. memblock_is_map_memory() needs +to be skipped for such memory ranges. As ZONE_DEVICE memory gets hotplugged +into the system via memremap_pages() called from a driver, their respective +memory sections will not have SECTION_IS_EARLY set. + +Normal hotplug memory will never have MEMBLOCK_NOMAP set in their memblock +regions. Because the flag MEMBLOCK_NOMAP was specifically designed and set +for firmware reserved memory regions. memblock_is_map_memory() can just be +skipped as its always going to be positive and that will be an optimization +for the normal hotplug memory. Like ZONE_DEVICE based memory, all normal +hotplugged memory too will not have SECTION_IS_EARLY set for their sections + +Skipping memblock_is_map_memory() for all non early memory sections would +fix pfn_valid() problem for ZONE_DEVICE based memory and also improve its +performance for normal hotplug memory as well. + +Cc: Catalin Marinas +Cc: Will Deacon +Cc: Ard Biesheuvel +Cc: Robin Murphy +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux-kernel@vger.kernel.org +Acked-by: David Hildenbrand +Fixes: 73b20c84d42d ("arm64: mm: implement pte_devmap support") +Signed-off-by: Anshuman Khandual +Acked-by: Catalin Marinas +Link: https://lore.kernel.org/r/1614921898-4099-2-git-send-email-anshuman.khandual@arm.com +Signed-off-by: Will Deacon +Signed-off-by: Mian Yousaf Kaukab +--- + arch/arm64/mm/init.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c +index 0ace5e68efba..5920c527845a 100644 +--- a/arch/arm64/mm/init.c ++++ b/arch/arm64/mm/init.c +@@ -230,6 +230,18 @@ int pfn_valid(unsigned long pfn) + + if (!valid_section(__pfn_to_section(pfn))) + return 0; ++ ++ /* ++ * ZONE_DEVICE memory does not have the memblock entries. ++ * memblock_is_map_memory() check for ZONE_DEVICE based ++ * addresses will always fail. Even the normal hotplugged ++ * memory will never have MEMBLOCK_NOMAP flag set in their ++ * memblock entries. Skip memblock search for all non early ++ * memory sections covering all of hotplug memory including ++ * both normal and ZONE_DEVICE based. ++ */ ++ if (!early_section(__pfn_to_section(pfn))) ++ return pfn_section_valid(__pfn_to_section(pfn), pfn); + #endif + return memblock_is_map_memory(addr); + } +-- +2.26.2 + diff --git a/patches.suse/arm64-ptrace-Fix-seccomp-of-traced-syscall-1-NO_SYSC.patch b/patches.suse/arm64-ptrace-Fix-seccomp-of-traced-syscall-1-NO_SYSC.patch new file mode 100644 index 0000000..222d910 --- /dev/null +++ b/patches.suse/arm64-ptrace-Fix-seccomp-of-traced-syscall-1-NO_SYSC.patch @@ -0,0 +1,56 @@ +From: Timothy E Baldwin +Date: Sat, 16 Jan 2021 15:18:54 +0000 +Subject: arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL) + +Git-commit: df84fe94708985cdfb78a83148322bcd0a699472 +Patch-mainline: v5.12-rc1 +References: git-fixes + +Since commit f086f67485c5 ("arm64: ptrace: add support for syscall +emulation"), if system call number -1 is called and the process is being +traced with PTRACE_SYSCALL, for example by strace, the seccomp check is +skipped and -ENOSYS is returned unconditionally (unless altered by the +tracer) rather than carrying out action specified in the seccomp filter. + +The consequence of this is that it is not possible to reliably strace +a seccomp based implementation of a foreign system call interface in +which r7/x8 is permitted to be -1 on entry to a system call. + +Also trace_sys_enter and audit_syscall_entry are skipped if a system +call is skipped. + +Fix by removing the in_syscall(regs) check restoring the previous +behaviour which is like AArch32, x86 (which uses generic code) and +everything else. + +Cc: Oleg Nesterov +Cc: Catalin Marinas +Cc: +Fixes: f086f67485c5 ("arm64: ptrace: add support for syscall emulation") +Reviewed-by: Kees Cook +Reviewed-by: Sudeep Holla +Tested-by: Sudeep Holla +Signed-off-by: Timothy E Baldwin +Link: https://lore.kernel.org/r/90edd33b-6353-1228-791f-0336d94d5f8c@majoroak.me.uk +Signed-off-by: Will Deacon +Signed-off-by: Mian Yousaf Kaukab +--- + arch/arm64/kernel/ptrace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c +index 3d5c8afca75b..170f42fd6101 100644 +--- a/arch/arm64/kernel/ptrace.c ++++ b/arch/arm64/kernel/ptrace.c +@@ -1797,7 +1797,7 @@ int syscall_trace_enter(struct pt_regs *regs) + + if (flags & (_TIF_SYSCALL_EMU | _TIF_SYSCALL_TRACE)) { + tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER); +- if (!in_syscall(regs) || (flags & _TIF_SYSCALL_EMU)) ++ if (flags & _TIF_SYSCALL_EMU) + return NO_SYSCALL; + } + +-- +2.26.2 + diff --git a/patches.suse/arm64-ptrace-Use-NO_SYSCALL-instead-of-1-in-syscall_.patch b/patches.suse/arm64-ptrace-Use-NO_SYSCALL-instead-of-1-in-syscall_.patch new file mode 100644 index 0000000..30da932 --- /dev/null +++ b/patches.suse/arm64-ptrace-Use-NO_SYSCALL-instead-of-1-in-syscall_.patch @@ -0,0 +1,40 @@ +From: Will Deacon +Date: Fri, 10 Jul 2020 13:20:57 +0100 +Subject: arm64: ptrace: Use NO_SYSCALL instead of -1 in syscall_trace_enter() + +Git-commit: d83ee6e3e75db6f518ef2b0858f163849f2ddeb7 +Patch-mainline: v5.8-rc6 +References: git-fixes + +Setting a system call number of -1 is special, as it indicates that the +current system call should be skipped. + +Use NO_SYSCALL instead of -1 when checking for this scenario, which is +different from the -1 returned due to a seccomp failure. + +Cc: Mark Rutland +Cc: Keno Fischer +Cc: Luis Machado +Signed-off-by: Will Deacon +Signed-off-by: Mian Yousaf Kaukab +--- + arch/arm64/kernel/ptrace.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm64/kernel/ptrace.c ++++ b/arch/arm64/kernel/ptrace.c +@@ -1834,12 +1834,12 @@ int syscall_trace_enter(struct pt_regs * + if (flags & (_TIF_SYSCALL_EMU | _TIF_SYSCALL_TRACE)) { + tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER); + if (!in_syscall(regs) || (flags & _TIF_SYSCALL_EMU)) +- return -1; ++ return NO_SYSCALL; + } + + /* Do the secure computing after ptrace; failures should be fast. */ + if (secure_computing(NULL) == -1) +- return -1; ++ return NO_SYSCALL; + + if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) + trace_sys_enter(regs, regs->syscallno); diff --git a/patches.suse/arm64-vdso32-make-vdso32-install-conditional.patch b/patches.suse/arm64-vdso32-make-vdso32-install-conditional.patch new file mode 100644 index 0000000..725f19d --- /dev/null +++ b/patches.suse/arm64-vdso32-make-vdso32-install-conditional.patch @@ -0,0 +1,39 @@ +From: Frank van der Linden +Date: Thu, 27 Aug 2020 23:40:12 +0000 +Subject: arm64: vdso32: make vdso32 install conditional + +Git-commit: 5d28ba5f8a0cfa3a874fa96c33731b8fcd141b3a +Patch-mainline: v5.9-rc3 +References: git-fixes + +vdso32 should only be installed if CONFIG_COMPAT_VDSO is enabled, +since it's not even supposed to be compiled otherwise, and arm64 +builds without a 32bit crosscompiler will fail. + +Fixes: 8d75785a8142 ("ARM64: vdso32: Install vdso32 from vdso_install") +Signed-off-by: Frank van der Linden +Cc: stable@vger.kernel.org [5.4+] +Link: https://lore.kernel.org/r/20200827234012.19757-1-fllinden@amazon.com +Signed-off-by: Catalin Marinas +Signed-off-by: Mian Yousaf Kaukab +--- + arch/arm64/Makefile | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile +index 20ab5c9375a5..130569f90c54 100644 +--- a/arch/arm64/Makefile ++++ b/arch/arm64/Makefile +@@ -170,7 +170,8 @@ zinstall install: + PHONY += vdso_install + vdso_install: + $(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso $@ +- $(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso32 $@ ++ $(if $(CONFIG_COMPAT_VDSO), \ ++ $(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso32 $@) + + # We use MRPROPER_FILES and CLEAN_FILES now + archclean: +-- +2.26.2 + diff --git a/patches.suse/blk-mq-Swap-two-calls-in-blk_mq_exit_queue.patch b/patches.suse/blk-mq-Swap-two-calls-in-blk_mq_exit_queue.patch new file mode 100644 index 0000000..d7dc933 --- /dev/null +++ b/patches.suse/blk-mq-Swap-two-calls-in-blk_mq_exit_queue.patch @@ -0,0 +1,49 @@ +From: Bart Van Assche +Date: Thu, 13 May 2021 10:15:29 -0700 +Subject: [PATCH] blk-mq: Swap two calls in blk_mq_exit_queue() +Git-commit: 630ef623ed26c18a457cdc070cf24014e50129c2 +Patch-mainline: v5.13-rc2 +References: git-fixes + +If a tag set is shared across request queues (e.g. SCSI LUNs) then the +block layer core keeps track of the number of active request queues in +tags->active_queues. blk_mq_tag_busy() and blk_mq_tag_idle() update that +atomic counter if the hctx flag BLK_MQ_F_TAG_QUEUE_SHARED is set. Make +sure that blk_mq_exit_queue() calls blk_mq_tag_idle() before that flag is +cleared by blk_mq_del_queue_tag_set(). + +Cc: Christoph Hellwig +Cc: Ming Lei +Cc: Hannes Reinecke +Fixes: 0d2602ca30e4 ("blk-mq: improve support for shared tags maps") +Signed-off-by: Bart Van Assche +Reviewed-by: Ming Lei +Link: https://lore.kernel.org/r/20210513171529.7977-1-bvanassche@acm.org +Signed-off-by: Jens Axboe +Acked-by: Hannes Reinecke +--- + block/blk-mq.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 28ef0248efba..c86c01bfecdb 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -3286,10 +3286,12 @@ EXPORT_SYMBOL(blk_mq_init_allocated_queue); + /* tags can _not_ be used after returning from blk_mq_exit_queue */ + void blk_mq_exit_queue(struct request_queue *q) + { +- struct blk_mq_tag_set *set = q->tag_set; ++ struct blk_mq_tag_set *set = q->tag_set; + +- blk_mq_del_queue_tag_set(q); ++ /* Checks hctx->flags & BLK_MQ_F_TAG_QUEUE_SHARED. */ + blk_mq_exit_hw_queues(q, set, set->nr_hw_queues); ++ /* May clear BLK_MQ_F_TAG_QUEUE_SHARED in hctx->flags. */ ++ blk_mq_del_queue_tag_set(q); + } + + static int __blk_mq_alloc_rq_maps(struct blk_mq_tag_set *set) +-- +2.29.2 + diff --git a/patches.suse/block-Fix-three-kernel-doc-warnings.patch b/patches.suse/block-Fix-three-kernel-doc-warnings.patch new file mode 100644 index 0000000..d6557ef --- /dev/null +++ b/patches.suse/block-Fix-three-kernel-doc-warnings.patch @@ -0,0 +1,52 @@ +From: Bart Van Assche +Date: Mon, 30 Sep 2019 16:00:40 -0700 +Subject: [PATCH] block: Fix three kernel-doc warnings +Git-commit: 98e5440271172ca5c654784a31e46453464a3ca9 +Patch-mainline: v5.5-rc1 +References: git-fixes + +Fix the following kernel-doc warnings: + +block/t10-pi.c:242: warning: Function parameter or member 'rq' not described in 't10_pi_type3_prepare' +block/t10-pi.c:249: warning: Function parameter or member 'rq' not described in 't10_pi_type3_complete' +block/t10-pi.c:249: warning: Function parameter or member 'nr_bytes' not described in 't10_pi_type3_complete' + +Cc: Max Gurtovoy +Cc: Christoph Hellwig +Cc: Ming Lei +Cc: Hannes Reinecke +Cc: Johannes Thumshirn +Fixes: 54d4e6ab91eb ("block: centralize PI remapping logic to the block layer") +Signed-off-by: Bart Van Assche +Signed-off-by: Jens Axboe +Acked-by: Hannes Reinecke +--- + block/t10-pi.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/block/t10-pi.c b/block/t10-pi.c +index 9803c7e0376e..f4907d941f03 100644 +--- a/block/t10-pi.c ++++ b/block/t10-pi.c +@@ -235,16 +235,12 @@ static blk_status_t t10_pi_type3_verify_ip(struct blk_integrity_iter *iter) + return t10_pi_verify(iter, t10_pi_ip_fn, T10_PI_TYPE3_PROTECTION); + } + +-/** +- * Type 3 does not have a reference tag so no remapping is required. +- */ ++/* Type 3 does not have a reference tag so no remapping is required. */ + static void t10_pi_type3_prepare(struct request *rq) + { + } + +-/** +- * Type 3 does not have a reference tag so no remapping is required. +- */ ++/* Type 3 does not have a reference tag so no remapping is required. */ + static void t10_pi_type3_complete(struct request *rq, unsigned int nr_bytes) + { + } +-- +2.29.2 + diff --git a/patches.suse/block-genhd-use-atomic_t-for-disk_event-block.patch b/patches.suse/block-genhd-use-atomic_t-for-disk_event-block.patch new file mode 100644 index 0000000..54d2413 --- /dev/null +++ b/patches.suse/block-genhd-use-atomic_t-for-disk_event-block.patch @@ -0,0 +1,131 @@ +From ebd780ac233884d6ad298e29ba13d002da2ee5be Mon Sep 17 00:00:00 2001 +From: Hannes Reinecke +Date: Fri, 14 May 2021 12:44:38 +0200 +Subject: [PATCH] block/genhd: use atomic_t for disk_event->block +References: bsc#1185497 +Patch-Mainline: submitted linux-block 2021/06/01 + +__disk_unblock_events() will call queue_delayed_work() with a '0' argument +under a spin lock. This might cause the queue_work item to be executed +immediately, and run into a deadlock in disk_check_events() waiting for +the lock to be released. + +This patch converts the 'blocked' counter into an atomic variable, so we don't +need to hold a spinlock anymore when scheduling the workqueue function. + +Signed-off-by: Hannes Reinecke +--- + block/genhd.c | 36 +++++++++++++----------------------- + 1 file changed, 13 insertions(+), 23 deletions(-) + +diff --git a/block/genhd.c b/block/genhd.c +index ab29d1a723b2..e1c3b9d2b5d6 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -1731,7 +1731,7 @@ struct disk_events { + spinlock_t lock; + + struct mutex block_mutex; /* protects blocking */ +- int block; /* event blocking depth */ ++ atomic_t block; /* event blocking depth */ + unsigned int pending; /* events already sent out */ + unsigned int clearing; /* events being cleared */ + +@@ -1791,8 +1791,6 @@ static unsigned long disk_events_poll_jiffies(struct gendisk *disk) + void disk_block_events(struct gendisk *disk) + { + struct disk_events *ev = disk->ev; +- unsigned long flags; +- bool cancel; + + if (!ev) + return; +@@ -1803,11 +1801,7 @@ void disk_block_events(struct gendisk *disk) + */ + mutex_lock(&ev->block_mutex); + +- spin_lock_irqsave(&ev->lock, flags); +- cancel = !ev->block++; +- spin_unlock_irqrestore(&ev->lock, flags); +- +- if (cancel) ++ if (atomic_inc_return(&ev->block) == 1) + cancel_delayed_work_sync(&disk->ev->dwork); + + mutex_unlock(&ev->block_mutex); +@@ -1819,23 +1813,19 @@ static void __disk_unblock_events(struct gendisk *disk, bool check_now) + unsigned long intv; + unsigned long flags; + ++ if (atomic_dec_return(&ev->block) <= 0) { ++ mutex_unlock(&ev->block_mutex); ++ return; ++ } + spin_lock_irqsave(&ev->lock, flags); +- +- if (WARN_ON_ONCE(ev->block <= 0)) +- goto out_unlock; +- +- if (--ev->block) +- goto out_unlock; +- + intv = disk_events_poll_jiffies(disk); ++ spin_unlock_irqrestore(&ev->lock, flags); + if (check_now) + queue_delayed_work(system_freezable_power_efficient_wq, + &ev->dwork, 0); + else if (intv) + queue_delayed_work(system_freezable_power_efficient_wq, + &ev->dwork, intv); +-out_unlock: +- spin_unlock_irqrestore(&ev->lock, flags); + } + + /** +@@ -1875,10 +1865,10 @@ void disk_flush_events(struct gendisk *disk, unsigned int mask) + + spin_lock_irq(&ev->lock); + ev->clearing |= mask; +- if (!ev->block) ++ spin_unlock_irq(&ev->lock); ++ if (!atomic_read(&ev->block)) + mod_delayed_work(system_freezable_power_efficient_wq, + &ev->dwork, 0); +- spin_unlock_irq(&ev->lock); + } + + /** +@@ -1969,11 +1959,11 @@ static void disk_check_events(struct disk_events *ev, + *clearing_ptr &= ~clearing; + + intv = disk_events_poll_jiffies(disk); +- if (!ev->block && intv) ++ spin_unlock_irq(&ev->lock); ++ if (!atomic_read(&ev->block) && intv) + queue_delayed_work(system_freezable_power_efficient_wq, + &ev->dwork, intv); + +- spin_unlock_irq(&ev->lock); + + /* + * Tell userland about new events. Only the events listed in +@@ -2138,7 +2128,7 @@ static void disk_alloc_events(struct gendisk *disk) + ev->disk = disk; + spin_lock_init(&ev->lock); + mutex_init(&ev->block_mutex); +- ev->block = 1; ++ atomic_set(&ev->block, 1); + ev->poll_msecs = -1; + INIT_DELAYED_WORK(&ev->dwork, disk_events_workfn); + +@@ -2182,6 +2172,6 @@ static void disk_del_events(struct gendisk *disk) + static void disk_release_events(struct gendisk *disk) + { + /* the block count should be 1 from disk_del_events() */ +- WARN_ON_ONCE(disk->ev && disk->ev->block != 1); ++ WARN_ON_ONCE(disk->ev && atomic_read(&disk->ev->block) != 1); + kfree(disk->ev); + } +-- +2.29.2 + diff --git a/patches.suse/bpf-Fix-mask-direction-swap-upon-off-reg-sign-change.patch b/patches.suse/bpf-Fix-mask-direction-swap-upon-off-reg-sign-change.patch new file mode 100644 index 0000000..b8c0922 --- /dev/null +++ b/patches.suse/bpf-Fix-mask-direction-swap-upon-off-reg-sign-change.patch @@ -0,0 +1,73 @@ +From: Daniel Borkmann +Date: Fri, 21 May 2021 10:19:22 +0000 +Subject: bpf: Fix mask direction swap upon off reg sign change +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git +Git-commit: bb01a1bba579b4b1c5566af24d95f1767859771e +References: bsc#1186484,CVE-2021-33200 + +Masking direction as indicated via mask_to_left is considered to be +calculated once and then used to derive pointer limits. Thus, this +needs to be placed into bpf_sanitize_info instead so we can pass it +to sanitize_ptr_alu() call after the pointer move. Piotr noticed a +corner case where the off reg causes masking direction change which +then results in an incorrect final aux->alu_limit. + +Fixes: 7fedb63a8307 ("bpf: Tighten speculative pointer arithmetic mask") +Reported-by: Piotr Krysiuk +Signed-off-by: Daniel Borkmann +Reviewed-by: Piotr Krysiuk +Acked-by: Alexei Starovoitov +Acked-by: Gary Lin +--- + kernel/bpf/verifier.c | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -4451,18 +4451,10 @@ enum { + }; + + static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg, +- const struct bpf_reg_state *off_reg, +- u32 *alu_limit, u8 opcode) ++ u32 *alu_limit, bool mask_to_left) + { +- bool off_is_neg = off_reg->smin_value < 0; +- bool mask_to_left = (opcode == BPF_ADD && off_is_neg) || +- (opcode == BPF_SUB && !off_is_neg); + u32 max = 0, ptr_limit = 0; + +- if (!tnum_is_const(off_reg->var_off) && +- (off_reg->smin_value < 0) != (off_reg->smax_value < 0)) +- return REASON_BOUNDS; +- + switch (ptr_reg->type) { + case PTR_TO_STACK: + /* Offset 0 is out-of-bounds, but acceptable start for the +@@ -4530,6 +4522,7 @@ static bool sanitize_needed(u8 opcode) + + struct bpf_sanitize_info { + struct bpf_insn_aux_data aux; ++ bool mask_to_left; + }; + + static int sanitize_ptr_alu(struct bpf_verifier_env *env, +@@ -4561,7 +4554,16 @@ static int sanitize_ptr_alu(struct bpf_v + if (vstate->speculative) + goto do_sim; + +- err = retrieve_ptr_limit(ptr_reg, off_reg, &alu_limit, opcode); ++ if (!commit_window) { ++ if (!tnum_is_const(off_reg->var_off) && ++ (off_reg->smin_value < 0) != (off_reg->smax_value < 0)) ++ return REASON_BOUNDS; ++ ++ info->mask_to_left = (opcode == BPF_ADD && off_is_neg) || ++ (opcode == BPF_SUB && !off_is_neg); ++ } ++ ++ err = retrieve_ptr_limit(ptr_reg, &alu_limit, info->mask_to_left); + if (err < 0) + return err; + diff --git a/patches.suse/bpf-No-need-to-simulate-speculative-domain-for-immed.patch b/patches.suse/bpf-No-need-to-simulate-speculative-domain-for-immed.patch new file mode 100644 index 0000000..3fa22eb --- /dev/null +++ b/patches.suse/bpf-No-need-to-simulate-speculative-domain-for-immed.patch @@ -0,0 +1,43 @@ +From: Daniel Borkmann +Date: Tue, 4 May 2021 08:58:25 +0000 +Subject: bpf: No need to simulate speculative domain for immediates +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git +Git-commit: a7036191277f9fa68d92f2071ddc38c09b1e5ee5 +References: bsc#1186484,CVE-2021-33200 + +In 801c6058d14a ("bpf: Fix leakage of uninitialized bpf stack under +speculation") we replaced masking logic with direct loads of immediates +if the register is a known constant. Given in this case we do not apply +any masking, there is also no reason for the operation to be truncated +under the speculative domain. + +Therefore, there is also zero reason for the verifier to branch-off and +simulate this case, it only needs to do it for unknown but bounded scalars. +As a side-effect, this also enables few test cases that were previously +rejected due to simulation under zero truncation. + +Signed-off-by: Daniel Borkmann +Reviewed-by: Piotr Krysiuk +Acked-by: Alexei Starovoitov +Acked-by: Gary Lin +--- + kernel/bpf/verifier.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -4587,8 +4587,12 @@ do_sim: + /* If we're in commit phase, we're done here given we already + * pushed the truncated dst_reg into the speculative verification + * stack. ++ * ++ * Also, when register is a known constant, we rewrite register-based ++ * operation to immediate-based, and thus do not need masking (and as ++ * a consequence, do not need to simulate the zero-truncation either). + */ +- if (commit_window) ++ if (commit_window || off_is_imm) + return 0; + + /* Simulate and find potential out-of-bounds access under diff --git a/patches.suse/bpf-Wrap-aux-data-inside-bpf_sanitize_info-container.patch b/patches.suse/bpf-Wrap-aux-data-inside-bpf_sanitize_info-container.patch new file mode 100644 index 0000000..baeebc8 --- /dev/null +++ b/patches.suse/bpf-Wrap-aux-data-inside-bpf_sanitize_info-container.patch @@ -0,0 +1,83 @@ +From: Daniel Borkmann +Date: Fri, 21 May 2021 10:17:36 +0000 +Subject: bpf: Wrap aux data inside bpf_sanitize_info container +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git +Git-commit: 3d0220f6861d713213b015b582e9f21e5b28d2e0 +References: bsc#1186484,CVE-2021-33200 + +Add a container structure struct bpf_sanitize_info which holds +the current aux info, and update call-sites to sanitize_ptr_alu() +to pass it in. This is needed for passing in additional state +later on. + +Signed-off-by: Daniel Borkmann +Reviewed-by: Piotr Krysiuk +Acked-by: Alexei Starovoitov +Acked-by: Gary Lin +--- + kernel/bpf/verifier.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -4528,15 +4528,19 @@ static bool sanitize_needed(u8 opcode) + return opcode == BPF_ADD || opcode == BPF_SUB; + } + ++struct bpf_sanitize_info { ++ struct bpf_insn_aux_data aux; ++}; ++ + static int sanitize_ptr_alu(struct bpf_verifier_env *env, + struct bpf_insn *insn, + const struct bpf_reg_state *ptr_reg, + const struct bpf_reg_state *off_reg, + struct bpf_reg_state *dst_reg, +- struct bpf_insn_aux_data *tmp_aux, ++ struct bpf_sanitize_info *info, + const bool commit_window) + { +- struct bpf_insn_aux_data *aux = commit_window ? cur_aux(env) : tmp_aux; ++ struct bpf_insn_aux_data *aux = commit_window ? cur_aux(env) : &info->aux; + struct bpf_verifier_state *vstate = env->cur_state; + bool off_is_imm = tnum_is_const(off_reg->var_off); + bool off_is_neg = off_reg->smin_value < 0; +@@ -4565,8 +4569,8 @@ static int sanitize_ptr_alu(struct bpf_v + /* In commit phase we narrow the masking window based on + * the observed pointer move after the simulated operation. + */ +- alu_state = tmp_aux->alu_state; +- alu_limit = abs(tmp_aux->alu_limit - alu_limit); ++ alu_state = info->aux.alu_state; ++ alu_limit = abs(info->aux.alu_limit - alu_limit); + } else { + alu_state = off_is_neg ? BPF_ALU_NEG_VALUE : 0; + alu_state |= off_is_imm ? BPF_ALU_IMMEDIATE : 0; +@@ -4696,7 +4700,7 @@ static int adjust_ptr_min_max_vals(struc + smin_ptr = ptr_reg->smin_value, smax_ptr = ptr_reg->smax_value; + u64 umin_val = off_reg->umin_value, umax_val = off_reg->umax_value, + umin_ptr = ptr_reg->umin_value, umax_ptr = ptr_reg->umax_value; +- struct bpf_insn_aux_data tmp_aux = {}; ++ struct bpf_sanitize_info info = {}; + u8 opcode = BPF_OP(insn->code); + u32 dst = insn->dst_reg; + int ret; +@@ -4753,7 +4757,7 @@ static int adjust_ptr_min_max_vals(struc + + if (sanitize_needed(opcode)) { + ret = sanitize_ptr_alu(env, insn, ptr_reg, off_reg, dst_reg, +- &tmp_aux, false); ++ &info, false); + if (ret < 0) + return sanitize_err(env, insn, ret, off_reg, dst_reg); + } +@@ -4894,7 +4898,7 @@ static int adjust_ptr_min_max_vals(struc + return -EACCES; + if (sanitize_needed(opcode)) { + ret = sanitize_ptr_alu(env, insn, dst_reg, off_reg, dst_reg, +- &tmp_aux, true); ++ &info, true); + if (ret < 0) + return sanitize_err(env, insn, ret, off_reg, dst_reg); + } diff --git a/patches.suse/btrfs-fix-race-between-transaction-aborts-and-fsyncs.patch b/patches.suse/btrfs-fix-race-between-transaction-aborts-and-fsyncs.patch new file mode 100644 index 0000000..5df8a4e --- /dev/null +++ b/patches.suse/btrfs-fix-race-between-transaction-aborts-and-fsyncs.patch @@ -0,0 +1,154 @@ +From: Filipe Manana +Date: Mon, 5 Apr 2021 12:32:16 +0100 +Git-commit: 061dde8245356d8864d29e25207aa4daa0be4d3c +Patch-mainline: v5.13-rc1 +Subject: [PATCH] btrfs: fix race between transaction aborts and fsyncs leading + to use-after-free +References: bsc#1186441 + +There is a race between a task aborting a transaction during a commit, +a task doing an fsync and the transaction kthread, which leads to an +use-after-free of the log root tree. When this happens, it results in a +stack trace like the following: + + BTRFS info (device dm-0): forced readonly + BTRFS warning (device dm-0): Skipping commit of aborted transaction. + BTRFS: error (device dm-0) in cleanup_transaction:1958: errno=-5 IO failure + BTRFS warning (device dm-0): lost page write due to IO error on /dev/mapper/error-test (-5) + BTRFS warning (device dm-0): Skipping commit of aborted transaction. + BTRFS warning (device dm-0): direct IO failed ino 261 rw 0,0 sector 0xa4e8 len 4096 err no 10 + BTRFS error (device dm-0): error writing primary super block to device 1 + BTRFS warning (device dm-0): direct IO failed ino 261 rw 0,0 sector 0x12e000 len 4096 err no 10 + BTRFS warning (device dm-0): direct IO failed ino 261 rw 0,0 sector 0x12e008 len 4096 err no 10 + BTRFS warning (device dm-0): direct IO failed ino 261 rw 0,0 sector 0x12e010 len 4096 err no 10 + BTRFS: error (device dm-0) in write_all_supers:4110: errno=-5 IO failure (1 errors while writing supers) + BTRFS: error (device dm-0) in btrfs_sync_log:3308: errno=-5 IO failure + general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b68: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI + CPU: 2 PID: 2458471 Comm: fsstress Not tainted 5.12.0-rc5-btrfs-next-84 #1 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 + RIP: 0010:__mutex_lock+0x139/0xa40 + Code: c0 74 19 (...) + RSP: 0018:ffff9f18830d7b00 EFLAGS: 00010202 + RAX: 6b6b6b6b6b6b6b68 RBX: 0000000000000001 RCX: 0000000000000002 + RDX: ffffffffb9c54d13 RSI: 0000000000000000 RDI: 0000000000000000 + RBP: ffff9f18830d7bc0 R08: 0000000000000000 R09: 0000000000000000 + R10: ffff9f18830d7be0 R11: 0000000000000001 R12: ffff8c6cd199c040 + R13: ffff8c6c95821358 R14: 00000000fffffffb R15: ffff8c6cbcf01358 + FS: 00007fa9140c2b80(0000) GS:ffff8c6fac600000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007fa913d52000 CR3: 000000013d2b4003 CR4: 0000000000370ee0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + ? __btrfs_handle_fs_error+0xde/0x146 [btrfs] + ? btrfs_sync_log+0x7c1/0xf20 [btrfs] + ? btrfs_sync_log+0x7c1/0xf20 [btrfs] + btrfs_sync_log+0x7c1/0xf20 [btrfs] + btrfs_sync_file+0x40c/0x580 [btrfs] + do_fsync+0x38/0x70 + __x64_sys_fsync+0x10/0x20 + do_syscall_64+0x33/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + RIP: 0033:0x7fa9142a55c3 + Code: 8b 15 09 (...) + RSP: 002b:00007fff26278d48 EFLAGS: 00000246 ORIG_RAX: 000000000000004a + RAX: ffffffffffffffda RBX: 0000563c83cb4560 RCX: 00007fa9142a55c3 + RDX: 00007fff26278cb0 RSI: 00007fff26278cb0 RDI: 0000000000000005 + RBP: 0000000000000005 R08: 0000000000000001 R09: 00007fff26278d5c + R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000340 + R13: 00007fff26278de0 R14: 00007fff26278d96 R15: 0000563c83ca57c0 + Modules linked in: btrfs dm_zero dm_snapshot dm_thin_pool (...) + ---[ end trace ee2f1b19327d791d ]--- + +The steps that lead to this crash are the following: + +1) We are at transaction N; + +2) We have two tasks with a transaction handle attached to transaction N. + Task A and Task B. Task B is doing an fsync; + +3) Task B is at btrfs_sync_log(), and has saved fs_info->log_root_tree + into a local variable named 'log_root_tree' at the top of + btrfs_sync_log(). Task B is about to call write_all_supers(), but + before that... + +4) Task A calls btrfs_commit_transaction(), and after it sets the + transaction state to TRANS_STATE_COMMIT_START, an error happens before + it waits for the transaction's 'num_writers' counter to reach a value + of 1 (no one else attached to the transaction), so it jumps to the + label "cleanup_transaction"; + +5) Task A then calls cleanup_transaction(), where it aborts the + transaction, setting BTRFS_FS_STATE_TRANS_ABORTED on fs_info->fs_state, + setting the ->aborted field of the transaction and the handle to an + errno value and also setting BTRFS_FS_STATE_ERROR on fs_info->fs_state. + + After that, at cleanup_transaction(), it deletes the transaction from + the list of transactions (fs_info->trans_list), sets the transaction + to the state TRANS_STATE_COMMIT_DOING and then waits for the number + of writers to go down to 1, as it's currently 2 (1 for task A and 1 + for task B); + +6) The transaction kthread is running and sees that BTRFS_FS_STATE_ERROR + is set in fs_info->fs_state, so it calls btrfs_cleanup_transaction(). + + There it sees the list fs_info->trans_list is empty, and then proceeds + into calling btrfs_drop_all_logs(), which frees the log root tree with + a call to btrfs_free_log_root_tree(); + +7) Task B calls write_all_supers() and, shortly after, under the label + 'out_wake_log_root', it deferences the pointer stored in + 'log_root_tree', which was already freed in the previous step by the + transaction kthread. This results in a use-after-free leading to a + crash. + +Fix this by deleting the transaction from the list of transactions at +cleanup_transaction() only after setting the transaction state to +TRANS_STATE_COMMIT_DOING and waiting for all existing tasks that are +attached to the transaction to release their transaction handles. +This makes the transaction kthread wait for all the tasks attached to +the transaction to be done with the transaction before dropping the +log roots and doing other cleanups. + +Fixes: ef67963dac255b ("btrfs: drop logs when we've aborted a transaction") +CC: stable@vger.kernel.org # 5.10+ +Reviewed-by: Josef Bacik +Signed-off-by: Filipe Manana +Signed-off-by: David Sterba +--- + fs/btrfs/transaction.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c +index 62f5195d0076..f75de9f6c0ad 100644 +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -1986,7 +1986,6 @@ static void cleanup_transaction(struct btrfs_trans_handle *trans, int err) + */ + BUG_ON(list_empty(&cur_trans->list)); + +- list_del_init(&cur_trans->list); + if (cur_trans == fs_info->running_transaction) { + cur_trans->state = TRANS_STATE_COMMIT_DOING; + spin_unlock(&fs_info->trans_lock); +@@ -1995,6 +1994,17 @@ static void cleanup_transaction(struct btrfs_trans_handle *trans, int err) + + spin_lock(&fs_info->trans_lock); + } ++ ++ /* ++ * Now that we know no one else is still using the transaction we can ++ * remove the transaction from the list of transactions. This avoids ++ * the transaction kthread from cleaning up the transaction while some ++ * other task is still using it, which could result in a use-after-free ++ * on things like log trees, as it forces the transaction kthread to ++ * wait for this transaction to be cleaned up by us. ++ */ ++ list_del_init(&cur_trans->list); ++ + spin_unlock(&fs_info->trans_lock); + + btrfs_cleanup_one_transaction(trans->transaction, fs_info); +-- +2.26.2 + diff --git a/patches.suse/btrfs-fix-race-when-picking-most-recent-mod-log-oper.patch b/patches.suse/btrfs-fix-race-when-picking-most-recent-mod-log-oper.patch new file mode 100644 index 0000000..b132e2f --- /dev/null +++ b/patches.suse/btrfs-fix-race-when-picking-most-recent-mod-log-oper.patch @@ -0,0 +1,326 @@ +From: Filipe Manana +Date: Tue, 20 Apr 2021 10:55:44 +0100 +Git-commit: f9690f426b2134cc3e74bfc5d9dfd6a4b2ca5281 +Patch-mainline: v5.13-rc1 +Subject: [PATCH] btrfs: fix race when picking most recent mod log operation + for an old root +References: bsc#1186439 + +Commit dbcc7d57bffc0c ("btrfs: fix race when cloning extent buffer during +rewind of an old root"), fixed a race when we need to rewind the extent +buffer of an old root. It was caused by picking a new mod log operation +for the extent buffer while getting a cloned extent buffer with an outdated +number of items (off by -1), because we cloned the extent buffer without +locking it first. + +However there is still another similar race, but in the opposite direction. +The cloned extent buffer has a number of items that does not match the +number of tree mod log operations that are going to be replayed. This is +because right after we got the last (most recent) tree mod log operation to +replay and before locking and cloning the extent buffer, another task adds +a new pointer to the extent buffer, which results in adding a new tree mod +log operation and incrementing the number of items in the extent buffer. +So after cloning we have mismatch between the number of items in the extent +buffer and the number of mod log operations we are going to apply to it. +This results in hitting a BUG_ON() that produces the following stack trace: + + ------------[ cut here ]------------ + kernel BUG at fs/btrfs/tree-mod-log.c:675! + invalid opcode: 0000 [#1] SMP KASAN PTI + CPU: 3 PID: 4811 Comm: crawl_1215 Tainted: G W 5.12.0-7d1efdf501f8-misc-next+ #99 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 + RIP: 0010:tree_mod_log_rewind+0x3b1/0x3c0 + Code: 05 48 8d 74 10 (...) + RSP: 0018:ffffc90001027090 EFLAGS: 00010293 + RAX: 0000000000000000 RBX: ffff8880a8514600 RCX: ffffffffaa9e59b6 + RDX: 0000000000000007 RSI: dffffc0000000000 RDI: ffff8880a851462c + RBP: ffffc900010270e0 R08: 00000000000000c0 R09: ffffed1004333417 + R10: ffff88802199a0b7 R11: ffffed1004333416 R12: 000000000000000e + R13: ffff888135af8748 R14: ffff88818766ff00 R15: ffff8880a851462c + FS: 00007f29acf62700(0000) GS:ffff8881f2200000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007f0e6013f718 CR3: 000000010d42e003 CR4: 0000000000170ee0 + Call Trace: + btrfs_get_old_root+0x16a/0x5c0 + ? lock_downgrade+0x400/0x400 + btrfs_search_old_slot+0x192/0x520 + ? btrfs_search_slot+0x1090/0x1090 + ? free_extent_buffer.part.61+0xd7/0x140 + ? free_extent_buffer+0x13/0x20 + resolve_indirect_refs+0x3e9/0xfc0 + ? lock_downgrade+0x400/0x400 + ? __kasan_check_read+0x11/0x20 + ? add_prelim_ref.part.11+0x150/0x150 + ? lock_downgrade+0x400/0x400 + ? __kasan_check_read+0x11/0x20 + ? lock_acquired+0xbb/0x620 + ? __kasan_check_write+0x14/0x20 + ? do_raw_spin_unlock+0xa8/0x140 + ? rb_insert_color+0x340/0x360 + ? prelim_ref_insert+0x12d/0x430 + find_parent_nodes+0x5c3/0x1830 + ? stack_trace_save+0x87/0xb0 + ? resolve_indirect_refs+0xfc0/0xfc0 + ? fs_reclaim_acquire+0x67/0xf0 + ? __kasan_check_read+0x11/0x20 + ? lockdep_hardirqs_on_prepare+0x210/0x210 + ? fs_reclaim_acquire+0x67/0xf0 + ? __kasan_check_read+0x11/0x20 + ? ___might_sleep+0x10f/0x1e0 + ? __kasan_kmalloc+0x9d/0xd0 + ? trace_hardirqs_on+0x55/0x120 + btrfs_find_all_roots_safe+0x142/0x1e0 + ? find_parent_nodes+0x1830/0x1830 + ? trace_hardirqs_on+0x55/0x120 + ? ulist_free+0x1f/0x30 + ? btrfs_inode_flags_to_xflags+0x50/0x50 + iterate_extent_inodes+0x20e/0x580 + ? tree_backref_for_extent+0x230/0x230 + ? release_extent_buffer+0x225/0x280 + ? read_extent_buffer+0xdd/0x110 + ? lock_downgrade+0x400/0x400 + ? __kasan_check_read+0x11/0x20 + ? lock_acquired+0xbb/0x620 + ? __kasan_check_write+0x14/0x20 + ? do_raw_spin_unlock+0xa8/0x140 + ? _raw_spin_unlock+0x22/0x30 + ? release_extent_buffer+0x225/0x280 + iterate_inodes_from_logical+0x129/0x170 + ? iterate_inodes_from_logical+0x129/0x170 + ? btrfs_inode_flags_to_xflags+0x50/0x50 + ? iterate_extent_inodes+0x580/0x580 + ? __vmalloc_node+0x92/0xb0 + ? init_data_container+0x34/0xb0 + ? init_data_container+0x34/0xb0 + ? kvmalloc_node+0x60/0x80 + btrfs_ioctl_logical_to_ino+0x158/0x230 + btrfs_ioctl+0x2038/0x4360 + ? __kasan_check_write+0x14/0x20 + ? mmput+0x3b/0x220 + ? btrfs_ioctl_get_supported_features+0x30/0x30 + ? __kasan_check_read+0x11/0x20 + ? __kasan_check_read+0x11/0x20 + ? lock_release+0xc8/0x650 + ? __might_fault+0x64/0xd0 + ? __kasan_check_read+0x11/0x20 + ? lock_downgrade+0x400/0x400 + ? lockdep_hardirqs_on_prepare+0x210/0x210 + ? lockdep_hardirqs_on_prepare+0x13/0x210 + ? _raw_spin_unlock_irqrestore+0x51/0x63 + ? __kasan_check_read+0x11/0x20 + ? do_vfs_ioctl+0xfc/0x9d0 + ? ioctl_file_clone+0xe0/0xe0 + ? lock_downgrade+0x400/0x400 + ? lockdep_hardirqs_on_prepare+0x210/0x210 + ? __kasan_check_read+0x11/0x20 + ? lock_release+0xc8/0x650 + ? __task_pid_nr_ns+0xd3/0x250 + ? __kasan_check_read+0x11/0x20 + ? __fget_files+0x160/0x230 + ? __fget_light+0xf2/0x110 + __x64_sys_ioctl+0xc3/0x100 + do_syscall_64+0x37/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + RIP: 0033:0x7f29ae85b427 + Code: 00 00 90 48 8b (...) + RSP: 002b:00007f29acf5fcf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 + RAX: ffffffffffffffda RBX: 00007f29acf5ff40 RCX: 00007f29ae85b427 + RDX: 00007f29acf5ff48 RSI: 00000000c038943b RDI: 0000000000000003 + RBP: 0000000001000000 R08: 0000000000000000 R09: 00007f29acf60120 + R10: 00005640d5fc7b00 R11: 0000000000000246 R12: 0000000000000003 + R13: 00007f29acf5ff48 R14: 00007f29acf5ff40 R15: 00007f29acf5fef8 + Modules linked in: + ---[ end trace 85e5fce078dfbe04 ]--- + + (gdb) l *(tree_mod_log_rewind+0x3b1) + 0xffffffff819e5b21 is in tree_mod_log_rewind (fs/btrfs/tree-mod-log.c:675). + 670 * the modification. As we're going backwards, we do the + 671 * opposite of each operation here. + 672 */ + 673 switch (tm->op) { + 674 case BTRFS_MOD_LOG_KEY_REMOVE_WHILE_FREEING: + 675 BUG_ON(tm->slot < n); + 676 fallthrough; + 677 case BTRFS_MOD_LOG_KEY_REMOVE_WHILE_MOVING: + 678 case BTRFS_MOD_LOG_KEY_REMOVE: + 679 btrfs_set_node_key(eb, &tm->key, tm->slot); + (gdb) quit + +The following steps explain in more detail how it happens: + +1) We have one tree mod log user (through fiemap or the logical ino ioctl), + with a sequence number of 1, so we have fs_info->tree_mod_seq == 1. + This is task A; + +2) Another task is at ctree.c:balance_level() and we have eb X currently as + the root of the tree, and we promote its single child, eb Y, as the new + root. + + Then, at ctree.c:balance_level(), we call: + + ret = btrfs_tree_mod_log_insert_root(root->node, child, true); + +3) At btrfs_tree_mod_log_insert_root() we create a tree mod log operation + of type BTRFS_MOD_LOG_KEY_REMOVE_WHILE_FREEING, with a ->logical field + pointing to ebX->start. We only have one item in eb X, so we create + only one tree mod log operation, and store in the "tm_list" array; + +4) Then, still at btrfs_tree_mod_log_insert_root(), we create a tree mod + log element of operation type BTRFS_MOD_LOG_ROOT_REPLACE, ->logical set + to ebY->start, ->old_root.logical set to ebX->start, ->old_root.level + set to the level of eb X and ->generation set to the generation of eb X; + +5) Then btrfs_tree_mod_log_insert_root() calls tree_mod_log_free_eb() with + "tm_list" as argument. After that, tree_mod_log_free_eb() calls + tree_mod_log_insert(). This inserts the mod log operation of type + BTRFS_MOD_LOG_KEY_REMOVE_WHILE_FREEING from step 3 into the rbtree + with a sequence number of 2 (and fs_info->tree_mod_seq set to 2); + +6) Then, after inserting the "tm_list" single element into the tree mod + log rbtree, the BTRFS_MOD_LOG_ROOT_REPLACE element is inserted, which + gets the sequence number 3 (and fs_info->tree_mod_seq set to 3); + +7) Back to ctree.c:balance_level(), we free eb X by calling + btrfs_free_tree_block() on it. Because eb X was created in the current + transaction, has no other references and writeback did not happen for + it, we add it back to the free space cache/tree; + +8) Later some other task B allocates the metadata extent from eb X, since + it is marked as free space in the space cache/tree, and uses it as a + node for some other btree; + +9) The tree mod log user task calls btrfs_search_old_slot(), which calls + btrfs_get_old_root(), and finally that calls tree_mod_log_oldest_root() + with time_seq == 1 and eb_root == eb Y; + +10) The first iteration of the while loop finds the tree mod log element + with sequence number 3, for the logical address of eb Y and of type + BTRFS_MOD_LOG_ROOT_REPLACE; + +11) Because the operation type is BTRFS_MOD_LOG_ROOT_REPLACE, we don't + break out of the loop, and set root_logical to point to + tm->old_root.logical, which corresponds to the logical address of + eb X; + +12) On the next iteration of the while loop, the call to + tree_mod_log_search_oldest() returns the smallest tree mod log element + for the logical address of eb X, which has a sequence number of 2, an + operation type of BTRFS_MOD_LOG_KEY_REMOVE_WHILE_FREEING and + corresponds to the old slot 0 of eb X (eb X had only 1 item in it + before being freed at step 7); + +13) We then break out of the while loop and return the tree mod log + operation of type BTRFS_MOD_LOG_ROOT_REPLACE (eb Y), and not the one + for slot 0 of eb X, to btrfs_get_old_root(); + +14) At btrfs_get_old_root(), we process the BTRFS_MOD_LOG_ROOT_REPLACE + operation and set "logical" to the logical address of eb X, which was + the old root. We then call tree_mod_log_search() passing it the logical + address of eb X and time_seq == 1; + +15) But before calling tree_mod_log_search(), task B locks eb X, adds a + key to eb X, which results in adding a tree mod log operation of type + BTRFS_MOD_LOG_KEY_ADD, with a sequence number of 4, to the tree mod + log, and increments the number of items in eb X from 0 to 1. + Now fs_info->tree_mod_seq has a value of 4; + +16) Task A then calls tree_mod_log_search(), which returns the most recent + tree mod log operation for eb X, which is the one just added by task B + at the previous step, with a sequence number of 4, a type of + BTRFS_MOD_LOG_KEY_ADD and for slot 0; + +17) Before task A locks and clones eb X, task A adds another key to eb X, + which results in adding a new BTRFS_MOD_LOG_KEY_ADD mod log operation, + with a sequence number of 5, for slot 1 of eb X, increments the + number of items in eb X from 1 to 2, and unlocks eb X. + Now fs_info->tree_mod_seq has a value of 5; + +18) Task A then locks eb X and clones it. The clone has a value of 2 for + the number of items and the pointer "tm" points to the tree mod log + operation with sequence number 4, not the most recent one with a + sequence number of 5, so there is mismatch between the number of + mod log operations that are going to be applied to the cloned version + of eb X and the number of items in the clone; + +19) Task A then calls tree_mod_log_rewind() with the clone of eb X, the + tree mod log operation with sequence number 4 and a type of + BTRFS_MOD_LOG_KEY_ADD, and time_seq == 1; + +20) At tree_mod_log_rewind(), we set the local variable "n" with a value + of 2, which is the number of items in the clone of eb X. + + Then in the first iteration of the while loop, we process the mod log + operation with sequence number 4, which is targeted at slot 0 and has + a type of BTRFS_MOD_LOG_KEY_ADD. This results in decrementing "n" from + 2 to 1. + + Then we pick the next tree mod log operation for eb X, which is the + tree mod log operation with a sequence number of 2, a type of + BTRFS_MOD_LOG_KEY_REMOVE_WHILE_FREEING and for slot 0, it is the one + added in step 5 to the tree mod log tree. + + We go back to the top of the loop to process this mod log operation, + and because its slot is 0 and "n" has a value of 1, we hit the BUG_ON: + + (...) + switch (tm->op) { + case BTRFS_MOD_LOG_KEY_REMOVE_WHILE_FREEING: + BUG_ON(tm->slot < n); + fallthrough; + (...) + +Fix this by checking for a more recent tree mod log operation after locking +and cloning the extent buffer of the old root node, and use it as the first +operation to apply to the cloned extent buffer when rewinding it. + +Stable backport notes: due to moved code and renames, in =< 5.11 the +change should be applied to ctree.c:get_old_root. + +Reported-by: Zygo Blaxell +Link: https://lore.kernel.org/linux-btrfs/20210404040732.GZ32440@hungrycats.org/ +Fixes: 834328a8493079 ("Btrfs: tree mod log's old roots could still be part of the tree") +CC: stable@vger.kernel.org # 4.4+ +Signed-off-by: Filipe Manana +Signed-off-by: David Sterba +--- + fs/btrfs/ctree.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c +index 3c9da1aec..8780a7432 100755 +--- a/fs/btrfs/ctree.c ++++ b/fs/btrfs/ctree.c +@@ -1384,10 +1384,30 @@ get_old_root(struct btrfs_root *root, u64 time_seq) + "failed to read tree block %llu from get_old_root", + logical); + } else { ++ struct tree_mod_elem *tm2; ++ + btrfs_tree_read_lock(old); + eb = btrfs_clone_extent_buffer(old); ++ /* ++ * After the lookup for the most recent tree mod operation ++ * above and before we locked and cloned the extent buffer ++ * 'old', a new tree mod log operation may have been added. ++ * So lookup for a more recent one to make sure the number ++ * of mod log operations we replay is consistent with the ++ * number of items we have in the cloned extent buffer, ++ * otherwise we can hit a BUG_ON when rewinding the extent ++ * buffer. ++ */ ++ tm2 = tree_mod_log_search(fs_info, logical, time_seq); + btrfs_tree_read_unlock(old); + free_extent_buffer(old); ++ ASSERT(tm2); ++ ASSERT(tm2 == tm || tm2->seq > tm->seq); ++ if (!tm2 || tm2->seq < tm->seq) { ++ free_extent_buffer(eb); ++ return NULL; ++ } ++ tm = tm2; + } + } else if (old_root) { + eb_root_owner = btrfs_header_owner(eb_root); +-- +2.26.2 + diff --git a/patches.suse/cdc-wdm-untangle-a-circular-dependency-between-callb.patch b/patches.suse/cdc-wdm-untangle-a-circular-dependency-between-callb.patch new file mode 100644 index 0000000..b020deb --- /dev/null +++ b/patches.suse/cdc-wdm-untangle-a-circular-dependency-between-callb.patch @@ -0,0 +1,111 @@ +From 18abf874367456540846319574864e6ff32752e2 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Mon, 26 Apr 2021 11:26:22 +0200 +Subject: [PATCH] cdc-wdm: untangle a circular dependency between callback and softint +Git-commit: 18abf874367456540846319574864e6ff32752e2 +Patch-mainline: v5.13-rc2 +References: git-fixes + +We have a cycle of callbacks scheduling works which submit +URBs with those callbacks. This needs to be blocked, stopped +and unblocked to untangle the circle. + +Signed-off-by: Oliver Neukum +Link: https://lore.kernel.org/r/20210426092622.20433-1-oneukum@suse.com +Cc: stable +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/class/cdc-wdm.c | 30 ++++++++++++++++++++++-------- + 1 file changed, 22 insertions(+), 8 deletions(-) + +diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c +index 508b1c3f8b73..d1e4a7379beb 100644 +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -321,12 +321,23 @@ static void wdm_int_callback(struct urb *urb) + + } + +-static void kill_urbs(struct wdm_device *desc) ++static void poison_urbs(struct wdm_device *desc) + { + /* the order here is essential */ +- usb_kill_urb(desc->command); +- usb_kill_urb(desc->validity); +- usb_kill_urb(desc->response); ++ usb_poison_urb(desc->command); ++ usb_poison_urb(desc->validity); ++ usb_poison_urb(desc->response); ++} ++ ++static void unpoison_urbs(struct wdm_device *desc) ++{ ++ /* ++ * the order here is not essential ++ * it is symmetrical just to be nice ++ */ ++ usb_unpoison_urb(desc->response); ++ usb_unpoison_urb(desc->validity); ++ usb_unpoison_urb(desc->command); + } + + static void free_urbs(struct wdm_device *desc) +@@ -741,11 +752,12 @@ static int wdm_release(struct inode *inode, struct file *file) + if (!desc->count) { + if (!test_bit(WDM_DISCONNECTING, &desc->flags)) { + dev_dbg(&desc->intf->dev, "wdm_release: cleanup\n"); +- kill_urbs(desc); ++ poison_urbs(desc); + spin_lock_irq(&desc->iuspin); + desc->resp_count = 0; + spin_unlock_irq(&desc->iuspin); + desc->manage_power(desc->intf, 0); ++ unpoison_urbs(desc); + } else { + /* must avoid dev_printk here as desc->intf is invalid */ + pr_debug(KBUILD_MODNAME " %s: device gone - cleaning up\n", __func__); +@@ -1037,9 +1049,9 @@ static void wdm_disconnect(struct usb_interface *intf) + wake_up_all(&desc->wait); + mutex_lock(&desc->rlock); + mutex_lock(&desc->wlock); ++ poison_urbs(desc); + cancel_work_sync(&desc->rxwork); + cancel_work_sync(&desc->service_outs_intr); +- kill_urbs(desc); + mutex_unlock(&desc->wlock); + mutex_unlock(&desc->rlock); + +@@ -1080,9 +1092,10 @@ static int wdm_suspend(struct usb_interface *intf, pm_message_t message) + set_bit(WDM_SUSPENDING, &desc->flags); + spin_unlock_irq(&desc->iuspin); + /* callback submits work - order is essential */ +- kill_urbs(desc); ++ poison_urbs(desc); + cancel_work_sync(&desc->rxwork); + cancel_work_sync(&desc->service_outs_intr); ++ unpoison_urbs(desc); + } + if (!PMSG_IS_AUTO(message)) { + mutex_unlock(&desc->wlock); +@@ -1140,7 +1153,7 @@ static int wdm_pre_reset(struct usb_interface *intf) + wake_up_all(&desc->wait); + mutex_lock(&desc->rlock); + mutex_lock(&desc->wlock); +- kill_urbs(desc); ++ poison_urbs(desc); + cancel_work_sync(&desc->rxwork); + cancel_work_sync(&desc->service_outs_intr); + return 0; +@@ -1151,6 +1164,7 @@ static int wdm_post_reset(struct usb_interface *intf) + struct wdm_device *desc = wdm_find_device(intf); + int rv; + ++ unpoison_urbs(desc); + clear_bit(WDM_OVERFLOW, &desc->flags); + clear_bit(WDM_RESETTING, &desc->flags); + rv = recover_from_urb_loss(desc); +-- +2.26.2 + diff --git a/patches.suse/cdrom-gdrom-deallocate-struct-gdrom_unit-fields-in-r.patch b/patches.suse/cdrom-gdrom-deallocate-struct-gdrom_unit-fields-in-r.patch new file mode 100644 index 0000000..bb54539 --- /dev/null +++ b/patches.suse/cdrom-gdrom-deallocate-struct-gdrom_unit-fields-in-r.patch @@ -0,0 +1,58 @@ +From d03d1021da6fe7f46efe9f2a7335564e7c9db5ab Mon Sep 17 00:00:00 2001 +From: Atul Gopinathan +Date: Mon, 3 May 2021 13:56:54 +0200 +Subject: [PATCH] cdrom: gdrom: deallocate struct gdrom_unit fields in remove_gdrom +Git-commit: d03d1021da6fe7f46efe9f2a7335564e7c9db5ab +Patch-mainline: v5.13-rc3 +References: git-fixes + +The fields, "toc" and "cd_info", of "struct gdrom_unit gd" are allocated +in "probe_gdrom()". Prevent a memory leak by making sure "gd.cd_info" is +deallocated in the "remove_gdrom()" function. + +Also prevent double free of the field "gd.toc" by moving it from the +module's exit function to "remove_gdrom()". This is because, in +"probe_gdrom()", the function makes sure to deallocate "gd.toc" in case +of any errors, so the exit function invoked later would again free +"gd.toc". + +The patch also maintains consistency by deallocating the above mentioned +fields in "remove_gdrom()" along with another memory allocated field +"gd.disk". + +Suggested-by: Jens Axboe +Cc: Peter Rosin +Cc: stable +Signed-off-by: Atul Gopinathan +Link: https://lore.kernel.org/r/20210503115736.2104747-28-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/cdrom/gdrom.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c +index 7f681320c7d3..6c4f6139f853 100644 +--- a/drivers/cdrom/gdrom.c ++++ b/drivers/cdrom/gdrom.c +@@ -830,6 +830,8 @@ static int remove_gdrom(struct platform_device *devptr) + if (gdrom_major) + unregister_blkdev(gdrom_major, GDROM_DEV_NAME); + unregister_cdrom(gd.cd_info); ++ kfree(gd.cd_info); ++ kfree(gd.toc); + + return 0; + } +@@ -861,7 +863,6 @@ static void __exit exit_gdrom(void) + { + platform_device_unregister(pd); + platform_driver_unregister(&gdrom_driver); +- kfree(gd.toc); + } + + module_init(init_gdrom); +-- +2.26.2 + diff --git a/patches.suse/cdrom-gdrom-initialize-global-variable-at-init-time.patch b/patches.suse/cdrom-gdrom-initialize-global-variable-at-init-time.patch new file mode 100644 index 0000000..147313b --- /dev/null +++ b/patches.suse/cdrom-gdrom-initialize-global-variable-at-init-time.patch @@ -0,0 +1,53 @@ +From 9183f01b5e6e32eb3f17b5f3f8d5ad5ac9786c49 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Thu, 6 May 2021 16:00:47 +0200 +Subject: [PATCH] cdrom: gdrom: initialize global variable at init time +Git-commit: 9183f01b5e6e32eb3f17b5f3f8d5ad5ac9786c49 +Patch-mainline: v5.13-rc3 +References: git-fixes + +As Peter points out, if we were to disconnect and then reconnect this +driver from a device, the "global" state of the device would contain odd +values and could cause problems. Fix this up by just initializing the +whole thing to 0 at probe() time. + +Ideally this would be a per-device variable, but given the age and the +total lack of users of it, that would require a lot of s/./->/g changes +for really no good reason. + +Reported-by: Peter Rosin +Cc: Jens Axboe +Reviewed-by: Peter Rosin +Link: https://lore.kernel.org/r/YJP2j6AU82MqEY2M@kroah.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/cdrom/gdrom.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/cdrom/gdrom.c ++++ b/drivers/cdrom/gdrom.c +@@ -740,6 +740,13 @@ static const struct blk_mq_ops gdrom_mq_ + static int probe_gdrom(struct platform_device *devptr) + { + int err; ++ ++ /* ++ * Ensure our "one" device is initialized properly in case of previous ++ * usages of it ++ */ ++ memset(&gd, 0, sizeof(gd)); ++ + /* Start the device */ + if (gdrom_execute_diagnostic() != 1) { + pr_warning("ATA Probe for GDROM failed\n"); +@@ -845,7 +852,7 @@ static struct platform_driver gdrom_driv + static int __init init_gdrom(void) + { + int rc; +- gd.toc = NULL; ++ + rc = platform_driver_register(&gdrom_driver); + if (rc) + return rc; diff --git a/patches.suse/ceph-don-t-clobber-i_snap_caps-on-non-i_new-inode.patch b/patches.suse/ceph-don-t-clobber-i_snap_caps-on-non-i_new-inode.patch new file mode 100644 index 0000000..4498783 --- /dev/null +++ b/patches.suse/ceph-don-t-clobber-i_snap_caps-on-non-i_new-inode.patch @@ -0,0 +1,50 @@ +From: Jeff Layton +Date: Mon, 1 Mar 2021 07:38:01 -0500 +Subject: ceph: don't clobber i_snap_caps on non-I_NEW inode +Git-commit: d3c51ae1b8cce5bdaf91a1ce32b33cf5626075dc +Patch-mainline: v5.13-rc1 +References: bsc#1186501 + +We want the snapdir to mirror the non-snapped directory's attributes for +most things, but i_snap_caps represents the caps granted on the snapshot +directory by the MDS itself. A misbehaving MDS could issue different +caps for the snapdir and we lose them here. + +Only reset i_snap_caps when the inode is I_NEW. Also, move the setting +of i_op and i_fop inside the if block since they should never change +anyway. + +Reported-by: Al Viro +Signed-off-by: Jeff Layton +Signed-off-by: Ilya Dryomov +Acked-by: Luis Henriques + +--- + fs/ceph/inode.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c +index 4418d4be2907..2fd1c48ac5d7 100644 +--- a/fs/ceph/inode.c ++++ b/fs/ceph/inode.c +@@ -87,14 +87,15 @@ struct inode *ceph_get_snapdir(struct inode *parent) + inode->i_mtime = parent->i_mtime; + inode->i_ctime = parent->i_ctime; + inode->i_atime = parent->i_atime; +- inode->i_op = &ceph_snapdir_iops; +- inode->i_fop = &ceph_snapdir_fops; +- ci->i_snap_caps = CEPH_CAP_PIN; /* so we can open */ + ci->i_rbytes = 0; + ci->i_btime = ceph_inode(parent)->i_btime; + +- if (inode->i_state & I_NEW) ++ if (inode->i_state & I_NEW) { ++ inode->i_op = &ceph_snapdir_iops; ++ inode->i_fop = &ceph_snapdir_fops; ++ ci->i_snap_caps = CEPH_CAP_PIN; /* so we can open */ + unlock_new_inode(inode); ++ } + + return inode; + } + diff --git a/patches.suse/ceph-fix-inode-leak-on-getattr-error-in-_fh_to_dentry.patch b/patches.suse/ceph-fix-inode-leak-on-getattr-error-in-_fh_to_dentry.patch new file mode 100644 index 0000000..584f9b6 --- /dev/null +++ b/patches.suse/ceph-fix-inode-leak-on-getattr-error-in-_fh_to_dentry.patch @@ -0,0 +1,34 @@ +From: Jeff Layton +Date: Fri, 26 Mar 2021 09:21:53 -0400 +Subject: ceph: fix inode leak on getattr error in __fh_to_dentry +Git-commit: 1775c7ddacfcea29051c67409087578f8f4d751b +Patch-mainline: v5.13-rc1 +References: bsc#1186501 + +Fixes: 878dabb64117 ("ceph: don't return -ESTALE if there's still an open file") +Signed-off-by: Jeff Layton +Reviewed-by: Xiubo Li +Signed-off-by: Ilya Dryomov +Acked-by: Luis Henriques + +--- + fs/ceph/export.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/ceph/export.c b/fs/ceph/export.c +index e088843a7734..baa6368bece5 100644 +--- a/fs/ceph/export.c ++++ b/fs/ceph/export.c +@@ -178,8 +178,10 @@ static struct dentry *__fh_to_dentry(struct super_block *sb, u64 ino) + return ERR_CAST(inode); + /* We need LINK caps to reliably check i_nlink */ + err = ceph_do_getattr(inode, CEPH_CAP_LINK_SHARED, false); +- if (err) ++ if (err) { ++ iput(inode); + return ERR_PTR(err); ++ } + /* -ESTALE if inode as been unlinked and no file is open */ + if ((inode->i_nlink == 0) && (atomic_read(&inode->i_count) == 1)) { + iput(inode); + diff --git a/patches.suse/ceph-fix-up-error-handling-with-snapdirs.patch b/patches.suse/ceph-fix-up-error-handling-with-snapdirs.patch new file mode 100644 index 0000000..f67d557 --- /dev/null +++ b/patches.suse/ceph-fix-up-error-handling-with-snapdirs.patch @@ -0,0 +1,93 @@ +From: Jeff Layton +Date: Thu, 25 Feb 2021 15:04:15 -0500 +Subject: ceph: fix up error handling with snapdirs +Git-commit: 3e10a15ffc8d77f05e655d14fd48c0b790dede35 +Patch-mainline: v5.13-rc1 +References: bsc#1186501 + +There are several warts in the snapdir error handling. The -EOPNOTSUPP +return in __snapfh_to_dentry is currently lost, and the call to +ceph_handle_snapdir is not currently checked at all. + +Fix all of this up and eliminate a BUG_ON in ceph_get_snapdir. We can +handle that case with a warning and return an error. + +Signed-off-by: Jeff Layton +Signed-off-by: Al Viro +Acked-by: Luis Henriques + +--- + fs/ceph/dir.c | 2 ++ + fs/ceph/export.c | 9 +++++---- + fs/ceph/inode.c | 14 +++++++++++++- + 3 files changed, 20 insertions(+), 5 deletions(-) + +diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c +index 83d9358854fb..f7a790ed62c4 100644 +--- a/fs/ceph/dir.c ++++ b/fs/ceph/dir.c +@@ -677,6 +677,8 @@ int ceph_handle_snapdir(struct ceph_mds_request *req, + strcmp(dentry->d_name.name, + fsc->mount_options->snapdir_name) == 0) { + struct inode *inode = ceph_get_snapdir(parent); ++ if (IS_ERR(inode)) ++ return PTR_ERR(inode); + dout("ENOENT on snapdir %p '%pd', linking to snapdir %p\n", + dentry, dentry, inode); + BUG_ON(!d_unhashed(dentry)); +diff --git a/fs/ceph/export.c b/fs/ceph/export.c +index e088843a7734..f22156ee7306 100644 +--- a/fs/ceph/export.c ++++ b/fs/ceph/export.c +@@ -248,9 +248,10 @@ static struct dentry *__snapfh_to_dentry(struct super_block *sb, + ihold(inode); + } else { + /* mds does not support lookup snapped inode */ +- err = -EOPNOTSUPP; +- inode = NULL; ++ inode = ERR_PTR(-EOPNOTSUPP); + } ++ } else { ++ inode = ERR_PTR(-ESTALE); + } + ceph_mdsc_put_request(req); + +@@ -261,8 +262,8 @@ static struct dentry *__snapfh_to_dentry(struct super_block *sb, + dout("snapfh_to_dentry %llx.%llx parent %llx hash %x err=%d", + vino.ino, vino.snap, sfh->parent_ino, sfh->hash, err); + } +- if (!inode) +- return ERR_PTR(-ESTALE); ++ if (IS_ERR(inode)) ++ return ERR_CAST(inode); + /* see comments in ceph_get_parent() */ + return unlinked ? d_obtain_root(inode) : d_obtain_alias(inode); + } +diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c +index 156f849f5385..5db7bf4c6a26 100644 +--- a/fs/ceph/inode.c ++++ b/fs/ceph/inode.c +@@ -78,9 +78,21 @@ struct inode *ceph_get_snapdir(struct inode *parent) + struct inode *inode = ceph_get_inode(parent->i_sb, vino); + struct ceph_inode_info *ci = ceph_inode(inode); + +- BUG_ON(!S_ISDIR(parent->i_mode)); + if (IS_ERR(inode)) + return inode; ++ ++ if (!S_ISDIR(parent->i_mode)) { ++ pr_warn_once("bad snapdir parent type (mode=0%o)\n", ++ parent->i_mode); ++ return ERR_PTR(-ENOTDIR); ++ } ++ ++ if (!(inode->i_state & I_NEW) && !S_ISDIR(inode->i_mode)) { ++ pr_warn_once("bad snapdir inode type (mode=0%o)\n", ++ inode->i_mode); ++ return ERR_PTR(-ENOTDIR); ++ } ++ + inode->i_mode = parent->i_mode; + inode->i_uid = parent->i_uid; + inode->i_gid = parent->i_gid; + diff --git a/patches.suse/ceph-only-check-pool-permissions-for-regular-files.patch b/patches.suse/ceph-only-check-pool-permissions-for-regular-files.patch new file mode 100644 index 0000000..28d0c65 --- /dev/null +++ b/patches.suse/ceph-only-check-pool-permissions-for-regular-files.patch @@ -0,0 +1,37 @@ +From: Jeff Layton +Date: Tue, 26 Jan 2021 11:49:54 -0500 +Subject: ceph: only check pool permissions for regular files +Git-commit: e9b2250156c381b0973ea6ec3890fe8706426ecc +Patch-mainline: v5.13-rc1 +References: bsc#1186501 + +There is no need to do a ceph_pool_perm_check() on anything that isn't a +regular file, as the MDS is what handles talking to the OSD in those +cases. Just return 0 if it's not a regular file. + +Reported-by: Luis Henriques +Signed-off-by: Jeff Layton +Reviewed-by: Xiubo Li +Signed-off-by: Ilya Dryomov +Acked-by: Luis Henriques + +--- + fs/ceph/addr.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c +index bc9864524fde..aa612bc8a559 100644 +--- a/fs/ceph/addr.c ++++ b/fs/ceph/addr.c +@@ -1941,6 +1941,10 @@ int ceph_pool_perm_check(struct inode *inode, int need) + s64 pool; + int ret, flags; + ++ /* Only need to do this for regular files */ ++ if (!S_ISREG(inode->i_mode)) ++ return 0; ++ + if (ci->i_vino.snap != CEPH_NOSNAP) { + /* + * Pool permission check needs to write to the first object. + diff --git a/patches.suse/dmaengine-dw-edma-Fix-crash-on-loading-unloading-dri.patch b/patches.suse/dmaengine-dw-edma-Fix-crash-on-loading-unloading-dri.patch new file mode 100644 index 0000000..cd0b834 --- /dev/null +++ b/patches.suse/dmaengine-dw-edma-Fix-crash-on-loading-unloading-dri.patch @@ -0,0 +1,52 @@ +From e970dcc4bd8e0a1376e794fc81d41d0fc98262dd Mon Sep 17 00:00:00 2001 +From: Gustavo Pimentel +Date: Thu, 18 Feb 2021 20:04:06 +0100 +Subject: [PATCH] dmaengine: dw-edma: Fix crash on loading/unloading driver +Git-commit: e970dcc4bd8e0a1376e794fc81d41d0fc98262dd +Patch-mainline: v5.13-rc1 +References: git-fixes + +When the driver is compiled as a module and loaded if we try to unload +it, the Kernel shows a crash log. This Kernel crash is due to the +dma_async_device_unregister() call done after deleting the channels, +this patch fixes this issue. + +Signed-off-by: Gustavo Pimentel +Link: https://lore.kernel.org/r/4aa850c035cf7ee488f1d3fb6dee0e37be0dce0a.1613674948.git.gustavo.pimentel@synopsys.com +Signed-off-by: Vinod Koul +Acked-by: Takashi Iwai + +--- + drivers/dma/dw-edma/dw-edma-core.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/dma/dw-edma/dw-edma-core.c ++++ b/drivers/dma/dw-edma/dw-edma-core.c +@@ -910,22 +910,21 @@ int dw_edma_remove(struct dw_edma_chip * + /* Power management */ + pm_runtime_disable(dev); + ++ /* Deregister eDMA device */ ++ dma_async_device_unregister(&dw->wr_edma); + list_for_each_entry_safe(chan, _chan, &dw->wr_edma.channels, + vc.chan.device_node) { +- list_del(&chan->vc.chan.device_node); + tasklet_kill(&chan->vc.task); ++ list_del(&chan->vc.chan.device_node); + } + ++ dma_async_device_unregister(&dw->rd_edma); + list_for_each_entry_safe(chan, _chan, &dw->rd_edma.channels, + vc.chan.device_node) { +- list_del(&chan->vc.chan.device_node); + tasklet_kill(&chan->vc.task); ++ list_del(&chan->vc.chan.device_node); + } + +- /* Deregister eDMA device */ +- dma_async_device_unregister(&dw->wr_edma); +- dma_async_device_unregister(&dw->rd_edma); +- + /* Turn debugfs off */ + dw_edma_v0_core_debugfs_off(); + diff --git a/patches.suse/drm-amd-display-Fix-two-cursor-duplication-when-usin.patch b/patches.suse/drm-amd-display-Fix-two-cursor-duplication-when-usin.patch new file mode 100644 index 0000000..9e6c4cc --- /dev/null +++ b/patches.suse/drm-amd-display-Fix-two-cursor-duplication-when-usin.patch @@ -0,0 +1,142 @@ +From 16e9b3e58bc3fce7391539e0eb3fd167cbf9951f Mon Sep 17 00:00:00 2001 +From: Rodrigo Siqueira +Date: Tue, 13 Apr 2021 20:06:04 -0400 +Subject: [PATCH] drm/amd/display: Fix two cursor duplication when using overlay +Git-commit: 16e9b3e58bc3fce7391539e0eb3fd167cbf9951f +Patch-mainline: v5.13-rc1 +References: git-fixes + +Our driver supports overlay planes, and as expected, some userspace +compositor takes advantage of these features. If the userspace is not +enabling the cursor, they can use multiple planes as they please. +Nevertheless, we start to have constraints when userspace tries to +enable hardware cursor with various planes. Basically, we cannot draw +the cursor at the same size and position on two separated pipes since it +uses extra bandwidth and DML only run with one cursor. + +For those reasons, when we enable hardware cursor and multiple planes, +our driver should accept variations like the ones described below: + + +-------------+ +--------------+ + | +---------+ | | | + | |Primary | | | Primary | + | | | | | Overlay | + | +---------+ | | | + |Overlay | | | + +-------------+ +--------------+ + +In this scenario, we can have the desktop UI in the overlay and some +other framebuffer attached to the primary plane (e.g., video). However, +userspace needs to obey some rules and avoid scenarios like the ones +described below (when enabling hw cursor): + + +--------+ + |Overlay | + +-------------+ +-----+-------+ +-| |--+ + | +--------+ | +--------+ | | +--------+ | + | |Overlay | | |Overlay | | | | + | | | | | | | | | + | +--------+ | +--------+ | | | + | Primary | | Primary | | Primary | + +-------------+ +-------------+ +-------------+ + + +-------------+ +-------------+ + | +--------+ | Primary | + | |Overlay | | | + | | | | | + | +--------+ | +--------+ | + | Primary | | |Overlay | | + +-------------+ +-| |--+ + +--------+ + +If the userspace violates some of the above scenarios, our driver needs +to reject the commit; otherwise, we can have unexpected behavior. Since +we don't have a proper driver validation for the above case, we can see +some problems like a duplicate cursor in applications that use multiple +planes. This commit fixes the cursor issue and others by adding adequate +verification for multiple planes. + +Change since V1 (Harry and Sean): +- Remove cursor verification from the equation. + +Cc: Louis Li +Cc: Nicholas Kazlauskas +Cc: Harry Wentland +Cc: Hersen Wu +Cc: Sean Paul +Signed-off-by: Rodrigo Siqueira +Reviewed-by: Harry Wentland +Signed-off-by: Alex Deucher +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 51 ++++++++++++++++++++++ + 1 file changed, 51 insertions(+) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -7172,6 +7172,53 @@ cleanup: + return ret; + } + ++static int validate_overlay(struct drm_atomic_state *state) ++{ ++ int i; ++ struct drm_plane *plane; ++ struct drm_plane_state *old_plane_state, *new_plane_state; ++ struct drm_plane_state *primary_state, *overlay_state = NULL; ++ ++ /* Check if primary plane is contained inside overlay */ ++ for_each_oldnew_plane_in_state_reverse(state, plane, old_plane_state, new_plane_state, i) { ++ if (plane->type == DRM_PLANE_TYPE_OVERLAY) { ++ if (drm_atomic_plane_disabling(plane->state, new_plane_state)) ++ return 0; ++ ++ overlay_state = new_plane_state; ++ continue; ++ } ++ } ++ ++ /* check if we're making changes to the overlay plane */ ++ if (!overlay_state) ++ return 0; ++ ++ /* check if overlay plane is enabled */ ++ if (!overlay_state->crtc) ++ return 0; ++ ++ /* find the primary plane for the CRTC that the overlay is enabled on */ ++ primary_state = drm_atomic_get_plane_state(state, overlay_state->crtc->primary); ++ if (IS_ERR(primary_state)) ++ return PTR_ERR(primary_state); ++ ++ /* check if primary plane is enabled */ ++ if (!primary_state->crtc) ++ return 0; ++ ++ /* Perform the bounds check to ensure the overlay plane covers the primary */ ++ if (primary_state->crtc_x < overlay_state->crtc_x || ++ primary_state->crtc_y < overlay_state->crtc_y || ++ primary_state->crtc_x + primary_state->crtc_w > overlay_state->crtc_x + overlay_state->crtc_w || ++ primary_state->crtc_y + primary_state->crtc_h > overlay_state->crtc_y + overlay_state->crtc_h) { ++ DRM_DEBUG_ATOMIC("Overlay plane is enabled with hardware cursor but does not fully cover primary plane\n"); ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ + /** + * amdgpu_dm_atomic_check() - Atomic check implementation for AMDgpu DM. + * @dev: The DRM device +@@ -7311,6 +7358,10 @@ static int amdgpu_dm_atomic_check(struct + goto fail; + } + ++ ret = validate_overlay(state); ++ if (ret) ++ goto fail; ++ + /* Add new/modified planes */ + for_each_oldnew_plane_in_state_reverse(state, plane, old_plane_state, new_plane_state, i) { + ret = dm_update_plane_state(dc, state, plane, diff --git a/patches.suse/drm-amd-display-Force-vsync-flip-when-reconfiguring-.patch b/patches.suse/drm-amd-display-Force-vsync-flip-when-reconfiguring-.patch new file mode 100644 index 0000000..a918254 --- /dev/null +++ b/patches.suse/drm-amd-display-Force-vsync-flip-when-reconfiguring-.patch @@ -0,0 +1,40 @@ +From 56d63782af9bbd1271bff1422a6a013123eade4d Mon Sep 17 00:00:00 2001 +From: Anthony Wang +Date: Wed, 31 Mar 2021 11:03:35 -0400 +Subject: [PATCH] drm/amd/display: Force vsync flip when reconfiguring MPCC +Git-commit: 56d63782af9bbd1271bff1422a6a013123eade4d +Patch-mainline: v5.13-rc1 +References: git-fixes + +[Why] +Underflow observed when disabling PIP overlay in-game when +vsync is disabled, due to OTC master lock not working with +game pipe which is immediate flip. + +[How] +When performing a full update, override flip_immediate value +to false for all planes, so that flip occurs on vsync. + +Signed-off-by: Anthony Wang +Acked-by: Bindu Ramamurthy +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/amd/display/dc/core/dc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -1976,6 +1976,10 @@ static void commit_planes_for_stream(str + plane_state->triplebuffer_flips = true; + } + } ++ if (update_type == UPDATE_TYPE_FULL) { ++ /* force vsync flip when reconfiguring pipes to prevent underflow */ ++ plane_state->flip_immediate = false; ++ } + } + } + #endif diff --git a/patches.suse/drm-amd-display-fixed-divide-by-zero-kernel-crash-du.patch b/patches.suse/drm-amd-display-fixed-divide-by-zero-kernel-crash-du.patch new file mode 100644 index 0000000..8c35819 --- /dev/null +++ b/patches.suse/drm-amd-display-fixed-divide-by-zero-kernel-crash-du.patch @@ -0,0 +1,111 @@ +From 19cc1f3829567e7dca21c1389ea6407b8f5efab4 Mon Sep 17 00:00:00 2001 +From: Robin Singh +Date: Mon, 14 Dec 2020 19:14:48 -0500 +Subject: [PATCH] drm/amd/display: fixed divide by zero kernel crash during dsc enablement +Git-commit: 19cc1f3829567e7dca21c1389ea6407b8f5efab4 +Patch-mainline: v5.13-rc1 +References: git-fixes + +[why] +During dsc enable, a divide by zero condition triggered the +kernel crash. + +[how] +An IGT test, which enable the DSC, was crashing at the time of +restore the default dsc status, becaue of h_totals value +becoming 0. So add a check before divide condition. If h_total +is zero, gracefully ignore and set the default value. + +kernel panic log: + + [ 128.758827] divide error: 0000 [#1] PREEMPT SMP NOPTI + [ 128.762714] CPU: 5 PID: 4562 Comm: amd_dp_dsc Tainted: G W 5.4.19-android-x86_64 #1 + [ 128.769728] Hardware name: ADVANCED MICRO DEVICES, INC. Mauna/Mauna, BIOS WMN0B13N Nov 11 2020 + [ 128.777695] RIP: 0010:hubp2_vready_at_or_After_vsync+0x37/0x7a [amdgpu] + [ 128.785707] Code: 80 02 00 00 48 89 f3 48 8b 7f 08 b ...... + [ 128.805696] RSP: 0018:ffffad8f82d43628 EFLAGS: 00010246 + ...... + [ 128.857707] CR2: 00007106d8465000 CR3: 0000000426530000 CR4: 0000000000140ee0 + [ 128.865695] Call Trace: + [ 128.869712] hubp3_setup+0x1f/0x7f [amdgpu] + [ 128.873705] dcn20_update_dchubp_dpp+0xc8/0x54a [amdgpu] + [ 128.877706] dcn20_program_front_end_for_ctx+0x31d/0x463 [amdgpu] + [ 128.885706] dc_commit_state+0x3d2/0x658 [amdgpu] + [ 128.889707] amdgpu_dm_atomic_commit_tail+0x4b3/0x1e7c [amdgpu] + [ 128.897699] ? dm_read_reg_func+0x41/0xb5 [amdgpu] + [ 128.901707] ? dm_read_reg_func+0x41/0xb5 [amdgpu] + [ 128.905706] ? __is_insn_slot_addr+0x43/0x48 + [ 128.909706] ? fill_plane_buffer_attributes+0x29e/0x3dc [amdgpu] + [ 128.917705] ? dm_plane_helper_prepare_fb+0x255/0x284 [amdgpu] + [ 128.921700] ? usleep_range+0x7c/0x7c + [ 128.925705] ? preempt_count_sub+0xf/0x18 + [ 128.929706] ? _raw_spin_unlock_irq+0x13/0x24 + [ 128.933732] ? __wait_for_common+0x11e/0x18f + [ 128.937705] ? _raw_spin_unlock_irq+0x13/0x24 + [ 128.941706] ? __wait_for_common+0x11e/0x18f + [ 128.945705] commit_tail+0x8b/0xd2 [drm_kms_helper] + [ 128.949707] drm_atomic_helper_commit+0xd8/0xf5 [drm_kms_helper] + [ 128.957706] amdgpu_dm_atomic_commit+0x337/0x360 [amdgpu] + [ 128.961705] ? drm_atomic_check_only+0x543/0x68d [drm] + [ 128.969705] ? drm_atomic_set_property+0x760/0x7af [drm] + [ 128.973704] ? drm_mode_atomic_ioctl+0x6f3/0x85a [drm] + [ 128.977705] drm_mode_atomic_ioctl+0x6f3/0x85a [drm] + [ 128.985705] ? drm_atomic_set_property+0x7af/0x7af [drm] + [ 128.989706] drm_ioctl_kernel+0x82/0xda [drm] + [ 128.993706] drm_ioctl+0x225/0x319 [drm] + [ 128.997707] ? drm_atomic_set_property+0x7af/0x7af [drm] + [ 129.001706] ? preempt_count_sub+0xf/0x18 + [ 129.005713] amdgpu_drm_ioctl+0x4b/0x76 [amdgpu] + [ 129.009705] vfs_ioctl+0x1d/0x2a + [ 129.013705] do_vfs_ioctl+0x419/0x43d + [ 129.017707] ksys_ioctl+0x52/0x71 + [ 129.021707] __x64_sys_ioctl+0x16/0x19 + [ 129.025706] do_syscall_64+0x78/0x85 + [ 129.029705] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Signed-off-by: Robin Singh +Reviewed-by: Harry Wentland +Reviewed-by: Robin Singh +Acked-by: Aurabindo Pillai +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c +index bec7059f6d5d..a1318c31bcfa 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c +@@ -1,5 +1,5 @@ + /* +- * Copyright 2012-17 Advanced Micro Devices, Inc. ++ * Copyright 2012-2021 Advanced Micro Devices, Inc. + * + * Permission is hereby granted, free of charge, to any person obtaining a + * copy of this software and associated documentation files (the "Software"), +@@ -181,11 +181,14 @@ void hubp2_vready_at_or_After_vsync(struct hubp *hubp, + else + Set HUBP_VREADY_AT_OR_AFTER_VSYNC = 0 + */ +- if ((pipe_dest->vstartup_start - (pipe_dest->vready_offset+pipe_dest->vupdate_width +- + pipe_dest->vupdate_offset) / pipe_dest->htotal) <= pipe_dest->vblank_end) { +- value = 1; +- } else +- value = 0; ++ if (pipe_dest->htotal != 0) { ++ if ((pipe_dest->vstartup_start - (pipe_dest->vready_offset+pipe_dest->vupdate_width ++ + pipe_dest->vupdate_offset) / pipe_dest->htotal) <= pipe_dest->vblank_end) { ++ value = 1; ++ } else ++ value = 0; ++ } ++ + REG_UPDATE(DCHUBP_CNTL, HUBP_VREADY_AT_OR_AFTER_VSYNC, value); + } + +-- +2.26.2 + diff --git a/patches.suse/drm-amdgpu-disable-3DCGCG-on-picasso-raven1-to-avoid.patch b/patches.suse/drm-amdgpu-disable-3DCGCG-on-picasso-raven1-to-avoid.patch new file mode 100644 index 0000000..08d4af5 --- /dev/null +++ b/patches.suse/drm-amdgpu-disable-3DCGCG-on-picasso-raven1-to-avoid.patch @@ -0,0 +1,75 @@ +From dbd1003d1252db5973dddf20b24bb0106ac52aa2 Mon Sep 17 00:00:00 2001 +From: Changfeng +Date: Fri, 14 May 2021 15:28:25 +0800 +Subject: [PATCH] drm/amdgpu: disable 3DCGCG on picasso/raven1 to avoid compute hang +Git-commit: dbd1003d1252db5973dddf20b24bb0106ac52aa2 +Patch-mainline: v5.13-rc3 +References: git-fixes + +There is problem with 3DCGCG firmware and it will cause compute test +hang on picasso/raven1. It needs to disable 3DCGCG in driver to avoid +compute hang. + +Signed-off-by: Changfeng +Reviewed-by: Alex Deucher +Reviewed-by: Huang Rui +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 10 +++++++--- + drivers/gpu/drm/amd/amdgpu/soc15.c | 2 -- + 2 files changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +index a078a38c2cee..516467e962b7 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -4943,7 +4943,7 @@ static void gfx_v9_0_update_3d_clock_gating(struct amdgpu_device *adev, + amdgpu_gfx_rlc_enter_safe_mode(adev); + + /* Enable 3D CGCG/CGLS */ +- if (enable && (adev->cg_flags & AMD_CG_SUPPORT_GFX_3D_CGCG)) { ++ if (enable) { + /* write cmd to clear cgcg/cgls ov */ + def = data = RREG32_SOC15(GC, 0, mmRLC_CGTT_MGCG_OVERRIDE); + /* unset CGCG override */ +@@ -4955,8 +4955,12 @@ static void gfx_v9_0_update_3d_clock_gating(struct amdgpu_device *adev, + /* enable 3Dcgcg FSM(0x0000363f) */ + def = RREG32_SOC15(GC, 0, mmRLC_CGCG_CGLS_CTRL_3D); + +- data = (0x36 << RLC_CGCG_CGLS_CTRL_3D__CGCG_GFX_IDLE_THRESHOLD__SHIFT) | +- RLC_CGCG_CGLS_CTRL_3D__CGCG_EN_MASK; ++ if (adev->cg_flags & AMD_CG_SUPPORT_GFX_3D_CGCG) ++ data = (0x36 << RLC_CGCG_CGLS_CTRL_3D__CGCG_GFX_IDLE_THRESHOLD__SHIFT) | ++ RLC_CGCG_CGLS_CTRL_3D__CGCG_EN_MASK; ++ else ++ data = 0x0 << RLC_CGCG_CGLS_CTRL_3D__CGCG_GFX_IDLE_THRESHOLD__SHIFT; ++ + if (adev->cg_flags & AMD_CG_SUPPORT_GFX_3D_CGLS) + data |= (0x000F << RLC_CGCG_CGLS_CTRL_3D__CGLS_REP_COMPANSAT_DELAY__SHIFT) | + RLC_CGCG_CGLS_CTRL_3D__CGLS_EN_MASK; +diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c +index 8e1b9a40839f..980675052b53 100644 +--- a/drivers/gpu/drm/amd/amdgpu/soc15.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c +@@ -1392,7 +1392,6 @@ static int soc15_common_early_init(void *handle) + adev->cg_flags = AMD_CG_SUPPORT_GFX_MGCG | + AMD_CG_SUPPORT_GFX_MGLS | + AMD_CG_SUPPORT_GFX_CP_LS | +- AMD_CG_SUPPORT_GFX_3D_CGCG | + AMD_CG_SUPPORT_GFX_3D_CGLS | + AMD_CG_SUPPORT_GFX_CGCG | + AMD_CG_SUPPORT_GFX_CGLS | +@@ -1412,7 +1411,6 @@ static int soc15_common_early_init(void *handle) + AMD_CG_SUPPORT_GFX_MGLS | + AMD_CG_SUPPORT_GFX_RLC_LS | + AMD_CG_SUPPORT_GFX_CP_LS | +- AMD_CG_SUPPORT_GFX_3D_CGCG | + AMD_CG_SUPPORT_GFX_3D_CGLS | + AMD_CG_SUPPORT_GFX_CGCG | + AMD_CG_SUPPORT_GFX_CGLS | +-- +2.26.2 + diff --git a/patches.suse/drm-i915-Avoid-div-by-zero-on-gen2.patch b/patches.suse/drm-i915-Avoid-div-by-zero-on-gen2.patch new file mode 100644 index 0000000..a83f277 --- /dev/null +++ b/patches.suse/drm-i915-Avoid-div-by-zero-on-gen2.patch @@ -0,0 +1,54 @@ +From 4819d16d91145966ce03818a95169df1fd56b299 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Wed, 21 Apr 2021 18:33:58 +0300 +Subject: [PATCH] drm/i915: Avoid div-by-zero on gen2 +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 4819d16d91145966ce03818a95169df1fd56b299 +Patch-mainline: v5.13-rc2 +Alt-commit: ed52c62d386f764194e0184fdb905d5f24194cae +References: git-fixes + +Gen2 tiles are 2KiB in size so i915_gem_object_get_tile_row_size() +can in fact return <4KiB, which leads to div-by-zero here. +Avoid that. + +Not sure i915_gem_object_get_tile_row_size() is entirely +sane anyway since it doesn't account for the different tile +layouts on i8xx/i915... + +I'm not able to hit this before commit 6846895fde05 ("drm/i915: +Replace PIN_NONFAULT with calls to PIN_NOEVICT") and it looks +like I also need to run recent version of Mesa. With those in +place xonotic trips on this quite easily on my 85x. + +Cc: stable@vger.kernel.org +Reviewed-by: Chris Wilson +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20210421153401.13847-2-ville.syrjala@linux.intel.com +(cherry picked from commit ed52c62d386f764194e0184fdb905d5f24194cae) + +Signed-off-by: Jani Nikula +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/i915/gem/i915_gem_mman.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/gem/i915_gem_mman.c b/drivers/gpu/drm/i915/gem/i915_gem_mman.c +index 23f6b00e08e2..f6fe5cb01438 100644 +--- a/drivers/gpu/drm/i915/gem/i915_gem_mman.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_mman.c +@@ -189,7 +189,7 @@ compute_partial_view(const struct drm_i915_gem_object *obj, + struct i915_ggtt_view view; + + if (i915_gem_object_is_tiled(obj)) +- chunk = roundup(chunk, tile_row_pages(obj)); ++ chunk = roundup(chunk, tile_row_pages(obj) ?: 1); + + view.type = I915_GGTT_VIEW_PARTIAL; + view.partial.offset = rounddown(page_offset, chunk); +-- +2.26.2 + diff --git a/patches.suse/drm-meson-fix-shutdown-crash-when-component-not-prob.patch b/patches.suse/drm-meson-fix-shutdown-crash-when-component-not-prob.patch new file mode 100644 index 0000000..472e909 --- /dev/null +++ b/patches.suse/drm-meson-fix-shutdown-crash-when-component-not-prob.patch @@ -0,0 +1,64 @@ +From 7cfc4ea78fc103ea51ecbacd9236abb5b1c490d2 Mon Sep 17 00:00:00 2001 +From: Neil Armstrong +Date: Fri, 30 Apr 2021 10:27:44 +0200 +Subject: [PATCH] drm/meson: fix shutdown crash when component not probed +Git-commit: 7cfc4ea78fc103ea51ecbacd9236abb5b1c490d2 +Patch-mainline: v5.13-rc4 +References: git-fixes + +When main component is not probed, by example when the dw-hdmi module is +not loaded yet or in probe defer, the following crash appears on shutdown: + +Unable to handle kernel NULL pointer dereference at virtual address 0000000000000038 +... +pc : meson_drv_shutdown+0x24/0x50 +lr : platform_drv_shutdown+0x20/0x30 +... +Call trace: +meson_drv_shutdown+0x24/0x50 +platform_drv_shutdown+0x20/0x30 +device_shutdown+0x158/0x360 +kernel_restart_prepare+0x38/0x48 +kernel_restart+0x18/0x68 +__do_sys_reboot+0x224/0x250 +__arm64_sys_reboot+0x24/0x30 +... + +Simply check if the priv struct has been allocated before using it. + +Fixes: fa0c16caf3d7 ("drm: meson_drv add shutdown function") +Reported-by: Stefan Agner +Signed-off-by: Neil Armstrong +Tested-by: Martin Blumenstingl +Reviewed-by: Martin Blumenstingl +Link: https://patchwork.freedesktop.org/patch/msgid/20210430082744.3638743-1-narmstrong@baylibre.com +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/meson/meson_drv.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c +index 453d8b4c5763..07fcd12dca16 100644 +--- a/drivers/gpu/drm/meson/meson_drv.c ++++ b/drivers/gpu/drm/meson/meson_drv.c +@@ -485,11 +485,12 @@ static int meson_probe_remote(struct platform_device *pdev, + static void meson_drv_shutdown(struct platform_device *pdev) + { + struct meson_drm *priv = dev_get_drvdata(&pdev->dev); +- struct drm_device *drm = priv->drm; + +- DRM_DEBUG_DRIVER("\n"); +- drm_kms_helper_poll_fini(drm); +- drm_atomic_helper_shutdown(drm); ++ if (!priv) ++ return; ++ ++ drm_kms_helper_poll_fini(priv->drm); ++ drm_atomic_helper_shutdown(priv->drm); + } + + static int meson_drv_probe(struct platform_device *pdev) +-- +2.26.2 + diff --git a/patches.suse/drm-radeon-dpm-Disable-sclk-switching-on-Oland-when-.patch b/patches.suse/drm-radeon-dpm-Disable-sclk-switching-on-Oland-when-.patch new file mode 100644 index 0000000..7ead9de --- /dev/null +++ b/patches.suse/drm-radeon-dpm-Disable-sclk-switching-on-Oland-when-.patch @@ -0,0 +1,93 @@ +From 227545b9a08c68778ddd89428f99c351fc9315ac Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Fri, 30 Apr 2021 12:56:56 +0800 +Subject: [PATCH] drm/radeon/dpm: Disable sclk switching on Oland when two 4K 60Hz monitors are connected +Git-commit: 227545b9a08c68778ddd89428f99c351fc9315ac +Patch-mainline: v5.13-rc2 +References: git-fixes + +Screen flickers rapidly when two 4K 60Hz monitors are in use. This issue +doesn't happen when one monitor is 4K 60Hz (pixelclock 594MHz) and +another one is 4K 30Hz (pixelclock 297MHz). + +The issue is gone after setting "power_dpm_force_performance_level" to +"high". Following the indication, we found that the issue occurs when +sclk is too low. + +So resolve the issue by disabling sclk switching when there are two +monitors requires high pixelclock (> 297MHz). + +V2: - Only apply the fix to Oland. +Signed-off-by: Kai-Heng Feng +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/radeon/radeon.h | 1 + + drivers/gpu/drm/radeon/radeon_pm.c | 8 ++++++++ + drivers/gpu/drm/radeon/si_dpm.c | 3 +++ + 3 files changed, 12 insertions(+) + +diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h +index 42281fce552e..56ed5634cebe 100644 +--- a/drivers/gpu/drm/radeon/radeon.h ++++ b/drivers/gpu/drm/radeon/radeon.h +@@ -1549,6 +1549,7 @@ struct radeon_dpm { + void *priv; + u32 new_active_crtcs; + int new_active_crtc_count; ++ int high_pixelclock_count; + u32 current_active_crtcs; + int current_active_crtc_count; + bool single_display; +diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c +index 0c1950f4e146..3861c0b98fcf 100644 +--- a/drivers/gpu/drm/radeon/radeon_pm.c ++++ b/drivers/gpu/drm/radeon/radeon_pm.c +@@ -1767,6 +1767,7 @@ static void radeon_pm_compute_clocks_dpm(struct radeon_device *rdev) + struct drm_device *ddev = rdev->ddev; + struct drm_crtc *crtc; + struct radeon_crtc *radeon_crtc; ++ struct radeon_connector *radeon_connector; + + if (!rdev->pm.dpm_enabled) + return; +@@ -1776,6 +1777,7 @@ static void radeon_pm_compute_clocks_dpm(struct radeon_device *rdev) + /* update active crtc counts */ + rdev->pm.dpm.new_active_crtcs = 0; + rdev->pm.dpm.new_active_crtc_count = 0; ++ rdev->pm.dpm.high_pixelclock_count = 0; + if (rdev->num_crtc && rdev->mode_info.mode_config_initialized) { + list_for_each_entry(crtc, + &ddev->mode_config.crtc_list, head) { +@@ -1783,6 +1785,12 @@ static void radeon_pm_compute_clocks_dpm(struct radeon_device *rdev) + if (crtc->enabled) { + rdev->pm.dpm.new_active_crtcs |= (1 << radeon_crtc->crtc_id); + rdev->pm.dpm.new_active_crtc_count++; ++ if (!radeon_crtc->connector) ++ continue; ++ ++ radeon_connector = to_radeon_connector(radeon_crtc->connector); ++ if (radeon_connector->pixelclock_for_modeset > 297000) ++ rdev->pm.dpm.high_pixelclock_count++; + } + } + } +diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c +index 2c54c0d7ca5b..3add39c1a689 100644 +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -2979,6 +2979,9 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev, + (rdev->pdev->device == 0x6605)) { + max_sclk = 75000; + } ++ ++ if (rdev->pm.dpm.high_pixelclock_count > 1) ++ disable_sclk_switching = true; + } + + if (rps->vce_active) { +-- +2.26.2 + diff --git a/patches.suse/firmware-arm_scpi-Prevent-the-ternary-sign-expansion.patch b/patches.suse/firmware-arm_scpi-Prevent-the-ternary-sign-expansion.patch new file mode 100644 index 0000000..9ddc984 --- /dev/null +++ b/patches.suse/firmware-arm_scpi-Prevent-the-ternary-sign-expansion.patch @@ -0,0 +1,49 @@ +From d9cd78edb2e6b7e26747c0ec312be31e7ef196fe Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 22 Apr 2021 12:02:29 +0300 +Subject: [PATCH] firmware: arm_scpi: Prevent the ternary sign expansion bug +Git-commit: d9cd78edb2e6b7e26747c0ec312be31e7ef196fe +Patch-mainline: v5.13-rc3 +References: git-fixes + +How the type promotion works in ternary expressions is a bit tricky. +The problem is that scpi_clk_get_val() returns longs, "ret" is a int +which holds a negative error code, and le32_to_cpu() is an unsigned int. +We want the negative error code to be cast to a negative long. But +because le32_to_cpu() is an u32 then "ret" is type promoted to u32 and +becomes a high positive and then it is promoted to long and it is still +a high positive value. + +Fix this by getting rid of the ternary. + +Link: https://lore.kernel.org/r/YIE7pdqV/h10tEAK@mwanda +Fixes: 8cb7cf56c9fe ("firmware: add support for ARM System Control and Power Interface(SCPI) protocol") +Reviewed-by: Cristian Marussi +Signed-off-by: Dan Carpenter +[sudeep.holla: changed to return 0 as clock rate on error] +Signed-off-by: Sudeep Holla +Acked-by: Takashi Iwai + +--- + drivers/firmware/arm_scpi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/firmware/arm_scpi.c b/drivers/firmware/arm_scpi.c +index d0dee37ad522..4ceba5ef7895 100644 +--- a/drivers/firmware/arm_scpi.c ++++ b/drivers/firmware/arm_scpi.c +@@ -552,8 +552,10 @@ static unsigned long scpi_clk_get_val(u16 clk_id) + + ret = scpi_send_message(CMD_GET_CLOCK_VALUE, &le_clk_id, + sizeof(le_clk_id), &rate, sizeof(rate)); ++ if (ret) ++ return 0; + +- return ret ? ret : le32_to_cpu(rate); ++ return le32_to_cpu(rate); + } + + static int scpi_clk_set_val(u16 clk_id, unsigned long rate) +-- +2.26.2 + diff --git a/patches.suse/futex-Change-utime-parameter-to-be-const.patch b/patches.suse/futex-Change-utime-parameter-to-be-const.patch new file mode 100644 index 0000000..b5ec8be --- /dev/null +++ b/patches.suse/futex-Change-utime-parameter-to-be-const.patch @@ -0,0 +1,80 @@ +From 1ce53e2c2ac069e7b3c400a427002a70deb4a916 Mon Sep 17 00:00:00 2001 +From: Alejandro Colomar +Date: Sat, 28 Nov 2020 13:39:46 +0100 +Subject: [PATCH] futex: Change utime parameter to be 'const ... *' +Git-commit: 1ce53e2c2ac069e7b3c400a427002a70deb4a916 +Patch-mainline: v5.12-rc1 +References: git-fixes + +futex(2) says that 'utime' is a pointer to 'const'. The implementation +doesn't use 'const'; however, it _never_ modifies the contents of utime. + +- futex() either uses 'utime' as a pointer to struct or as a 'u32'. + +- In case it's used as a 'u32', it makes a copy of it, and of course it is + not dereferenced. + +- In case it's used as a 'struct __kernel_timespec __user *', the pointer + is not dereferenced inside the futex() definition, and it is only passed + to a function: get_timespec64(), which accepts a 'const struct + __kernel_timespec __user *'. + +[ tglx: Make the same change to the compat syscall and fixup the prototypes. ] + +Signed-off-by: Alejandro Colomar +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20201128123945.4592-1-alx.manpages@gmail.com +Signed-off-by: Davidlohr Bueso + +--- + include/linux/syscalls.h | 8 ++++---- + kernel/futex.c | 6 +++--- + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h +index f3929aff39cf..5cb74edd9a4f 100644 +--- a/include/linux/syscalls.h ++++ b/include/linux/syscalls.h +@@ -583,11 +583,11 @@ asmlinkage long sys_unshare(unsigned long unshare_flags); + + /* kernel/futex.c */ + asmlinkage long sys_futex(u32 __user *uaddr, int op, u32 val, +- struct __kernel_timespec __user *utime, u32 __user *uaddr2, +- u32 val3); ++ const struct __kernel_timespec __user *utime, ++ u32 __user *uaddr2, u32 val3); + asmlinkage long sys_futex_time32(u32 __user *uaddr, int op, u32 val, +- struct old_timespec32 __user *utime, u32 __user *uaddr2, +- u32 val3); ++ const struct old_timespec32 __user *utime, ++ u32 __user *uaddr2, u32 val3); + asmlinkage long sys_get_robust_list(int pid, + struct robust_list_head __user * __user *head_ptr, + size_t __user *len_ptr); +diff --git a/kernel/futex.c b/kernel/futex.c +index c47d1015d759..d0775aab8da9 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -3790,8 +3790,8 @@ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout, + + + SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val, +- struct __kernel_timespec __user *, utime, u32 __user *, uaddr2, +- u32, val3) ++ const struct __kernel_timespec __user *, utime, ++ u32 __user *, uaddr2, u32, val3) + { + struct timespec64 ts; + ktime_t t, *tp = NULL; +@@ -3986,7 +3986,7 @@ COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid, + + #ifdef CONFIG_COMPAT_32BIT_TIME + SYSCALL_DEFINE6(futex_time32, u32 __user *, uaddr, int, op, u32, val, +- struct old_timespec32 __user *, utime, u32 __user *, uaddr2, ++ const struct old_timespec32 __user *, utime, u32 __user *, uaddr2, + u32, val3) + { + struct timespec64 ts; +-- +2.26.2 + diff --git a/patches.suse/futex-Do-not-apply-time-namespace-adjustment-on-FUTE.patch b/patches.suse/futex-Do-not-apply-time-namespace-adjustment-on-FUTE.patch new file mode 100644 index 0000000..2a8e845 --- /dev/null +++ b/patches.suse/futex-Do-not-apply-time-namespace-adjustment-on-FUTE.patch @@ -0,0 +1,52 @@ +From cdf78db4070967869e4d027c11f4dd825d8f815a Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Thu, 22 Apr 2021 21:44:19 +0200 +Subject: [PATCH 2/4] futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI +Git-commit: cdf78db4070967869e4d027c11f4dd825d8f815a +Patch-mainline: v5.13-rc1 +References: bsc#1164648 + +FUTEX_LOCK_PI does not require to have the FUTEX_CLOCK_REALTIME bit set +because it has been using CLOCK_REALTIME based absolute timeouts +forever. Due to that, the time namespace adjustment which is applied when +FUTEX_CLOCK_REALTIME is not set, will wrongly take place for FUTEX_LOCK_PI +and wreckage the timeout. + +Exclude it from that procedure. + +Fixes: c2f7d08cccf4 ("futex: Adjust absolute futex timeouts with per time namespace offset") +Signed-off-by: Thomas Gleixner +Acked-by: Peter Zijlstra (Intel) +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20210422194704.984540159@linutronix.de +Signed-off-by: Davidlohr Bueso + +--- + kernel/futex.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/futex.c b/kernel/futex.c +index 47402008a430..b0f53045f206 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -3780,7 +3780,7 @@ SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val, + t = timespec64_to_ktime(ts); + if (cmd == FUTEX_WAIT) + t = ktime_add_safe(ktime_get(), t); +- else if (!(op & FUTEX_CLOCK_REALTIME)) ++ else if (cmd != FUTEX_LOCK_PI && !(op & FUTEX_CLOCK_REALTIME)) + t = timens_ktime_to_host(CLOCK_MONOTONIC, t); + tp = &t; + } +@@ -3974,7 +3974,7 @@ SYSCALL_DEFINE6(futex_time32, u32 __user *, uaddr, int, op, u32, val, + t = timespec64_to_ktime(ts); + if (cmd == FUTEX_WAIT) + t = ktime_add_safe(ktime_get(), t); +- else if (!(op & FUTEX_CLOCK_REALTIME)) ++ else if (cmd != FUTEX_LOCK_PI && !(op & FUTEX_CLOCK_REALTIME)) + t = timens_ktime_to_host(CLOCK_MONOTONIC, t); + tp = &t; + } +-- +2.26.2 + diff --git a/patches.suse/futex-Get-rid-of-the-val2-conditional-dance.patch b/patches.suse/futex-Get-rid-of-the-val2-conditional-dance.patch new file mode 100644 index 0000000..23c832a --- /dev/null +++ b/patches.suse/futex-Get-rid-of-the-val2-conditional-dance.patch @@ -0,0 +1,77 @@ +From b097d5ed33561507eeffc77120a8c16c2f0f2c4c Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Thu, 22 Apr 2021 21:44:20 +0200 +Subject: [PATCH 3/4] futex: Get rid of the val2 conditional dance +Git-commit: b097d5ed33561507eeffc77120a8c16c2f0f2c4c +Patch-mainline: v5.13-rc1 +References: git-fixes + +There is no point in checking which FUTEX operand treats the utime pointer +as 'val2' argument because that argument to do_futex() is only used by +exactly these operands. + +So just handing it in unconditionally is not making any difference, but +removes a lot of pointless gunk. + +Signed-off-by: Thomas Gleixner +Acked-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20210422194705.125957049@linutronix.de +Signed-off-by: Davidlohr Bueso + +--- + kernel/futex.c | 16 ++-------------- + 1 file changed, 2 insertions(+), 14 deletions(-) + +diff --git a/kernel/futex.c b/kernel/futex.c +index b0f53045f206..4ddfdce325ad 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -3764,7 +3764,6 @@ SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val, + { + struct timespec64 ts; + ktime_t t, *tp = NULL; +- u32 val2 = 0; + int cmd = op & FUTEX_CMD_MASK; + + if (utime && (cmd == FUTEX_WAIT || cmd == FUTEX_LOCK_PI || +@@ -3784,15 +3783,8 @@ SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val, + t = timens_ktime_to_host(CLOCK_MONOTONIC, t); + tp = &t; + } +- /* +- * requeue parameter in 'utime' if cmd == FUTEX_*_REQUEUE_*. +- * number of waiters to wake in 'utime' if cmd == FUTEX_WAKE_OP. +- */ +- if (cmd == FUTEX_REQUEUE || cmd == FUTEX_CMP_REQUEUE || +- cmd == FUTEX_CMP_REQUEUE_PI || cmd == FUTEX_WAKE_OP) +- val2 = (u32) (unsigned long) utime; + +- return do_futex(uaddr, op, val, tp, uaddr2, val2, val3); ++ return do_futex(uaddr, op, val, tp, uaddr2, (unsigned long)utime, val3); + } + + #ifdef CONFIG_COMPAT +@@ -3960,7 +3952,6 @@ SYSCALL_DEFINE6(futex_time32, u32 __user *, uaddr, int, op, u32, val, + { + struct timespec64 ts; + ktime_t t, *tp = NULL; +- int val2 = 0; + int cmd = op & FUTEX_CMD_MASK; + + if (utime && (cmd == FUTEX_WAIT || cmd == FUTEX_LOCK_PI || +@@ -3978,11 +3969,8 @@ SYSCALL_DEFINE6(futex_time32, u32 __user *, uaddr, int, op, u32, val, + t = timens_ktime_to_host(CLOCK_MONOTONIC, t); + tp = &t; + } +- if (cmd == FUTEX_REQUEUE || cmd == FUTEX_CMP_REQUEUE || +- cmd == FUTEX_CMP_REQUEUE_PI || cmd == FUTEX_WAKE_OP) +- val2 = (int) (unsigned long) utime; + +- return do_futex(uaddr, op, val, tp, uaddr2, val2, val3); ++ return do_futex(uaddr, op, val, tp, uaddr2, (unsigned long)utime, val3); + } + #endif /* CONFIG_COMPAT_32BIT_TIME */ + +-- +2.26.2 + diff --git a/patches.suse/futex-Make-syscall-entry-points-less-convoluted.patch b/patches.suse/futex-Make-syscall-entry-points-less-convoluted.patch new file mode 100644 index 0000000..05d641e --- /dev/null +++ b/patches.suse/futex-Make-syscall-entry-points-less-convoluted.patch @@ -0,0 +1,122 @@ +From 51cf94d16860a324e97d1b670d88f1f2b643bc32 Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Thu, 22 Apr 2021 21:44:21 +0200 +Subject: [PATCH 4/4] futex: Make syscall entry points less convoluted +Git-commit: 51cf94d16860a324e97d1b670d88f1f2b643bc32 +Patch-mainline: v5.13-rc1 +References: git-fixes + +The futex and the compat syscall entry points do pretty much the same +except for the timespec data types and the corresponding copy from +user function. + +Split out the rest into inline functions and share the functionality. + +Signed-off-by: Thomas Gleixner +Acked-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20210422194705.244476369@linutronix.de +Signed-off-by: Davidlohr Bueso + +--- + kernel/futex.c | 63 +++++++++++++++++++++++++++++--------------------- + 1 file changed, 37 insertions(+), 26 deletions(-) + +diff --git a/kernel/futex.c b/kernel/futex.c +index 4ddfdce325ad..4938a00bc785 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -3757,30 +3757,48 @@ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout, + return -ENOSYS; + } + ++static __always_inline bool futex_cmd_has_timeout(u32 cmd) ++{ ++ switch (cmd) { ++ case FUTEX_WAIT: ++ case FUTEX_LOCK_PI: ++ case FUTEX_WAIT_BITSET: ++ case FUTEX_WAIT_REQUEUE_PI: ++ return true; ++ } ++ return false; ++} ++ ++static __always_inline int ++futex_init_timeout(u32 cmd, u32 op, struct timespec64 *ts, ktime_t *t) ++{ ++ if (!timespec64_valid(ts)) ++ return -EINVAL; ++ ++ *t = timespec64_to_ktime(*ts); ++ if (cmd == FUTEX_WAIT) ++ *t = ktime_add_safe(ktime_get(), *t); ++ else if (cmd != FUTEX_LOCK_PI && !(op & FUTEX_CLOCK_REALTIME)) ++ *t = timens_ktime_to_host(CLOCK_MONOTONIC, *t); ++ return 0; ++} + + SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val, + const struct __kernel_timespec __user *, utime, + u32 __user *, uaddr2, u32, val3) + { +- struct timespec64 ts; ++ int ret, cmd = op & FUTEX_CMD_MASK; + ktime_t t, *tp = NULL; +- int cmd = op & FUTEX_CMD_MASK; ++ struct timespec64 ts; + +- if (utime && (cmd == FUTEX_WAIT || cmd == FUTEX_LOCK_PI || +- cmd == FUTEX_WAIT_BITSET || +- cmd == FUTEX_WAIT_REQUEUE_PI)) { ++ if (utime && futex_cmd_has_timeout(cmd)) { + if (unlikely(should_fail_futex(!(op & FUTEX_PRIVATE_FLAG)))) + return -EFAULT; + if (get_timespec64(&ts, utime)) + return -EFAULT; +- if (!timespec64_valid(&ts)) +- return -EINVAL; +- +- t = timespec64_to_ktime(ts); +- if (cmd == FUTEX_WAIT) +- t = ktime_add_safe(ktime_get(), t); +- else if (cmd != FUTEX_LOCK_PI && !(op & FUTEX_CLOCK_REALTIME)) +- t = timens_ktime_to_host(CLOCK_MONOTONIC, t); ++ ret = futex_init_timeout(cmd, op, &ts, &t); ++ if (ret) ++ return ret; + tp = &t; + } + +@@ -3950,23 +3968,16 @@ SYSCALL_DEFINE6(futex_time32, u32 __user *, uaddr, int, op, u32, val, + const struct old_timespec32 __user *, utime, u32 __user *, uaddr2, + u32, val3) + { +- struct timespec64 ts; ++ int ret, cmd = op & FUTEX_CMD_MASK; + ktime_t t, *tp = NULL; +- int cmd = op & FUTEX_CMD_MASK; ++ struct timespec64 ts; + +- if (utime && (cmd == FUTEX_WAIT || cmd == FUTEX_LOCK_PI || +- cmd == FUTEX_WAIT_BITSET || +- cmd == FUTEX_WAIT_REQUEUE_PI)) { ++ if (utime && futex_cmd_has_timeout(cmd)) { + if (get_old_timespec32(&ts, utime)) + return -EFAULT; +- if (!timespec64_valid(&ts)) +- return -EINVAL; +- +- t = timespec64_to_ktime(ts); +- if (cmd == FUTEX_WAIT) +- t = ktime_add_safe(ktime_get(), t); +- else if (cmd != FUTEX_LOCK_PI && !(op & FUTEX_CLOCK_REALTIME)) +- t = timens_ktime_to_host(CLOCK_MONOTONIC, t); ++ ret = futex_init_timeout(cmd, op, &ts, &t); ++ if (ret) ++ return ret; + tp = &t; + } + +-- +2.26.2 + diff --git a/patches.suse/gpio-xilinx-Correct-kernel-doc-for-xgpio_probe.patch b/patches.suse/gpio-xilinx-Correct-kernel-doc-for-xgpio_probe.patch new file mode 100644 index 0000000..a32ecbb --- /dev/null +++ b/patches.suse/gpio-xilinx-Correct-kernel-doc-for-xgpio_probe.patch @@ -0,0 +1,41 @@ +From a0579474effff6a139768b300d8439c2327b3848 Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Mon, 10 May 2021 22:46:30 +0300 +Subject: [PATCH] gpio: xilinx: Correct kernel doc for xgpio_probe() +Git-commit: a0579474effff6a139768b300d8439c2327b3848 +Patch-mainline: v5.13-rc3 +References: git-fixes + +Kernel doc validator complains: + +.../gpio-xilinx.c:556: warning: expecting prototype for xgpio_of_probe(). Prototype was for xgpio_probe() instead + +Correct as suggested by changing the name of the function in the doc.. + +Fixes: 749564ffd52d ("gpio/xilinx: Convert the driver to platform device interface") +Signed-off-by: Andy Shevchenko +Tested-by: Neeli Srinivas +Reviewed-by: Michal Simek +Signed-off-by: Bartosz Golaszewski +Acked-by: Takashi Iwai + +--- + drivers/gpio/gpio-xilinx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-xilinx.c b/drivers/gpio/gpio-xilinx.c +index b411d3156e0b..136557e7dd3c 100644 +--- a/drivers/gpio/gpio-xilinx.c ++++ b/drivers/gpio/gpio-xilinx.c +@@ -542,7 +542,7 @@ static void xgpio_irqhandler(struct irq_desc *desc) + } + + /** +- * xgpio_of_probe - Probe method for the GPIO device. ++ * xgpio_probe - Probe method for the GPIO device. + * @pdev: pointer to the platform device + * + * Return: +-- +2.26.2 + diff --git a/patches.suse/gpiolib-acpi-Add-quirk-to-ignore-EC-wakeups-on-Dell-.patch b/patches.suse/gpiolib-acpi-Add-quirk-to-ignore-EC-wakeups-on-Dell-.patch new file mode 100644 index 0000000..90508ff --- /dev/null +++ b/patches.suse/gpiolib-acpi-Add-quirk-to-ignore-EC-wakeups-on-Dell-.patch @@ -0,0 +1,56 @@ +From da91ece226729c76f60708efc275ebd4716ad089 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 1 Apr 2021 18:27:40 +0200 +Subject: [PATCH] gpiolib: acpi: Add quirk to ignore EC wakeups on Dell Venue 10 Pro 5055 +Git-commit: da91ece226729c76f60708efc275ebd4716ad089 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Like some other Bay and Cherry Trail SoC based devices the Dell Venue +10 Pro 5055 has an embedded-controller which uses ACPI GPIO events to +report events instead of using the standard ACPI EC interface for this. + +The EC interrupt is only used to report battery-level changes and +it keeps doing this while the system is suspended, causing the system +to not stay suspended. + +Add an ignore-wake quirk for the GPIO pin used by the EC to fix the +spurious wakeups from suspend. + +Signed-off-by: Hans de Goede +Acked-by: Andy Shevchenko +Signed-off-by: Andy Shevchenko +Acked-by: Takashi Iwai + +--- + drivers/gpio/gpiolib-acpi.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c +index 21750be9c489..3ef22a3c104d 100644 +--- a/drivers/gpio/gpiolib-acpi.c ++++ b/drivers/gpio/gpiolib-acpi.c +@@ -1445,6 +1445,20 @@ static const struct dmi_system_id gpiolib_acpi_quirks[] __initconst = { + .no_edge_events_on_boot = true, + }, + }, ++ { ++ /* ++ * The Dell Venue 10 Pro 5055, with Bay Trail SoC + TI PMIC uses an ++ * external embedded-controller connected via I2C + an ACPI GPIO ++ * event handler on INT33FFC:02 pin 12, causing spurious wakeups. ++ */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Venue 10 Pro 5055"), ++ }, ++ .driver_data = &(struct acpi_gpiolib_dmi_quirk) { ++ .ignore_wake = "INT33FC:02@12", ++ }, ++ }, + { + /* + * HP X2 10 models with Cherry Trail SoC + TI PMIC use an +-- +2.26.2 + diff --git a/patches.suse/i2c-Add-I2C_AQ_NO_REP_START-adapter-quirk.patch b/patches.suse/i2c-Add-I2C_AQ_NO_REP_START-adapter-quirk.patch new file mode 100644 index 0000000..31fc373 --- /dev/null +++ b/patches.suse/i2c-Add-I2C_AQ_NO_REP_START-adapter-quirk.patch @@ -0,0 +1,39 @@ +From aca01415e076aa96cca0f801f4420ee5c10c660d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Bence=20Cs=C3=B3k=C3=A1s?= +Date: Wed, 31 Mar 2021 19:19:20 +0000 +Subject: [PATCH] i2c: Add I2C_AQ_NO_REP_START adapter quirk +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: aca01415e076aa96cca0f801f4420ee5c10c660d +Patch-mainline: v5.13-rc1 +References: git-fixes + +This quirk signifies that the adapter cannot do a repeated +START, it always issues a STOP condition after transfers. + +Suggested-by: Wolfram Sang +Signed-off-by: Bence Csókás +Signed-off-by: Wolfram Sang +Acked-by: Takashi Iwai + +--- + include/linux/i2c.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/include/linux/i2c.h b/include/linux/i2c.h +index 56622658b215..a670ae129f4b 100644 +--- a/include/linux/i2c.h ++++ b/include/linux/i2c.h +@@ -687,6 +687,8 @@ struct i2c_adapter_quirks { + #define I2C_AQ_NO_ZERO_LEN_READ BIT(5) + #define I2C_AQ_NO_ZERO_LEN_WRITE BIT(6) + #define I2C_AQ_NO_ZERO_LEN (I2C_AQ_NO_ZERO_LEN_READ | I2C_AQ_NO_ZERO_LEN_WRITE) ++/* adapter cannot do repeated START */ ++#define I2C_AQ_NO_REP_START BIT(7) + + /* + * i2c_adapter is the structure used to identify a physical i2c bus along +-- +2.26.2 + diff --git a/patches.suse/i2c-bail-out-early-when-RDWR-parameters-are-wrong.patch b/patches.suse/i2c-bail-out-early-when-RDWR-parameters-are-wrong.patch new file mode 100644 index 0000000..d0d2608 --- /dev/null +++ b/patches.suse/i2c-bail-out-early-when-RDWR-parameters-are-wrong.patch @@ -0,0 +1,46 @@ +From 71581562ee36032d2d574a9b23ad4af6d6a64cf7 Mon Sep 17 00:00:00 2001 +From: Wolfram Sang +Date: Fri, 12 Mar 2021 12:57:34 +0100 +Subject: [PATCH] i2c: bail out early when RDWR parameters are wrong +Git-commit: 71581562ee36032d2d574a9b23ad4af6d6a64cf7 +Patch-mainline: v5.13-rc1 +References: git-fixes + +The buggy parameters currently get caught later, but emit a noisy WARN. +Userspace should not be able to trigger this, so add similar checks much +earlier. Also avoids some unneeded code paths, of course. Apply kernel +coding stlye to a comment while here. + +Reported-by: syzbot+ffb0b3ffa6cfbc7d7b3f@syzkaller.appspotmail.com +Tested-by: syzbot+ffb0b3ffa6cfbc7d7b3f@syzkaller.appspotmail.com +Signed-off-by: Wolfram Sang +Signed-off-by: Wolfram Sang +Acked-by: Takashi Iwai + +--- + drivers/i2c/i2c-dev.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c +index 6ceb11cc4be1..6ef38a8ee95c 100644 +--- a/drivers/i2c/i2c-dev.c ++++ b/drivers/i2c/i2c-dev.c +@@ -440,8 +440,13 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + sizeof(rdwr_arg))) + return -EFAULT; + +- /* Put an arbitrary limit on the number of messages that can +- * be sent at once */ ++ if (!rdwr_arg.msgs || rdwr_arg.nmsgs == 0) ++ return -EINVAL; ++ ++ /* ++ * Put an arbitrary limit on the number of messages that can ++ * be sent at once ++ */ + if (rdwr_arg.nmsgs > I2C_RDWR_IOCTL_MAX_MSGS) + return -EINVAL; + +-- +2.26.2 + diff --git a/patches.suse/i2c-i801-Don-t-generate-an-interrupt-on-bus-reset.patch b/patches.suse/i2c-i801-Don-t-generate-an-interrupt-on-bus-reset.patch new file mode 100644 index 0000000..79dea11 --- /dev/null +++ b/patches.suse/i2c-i801-Don-t-generate-an-interrupt-on-bus-reset.patch @@ -0,0 +1,61 @@ +From e4d8716c3dcec47f1557024add24e1f3c09eb24b Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Tue, 25 May 2021 17:03:36 +0200 +Subject: [PATCH] i2c: i801: Don't generate an interrupt on bus reset +Git-commit: e4d8716c3dcec47f1557024add24e1f3c09eb24b +Patch-mainline: v5.13-rc4 +References: git-fixes + +Now that the i2c-i801 driver supports interrupts, setting the KILL bit +in a attempt to recover from a timed out transaction triggers an +interrupt. Unfortunately, the interrupt handler (i801_isr) is not +prepared for this situation and will try to process the interrupt as +if it was signaling the end of a successful transaction. In the case +of a block transaction, this can result in an out-of-range memory +access. + +This condition was reproduced several times by syzbot: +https://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e +https://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e +https://syzkaller.appspot.com/bug?extid=c8ff0b6d6c73d81b610e +https://syzkaller.appspot.com/bug?extid=33f6c360821c399d69eb +https://syzkaller.appspot.com/bug?extid=be15dc0b1933f04b043a +https://syzkaller.appspot.com/bug?extid=b4d3fd1dfd53e90afd79 + +So disable interrupts while trying to reset the bus. Interrupts will +be enabled again for the following transaction. + +Fixes: 636752bcb517 ("i2c-i801: Enable IRQ for SMBus transactions") +Reported-by: syzbot+b4d3fd1dfd53e90afd79@syzkaller.appspotmail.com +Signed-off-by: Jean Delvare +Acked-by: Andy Shevchenko +Cc: Jarkko Nikula +Tested-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Acked-by: Takashi Iwai + +--- + drivers/i2c/busses/i2c-i801.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c +index 99d446763530..f9e1c2ceaac0 100644 +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -395,11 +395,9 @@ static int i801_check_post(struct i801_priv *priv, int status) + dev_err(&priv->pci_dev->dev, "Transaction timeout\n"); + /* try to stop the current command */ + dev_dbg(&priv->pci_dev->dev, "Terminating the current operation\n"); +- outb_p(inb_p(SMBHSTCNT(priv)) | SMBHSTCNT_KILL, +- SMBHSTCNT(priv)); ++ outb_p(SMBHSTCNT_KILL, SMBHSTCNT(priv)); + usleep_range(1000, 2000); +- outb_p(inb_p(SMBHSTCNT(priv)) & (~SMBHSTCNT_KILL), +- SMBHSTCNT(priv)); ++ outb_p(0, SMBHSTCNT(priv)); + + /* Check if it worked */ + status = inb_p(SMBHSTSTS(priv)); +-- +2.26.2 + diff --git a/patches.suse/i2c-s3c2410-fix-possible-NULL-pointer-deref-on-read-.patch b/patches.suse/i2c-s3c2410-fix-possible-NULL-pointer-deref-on-read-.patch new file mode 100644 index 0000000..fc8428c --- /dev/null +++ b/patches.suse/i2c-s3c2410-fix-possible-NULL-pointer-deref-on-read-.patch @@ -0,0 +1,72 @@ +From 24990423267ec283b9d86f07f362b753eb9b0ed5 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Wed, 26 May 2021 08:39:37 -0400 +Subject: [PATCH] i2c: s3c2410: fix possible NULL pointer deref on read message after write +Git-commit: 24990423267ec283b9d86f07f362b753eb9b0ed5 +Patch-mainline: v5.13-rc4 +References: git-fixes + +Interrupt handler processes multiple message write requests one after +another, till the driver message queue is drained. However if driver +encounters a read message without preceding START, it stops the I2C +transfer as it is an invalid condition for the controller. At least the +comment describes a requirement "the controller forces us to send a new +START when we change direction". This stop results in clearing the +message queue (i2c->msg = NULL). + +The code however immediately jumped back to label "retry_write" which +dereferenced the "i2c->msg" making it a possible NULL pointer +dereference. + +The Coverity analysis: +1. Condition !is_msgend(i2c), taking false branch. + if (!is_msgend(i2c)) { + +2. Condition !is_lastmsg(i2c), taking true branch. + } else if (!is_lastmsg(i2c)) { + +3. Condition i2c->msg->flags & 1, taking true branch. + if (i2c->msg->flags & I2C_M_RD) { + +4. write_zero_model: Passing i2c to s3c24xx_i2c_stop, which sets i2c->msg to NULL. + s3c24xx_i2c_stop(i2c, -EINVAL); + +5. Jumping to label retry_write. + goto retry_write; + +6. var_deref_model: Passing i2c to is_msgend, which dereferences null i2c->msg. + if (!is_msgend(i2c)) {" + +All previous calls to s3c24xx_i2c_stop() in this interrupt service +routine are followed by jumping to end of function (acknowledging +the interrupt and returning). This seems a reasonable choice also here +since message buffer was entirely emptied. + +Addresses-coverity: Explicit null dereferenced +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Wolfram Sang +Acked-by: Takashi Iwai + +--- + drivers/i2c/busses/i2c-s3c2410.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c +index ab928613afba..4d82761e1585 100644 +--- a/drivers/i2c/busses/i2c-s3c2410.c ++++ b/drivers/i2c/busses/i2c-s3c2410.c +@@ -480,7 +480,10 @@ static int i2c_s3c_irq_nextbyte(struct s3c24xx_i2c *i2c, unsigned long iicstat) + * forces us to send a new START + * when we change direction + */ ++ dev_dbg(i2c->dev, ++ "missing START before write->read\n"); + s3c24xx_i2c_stop(i2c, -EINVAL); ++ break; + } + + goto retry_write; +-- +2.26.2 + diff --git a/patches.suse/i2c-sh_mobile-Use-new-clock-calculation-formulas-for.patch b/patches.suse/i2c-sh_mobile-Use-new-clock-calculation-formulas-for.patch new file mode 100644 index 0000000..ff1dd86 --- /dev/null +++ b/patches.suse/i2c-sh_mobile-Use-new-clock-calculation-formulas-for.patch @@ -0,0 +1,38 @@ +From c4740e293c93c747e65d53d9aacc2ba8521d1489 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Thu, 6 May 2021 13:15:40 +0200 +Subject: [PATCH] i2c: sh_mobile: Use new clock calculation formulas for RZ/G2E +Git-commit: c4740e293c93c747e65d53d9aacc2ba8521d1489 +Patch-mainline: v5.13-rc4 +References: git-fixes + +When switching the Gen3 SoCs to the new clock calculation formulas, the +match entry for RZ/G2E added in commit 51243b73455f2d12 ("i2c: +Sh_mobile: Add support for r8a774c0 (RZ/G2E)") was forgotten. + +Fixes: e8a27567509b2439 ("i2c: sh_mobile: use new clock calculation formulas for Gen3") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Fabrizio Castro +Signed-off-by: Wolfram Sang +Acked-by: Takashi Iwai + +--- + drivers/i2c/busses/i2c-sh_mobile.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c +index 3ae6ca21a02c..2d2e630fd438 100644 +--- a/drivers/i2c/busses/i2c-sh_mobile.c ++++ b/drivers/i2c/busses/i2c-sh_mobile.c +@@ -807,7 +807,7 @@ static const struct sh_mobile_dt_config r8a7740_dt_config = { + static const struct of_device_id sh_mobile_i2c_dt_ids[] = { + { .compatible = "renesas,iic-r8a73a4", .data = &fast_clock_dt_config }, + { .compatible = "renesas,iic-r8a7740", .data = &r8a7740_dt_config }, +- { .compatible = "renesas,iic-r8a774c0", .data = &fast_clock_dt_config }, ++ { .compatible = "renesas,iic-r8a774c0", .data = &v2_freq_calc_dt_config }, + { .compatible = "renesas,iic-r8a7790", .data = &v2_freq_calc_dt_config }, + { .compatible = "renesas,iic-r8a7791", .data = &v2_freq_calc_dt_config }, + { .compatible = "renesas,iic-r8a7792", .data = &v2_freq_calc_dt_config }, +-- +2.26.2 + diff --git a/patches.suse/ics932s401-fix-broken-handling-of-errors-when-word-r.patch b/patches.suse/ics932s401-fix-broken-handling-of-errors-when-word-r.patch new file mode 100644 index 0000000..fa08635 --- /dev/null +++ b/patches.suse/ics932s401-fix-broken-handling-of-errors-when-word-r.patch @@ -0,0 +1,45 @@ +From a73b6a3b4109ce2ed01dbc51a6c1551a6431b53c Mon Sep 17 00:00:00 2001 +From: "Darrick J. Wong" +Date: Wed, 28 Apr 2021 15:25:34 -0700 +Subject: [PATCH] ics932s401: fix broken handling of errors when word reading fails +Git-commit: a73b6a3b4109ce2ed01dbc51a6c1551a6431b53c +Patch-mainline: v5.13-rc3 +References: git-fixes + +In commit b05ae01fdb89, someone tried to make the driver handle i2c read +errors by simply zeroing out the register contents, but for some reason +left unaltered the code that sets the cached register value the function +call return value. + +The original patch was authored by a member of the Underhanded +Mangle-happy Nerds, I'm not terribly surprised. I don't have the +hardware anymore so I can't test this, but it seems like a pretty +obvious API usage fix to me... + +Fixes: b05ae01fdb89 ("misc/ics932s401: Add a missing check to i2c_smbus_read_word_data") +Signed-off-by: Darrick J. Wong +Link: https://lore.kernel.org/r/20210428222534.GJ3122264@magnolia +Cc: stable +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/misc/ics932s401.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/misc/ics932s401.c b/drivers/misc/ics932s401.c +index 2bdf560ee681..0f9ea75b0b18 100644 +--- a/drivers/misc/ics932s401.c ++++ b/drivers/misc/ics932s401.c +@@ -134,7 +134,7 @@ static struct ics932s401_data *ics932s401_update_device(struct device *dev) + for (i = 0; i < NUM_MIRRORED_REGS; i++) { + temp = i2c_smbus_read_word_data(client, regs_to_copy[i]); + if (temp < 0) +- data->regs[regs_to_copy[i]] = 0; ++ temp = 0; + data->regs[regs_to_copy[i]] = temp >> 8; + } + +-- +2.26.2 + diff --git a/patches.suse/iio-adc-ad7124-Fix-missbalanced-regulator-enable-dis.patch b/patches.suse/iio-adc-ad7124-Fix-missbalanced-regulator-enable-dis.patch new file mode 100644 index 0000000..967b29e --- /dev/null +++ b/patches.suse/iio-adc-ad7124-Fix-missbalanced-regulator-enable-dis.patch @@ -0,0 +1,99 @@ +From 4573472315f0fa461330545ff2aa2f6da0b1ae76 Mon Sep 17 00:00:00 2001 +From: Jonathan Cameron +Date: Thu, 13 May 2021 15:07:41 +0300 +Subject: [PATCH] iio: adc: ad7124: Fix missbalanced regulator enable / disable on error. +Git-commit: 4573472315f0fa461330545ff2aa2f6da0b1ae76 +Patch-mainline: v5.13-rc4 +References: git-fixes + +If the devm_regulator_get() call succeeded but not the regulator_enable() +then regulator_disable() would be called on a regulator that was not +enabled. + +Fix this by moving regulator enabling / disabling over to +devm_ management via devm_add_action_or_reset. + +Alexandru's sign-off here because he pulled Jonathan's patch into +a larger set which Jonathan then applied. + +Fixes: b3af341bbd96 ("iio: adc: Add ad7124 support") +Reviewed-by: Alexandru Ardelean +Signed-off-by: Jonathan Cameron +Signed-off-by: Alexandru Ardelean +Cc: +Acked-by: Takashi Iwai + +--- + drivers/iio/adc/ad7124.c | 29 +++++++++++++---------------- + 1 file changed, 13 insertions(+), 16 deletions(-) + +--- a/drivers/iio/adc/ad7124.c ++++ b/drivers/iio/adc/ad7124.c +@@ -564,6 +564,11 @@ static int ad7124_setup(struct ad7124_st + return ret; + } + ++static void ad7124_reg_disable(void *r) ++{ ++ regulator_disable(r); ++} ++ + static int ad7124_probe(struct spi_device *spi) + { + const struct spi_device_id *id; +@@ -607,17 +612,20 @@ static int ad7124_probe(struct spi_devic + ret = regulator_enable(st->vref[i]); + if (ret) + return ret; ++ ++ ret = devm_add_action_or_reset(&spi->dev, ad7124_reg_disable, ++ st->vref[i]); ++ if (ret) ++ return ret; + } + + st->mclk = devm_clk_get(&spi->dev, "mclk"); +- if (IS_ERR(st->mclk)) { +- ret = PTR_ERR(st->mclk); +- goto error_regulator_disable; +- } ++ if (IS_ERR(st->mclk)) ++ return PTR_ERR(st->mclk); + + ret = clk_prepare_enable(st->mclk); + if (ret < 0) +- goto error_regulator_disable; ++ return ret; + + ret = ad7124_soft_reset(st); + if (ret < 0) +@@ -643,11 +651,6 @@ error_remove_trigger: + ad_sd_cleanup_buffer_and_trigger(indio_dev); + error_clk_disable_unprepare: + clk_disable_unprepare(st->mclk); +-error_regulator_disable: +- for (i = ARRAY_SIZE(st->vref) - 1; i >= 0; i--) { +- if (!IS_ERR_OR_NULL(st->vref[i])) +- regulator_disable(st->vref[i]); +- } + + return ret; + } +@@ -656,17 +659,11 @@ static int ad7124_remove(struct spi_devi + { + struct iio_dev *indio_dev = spi_get_drvdata(spi); + struct ad7124_state *st = iio_priv(indio_dev); +- int i; + + iio_device_unregister(indio_dev); + ad_sd_cleanup_buffer_and_trigger(indio_dev); + clk_disable_unprepare(st->mclk); + +- for (i = ARRAY_SIZE(st->vref) - 1; i >= 0; i--) { +- if (!IS_ERR_OR_NULL(st->vref[i])) +- regulator_disable(st->vref[i]); +- } +- + return 0; + } + diff --git a/patches.suse/iio-adc-ad7124-Fix-potential-overflow-due-to-non-seq.patch b/patches.suse/iio-adc-ad7124-Fix-potential-overflow-due-to-non-seq.patch new file mode 100644 index 0000000..2cffb2c --- /dev/null +++ b/patches.suse/iio-adc-ad7124-Fix-potential-overflow-due-to-non-seq.patch @@ -0,0 +1,53 @@ +From f2a772c51206b0c3f262e4f6a3812c89a650191b Mon Sep 17 00:00:00 2001 +From: Jonathan Cameron +Date: Thu, 13 May 2021 15:07:42 +0300 +Subject: [PATCH] iio: adc: ad7124: Fix potential overflow due to non sequential channel numbers +Git-commit: f2a772c51206b0c3f262e4f6a3812c89a650191b +Patch-mainline: v5.13-rc4 +References: git-fixes + +Channel numbering must start at 0 and then not have any holes, or +it is possible to overflow the available storage. Note this bug was +introduced as part of a fix to ensure we didn't rely on the ordering +of child nodes. So we need to support arbitrary ordering but they all +need to be there somewhere. + +Note I hit this when using qemu to test the rest of this series. +Arguably this isn't the best fix, but it is probably the most minimal +option for backporting etc. + +Alexandru's sign-off is here because he carried this patch in a larger +set that Jonathan then applied. + +Fixes: d7857e4ee1ba6 ("iio: adc: ad7124: Fix DT channel configuration") +Reviewed-by: Alexandru Ardelean +Signed-off-by: Jonathan Cameron +Signed-off-by: Alexandru Ardelean +Cc: +Acked-by: Takashi Iwai + +--- + drivers/iio/adc/ad7124.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/iio/adc/ad7124.c b/drivers/iio/adc/ad7124.c +index 437116a07cf1..a27db78ea13e 100644 +--- a/drivers/iio/adc/ad7124.c ++++ b/drivers/iio/adc/ad7124.c +@@ -771,6 +771,13 @@ static int ad7124_of_parse_channel_config(struct iio_dev *indio_dev, + if (ret) + goto err; + ++ if (channel >= indio_dev->num_channels) { ++ dev_err(indio_dev->dev.parent, ++ "Channel index >= number of channels\n"); ++ ret = -EINVAL; ++ goto err; ++ } ++ + ret = of_property_read_u32_array(child, "diff-channels", + ain, 2); + if (ret) +-- +2.26.2 + diff --git a/patches.suse/iio-adc-ad7768-1-Fix-too-small-buffer-passed-to-iio_.patch b/patches.suse/iio-adc-ad7768-1-Fix-too-small-buffer-passed-to-iio_.patch new file mode 100644 index 0000000..621ef54 --- /dev/null +++ b/patches.suse/iio-adc-ad7768-1-Fix-too-small-buffer-passed-to-iio_.patch @@ -0,0 +1,54 @@ +From a1caeebab07e9d72eec534489f47964782b93ba9 Mon Sep 17 00:00:00 2001 +From: Jonathan Cameron +Date: Sat, 1 May 2021 17:53:13 +0100 +Subject: [PATCH] iio: adc: ad7768-1: Fix too small buffer passed to iio_push_to_buffers_with_timestamp() +Git-commit: a1caeebab07e9d72eec534489f47964782b93ba9 +Patch-mainline: v5.13-rc4 +References: git-fixes + +Add space for the timestamp to be inserted. Also ensure correct +alignment for passing to iio_push_to_buffers_with_timestamp() + +Fixes: a5f8c7da3dbe ("iio: adc: Add AD7768-1 ADC basic support") +Signed-off-by: Jonathan Cameron +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210501165314.511954-2-jic23@kernel.org +Cc: +Acked-by: Takashi Iwai + +--- + drivers/iio/adc/ad7768-1.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/iio/adc/ad7768-1.c b/drivers/iio/adc/ad7768-1.c +index c945f1349623..60f21fed6dcb 100644 +--- a/drivers/iio/adc/ad7768-1.c ++++ b/drivers/iio/adc/ad7768-1.c +@@ -167,6 +167,10 @@ struct ad7768_state { + * transfer buffers to live in their own cache lines. + */ + union { ++ struct { ++ __be32 chan; ++ s64 timestamp; ++ } scan; + __be32 d32; + u8 d8[2]; + } data ____cacheline_aligned; +@@ -469,11 +473,11 @@ static irqreturn_t ad7768_trigger_handler(int irq, void *p) + + mutex_lock(&st->lock); + +- ret = spi_read(st->spi, &st->data.d32, 3); ++ ret = spi_read(st->spi, &st->data.scan.chan, 3); + if (ret < 0) + goto err_unlock; + +- iio_push_to_buffers_with_timestamp(indio_dev, &st->data.d32, ++ iio_push_to_buffers_with_timestamp(indio_dev, &st->data.scan, + iio_get_time_ns(indio_dev)); + + iio_trigger_notify_done(indio_dev->trig); +-- +2.26.2 + diff --git a/patches.suse/iio-adc-ad7793-Add-missing-error-code-in-ad7793_setu.patch b/patches.suse/iio-adc-ad7793-Add-missing-error-code-in-ad7793_setu.patch new file mode 100644 index 0000000..8191d90 --- /dev/null +++ b/patches.suse/iio-adc-ad7793-Add-missing-error-code-in-ad7793_setu.patch @@ -0,0 +1,35 @@ +From 4ed243b1da169bcbc1ec5507867e56250c5f1ff9 Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Fri, 14 May 2021 16:02:54 +0800 +Subject: [PATCH] iio: adc: ad7793: Add missing error code in ad7793_setup() +Git-commit: 4ed243b1da169bcbc1ec5507867e56250c5f1ff9 +Patch-mainline: v5.13-rc4 +References: git-fixes + +Set error code while device ID query failed. + +Fixes: 88bc30548aae ("IIO: ADC: New driver for AD7792/AD7793 3 Channel SPI ADC") +Signed-off-by: YueHaibing +Cc: +Signed-off-by: Jonathan Cameron +Acked-by: Takashi Iwai + +--- + drivers/iio/adc/ad7793.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c +index 5e980a06258e..440ef4c7be07 100644 +--- a/drivers/iio/adc/ad7793.c ++++ b/drivers/iio/adc/ad7793.c +@@ -279,6 +279,7 @@ static int ad7793_setup(struct iio_dev *indio_dev, + id &= AD7793_ID_MASK; + + if (id != st->chip_info->id) { ++ ret = -ENODEV; + dev_err(&st->sd.spi->dev, "device ID query failed\n"); + goto out; + } +-- +2.26.2 + diff --git a/patches.suse/iio-gyro-fxas21002c-balance-runtime-power-in-error-p.patch b/patches.suse/iio-gyro-fxas21002c-balance-runtime-power-in-error-p.patch new file mode 100644 index 0000000..2808304 --- /dev/null +++ b/patches.suse/iio-gyro-fxas21002c-balance-runtime-power-in-error-p.patch @@ -0,0 +1,48 @@ +From 2a54c8c9ebc2006bf72554afc84ffc67768979a0 Mon Sep 17 00:00:00 2001 +From: Rui Miguel Silva +Date: Wed, 12 May 2021 23:39:29 +0100 +Subject: [PATCH] iio: gyro: fxas21002c: balance runtime power in error path +Git-commit: 2a54c8c9ebc2006bf72554afc84ffc67768979a0 +Patch-mainline: v5.13-rc4 +References: git-fixes + +If we fail to read temperature or axis we need to decrement the +runtime pm reference count to trigger autosuspend. + +Add the call to pm_put to do that in case of error. + +Fixes: a0701b6263ae ("iio: gyro: add core driver for fxas21002c") +Suggested-by: Mauro Carvalho Chehab +Signed-off-by: Rui Miguel Silva +Link: https://lore.kernel.org/linux-iio/CBBZA9T1OY9C.2611WSV49DV2G@arch-thunder/ +Cc: +Signed-off-by: Jonathan Cameron +Acked-by: Takashi Iwai + +--- + drivers/iio/gyro/fxas21002c_core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/iio/gyro/fxas21002c_core.c b/drivers/iio/gyro/fxas21002c_core.c +index 1a20c6b88e7d..645461c70454 100644 +--- a/drivers/iio/gyro/fxas21002c_core.c ++++ b/drivers/iio/gyro/fxas21002c_core.c +@@ -399,6 +399,7 @@ static int fxas21002c_temp_get(struct fxas21002c_data *data, int *val) + ret = regmap_field_read(data->regmap_fields[F_TEMP], &temp); + if (ret < 0) { + dev_err(dev, "failed to read temp: %d\n", ret); ++ fxas21002c_pm_put(data); + goto data_unlock; + } + +@@ -432,6 +433,7 @@ static int fxas21002c_axis_get(struct fxas21002c_data *data, + &axis_be, sizeof(axis_be)); + if (ret < 0) { + dev_err(dev, "failed to read axis: %d: %d\n", index, ret); ++ fxas21002c_pm_put(data); + goto data_unlock; + } + +-- +2.26.2 + diff --git a/patches.suse/ipc-mqueue-msg-sem-Avoid-relying-on-a-stack-reference.patch b/patches.suse/ipc-mqueue-msg-sem-Avoid-relying-on-a-stack-reference.patch index b704bd0..18a4fde 100644 --- a/patches.suse/ipc-mqueue-msg-sem-Avoid-relying-on-a-stack-reference.patch +++ b/patches.suse/ipc-mqueue-msg-sem-Avoid-relying-on-a-stack-reference.patch @@ -1,10 +1,12 @@ -From 60f611fa216cd0b0395499d703215537ed1f0b44 Mon Sep 17 00:00:00 2001 +From a11ddb37bf367e6b5239b95ca759e5389bb46048 Mon Sep 17 00:00:00 2001 From: Varad Gautam Date: Fri, 14 May 2021 10:39:22 +1000 Subject: ipc/mqueue, msg, sem: Avoid relying on a stack reference past its expiry -Patch-mainline: Not yet, queued on linux-next via akpm's -mm patchqueue References: bsc#1185988 +Git-commit: a11ddb37bf367e6b5239b95ca759e5389bb46048 +Patch-mainline: v5.13-rc3 + do_mq_timedreceive calls wq_sleep with a stack local address. The sender (do_mq_timedsend) uses this address to later call pipelined_send. diff --git a/patches.suse/leds-lp5523-check-return-value-of-lp5xx_read-and-jum.patch b/patches.suse/leds-lp5523-check-return-value-of-lp5xx_read-and-jum.patch new file mode 100644 index 0000000..ffd2890 --- /dev/null +++ b/patches.suse/leds-lp5523-check-return-value-of-lp5xx_read-and-jum.patch @@ -0,0 +1,43 @@ +From 6647f7a06eb030a2384ec71f0bb2e78854afabfe Mon Sep 17 00:00:00 2001 +From: Phillip Potter +Date: Mon, 3 May 2021 13:56:36 +0200 +Subject: [PATCH] leds: lp5523: check return value of lp5xx_read and jump to cleanup code +Git-commit: 6647f7a06eb030a2384ec71f0bb2e78854afabfe +Patch-mainline: v5.13-rc3 +References: git-fixes + +Check return value of lp5xx_read and if non-zero, jump to code at end of +the function, causing lp5523_stop_all_engines to be executed before +returning the error value up the call chain. This fixes the original +commit (248b57015f35) which was reverted due to the University of Minnesota +problems. + +Cc: stable +Acked-by: Jacek Anaszewski +Signed-off-by: Phillip Potter +Link: https://lore.kernel.org/r/20210503115736.2104747-10-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/leds/leds-lp5523.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c +index 5036d7d5f3d4..b1590cb4a188 100644 +--- a/drivers/leds/leds-lp5523.c ++++ b/drivers/leds/leds-lp5523.c +@@ -305,7 +305,9 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip) + + /* Let the programs run for couple of ms and check the engine status */ + usleep_range(3000, 6000); +- lp55xx_read(chip, LP5523_REG_STATUS, &status); ++ ret = lp55xx_read(chip, LP5523_REG_STATUS, &status); ++ if (ret) ++ goto out; + status &= LP5523_ENG_STATUS_MASK; + + if (status != LP5523_ENG_STATUS_MASK) { +-- +2.26.2 + diff --git a/patches.suse/mac80211-clear-the-beacon-s-CRC-after-channel-switch.patch b/patches.suse/mac80211-clear-the-beacon-s-CRC-after-channel-switch.patch new file mode 100644 index 0000000..aa604d8 --- /dev/null +++ b/patches.suse/mac80211-clear-the-beacon-s-CRC-after-channel-switch.patch @@ -0,0 +1,52 @@ +From d6843d1ee283137723b4a8c76244607ce6db1951 Mon Sep 17 00:00:00 2001 +From: Emmanuel Grumbach +Date: Thu, 8 Apr 2021 14:31:25 +0200 +Subject: [PATCH] mac80211: clear the beacon's CRC after channel switch +Git-commit: d6843d1ee283137723b4a8c76244607ce6db1951 +Patch-mainline: v5.13-rc1 +References: git-fixes + +After channel switch, we should consider any beacon with a +CSA IE as a new switch. If the CSA IE is a leftover from +before the switch that the AP forgot to remove, we'll get +a CSA-to-Self. + +This caused issues in iwlwifi where the firmware saw a beacon +with a CSA-to-Self with mode = 1 on the new channel after a +switch. The firmware considered this a new switch and closed +its queues. Since the beacon didn't change between before and +after the switch, we wouldn't handle it (the CRC is the same) +and we wouldn't let the firmware open its queues again or +disconnect if the CSA IE stays for too long. + +Clear the CRC valid state after we switch to make sure that +we handle the beacon and handle the CSA IE as required. + +Signed-off-by: Emmanuel Grumbach +Link: https://lore.kernel.org/r/20210408143124.b9e68aa98304.I465afb55ca2c7d59f7bf610c6046a1fd732b4c28@changeid +Signed-off-by: Johannes Berg +Acked-by: Takashi Iwai + +--- + net/mac80211/mlme.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index ce4e3855fec1..5f89aae9ea23 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -1295,6 +1295,11 @@ static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata) + + sdata->vif.csa_active = false; + ifmgd->csa_waiting_bcn = false; ++ /* ++ * If the CSA IE is still present on the beacon after the switch, ++ * we need to consider it as a new CSA (possibly to self). ++ */ ++ ifmgd->beacon_crc_valid = false; + + ret = drv_post_channel_switch(sdata); + if (ret) { +-- +2.26.2 + diff --git a/patches.suse/misc-uss720-fix-memory-leak-in-uss720_probe.patch b/patches.suse/misc-uss720-fix-memory-leak-in-uss720_probe.patch new file mode 100644 index 0000000..54e7d8c --- /dev/null +++ b/patches.suse/misc-uss720-fix-memory-leak-in-uss720_probe.patch @@ -0,0 +1,57 @@ +From dcb4b8ad6a448532d8b681b5d1a7036210b622de Mon Sep 17 00:00:00 2001 +From: Dongliang Mu +Date: Fri, 14 May 2021 20:43:48 +0800 +Subject: [PATCH] misc/uss720: fix memory leak in uss720_probe +Git-commit: dcb4b8ad6a448532d8b681b5d1a7036210b622de +Patch-mainline: v5.13-rc4 +References: git-fixes + +uss720_probe forgets to decrease the refcount of usbdev in uss720_probe. +Fix this by decreasing the refcount of usbdev by usb_put_dev. + +Bug: memory leak +unreferenced object 0xffff888101113800 (size 2048): + comm "kworker/0:1", pid 7, jiffies 4294956777 (age 28.870s) + hex dump (first 32 bytes): + ff ff ff ff 31 00 00 00 00 00 00 00 00 00 00 00 ....1........... + 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 ................ + backtrace: + [] kmalloc include/linux/slab.h:554 [inline] + [] kzalloc include/linux/slab.h:684 [inline] + [] usb_alloc_dev+0x32/0x450 drivers/usb/core/usb.c:582 + [] hub_port_connect drivers/usb/core/hub.c:5129 [inline] + [] hub_port_connect_change drivers/usb/core/hub.c:5363 [inline] + [] port_event drivers/usb/core/hub.c:5509 [inline] + [] hub_event+0x1171/0x20c0 drivers/usb/core/hub.c:5591 + [] process_one_work+0x2c9/0x600 kernel/workqueue.c:2275 + [] worker_thread+0x59/0x5d0 kernel/workqueue.c:2421 + [] kthread+0x178/0x1b0 kernel/kthread.c:292 + [] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 + +Fixes: 0f36163d3abe ("[PATCH] usb: fix uss720 schedule with interrupts off") +Cc: stable +Reported-by: syzbot+636c58f40a86b4a879e7@syzkaller.appspotmail.com +Signed-off-by: Dongliang Mu +Link: https://lore.kernel.org/r/20210514124348.6587-1-mudongliangabcd@gmail.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/misc/uss720.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c +index b5d661644263..748139d26263 100644 +--- a/drivers/usb/misc/uss720.c ++++ b/drivers/usb/misc/uss720.c +@@ -736,6 +736,7 @@ static int uss720_probe(struct usb_interface *intf, + parport_announce_port(pp); + + usb_set_intfdata(intf, pp); ++ usb_put_dev(usbdev); + return 0; + + probe_abort: +-- +2.26.2 + diff --git a/patches.suse/mmc-sdhci-pci-gli-increase-1.8V-regulator-wait.patch b/patches.suse/mmc-sdhci-pci-gli-increase-1.8V-regulator-wait.patch new file mode 100644 index 0000000..a37f31f --- /dev/null +++ b/patches.suse/mmc-sdhci-pci-gli-increase-1.8V-regulator-wait.patch @@ -0,0 +1,58 @@ +From a1149a6c06ee094a6e62886b0c0e8e66967a728a Mon Sep 17 00:00:00 2001 +From: Daniel Beer +Date: Sat, 24 Apr 2021 20:16:52 +1200 +Subject: [PATCH] mmc: sdhci-pci-gli: increase 1.8V regulator wait +Git-commit: a1149a6c06ee094a6e62886b0c0e8e66967a728a +Patch-mainline: v5.13-rc3 +References: git-fixes + +Inserting an SD-card on an Intel NUC10i3FNK4 (which contains a GL9755) +results in the message: + + mmc0: 1.8V regulator output did not become stable + +Following this message, some cards work (sometimes), but most cards fail +with EILSEQ. This behaviour is observed on Debian 10 running kernel +4.19.188, but also with 5.8.18 and 5.11.15. + +The driver currently waits 5ms after switching on the 1.8V regulator for +it to become stable. Increasing this to 10ms gets rid of the warning +about stability, but most cards still fail. Increasing it to 20ms gets +some cards working (a 32GB Samsung micro SD works, a 128GB ADATA +doesn't). At 50ms, the ADATA works most of the time, and at 100ms both +cards work reliably. + +Signed-off-by: Daniel Beer +Acked-by: Ben Chuang +Fixes: e51df6ce668a ("mmc: host: sdhci-pci: Add Genesys Logic GL975x support") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20210424081652.GA16047@nyquist.nev +Signed-off-by: Ulf Hansson +Acked-by: Takashi Iwai + +--- + drivers/mmc/host/sdhci-pci-gli.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/sdhci-pci-gli.c b/drivers/mmc/host/sdhci-pci-gli.c +index 592d79082f58..061618aa247f 100644 +--- a/drivers/mmc/host/sdhci-pci-gli.c ++++ b/drivers/mmc/host/sdhci-pci-gli.c +@@ -627,8 +627,13 @@ static void sdhci_gli_voltage_switch(struct sdhci_host *host) + * + * Wait 5ms after set 1.8V signal enable in Host Control 2 register + * to ensure 1.8V signal enable bit is set by GL9750/GL9755. ++ * ++ * ...however, the controller in the NUC10i3FNK4 (a 9755) requires ++ * slightly longer than 5ms before the control register reports that ++ * 1.8V is ready, and far longer still before the card will actually ++ * work reliably. + */ +- usleep_range(5000, 5500); ++ usleep_range(100000, 110000); + } + + static void sdhci_gl9750_reset(struct sdhci_host *host, u8 mask) +-- +2.26.2 + diff --git a/patches.suse/msft-hv-2080-uio_hv_generic-add-missed-sysfs_remove_bin_file.patch b/patches.suse/msft-hv-2080-uio_hv_generic-add-missed-sysfs_remove_bin_file.patch new file mode 100644 index 0000000..231aa2f --- /dev/null +++ b/patches.suse/msft-hv-2080-uio_hv_generic-add-missed-sysfs_remove_bin_file.patch @@ -0,0 +1,30 @@ +From: Chuhong Yuan +Date: Thu, 7 May 2020 23:13:43 +0800 +Patch-mainline: v5.8-rc1 +References: git-fixes +Subject: uio_hv_generic: add missed sysfs_remove_bin_file +Git-commit: 7066c2f61ce49b131026fec68ed1c9b0d0d9a05a + +This driver calls sysfs_create_bin_file() in probe, but forgets to +call sysfs_remove_bin_file() in remove. +Add the missed call to fix it. + +Signed-off-by: Chuhong Yuan +Link: https://lore.kernel.org/r/20200507151343.792816-1-hslester96@gmail.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Olaf Hering +--- + drivers/uio/uio_hv_generic.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c +--- a/drivers/uio/uio_hv_generic.c ++++ b/drivers/uio/uio_hv_generic.c +@@ -361,6 +361,7 @@ hv_uio_remove(struct hv_device *dev) + if (!pdata) + return 0; + ++ sysfs_remove_bin_file(&dev->channel->kobj, &ring_buffer_bin_attr); + uio_unregister_device(&pdata->info); + hv_uio_cleanup(dev, pdata); + hv_set_drvdata(dev, NULL); diff --git a/patches.suse/msft-hv-2197-uio-uio_hv_generic-use-devm_kzalloc-for-private-data.patch b/patches.suse/msft-hv-2197-uio-uio_hv_generic-use-devm_kzalloc-for-private-data.patch new file mode 100644 index 0000000..ba470ea --- /dev/null +++ b/patches.suse/msft-hv-2197-uio-uio_hv_generic-use-devm_kzalloc-for-private-data.patch @@ -0,0 +1,61 @@ +From: Alexandru Ardelean +Date: Thu, 19 Nov 2020 17:49:03 +0200 +Patch-mainline: v5.11-rc1 +References: git-fixes +Subject: uio: uio_hv_generic: use devm_kzalloc() for private data alloc +Git-commit: 74e71964b1a9ffd34fa4b6ec8f2fa13e7cf0ac7a + +This is a minor cleanup for the management of the private object of this +driver. The allocation can be tied to the life-time of the hv_device +object. +This cleans up a bit the exit & error paths, since the object doesn't need +to be explicitly free'd anymore. + +Signed-off-by: Alexandru Ardelean +Link: https://lore.kernel.org/r/20201119154903.82099-4-alexandru.ardelean@analog.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Olaf Hering +--- + drivers/uio/uio_hv_generic.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c +--- a/drivers/uio/uio_hv_generic.c ++++ b/drivers/uio/uio_hv_generic.c +@@ -247,14 +247,14 @@ hv_uio_probe(struct hv_device *dev, + return -ENOTSUPP; + } + +- pdata = kzalloc(sizeof(*pdata), GFP_KERNEL); ++ pdata = devm_kzalloc(&dev->device, sizeof(*pdata), GFP_KERNEL); + if (!pdata) + return -ENOMEM; + + ret = vmbus_alloc_ring(channel, HV_RING_SIZE * PAGE_SIZE, + HV_RING_SIZE * PAGE_SIZE); + if (ret) +- goto fail; ++ return ret; + + set_channel_read_mode(channel, HV_CALL_ISR); + +@@ -347,8 +347,6 @@ hv_uio_probe(struct hv_device *dev, + + fail_close: + hv_uio_cleanup(dev, pdata); +-fail: +- kfree(pdata); + + return ret; + } +@@ -364,10 +362,8 @@ hv_uio_remove(struct hv_device *dev) + sysfs_remove_bin_file(&dev->channel->kobj, &ring_buffer_bin_attr); + uio_unregister_device(&pdata->info); + hv_uio_cleanup(dev, pdata); +- hv_set_drvdata(dev, NULL); + + vmbus_free_ring(dev->channel); +- kfree(pdata); + return 0; + } + diff --git a/patches.suse/msft-hv-2316-uio_hv_generic-Fix-a-memory-leak-in-error-handling-p.patch b/patches.suse/msft-hv-2316-uio_hv_generic-Fix-a-memory-leak-in-error-handling-p.patch new file mode 100644 index 0000000..76ee174 --- /dev/null +++ b/patches.suse/msft-hv-2316-uio_hv_generic-Fix-a-memory-leak-in-error-handling-p.patch @@ -0,0 +1,50 @@ +From: Christophe JAILLET +Date: Sun, 9 May 2021 09:13:03 +0200 +Patch-mainline: v5.13-rc3 +References: git-fixes +Subject: uio_hv_generic: Fix a memory leak in error handling paths +Git-commit: 3ee098f96b8b6c1a98f7f97915f8873164e6af9d + +If 'vmbus_establish_gpadl()' fails, the (recv|send)_gpadl will not be +updated and 'hv_uio_cleanup()' in the error handling path will not be +able to free the corresponding buffer. + +In such a case, we need to free the buffer explicitly. + +Fixes: cdfa835c6e5e ("uio_hv_generic: defer opening vmbus until first use") +Cc: stable +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/4fdaff557deef6f0475d02ba7922ddbaa1ab08a6.1620544055.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Acked-by: Olaf Hering +--- + drivers/uio/uio_hv_generic.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c +--- a/drivers/uio/uio_hv_generic.c ++++ b/drivers/uio/uio_hv_generic.c +@@ -296,8 +296,10 @@ hv_uio_probe(struct hv_device *dev, + + ret = vmbus_establish_gpadl(channel, pdata->recv_buf, + RECV_BUFFER_SIZE, &pdata->recv_gpadl); +- if (ret) ++ if (ret) { ++ vfree(pdata->recv_buf); + goto fail_close; ++ } + + /* put Global Physical Address Label in name */ + snprintf(pdata->recv_name, sizeof(pdata->recv_name), +@@ -316,8 +318,10 @@ hv_uio_probe(struct hv_device *dev, + + ret = vmbus_establish_gpadl(channel, pdata->send_buf, + SEND_BUFFER_SIZE, &pdata->send_gpadl); +- if (ret) ++ if (ret) { ++ vfree(pdata->send_buf); + goto fail_close; ++ } + + snprintf(pdata->send_name, sizeof(pdata->send_name), + "send:%u", pdata->send_gpadl); diff --git a/patches.suse/msft-hv-2317-uio_hv_generic-Fix-another-memory-leak-in-error-hand.patch b/patches.suse/msft-hv-2317-uio_hv_generic-Fix-another-memory-leak-in-error-hand.patch new file mode 100644 index 0000000..e141e38 --- /dev/null +++ b/patches.suse/msft-hv-2317-uio_hv_generic-Fix-another-memory-leak-in-error-hand.patch @@ -0,0 +1,45 @@ +From: Christophe JAILLET +Date: Sun, 9 May 2021 09:13:12 +0200 +Patch-mainline: v5.13-rc3 +References: git-fixes +Subject: uio_hv_generic: Fix another memory leak in error handling paths +Git-commit: 0b0226be3a52dadd965644bc52a807961c2c26df + +Memory allocated by 'vmbus_alloc_ring()' at the beginning of the probe +function is never freed in the error handling path. + +Add the missing 'vmbus_free_ring()' call. + +Note that it is already freed in the .remove function. + +Fixes: cdfa835c6e5e ("uio_hv_generic: defer opening vmbus until first use") +Cc: stable +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/0d86027b8eeed8e6360bc3d52bcdb328ff9bdca1.1620544055.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Acked-by: Olaf Hering +--- + drivers/uio/uio_hv_generic.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c +--- a/drivers/uio/uio_hv_generic.c ++++ b/drivers/uio/uio_hv_generic.c +@@ -291,7 +291,7 @@ hv_uio_probe(struct hv_device *dev, + pdata->recv_buf = vzalloc(RECV_BUFFER_SIZE); + if (pdata->recv_buf == NULL) { + ret = -ENOMEM; +- goto fail_close; ++ goto fail_free_ring; + } + + ret = vmbus_establish_gpadl(channel, pdata->recv_buf, +@@ -351,6 +351,8 @@ hv_uio_probe(struct hv_device *dev, + + fail_close: + hv_uio_cleanup(dev, pdata); ++fail_free_ring: ++ vmbus_free_ring(dev->channel); + + return ret; + } diff --git a/patches.suse/net-enetc-fix-link-error-again.patch b/patches.suse/net-enetc-fix-link-error-again.patch new file mode 100644 index 0000000..be2942c --- /dev/null +++ b/patches.suse/net-enetc-fix-link-error-again.patch @@ -0,0 +1,46 @@ +From: Arnd Bergmann +Date: Thu, 22 Apr 2021 15:35:11 +0200 +Subject: net: enetc: fix link error again + +Git-commit: 74c97ea3b61e4ce149444f904ee8d4fc7073505b +Patch-mainline: v5.13-rc1 +References: git-fixes + +A link time bug that I had fixed before has come back now that +another sub-module was added to the enetc driver: + +ERROR: modpost: "enetc_ierb_register_pf" [drivers/net/ethernet/freescale/enetc/fsl-enetc.ko] undefined! + +The problem is that the enetc Makefile is not actually used for +the ierb module if that is the only built-in driver in there +and everything else is a loadable module. + +Fix it by always entering the directory this time, regardless +of which symbols are configured. This should reliably fix the +problem and prevent it from coming back another time. + +Fixes: 112463ddbe82 ("net: dsa: felix: fix link error") +Fixes: e7d48e5fbf30 ("net: enetc: add a mini driver for the Integrated Endpoint Register Block") +Signed-off-by: Arnd Bergmann +Acked-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Mian Yousaf Kaukab +--- + drivers/net/ethernet/freescale/Makefile | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/Makefile b/drivers/net/ethernet/freescale/Makefile +index 67c436400352..de7b31842233 100644 +--- a/drivers/net/ethernet/freescale/Makefile ++++ b/drivers/net/ethernet/freescale/Makefile +@@ -24,6 +24,4 @@ obj-$(CONFIG_FSL_DPAA_ETH) += dpaa/ + + obj-$(CONFIG_FSL_DPAA2_ETH) += dpaa2/ + +-obj-$(CONFIG_FSL_ENETC) += enetc/ +-obj-$(CONFIG_FSL_ENETC_MDIO) += enetc/ +-obj-$(CONFIG_FSL_ENETC_VF) += enetc/ ++obj-y += enetc/ +-- +2.26.2 + diff --git a/patches.suse/net-usb-fix-memory-leak-in-smsc75xx_bind.patch b/patches.suse/net-usb-fix-memory-leak-in-smsc75xx_bind.patch new file mode 100644 index 0000000..5a28f26 --- /dev/null +++ b/patches.suse/net-usb-fix-memory-leak-in-smsc75xx_bind.patch @@ -0,0 +1,61 @@ +From 46a8b29c6306d8bbfd92b614ef65a47c900d8e70 Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Mon, 24 May 2021 23:02:08 +0300 +Subject: [PATCH] net: usb: fix memory leak in smsc75xx_bind +Git-commit: 46a8b29c6306d8bbfd92b614ef65a47c900d8e70 +Patch-mainline: v5.13-rc4 +References: git-fixes + +Syzbot reported memory leak in smsc75xx_bind(). +The problem was is non-freed memory in case of +errors after memory allocation. + +Backtrace: [] kmalloc include/linux/slab.h:556 [inline] [] kzalloc include/linux/slab.h:686 [inline] [] smsc75xx_bind+0x7a/0x334 drivers/net/usb/smsc75xx.c:1460 [] usbnet_probe+0x3b6/0xc30 drivers/net/usb/usbnet.c:1728 + +Fixes: d0cad871703b ("smsc75xx: SMSC LAN75xx USB gigabit ethernet adapter driver") +Cc: stable@kernel.vger.org +Reported-and-tested-by: syzbot+b558506ba8165425fee2@syzkaller.appspotmail.com +Signed-off-by: Pavel Skripkin +Signed-off-by: David S. Miller +Acked-by: Takashi Iwai + +--- + drivers/net/usb/smsc75xx.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c +index f8cdabb9ef5a..b286993da67c 100644 +--- a/drivers/net/usb/smsc75xx.c ++++ b/drivers/net/usb/smsc75xx.c +@@ -1483,7 +1483,7 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf) + ret = smsc75xx_wait_ready(dev, 0); + if (ret < 0) { + netdev_warn(dev->net, "device not ready in smsc75xx_bind\n"); +- return ret; ++ goto err; + } + + smsc75xx_init_mac_address(dev); +@@ -1492,7 +1492,7 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf) + ret = smsc75xx_reset(dev); + if (ret < 0) { + netdev_warn(dev->net, "smsc75xx_reset error %d\n", ret); +- return ret; ++ goto err; + } + + dev->net->netdev_ops = &smsc75xx_netdev_ops; +@@ -1502,6 +1502,10 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf) + dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len; + dev->net->max_mtu = MAX_SINGLE_PACKET_SIZE; + return 0; ++ ++err: ++ kfree(pdata); ++ return ret; + } + + static void smsc75xx_unbind(struct usbnet *dev, struct usb_interface *intf) +-- +2.26.2 + diff --git a/patches.suse/nvme-add-NVME_REQ_CANCELLED-flag-in-nvme_cancel_requ.patch b/patches.suse/nvme-add-NVME_REQ_CANCELLED-flag-in-nvme_cancel_requ.patch new file mode 100644 index 0000000..f1c9457 --- /dev/null +++ b/patches.suse/nvme-add-NVME_REQ_CANCELLED-flag-in-nvme_cancel_requ.patch @@ -0,0 +1,32 @@ +From: Hannes Reinecke +Date: Fri, 26 Feb 2021 08:17:26 +0100 +Subject: nvme: add NVME_REQ_CANCELLED flag in nvme_cancel_request() +Patch-mainline: v5.12-rc3 +Git-commit: d3589381987ec879b03f8ce3039df57e87f05901 +References: bsc#1184259 + +NVME_REQ_CANCELLED is translated into -EINTR in nvme_submit_sync_cmd(), +so we should be setting this flags during nvme_cancel_request() to +ensure that the callers to nvme_submit_sync_cmd() will get the correct +error code when the controller is reset. + +Signed-off-by: Hannes Reinecke +Reviewed-by: Keith Busch +Reviewed-by: Sagi Grimberg +Reviewed-by: Chao Leng +Reviewed-by: Daniel Wagner +Signed-off-by: Christoph Hellwig +--- + drivers/nvme/host/core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -341,6 +341,7 @@ bool nvme_cancel_request(struct request + return true; + + nvme_req(req)->status = NVME_SC_HOST_ABORTED_CMD; ++ nvme_req(req)->flags |= NVME_REQ_CANCELLED; + blk_mq_force_complete_rq(req); + return true; + } diff --git a/patches.suse/nvme-document-nvme-controller-states.patch b/patches.suse/nvme-document-nvme-controller-states.patch new file mode 100644 index 0000000..9ef10fc --- /dev/null +++ b/patches.suse/nvme-document-nvme-controller-states.patch @@ -0,0 +1,45 @@ +From: Sagi Grimberg +Date: Wed, 22 Jul 2020 16:32:18 -0700 +Subject: [PATCH] nvme: document nvme controller states +Git-commit: 4212f4e94633f3403c3871d11213badc50b3f6e4 +Patch-mainline: v5.9-rc1 +References: git-fixes + +We are starting to see some non-trivial states +so lets start documenting them. + +Signed-off-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/nvme.h | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index 2ee91a3dd8e0..92629758b77c 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -181,6 +181,20 @@ static inline u16 nvme_req_qid(struct request *req) + */ + #define NVME_QUIRK_DELAY_AMOUNT 2300 + ++/* ++ * enum nvme_ctrl_state: Controller state ++ * ++ * @NVME_CTRL_NEW: New controller just allocated, initial state ++ * @NVME_CTRL_LIVE: Controller is connected and I/O capable ++ * @NVME_CTRL_RESETTING: Controller is resetting (or scheduled reset) ++ * @NVME_CTRL_CONNECTING: Controller is disconnected, now connecting the ++ * transport ++ * @NVME_CTRL_DELETING: Controller is deleting (or scheduled deletion) ++ * @NVME_CTRL_DEAD: Controller is non-present/unresponsive during ++ * shutdown or removal. In this case we forcibly ++ * kill all inflight I/O as they have no chance to ++ * complete ++ */ + enum nvme_ctrl_state { + NVME_CTRL_NEW, + NVME_CTRL_LIVE, +-- +2.29.2 + diff --git a/patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch b/patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch new file mode 100644 index 0000000..0e28af2 --- /dev/null +++ b/patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch @@ -0,0 +1,33 @@ +From: Hannes Reinecke +Date: Fri, 21 May 2021 10:23:46 +0200 +Subject: nvme-fabrics: decode host pathing error for connect +Patch-mainline: v5.13-rc4 +Git-commit: 4d9442bf263ac45d495bb7ecf75009e59c0622b2 +References: bsc#1179827 + +Add an additional decoding for 'host pathing error' during connect. + +Signed-off-by: Hannes Reinecke +Reviewed-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Himanshu Madhani +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/fabrics.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/nvme/host/fabrics.c ++++ b/drivers/nvme/host/fabrics.c +@@ -336,6 +336,11 @@ static void nvmf_log_connect_error(struc + cmd->connect.recfmt); + break; + ++ case NVME_SC_HOST_PATH_ERROR: ++ dev_err(ctrl->device, ++ "Connect command failed: host path error\n"); ++ break; ++ + default: + dev_err(ctrl->device, + "Connect command failed, error wo/DNR bit: %d\n", diff --git a/patches.suse/nvme-fabrics-reject-I-O-to-offline-device.patch b/patches.suse/nvme-fabrics-reject-I-O-to-offline-device.patch index f0846ca..caca65a 100644 --- a/patches.suse/nvme-fabrics-reject-I-O-to-offline-device.patch +++ b/patches.suse/nvme-fabrics-reject-I-O-to-offline-device.patch @@ -127,7 +127,7 @@ Acked-by: Enzo Matsumiya +++ b/drivers/nvme/host/fabrics.c @@ -549,6 +549,7 @@ blk_status_t nvmf_fail_nonready_command( { - if (ctrl->state != NVME_CTRL_DELETING && + if (ctrl->state != NVME_CTRL_DELETING_NOIO && ctrl->state != NVME_CTRL_DEAD && + !test_bit(NVME_CTRL_FAILFAST_EXPIRED, &ctrl->flags) && !blk_noretry_request(rq) && !(rq->cmd_flags & REQ_NVME_MPATH)) diff --git a/patches.suse/nvme-fc-check-sgl-supported-by-target.patch b/patches.suse/nvme-fc-check-sgl-supported-by-target.patch new file mode 100644 index 0000000..bd4a1ca --- /dev/null +++ b/patches.suse/nvme-fc-check-sgl-supported-by-target.patch @@ -0,0 +1,32 @@ +From: Max Gurtovoy +Date: Tue, 30 Mar 2021 23:01:20 +0000 +Subject: nvme-fc: check sgl supported by target +Patch-mainline: v5.13-rc1 +Git-commit: 8df1bff57c7e5fc7747b9236561079907d8cf82e +References: bsc#1179827 + +SGLs support is mandatory for NVMe/FC, make sure that the target is +aligned to the specification. + +Signed-off-by: Max Gurtovoy +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/fc.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -3097,6 +3097,11 @@ nvme_fc_create_association(struct nvme_f + } + + /* FC-NVME supports normal SGL Data Block Descriptors */ ++ if (!(ctrl->ctrl.sgls & ((1 << 0) | (1 << 1)))) { ++ dev_err(ctrl->ctrl.device, ++ "Mandatory sgls are not supported!\n"); ++ goto out_disconnect_admin_queue; ++ } + + if (opts->queue_size > ctrl->ctrl.maxcmd) { + /* warn if maxcmd is lower than queue_size */ diff --git a/patches.suse/nvme-fc-clear-q_live-at-beginning-of-association-tea.patch b/patches.suse/nvme-fc-clear-q_live-at-beginning-of-association-tea.patch new file mode 100644 index 0000000..b67e58d --- /dev/null +++ b/patches.suse/nvme-fc-clear-q_live-at-beginning-of-association-tea.patch @@ -0,0 +1,52 @@ +From: James Smart +Date: Mon, 10 May 2021 21:56:35 -0700 +Subject: nvme-fc: clear q_live at beginning of association teardown +Patch-mainline: v5.13-rc3 +Git-commit: a7d139145a6640172516b193abf6d2398620aa14 +References: bsc#1186479 + +The __nvmf_check_ready() routine used to bounce all filesystem io if the +controller state isn't LIVE. However, a later patch changed the logic so +that it rejection ends up being based on the Q live check. The FC +transport has a slightly different sequence from rdma and tcp for +shutting down queues/marking them non-live. FC marks its queue non-live +after aborting all ios and waiting for their termination, leaving a +rather large window for filesystem io to continue to hit the transport. +Unfortunately this resulted in filesystem I/O or applications seeing I/O +errors. + +Change the FC transport to mark the queues non-live at the first sign of +teardown for the association (when I/O is initially terminated). + +Fixes: 73a5379937ec ("nvme-fabrics: allow to queue requests for live queues") +Signed-off-by: James Smart +Reviewed-by: Sagi Grimberg +Reviewed-by: Himanshu Madhani +Reviewed-by: Hannes Reinecke +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/fc.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -2457,6 +2457,18 @@ nvme_fc_terminate_exchange(struct reques + static void + __nvme_fc_abort_outstanding_ios(struct nvme_fc_ctrl *ctrl, bool start_queues) + { ++ int q; ++ ++ /* ++ * if aborting io, the queues are no longer good, mark them ++ * all as not live. ++ */ ++ if (ctrl->ctrl.queue_count > 1) { ++ for (q = 1; q < ctrl->ctrl.queue_count; q++) ++ clear_bit(NVME_FC_Q_LIVE, &ctrl->queues[q].flags); ++ } ++ clear_bit(NVME_FC_Q_LIVE, &ctrl->queues[0].flags); ++ + /* + * If io queues are present, stop them and terminate all outstanding + * ios on them. As FC allocates FC exchange for each io, the diff --git a/patches.suse/nvme-fc-return-NVME_SC_HOST_ABORTED_CMD-when-a-comma.patch b/patches.suse/nvme-fc-return-NVME_SC_HOST_ABORTED_CMD-when-a-comma.patch new file mode 100644 index 0000000..c18eb32 --- /dev/null +++ b/patches.suse/nvme-fc-return-NVME_SC_HOST_ABORTED_CMD-when-a-comma.patch @@ -0,0 +1,31 @@ +From: Hannes Reinecke +Date: Fri, 26 Feb 2021 08:17:28 +0100 +Subject: nvme-fc: return NVME_SC_HOST_ABORTED_CMD when a command has been + aborted +Patch-mainline: v5.12-rc3 +Git-commit: ae3afe6308b43bbf49953101d4ba2c1c481133a8 +References: bsc#1184259 + +When a command has been aborted we should return NVME_SC_HOST_ABORTED_CMD +to be consistent with the other transports. + +Signed-off-by: Hannes Reinecke +Reviewed-by: Sagi Grimberg +Reviewed-by: James Smart +Reviewed-by: Daniel Wagner +Signed-off-by: Christoph Hellwig +--- + drivers/nvme/host/fc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -1954,7 +1954,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req + sizeof(op->rsp_iu), DMA_FROM_DEVICE); + + if (opstate == FCPOP_STATE_ABORTED) +- status = cpu_to_le16(NVME_SC_HOST_PATH_ERROR << 1); ++ status = cpu_to_le16(NVME_SC_HOST_ABORTED_CMD << 1); + else if (freq->status) { + status = cpu_to_le16(NVME_SC_HOST_PATH_ERROR << 1); + dev_info(ctrl->ctrl.device, diff --git a/patches.suse/nvme-fc-set-NVME_REQ_CANCELLED-in-nvme_fc_terminate_.patch b/patches.suse/nvme-fc-set-NVME_REQ_CANCELLED-in-nvme_fc_terminate_.patch new file mode 100644 index 0000000..01274db --- /dev/null +++ b/patches.suse/nvme-fc-set-NVME_REQ_CANCELLED-in-nvme_fc_terminate_.patch @@ -0,0 +1,31 @@ +From: Hannes Reinecke +Date: Fri, 26 Feb 2021 08:17:27 +0100 +Subject: nvme-fc: set NVME_REQ_CANCELLED in nvme_fc_terminate_exchange() +Patch-mainline: v5.12-rc3 +Git-commit: 3c7aafbc8d3d4d90430dfa126847a796c3e4ecfc +References: bsc#1184259 + +nvme_fc_terminate_exchange() is being called when exchanges are +being deleted, and as such we should be setting the NVME_REQ_CANCELLED +flag to have identical behaviour on all transports. + +Signed-off-by: Hannes Reinecke +Reviewed-by: Keith Busch +Reviewed-by: Sagi Grimberg +Reviewed-by: James Smart +Reviewed-by: Daniel Wagner +Signed-off-by: Christoph Hellwig +--- + drivers/nvme/host/fc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -2440,6 +2440,7 @@ nvme_fc_terminate_exchange(struct reques + struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl); + struct nvme_fc_fcp_op *op = blk_mq_rq_to_pdu(req); + ++ op->nreq.flags |= NVME_REQ_CANCELLED; + __nvme_fc_abort_op(ctrl, op); + return true; + } diff --git a/patches.suse/nvme-fc-short-circuit-reconnect-retries.patch b/patches.suse/nvme-fc-short-circuit-reconnect-retries.patch new file mode 100644 index 0000000..403db06 --- /dev/null +++ b/patches.suse/nvme-fc-short-circuit-reconnect-retries.patch @@ -0,0 +1,86 @@ +From: Hannes Reinecke +Date: Fri, 21 May 2021 10:23:00 +0200 +Subject: nvme-fc: short-circuit reconnect retries +Patch-mainline: v5.13-rc4 +Git-commit: f25f8ef70ce2e85bae1a266dd5de714aefda81d2 +References: bsc#1179827 + +Returning an nvme status from nvme_fc_create_association() indicates +that the association is established, and we should honour the DNR bit. +If it's set a reconnect attempt will just return the same error, so +we can short-circuit the reconnect attempts and fail the connection +directly. + +Signed-off-by: Hannes Reinecke +Reviewed-by: Sagi Grimberg +Reviewed-by: Himanshu Madhani +Reviewed-by: James Smart +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/fc.c | 25 +++++++++++++++++-------- + 1 file changed, 17 insertions(+), 8 deletions(-) + +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index 256e87721a01..f183f9fa03d0 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -3107,6 +3107,7 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl) + if (ctrl->ctrl.icdoff) { + dev_err(ctrl->ctrl.device, "icdoff %d is not supported!\n", + ctrl->ctrl.icdoff); ++ ret = NVME_SC_INVALID_FIELD | NVME_SC_DNR; + goto out_disconnect_admin_queue; + } + +@@ -3114,6 +3115,7 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl) + if (!(ctrl->ctrl.sgls & ((1 << 0) | (1 << 1)))) { + dev_err(ctrl->ctrl.device, + "Mandatory sgls are not supported!\n"); ++ ret = NVME_SC_INVALID_FIELD | NVME_SC_DNR; + goto out_disconnect_admin_queue; + } + +@@ -3280,11 +3282,13 @@ nvme_fc_reconnect_or_delete(struct nvme_fc_ctrl *ctrl, int status) + if (ctrl->ctrl.state != NVME_CTRL_CONNECTING) + return; + +- if (portptr->port_state == FC_OBJSTATE_ONLINE) ++ if (portptr->port_state == FC_OBJSTATE_ONLINE) { + dev_info(ctrl->ctrl.device, + "NVME-FC{%d}: reset: Reconnect attempt failed (%d)\n", + ctrl->cnum, status); +- else if (time_after_eq(jiffies, rport->dev_loss_end)) ++ if (status > 0 && (status & NVME_SC_DNR)) ++ recon = false; ++ } else if (time_after_eq(jiffies, rport->dev_loss_end)) + recon = false; + + if (recon && nvmf_should_reconnect(&ctrl->ctrl)) { +@@ -3298,12 +3302,17 @@ nvme_fc_reconnect_or_delete(struct nvme_fc_ctrl *ctrl, int status) + + queue_delayed_work(nvme_wq, &ctrl->connect_work, recon_delay); + } else { +- if (portptr->port_state == FC_OBJSTATE_ONLINE) +- dev_warn(ctrl->ctrl.device, +- "NVME-FC{%d}: Max reconnect attempts (%d) " +- "reached.\n", +- ctrl->cnum, ctrl->ctrl.nr_reconnects); +- else ++ if (portptr->port_state == FC_OBJSTATE_ONLINE) { ++ if (status > 0 && (status & NVME_SC_DNR)) ++ dev_warn(ctrl->ctrl.device, ++ "NVME-FC{%d}: reconnect failure\n", ++ ctrl->cnum); ++ else ++ dev_warn(ctrl->ctrl.device, ++ "NVME-FC{%d}: Max reconnect attempts " ++ "(%d) reached.\n", ++ ctrl->cnum, ctrl->ctrl.nr_reconnects); ++ } else + dev_warn(ctrl->ctrl.device, + "NVME-FC{%d}: dev_loss_tmo (%d) expired " + "while waiting for remoteport connectivity.\n", +-- +2.29.2 + diff --git a/patches.suse/nvme-fix-deadlock-in-disconnect-during-scan_work-and.patch b/patches.suse/nvme-fix-deadlock-in-disconnect-during-scan_work-and.patch new file mode 100644 index 0000000..83d0b62 --- /dev/null +++ b/patches.suse/nvme-fix-deadlock-in-disconnect-during-scan_work-and.patch @@ -0,0 +1,353 @@ +From: Sagi Grimberg +Date: Wed, 22 Jul 2020 16:32:19 -0700 +Subject: [PATCH] nvme: fix deadlock in disconnect during scan_work and/or + ana_work +Git-commit: ecca390e80561debbfdb4dc96bf94595136889fa +Patch-mainline: v5.9-rc1 +References: git-fixes + +A deadlock happens in the following scenario with multipath: +1) scan_work(nvme0) detects a new nsid while nvme0 + is an optimized path to it, path nvme1 happens to be + inaccessible. + +2) Before scan_work is complete nvme0 disconnect is initiated + nvme_delete_ctrl_sync() sets nvme0 state to NVME_CTRL_DELETING + +3) scan_work(1) attempts to submit IO, + but nvme_path_is_optimized() observes nvme0 is not LIVE. + Since nvme1 is a possible path IO is requeued and scan_work hangs. + +-- +Workqueue: nvme-wq nvme_scan_work [nvme_core] +kernel: Call Trace: +kernel: __schedule+0x2b9/0x6c0 +kernel: schedule+0x42/0xb0 +kernel: io_schedule+0x16/0x40 +kernel: do_read_cache_page+0x438/0x830 +kernel: read_cache_page+0x12/0x20 +kernel: read_dev_sector+0x27/0xc0 +kernel: read_lba+0xc1/0x220 +kernel: efi_partition+0x1e6/0x708 +kernel: check_partition+0x154/0x244 +kernel: rescan_partitions+0xae/0x280 +kernel: __blkdev_get+0x40f/0x560 +kernel: blkdev_get+0x3d/0x140 +kernel: __device_add_disk+0x388/0x480 +kernel: device_add_disk+0x13/0x20 +kernel: nvme_mpath_set_live+0x119/0x140 [nvme_core] +kernel: nvme_update_ns_ana_state+0x5c/0x60 [nvme_core] +kernel: nvme_set_ns_ana_state+0x1e/0x30 [nvme_core] +kernel: nvme_parse_ana_log+0xa1/0x180 [nvme_core] +kernel: nvme_mpath_add_disk+0x47/0x90 [nvme_core] +kernel: nvme_validate_ns+0x396/0x940 [nvme_core] +kernel: nvme_scan_work+0x24f/0x380 [nvme_core] +kernel: process_one_work+0x1db/0x380 +kernel: worker_thread+0x249/0x400 +kernel: kthread+0x104/0x140 +-- + +4) Delete also hangs in flush_work(ctrl->scan_work) + from nvme_remove_namespaces(). + +Similiarly a deadlock with ana_work may happen: if ana_work has started +and calls nvme_mpath_set_live and device_add_disk, it will +trigger I/O. When we trigger disconnect I/O will block because +our accessible (optimized) path is disconnecting, but the alternate +path is inaccessible, so I/O blocks. Then disconnect tries to flush +the ana_work and hangs. + +[ 605.550896] Workqueue: nvme-wq nvme_ana_work [nvme_core] +[ 605.552087] Call Trace: +[ 605.552683] __schedule+0x2b9/0x6c0 +[ 605.553507] schedule+0x42/0xb0 +[ 605.554201] io_schedule+0x16/0x40 +[ 605.555012] do_read_cache_page+0x438/0x830 +[ 605.556925] read_cache_page+0x12/0x20 +[ 605.557757] read_dev_sector+0x27/0xc0 +[ 605.558587] amiga_partition+0x4d/0x4c5 +[ 605.561278] check_partition+0x154/0x244 +[ 605.562138] rescan_partitions+0xae/0x280 +[ 605.563076] __blkdev_get+0x40f/0x560 +[ 605.563830] blkdev_get+0x3d/0x140 +[ 605.564500] __device_add_disk+0x388/0x480 +[ 605.565316] device_add_disk+0x13/0x20 +[ 605.566070] nvme_mpath_set_live+0x5e/0x130 [nvme_core] +[ 605.567114] nvme_update_ns_ana_state+0x2c/0x30 [nvme_core] +[ 605.568197] nvme_update_ana_state+0xca/0xe0 [nvme_core] +[ 605.569360] nvme_parse_ana_log+0xa1/0x180 [nvme_core] +[ 605.571385] nvme_read_ana_log+0x76/0x100 [nvme_core] +[ 605.572376] nvme_ana_work+0x15/0x20 [nvme_core] +[ 605.573330] process_one_work+0x1db/0x380 +[ 605.574144] worker_thread+0x4d/0x400 +[ 605.574896] kthread+0x104/0x140 +[ 605.577205] ret_from_fork+0x35/0x40 +[ 605.577955] INFO: task nvme:14044 blocked for more than 120 seconds. +[ 605.579239] Tainted: G OE 5.3.5-050305-generic #201910071830 +[ 605.580712] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 605.582320] nvme D 0 14044 14043 0x00000000 +[ 605.583424] Call Trace: +[ 605.583935] __schedule+0x2b9/0x6c0 +[ 605.584625] schedule+0x42/0xb0 +[ 605.585290] schedule_timeout+0x203/0x2f0 +[ 605.588493] wait_for_completion+0xb1/0x120 +[ 605.590066] __flush_work+0x123/0x1d0 +[ 605.591758] __cancel_work_timer+0x10e/0x190 +[ 605.593542] cancel_work_sync+0x10/0x20 +[ 605.594347] nvme_mpath_stop+0x2f/0x40 [nvme_core] +[ 605.595328] nvme_stop_ctrl+0x12/0x50 [nvme_core] +[ 605.596262] nvme_do_delete_ctrl+0x3f/0x90 [nvme_core] +[ 605.597333] nvme_sysfs_delete+0x5c/0x70 [nvme_core] +[ 605.598320] dev_attr_store+0x17/0x30 + +Fix this by introducing a new state: NVME_CTRL_DELETE_NOIO, which will +indicate the phase of controller deletion where I/O cannot be allowed +to access the namespace. NVME_CTRL_DELETING still allows mpath I/O to +be issued to the bottom device, and only after we flush the ana_work +and scan_work (after nvme_stop_ctrl and nvme_prep_remove_namespaces) +we change the state to NVME_CTRL_DELETING_NOIO. Also we prevent ana_work +from re-firing by aborting early if we are not LIVE, so we should be safe +here. + +In addition, change the transport drivers to follow the updated state +machine. + +Fixes: 0d0b660f214d ("nvme: add ANA support") +Reported-by: Anton Eidelman +Signed-off-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/core.c | 15 +++++++++++++++ + drivers/nvme/host/fabrics.c | 2 +- + drivers/nvme/host/fabrics.h | 3 ++- + drivers/nvme/host/fc.c | 1 + + drivers/nvme/host/multipath.c | 18 +++++++++++++++--- + drivers/nvme/host/nvme.h | 6 ++++++ + drivers/nvme/host/rdma.c | 10 ++++++---- + drivers/nvme/host/tcp.c | 15 +++++++++------ + 8 files changed, 55 insertions(+), 15 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 1d7c7afb1348..c16bfdff2953 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -366,6 +366,16 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl, + break; + } + break; ++ case NVME_CTRL_DELETING_NOIO: ++ switch (old_state) { ++ case NVME_CTRL_DELETING: ++ case NVME_CTRL_DEAD: ++ changed = true; ++ /* FALLTHRU */ ++ default: ++ break; ++ } ++ break; + case NVME_CTRL_DEAD: + switch (old_state) { + case NVME_CTRL_DELETING: +@@ -403,6 +413,7 @@ static bool nvme_state_terminal(struct nvme_ctrl *ctrl) + case NVME_CTRL_CONNECTING: + return false; + case NVME_CTRL_DELETING: ++ case NVME_CTRL_DELETING_NOIO: + case NVME_CTRL_DEAD: + return true; + default: +@@ -3476,6 +3487,7 @@ static ssize_t nvme_sysfs_show_state(struct device *dev, + [NVME_CTRL_RESETTING] = "resetting", + [NVME_CTRL_CONNECTING] = "connecting", + [NVME_CTRL_DELETING] = "deleting", ++ [NVME_CTRL_DELETING_NOIO]= "deleting (no IO)", + [NVME_CTRL_DEAD] = "dead", + }; + +@@ -4112,6 +4124,9 @@ void nvme_remove_namespaces(struct nvme_ctrl *ctrl) + if (ctrl->state == NVME_CTRL_DEAD) + nvme_kill_queues(ctrl); + ++ /* this is a no-op when called from the controller reset handler */ ++ nvme_change_ctrl_state(ctrl, NVME_CTRL_DELETING_NOIO); ++ + down_write(&ctrl->namespaces_rwsem); + list_splice_init(&ctrl->namespaces, &ns_list); + up_write(&ctrl->namespaces_rwsem); +diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c +index 2a6c8190eeb7..4ec4829d6233 100644 +--- a/drivers/nvme/host/fabrics.c ++++ b/drivers/nvme/host/fabrics.c +@@ -547,7 +547,7 @@ static struct nvmf_transport_ops *nvmf_lookup_transport( + blk_status_t nvmf_fail_nonready_command(struct nvme_ctrl *ctrl, + struct request *rq) + { +- if (ctrl->state != NVME_CTRL_DELETING && ++ if (ctrl->state != NVME_CTRL_DELETING_NOIO && + ctrl->state != NVME_CTRL_DEAD && + !blk_noretry_request(rq) && !(rq->cmd_flags & REQ_NVME_MPATH)) + return BLK_STS_RESOURCE; +diff --git a/drivers/nvme/host/fabrics.h b/drivers/nvme/host/fabrics.h +index a0ec40ab62ee..a9c1e3b4585e 100644 +--- a/drivers/nvme/host/fabrics.h ++++ b/drivers/nvme/host/fabrics.h +@@ -182,7 +182,8 @@ bool nvmf_ip_options_match(struct nvme_ctrl *ctrl, + static inline bool nvmf_check_ready(struct nvme_ctrl *ctrl, struct request *rq, + bool queue_live) + { +- if (likely(ctrl->state == NVME_CTRL_LIVE)) ++ if (likely(ctrl->state == NVME_CTRL_LIVE || ++ ctrl->state == NVME_CTRL_DELETING)) + return true; + return __nvmf_check_ready(ctrl, rq, queue_live); + } +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index 6aa30bb5a762..b27c54dc6683 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -826,6 +826,7 @@ nvme_fc_ctrl_connectivity_loss(struct nvme_fc_ctrl *ctrl) + break; + + case NVME_CTRL_DELETING: ++ case NVME_CTRL_DELETING_NOIO: + default: + /* no action to take - let it delete */ + break; +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index 74bad4e3d377..900b35d47ec7 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -167,9 +167,18 @@ void nvme_mpath_clear_ctrl_paths(struct nvme_ctrl *ctrl) + + static bool nvme_path_is_disabled(struct nvme_ns *ns) + { +- return ns->ctrl->state != NVME_CTRL_LIVE || +- test_bit(NVME_NS_ANA_PENDING, &ns->flags) || +- test_bit(NVME_NS_REMOVING, &ns->flags); ++ /* ++ * We don't treat NVME_CTRL_DELETING as a disabled path as I/O should ++ * still be able to complete assuming that the controller is connected. ++ * Otherwise it will fail immediately and return to the requeue list. ++ */ ++ if (ns->ctrl->state != NVME_CTRL_LIVE && ++ ns->ctrl->state != NVME_CTRL_DELETING) ++ return true; ++ if (test_bit(NVME_NS_ANA_PENDING, &ns->flags) || ++ test_bit(NVME_NS_REMOVING, &ns->flags)) ++ return true; ++ return false; + } + + static struct nvme_ns *__nvme_find_path(struct nvme_ns_head *head, int node) +@@ -563,6 +572,9 @@ static void nvme_ana_work(struct work_struct *work) + { + struct nvme_ctrl *ctrl = container_of(work, struct nvme_ctrl, ana_work); + ++ if (ctrl->state != NVME_CTRL_LIVE) ++ return; ++ + nvme_read_ana_log(ctrl); + } + +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index 92629758b77c..1609267a1f0e 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -190,6 +190,11 @@ static inline u16 nvme_req_qid(struct request *req) + * @NVME_CTRL_CONNECTING: Controller is disconnected, now connecting the + * transport + * @NVME_CTRL_DELETING: Controller is deleting (or scheduled deletion) ++ * @NVME_CTRL_DELETING_NOIO: Controller is deleting and I/O is not ++ * disabled/failed immediately. This state comes ++ * after all async event processing took place and ++ * before ns removal and the controller deletion ++ * progress + * @NVME_CTRL_DEAD: Controller is non-present/unresponsive during + * shutdown or removal. In this case we forcibly + * kill all inflight I/O as they have no chance to +@@ -201,6 +206,7 @@ enum nvme_ctrl_state { + NVME_CTRL_RESETTING, + NVME_CTRL_CONNECTING, + NVME_CTRL_DELETING, ++ NVME_CTRL_DELETING_NOIO, + NVME_CTRL_DEAD, + }; + +diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c +index 467da08db309..5c3848974ccb 100644 +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -1102,11 +1102,12 @@ static int nvme_rdma_setup_ctrl(struct nvme_rdma_ctrl *ctrl, bool new) + changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE); + if (!changed) { + /* +- * state change failure is ok if we're in DELETING state, ++ * state change failure is ok if we started ctrl delete, + * unless we're during creation of a new controller to + * avoid races with teardown flow. + */ +- WARN_ON_ONCE(ctrl->ctrl.state != NVME_CTRL_DELETING); ++ WARN_ON_ONCE(ctrl->ctrl.state != NVME_CTRL_DELETING && ++ ctrl->ctrl.state != NVME_CTRL_DELETING_NOIO); + WARN_ON_ONCE(new); + ret = -EINVAL; + goto destroy_io; +@@ -1159,8 +1160,9 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work) + blk_mq_unquiesce_queue(ctrl->ctrl.admin_q); + + if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) { +- /* state change failure is ok if we're in DELETING state */ +- WARN_ON_ONCE(ctrl->ctrl.state != NVME_CTRL_DELETING); ++ /* state change failure is ok if we started ctrl delete */ ++ WARN_ON_ONCE(ctrl->ctrl.state != NVME_CTRL_DELETING && ++ ctrl->ctrl.state != NVME_CTRL_DELETING_NOIO); + return; + } + +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index b2e73e19ef01..8c8fb65ca928 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -1950,11 +1950,12 @@ static int nvme_tcp_setup_ctrl(struct nvme_ctrl *ctrl, bool new) + + if (!nvme_change_ctrl_state(ctrl, NVME_CTRL_LIVE)) { + /* +- * state change failure is ok if we're in DELETING state, ++ * state change failure is ok if we started ctrl delete, + * unless we're during creation of a new controller to + * avoid races with teardown flow. + */ +- WARN_ON_ONCE(ctrl->state != NVME_CTRL_DELETING); ++ WARN_ON_ONCE(ctrl->state != NVME_CTRL_DELETING && ++ ctrl->state != NVME_CTRL_DELETING_NOIO); + WARN_ON_ONCE(new); + ret = -EINVAL; + goto destroy_io; +@@ -2010,8 +2011,9 @@ static void nvme_tcp_error_recovery_work(struct work_struct *work) + blk_mq_unquiesce_queue(ctrl->admin_q); + + if (!nvme_change_ctrl_state(ctrl, NVME_CTRL_CONNECTING)) { +- /* state change failure is ok if we're in DELETING state */ +- WARN_ON_ONCE(ctrl->state != NVME_CTRL_DELETING); ++ /* state change failure is ok if we started ctrl delete */ ++ WARN_ON_ONCE(ctrl->state != NVME_CTRL_DELETING && ++ ctrl->state != NVME_CTRL_DELETING_NOIO); + return; + } + +@@ -2046,8 +2048,9 @@ static void nvme_reset_ctrl_work(struct work_struct *work) + nvme_tcp_teardown_ctrl(ctrl, false); + + if (!nvme_change_ctrl_state(ctrl, NVME_CTRL_CONNECTING)) { +- /* state change failure is ok if we're in DELETING state */ +- WARN_ON_ONCE(ctrl->state != NVME_CTRL_DELETING); ++ /* state change failure is ok if we started ctrl delete */ ++ WARN_ON_ONCE(ctrl->state != NVME_CTRL_DELETING && ++ ctrl->state != NVME_CTRL_DELETING_NOIO); + return; + } + +-- +2.29.2 + diff --git a/patches.suse/nvme-pci-Remove-tag-from-process-cq.patch b/patches.suse/nvme-pci-Remove-tag-from-process-cq.patch new file mode 100644 index 0000000..ec17a82 --- /dev/null +++ b/patches.suse/nvme-pci-Remove-tag-from-process-cq.patch @@ -0,0 +1,115 @@ +From: Keith Busch +Date: Mon, 2 Mar 2020 08:45:04 -0800 +Subject: [PATCH] nvme-pci: Remove tag from process cq +Git-commit: bf392a5dc02a9b796f3da89fc5bb42856aca64cb +Patch-mainline: v5.7-rc1 +References: git-fixes + +The only user for tagged completion was for timeout handling. That user, +though, really only cares if the timed out command is completed, which +we can safely check within the timeout handler. + +Remove the tag check to simplify completion handling. + +Reviewed-by: Sagi Grimberg +Reviewed-by: Christoph Hellwig +Signed-off-by: Keith Busch +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/pci.c | 23 +++++++++++------------ + 1 file changed, 11 insertions(+), 12 deletions(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index cdc9b6149d38..98d8ddd7aa0f 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -989,14 +989,13 @@ static inline void nvme_update_cq_head(struct nvme_queue *nvmeq) + } + + static inline int nvme_process_cq(struct nvme_queue *nvmeq, u16 *start, +- u16 *end, unsigned int tag) ++ u16 *end) + { + int found = 0; + + *start = nvmeq->cq_head; + while (nvme_cqe_pending(nvmeq)) { +- if (tag == -1U || nvmeq->cqes[nvmeq->cq_head].command_id == tag) +- found++; ++ found++; + nvme_update_cq_head(nvmeq); + } + *end = nvmeq->cq_head; +@@ -1017,7 +1016,7 @@ static irqreturn_t nvme_irq(int irq, void *data) + * the irq handler, even if that was on another CPU. + */ + rmb(); +- nvme_process_cq(nvmeq, &start, &end, -1); ++ nvme_process_cq(nvmeq, &start, &end); + wmb(); + + if (start != end) { +@@ -1040,7 +1039,7 @@ static irqreturn_t nvme_irq_check(int irq, void *data) + * Poll for completions any queue, including those not dedicated to polling. + * Can be called from any context. + */ +-static int nvme_poll_irqdisable(struct nvme_queue *nvmeq, unsigned int tag) ++static int nvme_poll_irqdisable(struct nvme_queue *nvmeq) + { + struct pci_dev *pdev = to_pci_dev(nvmeq->dev->dev); + u16 start, end; +@@ -1053,11 +1052,11 @@ static int nvme_poll_irqdisable(struct nvme_queue *nvmeq, unsigned int tag) + */ + if (test_bit(NVMEQ_POLLED, &nvmeq->flags)) { + spin_lock(&nvmeq->cq_poll_lock); +- found = nvme_process_cq(nvmeq, &start, &end, tag); ++ found = nvme_process_cq(nvmeq, &start, &end); + spin_unlock(&nvmeq->cq_poll_lock); + } else { + disable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)); +- found = nvme_process_cq(nvmeq, &start, &end, tag); ++ found = nvme_process_cq(nvmeq, &start, &end); + enable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)); + } + +@@ -1075,8 +1074,7 @@ static int nvme_poll(struct blk_mq_hw_ctx *hctx) + return 0; + + spin_lock(&nvmeq->cq_poll_lock); +- found = nvme_process_cq(nvmeq, &start, &end, -1); +- nvme_complete_cqes(nvmeq, start, end); ++ found = nvme_process_cq(nvmeq, &start, &end); + spin_unlock(&nvmeq->cq_poll_lock); + + return found; +@@ -1253,7 +1251,8 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req, bool reserved) + /* + * Did we miss an interrupt? + */ +- if (nvme_poll_irqdisable(nvmeq, req->tag)) { ++ nvme_poll_irqdisable(nvmeq); ++ if (blk_mq_request_completed(req)) { + dev_warn(dev->ctrl.device, + "I/O %d QID %d timeout, completion polled\n", + req->tag, nvmeq->qid); +@@ -1396,7 +1395,7 @@ static void nvme_disable_admin_queue(struct nvme_dev *dev, bool shutdown) + else + nvme_disable_ctrl(&dev->ctrl); + +- nvme_poll_irqdisable(nvmeq, -1); ++ nvme_poll_irqdisable(nvmeq); + } + + /* +@@ -1411,7 +1410,7 @@ static void nvme_reap_pending_cqes(struct nvme_dev *dev) + int i; + + for (i = dev->ctrl.queue_count - 1; i > 0; i--) { +- nvme_process_cq(&dev->queues[i], &start, &end, -1); ++ nvme_process_cq(&dev->queues[i], &start, &end); + nvme_complete_cqes(&dev->queues[i], start, end); + } + } +-- +2.29.2 + diff --git a/patches.suse/nvme-pci-Remove-two-pass-completions.patch b/patches.suse/nvme-pci-Remove-two-pass-completions.patch new file mode 100644 index 0000000..8775b22 --- /dev/null +++ b/patches.suse/nvme-pci-Remove-two-pass-completions.patch @@ -0,0 +1,152 @@ +From: Keith Busch +Date: Mon, 2 Mar 2020 08:56:53 -0800 +Subject: [PATCH] nvme-pci: Remove two-pass completions +Git-commit: 324b494c286298d51bc5ed5107644ebe23f9dad6 +Patch-mainline: v5.7-rc1 +References: git-fixes + +Completion handling had been done in two steps: find all new completions +under a lock, then handle those completions outside the lock. This was +done to make the locked section as short as possible so that other +threads using the same lock wait less time. + +The driver no longer shares locks during completion, and is in fact +lockless for interrupt driven queues, so the optimization no longer +serves its original purpose. Replace the two-pass completion queue +handler with a single pass that completes entries immediately. + +Reviewed-by: Sagi Grimberg +Reviewed-by: Christoph Hellwig +Signed-off-by: Keith Busch +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/pci.c | 42 ++++++++++------------------------------- + 1 file changed, 10 insertions(+), 32 deletions(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 98d8ddd7aa0f..02f22c63adcf 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -971,15 +971,6 @@ static inline void nvme_handle_cqe(struct nvme_queue *nvmeq, u16 idx) + nvme_end_request(req, cqe->status, cqe->result); + } + +-static void nvme_complete_cqes(struct nvme_queue *nvmeq, u16 start, u16 end) +-{ +- while (start != end) { +- nvme_handle_cqe(nvmeq, start); +- if (++start == nvmeq->q_depth) +- start = 0; +- } +-} +- + static inline void nvme_update_cq_head(struct nvme_queue *nvmeq) + { + if (++nvmeq->cq_head == nvmeq->q_depth) { +@@ -988,19 +979,17 @@ static inline void nvme_update_cq_head(struct nvme_queue *nvmeq) + } + } + +-static inline int nvme_process_cq(struct nvme_queue *nvmeq, u16 *start, +- u16 *end) ++static inline int nvme_process_cq(struct nvme_queue *nvmeq) + { + int found = 0; + +- *start = nvmeq->cq_head; + while (nvme_cqe_pending(nvmeq)) { + found++; ++ nvme_handle_cqe(nvmeq, nvmeq->cq_head); + nvme_update_cq_head(nvmeq); + } +- *end = nvmeq->cq_head; + +- if (*start != *end) ++ if (found) + nvme_ring_cq_doorbell(nvmeq); + return found; + } +@@ -1009,21 +998,16 @@ static irqreturn_t nvme_irq(int irq, void *data) + { + struct nvme_queue *nvmeq = data; + irqreturn_t ret = IRQ_NONE; +- u16 start, end; + + /* + * The rmb/wmb pair ensures we see all updates from a previous run of + * the irq handler, even if that was on another CPU. + */ + rmb(); +- nvme_process_cq(nvmeq, &start, &end); ++ if (nvme_process_cq(nvmeq)) ++ ret = IRQ_HANDLED; + wmb(); + +- if (start != end) { +- nvme_complete_cqes(nvmeq, start, end); +- return IRQ_HANDLED; +- } +- + return ret; + } + +@@ -1042,7 +1026,6 @@ static irqreturn_t nvme_irq_check(int irq, void *data) + static int nvme_poll_irqdisable(struct nvme_queue *nvmeq) + { + struct pci_dev *pdev = to_pci_dev(nvmeq->dev->dev); +- u16 start, end; + int found; + + /* +@@ -1052,29 +1035,27 @@ static int nvme_poll_irqdisable(struct nvme_queue *nvmeq) + */ + if (test_bit(NVMEQ_POLLED, &nvmeq->flags)) { + spin_lock(&nvmeq->cq_poll_lock); +- found = nvme_process_cq(nvmeq, &start, &end); ++ found = nvme_process_cq(nvmeq); + spin_unlock(&nvmeq->cq_poll_lock); + } else { + disable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)); +- found = nvme_process_cq(nvmeq, &start, &end); ++ found = nvme_process_cq(nvmeq); + enable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)); + } + +- nvme_complete_cqes(nvmeq, start, end); + return found; + } + + static int nvme_poll(struct blk_mq_hw_ctx *hctx) + { + struct nvme_queue *nvmeq = hctx->driver_data; +- u16 start, end; + bool found; + + if (!nvme_cqe_pending(nvmeq)) + return 0; + + spin_lock(&nvmeq->cq_poll_lock); +- found = nvme_process_cq(nvmeq, &start, &end); ++ found = nvme_process_cq(nvmeq); + spin_unlock(&nvmeq->cq_poll_lock); + + return found; +@@ -1406,13 +1387,10 @@ static void nvme_disable_admin_queue(struct nvme_dev *dev, bool shutdown) + */ + static void nvme_reap_pending_cqes(struct nvme_dev *dev) + { +- u16 start, end; + int i; + +- for (i = dev->ctrl.queue_count - 1; i > 0; i--) { +- nvme_process_cq(&dev->queues[i], &start, &end); +- nvme_complete_cqes(&dev->queues[i], start, end); +- } ++ for (i = dev->ctrl.queue_count - 1; i > 0; i--) ++ nvme_process_cq(&dev->queues[i]); + } + + static int nvme_cmb_qdepth(struct nvme_dev *dev, int nr_io_queues, +-- +2.29.2 + diff --git a/patches.suse/nvme-pci-Simplify-nvme_poll_irqdisable.patch b/patches.suse/nvme-pci-Simplify-nvme_poll_irqdisable.patch new file mode 100644 index 0000000..db4fb92 --- /dev/null +++ b/patches.suse/nvme-pci-Simplify-nvme_poll_irqdisable.patch @@ -0,0 +1,74 @@ +From: Keith Busch +Date: Wed, 4 Mar 2020 09:17:01 -0800 +Subject: [PATCH] nvme-pci: Simplify nvme_poll_irqdisable +Git-commit: fa059b856a593a7bddd4d3779ae8ab1380e05d91 +Patch-mainline: v5.7-rc1 +References: git-fixes + +The timeout handler can use the existing nvme_poll() if it needs to +check a polled queue, allowing nvme_poll_irqdisable() to handle only +irq driven queues for the remaining callers. + +Signed-off-by: Keith Busch +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/pci.c | 30 +++++++++++------------------- + 1 file changed, 11 insertions(+), 19 deletions(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 02f22c63adcf..f45e26e6af7e 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -1020,30 +1020,18 @@ static irqreturn_t nvme_irq_check(int irq, void *data) + } + + /* +- * Poll for completions any queue, including those not dedicated to polling. ++ * Poll for completions for any interrupt driven queue + * Can be called from any context. + */ +-static int nvme_poll_irqdisable(struct nvme_queue *nvmeq) ++static void nvme_poll_irqdisable(struct nvme_queue *nvmeq) + { + struct pci_dev *pdev = to_pci_dev(nvmeq->dev->dev); +- int found; + +- /* +- * For a poll queue we need to protect against the polling thread +- * using the CQ lock. For normal interrupt driven threads we have +- * to disable the interrupt to avoid racing with it. +- */ +- if (test_bit(NVMEQ_POLLED, &nvmeq->flags)) { +- spin_lock(&nvmeq->cq_poll_lock); +- found = nvme_process_cq(nvmeq); +- spin_unlock(&nvmeq->cq_poll_lock); +- } else { +- disable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)); +- found = nvme_process_cq(nvmeq); +- enable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)); +- } ++ WARN_ON_ONCE(test_bit(NVMEQ_POLLED, &nvmeq->flags)); + +- return found; ++ disable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)); ++ nvme_process_cq(nvmeq); ++ enable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)); + } + + static int nvme_poll(struct blk_mq_hw_ctx *hctx) +@@ -1232,7 +1220,11 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req, bool reserved) + /* + * Did we miss an interrupt? + */ +- nvme_poll_irqdisable(nvmeq); ++ if (test_bit(NVMEQ_POLLED, &nvmeq->flags)) ++ nvme_poll(req->mq_hctx); ++ else ++ nvme_poll_irqdisable(nvmeq); ++ + if (blk_mq_request_completed(req)) { + dev_warn(dev->ctrl.device, + "I/O %d QID %d timeout, completion polled\n", +-- +2.29.2 + diff --git a/patches.suse/nvme-pci-align-io-queue-count-with-allocted-nvme_que.patch b/patches.suse/nvme-pci-align-io-queue-count-with-allocted-nvme_que.patch new file mode 100644 index 0000000..9e9e22a --- /dev/null +++ b/patches.suse/nvme-pci-align-io-queue-count-with-allocted-nvme_que.patch @@ -0,0 +1,178 @@ +From: Weiping Zhang +Date: Sat, 2 May 2020 15:29:41 +0800 +Subject: [PATCH] nvme-pci: align io queue count with allocted nvme_queue in +Git-commit: 2a5bcfdd41d68559567cec3c124a75e093506cc1 +Patch-mainline: v5.8-rc1 +References: git-fixes + nvme_probe + +Since commit 147b27e4bd08 ("nvme-pci: allocate device queues storage +space at probe"), nvme_alloc_queue does not alloc the nvme queues +itself anymore. + +If the write/poll_queues module parameters are changed at runtime to +values larger than the number of allocated queues in nvme_probe, +nvme_alloc_queue will access unallocated memory. + +Add a new nr_allocated_queues member to struct nvme_dev to record how +many queues were alloctated in nvme_probe to avoid using more than the +allocated queues after a reset following a change to the +write/poll_queues module parameters. + +Also add nr_write_queues and nr_poll_queues members to allow refreshing +the number of write and poll queues based on a change to the module +parameters when resetting the controller. + +Fixes: 147b27e4bd08 ("nvme-pci: allocate device queues storage space at probe") +Signed-off-by: Weiping Zhang +Reviewed-by: Keith Busch +Reviewed-by: Max Gurtovoy +[hch: add nvme_max_io_queues, update the commit message] +Signed-off-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/pci.c | 57 ++++++++++++++++++++++++----------------- + 1 file changed, 33 insertions(+), 24 deletions(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index b945e9a89883..b0978ac554d5 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -128,6 +128,9 @@ struct nvme_dev { + dma_addr_t host_mem_descs_dma; + struct nvme_host_mem_buf_desc *host_mem_descs; + void **host_mem_desc_bufs; ++ unsigned int nr_allocated_queues; ++ unsigned int nr_write_queues; ++ unsigned int nr_poll_queues; + }; + + static int io_queue_depth_set(const char *val, const struct kernel_param *kp) +@@ -208,25 +211,14 @@ struct nvme_iod { + struct scatterlist *sg; + }; + +-static unsigned int max_io_queues(void) ++static inline unsigned int nvme_dbbuf_size(struct nvme_dev *dev) + { +- return num_possible_cpus() + write_queues + poll_queues; +-} +- +-static unsigned int max_queue_count(void) +-{ +- /* IO queues + admin queue */ +- return 1 + max_io_queues(); +-} +- +-static inline unsigned int nvme_dbbuf_size(u32 stride) +-{ +- return (max_queue_count() * 8 * stride); ++ return dev->nr_allocated_queues * 8 * dev->db_stride; + } + + static int nvme_dbbuf_dma_alloc(struct nvme_dev *dev) + { +- unsigned int mem_size = nvme_dbbuf_size(dev->db_stride); ++ unsigned int mem_size = nvme_dbbuf_size(dev); + + if (dev->dbbuf_dbs) + return 0; +@@ -251,7 +243,7 @@ static int nvme_dbbuf_dma_alloc(struct nvme_dev *dev) + + static void nvme_dbbuf_dma_free(struct nvme_dev *dev) + { +- unsigned int mem_size = nvme_dbbuf_size(dev->db_stride); ++ unsigned int mem_size = nvme_dbbuf_size(dev); + + if (dev->dbbuf_dbs) { + dma_free_coherent(dev->dev, mem_size, +@@ -1981,7 +1973,7 @@ static int nvme_setup_host_mem(struct nvme_dev *dev) + static void nvme_calc_irq_sets(struct irq_affinity *affd, unsigned int nrirqs) + { + struct nvme_dev *dev = affd->priv; +- unsigned int nr_read_queues; ++ unsigned int nr_read_queues, nr_write_queues = dev->nr_write_queues; + + /* + * If there is no interupt available for queues, ensure that +@@ -1997,12 +1989,12 @@ static void nvme_calc_irq_sets(struct irq_affinity *affd, unsigned int nrirqs) + if (!nrirqs) { + nrirqs = 1; + nr_read_queues = 0; +- } else if (nrirqs == 1 || !write_queues) { ++ } else if (nrirqs == 1 || !nr_write_queues) { + nr_read_queues = 0; +- } else if (write_queues >= nrirqs) { ++ } else if (nr_write_queues >= nrirqs) { + nr_read_queues = 1; + } else { +- nr_read_queues = nrirqs - write_queues; ++ nr_read_queues = nrirqs - nr_write_queues; + } + + dev->io_queues[HCTX_TYPE_DEFAULT] = nrirqs - nr_read_queues; +@@ -2026,7 +2018,7 @@ static int nvme_setup_irqs(struct nvme_dev *dev, unsigned int nr_io_queues) + * Poll queues don't need interrupts, but we need at least one IO + * queue left over for non-polled IO. + */ +- this_p_queues = poll_queues; ++ this_p_queues = dev->nr_poll_queues; + if (this_p_queues >= nr_io_queues) { + this_p_queues = nr_io_queues - 1; + irq_queues = 1; +@@ -2056,14 +2048,25 @@ static void nvme_disable_io_queues(struct nvme_dev *dev) + __nvme_disable_io_queues(dev, nvme_admin_delete_cq); + } + ++static unsigned int nvme_max_io_queues(struct nvme_dev *dev) ++{ ++ return num_possible_cpus() + dev->nr_write_queues + dev->nr_poll_queues; ++} ++ + static int nvme_setup_io_queues(struct nvme_dev *dev) + { + struct nvme_queue *adminq = &dev->queues[0]; + struct pci_dev *pdev = to_pci_dev(dev->dev); +- int result, nr_io_queues; ++ unsigned int nr_io_queues; + unsigned long size; ++ int result; + +- nr_io_queues = max_io_queues(); ++ /* ++ * Sample the module parameters once at reset time so that we have ++ * stable values to work with. ++ */ ++ dev->nr_write_queues = write_queues; ++ dev->nr_poll_queues = poll_queues; + + /* + * If tags are shared with admin queue (Apple bug), then +@@ -2071,6 +2074,9 @@ static int nvme_setup_io_queues(struct nvme_dev *dev) + */ + if (dev->ctrl.quirks & NVME_QUIRK_SHARED_TAGS) + nr_io_queues = 1; ++ else ++ nr_io_queues = min(nvme_max_io_queues(dev), ++ dev->nr_allocated_queues - 1); + + result = nvme_set_queue_count(&dev->ctrl, &nr_io_queues); + if (result < 0) +@@ -2745,8 +2751,11 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id) + if (!dev) + return -ENOMEM; + +- dev->queues = kcalloc_node(max_queue_count(), sizeof(struct nvme_queue), +- GFP_KERNEL, node); ++ dev->nr_write_queues = write_queues; ++ dev->nr_poll_queues = poll_queues; ++ dev->nr_allocated_queues = nvme_max_io_queues(dev) + 1; ++ dev->queues = kcalloc_node(dev->nr_allocated_queues, ++ sizeof(struct nvme_queue), GFP_KERNEL, node); + if (!dev->queues) + goto free; + +-- +2.29.2 + diff --git a/patches.suse/nvme-pci-avoid-race-between-nvme_reap_pending_cqes-a.patch b/patches.suse/nvme-pci-avoid-race-between-nvme_reap_pending_cqes-a.patch new file mode 100644 index 0000000..e1aa1e8 --- /dev/null +++ b/patches.suse/nvme-pci-avoid-race-between-nvme_reap_pending_cqes-a.patch @@ -0,0 +1,73 @@ +From: Dongli Zhang +Date: Wed, 27 May 2020 09:13:52 -0700 +Subject: [PATCH] nvme-pci: avoid race between nvme_reap_pending_cqes() and + nvme_poll() +Git-commit: 9210c075cef29c1f764b4252f93105103bdfb292 +Patch-mainline: v5.7 +References: git-fixes + +There may be a race between nvme_reap_pending_cqes() and nvme_poll(), e.g., +when doing live reset while polling the nvme device. + + CPU X CPU Y + nvme_poll() +nvme_dev_disable() +-> nvme_stop_queues() +-> nvme_suspend_io_queues() +-> nvme_suspend_queue() + -> spin_lock(&nvmeq->cq_poll_lock); +-> nvme_reap_pending_cqes() + -> nvme_process_cq() -> nvme_process_cq() + +In the above scenario, the nvme_process_cq() for the same queue may be +running on both CPU X and CPU Y concurrently. + +It is much more easier to reproduce the issue when CONFIG_PREEMPT is +enabled in kernel. When CONFIG_PREEMPT is disabled, it would take longer +time for nvme_stop_queues()-->blk_mq_quiesce_queue() to wait for grace +period. + +This patch protects nvme_process_cq() with nvmeq->cq_poll_lock in +nvme_reap_pending_cqes(). + +Fixes: fa46c6fb5d61 ("nvme/pci: move cqe check after device shutdown") +Signed-off-by: Dongli Zhang +Reviewed-by: Ming Lei +Reviewed-by: Keith Busch +Signed-off-by: Christoph Hellwig +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/pci.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 3726dc780d15..cc46e250fcac 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -1382,16 +1382,19 @@ static void nvme_disable_admin_queue(struct nvme_dev *dev, bool shutdown) + + /* + * Called only on a device that has been disabled and after all other threads +- * that can check this device's completion queues have synced. This is the +- * last chance for the driver to see a natural completion before +- * nvme_cancel_request() terminates all incomplete requests. ++ * that can check this device's completion queues have synced, except ++ * nvme_poll(). This is the last chance for the driver to see a natural ++ * completion before nvme_cancel_request() terminates all incomplete requests. + */ + static void nvme_reap_pending_cqes(struct nvme_dev *dev) + { + int i; + +- for (i = dev->ctrl.queue_count - 1; i > 0; i--) ++ for (i = dev->ctrl.queue_count - 1; i > 0; i--) { ++ spin_lock(&dev->queues[i].cq_poll_lock); + nvme_process_cq(&dev->queues[i]); ++ spin_unlock(&dev->queues[i].cq_poll_lock); ++ } + } + + static int nvme_cmb_qdepth(struct nvme_dev *dev, int nr_io_queues, +-- +2.29.2 + diff --git a/patches.suse/nvme-pci-dma-read-memory-barrier-for-completions.patch b/patches.suse/nvme-pci-dma-read-memory-barrier-for-completions.patch new file mode 100644 index 0000000..e390ae8 --- /dev/null +++ b/patches.suse/nvme-pci-dma-read-memory-barrier-for-completions.patch @@ -0,0 +1,50 @@ +From: Keith Busch +Date: Fri, 8 May 2020 13:04:06 -0700 +Subject: [PATCH] nvme-pci: dma read memory barrier for completions +Git-commit: b69e2ef24b7b4867f80f47e2781e95d0bacd15cb +Patch-mainline: v5.7-rc6 +References: git-fixes + +Control dependencies do not guarantee load order across the condition, +allowing a CPU to predict and speculate memory reads. + +Commit 324b494c2862 inlined verifying a new completion with its +handling. At least one architecture was observed to access the contents +out of order, resulting in the driver using stale data for the +completion. + +Add a dma read barrier before reading the completion queue entry and +after the condition its contents depend on to ensure the read order is +determinsitic. + +Reported-by: John Garry +Suggested-by: Will Deacon +Signed-off-by: Keith Busch +Tested-by: John Garry +Acked-by: Will Deacon +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/pci.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index e13c370de830..3726dc780d15 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -989,6 +989,11 @@ static inline int nvme_process_cq(struct nvme_queue *nvmeq) + + while (nvme_cqe_pending(nvmeq)) { + found++; ++ /* ++ * load-load control dependency between phase and the rest of ++ * the cqe requires a full read memory barrier ++ */ ++ dma_rmb(); + nvme_handle_cqe(nvmeq, nvmeq->cq_head); + nvme_update_cq_head(nvmeq); + } +-- +2.29.2 + diff --git a/patches.suse/nvme-pci-fix-slimmer-CQ-head-update.patch b/patches.suse/nvme-pci-fix-slimmer-CQ-head-update.patch new file mode 100644 index 0000000..bd6a395 --- /dev/null +++ b/patches.suse/nvme-pci-fix-slimmer-CQ-head-update.patch @@ -0,0 +1,57 @@ +From: Alexey Dobriyan +Date: Thu, 7 May 2020 23:07:04 +0300 +Subject: [PATCH] nvme-pci: fix "slimmer CQ head update" +Git-commit: a8de6639169b90e3dc4f27e752a3c5abac5e90da +Patch-mainline: v5.7-rc5 +References: git-fixes + +Pre-incrementing ->cq_head can't be done in memory because OOB value +can be observed by another context. + +This devalues space savings compared to original code :-\ + + $ ./scripts/bloat-o-meter ../vmlinux-000 ../obj/vmlinux + add/remove: 0/0 grow/shrink: 0/4 up/down: 0/-32 (-32) + Function old new delta + nvme_poll_irqdisable 464 456 -8 + nvme_poll 455 447 -8 + nvme_irq 388 380 -8 + nvme_dev_disable 955 947 -8 + +But the code is minimal now: one read for head, one read for q_depth, +one increment, one comparison, single instruction phase bit update and +one write for new head. + +Signed-off-by: Alexey Dobriyan +Reported-by: John Garry +Tested-by: John Garry +Fixes: e2a366a4b0feaeb ("nvme-pci: slimmer CQ head update") +Signed-off-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/pci.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 4e79e412b276..e13c370de830 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -973,9 +973,13 @@ static inline void nvme_handle_cqe(struct nvme_queue *nvmeq, u16 idx) + + static inline void nvme_update_cq_head(struct nvme_queue *nvmeq) + { +- if (++nvmeq->cq_head == nvmeq->q_depth) { ++ u16 tmp = nvmeq->cq_head + 1; ++ ++ if (tmp == nvmeq->q_depth) { + nvmeq->cq_head = 0; + nvmeq->cq_phase ^= 1; ++ } else { ++ nvmeq->cq_head = tmp; + } + } + +-- +2.29.2 + diff --git a/patches.suse/nvme-pci-make-sure-write-poll_queues-less-or-equal-t.patch b/patches.suse/nvme-pci-make-sure-write-poll_queues-less-or-equal-t.patch new file mode 100644 index 0000000..5af92ff --- /dev/null +++ b/patches.suse/nvme-pci-make-sure-write-poll_queues-less-or-equal-t.patch @@ -0,0 +1,111 @@ +From: Weiping Zhang +Date: Sat, 9 May 2020 14:22:08 +0800 +Subject: [PATCH] nvme-pci: make sure write/poll_queues less or equal then cpu +Git-commit: 9c9e76d5792b121f10c3b8ddbb639617e49197f7 +Patch-mainline: v5.8-rc1 +References: git-fixes + count + +Check module parameter write/poll_queues before using it to catch +too large values. + +Reproducer: + +modprobe -r nvme +modprobe nvme write_queues=`nproc` +echo $((`nproc`+1)) > /sys/module/nvme/parameters/write_queues +echo 1 > /sys/block/nvme0n1/device/reset_controller + +[ 657.069000] ------------[ cut here ]------------ +[ 657.069022] WARNING: CPU: 10 PID: 1163 at kernel/irq/affinity.c:390 irq_create_affinity_masks+0x47c/0x4a0 +[ 657.069056] dm_region_hash dm_log dm_mod +[ 657.069059] CPU: 10 PID: 1163 Comm: kworker/u193:9 Kdump: loaded Tainted: G W 5.6.0+ #8 +[ 657.069060] Hardware name: Inspur SA5212M5/YZMB-00882-104, BIOS 4.0.9 08/27/2019 +[ 657.069064] Workqueue: nvme-reset-wq nvme_reset_work [nvme] +[ 657.069066] RIP: 0010:irq_create_affinity_masks+0x47c/0x4a0 +[ 657.069067] Code: fe ff ff 48 c7 c0 b0 89 14 95 48 89 46 20 e9 e9 fb ff ff 31 c0 e9 90 fc ff ff 0f 0b 48 c7 44 24 08 00 00 00 00 e9 e9 fc ff ff <0f> 0b e9 87 fe ff ff 48 8b 7c 24 28 e8 33 a0 80 00 e9 b6 fc ff ff +[ 657.069068] RSP: 0018:ffffb505ce1ffc78 EFLAGS: 00010202 +[ 657.069069] RAX: 0000000000000060 RBX: ffff9b97921fe5c0 RCX: 0000000000000000 +[ 657.069069] RDX: ffff9b67bad80000 RSI: 00000000ffffffa0 RDI: 0000000000000000 +[ 657.069070] RBP: 0000000000000000 R08: 0000000000000000 R09: ffff9b97921fe718 +[ 657.069070] R10: ffff9b97921fe710 R11: 0000000000000001 R12: 0000000000000064 +[ 657.069070] R13: 0000000000000060 R14: 0000000000000000 R15: 0000000000000001 +[ 657.069071] FS: 0000000000000000(0000) GS:ffff9b67c0880000(0000) knlGS:0000000000000000 +[ 657.069072] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 657.069072] CR2: 0000559eac6fc238 CR3: 000000057860a002 CR4: 00000000007606e0 +[ 657.069073] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 657.069073] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 657.069073] PKRU: 55555554 +[ 657.069074] Call Trace: +[ 657.069080] __pci_enable_msix_range+0x233/0x5a0 +[ 657.069085] ? kernfs_put+0xec/0x190 +[ 657.069086] pci_alloc_irq_vectors_affinity+0xbb/0x130 +[ 657.069089] nvme_reset_work+0x6e6/0xeab [nvme] +[ 657.069093] ? __switch_to_asm+0x34/0x70 +[ 657.069094] ? __switch_to_asm+0x40/0x70 +[ 657.069095] ? nvme_irq_check+0x30/0x30 [nvme] +[ 657.069098] process_one_work+0x1a7/0x370 +[ 657.069101] worker_thread+0x1c9/0x380 +[ 657.069102] ? max_active_store+0x80/0x80 +[ 657.069103] kthread+0x112/0x130 +[ 657.069104] ? __kthread_parkme+0x70/0x70 +[ 657.069105] ret_from_fork+0x35/0x40 +[ 657.069106] ---[ end trace f4f06b7d24513d06 ]--- +[ 657.077110] nvme nvme0: 95/1/0 default/read/poll queues + +Signed-off-by: Weiping Zhang +Signed-off-by: Christoph Hellwig +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/pci.c | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index b0978ac554d5..6cc4630ddd6d 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -68,14 +68,30 @@ static int io_queue_depth = 1024; + module_param_cb(io_queue_depth, &io_queue_depth_ops, &io_queue_depth, 0644); + MODULE_PARM_DESC(io_queue_depth, "set io queue depth, should >= 2"); + ++static int io_queue_count_set(const char *val, const struct kernel_param *kp) ++{ ++ unsigned int n; ++ int ret; ++ ++ ret = kstrtouint(val, 10, &n); ++ if (ret != 0 || n > num_possible_cpus()) ++ return -EINVAL; ++ return param_set_uint(val, kp); ++} ++ ++static const struct kernel_param_ops io_queue_count_ops = { ++ .set = io_queue_count_set, ++ .get = param_get_uint, ++}; ++ + static unsigned int write_queues; +-module_param(write_queues, uint, 0644); ++module_param_cb(write_queues, &io_queue_count_ops, &write_queues, 0644); + MODULE_PARM_DESC(write_queues, + "Number of queues to use for writes. If not set, reads and writes " + "will share a queue set."); + + static unsigned int poll_queues; +-module_param(poll_queues, uint, 0644); ++module_param_cb(poll_queues, &io_queue_count_ops, &poll_queues, 0644); + MODULE_PARM_DESC(poll_queues, "Number of queues to use for polled IO."); + + struct nvme_dev; +@@ -3118,8 +3134,6 @@ static int __init nvme_init(void) + BUILD_BUG_ON(sizeof(struct nvme_delete_queue) != 64); + BUILD_BUG_ON(IRQ_AFFINITY_MAX_SETS < 2); + +- write_queues = min(write_queues, num_possible_cpus()); +- poll_queues = min(poll_queues, num_possible_cpus()); + return pci_register_driver(&nvme_driver); + } + +-- +2.29.2 + diff --git a/patches.suse/nvme-pci-remove-last_sq_tail.patch b/patches.suse/nvme-pci-remove-last_sq_tail.patch new file mode 100644 index 0000000..2771487 --- /dev/null +++ b/patches.suse/nvme-pci-remove-last_sq_tail.patch @@ -0,0 +1,89 @@ +From: Keith Busch +Date: Mon, 27 Apr 2020 11:54:46 -0700 +Subject: [PATCH] nvme-pci: remove last_sq_tail +Git-commit: 54b2fcee1db041a83b52b51752dade6090cf952f +Patch-mainline: v5.8-rc1 +References: git-fixes + +The nvme driver does not have enough tags to wrap the queue, and blk-mq +will no longer call commit_rqs() when there are no new submissions to +notify. + +Signed-off-by: Keith Busch +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/pci.c | 23 ++++------------------- + 1 file changed, 4 insertions(+), 19 deletions(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index e95c7465c7bd..b945e9a89883 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -173,7 +173,6 @@ struct nvme_queue { + u16 q_depth; + u16 cq_vector; + u16 sq_tail; +- u16 last_sq_tail; + u16 cq_head; + u16 qid; + u8 cq_phase; +@@ -446,24 +445,11 @@ static int nvme_pci_map_queues(struct blk_mq_tag_set *set) + return 0; + } + +-/* +- * Write sq tail if we are asked to, or if the next command would wrap. +- */ +-static inline void nvme_write_sq_db(struct nvme_queue *nvmeq, bool write_sq) ++static inline void nvme_write_sq_db(struct nvme_queue *nvmeq) + { +- if (!write_sq) { +- u16 next_tail = nvmeq->sq_tail + 1; +- +- if (next_tail == nvmeq->q_depth) +- next_tail = 0; +- if (next_tail != nvmeq->last_sq_tail) +- return; +- } +- + if (nvme_dbbuf_update_and_check_event(nvmeq->sq_tail, + nvmeq->dbbuf_sq_db, nvmeq->dbbuf_sq_ei)) + writel(nvmeq->sq_tail, nvmeq->q_db); +- nvmeq->last_sq_tail = nvmeq->sq_tail; + } + + /** +@@ -480,7 +466,8 @@ static void nvme_submit_cmd(struct nvme_queue *nvmeq, struct nvme_command *cmd, + cmd, sizeof(*cmd)); + if (++nvmeq->sq_tail == nvmeq->q_depth) + nvmeq->sq_tail = 0; +- nvme_write_sq_db(nvmeq, write_sq); ++ if (write_sq) ++ nvme_write_sq_db(nvmeq); + spin_unlock(&nvmeq->sq_lock); + } + +@@ -489,8 +476,7 @@ static void nvme_commit_rqs(struct blk_mq_hw_ctx *hctx) + struct nvme_queue *nvmeq = hctx->driver_data; + + spin_lock(&nvmeq->sq_lock); +- if (nvmeq->sq_tail != nvmeq->last_sq_tail) +- nvme_write_sq_db(nvmeq, true); ++ nvme_write_sq_db(nvmeq); + spin_unlock(&nvmeq->sq_lock); + } + +@@ -1494,7 +1480,6 @@ static void nvme_init_queue(struct nvme_queue *nvmeq, u16 qid) + struct nvme_dev *dev = nvmeq->dev; + + nvmeq->sq_tail = 0; +- nvmeq->last_sq_tail = 0; + nvmeq->cq_head = 0; + nvmeq->cq_phase = 1; + nvmeq->q_db = &dev->dbs[qid * 2 * dev->db_stride]; +-- +2.29.2 + diff --git a/patches.suse/nvme-pci-remove-volatile-cqes.patch b/patches.suse/nvme-pci-remove-volatile-cqes.patch new file mode 100644 index 0000000..f8e911c --- /dev/null +++ b/patches.suse/nvme-pci-remove-volatile-cqes.patch @@ -0,0 +1,58 @@ +From: Keith Busch +Date: Tue, 28 Apr 2020 07:21:56 -0700 +Subject: [PATCH] nvme-pci: remove volatile cqes +Git-commit: 74943d45eef4db64b1e5c9f7ad1d018576e113c5 +Patch-mainline: v5.8-rc1 +References: git-fixes + +The completion queue entry is not volatile once the phase is confirmed. +Remove the volatile keywords and check the phase using the appropriate +READ_ONCE() accessor, allowing the compiler to optimize the remaining +completion path. + +Signed-off-by: Keith Busch +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/pci.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index e13c370de830..e95c7465c7bd 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -166,7 +166,7 @@ struct nvme_queue { + void *sq_cmds; + /* only used for poll queues: */ + spinlock_t cq_poll_lock ____cacheline_aligned_in_smp; +- volatile struct nvme_completion *cqes; ++ struct nvme_completion *cqes; + dma_addr_t sq_dma_addr; + dma_addr_t cq_dma_addr; + u32 __iomem *q_db; +@@ -922,8 +922,9 @@ static void nvme_pci_complete_rq(struct request *req) + /* We read the CQE phase first to check if the rest of the entry is valid */ + static inline bool nvme_cqe_pending(struct nvme_queue *nvmeq) + { +- return (le16_to_cpu(nvmeq->cqes[nvmeq->cq_head].status) & 1) == +- nvmeq->cq_phase; ++ struct nvme_completion *hcqe = &nvmeq->cqes[nvmeq->cq_head]; ++ ++ return (le16_to_cpu(READ_ONCE(hcqe->status)) & 1) == nvmeq->cq_phase; + } + + static inline void nvme_ring_cq_doorbell(struct nvme_queue *nvmeq) +@@ -944,7 +945,7 @@ static inline struct blk_mq_tags *nvme_queue_tagset(struct nvme_queue *nvmeq) + + static inline void nvme_handle_cqe(struct nvme_queue *nvmeq, u16 idx) + { +- volatile struct nvme_completion *cqe = &nvmeq->cqes[idx]; ++ struct nvme_completion *cqe = &nvmeq->cqes[idx]; + struct request *req; + + if (unlikely(cqe->command_id >= nvmeq->q_depth)) { +-- +2.29.2 + diff --git a/patches.suse/nvme-pci-slimmer-CQ-head-update.patch b/patches.suse/nvme-pci-slimmer-CQ-head-update.patch new file mode 100644 index 0000000..00f93d6 --- /dev/null +++ b/patches.suse/nvme-pci-slimmer-CQ-head-update.patch @@ -0,0 +1,57 @@ +From: Alexey Dobriyan +Date: Fri, 28 Feb 2020 21:45:19 +0300 +Subject: [PATCH] nvme-pci: slimmer CQ head update +Git-commit: e2a366a4b0feaeba8f0bf6091ddd2ac27507a9d3 +Patch-mainline: v5.7-rc1 +References: git-fixes + +Update CQ head with pre-increment operator. This saves subtraction of 1 +and a few registers. + +Also update phase with "^= 1". This generates only one RMW instruction. + + ffffffff815ba150 : + ffffffff815ba150: 0f b7 47 70 movzx eax,WORD PTR [rdi+0x70] + ffffffff815ba154: 83 c0 01 add eax,0x1 + ffffffff815ba157: 66 89 47 70 mov WORD PTR [rdi+0x70],ax + ffffffff815ba15b: 66 3b 47 68 cmp ax,WORD PTR [rdi+0x68] + ffffffff815ba15f: 74 01 je ffffffff815ba162 + ffffffff815ba161: c3 ret + ffffffff815ba162: 31 c0 xor eax,eax + ffffffff815ba164: 80 77 74 01 ===> xor BYTE PTR [rdi+0x74],0x1 + ffffffff815ba168: 66 89 47 70 mov WORD PTR [rdi+0x70],ax + ffffffff815ba16c: c3 ret + + add/remove: 0/0 grow/shrink: 0/3 up/down: 0/-119 (-119) + Function old new delta + nvme_poll 690 678 -12 + nvme_dev_disable 1230 1177 -53 + nvme_irq 613 559 -54 + +Signed-off-by: Alexey Dobriyan +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/pci.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index d3f23d6254e4..cdc9b6149d38 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -982,11 +982,9 @@ static void nvme_complete_cqes(struct nvme_queue *nvmeq, u16 start, u16 end) + + static inline void nvme_update_cq_head(struct nvme_queue *nvmeq) + { +- if (nvmeq->cq_head == nvmeq->q_depth - 1) { ++ if (++nvmeq->cq_head == nvmeq->q_depth) { + nvmeq->cq_head = 0; +- nvmeq->cq_phase = !nvmeq->cq_phase; +- } else { +- nvmeq->cq_head++; ++ nvmeq->cq_phase ^= 1; + } + } + +-- +2.29.2 + diff --git a/patches.suse/nvme-pci-use-simple-suspend-when-a-HMB-is-enabled.patch b/patches.suse/nvme-pci-use-simple-suspend-when-a-HMB-is-enabled.patch new file mode 100644 index 0000000..c5afaf6 --- /dev/null +++ b/patches.suse/nvme-pci-use-simple-suspend-when-a-HMB-is-enabled.patch @@ -0,0 +1,44 @@ +From: Christoph Hellwig +Date: Wed, 3 Jun 2020 08:24:17 +0200 +Subject: [PATCH] nvme-pci: use simple suspend when a HMB is enabled +Git-commit: b97120b15ebd3de51325084136d3b9c3cce656d6 +Patch-mainline: v5.8-rc1 +References: git-fixes + +While the NVMe specification allows the device to access the host memory +buffer in host DRAM from all power states, hosts will fail access to +DRAM during S3 and similar power states. + +Fixes: d916b1be94b6 ("nvme-pci: use host managed power state for suspend") +Signed-off-by: Christoph Hellwig +Reviewed-by: Keith Busch +Reviewed-by: Sagi Grimberg +Signed-off-by: Jens Axboe +Acked-by: Hannes Reinecke +--- + drivers/nvme/host/pci.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index d690d5593a80..e2bacd369a88 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -2950,9 +2950,15 @@ static int nvme_suspend(struct device *dev) + * the PCI bus layer to put it into D3 in order to take the PCIe link + * down, so as to allow the platform to achieve its minimum low-power + * state (which may not be possible if the link is up). ++ * ++ * If a host memory buffer is enabled, shut down the device as the NVMe ++ * specification allows the device to access the host memory buffer in ++ * host DRAM from all power states, but hosts will fail access to DRAM ++ * during S3. + */ + if (pm_suspend_via_firmware() || !ctrl->npss || + !pcie_aspm_enabled(pdev) || ++ ndev->nr_host_mem_descs || + (ndev->ctrl.quirks & NVME_QUIRK_SIMPLE_SUSPEND)) + return nvme_disable_prepare_reset(ndev, true); + +-- +2.29.2 + diff --git a/patches.suse/nvme-simplify-error-logic-in-nvme_validate_ns.patch b/patches.suse/nvme-simplify-error-logic-in-nvme_validate_ns.patch new file mode 100644 index 0000000..4ddf391 --- /dev/null +++ b/patches.suse/nvme-simplify-error-logic-in-nvme_validate_ns.patch @@ -0,0 +1,82 @@ +From: Hannes Reinecke +Date: Fri, 26 Feb 2021 08:17:25 +0100 +Subject: nvme: simplify error logic in nvme_validate_ns() +Patch-mainline: v5.12-rc3 +Git-commit: d95c1f4179a7f3ea8aa728ed00252a8ed0f8158f +References: bsc#1184259 + +We only should remove namespaces when we get fatal error back from +the device or when the namespace IDs have changed. +So instead of painfully masking out error numbers which might indicate +that the error should be ignored we could use an NVME status code +to indicated when the namespace should be removed. +That simplifies the final logic and makes it less error-prone. + +Signed-off-by: Hannes Reinecke +Reviewed-by: Keith Busch +Reviewed-by: Sagi Grimberg +Reviewed-by: Daniel Wagner +Signed-off-by: Christoph Hellwig +[dwagner: adapt to missing refactoring code] +Signed-off-by: Daniel Wagner +--- + drivers/nvme/host/core.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1949,11 +1949,11 @@ static int nvme_revalidate_disk(struct g + struct nvme_ctrl *ctrl = ns->ctrl; + struct nvme_id_ns *id; + struct nvme_ns_ids ids; +- int ret = 0; ++ int ret = NVME_SC_INVALID_NS | NVME_SC_DNR; + + if (test_bit(NVME_NS_DEAD, &ns->flags)) { + set_capacity(disk, 0); +- return -ENODEV; ++ goto out; + } + + ret = nvme_identify_ns(ctrl, ns->head->ns_id, &id); +@@ -1961,7 +1961,7 @@ static int nvme_revalidate_disk(struct g + goto out; + + if (id->ncap == 0) { +- ret = -ENODEV; ++ ret = NVME_SC_INVALID_NS | NVME_SC_DNR; + goto free_id; + } + +@@ -1972,7 +1972,7 @@ static int nvme_revalidate_disk(struct g + if (!nvme_ns_ids_equal(&ns->head->ids, &ids)) { + dev_err(ctrl->device, + "identifiers changed for nsid %d\n", ns->head->ns_id); +- ret = -ENODEV; ++ ret = NVME_SC_INVALID_NS | NVME_SC_DNR; + goto free_id; + } + +@@ -1981,13 +1981,17 @@ static int nvme_revalidate_disk(struct g + kfree(id); + out: + /* +- * Only fail the function if we got a fatal error back from the ++ * Only remove the namespace if we got a fatal error back from the + * device, otherwise ignore the error and just move on. ++ * ++ * TODO: we should probably schedule a delayed retry here. + */ +- if (ret == -ENOMEM || (ret > 0 && !(ret & NVME_SC_DNR))) +- ret = 0; +- else if (ret > 0) +- ret = blk_status_to_errno(nvme_error_status(ret)); ++ if (ret > 0) { ++ if (ret & NVME_SC_DNR) ++ ret = blk_status_to_errno(nvme_error_status(ret)); ++ else ++ ret = 0; ++ } + return ret; + } + diff --git a/patches.suse/nxp-nci-add-NXP1002-id.patch b/patches.suse/nxp-nci-add-NXP1002-id.patch new file mode 100644 index 0000000..fe01491 --- /dev/null +++ b/patches.suse/nxp-nci-add-NXP1002-id.patch @@ -0,0 +1,25 @@ +From fdd19067c4d17a22567459a4db196a7e4adb22ea Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Tue, 11 May 2021 18:25:24 +0200 +Subject: [PATCH] nxp-nci: add NXP1002 id +Patch-mainline: Submitted (https://lore.kernel.org/linux-nfc/20210512135451.32375-1-oneukum@suse.com/T/#u) +References: bsc#1185589 + + +The driver also works with those new devices. + +Signed-off-by: Oliver Neukum +--- + drivers/nfc/nxp-nci/i2c.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/nfc/nxp-nci/i2c.c ++++ b/drivers/nfc/nxp-nci/i2c.c +@@ -376,6 +376,7 @@ MODULE_DEVICE_TABLE(of, of_nxp_nci_i2c_m + #ifdef CONFIG_ACPI + static struct acpi_device_id acpi_id[] = { + { "NXP1001" }, ++ { "NXP1002" }, + { "NXP7471" }, + { }, + }; diff --git a/patches.suse/pinctrl-ingenic-Improve-unreachable-code-generation.patch b/patches.suse/pinctrl-ingenic-Improve-unreachable-code-generation.patch new file mode 100644 index 0000000..8f83d68 --- /dev/null +++ b/patches.suse/pinctrl-ingenic-Improve-unreachable-code-generation.patch @@ -0,0 +1,67 @@ +From d6d43a92172085a2681e06a0d06aac53c7bcdd12 Mon Sep 17 00:00:00 2001 +From: Josh Poimboeuf +Date: Thu, 20 Feb 2020 09:35:09 -0600 +Subject: [PATCH] pinctrl: ingenic: Improve unreachable code generation +Git-commit: d6d43a92172085a2681e06a0d06aac53c7bcdd12 +Patch-mainline: v5.7-rc1 +References: git-fixes + +In the second loop of ingenic_pinconf_set(), it annotates the switch +default case as unreachable(). The annotation is technically correct, +because that same case would have resulted in an early function return +in the previous loop. + +However, the compiled code is suboptimal. GCC seems to work extra hard +to ensure that the unreachable code path triggers undefined behavior. +The function would fall through to start executing whatever function +happens to be next in the compilation unit. + +This is problematic because: + + a) it adds unnecessary 'ensure undefined behavior' logic, and + corresponding i-cache footprint; and + + b) it's less robust -- if a bug were to be introduced, falling through + to the next function would be catastrophic. + +Yet another issue is that, while objtool normally understands +unreachable() annotations, there's one special case where it doesn't: +when the annotation occurs immediately after a 'ret' instruction. That +happens to be the case here because unreachable() is immediately before +the return. + +Remove the unreachable() annotation and replace it with a comment. This +simplifies the code generation and changes the unreachable error path to +just silently return instead of corrupting execution. + +This fixes the following objtool warning: + + drivers/pinctrl/pinctrl-ingenic.o: warning: objtool: ingenic_pinconf_set() falls through to next function ingenic_pinconf_group_set() + +Reported-by: Randy Dunlap +Signed-off-by: Josh Poimboeuf +Link: https://lore.kernel.org/r/bc20fdbcb826512cf76b7dfd0972740875931b19.1582212881.git.jpoimboe@redhat.com +Signed-off-by: Linus Walleij +Acked-by: Takashi Iwai + +--- + drivers/pinctrl/pinctrl-ingenic.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/pinctrl-ingenic.c b/drivers/pinctrl/pinctrl-ingenic.c +index cb9576bc20db..34870f934563 100644 +--- a/drivers/pinctrl/pinctrl-ingenic.c ++++ b/drivers/pinctrl/pinctrl-ingenic.c +@@ -2195,7 +2195,8 @@ static int ingenic_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin, + break; + + default: +- unreachable(); ++ /* unreachable */ ++ break; + } + } + +-- +2.26.2 + diff --git a/patches.suse/pinctrl-samsung-use-int-for-register-masks-in-Exynos.patch b/patches.suse/pinctrl-samsung-use-int-for-register-masks-in-Exynos.patch new file mode 100644 index 0000000..7b0f557 --- /dev/null +++ b/patches.suse/pinctrl-samsung-use-int-for-register-masks-in-Exynos.patch @@ -0,0 +1,67 @@ +From fa0c10a5f3a49130dd11281aa27e7e1c8654abc7 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Thu, 8 Apr 2021 21:50:29 +0200 +Subject: [PATCH] pinctrl: samsung: use 'int' for register masks in Exynos +Git-commit: fa0c10a5f3a49130dd11281aa27e7e1c8654abc7 +Patch-mainline: v5.13-rc1 +References: git-fixes + +The Special Function Registers on all Exynos SoC, including ARM64, are +32-bit wide, so entire driver uses matching functions like readl() or +writel(). On 64-bit ARM using unsigned long for register masks: +1. makes little sense as immediately after bitwise operation it will be + cast to 32-bit value when calling writel(), +2. is actually error-prone because it might promote other operands to + 64-bit. + +Addresses-coverity: Unintentional integer overflow +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Sylwester Nawrocki +Link: https://lore.kernel.org/r/20210408195029.69974-1-krzysztof.kozlowski@canonical.com +Signed-off-by: Linus Walleij +Acked-by: Takashi Iwai + +--- + drivers/pinctrl/samsung/pinctrl-exynos.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/pinctrl/samsung/pinctrl-exynos.c ++++ b/drivers/pinctrl/samsung/pinctrl-exynos.c +@@ -55,7 +55,7 @@ static void exynos_irq_mask(struct irq_d + struct exynos_irq_chip *our_chip = to_exynos_irq_chip(chip); + struct samsung_pin_bank *bank = irq_data_get_irq_chip_data(irqd); + unsigned long reg_mask = our_chip->eint_mask + bank->eint_offset; +- unsigned long mask; ++ unsigned int mask; + unsigned long flags; + + spin_lock_irqsave(&bank->slock, flags); +@@ -83,7 +83,7 @@ static void exynos_irq_unmask(struct irq + struct exynos_irq_chip *our_chip = to_exynos_irq_chip(chip); + struct samsung_pin_bank *bank = irq_data_get_irq_chip_data(irqd); + unsigned long reg_mask = our_chip->eint_mask + bank->eint_offset; +- unsigned long mask; ++ unsigned int mask; + unsigned long flags; + + /* +@@ -474,7 +474,7 @@ static void exynos_irq_eint0_15(struct i + chained_irq_exit(chip, desc); + } + +-static inline void exynos_irq_demux_eint(unsigned long pend, ++static inline void exynos_irq_demux_eint(unsigned int pend, + struct irq_domain *domain) + { + unsigned int irq; +@@ -491,8 +491,8 @@ static void exynos_irq_demux_eint16_31(s + { + struct irq_chip *chip = irq_desc_get_chip(desc); + struct exynos_muxed_weint_data *eintd = irq_desc_get_handler_data(desc); +- unsigned long pend; +- unsigned long mask; ++ unsigned int pend; ++ unsigned int mask; + int i; + + chained_irq_enter(chip, desc); diff --git a/patches.suse/platform-mellanox-mlxbf-tmfifo-Fix-a-memory-barrier-.patch b/patches.suse/platform-mellanox-mlxbf-tmfifo-Fix-a-memory-barrier-.patch new file mode 100644 index 0000000..8d44d9c --- /dev/null +++ b/patches.suse/platform-mellanox-mlxbf-tmfifo-Fix-a-memory-barrier-.patch @@ -0,0 +1,66 @@ +From 1c0e5701c5e792c090aef0e5b9b8923c334d9324 Mon Sep 17 00:00:00 2001 +From: Liming Sun +Date: Fri, 7 May 2021 20:30:12 -0400 +Subject: [PATCH] platform/mellanox: mlxbf-tmfifo: Fix a memory barrier issue +Git-commit: 1c0e5701c5e792c090aef0e5b9b8923c334d9324 +Patch-mainline: v5.13-rc3 +References: git-fixes + +The virtio framework uses wmb() when updating avail->idx. It +guarantees the write order, but not necessarily loading order +for the code accessing the memory. This commit adds a load barrier +after reading the avail->idx to make sure all the data in the +descriptor is visible. It also adds a barrier when returning the +packet to virtio framework to make sure read/writes are visible to +the virtio code. + +Fixes: 1357dfd7261f ("platform/mellanox: Add TmFifo driver for Mellanox BlueField Soc") +Signed-off-by: Liming Sun +Reviewed-by: Vadim Pasternak +Link: https://lore.kernel.org/r/1620433812-17911-1-git-send-email-limings@nvidia.com +Signed-off-by: Hans de Goede +Acked-by: Takashi Iwai + +--- + drivers/platform/mellanox/mlxbf-tmfifo.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/mellanox/mlxbf-tmfifo.c b/drivers/platform/mellanox/mlxbf-tmfifo.c +index bbc4e71a16ff..38800e86ed8a 100644 +--- a/drivers/platform/mellanox/mlxbf-tmfifo.c ++++ b/drivers/platform/mellanox/mlxbf-tmfifo.c +@@ -294,6 +294,9 @@ mlxbf_tmfifo_get_next_desc(struct mlxbf_tmfifo_vring *vring) + if (vring->next_avail == virtio16_to_cpu(vdev, vr->avail->idx)) + return NULL; + ++ /* Make sure 'avail->idx' is visible already. */ ++ virtio_rmb(false); ++ + idx = vring->next_avail % vr->num; + head = virtio16_to_cpu(vdev, vr->avail->ring[idx]); + if (WARN_ON(head >= vr->num)) +@@ -322,7 +325,7 @@ static void mlxbf_tmfifo_release_desc(struct mlxbf_tmfifo_vring *vring, + * done or not. Add a memory barrier here to make sure the update above + * completes before updating the idx. + */ +- mb(); ++ virtio_mb(false); + vr->used->idx = cpu_to_virtio16(vdev, vr_idx + 1); + } + +@@ -733,6 +736,12 @@ static bool mlxbf_tmfifo_rxtx_one_desc(struct mlxbf_tmfifo_vring *vring, + desc = NULL; + fifo->vring[is_rx] = NULL; + ++ /* ++ * Make sure the load/store are in order before ++ * returning back to virtio. ++ */ ++ virtio_mb(false); ++ + /* Notify upper layer that packet is done. */ + spin_lock_irqsave(&fifo->spin_lock[is_rx], flags); + vring_interrupt(0, vring->vq); +-- +2.26.2 + diff --git a/patches.suse/powerpc-64s-Fix-crashes-when-toggling-entry-flush-ba.patch b/patches.suse/powerpc-64s-Fix-crashes-when-toggling-entry-flush-ba.patch index 2ee9bb1..f253b1c 100644 --- a/patches.suse/powerpc-64s-Fix-crashes-when-toggling-entry-flush-ba.patch +++ b/patches.suse/powerpc-64s-Fix-crashes-when-toggling-entry-flush-ba.patch @@ -3,7 +3,7 @@ From: Michael Ellerman Date: Thu, 6 May 2021 14:49:59 +1000 Subject: [PATCH] powerpc/64s: Fix crashes when toggling entry flush barrier -References: bsc#1177666 git-fixes +References: bsc#1177666 git-fixes bsc#1186460 ltc#192531 Patch-mainline: v5.13-rc2 Git-commit: aec86b052df6541cc97c5fca44e5934cbea4963b diff --git a/patches.suse/powerpc-64s-Fix-crashes-when-toggling-stf-barrier.patch b/patches.suse/powerpc-64s-Fix-crashes-when-toggling-stf-barrier.patch index 3893ae6..1a631c0 100644 --- a/patches.suse/powerpc-64s-Fix-crashes-when-toggling-stf-barrier.patch +++ b/patches.suse/powerpc-64s-Fix-crashes-when-toggling-stf-barrier.patch @@ -3,7 +3,7 @@ From: Michael Ellerman Date: Thu, 6 May 2021 14:49:58 +1000 Subject: [PATCH] powerpc/64s: Fix crashes when toggling stf barrier -References: bsc#1087082 git-fixes +References: bsc#1087082 git-fixes bsc#1186460 ltc#192531 Patch-mainline: v5.13-rc2 Git-commit: 8ec7791bae1327b1c279c5cd6e929c3b12daaf0a diff --git a/patches.suse/qtnfmac-Fix-possible-buffer-overflow-in-qtnf_event_h.patch b/patches.suse/qtnfmac-Fix-possible-buffer-overflow-in-qtnf_event_h.patch new file mode 100644 index 0000000..d785d82 --- /dev/null +++ b/patches.suse/qtnfmac-Fix-possible-buffer-overflow-in-qtnf_event_h.patch @@ -0,0 +1,42 @@ +From 130f634da1af649205f4a3dd86cbe5c126b57914 Mon Sep 17 00:00:00 2001 +From: Lee Gibson +Date: Mon, 19 Apr 2021 15:58:42 +0100 +Subject: [PATCH] qtnfmac: Fix possible buffer overflow in qtnf_event_handle_external_auth +Git-commit: 130f634da1af649205f4a3dd86cbe5c126b57914 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Function qtnf_event_handle_external_auth calls memcpy without +checking the length. +A user could control that length and trigger a buffer overflow. +Fix by checking the length is within the maximum allowed size. + +Signed-off-by: Lee Gibson +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210419145842.345787-1-leegib@gmail.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/quantenna/qtnfmac/event.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/quantenna/qtnfmac/event.c b/drivers/net/wireless/quantenna/qtnfmac/event.c +index c775c177933b..8dc80574d08d 100644 +--- a/drivers/net/wireless/quantenna/qtnfmac/event.c ++++ b/drivers/net/wireless/quantenna/qtnfmac/event.c +@@ -570,8 +570,10 @@ qtnf_event_handle_external_auth(struct qtnf_vif *vif, + return 0; + + if (ev->ssid_len) { +- memcpy(auth.ssid.ssid, ev->ssid, ev->ssid_len); +- auth.ssid.ssid_len = ev->ssid_len; ++ int len = clamp_val(ev->ssid_len, 0, IEEE80211_MAX_SSID_LEN); ++ ++ memcpy(auth.ssid.ssid, ev->ssid, len); ++ auth.ssid.ssid_len = len; + } + + auth.key_mgmt_suite = le32_to_cpu(ev->akm_suite); +-- +2.26.2 + diff --git a/patches.suse/rdma-addr-create-addr_wq-with-wq_mem_reclaim-flag.patch b/patches.suse/rdma-addr-create-addr_wq-with-wq_mem_reclaim-flag.patch new file mode 100644 index 0000000..7218f62 --- /dev/null +++ b/patches.suse/rdma-addr-create-addr_wq-with-wq_mem_reclaim-flag.patch @@ -0,0 +1,55 @@ +From: Steve Wise +Date: Wed, 26 May 2021 13:25:00 +0200 +Subject: RDMA/addr: create addr_wq with WQ_MEM_RECLAIM flag +Patch-mainline: Never, no fix yet availabe upstream revert offending change +References: bsc#1183346 + +While running NVMe/oF wire unplug tests, we hit this warning in +kernel/workqueue.c:check_flush_dependency(): + +WARN_ONCE(worker && ((worker->current_pwq->wq->flags & + (WQ_MEM_RECLAIM | __WQ_LEGACY)) == WQ_MEM_RECLAIM), + "workqueue: WQ_MEM_RECLAIM %s:%pf is flushing !WQ_MEM_RECLAIM %s:%pf", + worker->current_pwq->wq->name, worker->current_func, + target_wq->name, target_func); + +Which I think means we're flushing a workq that doesn't have +WQ_MEM_RECLAIM set, from workqueue context that does have it set. + +Looking at rdma_addr_cancel() which is doing the flushing, it flushes +the addr_wq which doesn't have MEM_RECLAIM set. Yet rdma_addr_cancel() +is being called by the nvme host connection timeout/reconnect workqueue +thread that does have WQ_MEM_RECLAIM set. + +So set WQ_MEM_RECLAIM on the addr_req workqueue. + +This is to silence the warning and not fixing the problem at +all. Upstream is aware of this problem but there is no fix yet. To +avoid a lot of support requests undo the offending commit. + +Link: https://patchwork.kernel.org/project/linux-rdma/patch/5f5a1e4e90f3625cea57ffa79fc0e5bcb7efe09d.1548963371.git.swise@opengridcomputing.com/ +Fixes: 39baf10310e6 ("IB/core: Fix use workqueue without WQ_MEM_RECLAIM") +Signed-off-by: Steve Wise +Reviewed-by: Parav Pandit +[dwagner: Updated commit message] +Signed-off-by: Daniel Wagner +--- + drivers/infiniband/core/addr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c +index 0abce004a959..c92d25c97ba1 100644 +--- a/drivers/infiniband/core/addr.c ++++ b/drivers/infiniband/core/addr.c +@@ -871,7 +871,7 @@ static struct notifier_block nb = { + + int addr_init(void) + { +- addr_wq = alloc_ordered_workqueue("ib_addr", 0); ++ addr_wq = alloc_ordered_workqueue("ib_addr", WQ_MEM_RECLAIM); + if (!addr_wq) + return -ENOMEM; + +-- +2.29.2 + diff --git a/patches.suse/rdma-core-create-ib_cm-with-wq_mem_reclaim-flag.patch b/patches.suse/rdma-core-create-ib_cm-with-wq_mem_reclaim-flag.patch new file mode 100644 index 0000000..a781975 --- /dev/null +++ b/patches.suse/rdma-core-create-ib_cm-with-wq_mem_reclaim-flag.patch @@ -0,0 +1,44 @@ +From: Daniel Wagner +Date: Wed, 26 May 2021 13:34:22 +0200 +Subject: RDMA/core: create ib_cm with WQ_MEM_RECLAIM flag +Patch-mainline: Never, no fix yet availabe upstream revert offending change +References: bsc#1183346 + +While running NVMe/oF wire unplug tests, we hit this warning in +kernel/workqueue.c:check_flush_dependency(): + +WARN_ONCE(worker && ((worker->current_pwq->wq->flags & + (WQ_MEM_RECLAIM | __WQ_LEGACY)) == WQ_MEM_RECLAIM), + "workqueue: WQ_MEM_RECLAIM %s:%pf is flushing !WQ_MEM_RECLAIM %s:%pf", + worker->current_pwq->wq->name, worker->current_func, + target_wq->name, target_func); + +Set WQ_MEM_RECLAIM on the ib_cm workqueue. + +This is to silence the warning and not fixing the problem at +all. Upstream is aware of this problem but there is no fix yet. To +avoid a lot of support requests undo the offending commit. + +Link: https://patchwork.kernel.org/project/linux-rdma/patch/5f5a1e4e90f3625cea57ffa79fc0e5bcb7efe09d.1548963371.git.swise@opengridcomputing.com/ +Fixes: cb93e597779e ("cm: Don't allocate ib_cm workqueue with WQ_MEM_RECLAIM") +Signed-off-by: Daniel Wagner +--- + drivers/infiniband/core/cm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index b686fa2a918c..d302e4a3150e 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -4518,7 +4518,7 @@ static int __init ib_cm_init(void) + goto error1; + } + +- cm.wq = alloc_workqueue("ib_cm", 0, 1); ++ cm.wq = alloc_workqueue("ib_cm", WQ_MEM_RECLAIM, 1); + if (!cm.wq) { + ret = -ENOMEM; + goto error2; +-- +2.29.2 + diff --git a/patches.suse/s390-dasd-fix-hanging-dasd-driver-unbind b/patches.suse/s390-dasd-fix-hanging-dasd-driver-unbind new file mode 100644 index 0000000..04b416e --- /dev/null +++ b/patches.suse/s390-dasd-fix-hanging-dasd-driver-unbind @@ -0,0 +1,47 @@ +From: Stefan Haberland +Date: Fri, 5 Mar 2021 13:54:38 +0100 +Subject: s390/dasd: fix hanging DASD driver unbind +Git-commit: 7d365bd0bff3c0310c39ebaffc9a8458e036d666 +Patch-mainline: v5.12-rc3 +References: bsc#1183932 LTC#192153 + +In case of an unbind of the DASD device driver the function +dasd_generic_remove() is called which shuts down the device. +Among others this functions removes the int_handler from the cdev. +During shutdown the device cancels all outstanding IO requests and waits +for completion of the clear request. +Unfortunately the clear interrupt will never be received when there is no +interrupt handler connected. + +Fix by moving the int_handler removal after the call to the state machine +where no request or interrupt is outstanding. + +Cc: stable@vger.kernel.org +Signed-off-by: Stefan Haberland +Tested-by: Bjoern Walk +Reviewed-by: Jan Hoeppner +Signed-off-by: Jens Axboe +Acked-by: Petr Tesarik +--- + drivers/s390/block/dasd.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/s390/block/dasd.c ++++ b/drivers/s390/block/dasd.c +@@ -3522,8 +3522,6 @@ void dasd_generic_remove(struct ccw_devi + struct dasd_device *device; + struct dasd_block *block; + +- cdev->handler = NULL; +- + device = dasd_device_from_cdev(cdev); + if (IS_ERR(device)) { + dasd_remove_sysfs_files(cdev); +@@ -3542,6 +3540,7 @@ void dasd_generic_remove(struct ccw_devi + * no quite down yet. + */ + dasd_set_target_state(device, DASD_STATE_NEW); ++ cdev->handler = NULL; + /* dasd_delete_device destroys the device reference. */ + block = device->block; + dasd_delete_device(device); diff --git a/patches.suse/s390-sles15sp2-kdump-fix-out-of-memory-with-PCI.patch b/patches.suse/s390-sles15sp2-kdump-fix-out-of-memory-with-PCI.patch new file mode 100644 index 0000000..3f654da --- /dev/null +++ b/patches.suse/s390-sles15sp2-kdump-fix-out-of-memory-with-PCI.patch @@ -0,0 +1,39 @@ +From: Gerald Schaefer +Subject: s390/kdump: fix out-of-memory with PCI +Patch-mainline: never, fixed upstream with larger code rework +References: bsc#1182257 LTC#191375 + +Description: s390/kdump: fix out-of-memory with PCI +Symptom: The kdump kernel runs out of memory when allocating memory for + PCI IOMMU bitmaps in zpci_dma_init_device(). +Problem: The kdump kernel does not properly restrict memory_end, which + the PCI code uses to calculate the size of the IOMMU bitmap, and + too much memory will be allocated. +Solution: Properly restrict memory_end to the available memory of the + kdump kernel (OLDMEM_SIZE), similar to how it would be done with + a "mem=" kernel parameter. + This was fixed inadvertently by an unrelated upstream commit + 73045a08cf55 ("s390: unify identity mapping limits handling"). + But that commit cannot easily be backported to distribution + levels, so only the part that fixes this bug will be submitted. +Reproduction: Try kdump on a system with large memory size and many PCI + functions. + + +Signed-off-by: Gerald Schaefer +Acked-by: Petr Tesarik +--- + arch/s390/boot/ipl_parm.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/s390/boot/ipl_parm.c ++++ b/arch/s390/boot/ipl_parm.c +@@ -243,6 +243,8 @@ void setup_memory_end(void) + #ifdef CONFIG_CRASH_DUMP + if (OLDMEM_BASE) { + kaslr_enabled = 0; ++ memory_end = min(memory_end ?: OLDMEM_SIZE, OLDMEM_SIZE); ++ memory_end_set = 1; + } else if (ipl_block_valid && + ipl_block.pb0_hdr.pbt == IPL_PBT_FCP && + ipl_block.fcp.opt == IPL_PB0_FCP_OPT_DUMP) { diff --git a/patches.suse/scsi-core-Run-queue-in-case-of-I-O-resource-contenti.patch b/patches.suse/scsi-core-Run-queue-in-case-of-I-O-resource-contenti.patch new file mode 100644 index 0000000..82aa180 --- /dev/null +++ b/patches.suse/scsi-core-Run-queue-in-case-of-I-O-resource-contenti.patch @@ -0,0 +1,97 @@ +From: Ming Lei +Date: Mon, 20 Jul 2020 10:54:35 +0800 +Subject: scsi: core: Run queue in case of I/O resource contention failure +Patch-mainline: v5.8-rc7 +Git-commit: 3f0dcfbcd2e162fc0a11c1f59b7acd42ee45f126 +References: bsc#1186416 + +I/O requests may be held in scheduler queue because of resource contention. +The starvation scenario was handled properly in the regular completion +path but we failed to account for it during I/O submission. This lead to +the hang captured below. Make sure we run the queue when resource +contention is encountered in the submission path. + +[ 39.054963] scsi 13:0:0:0: rejecting I/O to dead device +[ 39.058700] scsi 13:0:0:0: rejecting I/O to dead device +[ 39.087855] sd 13:0:0:1: [sdd] Synchronizing SCSI cache +[ 39.088909] scsi 13:0:0:1: rejecting I/O to dead device +[ 39.095351] scsi 13:0:0:1: rejecting I/O to dead device +[ 39.096962] scsi 13:0:0:1: rejecting I/O to dead device +[ 247.021859] INFO: task scsi-stress-rem:813 blocked for more than 122 seconds. +[ 247.023258] Not tainted 5.8.0-rc2 #8 +[ 247.024069] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 247.025331] scsi-stress-rem D 0 813 802 0x00004000 +[ 247.025334] Call Trace: +[ 247.025354] __schedule+0x504/0x55f +[ 247.027987] schedule+0x72/0xa8 +[ 247.027991] blk_mq_freeze_queue_wait+0x63/0x8c +[ 247.027994] ? do_wait_intr_irq+0x7a/0x7a +[ 247.027996] blk_cleanup_queue+0x4b/0xc9 +[ 247.028000] __scsi_remove_device+0xf6/0x14e +[ 247.028002] scsi_remove_device+0x21/0x2b +[ 247.029037] sdev_store_delete+0x58/0x7c +[ 247.029041] kernfs_fop_write+0x10d/0x14f +[ 247.031281] vfs_write+0xa2/0xdf +[ 247.032670] ksys_write+0x6b/0xb3 +[ 247.032673] do_syscall_64+0x56/0x82 +[ 247.034053] entry_SYSCALL_64_after_hwframe+0x44/0xa9 +[ 247.034059] RIP: 0033:0x7f69f39e9008 +[ 247.036330] Code: Bad RIP value. +[ 247.036331] RSP: 002b:00007ffdd8116498 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 +[ 247.037613] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f69f39e9008 +[ 247.039714] RDX: 0000000000000002 RSI: 000055cde92a0ab0 RDI: 0000000000000001 +[ 247.039715] RBP: 000055cde92a0ab0 R08: 000000000000000a R09: 00007f69f3a79e80 +[ 247.039716] R10: 000000000000000a R11: 0000000000000246 R12: 00007f69f3abb780 +[ 247.039717] R13: 0000000000000002 R14: 00007f69f3ab6740 R15: 0000000000000002 + +Link: https://lore.kernel.org/r/20200720025435.812030-1-ming.lei@redhat.com +Cc: linux-block@vger.kernel.org +Cc: Christoph Hellwig +Reviewed-by: Bart Van Assche +Reviewed-by: Christoph Hellwig +Signed-off-by: Ming Lei +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/scsi_lib.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -568,6 +568,15 @@ static void scsi_mq_uninit_cmd(struct sc + scsi_del_cmd_from_list(cmd); + } + ++static void scsi_run_queue_async(struct scsi_device *sdev) ++{ ++ if (scsi_target(sdev)->single_lun || ++ !list_empty(&sdev->host->starved_list)) ++ kblockd_schedule_work(&sdev->requeue_work); ++ else ++ blk_mq_run_hw_queues(sdev->request_queue, true); ++} ++ + /* Returns false when no more bytes to process, true if there are more */ + static bool scsi_end_request(struct request *req, blk_status_t error, + unsigned int bytes) +@@ -612,11 +621,7 @@ static bool scsi_end_request(struct requ + + __blk_mq_end_request(req, error); + +- if (scsi_target(sdev)->single_lun || +- !list_empty(&sdev->host->starved_list)) +- kblockd_schedule_work(&sdev->requeue_work); +- else +- blk_mq_run_hw_queues(q, true); ++ scsi_run_queue_async(sdev); + + percpu_ref_put(&q->q_usage_counter); + return false; +@@ -1726,6 +1731,7 @@ static blk_status_t scsi_queue_rq(struct + */ + if (req->rq_flags & RQF_DONTPREP) + scsi_mq_uninit_cmd(cmd); ++ scsi_run_queue_async(sdev); + break; + } + return ret; diff --git a/patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch b/patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch new file mode 100644 index 0000000..b53a622 --- /dev/null +++ b/patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch @@ -0,0 +1,105 @@ +From 5114975eb2de4e70d9d43b57912e1aee12ec090b Mon Sep 17 00:00:00 2001 +From: Brian King +Date: Tue, 11 May 2021 13:12:19 -0500 +Subject: [PATCH] scsi: ibmvfc: Avoid move login if fast fail is enabled + +References: bsc#1185938 ltc#192043 +Patch-mainline: queued +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git +Git-commit: 5114975eb2de4e70d9d43b57912e1aee12ec090b + +If fast fail is enabled and we encounter a WWPN moving from one port id to +another port id with I/O outstanding, if we use the move login MAD, +although it will work, it will leave any outstanding I/O still outstanding +to the old port id. Eventually, the SCSI command timers will fire and we +will abort these commands, however, this is generally much longer than the +fast fail timeout, which can lead to I/O operations being outstanding for a +long time. This patch changes the behavior to avoid the move login if fast +fail is enabled. Once terminate_rport_io cleans up the rport, then we force +the target back through the delete process, which re-drives the implicit +logout, then kicks us back into discovery where we will discover the WWPN +at the new location and do a PLOGI to it. + +Link: https://lore.kernel.org/r/1620756740-7045-3-git-send-email-brking@linux.vnet.ibm.com +Signed-off-by: Brian King +Signed-off-by: Martin K. Petersen +Acked-by: Michal Suchanek +--- + drivers/scsi/ibmvscsi/ibmvfc.c | 39 ++++++++++++++++++++++++---------- + drivers/scsi/ibmvscsi/ibmvfc.h | 1 + + 2 files changed, 29 insertions(+), 11 deletions(-) + +diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c +index 4ac5bff69305..c8d3fdf65a7f 100644 +--- a/drivers/scsi/ibmvscsi/ibmvfc.c ++++ b/drivers/scsi/ibmvscsi/ibmvfc.c +@@ -4728,19 +4728,24 @@ static int ibmvfc_alloc_target(struct ibmvfc_host *vhost, + * and it failed for some reason, such as there being I/O + * pending to the target. In this case, we will have already + * deleted the rport from the FC transport so we do a move +- * login, which works even with I/O pending, as it will cancel +- * any active commands. ++ * login, which works even with I/O pending, however, if ++ * there is still I/O pending, it will stay outstanding, so ++ * we only do this if fast fail is disabled for the rport, ++ * otherwise we let terminate_rport_io clean up the port ++ * before we login at the new location. + */ + if (wtgt->action == IBMVFC_TGT_ACTION_LOGOUT_DELETED_RPORT) { +- /* +- * Do a move login here. The old target is no longer +- * known to the transport layer We don't use the +- * normal ibmvfc_set_tgt_action to set this, as we +- * don't normally want to allow this state change. +- */ +- wtgt->new_scsi_id = scsi_id; +- wtgt->action = IBMVFC_TGT_ACTION_INIT; +- ibmvfc_init_tgt(wtgt, ibmvfc_tgt_move_login); ++ if (wtgt->move_login) { ++ /* ++ * Do a move login here. The old target is no longer ++ * known to the transport layer We don't use the ++ * normal ibmvfc_set_tgt_action to set this, as we ++ * don't normally want to allow this state change. ++ */ ++ wtgt->new_scsi_id = scsi_id; ++ wtgt->action = IBMVFC_TGT_ACTION_INIT; ++ ibmvfc_init_tgt(wtgt, ibmvfc_tgt_move_login); ++ } + goto unlock_out; + } else { + tgt_err(wtgt, "Unexpected target state: %d, %p\n", +@@ -5486,6 +5491,18 @@ static void ibmvfc_do_work(struct ibmvfc_host *vhost) + rport = tgt->rport; + tgt->rport = NULL; + ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_LOGOUT_DELETED_RPORT); ++ ++ /* ++ * If fast fail is enabled, we wait for it to fire and then clean up ++ * the old port, since we expect the fast fail timer to clean up the ++ * outstanding I/O faster than waiting for normal command timeouts. ++ * However, if fast fail is disabled, any I/O outstanding to the ++ * rport LUNs will stay outstanding indefinitely, since the EH handlers ++ * won't get invoked for I/O's timing out. If this is a NPIV failover ++ * scenario, the better alternative is to use the move login. ++ */ ++ if (rport && rport->fast_io_fail_tmo == -1) ++ tgt->move_login = 1; + spin_unlock_irqrestore(vhost->host->host_lock, flags); + if (rport) + fc_remote_port_delete(rport); +diff --git a/drivers/scsi/ibmvscsi/ibmvfc.h b/drivers/scsi/ibmvscsi/ibmvfc.h +index 4601bd21372d..4f0f3baefae4 100644 +--- a/drivers/scsi/ibmvscsi/ibmvfc.h ++++ b/drivers/scsi/ibmvscsi/ibmvfc.h +@@ -726,6 +726,7 @@ struct ibmvfc_target { + int add_rport; + int init_retries; + int logo_rcvd; ++ int move_login; + u32 cancel_key; + struct ibmvfc_service_parms service_parms; + struct ibmvfc_service_parms service_parms_change; +-- +2.26.2 + diff --git a/patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch b/patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch new file mode 100644 index 0000000..3122558 --- /dev/null +++ b/patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch @@ -0,0 +1,109 @@ +From d5b45dd5ba6c944b17118530843e67bf9c096e49 Mon Sep 17 00:00:00 2001 +From: Brian King +Date: Tue, 11 May 2021 13:12:18 -0500 +Subject: [PATCH] scsi: ibmvfc: Handle move login failure + +References: bsc#1185938 ltc#192043 +Patch-mainline: queued +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git +Git-commit: d5b45dd5ba6c944b17118530843e67bf9c096e49 + +When service is being performed on an SVC with NPIV enabled, the WWPN of +the canister / node being serviced fails over to the another canister / +node. This looks to the ibmvfc driver as a WWPN moving from one SCSI ID to +another. The driver will first attempt to do an implicit logout of the old +SCSI ID. If this works, we simply delete the rport at the old location and +add an rport at the new location and the FC transport class handles +everything. However, if there is I/O outstanding, this implicit logout will +fail, in which case we will send a "move login" request to the VIOS. This +will cancel any outstanding I/O to that port, logout the port, and PLOGI +the new port. Recently we've encountered a scenario where the move login +fails. This was resulting in an attempted plogi to the new scsi id, without +the old scsi id getting logged out, which is a VIOS protocol violation. To +solve this, we want to keep tracking the old scsi id as the current scsi +id. That way, once terminate_rport_io cancels the outstanding i/o, it will +send us back through to do an implicit logout of the old scsi id, rather +than the new scsi id, and then we can plogi the new scsi id. + +Link: https://lore.kernel.org/r/1620756740-7045-2-git-send-email-brking@linux.vnet.ibm.com +Signed-off-by: Brian King +Signed-off-by: Martin K. Petersen +Acked-by: Michal Suchanek +--- + drivers/scsi/ibmvscsi/ibmvfc.c | 16 ++++++++-------- + drivers/scsi/ibmvscsi/ibmvfc.h | 2 +- + 2 files changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c +index 6540d48eb0e8..4ac5bff69305 100644 +--- a/drivers/scsi/ibmvscsi/ibmvfc.c ++++ b/drivers/scsi/ibmvscsi/ibmvfc.c +@@ -4299,9 +4299,10 @@ static void ibmvfc_tgt_move_login_done(struct ibmvfc_event *evt) + ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_NONE); + switch (status) { + case IBMVFC_MAD_SUCCESS: +- tgt_dbg(tgt, "Move Login succeeded for old scsi_id: %llX\n", tgt->old_scsi_id); ++ tgt_dbg(tgt, "Move Login succeeded for new scsi_id: %llX\n", tgt->new_scsi_id); + tgt->ids.node_name = wwn_to_u64(rsp->service_parms.node_name); + tgt->ids.port_name = wwn_to_u64(rsp->service_parms.port_name); ++ tgt->scsi_id = tgt->new_scsi_id; + tgt->ids.port_id = tgt->scsi_id; + memcpy(&tgt->service_parms, &rsp->service_parms, + sizeof(tgt->service_parms)); +@@ -4319,8 +4320,8 @@ static void ibmvfc_tgt_move_login_done(struct ibmvfc_event *evt) + level += ibmvfc_retry_tgt_init(tgt, ibmvfc_tgt_move_login); + + tgt_log(tgt, level, +- "Move Login failed: old scsi_id: %llX, flags:%x, vios_flags:%x, rc=0x%02X\n", +- tgt->old_scsi_id, be32_to_cpu(rsp->flags), be16_to_cpu(rsp->vios_flags), ++ "Move Login failed: new scsi_id: %llX, flags:%x, vios_flags:%x, rc=0x%02X\n", ++ tgt->new_scsi_id, be32_to_cpu(rsp->flags), be16_to_cpu(rsp->vios_flags), + status); + break; + } +@@ -4357,8 +4358,8 @@ static void ibmvfc_tgt_move_login(struct ibmvfc_target *tgt) + move->common.opcode = cpu_to_be32(IBMVFC_MOVE_LOGIN); + move->common.length = cpu_to_be16(sizeof(*move)); + +- move->old_scsi_id = cpu_to_be64(tgt->old_scsi_id); +- move->new_scsi_id = cpu_to_be64(tgt->scsi_id); ++ move->old_scsi_id = cpu_to_be64(tgt->scsi_id); ++ move->new_scsi_id = cpu_to_be64(tgt->new_scsi_id); + move->wwpn = cpu_to_be64(tgt->wwpn); + move->node_name = cpu_to_be64(tgt->ids.node_name); + +@@ -4367,7 +4368,7 @@ static void ibmvfc_tgt_move_login(struct ibmvfc_target *tgt) + ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_DEL_RPORT); + kref_put(&tgt->kref, ibmvfc_release_tgt); + } else +- tgt_dbg(tgt, "Sent Move Login for old scsi_id: %llX\n", tgt->old_scsi_id); ++ tgt_dbg(tgt, "Sent Move Login for new scsi_id: %llX\n", tgt->new_scsi_id); + } + + /** +@@ -4737,8 +4738,7 @@ static int ibmvfc_alloc_target(struct ibmvfc_host *vhost, + * normal ibmvfc_set_tgt_action to set this, as we + * don't normally want to allow this state change. + */ +- wtgt->old_scsi_id = wtgt->scsi_id; +- wtgt->scsi_id = scsi_id; ++ wtgt->new_scsi_id = scsi_id; + wtgt->action = IBMVFC_TGT_ACTION_INIT; + ibmvfc_init_tgt(wtgt, ibmvfc_tgt_move_login); + goto unlock_out; +diff --git a/drivers/scsi/ibmvscsi/ibmvfc.h b/drivers/scsi/ibmvscsi/ibmvfc.h +index 19dcec3ae9ba..4601bd21372d 100644 +--- a/drivers/scsi/ibmvscsi/ibmvfc.h ++++ b/drivers/scsi/ibmvscsi/ibmvfc.h +@@ -718,7 +718,7 @@ struct ibmvfc_target { + struct ibmvfc_host *vhost; + u64 scsi_id; + u64 wwpn; +- u64 old_scsi_id; ++ u64 new_scsi_id; + struct fc_rport *rport; + int target_id; + enum ibmvfc_target_action action; +-- +2.26.2 + diff --git a/patches.suse/scsi-ibmvfc-Reinit-target-retries.patch b/patches.suse/scsi-ibmvfc-Reinit-target-retries.patch new file mode 100644 index 0000000..fd843e8 --- /dev/null +++ b/patches.suse/scsi-ibmvfc-Reinit-target-retries.patch @@ -0,0 +1,68 @@ +From 2e51f78b5d8717bba243f5e857031b1d104a3577 Mon Sep 17 00:00:00 2001 +From: Brian King +Date: Tue, 11 May 2021 13:12:20 -0500 +Subject: [PATCH] scsi: ibmvfc: Reinit target retries + +References: bsc#1185938 ltc#192043 +Patch-mainline: queued +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git +Git-commit: 2e51f78b5d8717bba243f5e857031b1d104a3577 + +If rport target discovery commands fail for some reason, they get retried +up to a set number of retries. Once the retry limit is exceeded, the target +is deleted. In order to delete the target, we either need to do an implicit +logout or a move login. In the move login case, if the move login fails, we +want to retry it. This ensures the retry counter gets reinitialized so the +move login will get retried. + +Link: https://lore.kernel.org/r/1620756740-7045-4-git-send-email-brking@linux.vnet.ibm.com +Signed-off-by: Brian King +Signed-off-by: Martin K. Petersen +Acked-by: Michal Suchanek +--- + drivers/scsi/ibmvscsi/ibmvfc.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c +index c8d3fdf65a7f..a251dbf630cc 100644 +--- a/drivers/scsi/ibmvscsi/ibmvfc.c ++++ b/drivers/scsi/ibmvscsi/ibmvfc.c +@@ -654,8 +654,10 @@ static void ibmvfc_reinit_host(struct ibmvfc_host *vhost) + **/ + static void ibmvfc_del_tgt(struct ibmvfc_target *tgt) + { +- if (!ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_LOGOUT_RPORT)) ++ if (!ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_LOGOUT_RPORT)) { + tgt->job_step = ibmvfc_tgt_implicit_logout_and_del; ++ tgt->init_retries = 0; ++ } + wake_up(&tgt->vhost->work_wait_q); + } + +@@ -4744,6 +4746,7 @@ static int ibmvfc_alloc_target(struct ibmvfc_host *vhost, + */ + wtgt->new_scsi_id = scsi_id; + wtgt->action = IBMVFC_TGT_ACTION_INIT; ++ wtgt->init_retries = 0; + ibmvfc_init_tgt(wtgt, ibmvfc_tgt_move_login); + } + goto unlock_out; +@@ -5336,6 +5339,7 @@ static void ibmvfc_tgt_add_rport(struct ibmvfc_target *tgt) + tgt_dbg(tgt, "Deleting rport with outstanding I/O\n"); + ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_LOGOUT_DELETED_RPORT); + tgt->rport = NULL; ++ tgt->init_retries = 0; + spin_unlock_irqrestore(vhost->host->host_lock, flags); + fc_remote_port_delete(rport); + return; +@@ -5490,6 +5494,7 @@ static void ibmvfc_do_work(struct ibmvfc_host *vhost) + tgt_dbg(tgt, "Deleting rport with I/O outstanding\n"); + rport = tgt->rport; + tgt->rport = NULL; ++ tgt->init_retries = 0; + ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_LOGOUT_DELETED_RPORT); + + /* +-- +2.26.2 + diff --git a/patches.suse/scsi-libfc-Avoid-invoking-response-handler-twice-if-.patch b/patches.suse/scsi-libfc-Avoid-invoking-response-handler-twice-if-.patch new file mode 100644 index 0000000..e5c5c9d --- /dev/null +++ b/patches.suse/scsi-libfc-Avoid-invoking-response-handler-twice-if-.patch @@ -0,0 +1,88 @@ +From: Javed Hasan +Date: Tue, 15 Dec 2020 11:47:31 -0800 +Subject: scsi: libfc: Avoid invoking response handler twice if ep is already + completed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Patch-mainline: v5.11-rc5 +Git-commit: b2b0f16fa65e910a3ec8771206bb49ee87a54ac5 +References: bsc#1186573 + +A race condition exists between the response handler getting called because +of exchange_mgr_reset() (which clears out all the active XIDs) and the +response we get via an interrupt. + +Sequence of events: + + rport ba0200: Port timeout, state PLOGI + rport ba0200: Port entered PLOGI state from PLOGI state + xid 1052: Exchange timer armed : 20000 msecs  xid timer armed here + rport ba0200: Received LOGO request while in state PLOGI + rport ba0200: Delete port + rport ba0200: work event 3 + rport ba0200: lld callback ev 3 + bnx2fc: rport_event_hdlr: event = 3, port_id = 0xba0200 + bnx2fc: ba0200 - rport not created Yet!! + /* Here we reset any outstanding exchanges before + freeing rport using the exch_mgr_reset() */ + xid 1052: Exchange timer canceled + /* Here we got two responses for one xid */ + xid 1052: invoking resp(), esb 20000000 state 3 + xid 1052: invoking resp(), esb 20000000 state 3 + xid 1052: fc_rport_plogi_resp() : ep->resp_active 2 + xid 1052: fc_rport_plogi_resp() : ep->resp_active 2 + +Skip the response if the exchange is already completed. + +Link: https://lore.kernel.org/r/20201215194731.2326-1-jhasan@marvell.com +Signed-off-by: Javed Hasan +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/libfc/fc_exch.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/libfc/fc_exch.c ++++ b/drivers/scsi/libfc/fc_exch.c +@@ -1619,8 +1619,13 @@ static void fc_exch_recv_seq_resp(struct + rc = fc_exch_done_locked(ep); + WARN_ON(fc_seq_exch(sp) != ep); + spin_unlock_bh(&ep->ex_lock); +- if (!rc) ++ if (!rc) { + fc_exch_delete(ep); ++ } else { ++ FC_EXCH_DBG(ep, "ep is completed already," ++ "hence skip calling the resp\n"); ++ goto skip_resp; ++ } + } + + /* +@@ -1639,6 +1644,7 @@ static void fc_exch_recv_seq_resp(struct + if (!fc_invoke_resp(ep, sp, fp)) + fc_frame_free(fp); + ++skip_resp: + fc_exch_release(ep); + return; + rel: +@@ -1895,10 +1901,16 @@ static void fc_exch_reset(struct fc_exch + + fc_exch_hold(ep); + +- if (!rc) ++ if (!rc) { + fc_exch_delete(ep); ++ } else { ++ FC_EXCH_DBG(ep, "ep is completed already," ++ "hence skip calling the resp\n"); ++ goto skip_resp; ++ } + + fc_invoke_resp(ep, sp, ERR_PTR(-FC_EX_CLOSED)); ++skip_resp: + fc_seq_set_resp(sp, NULL, ep->arg); + fc_exch_release(ep); + } diff --git a/patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch b/patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch new file mode 100644 index 0000000..6cb548a --- /dev/null +++ b/patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch @@ -0,0 +1,210 @@ +From: James Smart +Date: Fri, 14 May 2021 12:55:57 -0700 +Subject: scsi: lpfc: Add a option to enable interlocked ABTS before job + completion +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git +Git-commit: 3e49af9393c6e59d579de13333514fc9660a0e92 +References: bsc#1186451 + +Default behavior for the driver, when aborting an I/O, is to terminate the +I/O with the adapter. The adapter will initiate an ABTS to terminate the +exchange on the link and mark the exchange is terminated so that no further +use of the sgl or any traffic for the exchange is worked on. Completion on +the Abort is then posted to the driver, which as the I/O is terminated can +complete the I/O to the OS. This completion may occur prior to the ABTS +handshake completing on the wire. The ABTS handshake can take a long time +to complete with timeouts and retries reaching 60+ seconds. Note: if +retries fail, LOGO occurs. + +Some devices want to ensure that the ABTS handshake fully completes (this +device has fully ack'd it) before the I/O completion is posted back to the +OS, where a failed I/O may be retried via a different path. + +To support this behavior, an option was added to the driver to change I/O +completion from the Abort cmd completion to the Exchange termination (aka +ABTS) completion. + +Link: https://lore.kernel.org/r/20210514195559.119853-10-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc.h | 1 + drivers/scsi/lpfc/lpfc_attr.c | 11 ++++++++++ + drivers/scsi/lpfc/lpfc_mbox.c | 3 +- + drivers/scsi/lpfc/lpfc_scsi.c | 45 ++++++++++++++++++++++++++++++++++++------ + 4 files changed, 53 insertions(+), 7 deletions(-) + +--- a/drivers/scsi/lpfc/lpfc.h ++++ b/drivers/scsi/lpfc/lpfc.h +@@ -915,6 +915,7 @@ struct lpfc_hba { + uint32_t cfg_request_firmware_upgrade; + uint32_t cfg_suppress_link_up; + uint32_t cfg_rrq_xri_bitmap_sz; ++ u32 cfg_fcp_wait_abts_rsp; + uint32_t cfg_delay_discovery; + uint32_t cfg_sli_mode; + #define LPFC_INITIALIZE_LINK 0 /* do normal init_link mbox */ +--- a/drivers/scsi/lpfc/lpfc_attr.c ++++ b/drivers/scsi/lpfc/lpfc_attr.c +@@ -3449,6 +3449,15 @@ LPFC_ATTR_R(fcf_failover_policy, 1, 1, 2 + "FCF Fast failover=1 Priority failover=2"); + + /* ++ * lpfc_fcp_wait_abts_rsp: Modifies criteria for reporting completion of ++ * aborted IO. ++ * The range is [0,1]. Default value is 0 ++ * 0, IO completes after ABTS issued (default). ++ * 1, IO completes after receipt of ABTS response or timeout. ++ */ ++LPFC_ATTR_R(fcp_wait_abts_rsp, 0, 0, 1, "Wait for FCP ABTS completion"); ++ ++/* + # lpfc_enable_rrq: Track XRI/OXID reuse after IO failures + # 0x0 = disabled, XRI/OXID use not tracked. + # 0x1 = XRI/OXID reuse is timed with ratov, RRQ sent. +@@ -6205,6 +6214,7 @@ struct device_attribute *lpfc_hba_attrs[ + &dev_attr_lpfc_enable_npiv, + &dev_attr_lpfc_fcf_failover_policy, + &dev_attr_lpfc_enable_rrq, ++ &dev_attr_lpfc_fcp_wait_abts_rsp, + &dev_attr_nport_evt_cnt, + &dev_attr_board_mode, + &dev_attr_max_vpi, +@@ -7332,6 +7342,7 @@ lpfc_get_cfgparam(struct lpfc_hba *phba) + lpfc_enable_npiv_init(phba, lpfc_enable_npiv); + lpfc_fcf_failover_policy_init(phba, lpfc_fcf_failover_policy); + lpfc_enable_rrq_init(phba, lpfc_enable_rrq); ++ lpfc_fcp_wait_abts_rsp_init(phba, lpfc_fcp_wait_abts_rsp); + lpfc_fdmi_on_init(phba, lpfc_fdmi_on); + lpfc_enable_SmartSAN_init(phba, lpfc_enable_SmartSAN); + lpfc_use_msi_init(phba, lpfc_use_msi); +--- a/drivers/scsi/lpfc/lpfc_mbox.c ++++ b/drivers/scsi/lpfc/lpfc_mbox.c +@@ -522,7 +522,8 @@ lpfc_init_link(struct lpfc_hba * phba, + } + + /* Enable asynchronous ABTS responses from firmware */ +- mb->un.varInitLnk.link_flags |= FLAGS_IMED_ABORT; ++ if (phba->sli_rev == LPFC_SLI_REV3 && !phba->cfg_fcp_wait_abts_rsp) ++ mb->un.varInitLnk.link_flags |= FLAGS_IMED_ABORT; + + /* NEW_FEATURE + * Setting up the link speed +--- a/drivers/scsi/lpfc/lpfc_scsi.c ++++ b/drivers/scsi/lpfc/lpfc_scsi.c +@@ -518,6 +518,7 @@ lpfc_sli4_io_xri_aborted(struct lpfc_hba + struct lpfc_nodelist *ndlp; + int rrq_empty = 0; + struct lpfc_sli_ring *pring = phba->sli4_hba.els_wq->pring; ++ struct scsi_cmnd *cmd; + + if (!(phba->cfg_enable_fc4_type & LPFC_ENABLE_FCP)) + return; +@@ -553,6 +554,31 @@ lpfc_sli4_io_xri_aborted(struct lpfc_hba + psb->cur_iocbq.sli4_lxritag, rxid, 1); + lpfc_sli4_abts_err_handler(phba, ndlp, axri); + } ++ ++ if (phba->cfg_fcp_wait_abts_rsp) { ++ spin_lock_irqsave(&psb->buf_lock, iflag); ++ cmd = psb->pCmd; ++ psb->pCmd = NULL; ++ spin_unlock_irqrestore(&psb->buf_lock, iflag); ++ ++ /* The sdev is not guaranteed to be valid post ++ * scsi_done upcall. ++ */ ++ if (cmd) ++ cmd->scsi_done(cmd); ++ ++ /* ++ * We expect there is an abort thread waiting ++ * for command completion wake up the thread. ++ */ ++ spin_lock_irqsave(&psb->buf_lock, iflag); ++ psb->cur_iocbq.iocb_flag &= ++ ~LPFC_DRIVER_ABORTED; ++ if (psb->waitq) ++ wake_up(psb->waitq); ++ spin_unlock_irqrestore(&psb->buf_lock, iflag); ++ } ++ + lpfc_release_scsi_buf_s4(phba, psb); + if (rrq_empty) + lpfc_worker_wake_up(phba); +@@ -780,7 +806,8 @@ lpfc_release_scsi_buf_s4(struct lpfc_hba + qp = psb->hdwq; + if (psb->flags & LPFC_SBUF_XBUSY) { + spin_lock_irqsave(&qp->abts_io_buf_list_lock, iflag); +- psb->pCmd = NULL; ++ if (!phba->cfg_fcp_wait_abts_rsp) ++ psb->pCmd = NULL; + list_add_tail(&psb->list, &qp->lpfc_abts_io_buf_list); + qp->abts_scsi_io_bufs++; + spin_unlock_irqrestore(&qp->abts_io_buf_list_lock, iflag); +@@ -4045,6 +4072,7 @@ lpfc_fcp_io_cmd_wqe_cmpl(struct lpfc_hba + u32 logit = LOG_FCP; + u32 status, idx; + unsigned long iflags = 0; ++ u8 wait_xb_clr = 0; + + /* Sanity check on return of outstanding command */ + if (!lpfc_cmd) { +@@ -4096,8 +4124,11 @@ lpfc_fcp_io_cmd_wqe_cmpl(struct lpfc_hba + lpfc_cmd->result = (wcqe->parameter & IOERR_PARAM_MASK); + + lpfc_cmd->flags &= ~LPFC_SBUF_XBUSY; +- if (bf_get(lpfc_wcqe_c_xb, wcqe)) ++ if (bf_get(lpfc_wcqe_c_xb, wcqe)) { + lpfc_cmd->flags |= LPFC_SBUF_XBUSY; ++ if (phba->cfg_fcp_wait_abts_rsp) ++ wait_xb_clr = 1; ++ } + + #ifdef CONFIG_SCSI_LPFC_DEBUG_FS + if (lpfc_cmd->prot_data_type) { +@@ -4329,6 +4360,8 @@ lpfc_fcp_io_cmd_wqe_cmpl(struct lpfc_hba + lpfc_io_ktime(phba, lpfc_cmd); + } + #endif ++ if (wait_xb_clr) ++ goto out; + lpfc_cmd->pCmd = NULL; + spin_unlock(&lpfc_cmd->buf_lock); + +@@ -4343,8 +4376,8 @@ lpfc_fcp_io_cmd_wqe_cmpl(struct lpfc_hba + lpfc_cmd->cur_iocbq.iocb_flag &= ~LPFC_DRIVER_ABORTED; + if (lpfc_cmd->waitq) + wake_up(lpfc_cmd->waitq); ++out: + spin_unlock(&lpfc_cmd->buf_lock); +- + lpfc_release_scsi_buf(phba, lpfc_cmd); + } + +@@ -4398,11 +4431,10 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba + + lpfc_cmd->result = (pIocbOut->iocb.un.ulpWord[4] & IOERR_PARAM_MASK); + lpfc_cmd->status = pIocbOut->iocb.ulpStatus; +- /* pick up SLI4 exhange busy status from HBA */ ++ /* pick up SLI4 exchange busy status from HBA */ ++ lpfc_cmd->flags &= ~LPFC_SBUF_XBUSY; + if (pIocbOut->iocb_flag & LPFC_EXCHANGE_BUSY) + lpfc_cmd->flags |= LPFC_SBUF_XBUSY; +- else +- lpfc_cmd->flags &= ~LPFC_SBUF_XBUSY; + + #ifdef CONFIG_SCSI_LPFC_DEBUG_FS + if (lpfc_cmd->prot_data_type) { +@@ -4601,6 +4633,7 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba + lpfc_io_ktime(phba, lpfc_cmd); + } + #endif ++ + /* The sdev is not guaranteed to be valid post scsi_done upcall. */ + cmd->scsi_done(cmd); + diff --git a/patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch b/patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch new file mode 100644 index 0000000..3b8cb6f --- /dev/null +++ b/patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch @@ -0,0 +1,91 @@ +From: James Smart +Date: Fri, 14 May 2021 12:55:52 -0700 +Subject: scsi: lpfc: Add ndlp kref accounting for resume RPI path +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git +Git-commit: 1037e4b4f81dc4ddf928e0ca2f1b182efdfdcc9d +References: bsc#1186451 + +The driver is crashing due to a bad pointer during driver load due in an +adisc acc receive routine. The driver is missing node get/put in the +mbx_resume_rpi paths. + +Fix by adding the proper gets and puts into the resume_rpi path. + +Link: https://lore.kernel.org/r/20210514195559.119853-5-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc_nportdisc.c | 4 ++++ + drivers/scsi/lpfc/lpfc_sli.c | 23 ++++++++++++++++++++++- + 2 files changed, 26 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/lpfc/lpfc_nportdisc.c ++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c +@@ -662,6 +662,10 @@ lpfc_mbx_cmpl_resume_rpi(struct lpfc_hba + lpfc_els_rsp_acc(vport, ELS_CMD_PLOGI, elsiocb, + ndlp, NULL); + } ++ ++ /* This nlp_put pairs with lpfc_sli4_resume_rpi */ ++ lpfc_nlp_put(ndlp); ++ + kfree(elsiocb); + mempool_free(mboxq, phba->mbox_mem_pool); + } +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -2679,6 +2679,12 @@ lpfc_sli_def_mbox_cmpl(struct lpfc_hba * + } + } + ++ /* This nlp_put pairs with lpfc_sli4_resume_rpi */ ++ if (pmb->u.mb.mbxCommand == MBX_RESUME_RPI) { ++ ndlp = (struct lpfc_nodelist *)pmb->ctx_ndlp; ++ lpfc_nlp_put(ndlp); ++ } ++ + /* Check security permission status on INIT_LINK mailbox command */ + if ((pmb->u.mb.mbxCommand == MBX_INIT_LINK) && + (pmb->u.mb.mbxStatus == MBXERR_SEC_NO_PERMISSION)) +@@ -19038,14 +19044,28 @@ lpfc_sli4_resume_rpi(struct lpfc_nodelis + if (!mboxq) + return -ENOMEM; + ++ /* If cmpl assigned, then this nlp_get pairs with ++ * lpfc_mbx_cmpl_resume_rpi. ++ * ++ * Else cmpl is NULL, then this nlp_get pairs with ++ * lpfc_sli_def_mbox_cmpl. ++ */ ++ if (!lpfc_nlp_get(ndlp)) { ++ lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, ++ "2122 %s: Failed to get nlp ref\n", ++ __func__); ++ mempool_free(mboxq, phba->mbox_mem_pool); ++ return -EIO; ++ } ++ + /* Post all rpi memory regions to the port. */ + lpfc_resume_rpi(mboxq, ndlp); + if (cmpl) { + mboxq->mbox_cmpl = cmpl; + mboxq->ctx_buf = arg; +- mboxq->ctx_ndlp = ndlp; + } else + mboxq->mbox_cmpl = lpfc_sli_def_mbox_cmpl; ++ mboxq->ctx_ndlp = ndlp; + mboxq->vport = ndlp->vport; + rc = lpfc_sli_issue_mbox(phba, mboxq, MBX_NOWAIT); + if (rc == MBX_NOT_FINISHED) { +@@ -19053,6 +19073,7 @@ lpfc_sli4_resume_rpi(struct lpfc_nodelis + "2010 Resume RPI Mailbox failed " + "status %d, mbxStatus x%x\n", rc, + bf_get(lpfc_mqe_status, &mboxq->u.mqe)); ++ lpfc_nlp_put(ndlp); + mempool_free(mboxq, phba->mbox_mem_pool); + return -EIO; + } diff --git a/patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch b/patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch new file mode 100644 index 0000000..b3cb0f6 --- /dev/null +++ b/patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch @@ -0,0 +1,73 @@ +From: James Smart +Date: Fri, 14 May 2021 12:55:53 -0700 +Subject: scsi: lpfc: Fix Node recovery when driver is handling simultaneous + PLOGIs +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git +Git-commit: 4012baeab6ca22b7f7beb121b6d0da0a62942fdd +References: bsc#1186451 + +When lpfc is handling a solicited and unsolicited PLOGI with another +initiator, the remote initiator is never recovered. The node for the +initiator is erroneouosly removed and all resources released. + +In lpfc_cmpl_els_plogi(), when lpfc_els_retry() returns a failure code, the +driver is calling the state machine with a device remove event because the +remote port is not currently registered with the SCSI or NVMe +transports. The issue is that on a PLOGI "collision" the driver correctly +aborts the solicited PLOGI and allows the unsolicited PLOGI to complete the +process, but this process is interrupted with a device_rm event. + +Introduce logic in the PLOGI completion to capture the PLOGI collision +event and jump out of the routine. This will avoid removal of the node. +If there is no collision, the normal node removal will occur. + +Fixes: 52edb2caf675 ("scsi: lpfc: Remove ndlp when a PLOGI/ADISC/PRLI/REG_RPI ultimately fails") +Cc: # v5.11+ +Link: https://lore.kernel.org/r/20210514195559.119853-6-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc_els.c | 21 ++++++++++++++++++--- + 1 file changed, 18 insertions(+), 3 deletions(-) + +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -2007,9 +2007,20 @@ lpfc_cmpl_els_plogi(struct lpfc_hba *phb + lpfc_disc_state_machine(vport, ndlp, cmdiocb, + NLP_EVT_CMPL_PLOGI); + +- /* As long as this node is not registered with the scsi or nvme +- * transport, it is no longer an active node. Otherwise +- * devloss handles the final cleanup. ++ /* If a PLOGI collision occurred, the node needs to continue ++ * with the reglogin process. ++ */ ++ spin_lock_irq(&ndlp->lock); ++ if ((ndlp->nlp_flag & (NLP_ACC_REGLOGIN | NLP_RCV_PLOGI)) && ++ ndlp->nlp_state == NLP_STE_REG_LOGIN_ISSUE) { ++ spin_unlock_irq(&ndlp->lock); ++ goto out; ++ } ++ spin_unlock_irq(&ndlp->lock); ++ ++ /* No PLOGI collision and the node is not registered with the ++ * scsi or nvme transport. It is no longer an active node. Just ++ * start the device remove process. + */ + if (!(ndlp->fc4_xpt_flags & (SCSI_XPT_REGD | NVME_XPT_REGD))) { + spin_lock_irq(&ndlp->lock); +@@ -4629,6 +4640,10 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, + (vport && vport->port_type == LPFC_NPIV_PORT) && + ndlp->nlp_flag & NLP_RELEASE_RPI) { + lpfc_sli4_free_rpi(phba, ndlp->nlp_rpi); ++ spin_lock_irq(&ndlp->lock); ++ ndlp->nlp_rpi = LPFC_RPI_ALLOC_ERROR; ++ ndlp->nlp_flag &= ~NLP_RELEASE_RPI; ++ spin_unlock_irq(&ndlp->lock); + lpfc_drop_node(vport, ndlp); + } + diff --git a/patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch b/patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch new file mode 100644 index 0000000..c19bb99 --- /dev/null +++ b/patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch @@ -0,0 +1,47 @@ +From: James Smart +Date: Fri, 14 May 2021 12:55:51 -0700 +Subject: scsi: lpfc: Fix "Unexpected timeout" error in direct attach topology +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git +Git-commit: e30d55137edef47434c40d7570276a0846fe922c +References: bsc#1186451 + +An 'unexpected timeout' message may be seen in a point-2-point topology. +The message occurs when a PLOGI is received before the driver is notified +of FLOGI completion. The FLOGI completion failure causes discovery to be +triggered for a second time. The discovery timer is restarted but no new +discovery activity is initiated, thus the timeout message eventually +appears. + +In point-2-point, when discovery has progressed before the FLOGI completion +is processed, it is not a failure. Add code to FLOGI completion to detect +that discovery has progressed and exit the FLOGI handling (noop'ing it). + +Link: https://lore.kernel.org/r/20210514195559.119853-4-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc_els.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -1175,6 +1175,15 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phb + phba->fcf.fcf_redisc_attempted = 0; /* reset */ + goto out; + } ++ } else if (vport->port_state > LPFC_FLOGI && ++ vport->fc_flag & FC_PT2PT) { ++ /* ++ * In a p2p topology, it is possible that discovery has ++ * already progressed, and this completion can be ignored. ++ * Recheck the indicated topology. ++ */ ++ if (!sp->cmn.fPort) ++ goto out; + } + + flogifail: diff --git a/patches.suse/scsi-lpfc-Fix-bad-memory-access-during-VPD-DUMP-mail.patch b/patches.suse/scsi-lpfc-Fix-bad-memory-access-during-VPD-DUMP-mail.patch new file mode 100644 index 0000000..cca2067 --- /dev/null +++ b/patches.suse/scsi-lpfc-Fix-bad-memory-access-during-VPD-DUMP-mail.patch @@ -0,0 +1,84 @@ +From: James Smart +Date: Wed, 21 Apr 2021 16:45:11 -0700 +Subject: scsi: lpfc: Fix bad memory access during VPD DUMP mailbox command +Patch-mainline: v5.13-rc1 +Git-commit: e4ec10228fdf09b88ba018009f14a696fb50d3f2 +References: bsc#1186451 + +The dump command for reading a region passes a requested read length +specified in words (4-byte units). The response overwrites the same field +with the actual number of bytes read. + +The mailbox handler for DUMP which reads VPD data (region 23) is treating +the response field as if it were still a word_cnt, thus multiplying it by 4 +to set the read's "length". Given the read value was calculated based on +the size of the read buffer, the longer response length runs off the end of +the buffer. + +Fix by reworking the code to use the response field as a byte count. + +Link: https://lore.kernel.org/r/20210421234511.102206-1-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc_init.c | 12 ++++++------ + drivers/scsi/lpfc/lpfc_sli.c | 15 ++++++++------- + 2 files changed, 14 insertions(+), 13 deletions(-) + +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -254,13 +254,13 @@ lpfc_config_port_prep(struct lpfc_hba *p + if (mb->un.varDmp.word_cnt == 0) + break; + +- i = mb->un.varDmp.word_cnt * sizeof(uint32_t); +- if (offset + i > DMP_VPD_SIZE) +- i = DMP_VPD_SIZE - offset; ++ if (mb->un.varDmp.word_cnt > DMP_VPD_SIZE - offset) ++ mb->un.varDmp.word_cnt = DMP_VPD_SIZE - offset; + lpfc_sli_pcimem_bcopy(((uint8_t *)mb) + DMP_RSP_OFFSET, +- lpfc_vpd_data + offset, i); +- offset += i; +- } while (offset < DMP_VPD_SIZE); ++ lpfc_vpd_data + offset, ++ mb->un.varDmp.word_cnt); ++ offset += mb->un.varDmp.word_cnt; ++ } while (mb->un.varDmp.word_cnt && offset < DMP_VPD_SIZE); + + lpfc_parse_vpd(phba, lpfc_vpd_data, offset); + +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -19777,7 +19777,7 @@ lpfc_sli_get_config_region23(struct lpfc + LPFC_MBOXQ_t *pmb = NULL; + MAILBOX_t *mb; + uint32_t offset = 0; +- int i, rc; ++ int rc; + + if (!rgn23_data) + return 0; +@@ -19808,13 +19808,14 @@ lpfc_sli_get_config_region23(struct lpfc + if (mb->un.varDmp.word_cnt == 0) + break; + +- i = mb->un.varDmp.word_cnt * sizeof(uint32_t); +- if (offset + i > DMP_RGN23_SIZE) +- i = DMP_RGN23_SIZE - offset; ++ if (mb->un.varDmp.word_cnt > DMP_RGN23_SIZE - offset) ++ mb->un.varDmp.word_cnt = DMP_RGN23_SIZE - offset; ++ + lpfc_sli_pcimem_bcopy(((uint8_t *)mb) + DMP_RSP_OFFSET, +- rgn23_data + offset, i); +- offset += i; +- } while (offset < DMP_RGN23_SIZE); ++ rgn23_data + offset, ++ mb->un.varDmp.word_cnt); ++ offset += mb->un.varDmp.word_cnt; ++ } while (mb->un.varDmp.word_cnt && offset < DMP_RGN23_SIZE); + + mempool_free(pmb, phba->mbox_mem_pool); + return offset; diff --git a/patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch b/patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch new file mode 100644 index 0000000..107846a --- /dev/null +++ b/patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch @@ -0,0 +1,49 @@ +From: James Smart +Date: Fri, 14 May 2021 12:55:56 -0700 +Subject: scsi: lpfc: Fix crash when lpfc_sli4_hba_setup() fails to initialize + the SGLs +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git +Git-commit: 5aa615d195f1e142c662cb2253f057c9baec7531 +References: bsc#1186451 + +The driver is encountering a crash in lpfc_free_iocb_list() while +performing initial attachment. + +Code review found this to be an errant failure path that was taken, jumping +to a tag that then referenced structures that were uninitialized. + +Fix the failure path. + +Link: https://lore.kernel.org/r/20210514195559.119853-9-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc_sli.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -7964,7 +7964,7 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phb + "0393 Error %d during rpi post operation\n", + rc); + rc = -ENODEV; +- goto out_destroy_queue; ++ goto out_free_iocblist; + } + lpfc_sli4_node_prep(phba); + +@@ -8130,8 +8130,9 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phb + out_unset_queue: + /* Unset all the queues set up in this routine when error out */ + lpfc_sli4_queue_unset(phba); +-out_destroy_queue: ++out_free_iocblist: + lpfc_free_iocb_list(phba); ++out_destroy_queue: + lpfc_sli4_queue_destroy(phba); + out_stop_timers: + lpfc_stop_hba_timers(phba); diff --git a/patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch b/patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch new file mode 100644 index 0000000..44b6758 --- /dev/null +++ b/patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch @@ -0,0 +1,383 @@ +From: James Smart +Date: Fri, 14 May 2021 12:55:54 -0700 +Subject: scsi: lpfc: Fix node handling for Fabric Controller and Domain + Controller +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git +Git-commit: fe83e3b9b422ac8ece2359c7b7290efe7f0335a2 +References: bsc#1186451 + +During link bounce testing, RPI counts were seen to differ from the number +of nodes. For fabric and domain controllers, a temporary RPI is assigned, +but the code isn't registering it. If the nodes do go away, such as on link +down, the temporary RPI isn't being released. + +Change the way these two fabric services are managed, make them behave like +any other remote port. Register the RPI and register with the transport. +Never leave the nodes in a NPR or UNUSED state where their RPI is in limbo. +This allows them to follow normal dev_loss_tmo handling, RPI refcounting, +and normal removal rules. It also allows fabric I/Os to use the RPI for +traffic requests. + +Note: There is some logic that still has a couple of exceptions when the +Domain controller (0xfffcXX). There are cases where the fabric won't have a +valid login but will send RDP. Other times, it will it send a LOGO then an +RDP. It makes for ad-hoc behavior to manage the node. Exceptions are +documented in the code. + +Link: https://lore.kernel.org/r/20210514195559.119853-7-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc_crtn.h | 1 + drivers/scsi/lpfc/lpfc_debugfs.c | 4 - + drivers/scsi/lpfc/lpfc_disc.h | 1 + drivers/scsi/lpfc/lpfc_els.c | 137 +++++++++++++++++++++++++++++++++---- + drivers/scsi/lpfc/lpfc_hbadisc.c | 54 +++++++++++++- + drivers/scsi/lpfc/lpfc_nportdisc.c | 11 ++ + drivers/scsi/lpfc/lpfc_sli.c | 1 + 7 files changed, 189 insertions(+), 20 deletions(-) + +--- a/drivers/scsi/lpfc/lpfc_crtn.h ++++ b/drivers/scsi/lpfc/lpfc_crtn.h +@@ -80,6 +80,7 @@ void lpfc_mbx_cmpl_reg_login(struct lpfc + void lpfc_mbx_cmpl_dflt_rpi(struct lpfc_hba *, LPFC_MBOXQ_t *); + void lpfc_mbx_cmpl_fabric_reg_login(struct lpfc_hba *, LPFC_MBOXQ_t *); + void lpfc_mbx_cmpl_ns_reg_login(struct lpfc_hba *, LPFC_MBOXQ_t *); ++void lpfc_mbx_cmpl_fc_reg_login(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb); + void lpfc_mbx_cmpl_fdmi_reg_login(struct lpfc_hba *, LPFC_MBOXQ_t *); + void lpfc_mbx_cmpl_reg_vfi(struct lpfc_hba *, LPFC_MBOXQ_t *); + void lpfc_unregister_vfi_cmpl(struct lpfc_hba *, LPFC_MBOXQ_t *); +--- a/drivers/scsi/lpfc/lpfc_debugfs.c ++++ b/drivers/scsi/lpfc/lpfc_debugfs.c +@@ -863,10 +863,10 @@ lpfc_debugfs_nodelist_data(struct lpfc_v + len += scnprintf(buf+len, size-len, "%s DID:x%06x ", + statep, ndlp->nlp_DID); + len += scnprintf(buf+len, size-len, +- "WWPN x%llx ", ++ "WWPN x%016llx ", + wwn_to_u64(ndlp->nlp_portname.u.wwn)); + len += scnprintf(buf+len, size-len, +- "WWNN x%llx ", ++ "WWNN x%016llx ", + wwn_to_u64(ndlp->nlp_nodename.u.wwn)); + len += scnprintf(buf+len, size-len, "RPI:x%04x ", + ndlp->nlp_rpi); +--- a/drivers/scsi/lpfc/lpfc_disc.h ++++ b/drivers/scsi/lpfc/lpfc_disc.h +@@ -86,6 +86,7 @@ enum lpfc_fc4_xpt_flags { + + struct lpfc_nodelist { + struct list_head nlp_listp; ++ struct serv_parm fc_sparam; /* buffer for service params */ + struct lpfc_name nlp_portname; + struct lpfc_name nlp_nodename; + +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -3086,6 +3086,95 @@ lpfc_cmpl_els_cmd(struct lpfc_hba *phba, + } + + /** ++ * lpfc_reg_fab_ctrl_node - RPI register the fabric controller node. ++ * @vport: pointer to lpfc_vport data structure. ++ * @fc_ndlp: pointer to the fabric controller (0xfffffd) node. ++ * ++ * This routine registers the rpi assigned to the fabric controller ++ * NPort_ID (0xfffffd) with the port and moves the node to UNMAPPED ++ * state triggering a registration with the SCSI transport. ++ * ++ * This routine is single out because the fabric controller node ++ * does not receive a PLOGI. This routine is consumed by the ++ * SCR and RDF ELS commands. Callers are expected to qualify ++ * with SLI4 first. ++ **/ ++static int ++lpfc_reg_fab_ctrl_node(struct lpfc_vport *vport, struct lpfc_nodelist *fc_ndlp) ++{ ++ int rc = 0; ++ struct lpfc_hba *phba = vport->phba; ++ struct lpfc_nodelist *ns_ndlp; ++ LPFC_MBOXQ_t *mbox; ++ struct lpfc_dmabuf *mp; ++ ++ if (fc_ndlp->nlp_flag & NLP_RPI_REGISTERED) ++ return rc; ++ ++ ns_ndlp = lpfc_findnode_did(vport, NameServer_DID); ++ if (!ns_ndlp) ++ return -ENODEV; ++ ++ lpfc_printf_vlog(vport, KERN_INFO, LOG_NODE, ++ "0935 %s: Reg FC RPI x%x on FC DID x%x NSSte: x%x\n", ++ __func__, fc_ndlp->nlp_rpi, fc_ndlp->nlp_DID, ++ ns_ndlp->nlp_state); ++ if (ns_ndlp->nlp_state != NLP_STE_UNMAPPED_NODE) ++ return -ENODEV; ++ ++ mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL); ++ if (!mbox) { ++ lpfc_printf_vlog(vport, KERN_ERR, LOG_NODE, ++ "0936 %s: no memory for reg_login " ++ "Data: x%x x%x x%x x%x\n", __func__, ++ fc_ndlp->nlp_DID, fc_ndlp->nlp_state, ++ fc_ndlp->nlp_flag, fc_ndlp->nlp_rpi); ++ return -ENOMEM; ++ } ++ rc = lpfc_reg_rpi(phba, vport->vpi, fc_ndlp->nlp_DID, ++ (u8 *)&vport->fc_sparam, mbox, fc_ndlp->nlp_rpi); ++ if (rc) { ++ rc = -EACCES; ++ goto out; ++ } ++ ++ fc_ndlp->nlp_flag |= NLP_REG_LOGIN_SEND; ++ mbox->mbox_cmpl = lpfc_mbx_cmpl_fc_reg_login; ++ mbox->ctx_ndlp = lpfc_nlp_get(fc_ndlp); ++ if (!mbox->ctx_ndlp) { ++ rc = -ENOMEM; ++ goto out_mem; ++ } ++ ++ mbox->vport = vport; ++ rc = lpfc_sli_issue_mbox(phba, mbox, MBX_NOWAIT); ++ if (rc == MBX_NOT_FINISHED) { ++ rc = -ENODEV; ++ lpfc_nlp_put(fc_ndlp); ++ goto out_mem; ++ } ++ /* Success path. Exit. */ ++ lpfc_nlp_set_state(vport, fc_ndlp, ++ NLP_STE_REG_LOGIN_ISSUE); ++ return 0; ++ ++ out_mem: ++ fc_ndlp->nlp_flag &= ~NLP_REG_LOGIN_SEND; ++ mp = (struct lpfc_dmabuf *)mbox->ctx_buf; ++ lpfc_mbuf_free(phba, mp->virt, mp->phys); ++ kfree(mp); ++ ++ out: ++ mempool_free(mbox, phba->mbox_mem_pool); ++ lpfc_printf_vlog(vport, KERN_ERR, LOG_NODE, ++ "0938 %s: failed to format reg_login " ++ "Data: x%x x%x x%x x%x\n", __func__, ++ fc_ndlp->nlp_DID, fc_ndlp->nlp_state, ++ fc_ndlp->nlp_flag, fc_ndlp->nlp_rpi); ++ return rc; ++} ++ ++/** + * lpfc_cmpl_els_disc_cmd - Completion callback function for Discovery ELS cmd + * @phba: pointer to lpfc hba data structure. + * @cmdiocb: pointer to lpfc command iocb data structure. +@@ -3231,10 +3320,18 @@ lpfc_issue_els_scr(struct lpfc_vport *vp + + elsiocb = lpfc_prep_els_iocb(vport, 1, cmdsize, retry, ndlp, + ndlp->nlp_DID, ELS_CMD_SCR); +- + if (!elsiocb) + return 1; + ++ if (phba->sli_rev == LPFC_SLI_REV4) { ++ rc = lpfc_reg_fab_ctrl_node(vport, ndlp); ++ if (rc) { ++ lpfc_printf_vlog(vport, KERN_ERR, LOG_NODE, ++ "0937 %s: Failed to reg fc node, rc %d\n", ++ __func__, rc); ++ return 1; ++ } ++ } + pcmd = (uint8_t *) (((struct lpfc_dmabuf *) elsiocb->context2)->virt); + + *((uint32_t *) (pcmd)) = ELS_CMD_SCR; +@@ -3522,6 +3619,17 @@ lpfc_issue_els_rdf(struct lpfc_vport *vp + if (!elsiocb) + return -ENOMEM; + ++ if (phba->sli_rev == LPFC_SLI_REV4 && ++ !(ndlp->nlp_flag & NLP_RPI_REGISTERED)) { ++ lpfc_printf_vlog(vport, KERN_ERR, LOG_NODE, ++ "0939 %s: FC_NODE x%x RPI x%x flag x%x " ++ "ste x%x type x%x Not registered\n", ++ __func__, ndlp->nlp_DID, ndlp->nlp_rpi, ++ ndlp->nlp_flag, ndlp->nlp_state, ++ ndlp->nlp_type); ++ return -ENODEV; ++ } ++ + /* Configure the payload for the supported FPIN events. */ + prdf = (struct lpfc_els_rdf_req *) + (((struct lpfc_dmabuf *)elsiocb->context2)->virt); +@@ -4396,7 +4504,6 @@ lpfc_cmpl_els_logo_acc(struct lpfc_hba * + struct lpfc_nodelist *ndlp = (struct lpfc_nodelist *) cmdiocb->context1; + struct lpfc_vport *vport = cmdiocb->vport; + IOCB_t *irsp; +- u32 xpt_flags = 0, did_mask = 0; + + irsp = &rspiocb->iocb; + lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_RSP, +@@ -4409,6 +4516,15 @@ lpfc_cmpl_els_logo_acc(struct lpfc_hba * + ndlp->nlp_DID, kref_read(&ndlp->kref), ndlp->nlp_flag, + ndlp->nlp_state, ndlp->nlp_rpi); + ++ /* This clause allows the LOGO ACC to complete and free resources ++ * for the Fabric Domain Controller. It does deliberately skip ++ * the unreg_rpi and release rpi because some fabrics send RDP ++ * requests after logging out from the initiator. ++ */ ++ if (ndlp->nlp_type & NLP_FABRIC && ++ ((ndlp->nlp_DID & WELL_KNOWN_DID_MASK) != WELL_KNOWN_DID_MASK)) ++ goto out; ++ + if (ndlp->nlp_state == NLP_STE_NPR_NODE) { + /* NPort Recovery mode or node is just allocated */ + if (!lpfc_nlp_not_used(ndlp)) { +@@ -4416,16 +4532,11 @@ lpfc_cmpl_els_logo_acc(struct lpfc_hba * + * If this a fabric node that cleared its transport + * registration, release the rpi. + */ +- xpt_flags = SCSI_XPT_REGD | NVME_XPT_REGD; +- did_mask = ndlp->nlp_DID & Fabric_DID_MASK; +- if (did_mask == Fabric_DID_MASK && +- !(ndlp->fc4_xpt_flags & xpt_flags)) { +- spin_lock_irq(&ndlp->lock); +- ndlp->nlp_flag &= ~NLP_NPR_2B_DISC; +- if (phba->sli_rev == LPFC_SLI_REV4) +- ndlp->nlp_flag |= NLP_RELEASE_RPI; +- spin_unlock_irq(&ndlp->lock); +- } ++ spin_lock_irq(&ndlp->lock); ++ ndlp->nlp_flag &= ~NLP_NPR_2B_DISC; ++ if (phba->sli_rev == LPFC_SLI_REV4) ++ ndlp->nlp_flag |= NLP_RELEASE_RPI; ++ spin_unlock_irq(&ndlp->lock); + lpfc_unreg_rpi(vport, ndlp); + } else { + /* Indicate the node has already released, should +@@ -4434,7 +4545,7 @@ lpfc_cmpl_els_logo_acc(struct lpfc_hba * + cmdiocb->context1 = NULL; + } + } +- ++ out: + /* + * The driver received a LOGO from the rport and has ACK'd it. + * At this point, the driver is done so release the IOCB +--- a/drivers/scsi/lpfc/lpfc_hbadisc.c ++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c +@@ -77,9 +77,7 @@ static int + lpfc_valid_xpt_node(struct lpfc_nodelist *ndlp) + { + if (ndlp->nlp_fc4_type || +- ndlp->nlp_DID == Fabric_DID || +- ndlp->nlp_DID == NameServer_DID || +- ndlp->nlp_DID == FDMI_DID) ++ ndlp->nlp_type & NLP_FABRIC) + return 1; + return 0; + } +@@ -826,7 +824,8 @@ lpfc_cleanup_rpis(struct lpfc_vport *vpo + if ((phba->sli3_options & LPFC_SLI3_VPORT_TEARDOWN) || + ((vport->port_type == LPFC_NPIV_PORT) && + ((ndlp->nlp_DID == NameServer_DID) || +- (ndlp->nlp_DID == FDMI_DID)))) ++ (ndlp->nlp_DID == FDMI_DID) || ++ (ndlp->nlp_DID == Fabric_Cntl_DID)))) + lpfc_unreg_rpi(vport, ndlp); + + /* Leave Fabric nodes alone on link down */ +@@ -4161,6 +4160,53 @@ lpfc_mbx_cmpl_ns_reg_login(struct lpfc_h + return; + } + ++/* ++ * This routine handles processing a Fabric Controller REG_LOGIN mailbox ++ * command upon completion. It is setup in the LPFC_MBOXQ ++ * as the completion routine when the command is handed off to the SLI layer. ++ */ ++void ++lpfc_mbx_cmpl_fc_reg_login(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb) ++{ ++ struct lpfc_vport *vport = pmb->vport; ++ MAILBOX_t *mb = &pmb->u.mb; ++ struct lpfc_dmabuf *mp = (struct lpfc_dmabuf *)(pmb->ctx_buf); ++ struct lpfc_nodelist *ndlp; ++ ++ ndlp = (struct lpfc_nodelist *)pmb->ctx_ndlp; ++ pmb->ctx_ndlp = NULL; ++ pmb->ctx_buf = NULL; ++ ++ if (mb->mbxStatus) { ++ lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, ++ "0933 %s: Register FC login error: 0x%x\n", ++ __func__, mb->mbxStatus); ++ goto out; ++ } ++ ++ if (phba->sli_rev < LPFC_SLI_REV4) ++ ndlp->nlp_rpi = mb->un.varWords[0]; ++ ++ lpfc_printf_vlog(vport, KERN_INFO, LOG_NODE, ++ "0934 %s: Complete FC x%x RegLogin rpi x%x ste x%x\n", ++ __func__, ndlp->nlp_DID, ndlp->nlp_rpi, ++ ndlp->nlp_state); ++ ++ ndlp->nlp_flag |= NLP_RPI_REGISTERED; ++ ndlp->nlp_type |= NLP_FABRIC; ++ lpfc_nlp_set_state(vport, ndlp, NLP_STE_UNMAPPED_NODE); ++ ++ out: ++ lpfc_mbuf_free(phba, mp->virt, mp->phys); ++ kfree(mp); ++ mempool_free(pmb, phba->mbox_mem_pool); ++ ++ /* Drop the reference count from the mbox at the end after ++ * all the current reference to the ndlp have been done. ++ */ ++ lpfc_nlp_put(ndlp); ++} ++ + static void + lpfc_register_remote_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp) + { +--- a/drivers/scsi/lpfc/lpfc_nportdisc.c ++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c +@@ -785,6 +785,15 @@ lpfc_rcv_logo(struct lpfc_vport *vport, + else + lpfc_els_rsp_acc(vport, ELS_CMD_ACC, cmdiocb, ndlp, NULL); + ++ /* This clause allows the initiator to ACC the LOGO back to the ++ * Fabric Domain Controller. It does deliberately skip all other ++ * steps because some fabrics send RDP requests after logging out ++ * from the initiator. ++ */ ++ if (ndlp->nlp_type & NLP_FABRIC && ++ ((ndlp->nlp_DID & WELL_KNOWN_DID_MASK) != WELL_KNOWN_DID_MASK)) ++ return 0; ++ + /* Notify transport of connectivity loss to trigger cleanup. */ + if (phba->nvmet_support && + ndlp->nlp_state == NLP_STE_UNMAPPED_NODE) +@@ -1423,6 +1432,8 @@ lpfc_cmpl_plogi_plogi_issue(struct lpfc_ + switch (ndlp->nlp_DID) { + case NameServer_DID: + mbox->mbox_cmpl = lpfc_mbx_cmpl_ns_reg_login; ++ /* Fabric Controller Node needs these parameters. */ ++ memcpy(&ndlp->fc_sparam, sp, sizeof(struct serv_parm)); + break; + case FDMI_DID: + mbox->mbox_cmpl = lpfc_mbx_cmpl_fdmi_reg_login; +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -2755,7 +2755,6 @@ lpfc_sli4_unreg_rpi_cmpl_clr(struct lpfc + } else { + __lpfc_sli_rpi_release(vport, ndlp); + } +- + lpfc_nlp_put(ndlp); + } + } diff --git a/patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch b/patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch new file mode 100644 index 0000000..93965c3 --- /dev/null +++ b/patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch @@ -0,0 +1,50 @@ +From: James Smart +Date: Fri, 14 May 2021 12:55:50 -0700 +Subject: scsi: lpfc: Fix non-optimized ERSP handling +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git +Git-commit: fa21189db9ab022080e056cc6da219975da48fd6 +References: bsc#1186451 + +When processing an NVMe ERSP IU which didn't match the optimized CQE-only +path, the status was being left to the WQE status. WQE status is non-zero +as it is indicating a non-optimized completion that needs to be handled by +the driver. + +Fix by clearing the status field when falling into the non-optimized +case. Log message added to track optimized vs non-optimized debug. + +Link: https://lore.kernel.org/r/20210514195559.119853-3-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc_nvme.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/lpfc/lpfc_nvme.c ++++ b/drivers/scsi/lpfc/lpfc_nvme.c +@@ -1049,9 +1049,19 @@ lpfc_nvme_io_cmd_wqe_cmpl(struct lpfc_hb + nCmd->transferred_length = wcqe->total_data_placed; + nCmd->rcv_rsplen = wcqe->parameter; + nCmd->status = 0; +- /* Sanity check */ +- if (nCmd->rcv_rsplen == LPFC_NVME_ERSP_LEN) ++ ++ /* Check if this is really an ERSP */ ++ if (nCmd->rcv_rsplen == LPFC_NVME_ERSP_LEN) { ++ lpfc_ncmd->status = IOSTAT_SUCCESS; ++ lpfc_ncmd->result = 0; ++ ++ lpfc_printf_vlog(vport, KERN_INFO, LOG_NVME, ++ "6084 NVME Completion ERSP: " ++ "xri %x placed x%x\n", ++ lpfc_ncmd->cur_iocbq.sli4_xritag, ++ wcqe->total_data_placed); + break; ++ } + lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, + "6081 NVME Completion Protocol Error: " + "xri %x status x%x result x%x " diff --git a/patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch b/patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch new file mode 100644 index 0000000..60be11d --- /dev/null +++ b/patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch @@ -0,0 +1,363 @@ +From: James Smart +Date: Fri, 14 May 2021 12:55:49 -0700 +Subject: scsi: lpfc: Fix unreleased RPIs when NPIV ports are created +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git +Git-commit: 01131e7aae5d30e23e3cdd1eebe51bbc5489ae8f +References: bsc#1186451 + +While testing NPIV and watching logins and used RPI levels, it was seen the +used RPI count was much higher than the number of remote ports discovered. + +Code inspection showed that remote port removals on any NPIV instance are +releasing the RPI, but not performing an UNREG_RPI with the adapter thus +the reference counting never fully drops and the RPI is never fully +released. This was happening on NPIV nodes due to a log of fabric ELS's to +fabric addresses. This lack of UNREG_RPI was introduced by a prior node +rework patch that performed the UNREG_RPI as part of node cleanup. + +To resolve the issue, do the following: + + - Restore the RPI release code, but move the location to so that it is in + line with the new node cleanup design. + + - NPIV ports now release the RPI and drop the node when the caller sets + the NLP_RELEASE_RPI flag. + + - Set the NLP_RELEASE_RPI flag in node cleanup which will trigger a + release of RPI to free pool. + + - Ensure there's an UNREG_RPI at LOGO completion so that RPI release is + completed. + + - Stop offline_prep from skipping nodes that are UNUSED. The RPI may + not have been released. + + - Stop the default RPI handling in lpfc_cmpl_els_rsp() for SLI4. + + - Fixed up debugfs RPI displays for better debugging. + +Fixes: a70e63eee1c1 ("scsi: lpfc: Fix NPIV Fabric Node reference counting") +Link: https://lore.kernel.org/r/20210514195559.119853-2-jsmart2021@gmail.com +Cc: # v5.11+ +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc_debugfs.c | 7 --- + drivers/scsi/lpfc/lpfc_els.c | 79 +++++++++++++++++++++++++++++-------- + drivers/scsi/lpfc/lpfc_hbadisc.c | 27 +++++++++++- + drivers/scsi/lpfc/lpfc_init.c | 7 --- + drivers/scsi/lpfc/lpfc_nportdisc.c | 25 +++++++---- + drivers/scsi/lpfc/lpfc_sli.c | 10 +++- + 6 files changed, 115 insertions(+), 40 deletions(-) + +--- a/drivers/scsi/lpfc/lpfc_debugfs.c ++++ b/drivers/scsi/lpfc/lpfc_debugfs.c +@@ -868,11 +868,8 @@ lpfc_debugfs_nodelist_data(struct lpfc_v + len += scnprintf(buf+len, size-len, + "WWNN x%llx ", + wwn_to_u64(ndlp->nlp_nodename.u.wwn)); +- if (ndlp->nlp_flag & NLP_RPI_REGISTERED) +- len += scnprintf(buf+len, size-len, "RPI:%04d ", +- ndlp->nlp_rpi); +- else +- len += scnprintf(buf+len, size-len, "RPI:none "); ++ len += scnprintf(buf+len, size-len, "RPI:x%04x ", ++ ndlp->nlp_rpi); + len += scnprintf(buf+len, size-len, "flag:x%08x ", + ndlp->nlp_flag); + if (!ndlp->nlp_type) +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -2869,6 +2869,11 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba + * log into the remote port. + */ + if (ndlp->nlp_flag & NLP_TARGET_REMOVE) { ++ spin_lock_irq(&ndlp->lock); ++ if (phba->sli_rev == LPFC_SLI_REV4) ++ ndlp->nlp_flag |= NLP_RELEASE_RPI; ++ ndlp->nlp_flag &= ~NLP_NPR_2B_DISC; ++ spin_unlock_irq(&ndlp->lock); + lpfc_disc_state_machine(vport, ndlp, cmdiocb, + NLP_EVT_DEVICE_RM); + lpfc_els_free_iocb(phba, cmdiocb); +@@ -4371,6 +4376,7 @@ lpfc_cmpl_els_logo_acc(struct lpfc_hba * + struct lpfc_nodelist *ndlp = (struct lpfc_nodelist *) cmdiocb->context1; + struct lpfc_vport *vport = cmdiocb->vport; + IOCB_t *irsp; ++ u32 xpt_flags = 0, did_mask = 0; + + irsp = &rspiocb->iocb; + lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_RSP, +@@ -4386,9 +4392,20 @@ lpfc_cmpl_els_logo_acc(struct lpfc_hba * + if (ndlp->nlp_state == NLP_STE_NPR_NODE) { + /* NPort Recovery mode or node is just allocated */ + if (!lpfc_nlp_not_used(ndlp)) { +- /* If the ndlp is being used by another discovery +- * thread, just unregister the RPI. ++ /* A LOGO is completing and the node is in NPR state. ++ * If this a fabric node that cleared its transport ++ * registration, release the rpi. + */ ++ xpt_flags = SCSI_XPT_REGD | NVME_XPT_REGD; ++ did_mask = ndlp->nlp_DID & Fabric_DID_MASK; ++ if (did_mask == Fabric_DID_MASK && ++ !(ndlp->fc4_xpt_flags & xpt_flags)) { ++ spin_lock_irq(&ndlp->lock); ++ ndlp->nlp_flag &= ~NLP_NPR_2B_DISC; ++ if (phba->sli_rev == LPFC_SLI_REV4) ++ ndlp->nlp_flag |= NLP_RELEASE_RPI; ++ spin_unlock_irq(&ndlp->lock); ++ } + lpfc_unreg_rpi(vport, ndlp); + } else { + /* Indicate the node has already released, should +@@ -4424,28 +4441,37 @@ lpfc_mbx_cmpl_dflt_rpi(struct lpfc_hba * + { + struct lpfc_dmabuf *mp = (struct lpfc_dmabuf *)(pmb->ctx_buf); + struct lpfc_nodelist *ndlp = (struct lpfc_nodelist *)pmb->ctx_ndlp; ++ u32 mbx_flag = pmb->mbox_flag; ++ u32 mbx_cmd = pmb->u.mb.mbxCommand; + + pmb->ctx_buf = NULL; + pmb->ctx_ndlp = NULL; + +- lpfc_mbuf_free(phba, mp->virt, mp->phys); +- kfree(mp); +- mempool_free(pmb, phba->mbox_mem_pool); + if (ndlp) { + lpfc_printf_vlog(ndlp->vport, KERN_INFO, LOG_NODE, +- "0006 rpi x%x DID:%x flg:%x %d x%px\n", ++ "0006 rpi x%x DID:%x flg:%x %d x%px " ++ "mbx_cmd x%x mbx_flag x%x x%px\n", + ndlp->nlp_rpi, ndlp->nlp_DID, ndlp->nlp_flag, +- kref_read(&ndlp->kref), +- ndlp); +- /* This is the end of the default RPI cleanup logic for +- * this ndlp and it could get released. Clear the nlp_flags to +- * prevent any further processing. ++ kref_read(&ndlp->kref), ndlp, mbx_cmd, ++ mbx_flag, pmb); ++ ++ /* This ends the default/temporary RPI cleanup logic for this ++ * ndlp and the node and rpi needs to be released. Free the rpi ++ * first on an UNREG_LOGIN and then release the final ++ * references. + */ ++ spin_lock_irq(&ndlp->lock); + ndlp->nlp_flag &= ~NLP_REG_LOGIN_SEND; ++ if (mbx_cmd == MBX_UNREG_LOGIN) ++ ndlp->nlp_flag &= ~NLP_UNREG_INP; ++ spin_unlock_irq(&ndlp->lock); + lpfc_nlp_put(ndlp); +- lpfc_nlp_not_used(ndlp); ++ lpfc_drop_node(ndlp->vport, ndlp); + } + ++ lpfc_mbuf_free(phba, mp->virt, mp->phys); ++ kfree(mp); ++ mempool_free(pmb, phba->mbox_mem_pool); + return; + } + +@@ -4503,11 +4529,11 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, + /* ELS response tag completes */ + lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, + "0110 ELS response tag x%x completes " +- "Data: x%x x%x x%x x%x x%x x%x x%x\n", ++ "Data: x%x x%x x%x x%x x%x x%x x%x x%x x%px\n", + cmdiocb->iocb.ulpIoTag, rspiocb->iocb.ulpStatus, + rspiocb->iocb.un.ulpWord[4], rspiocb->iocb.ulpTimeout, + ndlp->nlp_DID, ndlp->nlp_flag, ndlp->nlp_state, +- ndlp->nlp_rpi); ++ ndlp->nlp_rpi, kref_read(&ndlp->kref), mbox); + if (mbox) { + if ((rspiocb->iocb.ulpStatus == 0) && + (ndlp->nlp_flag & NLP_ACC_REGLOGIN)) { +@@ -4587,6 +4613,16 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, + spin_unlock_irq(&ndlp->lock); + } + ++ /* An SLI4 NPIV instance wants to drop the node at this point under ++ * these conditions and release the RPI. ++ */ ++ if (phba->sli_rev == LPFC_SLI_REV4 && ++ (vport && vport->port_type == LPFC_NPIV_PORT) && ++ ndlp->nlp_flag & NLP_RELEASE_RPI) { ++ lpfc_sli4_free_rpi(phba, ndlp->nlp_rpi); ++ lpfc_drop_node(vport, ndlp); ++ } ++ + /* Release the originating I/O reference. */ + lpfc_els_free_iocb(phba, cmdiocb); + lpfc_nlp_put(ndlp); +@@ -4775,10 +4811,10 @@ lpfc_els_rsp_acc(struct lpfc_vport *vpor + lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, + "0128 Xmit ELS ACC response Status: x%x, IoTag: x%x, " + "XRI: x%x, DID: x%x, nlp_flag: x%x nlp_state: x%x " +- "RPI: x%x, fc_flag x%x\n", ++ "RPI: x%x, fc_flag x%x refcnt %d\n", + rc, elsiocb->iotag, elsiocb->sli4_xritag, + ndlp->nlp_DID, ndlp->nlp_flag, ndlp->nlp_state, +- ndlp->nlp_rpi, vport->fc_flag); ++ ndlp->nlp_rpi, vport->fc_flag, kref_read(&ndlp->kref)); + return 0; + } + +@@ -4856,6 +4892,17 @@ lpfc_els_rsp_reject(struct lpfc_vport *v + return 1; + } + ++ /* The NPIV instance is rejecting this unsolicited ELS. Make sure the ++ * node's assigned RPI needs to be released as this node will get ++ * freed. ++ */ ++ if (phba->sli_rev == LPFC_SLI_REV4 && ++ vport->port_type == LPFC_NPIV_PORT) { ++ spin_lock_irq(&ndlp->lock); ++ ndlp->nlp_flag |= NLP_RELEASE_RPI; ++ spin_unlock_irq(&ndlp->lock); ++ } ++ + rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, elsiocb, 0); + if (rc == IOCB_ERROR) { + lpfc_els_free_iocb(phba, elsiocb); +--- a/drivers/scsi/lpfc/lpfc_hbadisc.c ++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c +@@ -4791,12 +4791,17 @@ lpfc_nlp_logo_unreg(struct lpfc_hba *phb + ndlp->nlp_defer_did = NLP_EVT_NOTHING_PENDING; + lpfc_issue_els_plogi(vport, ndlp->nlp_DID, 0); + } else { ++ /* NLP_RELEASE_RPI is only set for SLI4 ports. */ + if (ndlp->nlp_flag & NLP_RELEASE_RPI) { + lpfc_sli4_free_rpi(vport->phba, ndlp->nlp_rpi); ++ spin_lock_irq(&ndlp->lock); + ndlp->nlp_flag &= ~NLP_RELEASE_RPI; + ndlp->nlp_rpi = LPFC_RPI_ALLOC_ERROR; ++ spin_unlock_irq(&ndlp->lock); + } ++ spin_lock_irq(&ndlp->lock); + ndlp->nlp_flag &= ~NLP_UNREG_INP; ++ spin_unlock_irq(&ndlp->lock); + } + } + +@@ -5131,8 +5136,10 @@ lpfc_cleanup_node(struct lpfc_vport *vpo + list_del_init(&ndlp->dev_loss_evt.evt_listp); + list_del_init(&ndlp->recovery_evt.evt_listp); + lpfc_cleanup_vports_rrqs(vport, ndlp); ++ + if (phba->sli_rev == LPFC_SLI_REV4) + ndlp->nlp_flag |= NLP_RELEASE_RPI; ++ + return 0; + } + +@@ -6178,8 +6185,23 @@ lpfc_nlp_release(struct kref *kref) + lpfc_cancel_retry_delay_tmo(vport, ndlp); + lpfc_cleanup_node(vport, ndlp); + +- /* Clear Node key fields to give other threads notice +- * that this node memory is not valid anymore. ++ /* Not all ELS transactions have registered the RPI with the port. ++ * In these cases the rpi usage is temporary and the node is ++ * released when the WQE is completed. Catch this case to free the ++ * RPI to the pool. Because this node is in the release path, a lock ++ * is unnecessary. All references are gone and the node has been ++ * dequeued. ++ */ ++ if (ndlp->nlp_flag & NLP_RELEASE_RPI) { ++ if (ndlp->nlp_rpi != LPFC_RPI_ALLOC_ERROR && ++ !(ndlp->nlp_flag & (NLP_RPI_REGISTERED | NLP_UNREG_INP))) { ++ lpfc_sli4_free_rpi(vport->phba, ndlp->nlp_rpi); ++ ndlp->nlp_rpi = LPFC_RPI_ALLOC_ERROR; ++ } ++ } ++ ++ /* The node is not freed back to memory, it is released to a pool so ++ * the node fields need to be cleaned up. + */ + ndlp->vport = NULL; + ndlp->nlp_state = NLP_STE_FREED_NODE; +@@ -6259,6 +6281,7 @@ lpfc_nlp_not_used(struct lpfc_nodelist * + "node not used: did:x%x flg:x%x refcnt:x%x", + ndlp->nlp_DID, ndlp->nlp_flag, + kref_read(&ndlp->kref)); ++ + if (kref_read(&ndlp->kref) == 1) + if (lpfc_nlp_put(ndlp)) + return 1; +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -3532,13 +3532,6 @@ lpfc_offline_prep(struct lpfc_hba *phba, + list_for_each_entry_safe(ndlp, next_ndlp, + &vports[i]->fc_nodes, + nlp_listp) { +- if (ndlp->nlp_state == NLP_STE_UNUSED_NODE) { +- /* Driver must assume RPI is invalid for +- * any unused or inactive node. +- */ +- ndlp->nlp_rpi = LPFC_RPI_ALLOC_ERROR; +- continue; +- } + + spin_lock_irq(&ndlp->lock); + ndlp->nlp_flag &= ~NLP_NPR_ADISC; +--- a/drivers/scsi/lpfc/lpfc_nportdisc.c ++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c +@@ -567,15 +567,24 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, + /* no deferred ACC */ + kfree(save_iocb); + +- /* In order to preserve RPIs, we want to cleanup +- * the default RPI the firmware created to rcv +- * this ELS request. The only way to do this is +- * to register, then unregister the RPI. ++ /* This is an NPIV SLI4 instance that does not need to register ++ * a default RPI. + */ +- spin_lock_irq(&ndlp->lock); +- ndlp->nlp_flag |= (NLP_RM_DFLT_RPI | NLP_ACC_REGLOGIN | +- NLP_RCV_PLOGI); +- spin_unlock_irq(&ndlp->lock); ++ if (phba->sli_rev == LPFC_SLI_REV4) { ++ mempool_free(login_mbox, phba->mbox_mem_pool); ++ login_mbox = NULL; ++ } else { ++ /* In order to preserve RPIs, we want to cleanup ++ * the default RPI the firmware created to rcv ++ * this ELS request. The only way to do this is ++ * to register, then unregister the RPI. ++ */ ++ spin_lock_irq(&ndlp->lock); ++ ndlp->nlp_flag |= (NLP_RM_DFLT_RPI | NLP_ACC_REGLOGIN | ++ NLP_RCV_PLOGI); ++ spin_unlock_irq(&ndlp->lock); ++ } ++ + stat.un.b.lsRjtRsnCode = LSRJT_INVALID_CMD; + stat.un.b.lsRjtRsnCodeExp = LSEXP_NOTHING_MORE; + rc = lpfc_els_rsp_reject(vport, stat.un.lsRjtError, cmdiocb, +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -13625,9 +13625,15 @@ lpfc_sli4_sp_handle_mbox_event(struct lp + if (mcqe_status == MB_CQE_STATUS_SUCCESS) { + mp = (struct lpfc_dmabuf *)(pmb->ctx_buf); + ndlp = (struct lpfc_nodelist *)pmb->ctx_ndlp; +- /* Reg_LOGIN of dflt RPI was successful. Now lets get +- * RID of the PPI using the same mbox buffer. ++ ++ /* Reg_LOGIN of dflt RPI was successful. Mark the ++ * node as having an UNREG_LOGIN in progress to stop ++ * an unsolicited PLOGI from the same NPortId from ++ * starting another mailbox transaction. + */ ++ spin_lock_irqsave(&ndlp->lock, iflags); ++ ndlp->nlp_flag |= NLP_UNREG_INP; ++ spin_unlock_irqrestore(&ndlp->lock, iflags); + lpfc_unreg_login(phba, vport->vpi, + pmbox->un.varWords[0], pmb); + pmb->mbox_cmpl = lpfc_mbx_cmpl_dflt_rpi; diff --git a/patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch b/patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch new file mode 100644 index 0000000..edf59d5 --- /dev/null +++ b/patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch @@ -0,0 +1,164 @@ +From: James Smart +Date: Fri, 14 May 2021 12:55:55 -0700 +Subject: scsi: lpfc: Ignore GID-FT response that may be received after a link + flip +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git +Git-commit: 04c1d9c50ae32d6efd0b71024b3829051821c7a2 +References: bsc#1186451 + +When a link bounce happens, there is a possibility that responses to +requests posted prior to the link bounce could be received. This is +problematic as the counter to track reglogin completion after link up can +become out of sync with the real state. + +As there is no reason to process a request made in a prior link up context, +eliminate all the disturbance by tagging the request with the event_tag +maintained by the SLI Port for the link. The event_tag will change on every +link state transition. As long as the tag matches the current event_tag, +the response can be processed. If it doesn't match, just discard the +response. + +Link: https://lore.kernel.org/r/20210514195559.119853-8-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc_ct.c | 43 ++++++++++++++++++++++++++++++++++++------- + drivers/scsi/lpfc/lpfc_sli.h | 3 ++- + 2 files changed, 38 insertions(+), 8 deletions(-) + +--- a/drivers/scsi/lpfc/lpfc_ct.c ++++ b/drivers/scsi/lpfc/lpfc_ct.c +@@ -587,7 +587,7 @@ lpfc_gen_req(struct lpfc_vport *vport, s + struct lpfc_dmabuf *inp, struct lpfc_dmabuf *outp, + void (*cmpl) (struct lpfc_hba *, struct lpfc_iocbq *, + struct lpfc_iocbq *), +- struct lpfc_nodelist *ndlp, uint32_t usr_flg, uint32_t num_entry, ++ struct lpfc_nodelist *ndlp, uint32_t event_tag, uint32_t num_entry, + uint32_t tmo, uint8_t retry) + { + struct lpfc_hba *phba = vport->phba; +@@ -608,15 +608,14 @@ lpfc_gen_req(struct lpfc_vport *vport, s + icmd->un.genreq64.bdl.bdeFlags = BUFF_TYPE_BLP_64; + icmd->un.genreq64.bdl.bdeSize = (num_entry * sizeof(struct ulp_bde64)); + +- if (usr_flg) +- geniocb->context3 = NULL; +- else +- geniocb->context3 = (uint8_t *) bmp; ++ geniocb->context3 = (uint8_t *) bmp; + + /* Save for completion so we can release these resources */ + geniocb->context1 = (uint8_t *) inp; + geniocb->context2 = (uint8_t *) outp; + ++ geniocb->event_tag = event_tag; ++ + /* Fill in payload, bp points to frame payload */ + icmd->ulpCommand = CMD_GEN_REQUEST64_CR; + +@@ -707,8 +706,8 @@ lpfc_ct_cmd(struct lpfc_vport *vport, st + * lpfc_alloc_ct_rsp. + */ + cnt += 1; +- status = lpfc_gen_req(vport, bmp, inmp, outmp, cmpl, ndlp, 0, +- cnt, 0, retry); ++ status = lpfc_gen_req(vport, bmp, inmp, outmp, cmpl, ndlp, ++ phba->fc_eventTag, cnt, 0, retry); + if (status) { + lpfc_free_ct_rsp(phba, outmp); + return -ENOMEM; +@@ -957,6 +956,13 @@ lpfc_cmpl_ct_cmd_gid_ft(struct lpfc_hba + "GID_FT cmpl: status:x%x/x%x rtry:%d", + irsp->ulpStatus, irsp->un.ulpWord[4], vport->fc_ns_retry); + ++ /* Ignore response if link flipped after this request was made */ ++ if (cmdiocb->event_tag != phba->fc_eventTag) { ++ lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY, ++ "9043 Event tag mismatch. Ignoring NS rsp\n"); ++ goto out; ++ } ++ + /* Don't bother processing response if vport is being torn down. */ + if (vport->load_flag & FC_UNLOADING) { + if (vport->fc_flag & FC_RSCN_MODE) +@@ -1167,6 +1173,13 @@ lpfc_cmpl_ct_cmd_gid_pt(struct lpfc_hba + irsp->ulpStatus, irsp->un.ulpWord[4], + vport->fc_ns_retry); + ++ /* Ignore response if link flipped after this request was made */ ++ if (cmdiocb->event_tag != phba->fc_eventTag) { ++ lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY, ++ "9044 Event tag mismatch. Ignoring NS rsp\n"); ++ goto out; ++ } ++ + /* Don't bother processing response if vport is being torn down. */ + if (vport->load_flag & FC_UNLOADING) { + if (vport->fc_flag & FC_RSCN_MODE) +@@ -1366,6 +1379,13 @@ lpfc_cmpl_ct_cmd_gff_id(struct lpfc_hba + "GFF_ID cmpl: status:x%x/x%x did:x%x", + irsp->ulpStatus, irsp->un.ulpWord[4], did); + ++ /* Ignore response if link flipped after this request was made */ ++ if (cmdiocb->event_tag != phba->fc_eventTag) { ++ lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY, ++ "9045 Event tag mismatch. Ignoring NS rsp\n"); ++ goto iocb_free; ++ } ++ + if (irsp->ulpStatus == IOSTAT_SUCCESS) { + /* Good status, continue checking */ + CTrsp = (struct lpfc_sli_ct_request *) outp->virt; +@@ -1479,6 +1499,7 @@ lpfc_cmpl_ct_cmd_gff_id(struct lpfc_hba + lpfc_disc_start(vport); + } + ++iocb_free: + free_ndlp = cmdiocb->context_un.ndlp; + lpfc_ct_free_iocb(phba, cmdiocb); + lpfc_nlp_put(free_ndlp); +@@ -1506,6 +1527,13 @@ lpfc_cmpl_ct_cmd_gft_id(struct lpfc_hba + "GFT_ID cmpl: status:x%x/x%x did:x%x", + irsp->ulpStatus, irsp->un.ulpWord[4], did); + ++ /* Ignore response if link flipped after this request was made */ ++ if ((uint32_t) cmdiocb->event_tag != phba->fc_eventTag) { ++ lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY, ++ "9046 Event tag mismatch. Ignoring NS rsp\n"); ++ goto out; ++ } ++ + /* Preserve the nameserver node to release the reference. */ + ns_ndlp = cmdiocb->context_un.ndlp; + +@@ -1572,6 +1600,7 @@ lpfc_cmpl_ct_cmd_gft_id(struct lpfc_hba + lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT, + "3065 GFT_ID failed x%08x\n", irsp->ulpStatus); + ++out: + lpfc_ct_free_iocb(phba, cmdiocb); + lpfc_nlp_put(ns_ndlp); + } +--- a/drivers/scsi/lpfc/lpfc_sli.h ++++ b/drivers/scsi/lpfc/lpfc_sli.h +@@ -1,7 +1,7 @@ + /******************************************************************* + * This file is part of the Emulex Linux Device Driver for * + * Fibre Channel Host Bus Adapters. * +- * Copyright (C) 2017-2020 Broadcom. All Rights Reserved. The term * ++ * Copyright (C) 2017-2021 Broadcom. All Rights Reserved. The term * + * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * + * Copyright (C) 2004-2016 Emulex. All rights reserved. * + * EMULEX and SLI are trademarks of Emulex. * +@@ -106,6 +106,7 @@ struct lpfc_iocbq { + void *context1; /* caller context information */ + void *context2; /* caller context information */ + void *context3; /* caller context information */ ++ uint32_t event_tag; /* LA Event tag */ + union { + wait_queue_head_t *wait_queue; + struct lpfc_iocbq *rsp_iocb; diff --git a/patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch b/patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch new file mode 100644 index 0000000..e490ad4 --- /dev/null +++ b/patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch @@ -0,0 +1,143 @@ +From: James Smart +Date: Fri, 14 May 2021 12:55:58 -0700 +Subject: scsi: lpfc: Reregister FPIN types if ELS_RDF is received from fabric + controller +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git +Git-commit: 8eced807077d198fc264629bd2592795d270c9f1 +References: bsc#1186451 + +FC-LS-5 specifies that a received RDF implies a possible change to fabric +supported diagnostic functions. Endpoints are to re-perform the RDF +exchange with the fabric to enable possible new features or adapt to +changes in values. + +This patch adds the logic to RDF receive to re-perform the RDF exchange +with the switch. + +Link: https://lore.kernel.org/r/20210514195559.119853-11-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc.h | 1 + drivers/scsi/lpfc/lpfc_els.c | 75 +++++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 76 insertions(+) + +--- a/drivers/scsi/lpfc/lpfc.h ++++ b/drivers/scsi/lpfc/lpfc.h +@@ -266,6 +266,7 @@ struct lpfc_stats { + uint32_t elsRcvECHO; + uint32_t elsRcvLCB; + uint32_t elsRcvRDP; ++ uint32_t elsRcvRDF; + uint32_t elsXmitFLOGI; + uint32_t elsXmitFDISC; + uint32_t elsXmitPLOGI; +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -3670,6 +3670,43 @@ lpfc_issue_els_rdf(struct lpfc_vport *vp + return 0; + } + ++ /** ++ * lpfc_els_rcv_rdf - Receive RDF ELS request from the fabric. ++ * @vport: pointer to a host virtual N_Port data structure. ++ * @cmdiocb: pointer to lpfc command iocb data structure. ++ * @ndlp: pointer to a node-list data structure. ++ * ++ * A received RDF implies a possible change to fabric supported diagnostic ++ * functions. This routine sends LS_ACC and then has the Nx_Port issue a new ++ * RDF request to reregister for supported diagnostic functions. ++ * ++ * Return code ++ * 0 - Success ++ * -EIO - Failed to process received RDF ++ **/ ++static int ++lpfc_els_rcv_rdf(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb, ++ struct lpfc_nodelist *ndlp) ++{ ++ /* Send LS_ACC */ ++ if (lpfc_els_rsp_acc(vport, ELS_CMD_RDF, cmdiocb, ndlp, NULL)) { ++ lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, ++ "1623 Failed to RDF_ACC from x%x for x%x\n", ++ ndlp->nlp_DID, vport->fc_myDID); ++ return -EIO; ++ } ++ ++ /* Issue new RDF for reregistering */ ++ if (lpfc_issue_els_rdf(vport, 0)) { ++ lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, ++ "2623 Failed to re register RDF for x%x\n", ++ vport->fc_myDID); ++ return -EIO; ++ } ++ ++ return 0; ++} ++ + /** + * lpfc_cancel_retry_delay_tmo - Cancel the timer with delayed iocb-cmd retry + * @vport: pointer to a host virtual N_Port data structure. +@@ -4803,6 +4840,7 @@ lpfc_els_rsp_acc(struct lpfc_vport *vpor + uint16_t cmdsize; + int rc; + ELS_PKT *els_pkt_ptr; ++ struct fc_els_rdf_resp *rdf_resp; + + oldcmd = &oldiocb->iocb; + +@@ -4914,6 +4952,29 @@ lpfc_els_rsp_acc(struct lpfc_vport *vpor + "Issue ACC PRLO: did:x%x flg:x%x", + ndlp->nlp_DID, ndlp->nlp_flag, 0); + break; ++ case ELS_CMD_RDF: ++ cmdsize = sizeof(*rdf_resp); ++ elsiocb = lpfc_prep_els_iocb(vport, 0, cmdsize, oldiocb->retry, ++ ndlp, ndlp->nlp_DID, ELS_CMD_ACC); ++ if (!elsiocb) ++ return 1; ++ ++ icmd = &elsiocb->iocb; ++ icmd->ulpContext = oldcmd->ulpContext; /* Xri / rx_id */ ++ icmd->unsli3.rcvsli3.ox_id = oldcmd->unsli3.rcvsli3.ox_id; ++ pcmd = (((struct lpfc_dmabuf *)elsiocb->context2)->virt); ++ rdf_resp = (struct fc_els_rdf_resp *)pcmd; ++ memset(rdf_resp, 0, sizeof(*rdf_resp)); ++ rdf_resp->acc_hdr.la_cmd = ELS_LS_ACC; ++ ++ /* FC-LS-5 specifies desc_list_len shall be set to 12 */ ++ rdf_resp->desc_list_len = cpu_to_be32(12); ++ ++ /* FC-LS-5 specifies LS REQ Information descriptor */ ++ rdf_resp->lsri.desc_tag = cpu_to_be32(1); ++ rdf_resp->lsri.desc_len = cpu_to_be32(sizeof(u32)); ++ rdf_resp->lsri.rqst_w0.cmd = ELS_RDF; ++ break; + default: + return 1; + } +@@ -9027,6 +9088,20 @@ lpfc_els_unsol_buffer(struct lpfc_hba *p + + /* There are no replies, so no rjt codes */ + break; ++ case ELS_CMD_RDF: ++ phba->fc_stat.elsRcvRDF++; ++ /* Accept RDF only from fabric controller */ ++ if (did != Fabric_Cntl_DID) { ++ lpfc_printf_vlog(vport, KERN_WARNING, LOG_ELS, ++ "1115 Received RDF from invalid DID " ++ "x%x\n", did); ++ rjt_err = LSRJT_PROTOCOL_ERR; ++ rjt_exp = LSEXP_NOTHING_MORE; ++ goto lsrjt; ++ } ++ ++ lpfc_els_rcv_rdf(vport, elsiocb, ndlp); ++ break; + default: + lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_UNSOL, + "RCV ELS cmd: cmd:x%x did:x%x/ste:x%x", diff --git a/patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch b/patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch new file mode 100644 index 0000000..d9124cd --- /dev/null +++ b/patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch @@ -0,0 +1,31 @@ +From: James Smart +Date: Fri, 14 May 2021 12:55:59 -0700 +Subject: scsi: lpfc: Update lpfc version to 12.8.0.10 +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git +Git-commit: e5e0280db792953ee7acbdbf01179d53187a6083 +References: bsc#1186451 + +Update lpfc version to 12.8.0.10 + +Link: https://lore.kernel.org/r/20210514195559.119853-12-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Acked-by: Daniel Wagner +--- + drivers/scsi/lpfc/lpfc_version.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/lpfc/lpfc_version.h ++++ b/drivers/scsi/lpfc/lpfc_version.h +@@ -20,7 +20,7 @@ + * included with this package. * + *******************************************************************/ + +-#define LPFC_DRIVER_VERSION "12.8.0.9" ++#define LPFC_DRIVER_VERSION "12.8.0.10" + #define LPFC_DRIVER_NAME "lpfc" + + /* Used for SLI 2/3 */ diff --git a/patches.suse/serial-core-fix-suspicious-security_locked_down-call.patch b/patches.suse/serial-core-fix-suspicious-security_locked_down-call.patch new file mode 100644 index 0000000..9216e19 --- /dev/null +++ b/patches.suse/serial-core-fix-suspicious-security_locked_down-call.patch @@ -0,0 +1,65 @@ +From 5e722b217ad3cf41f5504db80a68062df82b5242 Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Fri, 7 May 2021 13:57:19 +0200 +Subject: [PATCH] serial: core: fix suspicious security_locked_down() call +Git-commit: 5e722b217ad3cf41f5504db80a68062df82b5242 +Patch-mainline: v5.13-rc4 +References: git-fixes + +The commit that added this check did so in a very strange way - first +security_locked_down() is called, its value stored into retval, and if +it's nonzero, then an additional check is made for (change_irq || +change_port), and if this is true, the function returns. However, if +the goto exit branch is not taken, the code keeps the retval value and +continues executing the function. Then, depending on whether +uport->ops->verify_port is set, the retval value may or may not be reset +to zero and eventually the error value from security_locked_down() may +abort the function a few lines below. + +I will go out on a limb and assume that this isn't the intended behavior +and that an error value from security_locked_down() was supposed to +abort the function only in case (change_irq || change_port) is true. + +Note that security_locked_down() should be called last in any series of +checks, since the SELinux implementation of this hook will do a check +against the policy and generate an audit record in case of denial. If +the operation was to carry on after calling security_locked_down(), then +the SELinux denial record would be bogus. + +See commit 59438b46471a ("security,lockdown,selinux: implement SELinux +lockdown") for how SELinux implements this hook. + +Fixes: 794edf30ee6c ("lockdown: Lock down TIOCSSERIAL") +Acked-by: Kees Cook +Signed-off-by: Ondrej Mosnacek +Cc: stable +Link: https://lore.kernel.org/r/20210507115719.140799-1-omosnace@redhat.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/serial/serial_core.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index 87f7127b57e6..18ff85a83f80 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -863,9 +863,11 @@ static int uart_set_info(struct tty_struct *tty, struct tty_port *port, + goto check_and_exit; + } + +- retval = security_locked_down(LOCKDOWN_TIOCSSERIAL); +- if (retval && (change_irq || change_port)) +- goto exit; ++ if (change_irq || change_port) { ++ retval = security_locked_down(LOCKDOWN_TIOCSSERIAL); ++ if (retval) ++ goto exit; ++ } + + /* + * Ask the low level driver to verify the settings. +-- +2.26.2 + diff --git a/patches.suse/serial-sh-sci-Fix-off-by-one-error-in-FIFO-threshold.patch b/patches.suse/serial-sh-sci-Fix-off-by-one-error-in-FIFO-threshold.patch new file mode 100644 index 0000000..d52df0f --- /dev/null +++ b/patches.suse/serial-sh-sci-Fix-off-by-one-error-in-FIFO-threshold.patch @@ -0,0 +1,55 @@ +From 2ea2e019c190ee3973ef7bcaf829d8762e56e635 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Mon, 10 May 2021 14:07:55 +0200 +Subject: [PATCH] serial: sh-sci: Fix off-by-one error in FIFO threshold register setting +Git-commit: 2ea2e019c190ee3973ef7bcaf829d8762e56e635 +Patch-mainline: v5.13-rc4 +References: git-fixes + +The Receive FIFO Data Count Trigger field (RTRG[6:0]) in the Receive +FIFO Data Count Trigger Register (HSRTRGR) of HSCIF can only hold values +ranging from 0-127. As the FIFO size is equal to 128 on HSCIF, the user +can write an out-of-range value, touching reserved bits. + +Fix this by limiting the trigger value to the FIFO size minus one. +Reverse the order of the checks, to avoid rx_trig becoming zero if the +FIFO size is one. + +Note that this change has no impact on other SCIF variants, as their +maximum supported trigger value is lower than the FIFO size anyway, and +the code below takes care of enforcing these limits. + +Fixes: a380ed461f66d1b8 ("serial: sh-sci: implement FIFO threshold register setting") +Reported-by: Linh Phung +Reviewed-by: Wolfram Sang +Reviewed-by: Ulrich Hecht +Signed-off-by: Geert Uytterhoeven +Cc: stable +Link: https://lore.kernel.org/r/5eff320aef92ffb33d00e57979fd3603bbb4a70f.1620648218.git.geert+renesas@glider.be +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/serial/sh-sci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index ef37fdf37612..4baf1316ea72 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -1023,10 +1023,10 @@ static int scif_set_rtrg(struct uart_port *port, int rx_trig) + { + unsigned int bits; + ++ if (rx_trig >= port->fifosize) ++ rx_trig = port->fifosize - 1; + if (rx_trig < 1) + rx_trig = 1; +- if (rx_trig >= port->fifosize) +- rx_trig = port->fifosize; + + /* HSCIF can be set to an arbitrary level. */ + if (sci_getreg(port, HSRTRGR)->size) { +-- +2.26.2 + diff --git a/patches.suse/serial-tegra-Fix-a-mask-operation-that-is-always-tru.patch b/patches.suse/serial-tegra-Fix-a-mask-operation-that-is-always-tru.patch new file mode 100644 index 0000000..133d917 --- /dev/null +++ b/patches.suse/serial-tegra-Fix-a-mask-operation-that-is-always-tru.patch @@ -0,0 +1,40 @@ +From 3ddb4ce1e6e3bd112778ab93bbd9092f23a878ec Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Mon, 26 Apr 2021 11:55:14 +0100 +Subject: [PATCH] serial: tegra: Fix a mask operation that is always true +Git-commit: 3ddb4ce1e6e3bd112778ab93bbd9092f23a878ec +Patch-mainline: v5.13-rc4 +References: git-fixes + +Currently the expression lsr | UART_LSR_TEMT is always true and +this seems suspect. I believe the intent was to mask lsr with UART_LSR_TEMT +to check that bit, so the expression should be using the & operator +instead. Fix this. + +Fixes: b9c2470fb150 ("serial: tegra: flush the RX fifo on frame error") +Signed-off-by: Colin Ian King +Cc: stable +Link: https://lore.kernel.org/r/20210426105514.23268-1-colin.king@canonical.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/serial/serial-tegra.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c +index bbae072a125d..222032792d6c 100644 +--- a/drivers/tty/serial/serial-tegra.c ++++ b/drivers/tty/serial/serial-tegra.c +@@ -338,7 +338,7 @@ static void tegra_uart_fifo_reset(struct tegra_uart_port *tup, u8 fcr_bits) + + do { + lsr = tegra_uart_read(tup, UART_LSR); +- if ((lsr | UART_LSR_TEMT) && !(lsr & UART_LSR_DR)) ++ if ((lsr & UART_LSR_TEMT) && !(lsr & UART_LSR_DR)) + break; + udelay(1); + } while (--tmout); +-- +2.26.2 + diff --git a/patches.suse/spi-spi-fsl-dspi-Fix-a-resource-leak-in-an-error-han.patch b/patches.suse/spi-spi-fsl-dspi-Fix-a-resource-leak-in-an-error-han.patch new file mode 100644 index 0000000..8d12013 --- /dev/null +++ b/patches.suse/spi-spi-fsl-dspi-Fix-a-resource-leak-in-an-error-han.patch @@ -0,0 +1,45 @@ +From 680ec0549a055eb464dce6ffb4bfb736ef87236e Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sun, 9 May 2021 21:12:27 +0200 +Subject: [PATCH] spi: spi-fsl-dspi: Fix a resource leak in an error handling path +Git-commit: 680ec0549a055eb464dce6ffb4bfb736ef87236e +Patch-mainline: v5.13 or v5.13-rc4 (next release) +References: git-fixes + +'dspi_request_dma()' should be undone by a 'dspi_release_dma()' call in the +error handling path of the probe function, as already done in the remove +function + +Fixes: 90ba37033cb9 ("spi: spi-fsl-dspi: Add DMA support for Vybrid") +Signed-off-by: Christophe JAILLET +Reviewed-by: Vladimir Oltean +Link: https://lore.kernel.org/r/d51caaac747277a1099ba8dea07acd85435b857e.1620587472.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + drivers/spi/spi-fsl-dspi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c +index 028736687488..fb45e6af6638 100644 +--- a/drivers/spi/spi-fsl-dspi.c ++++ b/drivers/spi/spi-fsl-dspi.c +@@ -1375,11 +1375,13 @@ static int dspi_probe(struct platform_device *pdev) + ret = spi_register_controller(ctlr); + if (ret != 0) { + dev_err(&pdev->dev, "Problem registering DSPI ctlr\n"); +- goto out_free_irq; ++ goto out_release_dma; + } + + return ret; + ++out_release_dma: ++ dspi_release_dma(dspi); + out_free_irq: + if (dspi->irq) + free_irq(dspi->irq, dspi); +-- +2.26.2 + diff --git a/patches.suse/staging-emxx_udc-fix-loop-in-_nbu2ss_nuke.patch b/patches.suse/staging-emxx_udc-fix-loop-in-_nbu2ss_nuke.patch new file mode 100644 index 0000000..8a1e8b4 --- /dev/null +++ b/patches.suse/staging-emxx_udc-fix-loop-in-_nbu2ss_nuke.patch @@ -0,0 +1,49 @@ +From e0112a7c9e847ada15a631b88e279d547e8f26a7 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 19 May 2021 17:16:50 +0300 +Subject: [PATCH] staging: emxx_udc: fix loop in _nbu2ss_nuke() +Git-commit: e0112a7c9e847ada15a631b88e279d547e8f26a7 +Patch-mainline: v5.13-rc4 +References: git-fixes + +The _nbu2ss_ep_done() function calls: + + list_del_init(&req->queue); + +which means that the loop will never exit. + +Fixes: ca3d253eb967 ("Staging: emxx_udc: Iterate list using list_for_each_entry") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/YKUd0sDyjm/lkJfJ@mwanda +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/staging/emxx_udc/emxx_udc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/emxx_udc/emxx_udc.c b/drivers/staging/emxx_udc/emxx_udc.c +index 741147a4f0fe..ecc5c9da9027 100644 +--- a/drivers/staging/emxx_udc/emxx_udc.c ++++ b/drivers/staging/emxx_udc/emxx_udc.c +@@ -2064,7 +2064,7 @@ static int _nbu2ss_nuke(struct nbu2ss_udc *udc, + struct nbu2ss_ep *ep, + int status) + { +- struct nbu2ss_req *req; ++ struct nbu2ss_req *req, *n; + + /* Endpoint Disable */ + _nbu2ss_epn_exit(udc, ep); +@@ -2076,7 +2076,7 @@ static int _nbu2ss_nuke(struct nbu2ss_udc *udc, + return 0; + + /* called with irqs blocked */ +- list_for_each_entry(req, &ep->queue, queue) { ++ list_for_each_entry_safe(req, n, &ep->queue, queue) { + _nbu2ss_ep_done(ep, req, status); + } + +-- +2.26.2 + diff --git a/patches.suse/staging-iio-cdc-ad7746-avoid-overwrite-of-num_channe.patch b/patches.suse/staging-iio-cdc-ad7746-avoid-overwrite-of-num_channe.patch new file mode 100644 index 0000000..a07e487 --- /dev/null +++ b/patches.suse/staging-iio-cdc-ad7746-avoid-overwrite-of-num_channe.patch @@ -0,0 +1,38 @@ +From 04f5b9f539ce314f758d919a14dc7a669f3b7838 Mon Sep 17 00:00:00 2001 +From: Lucas Stankus +Date: Tue, 11 May 2021 17:54:18 -0300 +Subject: [PATCH] staging: iio: cdc: ad7746: avoid overwrite of num_channels +Git-commit: 04f5b9f539ce314f758d919a14dc7a669f3b7838 +Patch-mainline: v5.13-rc4 +References: git-fixes + +AD7745 devices don't have the CIN2 pins and therefore can't handle related +channels. Forcing the number of AD7746 channels may lead to enabling more +channels than what the hardware actually supports. +Avoid num_channels being overwritten after first assignment. + +Signed-off-by: Lucas Stankus +Fixes: 83e416f458d53 ("staging: iio: adc: Replace, rewrite ad7745 from scratch.") +Signed-off-by: Jonathan Cameron +Cc: +Acked-by: Takashi Iwai + +--- + drivers/staging/iio/cdc/ad7746.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/staging/iio/cdc/ad7746.c b/drivers/staging/iio/cdc/ad7746.c +index dfd71e99e872..eab534dc4bcc 100644 +--- a/drivers/staging/iio/cdc/ad7746.c ++++ b/drivers/staging/iio/cdc/ad7746.c +@@ -700,7 +700,6 @@ static int ad7746_probe(struct i2c_client *client, + indio_dev->num_channels = ARRAY_SIZE(ad7746_channels); + else + indio_dev->num_channels = ARRAY_SIZE(ad7746_channels) - 2; +- indio_dev->num_channels = ARRAY_SIZE(ad7746_channels); + indio_dev->modes = INDIO_DIRECT_MODE; + + if (pdata) { +-- +2.26.2 + diff --git a/patches.suse/thunderbolt-dma_port-Fix-NVM-read-buffer-bounds-and-.patch b/patches.suse/thunderbolt-dma_port-Fix-NVM-read-buffer-bounds-and-.patch new file mode 100644 index 0000000..1adc53a --- /dev/null +++ b/patches.suse/thunderbolt-dma_port-Fix-NVM-read-buffer-bounds-and-.patch @@ -0,0 +1,68 @@ +From b106776080a1cf953a1b2fd50cb2a995db4732be Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 27 Apr 2021 15:48:29 +0300 +Subject: [PATCH] thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue +Git-commit: b106776080a1cf953a1b2fd50cb2a995db4732be +Patch-mainline: v5.13-rc4 +References: git-fixes + +Up to 64 bytes of data can be read from NVM in one go. Read address +must be dword aligned. Data is read into a local buffer. + +If caller asks to read data starting at an unaligned address then full +dword is anyway read from NVM into a local buffer. Data is then copied +from the local buffer starting at the unaligned offset to the caller +buffer. + +In cases where asked data length + unaligned offset is over 64 bytes +we need to make sure we don't read past the 64 bytes in the local +buffer when copying to caller buffer, and make sure that we don't +skip copying unaligned offset bytes from local buffer anymore after +the first round of 64 byte NVM data read. + +Fixes: 3e13676862f9 ("thunderbolt: Add support for DMA configuration based mailbox") +Cc: stable@vger.kernel.org +Signed-off-by: Mathias Nyman +Signed-off-by: Mika Westerberg +Acked-by: Takashi Iwai + +--- + drivers/thunderbolt/dma_port.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/thunderbolt/dma_port.c b/drivers/thunderbolt/dma_port.c +index 7288aaf01ae6..5631319f7b20 100644 +--- a/drivers/thunderbolt/dma_port.c ++++ b/drivers/thunderbolt/dma_port.c +@@ -366,15 +366,15 @@ int dma_port_flash_read(struct tb_dma_port *dma, unsigned int address, + void *buf, size_t size) + { + unsigned int retries = DMA_PORT_RETRIES; +- unsigned int offset; +- +- offset = address & 3; +- address = address & ~3; + + do { +- u32 nbytes = min_t(u32, size, MAIL_DATA_DWORDS * 4); ++ unsigned int offset; ++ size_t nbytes; + int ret; + ++ offset = address & 3; ++ nbytes = min_t(size_t, size + offset, MAIL_DATA_DWORDS * 4); ++ + ret = dma_port_flash_read_block(dma, address, dma->buf, + ALIGN(nbytes, 4)); + if (ret) { +@@ -386,6 +386,7 @@ int dma_port_flash_read(struct tb_dma_port *dma, unsigned int address, + return ret; + } + ++ nbytes -= offset; + memcpy(buf, dma->buf + offset, nbytes); + + size -= nbytes; +-- +2.26.2 + diff --git a/patches.suse/usb-core-hub-fix-race-condition-about-TRSMRCY-of-res.patch b/patches.suse/usb-core-hub-fix-race-condition-about-TRSMRCY-of-res.patch new file mode 100644 index 0000000..8524f9d --- /dev/null +++ b/patches.suse/usb-core-hub-fix-race-condition-about-TRSMRCY-of-res.patch @@ -0,0 +1,51 @@ +From 975f94c7d6c306b833628baa9aec3f79db1eb3a1 Mon Sep 17 00:00:00 2001 +From: Chunfeng Yun +Date: Wed, 12 May 2021 10:07:38 +0800 +Subject: [PATCH] usb: core: hub: fix race condition about TRSMRCY of resume +Git-commit: 975f94c7d6c306b833628baa9aec3f79db1eb3a1 +Patch-mainline: v5.13-rc2 +References: git-fixes + +This may happen if the port becomes resume status exactly +when usb_port_resume() gets port status, it still need provide +a TRSMCRY time before access the device. + +Cc: +Reported-by: Tianping Fang +Acked-by: Alan Stern +Signed-off-by: Chunfeng Yun +Link: https://lore.kernel.org/r/20210512020738.52961-1-chunfeng.yun@mediatek.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/core/hub.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index b2bc4b7c4289..fc7d6cdacf16 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -3642,9 +3642,6 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg) + * sequence. + */ + status = hub_port_status(hub, port1, &portstatus, &portchange); +- +- /* TRSMRCY = 10 msec */ +- msleep(10); + } + + SuspendCleared: +@@ -3659,6 +3656,9 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg) + usb_clear_port_feature(hub->hdev, port1, + USB_PORT_FEAT_C_SUSPEND); + } ++ ++ /* TRSMRCY = 10 msec */ ++ msleep(10); + } + + if (udev->persist_enabled) +-- +2.26.2 + diff --git a/patches.suse/usb-dwc3-gadget-Enable-suspend-events.patch b/patches.suse/usb-dwc3-gadget-Enable-suspend-events.patch new file mode 100644 index 0000000..63c3576 --- /dev/null +++ b/patches.suse/usb-dwc3-gadget-Enable-suspend-events.patch @@ -0,0 +1,43 @@ +From d1d90dd27254c44d087ad3f8b5b3e4fff0571f45 Mon Sep 17 00:00:00 2001 +From: Jack Pham +Date: Wed, 28 Apr 2021 02:01:10 -0700 +Subject: [PATCH] usb: dwc3: gadget: Enable suspend events +Git-commit: d1d90dd27254c44d087ad3f8b5b3e4fff0571f45 +Patch-mainline: v5.13-rc2 +References: git-fixes + +[ backport note: open-coded the missing DWC3_VER_IS_PRIOR() macro -- tiwai ] + +commit 72704f876f50 ("dwc3: gadget: Implement the suspend entry event +handler") introduced (nearly 5 years ago!) an interrupt handler for +U3/L1-L2 suspend events. The problem is that these events aren't +currently enabled in the DEVTEN register so the handler is never +even invoked. Fix this simply by enabling the corresponding bit +in dwc3_gadget_enable_irq() using the same revision check as found +in the handler. + +Fixes: 72704f876f50 ("dwc3: gadget: Implement the suspend entry event handler") +Acked-by: Felipe Balbi +Signed-off-by: Jack Pham +Cc: stable +Link: https://lore.kernel.org/r/20210428090111.3370-1-jackp@codeaurora.org +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/dwc3/gadget.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1959,6 +1959,10 @@ static void dwc3_gadget_enable_irq(struc + if (dwc->revision < DWC3_REVISION_250A) + reg |= DWC3_DEVTEN_ULSTCNGEN; + ++ /* On 2.30a and above this bit enables U3/L2-L1 Suspend Events */ ++ if (dwc->revision >= DWC3_REVISION_230A) ++ reg |= DWC3_DEVTEN_EOPFEN; ++ + dwc3_writel(dwc->regs, DWC3_DEVTEN, reg); + } + diff --git a/patches.suse/usb-dwc3-omap-improve-extcon-initialization.patch b/patches.suse/usb-dwc3-omap-improve-extcon-initialization.patch new file mode 100644 index 0000000..f84bd63 --- /dev/null +++ b/patches.suse/usb-dwc3-omap-improve-extcon-initialization.patch @@ -0,0 +1,50 @@ +From e17b02d4970913233d543c79c9c66e72cac05bdd Mon Sep 17 00:00:00 2001 +From: Marcel Hamer +Date: Tue, 27 Apr 2021 14:21:18 +0200 +Subject: [PATCH] usb: dwc3: omap: improve extcon initialization +Git-commit: e17b02d4970913233d543c79c9c66e72cac05bdd +Patch-mainline: v5.13-rc2 +References: git-fixes + +When extcon is used in combination with dwc3, it is assumed that the dwc3 +registers are untouched and as such are only configured if VBUS is valid +or ID is tied to ground. + +In case VBUS is not valid or ID is floating, the registers are not +configured as such during driver initialization, causing a wrong +default state during boot. + +If the registers are not in a default state, because they are for +instance touched by a boot loader, this can cause for a kernel error. + +Signed-off-by: Marcel Hamer +Link: https://lore.kernel.org/r/20210427122118.1948340-1-marcel@solidxs.se +Cc: stable +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/dwc3/dwc3-omap.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c +index 3db17806e92e..e196673f5c64 100644 +--- a/drivers/usb/dwc3/dwc3-omap.c ++++ b/drivers/usb/dwc3/dwc3-omap.c +@@ -437,8 +437,13 @@ static int dwc3_omap_extcon_register(struct dwc3_omap *omap) + + if (extcon_get_state(edev, EXTCON_USB) == true) + dwc3_omap_set_mailbox(omap, OMAP_DWC3_VBUS_VALID); ++ else ++ dwc3_omap_set_mailbox(omap, OMAP_DWC3_VBUS_OFF); ++ + if (extcon_get_state(edev, EXTCON_USB_HOST) == true) + dwc3_omap_set_mailbox(omap, OMAP_DWC3_ID_GROUND); ++ else ++ dwc3_omap_set_mailbox(omap, OMAP_DWC3_ID_FLOAT); + + omap->edev = edev; + } +-- +2.26.2 + diff --git a/patches.suse/usb-gadget-udc-renesas_usb3-Fix-a-race-in-usb3_start.patch b/patches.suse/usb-gadget-udc-renesas_usb3-Fix-a-race-in-usb3_start.patch new file mode 100644 index 0000000..a2fed00 --- /dev/null +++ b/patches.suse/usb-gadget-udc-renesas_usb3-Fix-a-race-in-usb3_start.patch @@ -0,0 +1,69 @@ +From e752dbc59e1241b13b8c4f7b6eb582862e7668fe Mon Sep 17 00:00:00 2001 +From: Yoshihiro Shimoda +Date: Mon, 24 May 2021 15:01:55 +0900 +Subject: [PATCH] usb: gadget: udc: renesas_usb3: Fix a race in usb3_start_pipen() +Git-commit: e752dbc59e1241b13b8c4f7b6eb582862e7668fe +Patch-mainline: v5.13-rc4 +References: git-fixes + +The usb3_start_pipen() is called by renesas_usb3_ep_queue() and +usb3_request_done_pipen() so that usb3_start_pipen() is possible +to cause a race when getting usb3_first_req like below: + +renesas_usb3_ep_queue() + spin_lock_irqsave() + list_add_tail() + spin_unlock_irqrestore() + usb3_start_pipen() + usb3_first_req = usb3_get_request() --- [1] + --- interrupt --- + usb3_irq_dma_int() + usb3_request_done_pipen() + usb3_get_request() + usb3_start_pipen() + usb3_first_req = usb3_get_request() + ... + (the req is possible to be finished in the interrupt) + +The usb3_first_req [1] above may have been finished after the interrupt +ended so that this driver caused to start a transfer wrongly. To fix this +issue, getting/checking the usb3_first_req are under spin_lock_irqsave() +in the same section. + +Fixes: 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller") +Cc: stable +Signed-off-by: Yoshihiro Shimoda +Link: https://lore.kernel.org/r/20210524060155.1178724-1-yoshihiro.shimoda.uh@renesas.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/gadget/udc/renesas_usb3.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c +index 0c418ce50ba0..f1b35a39d1ba 100644 +--- a/drivers/usb/gadget/udc/renesas_usb3.c ++++ b/drivers/usb/gadget/udc/renesas_usb3.c +@@ -1488,7 +1488,7 @@ static void usb3_start_pipen(struct renesas_usb3_ep *usb3_ep, + struct renesas_usb3_request *usb3_req) + { + struct renesas_usb3 *usb3 = usb3_ep_to_usb3(usb3_ep); +- struct renesas_usb3_request *usb3_req_first = usb3_get_request(usb3_ep); ++ struct renesas_usb3_request *usb3_req_first; + unsigned long flags; + int ret = -EAGAIN; + u32 enable_bits = 0; +@@ -1496,7 +1496,8 @@ static void usb3_start_pipen(struct renesas_usb3_ep *usb3_ep, + spin_lock_irqsave(&usb3->lock, flags); + if (usb3_ep->halt || usb3_ep->started) + goto out; +- if (usb3_req != usb3_req_first) ++ usb3_req_first = __usb3_get_request(usb3_ep); ++ if (!usb3_req_first || usb3_req != usb3_req_first) + goto out; + + if (usb3_pn_change(usb3, usb3_ep->num) < 0) +-- +2.26.2 + diff --git a/patches.suse/usb-sl811-hcd-improve-misleading-indentation.patch b/patches.suse/usb-sl811-hcd-improve-misleading-indentation.patch new file mode 100644 index 0000000..7cdfdca --- /dev/null +++ b/patches.suse/usb-sl811-hcd-improve-misleading-indentation.patch @@ -0,0 +1,54 @@ +From 8460f6003a1d2633737b89c4f69d6f4c0c7c65a3 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 22 Mar 2021 17:42:26 +0100 +Subject: [PATCH] usb: sl811-hcd: improve misleading indentation +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 8460f6003a1d2633737b89c4f69d6f4c0c7c65a3 +Patch-mainline: v5.13-rc1 +References: git-fixes + +gcc-11 now warns about a confusingly indented code block: + +Drivers/usb/host/sl811-hcd.c: In function ‘sl811h_hub_control’: +drivers/usb/host/sl811-hcd.c:1291:9: error: this ‘if’ clause does not guard... [-Werror=misleading-indentation] + 1291 | if (*(u16*)(buf+2)) /* only if wPortChange is interesting */ + | ^~ +drivers/usb/host/sl811-hcd.c:1295:17: note: ...this statement, but the latter is misleadingly indented as if it were guarded by the ‘if’ + 1295 | break; + +Rewrite this to use a single if() block with the __is_defined() macro. + +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20210322164244.827589-1-arnd@kernel.org +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/host/sl811-hcd.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c +index d49fb656d34b..85623731a516 100644 +--- a/drivers/usb/host/sl811-hcd.c ++++ b/drivers/usb/host/sl811-hcd.c +@@ -1287,11 +1287,10 @@ sl811h_hub_control( + goto error; + put_unaligned_le32(sl811->port1, buf); + +-#ifndef VERBOSE +- if (*(u16*)(buf+2)) /* only if wPortChange is interesting */ +-#endif +- dev_dbg(hcd->self.controller, "GetPortStatus %08x\n", +- sl811->port1); ++ if (__is_defined(VERBOSE) || ++ *(u16*)(buf+2)) /* only if wPortChange is interesting */ ++ dev_dbg(hcd->self.controller, "GetPortStatus %08x\n", ++ sl811->port1); + break; + case SetPortFeature: + if (wIndex != 1 || wLength != 0) +-- +2.26.2 + diff --git a/patches.suse/usb-xhci-Increase-timeout-for-HC-halt.patch b/patches.suse/usb-xhci-Increase-timeout-for-HC-halt.patch new file mode 100644 index 0000000..0d7c161 --- /dev/null +++ b/patches.suse/usb-xhci-Increase-timeout-for-HC-halt.patch @@ -0,0 +1,44 @@ +From ca09b1bea63ab83f4cca3a2ae8bc4f597ec28851 Mon Sep 17 00:00:00 2001 +From: Maximilian Luz +Date: Wed, 12 May 2021 11:08:15 +0300 +Subject: [PATCH] usb: xhci: Increase timeout for HC halt +Git-commit: ca09b1bea63ab83f4cca3a2ae8bc4f597ec28851 +Patch-mainline: v5.13-rc2 +References: git-fixes + +On some devices (specifically the SC8180x based Surface Pro X with +QCOM04A6) HC halt / xhci_halt() times out during boot. Manually binding +the xhci-hcd driver at some point later does not exhibit this behavior. +To work around this, double XHCI_MAX_HALT_USEC, which also resolves this +issue. + +Cc: +Signed-off-by: Maximilian Luz +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20210512080816.866037-5-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/host/xhci-ext-caps.h | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/host/xhci-ext-caps.h b/drivers/usb/host/xhci-ext-caps.h +index fa59b242cd51..e8af0a125f84 100644 +--- a/drivers/usb/host/xhci-ext-caps.h ++++ b/drivers/usb/host/xhci-ext-caps.h +@@ -7,8 +7,9 @@ + * Author: Sarah Sharp + * Some code borrowed from the Linux EHCI driver. + */ +-/* Up to 16 ms to halt an HC */ +-#define XHCI_MAX_HALT_USEC (16*1000) ++ ++/* HC should halt within 16 ms, but use 32 ms as some hosts take longer */ ++#define XHCI_MAX_HALT_USEC (32 * 1000) + /* HC not running - set to 1 when run/stop bit is cleared. */ + #define XHCI_STS_HALT (1<<0) + +-- +2.26.2 + diff --git a/patches.suse/wl3501_cs-Fix-out-of-bounds-warnings-in-wl3501_mgmt_.patch b/patches.suse/wl3501_cs-Fix-out-of-bounds-warnings-in-wl3501_mgmt_.patch new file mode 100644 index 0000000..de036d8 --- /dev/null +++ b/patches.suse/wl3501_cs-Fix-out-of-bounds-warnings-in-wl3501_mgmt_.patch @@ -0,0 +1,286 @@ +From bb43e5718d8f1b46e7a77e7b39be3c691f293050 Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Wed, 14 Apr 2021 18:45:15 -0500 +Subject: [PATCH] wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join +Git-commit: bb43e5718d8f1b46e7a77e7b39be3c691f293050 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Fix the following out-of-bounds warnings by adding a new structure +wl3501_req instead of duplicating the same members in structure +wl3501_join_req and wl3501_scan_confirm: + +arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [39, 108] from the object at 'sig' is out of the bounds of referenced subobject 'beacon_period' with type 'short unsigned int' at offset 36 [-Warray-bounds] +arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [25, 95] from the object at 'sig' is out of the bounds of referenced subobject 'beacon_period' with type 'short unsigned int' at offset 22 [-Warray-bounds] + +Refactor the code, accordingly: + +$ pahole -C wl3501_req drivers/net/wireless/wl3501_cs.o +struct wl3501_req { + u16 beacon_period; /* 0 2 */ + u16 dtim_period; /* 2 2 */ + u16 cap_info; /* 4 2 */ + u8 bss_type; /* 6 1 */ + u8 bssid[6]; /* 7 6 */ + struct iw_mgmt_essid_pset ssid; /* 13 34 */ + struct iw_mgmt_ds_pset ds_pset; /* 47 3 */ + struct iw_mgmt_cf_pset cf_pset; /* 50 8 */ + struct iw_mgmt_ibss_pset ibss_pset; /* 58 4 */ + struct iw_mgmt_data_rset bss_basic_rset; /* 62 10 */ + + /* size: 72, cachelines: 2, members: 10 */ + /* last cacheline: 8 bytes */ +}; + +$ pahole -C wl3501_join_req drivers/net/wireless/wl3501_cs.o +struct wl3501_join_req { + u16 next_blk; /* 0 2 */ + u8 sig_id; /* 2 1 */ + u8 reserved; /* 3 1 */ + struct iw_mgmt_data_rset operational_rset; /* 4 10 */ + u16 reserved2; /* 14 2 */ + u16 timeout; /* 16 2 */ + u16 probe_delay; /* 18 2 */ + u8 timestamp[8]; /* 20 8 */ + u8 local_time[8]; /* 28 8 */ + struct wl3501_req req; /* 36 72 */ + + /* size: 108, cachelines: 2, members: 10 */ + /* last cacheline: 44 bytes */ +}; + +$ pahole -C wl3501_scan_confirm drivers/net/wireless/wl3501_cs.o +struct wl3501_scan_confirm { + u16 next_blk; /* 0 2 */ + u8 sig_id; /* 2 1 */ + u8 reserved; /* 3 1 */ + u16 status; /* 4 2 */ + char timestamp[8]; /* 6 8 */ + char localtime[8]; /* 14 8 */ + struct wl3501_req req; /* 22 72 */ + /* --- cacheline 1 boundary (64 bytes) was 30 bytes ago --- */ + u8 rssi; /* 94 1 */ + + /* size: 96, cachelines: 2, members: 8 */ + /* padding: 1 */ + /* last cacheline: 32 bytes */ +}; + +The problem is that the original code is trying to copy data into a +bunch of struct members adjacent to each other in a single call to +memcpy(). Now that a new struct wl3501_req enclosing all those adjacent +members is introduced, memcpy() doesn't overrun the length of +&sig.beacon_period and &this->bss_set[i].beacon_period, because the +address of the new struct object _req_ is used as the destination, +instead. + +This helps with the ongoing efforts to globally enable -Warray-bounds +and get us closer to being able to tighten the FORTIFY_SOURCE routines +on memcpy(). + +Link: https://github.com/KSPP/linux/issues/109 +Reported-by: kernel test robot +Signed-off-by: Gustavo A. R. Silva +Reviewed-by: Kees Cook +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1fbaf516da763b50edac47d792a9145aa4482e29.1618442265.git.gustavoars@kernel.org +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/wl3501.h | 35 +++++++++++-------------- + drivers/net/wireless/wl3501_cs.c | 44 +++++++++++++++++--------------- + 2 files changed, 38 insertions(+), 41 deletions(-) + +diff --git a/drivers/net/wireless/wl3501.h b/drivers/net/wireless/wl3501.h +index 8c5480bec104..91f276dd22a1 100644 +--- a/drivers/net/wireless/wl3501.h ++++ b/drivers/net/wireless/wl3501.h +@@ -379,16 +379,7 @@ struct wl3501_get_confirm { + u8 mib_value[100]; + }; + +-struct wl3501_join_req { +- u16 next_blk; +- u8 sig_id; +- u8 reserved; +- struct iw_mgmt_data_rset operational_rset; +- u16 reserved2; +- u16 timeout; +- u16 probe_delay; +- u8 timestamp[8]; +- u8 local_time[8]; ++struct wl3501_req { + u16 beacon_period; + u16 dtim_period; + u16 cap_info; +@@ -401,6 +392,19 @@ struct wl3501_join_req { + struct iw_mgmt_data_rset bss_basic_rset; + }; + ++struct wl3501_join_req { ++ u16 next_blk; ++ u8 sig_id; ++ u8 reserved; ++ struct iw_mgmt_data_rset operational_rset; ++ u16 reserved2; ++ u16 timeout; ++ u16 probe_delay; ++ u8 timestamp[8]; ++ u8 local_time[8]; ++ struct wl3501_req req; ++}; ++ + struct wl3501_join_confirm { + u16 next_blk; + u8 sig_id; +@@ -443,16 +447,7 @@ struct wl3501_scan_confirm { + u16 status; + char timestamp[8]; + char localtime[8]; +- u16 beacon_period; +- u16 dtim_period; +- u16 cap_info; +- u8 bss_type; +- u8 bssid[ETH_ALEN]; +- struct iw_mgmt_essid_pset ssid; +- struct iw_mgmt_ds_pset ds_pset; +- struct iw_mgmt_cf_pset cf_pset; +- struct iw_mgmt_ibss_pset ibss_pset; +- struct iw_mgmt_data_rset bss_basic_rset; ++ struct wl3501_req req; + u8 rssi; + }; + +diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c +index 70307308635f..672f5d5f3f2c 100644 +--- a/drivers/net/wireless/wl3501_cs.c ++++ b/drivers/net/wireless/wl3501_cs.c +@@ -590,7 +590,7 @@ static int wl3501_mgmt_join(struct wl3501_card *this, u16 stas) + struct wl3501_join_req sig = { + .sig_id = WL3501_SIG_JOIN_REQ, + .timeout = 10, +- .ds_pset = { ++ .req.ds_pset = { + .el = { + .id = IW_MGMT_INFO_ELEMENT_DS_PARAMETER_SET, + .len = 1, +@@ -599,7 +599,7 @@ static int wl3501_mgmt_join(struct wl3501_card *this, u16 stas) + }, + }; + +- memcpy(&sig.beacon_period, &this->bss_set[stas].beacon_period, 72); ++ memcpy(&sig.req, &this->bss_set[stas].req, sizeof(sig.req)); + return wl3501_esbq_exec(this, &sig, sizeof(sig)); + } + +@@ -667,35 +667,37 @@ static void wl3501_mgmt_scan_confirm(struct wl3501_card *this, u16 addr) + if (sig.status == WL3501_STATUS_SUCCESS) { + pr_debug("success"); + if ((this->net_type == IW_MODE_INFRA && +- (sig.cap_info & WL3501_MGMT_CAPABILITY_ESS)) || ++ (sig.req.cap_info & WL3501_MGMT_CAPABILITY_ESS)) || + (this->net_type == IW_MODE_ADHOC && +- (sig.cap_info & WL3501_MGMT_CAPABILITY_IBSS)) || ++ (sig.req.cap_info & WL3501_MGMT_CAPABILITY_IBSS)) || + this->net_type == IW_MODE_AUTO) { + if (!this->essid.el.len) + matchflag = 1; + else if (this->essid.el.len == 3 && + !memcmp(this->essid.essid, "ANY", 3)) + matchflag = 1; +- else if (this->essid.el.len != sig.ssid.el.len) ++ else if (this->essid.el.len != sig.req.ssid.el.len) + matchflag = 0; +- else if (memcmp(this->essid.essid, sig.ssid.essid, ++ else if (memcmp(this->essid.essid, sig.req.ssid.essid, + this->essid.el.len)) + matchflag = 0; + else + matchflag = 1; + if (matchflag) { + for (i = 0; i < this->bss_cnt; i++) { +- if (ether_addr_equal_unaligned(this->bss_set[i].bssid, sig.bssid)) { ++ if (ether_addr_equal_unaligned(this->bss_set[i].req.bssid, ++ sig.req.bssid)) { + matchflag = 0; + break; + } + } + } + if (matchflag && (i < 20)) { +- memcpy(&this->bss_set[i].beacon_period, +- &sig.beacon_period, 73); ++ memcpy(&this->bss_set[i].req, ++ &sig.req, sizeof(sig.req)); + this->bss_cnt++; + this->rssi = sig.rssi; ++ this->bss_set[i].rssi = sig.rssi; + } + } + } else if (sig.status == WL3501_STATUS_TIMEOUT) { +@@ -887,19 +889,19 @@ static void wl3501_mgmt_join_confirm(struct net_device *dev, u16 addr) + if (this->join_sta_bss < this->bss_cnt) { + const int i = this->join_sta_bss; + memcpy(this->bssid, +- this->bss_set[i].bssid, ETH_ALEN); +- this->chan = this->bss_set[i].ds_pset.chan; ++ this->bss_set[i].req.bssid, ETH_ALEN); ++ this->chan = this->bss_set[i].req.ds_pset.chan; + iw_copy_mgmt_info_element(&this->keep_essid.el, +- &this->bss_set[i].ssid.el); ++ &this->bss_set[i].req.ssid.el); + wl3501_mgmt_auth(this); + } + } else { + const int i = this->join_sta_bss; + +- memcpy(&this->bssid, &this->bss_set[i].bssid, ETH_ALEN); +- this->chan = this->bss_set[i].ds_pset.chan; ++ memcpy(&this->bssid, &this->bss_set[i].req.bssid, ETH_ALEN); ++ this->chan = this->bss_set[i].req.ds_pset.chan; + iw_copy_mgmt_info_element(&this->keep_essid.el, +- &this->bss_set[i].ssid.el); ++ &this->bss_set[i].req.ssid.el); + wl3501_online(dev); + } + } else { +@@ -1573,30 +1575,30 @@ static int wl3501_get_scan(struct net_device *dev, struct iw_request_info *info, + for (i = 0; i < this->bss_cnt; ++i) { + iwe.cmd = SIOCGIWAP; + iwe.u.ap_addr.sa_family = ARPHRD_ETHER; +- memcpy(iwe.u.ap_addr.sa_data, this->bss_set[i].bssid, ETH_ALEN); ++ memcpy(iwe.u.ap_addr.sa_data, this->bss_set[i].req.bssid, ETH_ALEN); + current_ev = iwe_stream_add_event(info, current_ev, + extra + IW_SCAN_MAX_DATA, + &iwe, IW_EV_ADDR_LEN); + iwe.cmd = SIOCGIWESSID; + iwe.u.data.flags = 1; +- iwe.u.data.length = this->bss_set[i].ssid.el.len; ++ iwe.u.data.length = this->bss_set[i].req.ssid.el.len; + current_ev = iwe_stream_add_point(info, current_ev, + extra + IW_SCAN_MAX_DATA, + &iwe, +- this->bss_set[i].ssid.essid); ++ this->bss_set[i].req.ssid.essid); + iwe.cmd = SIOCGIWMODE; +- iwe.u.mode = this->bss_set[i].bss_type; ++ iwe.u.mode = this->bss_set[i].req.bss_type; + current_ev = iwe_stream_add_event(info, current_ev, + extra + IW_SCAN_MAX_DATA, + &iwe, IW_EV_UINT_LEN); + iwe.cmd = SIOCGIWFREQ; +- iwe.u.freq.m = this->bss_set[i].ds_pset.chan; ++ iwe.u.freq.m = this->bss_set[i].req.ds_pset.chan; + iwe.u.freq.e = 0; + current_ev = iwe_stream_add_event(info, current_ev, + extra + IW_SCAN_MAX_DATA, + &iwe, IW_EV_FREQ_LEN); + iwe.cmd = SIOCGIWENCODE; +- if (this->bss_set[i].cap_info & WL3501_MGMT_CAPABILITY_PRIVACY) ++ if (this->bss_set[i].req.cap_info & WL3501_MGMT_CAPABILITY_PRIVACY) + iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY; + else + iwe.u.data.flags = IW_ENCODE_DISABLED; +-- +2.26.2 + diff --git a/patches.suse/wl3501_cs-Fix-out-of-bounds-warnings-in-wl3501_send_.patch b/patches.suse/wl3501_cs-Fix-out-of-bounds-warnings-in-wl3501_send_.patch new file mode 100644 index 0000000..a172e30 --- /dev/null +++ b/patches.suse/wl3501_cs-Fix-out-of-bounds-warnings-in-wl3501_send_.patch @@ -0,0 +1,147 @@ +From 820aa37638a252b57967bdf4038a514b1ab85d45 Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Wed, 14 Apr 2021 18:43:19 -0500 +Subject: [PATCH] wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt +Git-commit: 820aa37638a252b57967bdf4038a514b1ab85d45 +Patch-mainline: v5.13-rc1 +References: git-fixes + +Fix the following out-of-bounds warnings by enclosing structure members +daddr and saddr into new struct addr, in structures wl3501_md_req and +Wl3501_md_ind: + +arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [18, 23] from the object at 'sig' is out of the bounds of referenced subobject 'daddr' with type 'u8[6]' {aka 'unsigned char[6]'} at offset 11 [-Warray-bounds] +arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [18, 23] from the object at 'sig' is out of the bounds of referenced subobject 'daddr' with type 'u8[6]' {aka 'unsigned char[6]'} at offset 11 [-Warray-bounds] + +Refactor the code, accordingly: + +$ pahole -C wl3501_md_req drivers/net/wireless/wl3501_cs.o +struct wl3501_md_req { + u16 next_blk; /* 0 2 */ + u8 sig_id; /* 2 1 */ + u8 routing; /* 3 1 */ + u16 data; /* 4 2 */ + u16 size; /* 6 2 */ + u8 pri; /* 8 1 */ + u8 service_class; /* 9 1 */ + struct { + u8 daddr[6]; /* 10 6 */ + u8 saddr[6]; /* 16 6 */ + } addr; /* 10 12 */ + + /* size: 22, cachelines: 1, members: 8 */ + /* last cacheline: 22 bytes */ +}; + +$ pahole -C wl3501_md_ind drivers/net/wireless/wl3501_cs.o +struct wl3501_md_ind { + u16 next_blk; /* 0 2 */ + u8 sig_id; /* 2 1 */ + u8 routing; /* 3 1 */ + u16 data; /* 4 2 */ + u16 size; /* 6 2 */ + u8 reception; /* 8 1 */ + u8 pri; /* 9 1 */ + u8 service_class; /* 10 1 */ + struct { + u8 daddr[6]; /* 11 6 */ + u8 saddr[6]; /* 17 6 */ + } addr; /* 11 12 */ + + /* size: 24, cachelines: 1, members: 9 */ + /* padding: 1 */ + /* last cacheline: 24 bytes */ +}; + +The problem is that the original code is trying to copy data into a +couple of arrays adjacent to each other in a single call to memcpy(). +Now that a new struct _addr_ enclosing those two adjacent arrays +is introduced, memcpy() doesn't overrun the length of &sig.daddr[0] +and &sig.daddr, because the address of the new struct object _addr_ +is used, instead. + +This helps with the ongoing efforts to globally enable -Warray-bounds +and get us closer to being able to tighten the FORTIFY_SOURCE routines +on memcpy(). + +Link: https://github.com/KSPP/linux/issues/109 +Reported-by: kernel test robot +Reviewed-by: Kees Cook +Signed-off-by: Gustavo A. R. Silva +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/d260fe56aed7112bff2be5b4d152d03ad7b78e78.1618442265.git.gustavoars@kernel.org +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/wl3501.h | 12 ++++++++---- + drivers/net/wireless/wl3501_cs.c | 10 ++++++---- + 2 files changed, 14 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/wl3501.h b/drivers/net/wireless/wl3501.h +index 5779ffbe5d0f..8c5480bec104 100644 +--- a/drivers/net/wireless/wl3501.h ++++ b/drivers/net/wireless/wl3501.h +@@ -471,8 +471,10 @@ struct wl3501_md_req { + u16 size; + u8 pri; + u8 service_class; +- u8 daddr[ETH_ALEN]; +- u8 saddr[ETH_ALEN]; ++ struct { ++ u8 daddr[ETH_ALEN]; ++ u8 saddr[ETH_ALEN]; ++ } addr; + }; + + struct wl3501_md_ind { +@@ -484,8 +486,10 @@ struct wl3501_md_ind { + u8 reception; + u8 pri; + u8 service_class; +- u8 daddr[ETH_ALEN]; +- u8 saddr[ETH_ALEN]; ++ struct { ++ u8 daddr[ETH_ALEN]; ++ u8 saddr[ETH_ALEN]; ++ } addr; + }; + + struct wl3501_md_confirm { +diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c +index 8ca5789c7b37..70307308635f 100644 +--- a/drivers/net/wireless/wl3501_cs.c ++++ b/drivers/net/wireless/wl3501_cs.c +@@ -469,6 +469,7 @@ static int wl3501_send_pkt(struct wl3501_card *this, u8 *data, u16 len) + struct wl3501_md_req sig = { + .sig_id = WL3501_SIG_MD_REQ, + }; ++ size_t sig_addr_len = sizeof(sig.addr); + u8 *pdata = (char *)data; + int rc = -EIO; + +@@ -484,9 +485,9 @@ static int wl3501_send_pkt(struct wl3501_card *this, u8 *data, u16 len) + goto out; + } + rc = 0; +- memcpy(&sig.daddr[0], pdata, 12); +- pktlen = len - 12; +- pdata += 12; ++ memcpy(&sig.addr, pdata, sig_addr_len); ++ pktlen = len - sig_addr_len; ++ pdata += sig_addr_len; + sig.data = bf; + if (((*pdata) * 256 + (*(pdata + 1))) > 1500) { + u8 addr4[ETH_ALEN] = { +@@ -980,7 +981,8 @@ static inline void wl3501_md_ind_interrupt(struct net_device *dev, + } else { + skb->dev = dev; + skb_reserve(skb, 2); /* IP headers on 16 bytes boundaries */ +- skb_copy_to_linear_data(skb, (unsigned char *)&sig.daddr, 12); ++ skb_copy_to_linear_data(skb, (unsigned char *)&sig.addr, ++ sizeof(sig.addr)); + wl3501_receive(this, skb->data, pkt_len); + skb_put(skb, pkt_len); + skb->protocol = eth_type_trans(skb, dev); +-- +2.26.2 + diff --git a/patches.suse/x86-cpu-initialize-msr_tsc_aux-if-rdtscp-or-rdpid-is-supported.patch b/patches.suse/x86-cpu-initialize-msr_tsc_aux-if-rdtscp-or-rdpid-is-supported.patch new file mode 100644 index 0000000..e17606f --- /dev/null +++ b/patches.suse/x86-cpu-initialize-msr_tsc_aux-if-rdtscp-or-rdpid-is-supported.patch @@ -0,0 +1,45 @@ +From: Sean Christopherson +Date: Tue, 4 May 2021 15:56:31 -0700 +Subject: x86/cpu: Initialize MSR_TSC_AUX if RDTSCP *or* RDPID is supported +Git-commit: b6b4fbd90b155a0025223df2c137af8a701d53b3 +Patch-mainline: v5.13-rc1 +References: bsc#1152489 + +Initialize MSR_TSC_AUX with CPU node information if RDTSCP or RDPID is +supported. This fixes a bug where vdso_read_cpunode() will read garbage +via RDPID if RDPID is supported but RDTSCP is not. While no known CPU +supports RDPID but not RDTSCP, both Intel's SDM and AMD's APM allow for +RDPID to exist without RDTSCP, e.g. it's technically a legal CPU model +for a virtual machine. + +Note, technically MSR_TSC_AUX could be initialized if and only if RDPID +is supported since RDTSCP is currently not used to retrieve the CPU node. +But, the cost of the superfluous WRMSR is negigible, whereas leaving +MSR_TSC_AUX uninitialized is just asking for future breakage if someone +decides to utilize RDTSCP. + +Fixes: a582c540ac1b ("x86/vdso: Use RDPID in preference to LSL when available") +Signed-off-by: Sean Christopherson +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20210504225632.1532621-2-seanjc@google.com + +Acked-by: Borislav Petkov +--- + arch/x86/kernel/cpu/common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index 6bdb69a9a7dc..490bed07fe35 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -1851,7 +1851,7 @@ static inline void setup_getcpu(int cpu) + unsigned long cpudata = vdso_encode_cpunode(cpu, early_cpu_to_node(cpu)); + struct desc_struct d = { }; + +- if (boot_cpu_has(X86_FEATURE_RDTSCP)) ++ if (boot_cpu_has(X86_FEATURE_RDTSCP) || boot_cpu_has(X86_FEATURE_RDPID)) + write_rdtscp_aux(cpudata); + + /* Store CPU and node number in limit. */ + diff --git a/series.conf b/series.conf index 4c04f28..2061301 100644 --- a/series.conf +++ b/series.conf @@ -1055,6 +1055,10 @@ patches.suse/net-hns3-Add-support-for-using-order-1-pages-with-a-.patch patches.suse/net-hns3-use-dev_info-instead-of-pr_info.patch patches.suse/NFC-fix-attrs-checks-in-netlink-interface.patch + patches.suse/NFC-nxp-nci-Add-NXP1001-to-the-ACPI-ID-table.patch + patches.suse/NFC-nxp-nci-Get-rid-of-platform-data.patch + patches.suse/NFC-nxp-nci-Convert-to-use-GPIO-descriptor.patch + patches.suse/NFC-nxp-nci-Add-GPIO-ACPI-mapping-table.patch patches.suse/bnxt_en-Update-firmware-interface-spec.-to-1.10.0.89.patch patches.suse/bnxt_en-Add-TPA-structure-definitions-for-BCM57500-c.patch patches.suse/bnxt_en-Refactor-TPA-logic.patch @@ -5413,6 +5417,7 @@ patches.suse/ahci-Add-support-for-Amazon-s-Annapurna-Labs-SATA-co.patch patches.suse/ahci-tegra-use-regulator_bulk_set_supply_names.patch patches.suse/libata-Ensure-ata_port-probe-has-completed-before-de.patch + patches.suse/block-Fix-three-kernel-doc-warnings.patch patches.suse/block-Fix-writeback-throttling-W-1-compiler-warnings.patch patches.suse/fcntl-fix-typo-in-RWH_WRITE_LIFE_NOT_SET-r-w-hint-na.patch patches.suse/blk-mq-avoid-sysfs-buffer-overflow-with-too-many-CPU.patch @@ -7144,6 +7149,7 @@ patches.suse/USB-chaoskey-fix-error-case-of-a-timeout.patch patches.suse/USBIP-add-config-dependency-for-SGL_ALLOC.patch patches.suse/usbip-Fix-uninitialized-symbol-nents-in-stub_recv_cm.patch + patches.suse/USB-serial-pl2303-add-support-for-PL2303HXN.patch patches.suse/USB-serial-mos7840-add-USB-ID-to-support-Moxa-UPort-.patch patches.suse/USB-serial-option-add-support-for-DW5821e-with-eSIM-.patch patches.suse/0001-USB-serial-mos7720-fix-remote-wakeup.patch @@ -11491,6 +11497,10 @@ patches.suse/nvme-code-cleanup-nvme_identify_ns_desc.patch patches.suse/nvme-log-additional-message-for-controller-status.patch patches.suse/nvme-Check-for-readiness-more-quickly-to-speed-up-bo.patch + patches.suse/nvme-pci-slimmer-CQ-head-update.patch + patches.suse/nvme-pci-Remove-tag-from-process-cq.patch + patches.suse/nvme-pci-Remove-two-pass-completions.patch + patches.suse/nvme-pci-Simplify-nvme_poll_irqdisable.patch patches.suse/nvme-tcp-optimize-queue-io_cpu-assignment-for-multip.patch patches.suse/nvmet-tcp-fix-maxh2cdata-icresp-parameter.patch patches.suse/nvme-tcp-move-send-failure-to-nvme_tcp_try_send.patch @@ -12170,6 +12180,7 @@ patches.suse/pinctrl-bcm2835-drop-unused-define.patch patches.suse/pinctrl-bcm2835-refactor-platform-data.patch patches.suse/pinctrl-bcm2835-add-support-for-all-gpios-on-bcm2711.patch + patches.suse/pinctrl-ingenic-Improve-unreachable-code-generation.patch patches.suse/pinctrl-sprd-Use-the-correct-pin-output-configuratio.patch patches.suse/ALSA-hda-ca0132-Add-Recon3Di-quirk-to-handle-integra.patch patches.suse/ALSA-hda-realtek-Enable-mute-LED-on-an-HP-system.patch @@ -13117,6 +13128,7 @@ patches.suse/bdi-move-bdi_dev_name-out-of-line.patch patches.suse/bdi-use-bdi_dev_name-to-get-device-name.patch patches.suse/bdi-add-a-dev_name-field-to-struct-backing_dev_info.patch + patches.suse/nvme-pci-fix-slimmer-CQ-head-update.patch patches.suse/nvme-fix-possible-hang-when-ns-scanning-fails-during.patch patches.suse/iommu-amd-fix-race-in-increase_address_space-fetch_pte patches.suse/iommu-amd-do-not-loop-forever-when-trying-to-increase-address-space @@ -13217,6 +13229,7 @@ patches.suse/pinctrl-sunrisepoint-Fix-PAD-lock-register-offset-fo.patch patches.suse/pinctrl-baytrail-Enable-pin-configuration-setting-fo.patch patches.suse/pinctrl-cherryview-Add-missing-spinlock-usage-in-chv.patch + patches.suse/nvme-pci-dma-read-memory-barrier-for-completions.patch patches.suse/arm64-dts-rockchip-Replace-RK805-PMIC-node-name-with.patch patches.suse/arm64-dts-rockchip-Rename-dwc3-device-nodes-on-rk339.patch patches.suse/ARM-oxnas-make-ox820_boot_secondary-static.patch @@ -13357,6 +13370,7 @@ patches.suse/RDMA-pvrdma-Fix-missing-pci-disable-in-pvrdma_pci_pr.patch patches.suse/RDMA-core-Fix-double-destruction-of-uobject.patch patches.suse/IB-ipoib-Fix-double-free-of-skb-in-case-of-multicast.patch + patches.suse/nvme-pci-avoid-race-between-nvme_reap_pending_cqes-a.patch patches.suse/iommu-fix-reference-count-leak-in-iommu_group_alloc patches.suse/0004-libceph-ignore-pool-overlay-and-cache-logic-on-redirects.patch patches.suse/0005-ceph-flush-release-queue-when-handling-caps-for-unknown-inode.patch @@ -13440,6 +13454,7 @@ patches.suse/x86-cpu-amd-make-erratum-1054-a-legacy-erratum.patch patches.suse/ACPI-IORT-Fix-PMCG-node-single-ID-mapping-handling.patch patches.suse/arm64-insn-Fix-two-bugs-in-encoding-32-bit-logical-i.patch + patches.suse/arm-mm-use-__pfn_to_section-to-get-mem_section.patch patches.suse/arm64-kexec_file-print-appropriate-variable.patch patches.suse/arm64-cacheflush-Fix-KGDB-trap-detection.patch patches.suse/drivers-perf-hisi-Permit-modular-builds-of-HiSilicon.patch @@ -13565,6 +13580,9 @@ patches.suse/nvme-revalidate-namespace-stream-parameters.patch patches.suse/nvme-consolodate-io-settings.patch patches.suse/nvme-fc-avoid-gcc-10-zero-length-bounds-warning.patch + patches.suse/nvme-pci-remove-volatile-cqes.patch + patches.suse/nvme-pci-remove-last_sq_tail.patch + patches.suse/nvme-pci-align-io-queue-count-with-allocted-nvme_que.patch patches.suse/nvme-tcp-use-bh_lock-in-data_ready.patch patches.suse/nvme-tcp-avoid-scheduling-io_work-if-we-are-already-.patch patches.suse/nvme-tcp-try-to-send-request-in-queue_rq-context.patch @@ -13572,6 +13590,7 @@ patches.suse/0001-md-don-t-flush-workqueue-unconditionally-in-md_open.patch patches.suse/0007-raid5-remove-gfp-flags-from-scribble_alloc.patch patches.suse/nvme-tcp-set-MSG_SENDPAGE_NOTLAST-with-MSG_MORE-when.patch + patches.suse/nvme-pci-make-sure-write-poll_queues-less-or-equal-t.patch patches.suse/nvme-fc-print-proper-nvme-fc-devloss_tmo-value.patch patches.suse/lpfc-Fix-pointer-checks-and-comments-in-LS-receive-r.patch patches.suse/lpfc-fix-axchg-pointer-reference-after-free-and-doub.patch @@ -13627,6 +13646,7 @@ patches.suse/kvm-x86-mmu-set-mmio_value-to-0-if-reserved-pf-can-t-be-generated patches.suse/kvm-x86-allow-kvm_state_nested_mtf_pending-in-kvm_state-flags patches.suse/KVM-nVMX-always-update-CR3-in-VMCS.patch + patches.suse/Bluetooth-L2CAP-Fix-handling-LE-modes-by-L2CAP_OPTIO.patch patches.suse/Bluetooth-hci_bcm-fix-freeing-not-requested-IRQ.patch patches.suse/Bluetooth-btrtl-Add-support-for-RTL8761B.patch patches.suse/e1000-Distribute-switch-variables-for-initialization.patch @@ -14060,6 +14080,7 @@ patches.suse/drivers-base-Fix-NULL-pointer-exception-in-__platfor.patch patches.suse/drivers-char-tlclk.c-Avoid-data-race-between-init-an.patch patches.suse/slimbus-ngd-get-drvdata-from-correct-device.patch + patches.suse/msft-hv-2080-uio_hv_generic-add-missed-sysfs_remove_bin_file.patch patches.suse/firmware-xilinx-Fix-an-error-handling-path-in-zynqmp.patch patches.suse/slimbus-core-Fix-mismatch-in-of_node_get-put.patch patches.suse/misc-fastrpc-fix-potential-fastrpc_invoke_ctx-leak.patch @@ -14251,6 +14272,7 @@ patches.suse/block-bio-integrity-don-t-free-buf-if-bio_integrity_.patch patches.suse/block-nr_sects_write-Disable-preemption-on-seqcount-.patch patches.suse/nvme-fc-don-t-call-nvme_cleanup_cmd-for-AENs.patch + patches.suse/nvme-pci-use-simple-suspend-when-a-HMB-is-enabled.patch patches.suse/io_uring-use-kvfree-in-io_sqe_buffer_register.patch patches.suse/lib-lzo-fix-ambiguous-encoding-bug-in-lzo-rle.patch patches.suse/amdgpu-a-NULL-mm-does-not-mean-a-thread-is-a-kthread.patch @@ -14750,6 +14772,7 @@ patches.suse/fuse-fix-parameter-for-fs_ioc_-get-set-flags.patch patches.suse/nvme-explicitly-update-mpath-disk-capacity-on-revali.patch patches.suse/drivers-perf-Fix-kernel-panic-when-rmmod-PMU-modules.patch + patches.suse/arm64-ptrace-Use-NO_SYSCALL-instead-of-1-in-syscall_.patch patches.suse/bus-ti-sysc-Do-not-disable-on-suspend-for-no-idle.patch patches.suse/NFS-Fix-interrupted-slots-by-sending-a-solo-SEQUENCE.patch patches.suse/xprtrdma-fix-incorrect-header-size-calculations.patch @@ -14880,6 +14903,7 @@ patches.suse/sched-Fix-race-against-ptrace_freeze_trace.patch patches.suse/x86-unwind-orc-fix-orc-for-newly-forked-tasks.patch patches.suse/x86-stacktrace-fix-reliable-check-for-empty-user-task-stacks.patch + patches.suse/scsi-core-Run-queue-in-case-of-I-O-resource-contenti.patch patches.suse/usb-xhci-mtk-fix-the-failure-of-bandwidth-allocation.patch patches.suse/usb-xhci-Fix-ASM2142-ASM3142-DMA-addressing.patch patches.suse/usb-tegra-Fix-allocation-for-the-FPCI-context.patch @@ -15096,6 +15120,8 @@ patches.suse/0003-md-cluster-fix-rmmod-issue-when-md_cluster-convert-b.patch patches.suse/0001-bcache-allocate-meta-data-pages-as-compound-pages.patch patches.suse/0003-bcache-fix-overflow-in-offset_to_stripe.patch + patches.suse/nvme-document-nvme-controller-states.patch + patches.suse/nvme-fix-deadlock-in-disconnect-during-scan_work-and.patch patches.suse/nvme-fc-set-max_segments-to-lldd-max-value.patch patches.suse/nvme-tcp-fix-controller-reset-hang-during-traffic.patch patches.suse/nvme-rdma-fix-controller-reset-hang-during-traffic.patch @@ -15791,6 +15817,7 @@ patches.suse/Revert-scsi-qla2xxx-Fix-crash-on-qla2x00_mailbox_com.patch patches.suse/Revert-scsi-qla2xxx-Disable-T10-DIF-feature-with-FC-.patch patches.suse/s390-cio-add-cond_resched-in-the-slow_eval_known_fn-loop + patches.suse/ARM64-vdso32-Install-vdso32-from-vdso_install.patch patches.suse/epoll-Keep-a-reference-on-files-added-to-the-check-list.patch patches.suse/do_epoll_ctl-clean-the-failure-exits-up-a-bit.patch patches.suse/net-gianfar-Add-of_node_put-before-goto-statement.patch @@ -15858,6 +15885,7 @@ patches.suse/writeback-Avoid-skipping-inode-writeback.patch patches.suse/writeback-Fix-sync-livelock-due-to-b_dirty_time-proc.patch patches.suse/writeback-Drop-I_DIRTY_TIME_EXPIRE.patch + patches.suse/arm64-vdso32-make-vdso32-install-conditional.patch patches.suse/PM-sleep-core-Fix-the-handling-of-pending-runtime-re.patch patches.suse/device-property-Fix-the-secondary-firmware-node-hand.patch patches.suse/hwmon-applesmc-check-status-earlier.patch @@ -16434,6 +16462,7 @@ patches.suse/0004-md-bitmap-md_bitmap_read_sb-uses-wrong-bitmap-blocks.patch patches.suse/0005-md-bitmap-md_bitmap_get_counter-returns-wrong-blocks.patch patches.suse/0006-md-bitmap-fix-memory-leak-of-temporary-bitmap.patch + patches.suse/Revert-arm64-vdso-Fix-compilation-with-clang-older-t.patch patches.suse/mmswapfile.c-fix-potential-memory-leak-in-sys_swapon.patch patches.suse/msft-hv-2161-hv-clocksource-Add-notrace-attribute-to-read_hv_sche.patch patches.suse/xen-gntdev.c-Mark-pages-as-dirty.patch @@ -16883,6 +16912,7 @@ patches.suse/vfio-iommu-add-dma-available-capability patches.suse/module-statically-initialize-init-section-freeing-da.patch patches.suse/Werror-return-type.patch + patches.suse/arm64-link-with-z-norelro-regardless-of-CONFIG_RELOC.patch patches.suse/KVM-x86-mmu-Commit-zap-of-remaining-invalid-pages-wh.patch patches.suse/kvm-nvmx-reload-vmcs01-if-getting-vmcs12-s-pages-fails patches.suse/kvm-x86-add-rip-to-the-kvm_entry-i-e-vm-enter-tracepoint @@ -16986,6 +17016,7 @@ patches.suse/ACPI-NFIT-Fix-comparison-to-ENXIO.patch patches.suse/ACPI-dock-fix-enum-conversion-warning.patch patches.suse/KVM-arm64-ARM_SMCCC_ARCH_WORKAROUND_1-doesn-t-return.patch + patches.suse/arm64-avoid-Woverride-init-warning.patch patches.suse/btrfs-fix-relocation-failure-due-to-race-with-falloc.patch patches.suse/btrfs-fix-use-after-free-on-readahead-extent-after-f.patch patches.suse/btrfs-fix-readahead-hang-and-use-after-free-after-re.patch @@ -17672,6 +17703,7 @@ patches.suse/speakup-fix-uninitialized-flush_lock.patch patches.suse/misc-vmw_vmci-fix-kernel-info-leak-by-initializing-d.patch patches.suse/bus-fsl-mc-fix-error-return-code-in-fsl_mc_object_al.patch + patches.suse/msft-hv-2197-uio-uio_hv_generic-use-devm_kzalloc-for-private-data.patch patches.suse/extcon-max77693-Fix-modalias-string.patch patches.suse/iio-buffer-Fix-demux-update.patch patches.suse/iio-light-rpr0521-Fix-timestamp-alignment-and-preven.patch @@ -18102,6 +18134,7 @@ patches.suse/net-mlx5e-Fix-two-double-free-cases.patch patches.suse/net-mlx5e-Fix-memleak-in-mlx5e_create_l2_table_group.patch patches.suse/arm64-mm-fix-arch_low_address_limit-when-config_zone_dma.patch + patches.suse/arm64-link-with-z-norelro-for-LLD-or-aarch64-elf.patch patches.suse/iommu-intel-fix-memleak-in-intel_irq_remapping_alloc patches.suse/iommu-vt-d-move-intel_iommu-info-from-struct-intel_svm-to-struct-intel_svm_dev patches.suse/iommu-vt-d-fix-general-protection-fault-in-aux_detach_device @@ -18240,6 +18273,7 @@ patches.suse/mmc-core-don-t-initialize-block-size-from-ext_csd-if.patch patches.suse/dm-avoid-filesystem-lookup-in-dm_get_dev_t.patch patches.suse/scsi-scsi_transport_srp-Don-t-block-target-in-failfa.patch + patches.suse/scsi-libfc-Avoid-invoking-response-handler-twice-if-.patch patches.suse/scsi-ibmvfc-Set-default-timeout-to-avoid-crash-durin.patch patches.suse/i2c-bpmp-tegra-Ignore-unknown-I2C_M-flags.patch patches.suse/i2c-octeon-check-correct-size-of-maximum-RECV_LEN-pa.patch @@ -18458,6 +18492,7 @@ patches.suse/usb-dwc3-gadget-Fix-dep-interval-for-fullspeed-inter.patch patches.suse/USB-quirks-sort-quirk-entries.patch patches.suse/USB-serial-mos7720-improve-OOM-handling-in-read_mos_.patch + patches.suse/USB-serial-pl2303-fix-line-speed-handling-on-newer-c.patch patches.suse/USB-serial-mos7840-fix-error-code-in-mos7840_write.patch patches.suse/USB-serial-mos7720-fix-error-code-in-mos7720_write.patch patches.suse/USB-serial-ftdi_sio-fix-FTX-sub-integer-prescaler.patch @@ -18494,6 +18529,7 @@ patches.suse/0019-Revert-bcache-Kill-btree_io_wq.patch patches.suse/nvme-hwmon-rework-to-avoid-devm-allocation.patch patches.suse/irqchip-ls-extirq-add-IRQCHIP_SKIP_SET_WAKE-to-the-i.patch + patches.suse/futex-Change-utime-parameter-to-be-const.patch patches.suse/mm-proc-Invalidate-TLB-after-clearing-soft-dirty-pag.patch patches.suse/sched-fair-Avoid-stale-CPU-util_est-value-for-schedu.patch patches.suse/sched-eas-Don-t-update-misfit-status-if-the-task-is-.patch @@ -18758,6 +18794,9 @@ patches.suse/0008-drm-msm-Fix-races-managing-the-OOB-state-for-timesta.patch patches.suse/pwm-rockchip-rockchip_pwm_probe-Remove-superfluous-c.patch patches.suse/0027-mm-rmap-fix-potential-pte_unmap-on-an-not-mapped-pte.patch + patches.suse/arm64-kexec_file-fix-memory-leakage-in-create_dtb-wh.patch + patches.suse/arm64-Add-missing-ISB-after-invalidating-TLB-in-__pr.patch + patches.suse/arm64-ptrace-Fix-seccomp-of-traced-syscall-1-NO_SYSC.patch patches.suse/cifs-New-optype-for-session-operations-.patch patches.suse/cifs-fix-nodfs-mount-option.patch patches.suse/cifs-check-all-path-components-in-resolved-dfs-target.patch @@ -18819,6 +18858,7 @@ patches.suse/ibmvnic-remove-excessive-irqsave.patch patches.suse/gianfar-fix-jumbo-packets-napi-rx-overrun-crash.patch patches.suse/ethernet-alx-fix-order-of-calls-on-resume.patch + patches.suse/0001-netfilter-conntrack-avoid-misleading-invalid-in-log-.patch patches.suse/net-bonding-fix-error-return-code-of-bond_neigh_init.patch patches.suse/s390-qeth-fix-memory-leak-after-failed-tx-buffer-allocation.patch patches.suse/s390-qeth-improve-completion-of-pending-tx-buffers.patch @@ -18843,6 +18883,8 @@ patches.suse/xen-events-reset-affinity-of-2-level-event-when-tear.patch patches.suse/xen-events-don-t-unmask-an-event-channel-when-an-eoi.patch patches.suse/xen-events-avoid-handling-the-same-event-on-two-cpus.patch + patches.suse/arm64-mm-Fix-pfn_valid-for-ZONE_DEVICE-based-memory.patch + patches.suse/arm64-kasan-fix-page_alloc-tagging-with-DEBUG_VIRTUA.patch patches.suse/configfs-fix-a-use-after-free-in-__configfs_open_file.patch patches.suse/mmc-core-Fix-partition-switch-time-for-eMMC.patch patches.suse/mmc-cqhci-Fix-random-crash-when-remove-mmc-module-ca.patch @@ -18856,8 +18898,13 @@ patches.suse/ALSA-hda-Avoid-spurious-unsol-event-handling-during-.patch patches.suse/ALSA-hda-hdmi-Cancel-pending-works-before-suspend.patch patches.suse/software-node-Fix-node-registration.patch + patches.suse/s390-dasd-fix-hanging-dasd-driver-unbind patches.suse/s390-dasd-fix-hanging-io-request-during-dasd-driver-unbind.patch patches.suse/block-rsxx-fix-error-return-code-of-rsxx_pci_probe.patch + patches.suse/nvme-simplify-error-logic-in-nvme_validate_ns.patch + patches.suse/nvme-add-NVME_REQ_CANCELLED-flag-in-nvme_cancel_requ.patch + patches.suse/nvme-fc-set-NVME_REQ_CANCELLED-in-nvme_fc_terminate_.patch + patches.suse/nvme-fc-return-NVME_SC_HOST_ABORTED_CMD-when-a-comma.patch patches.suse/nvme-fc-fix-racing-controller-reset-and-create-assoc.patch patches.suse/Goodix-Fingerprint-device-is-not-a-modem.patch patches.suse/USB-gadget-u_ether-Fix-a-configfs-return-code.patch @@ -19011,6 +19058,7 @@ patches.suse/libbpf-Fix-BTF-dump-of-pointer-to-array-of-struct.patch patches.suse/can-peak_usb-Revert-can-peak_usb-add-forgotten-suppo.patch patches.suse/net-mlx5e-Fix-error-path-for-ethtool-set-priv-flag.patch + patches.suse/arm64-kdump-update-ppos-when-reading-elfcorehdr.patch patches.suse/btrfs-fix-subvolume-snapshot-deletion-not-triggered-.patch patches.suse/drm-msm-adreno-a5xx_power-Don-t-apply-A540-lm_setup-.patch patches.suse/drm-msm-Ratelimit-invalid-fence-message.patch @@ -19200,6 +19248,7 @@ patches.suse/usb-typec-tcpci-Check-ROLE_CONTROL-while-interpretin.patch patches.suse/usb-gadget-uvc-add-bInterval-checking-for-HS-mode.patch patches.suse/usb-webcam-Invalid-size-of-Processing-Unit-Descripto.patch + patches.suse/usb-sl811-hcd-improve-misleading-indentation.patch patches.suse/usb-gadget-function-f_fs-string-table-fix-for-multip.patch patches.suse/usb-gadget-f_uac2-validate-input-parameters.patch patches.suse/usb-gadget-f_uac1-validate-input-parameters.patch @@ -19254,6 +19303,8 @@ patches.suse/soc-qcom-mdt_loader-Validate-that-p_filesz-p_memsz.patch patches.suse/soc-qcom-mdt_loader-Detect-truncated-read-of-segment.patch patches.suse/soc-aspeed-fix-a-ternary-sign-expansion-bug.patch + patches.suse/btrfs-fix-race-between-transaction-aborts-and-fsyncs.patch + patches.suse/btrfs-fix-race-when-picking-most-recent-mod-log-oper.patch patches.suse/ACPI-CPPC-Replace-cppc_attr-with-kobj_attribute.patch patches.suse/cpufreq-armada-37xx-Fix-setting-TBG-parent-for-load-.patch patches.suse/clk-mvebu-armada-37xx-periph-remove-.set_parent-meth.patch @@ -19283,6 +19334,7 @@ patches.suse/spi-fsl-lpspi-Fix-PM-reference-leak-in-lpspi_prepare.patch patches.suse/spi-omap-100k-Fix-reference-leak-to-master.patch patches.suse/spi-qup-fix-PM-reference-leak-in-spi_qup_remove.patch + patches.suse/ceph-fix-up-error-handling-with-snapdirs.patch patches.suse/media-ite-cir-check-for-receive-overflow.patch patches.suse/media-dvb-usb-Fix-memory-leak-at-error-in-dvb_usb_de.patch patches.suse/media-dvb-usb-Fix-use-after-free-access.patch @@ -19322,6 +19374,7 @@ patches.suse/drm-msm-mdp5-Configure-PP_SYNC_HEIGHT-to-double-the-.patch patches.suse/drm-msm-mdp5-Do-not-multiply-vclk-line-count-by-100.patch patches.suse/rsxx-remove-extraneous-const-qualifier.patch + patches.suse/nvme-fc-check-sgl-supported-by-target.patch patches.suse/nvme-remove-superfluous-else-in-nvme_ctrl_loss_tmo_s.patch patches.suse/nvme-retrigger-ANA-log-update-if-group-descriptor-is.patch patches.suse/0002-md-md_open-returns-EBUSY-when-entering-racing-area.patch @@ -19440,7 +19493,11 @@ patches.suse/xsk-Respect-device-s-headroom-and-tailroom-on-generi.patch patches.suse/nfc-pn533-prevent-potential-memory-corruption.patch patches.suse/liquidio-Fix-unintented-sign-extension-of-a-left-shi.patch + patches.suse/Bluetooth-SMP-Fail-if-remote-and-local-public-keys-a.patch + patches.suse/Bluetooth-Set-CONF_NOT_COMPLETE-as-l2cap_chan-defaul.patch patches.suse/Bluetooth-verify-AMP-hci_chan-before-amp_destroy.patch + patches.suse/Bluetooth-initialize-skb_queue_head-at-l2cap_chan_cr.patch + patches.suse/Bluetooth-check-for-zapped-sk-before-connecting.patch patches.suse/cxgb4-Fix-unintentional-sign-extension-issues.patch patches.suse/net-thunderx-Fix-unintentional-sign-extension-issue.patch patches.suse/ibmvnic-clean-up-the-remaining-debugfs-data-structur.patch @@ -19453,10 +19510,15 @@ patches.suse/ipw2x00-potential-buffer-overflow-in-libipw_wx_set_e.patch patches.suse/rsi-Use-resume_noirq-for-SDIO.patch patches.suse/rtw88-Fix-array-overrun-in-rtw_get_tx_power_params.patch + patches.suse/mac80211-clear-the-beacon-s-CRC-after-channel-switch.patch patches.suse/mac80211-bail-out-if-cipher-schemes-are-invalid.patch patches.suse/cfg80211-scan-drop-entry-from-hidden_list-on-overflo.patch + patches.suse/net-enetc-fix-link-error-again.patch patches.suse/ath9k-Fix-error-check-in-ath9k_hw_read_revisions-for.patch patches.suse/ath10k-Fix-ath10k_wmi_tlv_op_pull_peer_stats_info-un.patch + patches.suse/wl3501_cs-Fix-out-of-bounds-warnings-in-wl3501_send_.patch + patches.suse/wl3501_cs-Fix-out-of-bounds-warnings-in-wl3501_mgmt_.patch + patches.suse/qtnfmac-Fix-possible-buffer-overflow-in-qtnf_event_h.patch patches.suse/net-xdp-Update-pkt_type-if-generic-XDP-changes-unica.patch patches.suse/net-phy-intel-xway-enable-integrated-led-functions.patch patches.suse/net-phy-marvell-fix-m88e1011_set_downshift.patch @@ -19477,6 +19539,8 @@ patches.suse/powerpc-papr_scm-Fix-build-error-due-to-wrong-printf.patch patches.suse/KVM-PPC-Book3S-HV-P9-Restore-host-CTRL-SPR-after-gue.patch patches.suse/powerpc-pseries-Add-shutdown-to-vio_driver-and-vio_b.patch + patches.suse/drm-amd-display-Force-vsync-flip-when-reconfiguring-.patch + patches.suse/drm-amd-display-fixed-divide-by-zero-kernel-crash-du.patch patches.suse/drm-i915-gvt-Fix-error-code-in-intel_gvt_init_device.patch patches.suse/ALSA-usb-audio-Configure-Pioneer-DJM-850-samplerate.patch patches.suse/ALSA-hda-cirrus-Add-support-for-CS8409-HDA-bridge-an.patch @@ -19486,6 +19550,10 @@ patches.suse/ALSA-hda-cirrus-Cleanup-patch_cirrus.c-code.patch patches.suse/ALSA-hda-cirrus-Fix-CS42L42-Headset-Mic-volume-contr.patch patches.suse/ALSA-hda-cirrus-Make-CS8409-driver-more-generic-by-u.patch + patches.suse/ALSA-hdsp-don-t-disable-if-not-enabled.patch + patches.suse/ALSA-hdspm-don-t-disable-if-not-enabled.patch + patches.suse/ALSA-rme9652-don-t-disable-if-not-enabled.patch + patches.suse/ALSA-bebob-enable-to-deliver-MIDI-messages-for-multi.patch patches.suse/ALSA-core-remove-redundant-spin_lock-pair-in-snd_car.patch patches.suse/ALSA-usb-audio-Add-error-checks-for-usb_driver_claim.patch patches.suse/ALSA-usb-audio-Add-MIDI-quirk-for-Vox-ToneLab-EX.patch @@ -19499,10 +19567,16 @@ patches.suse/ALSA-hda-realtek-fix-static-noise-on-ALC285-Lenovo-l.patch patches.suse/ALSA-emu8000-Fix-a-use-after-free-in-snd_emu8000_cre.patch patches.suse/ASoC-Intel-kbl_da7219_max98927-Fix-kabylake_ssp_fixu.patch + patches.suse/ASoC-rt286-Make-RT286_SET_GPIO_-readable-and-writabl.patch + patches.suse/ASoC-Intel-bytcr_rt5640-Enable-jack-detect-support-o.patch patches.suse/ASoC-samsung-tm2_wm5110-check-of-of_parse-return-val.patch + patches.suse/ASoC-rsnd-core-Check-convert-rate-in-rsnd_hw_params.patch + patches.suse/ASoC-Intel-bytcr_rt5640-Add-quirk-for-the-Chuwi-Hi8-.patch patches.suse/ASoC-ak5558-Fix-s-show-slow-typo.patch patches.suse/ASoC-simple-card-fix-possible-uninitialized-single_c.patch patches.suse/ASoC-ak5558-correct-reset-polarity.patch + patches.suse/ASoC-rsnd-call-rsnd_ssi_master_clk_start-from-rsnd_s.patch + patches.suse/ASoC-rt286-Generalize-support-for-ALC3263-codec.patch patches.suse/ALSA-sb-Fix-two-use-after-free-in-snd_sb_qsound_buil.patch patches.suse/ALSA-hda-cirrus-Set-Initial-DMIC-volume-for-Bullseye.patch patches.suse/ALSA-hda-cirrus-Use-CS8409-filter-to-fix-abnormal-so.patch @@ -19519,7 +19593,10 @@ patches.suse/ALSA-hda-realtek-Re-order-remaining-ALC269-quirk-tab.patch patches.suse/ALSA-hda-realtek-Re-order-ALC662-quirk-table-entries.patch patches.suse/ALSA-hda-realtek-Remove-redundant-entry-for-ALC861-H.patch + patches.suse/ALSA-hda-conexant-Re-order-CX5066-quirk-table-entrie.patch patches.suse/HID-plantronics-Workaround-for-double-volume-key-pre.patch + patches.suse/i2c-bail-out-early-when-RDWR-parameters-are-wrong.patch + patches.suse/i2c-Add-I2C_AQ_NO_REP_START-adapter-quirk.patch patches.suse/i2c-img-scb-fix-reference-leak-when-pm_runtime_get_s.patch patches.suse/i2c-imx-lpi2c-fix-reference-leak-when-pm_runtime_get.patch patches.suse/i2c-omap-fix-reference-leak-when-pm_runtime_get_sync.patch @@ -19529,6 +19606,7 @@ patches.suse/i2c-jz4780-add-IRQ-check.patch patches.suse/i2c-sh7760-add-IRQ-check.patch patches.suse/i2c-sh7760-fix-IRQ-error-path.patch + patches.suse/pinctrl-samsung-use-int-for-register-masks-in-Exynos.patch patches.suse/pinctrl-Ingenic-Add-missing-pins-to-the-JZ4770-MAC-M.patch patches.suse/pinctrl-core-Fix-kernel-doc-string-for-pin_get_name.patch patches.suse/watchdog-rename-__touch_watchdog-to-a-better-descrip.patch @@ -19542,17 +19620,26 @@ patches.suse/KVM-s390-fix-guarded-storage-control-register-handli.patch patches.suse/tracing-map-all-pids-to-command-lines.patch patches.suse/rtc-ds1307-Fix-wday-settings-for-rx8130.patch + patches.suse/dmaengine-dw-edma-Fix-crash-on-loading-unloading-dri.patch patches.suse/docs-kernel-parameters-Move-gpio-mockup-for-alphabet.patch patches.suse/docs-kernel-parameters-Add-gpio_mockup_named_lines.patch + patches.suse/gpiolib-acpi-Add-quirk-to-ignore-EC-wakeups-on-Dell-.patch patches.suse/thermal-drivers-ti-soc-thermal-bandgap-Remove-unused.patch patches.suse/PCI-Release-OF-node-in-pci_scan_device-s-error-path.patch patches.suse/PCI-RCEC-Fix-RCiEP-device-to-RCEC-association.patch + patches.suse/ACPI-hotplug-PCI-Fix-reference-count-leak-in-enable_.patch patches.suse/PCI-Allow-VPD-access-for-QLogic-ISP2722.patch + patches.suse/PCI-thunder-Fix-compile-testing.patch patches.suse/PCI-endpoint-Fix-missing-destroy_workqueue.patch patches.suse/PCI-iproc-Fix-return-value-of-iproc_msi_irq_domain_a.patch patches.suse/ACPI-custom_method-fix-potential-use-after-free-issu.patch patches.suse/ACPI-custom_method-fix-a-possible-memory-leak.patch patches.suse/ftrace-handle-commands-when-closing-set_ftrace_filter-file.patch + patches.suse/ceph-don-t-clobber-i_snap_caps-on-non-i_new-inode.patch + patches.suse/ceph-only-check-pool-permissions-for-regular-files.patch + patches.suse/ceph-fix-inode-leak-on-getattr-error-in-_fh_to_dentry.patch + patches.suse/Input-elants_i2c-do-not-bind-to-i2c-hid-compatible-A.patch + patches.suse/Input-silead-add-workaround-for-x86-BIOS-es-which-br.patch patches.suse/fs-epoll-restore-waking-from-ep_done_scan.patch patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch patches.suse/ALSA-hda-realtek-ALC285-Thinkpad-jack-pin-quirk-is-u.patch @@ -19579,31 +19666,127 @@ patches.suse/i40e-Fix-PHY-type-identifiers-for-2.5G-and-5G-adapte.patch patches.suse/scsi-lpfc-Fix-illegal-memory-access-on-Abort-IOCBs.patch patches.suse/scsi-lpfc-Fix-DMA-virtual-address-ptr-assignment-in-.patch + patches.suse/scsi-lpfc-Fix-bad-memory-access-during-VPD-DUMP-mail.patch patches.suse/scsi-fnic-Kill-exclude_id-argument-to-fnic_cleanup_i.patch patches.suse/scsi-fnic-Use-scsi_host_busy_iter-to-traverse-commands.patch + patches.suse/x86-cpu-initialize-msr_tsc_aux-if-rdtscp-or-rdpid-is-supported.patch patches.suse/Revert-337f13046ff0-futex-Allow-FUTEX_CLOCK_REALTIME.patch + patches.suse/futex-Do-not-apply-time-namespace-adjustment-on-FUTE.patch + patches.suse/futex-Get-rid-of-the-val2-conditional-dance.patch + patches.suse/futex-Make-syscall-entry-points-less-convoluted.patch patches.suse/sched-fair-Fix-unfairness-caused-by-missing-load-dec.patch patches.suse/drm-amd-display-Reject-non-zero-src_y-and-src_x-for-.patch + patches.suse/drm-amd-display-Fix-two-cursor-duplication-when-usin.patch patches.suse/drm-radeon-Fix-off-by-one-power_state-index-heap-ove.patch patches.suse/drm-radeon-Avoid-power-table-parsing-memory-leaks.patch patches.suse/hwmon-occ-Fix-poll-rate-limiting.patch patches.suse/vgacon-Record-video-mode-changes-with-VT_RESIZEX.patch + patches.suse/drm-radeon-dpm-Disable-sclk-switching-on-Oland-when-.patch + patches.suse/drm-i915-Avoid-div-by-zero-on-gen2.patch patches.suse/nvme-multipath_fix_double_initialization_of_ANA_state.patch patches.suse/nvmet-use-new-ana_log_size-instead-the-old-one.patch + patches.suse/blk-mq-Swap-two-calls-in-blk_mq_exit_queue.patch patches.suse/powerpc-64s-Fix-crashes-when-toggling-stf-barrier.patch patches.suse/powerpc-64s-Fix-crashes-when-toggling-entry-flush-ba.patch + patches.suse/cdc-wdm-untangle-a-circular-dependency-between-callb.patch patches.suse/usb-dwc3-pci-Enable-usb2-gadget-lpm-disable-for-Inte.patch + patches.suse/usb-dwc3-gadget-Enable-suspend-events.patch patches.suse/usb-dwc2-Fix-gadget-DMA-unmap-direction.patch patches.suse/usb-dwc3-gadget-Return-success-always-for-kick-trans.patch + patches.suse/usb-dwc3-omap-improve-extcon-initialization.patch patches.suse/usb-fotg210-hcd-Fix-an-error-message.patch patches.suse/xhci-Do-not-use-GFP_KERNEL-in-potentially-atomic-con.patch + patches.suse/usb-xhci-Increase-timeout-for-HC-halt.patch + patches.suse/usb-core-hub-fix-race-condition-about-TRSMRCY-of-res.patch patches.suse/iio-proximity-pulsedlight-Fix-rumtime-PM-imbalance-o.patch patches.suse/iio-gyro-mpu3050-Fix-reported-temperature-value.patch patches.suse/iio-tsl2583-Fix-division-by-a-zero-lux_val.patch + patches.suse/ics932s401-fix-broken-handling-of-errors-when-word-r.patch + patches.suse/Revert-leds-lp5523-fix-a-missing-check-of-return-val.patch + patches.suse/leds-lp5523-check-return-value-of-lp5xx_read-and-jum.patch + patches.suse/Revert-gdrom-fix-a-memory-leak-bug.patch + patches.suse/cdrom-gdrom-deallocate-struct-gdrom_unit-fields-in-r.patch + patches.suse/cdrom-gdrom-initialize-global-variable-at-init-time.patch + patches.suse/msft-hv-2316-uio_hv_generic-Fix-a-memory-leak-in-error-handling-p.patch + patches.suse/msft-hv-2317-uio_hv_generic-Fix-another-memory-leak-in-error-hand.patch + patches.suse/platform-mellanox-mlxbf-tmfifo-Fix-a-memory-barrier-.patch + patches.suse/ALSA-hda-realtek-reset-eapd-coeff-to-default-value-f.patch + patches.suse/ALSA-hda-fixup-headset-for-ASUS-GU502-laptop.patch + patches.suse/ALSA-usb-audio-Validate-MS-endpoint-descriptors.patch + patches.suse/ALSA-dice-fix-stream-format-at-middle-sampling-rate-.patch + patches.suse/ALSA-bebob-oxfw-fix-Kconfig-entry-for-Mackie-d.2-Pro.patch + patches.suse/ALSA-firewire-lib-fix-check-for-the-size-of-isochron.patch + patches.suse/ALSA-firewire-lib-fix-calculation-for-size-of-IR-con.patch + patches.suse/ALSA-hda-realtek-Add-some-CLOVE-SSIDs-of-ALC293.patch + patches.suse/ALSA-intel8x0-Don-t-update-period-unless-prepared.patch + patches.suse/ALSA-dice-fix-stream-format-for-TC-Electronic-Konnek.patch + patches.suse/ALSA-line6-Fix-racy-initialization-of-LINE6-MIDI.patch + patches.suse/firmware-arm_scpi-Prevent-the-ternary-sign-expansion.patch + patches.suse/drm-amdgpu-disable-3DCGCG-on-picasso-raven1-to-avoid.patch + patches.suse/mmc-sdhci-pci-gli-increase-1.8V-regulator-wait.patch + patches.suse/gpio-xilinx-Correct-kernel-doc-for-xgpio_probe.patch + patches.suse/nvme-fc-clear-q_live-at-beginning-of-association-tea.patch + patches.suse/ipc-mqueue-msg-sem-Avoid-relying-on-a-stack-reference.patch + patches.suse/spi-spi-fsl-dspi-Fix-a-resource-leak-in-an-error-han.patch + patches.suse/NFC-nci-fix-memory-leak-in-nci_allocate_device.patch + patches.suse/net-usb-fix-memory-leak-in-smsc75xx_bind.patch + patches.suse/bpf-Wrap-aux-data-inside-bpf_sanitize_info-container.patch + patches.suse/bpf-Fix-mask-direction-swap-upon-off-reg-sign-change.patch + patches.suse/bpf-No-need-to-simulate-speculative-domain-for-immed.patch + patches.suse/ALSA-usb-audio-fix-control-request-direction.patch + patches.suse/ALSA-usb-audio-scarlett2-Fix-device-hang-with-ehci-p.patch + patches.suse/ALSA-usb-audio-scarlett2-Improve-driver-startup-mess.patch + patches.suse/ALSA-hda-realtek-Headphone-volume-is-controlled-by-F.patch + patches.suse/ALSA-usb-audio-scarlett2-snd_scarlett_gen2_controls_.patch + patches.suse/ASoC-cs42l42-Regmap-must-use_single_read-write.patch + patches.suse/ASoC-cs35l33-fix-an-error-code-in-probe.patch + patches.suse/SUNRPC-in-case-of-backlog-hand-free-slots-directly-t.patch + patches.suse/SUNRPC-More-fixes-for-backlog-congestion.patch + patches.suse/drm-meson-fix-shutdown-crash-when-component-not-prob.patch + patches.suse/nvme-fc-short-circuit-reconnect-retries.patch + patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch + patches.suse/misc-uss720-fix-memory-leak-in-uss720_probe.patch + patches.suse/USB-trancevibrator-fix-control-request-direction.patch + patches.suse/usb-gadget-udc-renesas_usb3-Fix-a-race-in-usb3_start.patch + patches.suse/thunderbolt-dma_port-Fix-NVM-read-buffer-bounds-and-.patch + patches.suse/serial-tegra-Fix-a-mask-operation-that-is-always-tru.patch + patches.suse/serial-core-fix-suspicious-security_locked_down-call.patch + patches.suse/serial-sh-sci-Fix-off-by-one-error-in-FIFO-threshold.patch + patches.suse/staging-emxx_udc-fix-loop-in-_nbu2ss_nuke.patch + patches.suse/iio-adc-ad7124-Fix-missbalanced-regulator-enable-dis.patch + patches.suse/iio-adc-ad7124-Fix-potential-overflow-due-to-non-seq.patch + patches.suse/staging-iio-cdc-ad7746-avoid-overwrite-of-num_channe.patch + patches.suse/iio-gyro-fxas21002c-balance-runtime-power-in-error-p.patch + patches.suse/iio-adc-ad7768-1-Fix-too-small-buffer-passed-to-iio_.patch + patches.suse/iio-adc-ad7793-Add-missing-error-code-in-ad7793_setu.patch + patches.suse/i2c-sh_mobile-Use-new-clock-calculation-formulas-for.patch + patches.suse/i2c-i801-Don-t-generate-an-interrupt-on-bus-reset.patch + patches.suse/i2c-s3c2410-fix-possible-NULL-pointer-deref-on-read-.patch # netdev/net-next patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch + # jejb/scsi for-next + patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch + patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch + patches.suse/scsi-ibmvfc-Reinit-target-retries.patch + + # mkp/scsi queue + patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch + patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch + patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch + patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch + patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch + patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch + patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch + patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch + patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch + patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch + patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch + + # git://github.com/cminyard/linux-ipmi.git for-next + patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch + ######################################################## # end of sorted patches ######################################################## @@ -19648,8 +19831,11 @@ patches.suse/rtc-pcf2127-handle-timestamp-interrupts.patch patches.suse/nvmet-seset-ns-file-when-open-fails.patch patches.suse/proc-Avoid-mixing-integer-types-in-mem_rw.patch - patches.suse/ipc-mqueue-msg-sem-Avoid-relying-on-a-stack-reference.patch patches.suse/cpufreq-intel_pstate-Add-Icelake-servers-support-in-.patch + patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch + patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch + patches.suse/block-genhd-use-atomic_t-for-disk_event-block.patch + patches.suse/nxp-nci-add-NXP1002-id.patch ######################################################## # kbuild/module infrastructure fixes @@ -19723,6 +19909,7 @@ patches.suse/x86-apic-force-bigsmp-apic-on-IBM-EXA3-4.patch # s390x + patches.suse/s390-sles15sp2-kdump-fix-out-of-memory-with-PCI.patch # ppc64 @@ -19982,6 +20169,8 @@ patches.suse/qla2xxx-add-module_version-back-to-driver.patch patches.suse/lpfc-decouple-port_template-and-vport_template.patch + patches.suse/rdma-addr-create-addr_wq-with-wq_mem_reclaim-flag.patch + patches.suse/rdma-core-create-ib_cm-with-wq_mem_reclaim-flag.patch ######################################################## # Networking drivers (wired) @@ -20185,6 +20374,7 @@ patches.kabi/cfg80211-kabi-workaround.patch patches.kabi/ath10k-CVE-2020-24588-kABI-workaround.patch patches.kabi/hci_chan-amp-kABI-workaround.patch + patches.kabi/nxp-i2c-restore-includes-for-kABI.patch ######################################################## # You'd better have a good reason for adding a patch