diff --git a/blacklist.conf b/blacklist.conf index 1ae67d0..58cf54b 100644 --- a/blacklist.conf +++ b/blacklist.conf @@ -813,8 +813,6 @@ db886979683a8360ced9b24ab1125ad0c4d2cf76 # we already have this commit 77515ebaf01920e2db49e04672ef669a7c2907f2 # cleanup designed to break kABI 4ba0b8187d98cb4c5e33c0e98895ac5dcb86af83 # depends on dd123e62bdedcd3a486e48e883ec63138ec2c14c, which introduces a new driver f81fead027ecbb525c29d681eb95a222e76306a3 # correction in a comment only -2355370cd941cbb20882cc3f34460f9f2b8f9a18 # already have it as part of a different commit -7fce8d6eccbc31a561d07c79f359ad09f0424347 # already have it as part of a different commit 9dba4d24cbb5524dd39ab1e08886373b17f07ff2 # breaks KABI d43b020b0f82c088ef8ff3196ef00575a97d200e # bug introduced by 4831967640916 not present 838d6d3461db0fdbf33fc5f8a69c27b50b4a46da # breaks KABI @@ -875,3 +873,4 @@ e4f74400308cb8abde5fdc9cad609c2aba32110c # kABI breakage, removed exported symbo b89ddf4cca43f1269093942cf5c4e457fd45c335 # Depends on heavy rework of arch/arm64/mm/extable.c 60115fa54ad7b913b7cb5844e6b7ffeb842d55f2 # We don't have KSAN on. Breaks kABI too. 6769a0b7ee0c3b31e1b22c3fadff2bfb642de23f # media/dvb-core: causing a regression (bsc#1205758) +3899d94e3831ee07ea6821c032dc297aec80586a # drbd git-fix, but drbd in kernel not supported diff --git a/patches.suse/ACPI-sleep-Avoid-breaking-S3-wakeup-due-to-might_sle.patch b/patches.suse/ACPI-sleep-Avoid-breaking-S3-wakeup-due-to-might_sle.patch new file mode 100644 index 0000000..62f3c3c --- /dev/null +++ b/patches.suse/ACPI-sleep-Avoid-breaking-S3-wakeup-due-to-might_sle.patch @@ -0,0 +1,95 @@ +From 22db06337f590d01d79f60f181d8dfe5a9ef9085 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Wed, 14 Jun 2023 17:29:21 +0200 +Subject: [PATCH] ACPI: sleep: Avoid breaking S3 wakeup due to might_sleep() +Git-commit: 22db06337f590d01d79f60f181d8dfe5a9ef9085 +Patch-mainline: v6.4 +References: git-fixes + +The addition of might_sleep() to down_timeout() caused the latter to +enable interrupts unconditionally in some cases, which in turn broke +the ACPI S3 wakeup path in acpi_suspend_enter(), where down_timeout() +is called by acpi_disable_all_gpes() via acpi_ut_acquire_mutex(). + +Namely, if CONFIG_DEBUG_ATOMIC_SLEEP is set, might_sleep() causes +might_resched() to be used and if CONFIG_PREEMPT_VOLUNTARY is set, +this triggers __cond_resched() which may call preempt_schedule_common(), +so __schedule() gets invoked and it ends up with enabled interrupts (in +the prev == next case). + +Now, enabling interrupts early in the S3 wakeup path causes the kernel +to crash. + +Address this by modifying acpi_suspend_enter() to disable GPEs without +attempting to acquire the sleeping lock which is not needed in that code +path anyway. + +Fixes: 99409b935c9a ("locking/semaphore: Add might_sleep() to down_*() family") +Reported-by: Srinivas Pandruvada +Signed-off-by: Rafael J. Wysocki +Acked-by: Peter Zijlstra (Intel) +Cc: 5.15+ # 5.15+ +Acked-by: Takashi Iwai + +--- + drivers/acpi/acpica/achware.h | 2 -- + drivers/acpi/sleep.c | 16 ++++++++++++---- + include/acpi/acpixf.h | 1 + + 3 files changed, 13 insertions(+), 6 deletions(-) + +diff --git a/drivers/acpi/acpica/achware.h b/drivers/acpi/acpica/achware.h +index ebf8fd373cf7..79bbfe00d241 100644 +--- a/drivers/acpi/acpica/achware.h ++++ b/drivers/acpi/acpica/achware.h +@@ -101,8 +101,6 @@ acpi_status + acpi_hw_get_gpe_status(struct acpi_gpe_event_info *gpe_event_info, + acpi_event_status *event_status); + +-acpi_status acpi_hw_disable_all_gpes(void); +- + acpi_status acpi_hw_enable_all_runtime_gpes(void); + + acpi_status acpi_hw_enable_all_wakeup_gpes(void); +diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c +index 72470b9f16c4..f32570f72b90 100644 +--- a/drivers/acpi/sleep.c ++++ b/drivers/acpi/sleep.c +@@ -636,11 +636,19 @@ static int acpi_suspend_enter(suspend_state_t pm_state) + } + + /* +- * Disable and clear GPE status before interrupt is enabled. Some GPEs +- * (like wakeup GPE) haven't handler, this can avoid such GPE misfire. +- * acpi_leave_sleep_state will reenable specific GPEs later ++ * Disable all GPE and clear their status bits before interrupts are ++ * enabled. Some GPEs (like wakeup GPEs) have no handlers and this can ++ * prevent them from producing spurious interrups. ++ * ++ * acpi_leave_sleep_state() will reenable specific GPEs later. ++ * ++ * Because this code runs on one CPU with disabled interrupts (all of ++ * the other CPUs are offline at this time), it need not acquire any ++ * sleeping locks which may trigger an implicit preemption point even ++ * if there is no contention, so avoid doing that by using a low-level ++ * library routine here. + */ +- acpi_disable_all_gpes(); ++ acpi_hw_disable_all_gpes(); + /* Allow EC transactions to happen. */ + acpi_ec_unblock_transactions(); + +diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h +index e6098a08c914..9ffdc0425bc2 100644 +--- a/include/acpi/acpixf.h ++++ b/include/acpi/acpixf.h +@@ -761,6 +761,7 @@ ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status + acpi_event_status + *event_status)) + ACPI_HW_DEPENDENT_RETURN_UINT32(u32 acpi_dispatch_gpe(acpi_handle gpe_device, u32 gpe_number)) ++ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_hw_disable_all_gpes(void)) + ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_disable_all_gpes(void)) + ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_enable_all_runtime_gpes(void)) + ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_enable_all_wakeup_gpes(void)) +-- +2.35.3 + diff --git a/patches.suse/ARM-dts-vexpress-add-missing-cache-properties.patch b/patches.suse/ARM-dts-vexpress-add-missing-cache-properties.patch new file mode 100644 index 0000000..b91cd1d --- /dev/null +++ b/patches.suse/ARM-dts-vexpress-add-missing-cache-properties.patch @@ -0,0 +1,37 @@ +From 328acc5657c6197753238d7ce0a6924ead829347 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Sun, 23 Apr 2023 17:08:37 +0200 +Subject: [PATCH] ARM: dts: vexpress: add missing cache properties +Git-commit: 328acc5657c6197753238d7ce0a6924ead829347 +Patch-mainline: v6.4-rc4 +References: git-fixes + +As all level 2 and level 3 caches are unified, add required +cache-unified property to fix warnings like: + + vexpress-v2p-ca5s.dtb: cache-controller@2c0f0000: 'cache-unified' is a required property + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230423150837.118466-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Sudeep Holla +Acked-by: Takashi Iwai + +--- + arch/arm/boot/dts/vexpress-v2p-ca5s.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/vexpress-v2p-ca5s.dts b/arch/arm/boot/dts/vexpress-v2p-ca5s.dts +index 3b88209bacea..ff1f9a1bcfcf 100644 +--- a/arch/arm/boot/dts/vexpress-v2p-ca5s.dts ++++ b/arch/arm/boot/dts/vexpress-v2p-ca5s.dts +@@ -132,6 +132,7 @@ L2: cache-controller@2c0f0000 { + reg = <0x2c0f0000 0x1000>; + interrupts = <0 84 4>; + cache-level = <2>; ++ cache-unified; + }; + + pmu { +-- +2.35.3 + diff --git a/patches.suse/ASoC-dwc-move-DMA-init-to-snd_soc_dai_driver-probe.patch b/patches.suse/ASoC-dwc-move-DMA-init-to-snd_soc_dai_driver-probe.patch new file mode 100644 index 0000000..7ba8f25 --- /dev/null +++ b/patches.suse/ASoC-dwc-move-DMA-init-to-snd_soc_dai_driver-probe.patch @@ -0,0 +1,146 @@ +From 011a8719d6105dcb48077ea7a6a88ac019d4aa50 Mon Sep 17 00:00:00 2001 +From: Maxim Kochetkov +Date: Fri, 12 May 2023 14:03:42 +0300 +Subject: [PATCH] ASoC: dwc: move DMA init to snd_soc_dai_driver probe() +Git-commit: 011a8719d6105dcb48077ea7a6a88ac019d4aa50 +Patch-mainline: v6.4-rc4 +References: git-fixes + +When using DMA mode we are facing with Oops: +[ 396.458157] Unable to handle kernel access to user memory without uaccess routines at virtual address 000000000000000c +[ 396.469374] Oops [#1] +[ 396.471839] Modules linked in: +[ 396.475144] CPU: 0 PID: 114 Comm: arecord Not tainted 6.0.0-00164-g9a8eccdaf2be-dirty #68 +[ 396.483619] Hardware name: YMP ELCT FPGA (DT) +[ 396.488156] epc : dmaengine_pcm_open+0x1d2/0x342 +[ 396.493227] ra : dmaengine_pcm_open+0x1d2/0x342 +[ 396.498140] epc : ffffffff807fe346 ra : ffffffff807fe346 sp : ffffffc804e138f0 +[ 396.505602] gp : ffffffff817bf730 tp : ffffffd8042c8ac0 t0 : 6500000000000000 +[ 396.513045] t1 : 0000000000000064 t2 : 656e69676e65616d s0 : ffffffc804e13990 +[ 396.520477] s1 : ffffffd801b86a18 a0 : 0000000000000026 a1 : ffffffff816920f8 +[ 396.527897] a2 : 0000000000000010 a3 : fffffffffffffffe a4 : 0000000000000000 +[ 396.535319] a5 : 0000000000000000 a6 : ffffffd801b87040 a7 : 0000000000000038 +[ 396.542740] s2 : ffffffd801b94a00 s3 : 0000000000000000 s4 : ffffffd80427f5e8 +[ 396.550153] s5 : ffffffd80427f5e8 s6 : ffffffd801b44410 s7 : fffffffffffffff5 +[ 396.557569] s8 : 0000000000000800 s9 : 0000000000000001 s10: ffffffff8066d254 +[ 396.564978] s11: ffffffd8059cf768 t3 : ffffffff817d5577 t4 : ffffffff817d5577 +[ 396.572391] t5 : ffffffff817d5578 t6 : ffffffc804e136e8 +[ 396.577876] status: 0000000200000120 badaddr: 000000000000000c cause: 000000000000000d +[ 396.586007] [] snd_soc_component_open+0x1a/0x68 +[ 396.592439] [] __soc_pcm_open+0xf0/0x502 +[ 396.598217] [] soc_pcm_open+0x2e/0x4e +[ 396.603741] [] snd_pcm_open_substream+0x442/0x68e +[ 396.610313] [] snd_pcm_open+0xfa/0x212 +[ 396.615868] [] snd_pcm_capture_open+0x3a/0x60 +[ 396.622048] [] snd_open+0xa8/0x17a +[ 396.627421] [] chrdev_open+0xa0/0x218 +[ 396.632893] [] do_dentry_open+0x17c/0x2a6 +[ 396.638713] [] vfs_open+0x1e/0x26 +[ 396.643850] [] path_openat+0x96e/0xc96 +[ 396.649518] [] do_filp_open+0x7c/0xf6 +[ 396.655034] [] do_sys_openat2+0x8a/0x11e +[ 396.660765] [] sys_openat+0x50/0x7c +[ 396.666068] [] ret_from_syscall+0x0/0x2 +[ 396.674964] ---[ end trace 0000000000000000 ]--- + +It happens because of play_dma_data/capture_dma_data pointers are NULL. +Current implementation assigns these pointers at snd_soc_dai_driver +startup() callback and reset them back to NULL at shutdown(). But +soc_pcm_open() sequence uses DMA pointers in dmaengine_pcm_open() +before snd_soc_dai_driver startup(). +Most generic DMA capable I2S drivers use snd_soc_dai_driver probe() +callback to init DMA pointers only once at probe. So move DMA init +to dw_i2s_dai_probe and drop shutdown() and startup() callbacks. + +Signed-off-by: Maxim Kochetkov +Link: https://lore.kernel.org/r/20230512110343.66664-1-fido_max@inbox.ru +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/dwc/dwc-i2s.c | 41 +++++++++-------------------------------- + 1 file changed, 9 insertions(+), 32 deletions(-) + +diff --git a/sound/soc/dwc/dwc-i2s.c b/sound/soc/dwc/dwc-i2s.c +index ca20cade6840..399a489f24f2 100644 +--- a/sound/soc/dwc/dwc-i2s.c ++++ b/sound/soc/dwc/dwc-i2s.c +@@ -183,30 +183,6 @@ static void i2s_stop(struct dw_i2s_dev *dev, + } + } + +-static int dw_i2s_startup(struct snd_pcm_substream *substream, +- struct snd_soc_dai *cpu_dai) +-{ +- struct dw_i2s_dev *dev = snd_soc_dai_get_drvdata(cpu_dai); +- union dw_i2s_snd_dma_data *dma_data = NULL; +- +- if (!(dev->capability & DWC_I2S_RECORD) && +- (substream->stream == SNDRV_PCM_STREAM_CAPTURE)) +- return -EINVAL; +- +- if (!(dev->capability & DWC_I2S_PLAY) && +- (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)) +- return -EINVAL; +- +- if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) +- dma_data = &dev->play_dma_data; +- else if (substream->stream == SNDRV_PCM_STREAM_CAPTURE) +- dma_data = &dev->capture_dma_data; +- +- snd_soc_dai_set_dma_data(cpu_dai, substream, (void *)dma_data); +- +- return 0; +-} +- + static void dw_i2s_config(struct dw_i2s_dev *dev, int stream) + { + u32 ch_reg; +@@ -305,12 +281,6 @@ static int dw_i2s_hw_params(struct snd_pcm_substream *substream, + return 0; + } + +-static void dw_i2s_shutdown(struct snd_pcm_substream *substream, +- struct snd_soc_dai *dai) +-{ +- snd_soc_dai_set_dma_data(dai, substream, NULL); +-} +- + static int dw_i2s_prepare(struct snd_pcm_substream *substream, + struct snd_soc_dai *dai) + { +@@ -382,8 +352,6 @@ static int dw_i2s_set_fmt(struct snd_soc_dai *cpu_dai, unsigned int fmt) + } + + static const struct snd_soc_dai_ops dw_i2s_dai_ops = { +- .startup = dw_i2s_startup, +- .shutdown = dw_i2s_shutdown, + .hw_params = dw_i2s_hw_params, + .prepare = dw_i2s_prepare, + .trigger = dw_i2s_trigger, +@@ -625,6 +593,14 @@ static int dw_configure_dai_by_dt(struct dw_i2s_dev *dev, + + } + ++static int dw_i2s_dai_probe(struct snd_soc_dai *dai) ++{ ++ struct dw_i2s_dev *dev = snd_soc_dai_get_drvdata(dai); ++ ++ snd_soc_dai_init_dma_data(dai, &dev->play_dma_data, &dev->capture_dma_data); ++ return 0; ++} ++ + static int dw_i2s_probe(struct platform_device *pdev) + { + const struct i2s_platform_data *pdata = pdev->dev.platform_data; +@@ -643,6 +619,7 @@ static int dw_i2s_probe(struct platform_device *pdev) + return -ENOMEM; + + dw_i2s_dai->ops = &dw_i2s_dai_ops; ++ dw_i2s_dai->probe = dw_i2s_dai_probe; + + dev->i2s_base = devm_platform_get_and_ioremap_resource(pdev, 0, &res); + if (IS_ERR(dev->i2s_base)) +-- +2.35.3 + diff --git a/patches.suse/ASoC-soc-pcm-test-if-a-BE-can-be-prepared.patch b/patches.suse/ASoC-soc-pcm-test-if-a-BE-can-be-prepared.patch new file mode 100644 index 0000000..fc8ef06 --- /dev/null +++ b/patches.suse/ASoC-soc-pcm-test-if-a-BE-can-be-prepared.patch @@ -0,0 +1,93 @@ +From e123036be377ddf628226a7c6d4f9af5efd113d3 Mon Sep 17 00:00:00 2001 +From: Ranjani Sridharan +Date: Wed, 17 May 2023 13:57:31 -0500 +Subject: [PATCH] ASoC: soc-pcm: test if a BE can be prepared +Git-commit: e123036be377ddf628226a7c6d4f9af5efd113d3 +Patch-mainline: v6.4-rc4 +References: git-fixes + +In the BE hw_params configuration, the existing code checks if any of the +existing FEs are prepared, running, paused or suspended - and skips the +configuration in those cases. This allows multiple calls of hw_params +which the ALSA state machine supports. + +This check is not handled for the prepare stage, which can lead to the +same BE being prepared multiple times. This patch adds a check similar to +that of the hw_params, with the main difference being that the suspended +state is allowed: the ALSA state machine allows a transition from +suspended to prepared with hw_params skipped. + +This problem was detected on Intel IPC4/SoundWire devices, where the BE +dailink .prepare stage is used to configure the SoundWire stream with a +bank switch. Multiple .prepare calls lead to conflicts with the .trigger +operation with IPC4 configurations. This problem was not detected earlier +on Intel devices, HDaudio BE dailinks detect that the link is already +prepared and skip the configuration, and for IPC3 devices there is no BE +trigger. + +Link: https://github.com/thesofproject/sof/issues/7596 +Signed-off-by: Ranjani Sridharan + +--- + include/sound/soc-dpcm.h | 4 ++++ + sound/soc/soc-pcm.c | 20 ++++++++++++++++++++ + 2 files changed, 24 insertions(+) + +diff --git a/include/sound/soc-dpcm.h b/include/sound/soc-dpcm.h +index 4d6ac7699833..ebd24753dd00 100644 +--- a/include/sound/soc-dpcm.h ++++ b/include/sound/soc-dpcm.h +@@ -122,6 +122,10 @@ int snd_soc_dpcm_can_be_free_stop(struct snd_soc_pcm_runtime *fe, + int snd_soc_dpcm_can_be_params(struct snd_soc_pcm_runtime *fe, + struct snd_soc_pcm_runtime *be, int stream); + ++/* can this BE perform prepare */ ++int snd_soc_dpcm_can_be_prepared(struct snd_soc_pcm_runtime *fe, ++ struct snd_soc_pcm_runtime *be, int stream); ++ + /* is the current PCM operation for this FE ? */ + int snd_soc_dpcm_fe_can_update(struct snd_soc_pcm_runtime *fe, int stream); + +diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c +index adb69d7820a8..4fb1ac8e1c4a 100644 +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -2405,6 +2405,9 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream) + if (!snd_soc_dpcm_be_can_update(fe, be, stream)) + continue; + ++ if (!snd_soc_dpcm_can_be_prepared(fe, be, stream)) ++ continue; ++ + if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_PARAMS) && + (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP) && + (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND) && +@@ -3042,3 +3045,20 @@ int snd_soc_dpcm_can_be_params(struct snd_soc_pcm_runtime *fe, + return snd_soc_dpcm_check_state(fe, be, stream, state, ARRAY_SIZE(state)); + } + EXPORT_SYMBOL_GPL(snd_soc_dpcm_can_be_params); ++ ++/* ++ * We can only prepare a BE DAI if any of it's FE are not prepared, ++ * running or paused for the specified stream direction. ++ */ ++int snd_soc_dpcm_can_be_prepared(struct snd_soc_pcm_runtime *fe, ++ struct snd_soc_pcm_runtime *be, int stream) ++{ ++ const enum snd_soc_dpcm_state state[] = { ++ SND_SOC_DPCM_STATE_START, ++ SND_SOC_DPCM_STATE_PAUSED, ++ SND_SOC_DPCM_STATE_PREPARE, ++ }; ++ ++ return snd_soc_dpcm_check_state(fe, be, stream, state, ARRAY_SIZE(state)); ++} ++EXPORT_SYMBOL_GPL(snd_soc_dpcm_can_be_prepared); +-- +2.35.3 + diff --git a/patches.suse/USB-serial-option-add-Quectel-EM061KGL-series.patch b/patches.suse/USB-serial-option-add-Quectel-EM061KGL-series.patch new file mode 100644 index 0000000..6ba07e4 --- /dev/null +++ b/patches.suse/USB-serial-option-add-Quectel-EM061KGL-series.patch @@ -0,0 +1,104 @@ +From f1832e2b5e498e258b090af3b065b85cf8cc5161 Mon Sep 17 00:00:00 2001 +From: Jerry Meng +Date: Wed, 31 May 2023 11:51:16 +0800 +Subject: [PATCH] USB: serial: option: add Quectel EM061KGL series +Git-commit: f1832e2b5e498e258b090af3b065b85cf8cc5161 +Patch-mainline: v6.4-rc7 +References: git-fixes + +Add support for Quectel EM061KGL series which are based on Qualcomm +SDX12 chip: + +EM061KGL_LTA(0x2c7c / 0x0123): MBIM + GNSS + DIAG + NMEA + AT + QDSS + DPL +EM061KGL_LMS(0x2c7c / 0x0124): MBIM + GNSS + DIAG + NMEA + AT + QDSS + DPL +EM061KGL_LWW(0x2c7c / 0x6008): MBIM + GNSS + DIAG + NMEA + AT + QDSS + DPL +EM061KGL_LCN(0x2c7c / 0x6009): MBIM + GNSS + DIAG + NMEA + AT + QDSS + DPL + +Above products use the exact same interface layout and +option driver is for interfaces DIAG, NMEA and AT. + +T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 5 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=6008 Rev= 5.04 +S: Manufacturer=Quectel +S: Product=Quectel EM061K-GL +S: SerialNumber=f6fa08b6 +C:* #Ifs= 8 Cfg#= 1 Atr=a0 MxPwr=500mA +A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=8f(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Jerry Meng +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Acked-by: Takashi Iwai + +--- + drivers/usb/serial/option.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 644a55447fd7..fd42e3a0bd18 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -248,6 +248,8 @@ static void option_instat_callback(struct urb *urb); + #define QUECTEL_VENDOR_ID 0x2c7c + /* These Quectel products use Quectel's vendor ID */ + #define QUECTEL_PRODUCT_EC21 0x0121 ++#define QUECTEL_PRODUCT_EM061K_LTA 0x0123 ++#define QUECTEL_PRODUCT_EM061K_LMS 0x0124 + #define QUECTEL_PRODUCT_EC25 0x0125 + #define QUECTEL_PRODUCT_EG91 0x0191 + #define QUECTEL_PRODUCT_EG95 0x0195 +@@ -266,6 +268,8 @@ static void option_instat_callback(struct urb *urb); + #define QUECTEL_PRODUCT_RM520N 0x0801 + #define QUECTEL_PRODUCT_EC200U 0x0901 + #define QUECTEL_PRODUCT_EC200S_CN 0x6002 ++#define QUECTEL_PRODUCT_EM061K_LWW 0x6008 ++#define QUECTEL_PRODUCT_EM061K_LCN 0x6009 + #define QUECTEL_PRODUCT_EC200T 0x6026 + #define QUECTEL_PRODUCT_RM500K 0x7001 + +@@ -1189,6 +1193,18 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LMS, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LMS, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LMS, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LTA, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LTA, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LTA, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LWW, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LWW, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LWW, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0, 0) }, +-- +2.35.3 + diff --git a/patches.suse/binfmt_elf-takethe-mmap_lock-when-walking-the-VMA-list.patch b/patches.suse/binfmt_elf-takethe-mmap_lock-when-walking-the-VMA-list.patch new file mode 100644 index 0000000..49c2545 --- /dev/null +++ b/patches.suse/binfmt_elf-takethe-mmap_lock-when-walking-the-VMA-list.patch @@ -0,0 +1,62 @@ +Subject: [PATCH] binfmt_elf: Take the mmap lock when walking the VMA list +Date: Mon, 31 Jan 2022 15:37:40 +0000 +Message-id: <20220131153740.2396974-1-willy@infradead.org> +From: "Matthew Wilcox (Oracle)" +Patch-mainline: never (different fix) +References: bsc#1209039 CVE-2023-1249 + +mhocko@suse.com: +The upstream fix 390031c94211 ("coredump: Use the vma snapshot in fill_files_note") +has turned out much more complex and much more disruptive to backport to older +code streams. The reference to the upstream discussion is +https://lore.kernel.org/all/20220131153740.2396974-1-willy@infradead.org/T/#u + +I'm not sure if the VMA list can change under us, but dump_vma_snapshot() +is very careful to take the mmap_lock in write mode. We only need to +take it in read mode here as we do not care if the size of the stack +VMA changes underneath us. + +If it can be changed underneath us, this is a potential use-after-free +for a multithreaded process which is dumping core. + +Fixes: 2aa362c49c31 ("coredump: extend core dump note section to contain file names of mapped files") +Signed-off-by: Matthew Wilcox (Oracle) +Reviewed-by: Liam R. Howlett +Signed-off-by: Michal Hocko + +--- + fs/binfmt_elf.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c +index 605017eb9349..dc2318355762 100644 +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -1651,6 +1651,7 @@ static int fill_files_note(struct memelfnote *note) + name_base = name_curpos = ((char *)data) + names_ofs; + remaining = size - names_ofs; + count = 0; ++ mmap_read_lock(mm); + for (vma = mm->mmap; vma != NULL; vma = vma->vm_next) { + struct file *file; + const char *filename; +@@ -1661,6 +1662,7 @@ static int fill_files_note(struct memelfnote *note) + filename = file_path(file, name_curpos, remaining); + if (IS_ERR(filename)) { + if (PTR_ERR(filename) == -ENAMETOOLONG) { ++ mmap_read_unlock(mm); + kvfree(data); + size = size * 5 / 4; + goto alloc; +@@ -1680,6 +1682,7 @@ static int fill_files_note(struct memelfnote *note) + *start_end_ofs++ = vma->vm_pgoff; + count++; + } ++ mmap_read_unlock(mm); + + /* Now we know exact count of files, can store it */ + data[0] = count; +-- +2.34.1 + + diff --git a/patches.suse/bpf-Fix-UAF-in-task-local-storage.patch b/patches.suse/bpf-Fix-UAF-in-task-local-storage.patch new file mode 100644 index 0000000..ceeed12 --- /dev/null +++ b/patches.suse/bpf-Fix-UAF-in-task-local-storage.patch @@ -0,0 +1,52 @@ +From: KP Singh +Date: Fri, 2 Jun 2023 02:26:12 +0200 +Subject: bpf: Fix UAF in task local storage +Git-commit: b0fd1852bcc21accca6260ef245356d5c141ff66 +Patch-mainline: v6.4-rc6 +References: bsc#1212564 + +When task local storage was generalized for tracing programs, the +bpf_task_local_storage callback was moved from a BPF LSM hook +callback for security_task_free LSM hook to it's own callback. But a +failure case in bad_fork_cleanup_security was missed which, when +triggered, led to a dangling task owner pointer and a subsequent +use-after-free. Move the bpf_task_storage_free to the very end of +free_task to handle all failure cases. + +This issue was noticed when a BPF LSM program was attached to the +task_alloc hook on a kernel with KASAN enabled. The program used +bpf_task_storage_get to copy the task local storage from the current +task to the new task being created. + +Fixes: a10787e6d58c ("bpf: Enable task local storage for tracing programs") +Reported-by: Kuba Piecuch +Signed-off-by: KP Singh +Acked-by: Song Liu +Link: https://lore.kernel.org/r/20230602002612.1117381-1-kpsingh@kernel.org +Signed-off-by: Martin KaFai Lau +Acked-by: Michal Koutný +--- + kernel/fork.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/fork.c b/kernel/fork.c +index ed4e01daccaa..cb20f9f596d3 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -627,6 +627,7 @@ void free_task(struct task_struct *tsk) + arch_release_task_struct(tsk); + if (tsk->flags & PF_KTHREAD) + free_kthread_struct(tsk); ++ bpf_task_storage_free(tsk); + free_task_struct(tsk); + } + EXPORT_SYMBOL(free_task); +@@ -979,7 +980,6 @@ void __put_task_struct(struct task_struct *tsk) + cgroup_free(tsk); + task_numa_free(tsk, true); + security_task_free(tsk); +- bpf_task_storage_free(tsk); + exit_creds(tsk); + delayacct_tsk_free(tsk); + put_signal_struct(tsk->signal); + diff --git a/patches.suse/ceph-fix-use-after-free-bug-for-inodes-when-flushing-.patch b/patches.suse/ceph-fix-use-after-free-bug-for-inodes-when-flushing-.patch new file mode 100644 index 0000000..96858b2 --- /dev/null +++ b/patches.suse/ceph-fix-use-after-free-bug-for-inodes-when-flushing-.patch @@ -0,0 +1,90 @@ +From: Xiubo Li +Date: Thu, 1 Jun 2023 08:59:31 +0800 +Subject: ceph: fix use-after-free bug for inodes when flushing capsnaps +Git-commit: 409e873ea3c1fd3079909718bbeb06ac1ec7f38b +Patch-mainline: v6.4-rc6 +References: bsc#1212540 + +There is a race between capsnaps flush and removing the inode from +'mdsc->snap_flush_list' list: + + == Thread A == == Thread B == +ceph_queue_cap_snap() + -> allocate 'capsnapA' + ->ihold('&ci->vfs_inode') + ->add 'capsnapA' to 'ci->i_cap_snaps' + ->add 'ci' to 'mdsc->snap_flush_list' + ... + == Thread C == +ceph_flush_snaps() + ->__ceph_flush_snaps() + ->__send_flush_snap() + handle_cap_flushsnap_ack() + ->iput('&ci->vfs_inode') + this also will release 'ci' + ... + == Thread D == + ceph_handle_snap() + ->flush_snaps() + ->iterate 'mdsc->snap_flush_list' + ->get the stale 'ci' + ->remove 'ci' from ->ihold(&ci->vfs_inode) this + 'mdsc->snap_flush_list' will WARNING + +To fix this we will increase the inode's i_count ref when adding 'ci' +to the 'mdsc->snap_flush_list' list. + +[ idryomov: need_put int -> bool ] + +Cc: stable@vger.kernel.org +Link: https://bugzilla.redhat.com/show_bug.cgi?id=2209299 +Signed-off-by: Xiubo Li +Reviewed-by: Milind Changire +Reviewed-by: Ilya Dryomov +Signed-off-by: Ilya Dryomov +Acked-by: Luís Henriques + +--- + fs/ceph/caps.c | 6 ++++++ + fs/ceph/snap.c | 4 +++- + 2 files changed, 9 insertions(+), 1 deletion(-) + +--- a/fs/ceph/caps.c ++++ b/fs/ceph/caps.c +@@ -1634,6 +1634,7 @@ void ceph_flush_snaps(struct ceph_inode_ + struct inode *inode = &ci->vfs_inode; + struct ceph_mds_client *mdsc = ceph_inode_to_client(inode)->mdsc; + struct ceph_mds_session *session = NULL; ++ bool need_put = false; + int mds; + + dout("ceph_flush_snaps %p\n", inode); +@@ -1678,8 +1679,13 @@ out: + ceph_put_mds_session(session); + /* we flushed them all; remove this inode from the queue */ + spin_lock(&mdsc->snap_flush_lock); ++ if (!list_empty(&ci->i_snap_flush_item)) ++ need_put = true; + list_del_init(&ci->i_snap_flush_item); + spin_unlock(&mdsc->snap_flush_lock); ++ ++ if (need_put) ++ iput(inode); + } + + /* +--- a/fs/ceph/snap.c ++++ b/fs/ceph/snap.c +@@ -657,8 +657,10 @@ int __ceph_finish_cap_snap(struct ceph_i + capsnap->size); + + spin_lock(&mdsc->snap_flush_lock); +- if (list_empty(&ci->i_snap_flush_item)) ++ if (list_empty(&ci->i_snap_flush_item)) { ++ ihold(inode); + list_add_tail(&ci->i_snap_flush_item, &mdsc->snap_flush_list); ++ } + spin_unlock(&mdsc->snap_flush_lock); + return 1; /* caller may want to ceph_flush_snaps */ + } + diff --git a/patches.suse/cgroup-Use-cgroup_attach_-lock-unlock-from-cgroup_attach_task_all.patch b/patches.suse/cgroup-Use-cgroup_attach_-lock-unlock-from-cgroup_attach_task_all.patch new file mode 100644 index 0000000..8360989 --- /dev/null +++ b/patches.suse/cgroup-Use-cgroup_attach_-lock-unlock-from-cgroup_attach_task_all.patch @@ -0,0 +1,80 @@ +From: Tetsuo Handa +Date: Fri, 26 Aug 2022 11:48:29 +0900 +Subject: cgroup: Use cgroup_attach_{lock,unlock}() from + cgroup_attach_task_all() +Git-commit: 075b593f54f0f3883532cb750081cae6917bc8fe +Patch-mainline: v6.1-rc1 +References: bsc#1212563 + +No behavior changes; preparing for potential locking changes in future. + +Signed-off-by: Tetsuo Handa +Reviewed-by:Mukesh Ojha +Signed-off-by: Tejun Heo +Acked-by: Michal Koutný +--- + kernel/cgroup/cgroup-internal.h | 2 ++ + kernel/cgroup/cgroup-v1.c | 6 ++---- + kernel/cgroup/cgroup.c | 4 ++-- + 3 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/kernel/cgroup/cgroup-internal.h b/kernel/cgroup/cgroup-internal.h +index 36b740cb3d59..2c7ecca226be 100644 +--- a/kernel/cgroup/cgroup-internal.h ++++ b/kernel/cgroup/cgroup-internal.h +@@ -250,6 +250,8 @@ int cgroup_migrate(struct task_struct *leader, bool threadgroup, + + int cgroup_attach_task(struct cgroup *dst_cgrp, struct task_struct *leader, + bool threadgroup); ++void cgroup_attach_lock(bool lock_threadgroup); ++void cgroup_attach_unlock(bool lock_threadgroup); + struct task_struct *cgroup_procs_write_start(char *buf, bool threadgroup, + bool *locked) + __acquires(&cgroup_threadgroup_rwsem); +diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c +index ff6a8099eb2a..52bb5a74a23b 100644 +--- a/kernel/cgroup/cgroup-v1.c ++++ b/kernel/cgroup/cgroup-v1.c +@@ -59,8 +59,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk) + int retval = 0; + + mutex_lock(&cgroup_mutex); +- cpus_read_lock(); +- percpu_down_write(&cgroup_threadgroup_rwsem); ++ cgroup_attach_lock(true); + for_each_root(root) { + struct cgroup *from_cgrp; + +@@ -72,8 +71,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk) + if (retval) + break; + } +- percpu_up_write(&cgroup_threadgroup_rwsem); +- cpus_read_unlock(); ++ cgroup_attach_unlock(true); + mutex_unlock(&cgroup_mutex); + + return retval; +diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c +index 65497a1a44fa..0005de2e2ed9 100644 +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -2393,7 +2393,7 @@ EXPORT_SYMBOL_GPL(task_cgroup_path); + * write-locking cgroup_threadgroup_rwsem. This allows ->attach() to assume that + * CPU hotplug is disabled on entry. + */ +-static void cgroup_attach_lock(bool lock_threadgroup) ++void cgroup_attach_lock(bool lock_threadgroup) + { + cpus_read_lock(); + if (lock_threadgroup) +@@ -2404,7 +2404,7 @@ static void cgroup_attach_lock(bool lock_threadgroup) + * cgroup_attach_unlock - Undo cgroup_attach_lock() + * @lock_threadgroup: whether to up_write cgroup_threadgroup_rwsem + */ +-static void cgroup_attach_unlock(bool lock_threadgroup) ++void cgroup_attach_unlock(bool lock_threadgroup) + { + if (lock_threadgroup) + percpu_up_write(&cgroup_threadgroup_rwsem); + diff --git a/patches.suse/cgroup-always-put-cset-in-cgroup_css_set_put_fork.patch b/patches.suse/cgroup-always-put-cset-in-cgroup_css_set_put_fork.patch new file mode 100644 index 0000000..238e95b --- /dev/null +++ b/patches.suse/cgroup-always-put-cset-in-cgroup_css_set_put_fork.patch @@ -0,0 +1,80 @@ +From: John Sperbeck +Date: Sun, 21 May 2023 19:29:53 +0000 +Subject: cgroup: always put cset in cgroup_css_set_put_fork +Git-commit: 2bd110339288c18823dcace602b63b0d8627e520 +Patch-mainline: v6.4-rc6 +References: bsc#1212561 + +A successful call to cgroup_css_set_fork() will always have taken +a ref on kargs->cset (regardless of CLONE_INTO_CGROUP), so always +do a corresponding put in cgroup_css_set_put_fork(). + +Without this, a cset and its contained css structures will be +leaked for some fork failures. The following script reproduces +the leak for a fork failure due to exceeding pids.max in the +pids controller. A similar thing can happen if we jump to the +bad_fork_cancel_cgroup label in copy_process(). + +[ -z "$1" ] && echo "Usage $0 pids-root" && exit 1 +PID_ROOT=$1 +CGROUP=$PID_ROOT/foo + +[ -e $CGROUP ] && rmdir -f $CGROUP +mkdir $CGROUP +echo 5 > $CGROUP/pids.max +echo $$ > $CGROUP/cgroup.procs + +fork_bomb() +{ + set -e + for i in $(seq 10); do + /bin/sleep 3600 & + done +} + +(fork_bomb) & +wait +echo $$ > $PID_ROOT/cgroup.procs +kill $(cat $CGROUP/cgroup.procs) +rmdir $CGROUP + +Fixes: ef2c41cf38a7 ("clone3: allow spawning processes into cgroups") +Cc: stable@vger.kernel.org # v5.7+ +Signed-off-by: John Sperbeck +Signed-off-by: Tejun Heo +Acked-by: Michal Koutný +--- + kernel/cgroup/cgroup.c | 17 ++++++++--------- + 1 file changed, 8 insertions(+), 9 deletions(-) + +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -6276,19 +6276,18 @@ err: + static void cgroup_css_set_put_fork(struct kernel_clone_args *kargs) + __releases(&cgroup_threadgroup_rwsem) __releases(&cgroup_mutex) + { ++ struct cgroup *cgrp = kargs->cgrp; ++ struct css_set *cset = kargs->cset; ++ + cgroup_threadgroup_change_end(current); + +- if (kargs->flags & CLONE_INTO_CGROUP) { +- struct cgroup *cgrp = kargs->cgrp; +- struct css_set *cset = kargs->cset; ++ if (cset) { ++ put_css_set(cset); ++ kargs->cset = NULL; ++ } + ++ if (kargs->flags & CLONE_INTO_CGROUP) { + mutex_unlock(&cgroup_mutex); +- +- if (cset) { +- put_css_set(cset); +- kargs->cset = NULL; +- } +- + if (cgrp) { + cgroup_put(cgrp); + kargs->cgrp = NULL; + diff --git a/patches.suse/cgroup-fix-missing-cpus_read_-lock-unlock-in-cgroup_transfer_tasks.patch b/patches.suse/cgroup-fix-missing-cpus_read_-lock-unlock-in-cgroup_transfer_tasks.patch new file mode 100644 index 0000000..1ae1ad9 --- /dev/null +++ b/patches.suse/cgroup-fix-missing-cpus_read_-lock-unlock-in-cgroup_transfer_tasks.patch @@ -0,0 +1,72 @@ +From: Qi Zheng +Date: Wed, 17 May 2023 07:45:45 +0000 +Subject: cgroup: fix missing cpus_read_{lock,unlock}() in + cgroup_transfer_tasks() +Git-commit: ab1de7ead871ebe6d12a774c3c25de0388cde082 +Patch-mainline: v6.4-rc6 +References: bsc#1212563 + +The commit 4f7e7236435c ("cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() +deadlock") fixed the deadlock between cgroup_threadgroup_rwsem and +cpus_read_lock() by introducing cgroup_attach_{lock,unlock}() and removing +cpus_read_{lock,unlock}() from cpuset_attach(). But cgroup_transfer_tasks() +was missed and not handled, which will cause th following warning: + + WARNING: CPU: 0 PID: 589 at kernel/cpu.c:526 lockdep_assert_cpus_held+0x32/0x40 + CPU: 0 PID: 589 Comm: kworker/1:4 Not tainted 6.4.0-rc2-next-20230517 #50 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 + Workqueue: events cpuset_hotplug_workfn + RIP: 0010:lockdep_assert_cpus_held+0x32/0x40 + <...> + Call Trace: + + cpuset_attach+0x40/0x240 + cgroup_migrate_execute+0x452/0x5e0 + ? _raw_spin_unlock_irq+0x28/0x40 + cgroup_transfer_tasks+0x1f3/0x360 + ? find_held_lock+0x32/0x90 + ? cpuset_hotplug_workfn+0xc81/0xed0 + cpuset_hotplug_workfn+0xcb1/0xed0 + ? process_one_work+0x248/0x5b0 + process_one_work+0x2b9/0x5b0 + worker_thread+0x56/0x3b0 + ? process_one_work+0x5b0/0x5b0 + kthread+0xf1/0x120 + ? kthread_complete_and_exit+0x20/0x20 + ret_from_fork+0x1f/0x30 + + +So just use the cgroup_attach_{lock,unlock}() helper to fix it. + +Reported-by: Zhao Gongyi +Signed-off-by: Qi Zheng +Acked-by: Muchun Song +Fixes: 05c7b7a92cc8 ("cgroup/cpuset: Fix a race between cpuset_attach() and cpu hotplug") +Cc: stable@vger.kernel.org # v5.17+ +Signed-off-by: Tejun Heo +Acked-by: Michal Koutný +--- + kernel/cgroup/cgroup-v1.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/kernel/cgroup/cgroup-v1.c ++++ b/kernel/cgroup/cgroup-v1.c +@@ -113,7 +113,7 @@ int cgroup_transfer_tasks(struct cgroup + + mutex_lock(&cgroup_mutex); + +- percpu_down_write(&cgroup_threadgroup_rwsem); ++ cgroup_attach_lock(true); + + /* all tasks in @from are being moved, all csets are source */ + spin_lock_irq(&css_set_lock); +@@ -149,7 +149,7 @@ int cgroup_transfer_tasks(struct cgroup + } while (task && !ret); + out_err: + cgroup_migrate_finish(&mgctx); +- percpu_up_write(&cgroup_threadgroup_rwsem); ++ cgroup_attach_unlock(true); + mutex_unlock(&cgroup_mutex); + return ret; + } + diff --git a/patches.suse/drm-amd-amdgpu-Fix-missing-buffer-object-unlock-in-f.patch b/patches.suse/drm-amd-amdgpu-Fix-missing-buffer-object-unlock-in-f.patch new file mode 100644 index 0000000..6490419 --- /dev/null +++ b/patches.suse/drm-amd-amdgpu-Fix-missing-buffer-object-unlock-in-f.patch @@ -0,0 +1,58 @@ +From 60ecaaf54886b0642d5c4744f7fbf1ff0d6b3e42 Mon Sep 17 00:00:00 2001 +From: Sukrut Bellary +Date: Wed, 3 May 2023 16:15:07 -0700 +Subject: [PATCH] drm:amd:amdgpu: Fix missing buffer object unlock in failure path +Git-commit: 60ecaaf54886b0642d5c4744f7fbf1ff0d6b3e42 +Patch-mainline: v6.4-rc4 +References: git-fixes + +smatch warning - +1) drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:3615 gfx_v9_0_kiq_resume() +Warn: inconsistent returns 'ring->mqd_obj->tbo.base.resv'. + +2) drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:6901 gfx_v10_0_kiq_resume() + +Signed-off-by: Sukrut Bellary +Signed-off-by: Alex Deucher +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 4 +++- + drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 4 +++- + 2 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +index 1ec076517c96..ab44c1391d52 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +@@ -6892,8 +6892,10 @@ static int gfx_v10_0_kiq_resume(struct amdgpu_device *adev) + return r; + + r = amdgpu_bo_kmap(ring->mqd_obj, (void **)&ring->mqd_ptr); +- if (unlikely(r != 0)) ++ if (unlikely(r != 0)) { ++ amdgpu_bo_unreserve(ring->mqd_obj); + return r; ++ } + + gfx_v10_0_kiq_init_queue(ring); + amdgpu_bo_kunmap(ring->mqd_obj); +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +index 9818743ec419..ce22f7b30416 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -3617,8 +3617,10 @@ static int gfx_v9_0_kiq_resume(struct amdgpu_device *adev) + return r; + + r = amdgpu_bo_kmap(ring->mqd_obj, (void **)&ring->mqd_ptr); +- if (unlikely(r != 0)) ++ if (unlikely(r != 0)) { ++ amdgpu_bo_unreserve(ring->mqd_obj); + return r; ++ } + + gfx_v9_0_kiq_init_queue(ring); + amdgpu_bo_kunmap(ring->mqd_obj); +-- +2.35.3 + diff --git a/patches.suse/drm-amd-display-edp-do-not-add-non-edid-timings.patch b/patches.suse/drm-amd-display-edp-do-not-add-non-edid-timings.patch new file mode 100644 index 0000000..d2a0d45 --- /dev/null +++ b/patches.suse/drm-amd-display-edp-do-not-add-non-edid-timings.patch @@ -0,0 +1,45 @@ +From e749dd10e5f292061ad63d2b030194bf7d7d452c Mon Sep 17 00:00:00 2001 +From: Hersen Wu +Date: Thu, 25 May 2023 08:37:40 -0400 +Subject: [PATCH] drm/amd/display: edp do not add non-edid timings +Git-commit: e749dd10e5f292061ad63d2b030194bf7d7d452c +Patch-mainline: v6.4-rc7 +References: git-fixes + +[Why] most edp support only timings from edid. applying +non-edid timings, especially those timings out of edp +bandwidth, may damage edp. + +[How] do not add non-edid timings for edp. + +Cc: Mario Limonciello +Cc: Alex Deucher +Cc: stable@vger.kernel.org +Acked-by: Stylon Wang +Signed-off-by: Hersen Wu +Reviewed-by: Roman Li +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -7821,7 +7821,13 @@ static int amdgpu_dm_connector_get_modes + drm_add_modes_noedid(connector, 640, 480); + } else { + amdgpu_dm_connector_ddc_get_modes(connector, edid); +- amdgpu_dm_connector_add_common_modes(encoder, connector); ++ /* most eDP supports only timings from its edid, ++ * usually only detailed timings are available ++ * from eDP edid. timings which are not from edid ++ * may damage eDP ++ */ ++ if (connector->connector_type != DRM_MODE_CONNECTOR_eDP) ++ amdgpu_dm_connector_add_common_modes(encoder, connector); + amdgpu_dm_connector_add_freesync_modes(connector, edid); + } + amdgpu_dm_fbc_init(connector); diff --git a/patches.suse/init-invoke-arch_cpu_finalize_init-earlier.patch b/patches.suse/init-invoke-arch_cpu_finalize_init-earlier.patch index b997cad..4dafbca 100644 --- a/patches.suse/init-invoke-arch_cpu_finalize_init-earlier.patch +++ b/patches.suse/init-invoke-arch_cpu_finalize_init-earlier.patch @@ -30,25 +30,35 @@ Link: https://lore.kernel.org/r/20230613224545.612182854@linutronix.de Acked-by: Nikolay Borisov --- - init/main.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) + init/main.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) --- a/init/main.c +++ b/init/main.c -@@ -1051,6 +1051,8 @@ asmlinkage __visible void __init __no_sa +@@ -1052,6 +1052,7 @@ asmlinkage __visible void __init __no_sa kmem_cache_init_late(); -+ arch_cpu_finalize_init(); + /* * HACK ALERT! This is early. We're enabling the console before * we've done PCI setups etc, and console_init() must be aware of -@@ -1120,7 +1122,6 @@ asmlinkage __visible void __init __no_sa +@@ -1095,6 +1096,9 @@ asmlinkage __visible void __init __no_sa + late_time_init(); + sched_clock_init(); + calibrate_delay(); ++ ++ arch_cpu_finalize_init(); ++ + pid_idr_init(); + anon_vma_init(); + #ifdef CONFIG_X86 +@@ -1120,8 +1124,6 @@ asmlinkage __visible void __init __no_sa + taskstats_init_early(); delayacct_init(); - poking_init(); - arch_cpu_finalize_init(); - +- acpi_subsystem_init(); arch_post_acpi_subsys_init(); + kcsan_init(); diff --git a/patches.suse/init-provide-arch_cpu_finalize_init.patch b/patches.suse/init-provide-arch_cpu_finalize_init.patch index c5088db..9419cca 100644 --- a/patches.suse/init-provide-arch_cpu_finalize_init.patch +++ b/patches.suse/init-provide-arch_cpu_finalize_init.patch @@ -61,9 +61,9 @@ Acked-by: Nikolay Borisov --- a/init/main.c +++ b/init/main.c @@ -1121,7 +1121,11 @@ asmlinkage __visible void __init __no_sa + taskstats_init_early(); delayacct_init(); - poking_init(); + arch_cpu_finalize_init(); + /* Temporary conditional until everything has been converted */ +#ifndef CONFIG_ARCH_HAS_CPU_FINALIZE_INIT diff --git a/patches.suse/init-remove-check_bugs-leftovers.patch b/patches.suse/init-remove-check_bugs-leftovers.patch index 19fcfa9..c46f102 100644 --- a/patches.suse/init-remove-check_bugs-leftovers.patch +++ b/patches.suse/init-remove-check_bugs-leftovers.patch @@ -133,8 +133,8 @@ Acked-by: Nikolay Borisov #include #include @@ -1122,10 +1121,6 @@ asmlinkage __visible void __init __no_sa + delayacct_init(); - poking_init(); arch_cpu_finalize_init(); - /* Temporary conditional until everything has been converted */ -#ifndef CONFIG_ARCH_HAS_CPU_FINALIZE_INIT diff --git a/patches.suse/media-rkvdec-fix-use-after-free-bug-in-rkvdec_remove.patch b/patches.suse/media-rkvdec-fix-use-after-free-bug-in-rkvdec_remove.patch index da935f7..72fd267 100644 --- a/patches.suse/media-rkvdec-fix-use-after-free-bug-in-rkvdec_remove.patch +++ b/patches.suse/media-rkvdec-fix-use-after-free-bug-in-rkvdec_remove.patch @@ -4,7 +4,7 @@ Date: Mon, 13 Mar 2023 16:42:20 +0000 Subject: [PATCH] media: rkvdec: fix use after free bug in rkvdec_remove Git-commit: 3228cec23b8b29215e18090c6ba635840190993d Patch-mainline: v6.4-rc1 -References: git-fixes +References: git-fixes bsc#1212495 CVE-2023-35829 In rkvdec_probe, rkvdec->watchdog_work is bound with rkvdec_watchdog_func. Then rkvdec_vp9_run may diff --git a/patches.suse/mm-move-mm_cachep-initialization-to-mm_init.patch b/patches.suse/mm-move-mm_cachep-initialization-to-mm_init.patch new file mode 100644 index 0000000..885a90d --- /dev/null +++ b/patches.suse/mm-move-mm_cachep-initialization-to-mm_init.patch @@ -0,0 +1,91 @@ +From: Peter Zijlstra +Date: Tue, 25 Oct 2022 21:38:18 +0200 +Subject: mm: Move mm_cachep initialization to mm_init() +Git-commit: af80602799681c78f14fbe20b6185a56020dedee +Patch-mainline: v6.2-rc1 +References: bsc#1212448 + +In order to allow using mm_alloc() much earlier, move initializing +mm_cachep into mm_init(). + +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20221025201057.751153381@infradead.org + +Acked-by: Nikolay Borisov +--- + include/linux/sched/task.h | 1 + + init/main.c | 1 + + kernel/fork.c | 32 ++++++++++++++++++-------------- + 3 files changed, 20 insertions(+), 14 deletions(-) + +--- a/include/linux/sched/task.h ++++ b/include/linux/sched/task.h +@@ -61,6 +61,7 @@ extern void sched_dead(struct task_struc + void __noreturn do_task_dead(void); + void __noreturn make_task_dead(int signr); + ++extern void mm_cache_init(void); + extern void proc_caches_init(void); + + extern void fork_init(void); +--- a/init/main.c ++++ b/init/main.c +@@ -843,6 +843,7 @@ static void __init mm_init(void) + init_espfix_bsp(); + /* Should be run after espfix64 is set up. */ + pti_init(); ++ mm_cache_init(); + } + + #ifdef CONFIG_HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -2847,10 +2847,27 @@ static void sighand_ctor(void *data) + init_waitqueue_head(&sighand->signalfd_wqh); + } + +-void __init proc_caches_init(void) ++void __init mm_cache_init(void) + { + unsigned int mm_size; + ++ /* ++ * The mm_cpumask is located at the end of mm_struct, and is ++ * dynamically sized based on the maximum CPU number this system ++ * can have, taking hotplug into account (nr_cpu_ids). ++ */ ++ mm_size = sizeof(struct mm_struct) + cpumask_size(); ++ ++ mm_cachep = kmem_cache_create_usercopy("mm_struct", ++ mm_size, ARCH_MIN_MMSTRUCT_ALIGN, ++ SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT, ++ offsetof(struct mm_struct, saved_auxv), ++ sizeof_field(struct mm_struct, saved_auxv), ++ NULL); ++} ++ ++void __init proc_caches_init(void) ++{ + sighand_cachep = kmem_cache_create("sighand_cache", + sizeof(struct sighand_struct), 0, + SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_TYPESAFE_BY_RCU| +@@ -2868,19 +2885,6 @@ void __init proc_caches_init(void) + SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT, + NULL); + +- /* +- * The mm_cpumask is located at the end of mm_struct, and is +- * dynamically sized based on the maximum CPU number this system +- * can have, taking hotplug into account (nr_cpu_ids). +- */ +- mm_size = sizeof(struct mm_struct) + cpumask_size(); +- +- mm_cachep = kmem_cache_create_usercopy("mm_struct", +- mm_size, ARCH_MIN_MMSTRUCT_ALIGN, +- SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT, +- offsetof(struct mm_struct, saved_auxv), +- sizeof_field(struct mm_struct, saved_auxv), +- NULL); + vm_area_cachep = KMEM_CACHE(vm_area_struct, SLAB_PANIC|SLAB_ACCOUNT); + mmap_init(); + nsproxy_cache_init(); diff --git a/patches.suse/mm-vmalloc-avoid-warn_alloc-noise-caused-by-fatal-signal.patch b/patches.suse/mm-vmalloc-avoid-warn_alloc-noise-caused-by-fatal-signal.patch new file mode 100644 index 0000000..76eb889 --- /dev/null +++ b/patches.suse/mm-vmalloc-avoid-warn_alloc-noise-caused-by-fatal-signal.patch @@ -0,0 +1,120 @@ +From: Yafang Shao +Date: Thu, 30 Mar 2023 16:26:25 +0000 +Subject: mm: vmalloc: avoid warn_alloc noise caused by fatal signal +Git-commit: f349b15e183d6956f1b63d6ff57849ff10c7edd5 +Patch-mainline: v6.3-rc6 +References: bsc#1211410 + +There're some suspicious warn_alloc on my test serer, for example, + +[13366.518837] warn_alloc: 81 callbacks suppressed +[13366.518841] test_verifier: vmalloc error: size 4096, page order 0, failed to allocate pages, mode:0x500dc2(GFP_HIGHUSER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 +[13366.522240] CPU: 30 PID: 722463 Comm: test_verifier Kdump: loaded Tainted: G W O 6.2.0+ #638 +[13366.524216] Call Trace: +[13366.524702] +[13366.525148] dump_stack_lvl+0x6c/0x80 +[13366.525712] dump_stack+0x10/0x20 +[13366.526239] warn_alloc+0x119/0x190 +[13366.526783] ? alloc_pages_bulk_array_mempolicy+0x9e/0x2a0 +[13366.527470] __vmalloc_area_node+0x546/0x5b0 +[13366.528066] __vmalloc_node_range+0xc2/0x210 +[13366.528660] __vmalloc_node+0x42/0x50 +[13366.529186] ? bpf_prog_realloc+0x53/0xc0 +[13366.529743] __vmalloc+0x1e/0x30 +[13366.530235] bpf_prog_realloc+0x53/0xc0 +[13366.530771] bpf_patch_insn_single+0x80/0x1b0 +[13366.531351] bpf_jit_blind_constants+0xe9/0x1c0 +[13366.531932] ? __free_pages+0xee/0x100 +[13366.532457] ? free_large_kmalloc+0x58/0xb0 +[13366.533002] bpf_int_jit_compile+0x8c/0x5e0 +[13366.533546] bpf_prog_select_runtime+0xb4/0x100 +[13366.534108] bpf_prog_load+0x6b1/0xa50 +[13366.534610] ? perf_event_task_tick+0x96/0xb0 +[13366.535151] ? security_capable+0x3a/0x60 +[13366.535663] __sys_bpf+0xb38/0x2190 +[13366.536120] ? kvm_clock_get_cycles+0x9/0x10 +[13366.536643] __x64_sys_bpf+0x1c/0x30 +[13366.537094] do_syscall_64+0x38/0x90 +[13366.537554] entry_SYSCALL_64_after_hwframe+0x72/0xdc +[13366.538107] RIP: 0033:0x7f78310f8e29 +[13366.538561] Code: 01 00 48 81 c4 80 00 00 00 e9 f1 fe ff ff 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 17 e0 2c 00 f7 d8 64 89 01 48 +[13366.540286] RSP: 002b:00007ffe2a61fff8 EFLAGS: 00000206 ORIG_RAX: 0000000000000141 +[13366.541031] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f78310f8e29 +[13366.541749] RDX: 0000000000000080 RSI: 00007ffe2a6200b0 RDI: 0000000000000005 +[13366.542470] RBP: 00007ffe2a620010 R08: 00007ffe2a6202a0 R09: 00007ffe2a6200b0 +[13366.543183] R10: 00000000000f423e R11: 0000000000000206 R12: 0000000000407800 +[13366.543900] R13: 00007ffe2a620540 R14: 0000000000000000 R15: 0000000000000000 +[13366.544623] +[13366.545260] Mem-Info: +[13366.546121] active_anon:81319 inactive_anon:20733 isolated_anon:0 + active_file:69450 inactive_file:5624 isolated_file:0 + unevictable:0 dirty:10 writeback:0 + slab_reclaimable:69649 slab_unreclaimable:48930 + mapped:27400 shmem:12868 pagetables:4929 + sec_pagetables:0 bounce:0 + kernel_misc_reclaimable:0 + free:15870308 free_pcp:142935 free_cma:0 +[13366.551886] Node 0 active_anon:224836kB inactive_anon:33528kB active_file:175692kB inactive_file:13752kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:59248kB dirty:32kB writeback:0kB shmem:18252kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:4616kB pagetables:10664kB sec_pagetables:0kB all_unreclaimable? no +[13366.555184] Node 1 active_anon:100440kB inactive_anon:49404kB active_file:102108kB inactive_file:8744kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:50352kB dirty:8kB writeback:0kB shmem:33220kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:3896kB pagetables:9052kB sec_pagetables:0kB all_unreclaimable? no +[13366.558262] Node 0 DMA free:15360kB boost:0kB min:304kB low:380kB high:456kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB +[13366.560821] lowmem_reserve[]: 0 2735 31873 31873 31873 +[13366.561981] Node 0 DMA32 free:2790904kB boost:0kB min:56028kB low:70032kB high:84036kB reserved_highatomic:0KB active_anon:1936kB inactive_anon:20kB active_file:396kB inactive_file:344kB unevictable:0kB writepending:0kB present:3129200kB managed:2801520kB mlocked:0kB bounce:0kB free_pcp:5188kB local_pcp:0kB free_cma:0kB +[13366.565148] lowmem_reserve[]: 0 0 29137 29137 29137 +[13366.566168] Node 0 Normal free:28533824kB boost:0kB min:596740kB low:745924kB high:895108kB reserved_highatomic:28672KB active_anon:222900kB inactive_anon:33508kB active_file:175296kB inactive_file:13408kB unevictable:0kB writepending:32kB present:30408704kB managed:29837172kB mlocked:0kB bounce:0kB free_pcp:295724kB local_pcp:0kB free_cma:0kB +[13366.569485] lowmem_reserve[]: 0 0 0 0 0 +[13366.570416] Node 1 Normal free:32141144kB boost:0kB min:660504kB low:825628kB high:990752kB reserved_highatomic:69632KB active_anon:100440kB inactive_anon:49404kB active_file:102108kB inactive_file:8744kB unevictable:0kB writepending:8kB present:33554432kB managed:33025372kB mlocked:0kB bounce:0kB free_pcp:270880kB local_pcp:46860kB free_cma:0kB +[13366.573403] lowmem_reserve[]: 0 0 0 0 0 +[13366.574015] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB +[13366.575474] Node 0 DMA32: 782*4kB (UME) 756*8kB (UME) 736*16kB (UME) 745*32kB (UME) 694*64kB (UME) 653*128kB (UME) 595*256kB (UME) 552*512kB (UME) 454*1024kB (UME) 347*2048kB (UME) 246*4096kB (UME) = 2790904kB +[13366.577442] Node 0 Normal: 33856*4kB (UMEH) 51815*8kB (UMEH) 42418*16kB (UMEH) 36272*32kB (UMEH) 22195*64kB (UMEH) 10296*128kB (UMEH) 7238*256kB (UMEH) 5638*512kB (UEH) 5337*1024kB (UMEH) 3506*2048kB (UMEH) 1470*4096kB (UME) = 28533784kB +[13366.580460] Node 1 Normal: 15776*4kB (UMEH) 37485*8kB (UMEH) 29509*16kB (UMEH) 21420*32kB (UMEH) 14818*64kB (UMEH) 13051*128kB (UMEH) 9918*256kB (UMEH) 7374*512kB (UMEH) 5397*1024kB (UMEH) 3887*2048kB (UMEH) 2002*4096kB (UME) = 32141240kB +[13366.583027] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB +[13366.584380] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB +[13366.585702] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB +[13366.587042] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB +[13366.588372] 87386 total pagecache pages +[13366.589266] 0 pages in swap cache +[13366.590327] Free swap = 0kB +[13366.591227] Total swap = 0kB +[13366.592142] 16777082 pages RAM +[13366.593057] 0 pages HighMem/MovableOnly +[13366.594037] 357226 pages reserved +[13366.594979] 0 pages hwpoisoned + +This failure really confuse me as there're still lots of available pages. +Finally I figured out it was caused by a fatal signal. When a process is +allocating memory via vm_area_alloc_pages(), it will break directly even +if it hasn't allocated the requested pages when it receives a fatal +signal. In that case, we shouldn't show this warn_alloc, as it is +useless. We only need to show this warning when there're really no enough +pages. + +Link: https://lkml.kernel.org/r/20230330162625.13604-1-laoar.shao@gmail.com +Signed-off-by: Yafang Shao +Reviewed-by: Lorenzo Stoakes +Cc: Christoph Hellwig +Cc: Uladzislau Rezki (Sony) +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Vlastimil Babka +--- + mm/vmalloc.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -2916,9 +2916,11 @@ static void *__vmalloc_area_node(struct + * allocation request, free them via __vfree() if any. + */ + if (area->nr_pages != nr_small_pages) { +- warn_alloc(orig_gfp_mask, NULL, +- "vmalloc error: size %lu, page order %u, failed to allocate pages", +- area->nr_pages * PAGE_SIZE, page_order); ++ /* vm_area_alloc_pages() can also fail due to a fatal signal */ ++ if (!fatal_signal_pending(current)) ++ warn_alloc(orig_gfp_mask, NULL, ++ "vmalloc error: size %lu, page order %u, failed to allocate pages", ++ area->nr_pages * PAGE_SIZE, page_order); + goto fail; + } + diff --git a/patches.suse/mm-vmalloc-do-not-output-a-spurious-warning-when-huge-vmalloc-fails.patch b/patches.suse/mm-vmalloc-do-not-output-a-spurious-warning-when-huge-vmalloc-fails.patch new file mode 100644 index 0000000..5324780 --- /dev/null +++ b/patches.suse/mm-vmalloc-do-not-output-a-spurious-warning-when-huge-vmalloc-fails.patch @@ -0,0 +1,68 @@ +From: Lorenzo Stoakes +Date: Mon, 5 Jun 2023 21:11:07 +0100 +Subject: mm/vmalloc: do not output a spurious warning when huge vmalloc() + fails +References: bsc#1211410 +Git-commit: 95a301eefa82057571207edd06ea36218985a75e +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git + +In __vmalloc_area_node() we always warn_alloc() when an allocation +performed by vm_area_alloc_pages() fails unless it was due to a pending +fatal signal. + +However, huge page allocations instigated either by vmalloc_huge() or +__vmalloc_node_range() (or a caller that invokes this like kvmalloc() or +kvmalloc_node()) always falls back to order-0 allocations if the huge page +allocation fails. + +This renders the warning useless and noisy, especially as all callers +appear to be aware that this may fallback. This has already resulted in +at least one bug report from a user who was confused by this (see link). + +Therefore, simply update the code to only output this warning for order-0 +pages when no fatal signal is pending. + +Link: https://bugzilla.suse.com/show_bug.cgi?id=1211410 +Link: https://lkml.kernel.org/r/20230605201107.83298-1-lstoakes@gmail.com +Fixes: 80b1d8fdfad1 ("mm: vmalloc: correct use of __GFP_NOWARN mask in __vmalloc_area_node()") +Signed-off-by: Lorenzo Stoakes +Acked-by: Vlastimil Babka +Reviewed-by: Baoquan He +Acked-by: Michal Hocko +Reviewed-by: Uladzislau Rezki (Sony) +Reviewed-by: David Hildenbrand +Cc: Christoph Hellwig +Cc: +Signed-off-by: Andrew Morton +--- + mm/vmalloc.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -2916,11 +2916,20 @@ static void *__vmalloc_area_node(struct + * allocation request, free them via __vfree() if any. + */ + if (area->nr_pages != nr_small_pages) { +- /* vm_area_alloc_pages() can also fail due to a fatal signal */ +- if (!fatal_signal_pending(current)) ++ /* ++ * vm_area_alloc_pages() can fail due to insufficient memory but ++ * also:- ++ * ++ * - a pending fatal signal ++ * - insufficient huge page-order pages ++ * ++ * Since we always retry allocations at order-0 in the huge page ++ * case a warning for either is spurious. ++ */ ++ if (!fatal_signal_pending(current) && page_order == 0) + warn_alloc(orig_gfp_mask, NULL, +- "vmalloc error: size %lu, page order %u, failed to allocate pages", +- area->nr_pages * PAGE_SIZE, page_order); ++ "vmalloc error: size %lu, failed to allocate pages", ++ area->nr_pages * PAGE_SIZE); + goto fail; + } + diff --git a/patches.suse/net-usb-qmi_wwan-add-support-for-Compal-RXM-G1.patch b/patches.suse/net-usb-qmi_wwan-add-support-for-Compal-RXM-G1.patch new file mode 100644 index 0000000..ca5ccc6 --- /dev/null +++ b/patches.suse/net-usb-qmi_wwan-add-support-for-Compal-RXM-G1.patch @@ -0,0 +1,78 @@ +From 863199199713908afaa47ba09332b87621c12496 Mon Sep 17 00:00:00 2001 +From: Wes Huang +Date: Thu, 8 Jun 2023 11:01:42 +0800 +Subject: [PATCH] net: usb: qmi_wwan: add support for Compal RXM-G1 +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 863199199713908afaa47ba09332b87621c12496 +Patch-mainline: v6.4-rc7 +References: git-fixes + +Add support for Compal RXM-G1 which is based on Qualcomm SDX55 chip. +This patch adds support for two compositions: + +0x9091: DIAG + MODEM + QMI_RMNET + ADB +0x90db: DIAG + DUN + RMNET + DPL + QDSS(Trace) + ADB + +T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=05c6 ProdID=9091 Rev= 4.14 +S: Manufacturer=QCOM +S: Product=SDXPRAIRIE-MTP _SN:719AB680 +S: SerialNumber=719ab680 +C:* #Ifs= 4 Cfg#= 1 Atr=80 MxPwr=896mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none) +E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +E: Ad=84(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +P: Vendor=05c6 ProdID=90db Rev= 4.14 +C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=896mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none) +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +I:* If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=8f(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +Cc: stable@vger.kernel.org +Signed-off-by: Wes Huang +Acked-by: Bjørn Mork +Link: https://lore.kernel.org/r/20230608030141.3546-1-wes.huang@moxa.com +Signed-off-by: Jakub Kicinski +Acked-by: Takashi Iwai + +--- + drivers/net/usb/qmi_wwan.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index f1865d047971..2e7c7b0cdc54 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1220,7 +1220,9 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x05c6, 0x9080, 8)}, + {QMI_FIXED_INTF(0x05c6, 0x9083, 3)}, + {QMI_FIXED_INTF(0x05c6, 0x9084, 4)}, ++ {QMI_QUIRK_SET_DTR(0x05c6, 0x9091, 2)}, /* Compal RXM-G1 */ + {QMI_FIXED_INTF(0x05c6, 0x90b2, 3)}, /* ublox R410M */ ++ {QMI_QUIRK_SET_DTR(0x05c6, 0x90db, 2)}, /* Compal RXM-G1 */ + {QMI_FIXED_INTF(0x05c6, 0x920d, 0)}, + {QMI_FIXED_INTF(0x05c6, 0x920d, 5)}, + {QMI_QUIRK_SET_DTR(0x05c6, 0x9625, 4)}, /* YUGA CLM920-NC5 */ +-- +2.35.3 + diff --git a/patches.suse/nilfs2-fix-incomplete-buffer-cleanup-in-nilfs_btnode.patch b/patches.suse/nilfs2-fix-incomplete-buffer-cleanup-in-nilfs_btnode.patch new file mode 100644 index 0000000..fa12b0e --- /dev/null +++ b/patches.suse/nilfs2-fix-incomplete-buffer-cleanup-in-nilfs_btnode.patch @@ -0,0 +1,58 @@ +From 2f012f2baca140c488e43d27a374029c1e59098d Mon Sep 17 00:00:00 2001 +From: Ryusuke Konishi +Date: Sat, 13 May 2023 19:24:28 +0900 +Subject: [PATCH] nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key() +Git-commit: 2f012f2baca140c488e43d27a374029c1e59098d +Patch-mainline: v6.4-rc7 +References: git-fixes + +A syzbot fault injection test reported that nilfs_btnode_create_block, a +helper function that allocates a new node block for b-trees, causes a +kernel BUG for disk images where the file system block size is smaller +than the page size. + +This was due to unexpected flags on the newly allocated buffer head, and +it turned out to be because the buffer flags were not cleared by +nilfs_btnode_abort_change_key() after an error occurred during a b-tree +update operation and the buffer was later reused in that state. + +Fix this issue by using nilfs_btnode_delete() to abandon the unused +preallocated buffer in nilfs_btnode_abort_change_key(). + +Link: https://lkml.kernel.org/r/20230513102428.10223-1-konishi.ryusuke@gmail.com +Signed-off-by: Ryusuke Konishi +Reported-by: syzbot+b0a35a5c1f7e846d3b09@syzkaller.appspotmail.com +Closes: https://lkml.kernel.org/r/000000000000d1d6c205ebc4d512@google.com +Tested-by: Ryusuke Konishi +Cc: +Signed-off-by: Andrew Morton +Acked-by: Takashi Iwai + +--- + fs/nilfs2/btnode.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/fs/nilfs2/btnode.c b/fs/nilfs2/btnode.c +index e956f886a1a1..5710833ac1cc 100644 +--- a/fs/nilfs2/btnode.c ++++ b/fs/nilfs2/btnode.c +@@ -285,6 +285,14 @@ void nilfs_btnode_abort_change_key(struct address_space *btnc, + if (nbh == NULL) { /* blocksize == pagesize */ + xa_erase_irq(&btnc->i_pages, newkey); + unlock_page(ctxt->bh->b_page); +- } else +- brelse(nbh); ++ } else { ++ /* ++ * When canceling a buffer that a prepare operation has ++ * allocated to copy a node block to another location, use ++ * nilfs_btnode_delete() to initialize and release the buffer ++ * so that the buffer flags will not be in an inconsistent ++ * state when it is reallocated. ++ */ ++ nilfs_btnode_delete(nbh); ++ } + } +-- +2.35.3 + diff --git a/patches.suse/platform-x86-asus-wmi-Ignore-WMI-events-with-codes-0.patch b/patches.suse/platform-x86-asus-wmi-Ignore-WMI-events-with-codes-0.patch new file mode 100644 index 0000000..de7123e --- /dev/null +++ b/patches.suse/platform-x86-asus-wmi-Ignore-WMI-events-with-codes-0.patch @@ -0,0 +1,45 @@ +From 362c1f2ec82cb65940e1c73e15a395a7a891fc6f Mon Sep 17 00:00:00 2001 +From: Alexandru Sorodoc +Date: Fri, 12 May 2023 13:15:17 +0300 +Subject: [PATCH] platform/x86: asus-wmi: Ignore WMI events with codes 0x7B, 0xC0 +Git-commit: 362c1f2ec82cb65940e1c73e15a395a7a891fc6f +Patch-mainline: v6.4-rc4 +References: git-fixes + +On ASUS GU604V the key 0x7B is issued when the charger is connected or +disconnected, and key 0xC0 is issued when an external display is +connected or disconnected. + +This commit maps them to KE_IGNORE to slience kernel messages about +unknown keys, such as: + + kernel: asus_wmi: Unknown key code 0x7b + +Signed-off-by: Alexandru Sorodoc +Link: https://lore.kernel.org/r/20230512101517.47416-1-ealex95@gmail.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Acked-by: Takashi Iwai + +--- + drivers/platform/x86/asus-nb-wmi.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -550,6 +550,7 @@ static const struct key_entry asus_nb_wm + { KE_KEY, 0x71, { KEY_F13 } }, /* General-purpose button */ + { KE_IGNORE, 0x79, }, /* Charger type dectection notification */ + { KE_KEY, 0x7a, { KEY_ALS_TOGGLE } }, /* Ambient Light Sensor Toggle */ ++ { KE_IGNORE, 0x7B, }, /* Charger connect/disconnect notification */ + { KE_KEY, 0x7c, { KEY_MICMUTE } }, + { KE_KEY, 0x7D, { KEY_BLUETOOTH } }, /* Bluetooth Enable */ + { KE_KEY, 0x7E, { KEY_BLUETOOTH } }, /* Bluetooth Disable */ +@@ -575,6 +576,7 @@ static const struct key_entry asus_nb_wm + { KE_KEY, 0xA6, { KEY_SWITCHVIDEOMODE } }, /* SDSP CRT + TV + HDMI */ + { KE_KEY, 0xA7, { KEY_SWITCHVIDEOMODE } }, /* SDSP LCD + CRT + TV + HDMI */ + { KE_KEY, 0xB5, { KEY_CALC } }, ++ { KE_IGNORE, 0xC0, }, /* External display connect/disconnect notification */ + { KE_KEY, 0xC4, { KEY_KBDILLUMUP } }, + { KE_KEY, 0xC5, { KEY_KBDILLUMDOWN } }, + { KE_IGNORE, 0xC6, }, /* Ambient Light Sensor notification */ diff --git a/patches.suse/power-supply-Fix-logic-checking-if-system-is-running.patch b/patches.suse/power-supply-Fix-logic-checking-if-system-is-running.patch new file mode 100644 index 0000000..a633f6c --- /dev/null +++ b/patches.suse/power-supply-Fix-logic-checking-if-system-is-running.patch @@ -0,0 +1,66 @@ +From 95339f40a8b652b5b1773def31e63fc53c26378a Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Tue, 16 May 2023 13:25:40 -0500 +Subject: [PATCH] power: supply: Fix logic checking if system is running from battery +Git-commit: 95339f40a8b652b5b1773def31e63fc53c26378a +Patch-mainline: v6.4-rc4 +References: git-fixes + +The logic used for power_supply_is_system_supplied() counts all power +supplies and assumes that the system is running from AC if there is +either a non-battery power-supply reporting to be online or if no +power-supplies exist at all. + +The second rule is for desktop systems, that don't have any +battery/charger devices. These systems will incorrectly report to be +powered from battery once a device scope power-supply is registered +(e.g. a HID device), since these power-supplies increase the counter. + +Apart from HID devices, recent dGPUs provide UCSI power supplies on a +desktop systems. The dGPU by default doesn't have anything plugged in so +it's 'offline'. This makes power_supply_is_system_supplied() return 0 +with a count of 1 meaning all drivers that use this get a wrong judgement. + +To fix this case adjust the logic to also examine the scope of the power +supply. If the power supply is deemed a device power supply, then don't +count it. + +Cc: Evan Quan +Suggested-by: Lijo Lazar +Signed-off-by: Mario Limonciello +Signed-off-by: Sebastian Reichel +Acked-by: Takashi Iwai + +--- + drivers/power/supply/power_supply_core.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c +index d1b19027f53b..3791aec69ddc 100644 +--- a/drivers/power/supply/power_supply_core.c ++++ b/drivers/power/supply/power_supply_core.c +@@ -348,6 +348,10 @@ static int __power_supply_is_system_supplied(struct device *dev, void *data) + struct power_supply *psy = dev_get_drvdata(dev); + unsigned int *count = data; + ++ if (!psy->desc->get_property(psy, POWER_SUPPLY_PROP_SCOPE, &ret)) ++ if (ret.intval == POWER_SUPPLY_SCOPE_DEVICE) ++ return 0; ++ + (*count)++; + if (psy->desc->type != POWER_SUPPLY_TYPE_BATTERY) + if (!psy->desc->get_property(psy, POWER_SUPPLY_PROP_ONLINE, +@@ -366,8 +370,8 @@ int power_supply_is_system_supplied(void) + __power_supply_is_system_supplied); + + /* +- * If no power class device was found at all, most probably we are +- * running on a desktop system, so assume we are on mains power. ++ * If no system scope power class device was found at all, most probably we ++ * are running on a desktop system, so assume we are on mains power. + */ + if (count == 0) + return 1; +-- +2.35.3 + diff --git a/patches.suse/power-supply-Ratelimit-no-data-debug-output.patch b/patches.suse/power-supply-Ratelimit-no-data-debug-output.patch new file mode 100644 index 0000000..ecd37cb --- /dev/null +++ b/patches.suse/power-supply-Ratelimit-no-data-debug-output.patch @@ -0,0 +1,43 @@ +From 155c45a25679f571c2ae57d10db843a9dfc63430 Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Sun, 5 Mar 2023 21:52:26 +0100 +Subject: [PATCH] power: supply: Ratelimit no data debug output +Git-commit: 155c45a25679f571c2ae57d10db843a9dfc63430 +Patch-mainline: v6.4-rc4 +References: git-fixes + +Reduce the amount of output this dev_dbg() statement emits into logs, +otherwise if system software polls the sysfs entry for data and keeps +getting -ENODATA, it could end up filling the logs up. + +This does in fact make systemd journald choke, since during boot the +sysfs power supply entries are polled and if journald starts at the +same time, the journal is just being repeatedly filled up, and the +system stops on trying to start journald without booting any further. + +Signed-off-by: Marek Vasut +Reviewed-by: Hans de Goede +Signed-off-by: Sebastian Reichel +Acked-by: Takashi Iwai + +--- + drivers/power/supply/power_supply_sysfs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/power/supply/power_supply_sysfs.c b/drivers/power/supply/power_supply_sysfs.c +index ba3b125cd66e..06e5b6b0e255 100644 +--- a/drivers/power/supply/power_supply_sysfs.c ++++ b/drivers/power/supply/power_supply_sysfs.c +@@ -286,7 +286,8 @@ static ssize_t power_supply_show_property(struct device *dev, + + if (ret < 0) { + if (ret == -ENODATA) +- dev_dbg(dev, "driver has no data for `%s' property\n", ++ dev_dbg_ratelimited(dev, ++ "driver has no data for `%s' property\n", + attr->attr.name); + else if (ret != -ENODEV && ret != -EAGAIN) + dev_err_ratelimited(dev, +-- +2.35.3 + diff --git a/patches.suse/power-supply-ab8500-Fix-external_power_changed-race.patch b/patches.suse/power-supply-ab8500-Fix-external_power_changed-race.patch new file mode 100644 index 0000000..ca2e240 --- /dev/null +++ b/patches.suse/power-supply-ab8500-Fix-external_power_changed-race.patch @@ -0,0 +1,73 @@ +From a5299ce4e96f3e8930e9c051b28d8093ada87b08 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sat, 15 Apr 2023 18:07:29 +0200 +Subject: [PATCH] power: supply: ab8500: Fix external_power_changed race +Git-commit: a5299ce4e96f3e8930e9c051b28d8093ada87b08 +Patch-mainline: v6.4-rc4 +References: git-fixes + +ab8500_btemp_external_power_changed() dereferences di->btemp_psy, +which gets sets in ab8500_btemp_probe() like this: + + di->btemp_psy = devm_power_supply_register(dev, &ab8500_btemp_desc, + &psy_cfg); + +As soon as devm_power_supply_register() has called device_add() +the external_power_changed callback can get called. So there is a window +where ab8500_btemp_external_power_changed() may get called while +di->btemp_psy has not been set yet leading to a NULL pointer dereference. + +Fixing this is easy. The external_power_changed callback gets passed +the power_supply which will eventually get stored in di->btemp_psy, +so ab8500_btemp_external_power_changed() can simply directly use +the passed in psy argument which is always valid. + +And the same applies to ab8500_fg_external_power_changed(). + +Signed-off-by: Hans de Goede +Reviewed-by: Linus Walleij +Signed-off-by: Sebastian Reichel +Acked-by: Takashi Iwai + +--- + drivers/power/supply/ab8500_btemp.c | 6 ++---- + drivers/power/supply/ab8500_fg.c | 6 ++---- + 2 files changed, 4 insertions(+), 8 deletions(-) + +diff --git a/drivers/power/supply/ab8500_btemp.c b/drivers/power/supply/ab8500_btemp.c +index 307ee6f71042..6f83e99d2eb7 100644 +--- a/drivers/power/supply/ab8500_btemp.c ++++ b/drivers/power/supply/ab8500_btemp.c +@@ -624,10 +624,8 @@ static int ab8500_btemp_get_ext_psy_data(struct device *dev, void *data) + */ + static void ab8500_btemp_external_power_changed(struct power_supply *psy) + { +- struct ab8500_btemp *di = power_supply_get_drvdata(psy); +- +- class_for_each_device(power_supply_class, NULL, +- di->btemp_psy, ab8500_btemp_get_ext_psy_data); ++ class_for_each_device(power_supply_class, NULL, psy, ++ ab8500_btemp_get_ext_psy_data); + } + + /* ab8500 btemp driver interrupts and their respective isr */ +diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c +index 41a7bff9ac37..53560fbb6dcd 100644 +--- a/drivers/power/supply/ab8500_fg.c ++++ b/drivers/power/supply/ab8500_fg.c +@@ -2407,10 +2407,8 @@ static int ab8500_fg_init_hw_registers(struct ab8500_fg *di) + */ + static void ab8500_fg_external_power_changed(struct power_supply *psy) + { +- struct ab8500_fg *di = power_supply_get_drvdata(psy); +- +- class_for_each_device(power_supply_class, NULL, +- di->fg_psy, ab8500_fg_get_ext_psy_data); ++ class_for_each_device(power_supply_class, NULL, psy, ++ ab8500_fg_get_ext_psy_data); + } + + /** +-- +2.35.3 + diff --git a/patches.suse/power-supply-bq27xxx-Use-mod_delayed_work-instead-of.patch b/patches.suse/power-supply-bq27xxx-Use-mod_delayed_work-instead-of.patch new file mode 100644 index 0000000..acb820f --- /dev/null +++ b/patches.suse/power-supply-bq27xxx-Use-mod_delayed_work-instead-of.patch @@ -0,0 +1,39 @@ +From 59dddea9879713423c7b2ade43c423bb71e0d216 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sat, 15 Apr 2023 20:23:39 +0200 +Subject: [PATCH] power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() + schedule() +Git-commit: 59dddea9879713423c7b2ade43c423bb71e0d216 +Patch-mainline: v6.4-rc4 +References: git-fixes + +Use mod_delayed_work() instead of separate cancel_delayed_work_sync() + +schedule_delayed_work() calls. + +Signed-off-by: Hans de Goede +Signed-off-by: Sebastian Reichel +Acked-by: Takashi Iwai + +--- + drivers/power/supply/bq27xxx_battery.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c +index 929e813b9c44..4296600e8912 100644 +--- a/drivers/power/supply/bq27xxx_battery.c ++++ b/drivers/power/supply/bq27xxx_battery.c +@@ -1083,10 +1083,8 @@ static int poll_interval_param_set(const char *val, const struct kernel_param *k + return ret; + + mutex_lock(&bq27xxx_list_lock); +- list_for_each_entry(di, &bq27xxx_battery_devices, list) { +- cancel_delayed_work_sync(&di->work); +- schedule_delayed_work(&di->work, 0); +- } ++ list_for_each_entry(di, &bq27xxx_battery_devices, list) ++ mod_delayed_work(system_wq, &di->work, 0); + mutex_unlock(&bq27xxx_list_lock); + + return ret; +-- +2.35.3 + diff --git a/patches.suse/power-supply-sc27xx-Fix-external_power_changed-race.patch b/patches.suse/power-supply-sc27xx-Fix-external_power_changed-race.patch new file mode 100644 index 0000000..90300de --- /dev/null +++ b/patches.suse/power-supply-sc27xx-Fix-external_power_changed-race.patch @@ -0,0 +1,70 @@ +From 4d5c129d6c8993fe96e9ae712141eedcb9ca68c2 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sat, 15 Apr 2023 18:07:32 +0200 +Subject: [PATCH] power: supply: sc27xx: Fix external_power_changed race +Git-commit: 4d5c129d6c8993fe96e9ae712141eedcb9ca68c2 +Patch-mainline: v6.4-rc4 +References: git-fixes + +sc27xx_fgu_external_power_changed() dereferences data->battery, +which gets sets in ab8500_btemp_probe() like this: + + data->battery = devm_power_supply_register(dev, &sc27xx_fgu_desc, + &fgu_cfg); + +As soon as devm_power_supply_register() has called device_add() +the external_power_changed callback can get called. So there is a window +where sc27xx_fgu_external_power_changed() may get called while +data->battery has not been set yet leading to a NULL pointer dereference. + +Fixing this is easy. The external_power_changed callback gets passed +the power_supply which will eventually get stored in data->battery, +so sc27xx_fgu_external_power_changed() can simply directly use +the passed in psy argument which is always valid. + +After this change sc27xx_fgu_external_power_changed() is reduced to just +"power_supply_changed(psy);" and it has the same prototype. While at it +simply replace it with making the external_power_changed callback +directly point to power_supply_changed. + +Cc: Orson Zhai +Cc: Chunyan Zhang +Signed-off-by: Hans de Goede +Reviewed-by: Baolin Wang +Signed-off-by: Sebastian Reichel +Acked-by: Takashi Iwai + +--- + drivers/power/supply/sc27xx_fuel_gauge.c | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +diff --git a/drivers/power/supply/sc27xx_fuel_gauge.c b/drivers/power/supply/sc27xx_fuel_gauge.c +index 632977f84b95..bd23c4d9fed4 100644 +--- a/drivers/power/supply/sc27xx_fuel_gauge.c ++++ b/drivers/power/supply/sc27xx_fuel_gauge.c +@@ -733,13 +733,6 @@ static int sc27xx_fgu_set_property(struct power_supply *psy, + return ret; + } + +-static void sc27xx_fgu_external_power_changed(struct power_supply *psy) +-{ +- struct sc27xx_fgu_data *data = power_supply_get_drvdata(psy); +- +- power_supply_changed(data->battery); +-} +- + static int sc27xx_fgu_property_is_writeable(struct power_supply *psy, + enum power_supply_property psp) + { +@@ -774,7 +767,7 @@ static const struct power_supply_desc sc27xx_fgu_desc = { + .num_properties = ARRAY_SIZE(sc27xx_fgu_props), + .get_property = sc27xx_fgu_get_property, + .set_property = sc27xx_fgu_set_property, +- .external_power_changed = sc27xx_fgu_external_power_changed, ++ .external_power_changed = power_supply_changed, + .property_is_writeable = sc27xx_fgu_property_is_writeable, + .no_thermal = true, + }; +-- +2.35.3 + diff --git a/patches.suse/regmap-spi-avmm-Fix-regmap_bus-max_raw_write.patch b/patches.suse/regmap-spi-avmm-Fix-regmap_bus-max_raw_write.patch new file mode 100644 index 0000000..b5d930b --- /dev/null +++ b/patches.suse/regmap-spi-avmm-Fix-regmap_bus-max_raw_write.patch @@ -0,0 +1,51 @@ +From c8e796895e2310b6130e7577248da1d771431a77 Mon Sep 17 00:00:00 2001 +From: Russ Weight +Date: Tue, 20 Jun 2023 13:28:24 -0700 +Subject: [PATCH] regmap: spi-avmm: Fix regmap_bus max_raw_write +Git-commit: c8e796895e2310b6130e7577248da1d771431a77 +Patch-mainline: v6.4 +References: git-fixes + +The max_raw_write member of the regmap_spi_avmm_bus structure is defined +As: .max_raw_write = SPI_AVMM_VAL_SIZE * MAX_WRITE_CNT + +SPI_AVMM_VAL_SIZE == 4 and MAX_WRITE_CNT == 1 so this results in a +maximum write transfer size of 4 bytes which provides only enough space to +transfer the address of the target register. It provides no space for the +value to be transferred. This bug became an issue (divide-by-zero in +_regmap_raw_write()) after the following was accepted into mainline: + +commit 3981514180c9 ("regmap: Account for register length when chunking") + +Change max_raw_write to include space (4 additional bytes) for both the +register address and value: + + .max_raw_write = SPI_AVMM_REG_SIZE + SPI_AVMM_VAL_SIZE * MAX_WRITE_CNT + +Fixes: 7f9fb67358a2 ("regmap: add Intel SPI Slave to AVMM Bus Bridge support") +Reviewed-by: Matthew Gerlach +Signed-off-by: Russ Weight +Link: https://lore.kernel.org/r/20230620202824.380313-1-russell.h.weight@intel.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + drivers/base/regmap/regmap-spi-avmm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/regmap/regmap-spi-avmm.c b/drivers/base/regmap/regmap-spi-avmm.c +index 4c2b94b3e30b..6af692844c19 100644 +--- a/drivers/base/regmap/regmap-spi-avmm.c ++++ b/drivers/base/regmap/regmap-spi-avmm.c +@@ -660,7 +660,7 @@ static const struct regmap_bus regmap_spi_avmm_bus = { + .reg_format_endian_default = REGMAP_ENDIAN_NATIVE, + .val_format_endian_default = REGMAP_ENDIAN_NATIVE, + .max_raw_read = SPI_AVMM_VAL_SIZE * MAX_READ_CNT, +- .max_raw_write = SPI_AVMM_VAL_SIZE * MAX_WRITE_CNT, ++ .max_raw_write = SPI_AVMM_REG_SIZE + SPI_AVMM_VAL_SIZE * MAX_WRITE_CNT, + .free_context = spi_avmm_bridge_ctx_free, + }; + +-- +2.35.3 + diff --git a/patches.suse/regulator-Fix-error-checking-for-debugfs_create_dir.patch b/patches.suse/regulator-Fix-error-checking-for-debugfs_create_dir.patch new file mode 100644 index 0000000..8bff9d7 --- /dev/null +++ b/patches.suse/regulator-Fix-error-checking-for-debugfs_create_dir.patch @@ -0,0 +1,46 @@ +From 2bf1c45be3b8f3a3f898d0756c1282f09719debd Mon Sep 17 00:00:00 2001 +From: Osama Muhammad +Date: Mon, 15 May 2023 22:29:38 +0500 +Subject: [PATCH] regulator: Fix error checking for debugfs_create_dir +Git-commit: 2bf1c45be3b8f3a3f898d0756c1282f09719debd +Patch-mainline: v6.4-rc4 +References: git-fixes + +This patch fixes the error checking in core.c in debugfs_create_dir. +The correct way to check if an error occurred is 'IS_ERR' inline function. + +Signed-off-by: Osama Muhammad + +--- + drivers/regulator/core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index dc741ac156c3..698ab7f5004b 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -5256,7 +5256,7 @@ static void rdev_init_debugfs(struct regulator_dev *rdev) + } + + rdev->debugfs = debugfs_create_dir(rname, debugfs_root); +- if (!rdev->debugfs) { ++ if (IS_ERR(rdev->debugfs)) { + rdev_warn(rdev, "Failed to create debugfs directory\n"); + return; + } +@@ -6178,7 +6178,7 @@ static int __init regulator_init(void) + ret = class_register(®ulator_class); + + debugfs_root = debugfs_create_dir("regulator", NULL); +- if (!debugfs_root) ++ if (IS_ERR(debugfs_root)) + pr_warn("regulator: Failed to create debugfs directory\n"); + + #ifdef CONFIG_DEBUG_FS +-- +2.35.3 + diff --git a/patches.suse/regulator-pca9450-Fix-LDO3OUT-and-LDO4OUT-MASK.patch b/patches.suse/regulator-pca9450-Fix-LDO3OUT-and-LDO4OUT-MASK.patch new file mode 100644 index 0000000..fbafc0c --- /dev/null +++ b/patches.suse/regulator-pca9450-Fix-LDO3OUT-and-LDO4OUT-MASK.patch @@ -0,0 +1,43 @@ +From 7257d930aadcd62d1c7971ab14f3b1126356abdc Mon Sep 17 00:00:00 2001 +From: Teresa Remmet +Date: Wed, 14 Jun 2023 14:52:40 +0200 +Subject: [PATCH] regulator: pca9450: Fix LDO3OUT and LDO4OUT MASK +Git-commit: 7257d930aadcd62d1c7971ab14f3b1126356abdc +Patch-mainline: v6.4 +References: git-fixes + +L3_OUT and L4_OUT Bit fields range from Bit 0:4 and thus the +mask should be 0x1F instead of 0x0F. + +Fixes: 0935ff5f1f0a ("regulator: pca9450: add pca9450 pmic driver") +Signed-off-by: Teresa Remmet +Reviewed-by: Frieder Schrempf +Link: https://lore.kernel.org/r/20230614125240.3946519-1-t.remmet@phytec.de +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + include/linux/regulator/pca9450.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/linux/regulator/pca9450.h b/include/linux/regulator/pca9450.h +index 3c01c2bf84f5..505c908dbb81 100644 +--- a/include/linux/regulator/pca9450.h ++++ b/include/linux/regulator/pca9450.h +@@ -196,11 +196,11 @@ enum { + + /* PCA9450_REG_LDO3_VOLT bits */ + #define LDO3_EN_MASK 0xC0 +-#define LDO3OUT_MASK 0x0F ++#define LDO3OUT_MASK 0x1F + + /* PCA9450_REG_LDO4_VOLT bits */ + #define LDO4_EN_MASK 0xC0 +-#define LDO4OUT_MASK 0x0F ++#define LDO4OUT_MASK 0x1F + + /* PCA9450_REG_LDO5_VOLT bits */ + #define LDO5L_EN_MASK 0xC0 +-- +2.35.3 + diff --git a/patches.suse/s390-dasd-Use-correct-lock-while-counting-channel-queue-length.patch b/patches.suse/s390-dasd-Use-correct-lock-while-counting-channel-queue-length.patch new file mode 100644 index 0000000..700fd09 --- /dev/null +++ b/patches.suse/s390-dasd-Use-correct-lock-while-counting-channel-queue-length.patch @@ -0,0 +1,52 @@ +From: =?utf-8?q?Jan_H=C3=B6ppner_=3Choeppner=40linux=2Eibm=2Ecom=3E?= +Date: Fri, 9 Jun 2023 17:37:50 +0200 +Subject: s390/dasd: Use correct lock while counting channel queue length +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Git-commit: ccc45cb4e7271c74dbb27776ae8f73d84557f5c6 +Patch-mainline: v6.4-rc6 +References: git-fixes bsc#1212592 + +The lock around counting the channel queue length in the BIODASDINFO +ioctl was incorrectly changed to the dasd_block->queue_lock with commit +583d6535cb9d ("dasd: remove dead code"). This can lead to endless list +iterations and a subsequent crash. + +The queue_lock is supposed to be used only for queue lists belonging to +dasd_block. For dasd_device related queue lists the ccwdev lock must be +used. + +Fix the mentioned issues by correctly using the ccwdev lock instead of +the queue lock. + +Fixes: 583d6535cb9d ("dasd: remove dead code") +Cc: stable@vger.kernel.org # v5.0+ +Signed-off-by: Jan Höppner +Reviewed-by: Stefan Haberland +Signed-off-by: Stefan Haberland +Link: https://lore.kernel.org/r/20230609153750.1258763-2-sth@linux.ibm.com +Signed-off-by: Jens Axboe +Acked-by: Miroslav Franc +--- + drivers/s390/block/dasd_ioctl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c +index 9327dcdd6e5e..8fca725b3dae 100644 +--- a/drivers/s390/block/dasd_ioctl.c ++++ b/drivers/s390/block/dasd_ioctl.c +@@ -552,10 +552,10 @@ static int __dasd_ioctl_information(struct dasd_block *block, + + memcpy(dasd_info->type, base->discipline->name, 4); + +- spin_lock_irqsave(&block->queue_lock, flags); ++ spin_lock_irqsave(get_ccwdev_lock(base->cdev), flags); + list_for_each(l, &base->ccw_queue) + dasd_info->chanq_len++; +- spin_unlock_irqrestore(&block->queue_lock, flags); ++ spin_unlock_irqrestore(get_ccwdev_lock(base->cdev), flags); + return 0; + } + + diff --git a/patches.suse/selftests-ptp-Fix-timestamp-printf-format-for-PTP_SY.patch b/patches.suse/selftests-ptp-Fix-timestamp-printf-format-for-PTP_SY.patch new file mode 100644 index 0000000..1f5c3b6 --- /dev/null +++ b/patches.suse/selftests-ptp-Fix-timestamp-printf-format-for-PTP_SY.patch @@ -0,0 +1,50 @@ +From 76a4c8b82938bc5020b67663db41f451684bf327 Mon Sep 17 00:00:00 2001 +From: Alex Maftei +Date: Thu, 15 Jun 2023 09:34:04 +0100 +Subject: [PATCH] selftests/ptp: Fix timestamp printf format for PTP_SYS_OFFSET +Git-commit: 76a4c8b82938bc5020b67663db41f451684bf327 +Patch-mainline: v6.4-rc7 +References: git-fixes + +Previously, timestamps were printed using "%lld.%u" which is incorrect +for nanosecond values lower than 100,000,000 as they're fractional +digits, therefore leading zeros are meaningful. + +This patch changes the format strings to "%lld.%09u" in order to add +leading zeros to the nanosecond value. + +Fixes: 568ebc5985f5 ("ptp: add the PTP_SYS_OFFSET ioctl to the testptp program") +Fixes: 4ec54f95736f ("ptp: Fix compiler warnings in the testptp utility") +Fixes: 6ab0e475f1f3 ("Documentation: fix misc. warnings") +Signed-off-by: Alex Maftei +Acked-by: Richard Cochran +Link: https://lore.kernel.org/r/20230615083404.57112-1-alex.maftei@amd.com +Signed-off-by: Jakub Kicinski +Acked-by: Takashi Iwai + +--- + tools/testing/selftests/ptp/testptp.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/ptp/testptp.c b/tools/testing/selftests/ptp/testptp.c +index 198ad5f32187..cfa9562f3cd8 100644 +--- a/tools/testing/selftests/ptp/testptp.c ++++ b/tools/testing/selftests/ptp/testptp.c +@@ -502,11 +502,11 @@ int main(int argc, char *argv[]) + interval = t2 - t1; + offset = (t2 + t1) / 2 - tp; + +- printf("system time: %lld.%u\n", ++ printf("system time: %lld.%09u\n", + (pct+2*i)->sec, (pct+2*i)->nsec); +- printf("phc time: %lld.%u\n", ++ printf("phc time: %lld.%09u\n", + (pct+2*i+1)->sec, (pct+2*i+1)->nsec); +- printf("system time: %lld.%u\n", ++ printf("system time: %lld.%09u\n", + (pct+2*i+2)->sec, (pct+2*i+2)->nsec); + printf("system/phc clock time offset is %" PRId64 " ns\n" + "system clock time delay is %" PRId64 " ns\n", +-- +2.35.3 + diff --git a/patches.suse/spi-fsl-dspi-avoid-SCK-glitches-with-continuous-tran.patch b/patches.suse/spi-fsl-dspi-avoid-SCK-glitches-with-continuous-tran.patch new file mode 100644 index 0000000..624f4cb --- /dev/null +++ b/patches.suse/spi-fsl-dspi-avoid-SCK-glitches-with-continuous-tran.patch @@ -0,0 +1,95 @@ +From c5c31fb71f16ba75bad4ade208abbae225305b65 Mon Sep 17 00:00:00 2001 +From: Vladimir Oltean +Date: Tue, 30 May 2023 01:34:02 +0300 +Subject: [PATCH] spi: fsl-dspi: avoid SCK glitches with continuous transfers +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: c5c31fb71f16ba75bad4ade208abbae225305b65 +Patch-mainline: v6.4-rc7 +References: git-fixes + +The DSPI controller has configurable timing for + +(a) tCSC: the interval between the assertion of the chip select and the + first clock edge + +(b) tASC: the interval between the last clock edge and the deassertion + of the chip select + +What is a bit surprising, but is documented in the figure "Example of +continuous transfer (CPHA=1, CONT=1)" in the datasheet, is that when the +chip select stays asserted between multiple TX FIFO writes, the tCSC and +tASC times still apply. With CONT=1, chip select remains asserted, but +SCK takes a break and goes to the idle state for tASC + tCSC ns. + +In other words, the default values (of 0 and 0 ns) result in SCK +glitches where the SCK transition to the idle state, as well as the SCK +transition from the idle state, will have no delay in between, and it +may appear that a SCK cycle has simply gone missing. The resulting +timing violation might cause data corruption in many peripherals, as +their chip select is asserted. + +The driver has device tree bindings for tCSC ("fsl,spi-cs-sck-delay") +and tASC ("fsl,spi-sck-cs-delay"), but these are only specified to apply +when the chip select toggles in the first place, and this timing +characteristic depends on each peripheral. Many peripherals do not have +explicit timing requirements, so many device trees do not have these +properties present at all. + +Nonetheless, the lack of SCK glitches is a common sense requirement, and +since the SCK stays in the idle state during transfers for tCSC+tASC ns, +and that in itself should look like half a cycle, then let's ensure that +tCSC and tASC are at least a quarter of a SCK period, such that their +sum is at least half of one. + +Fixes: 95bf15f38641 ("spi: fsl-dspi: Add ~50ns delay between cs and sck") +Reported-by: Lisa Chen (陈敏捷) +Debugged-by: Lisa Chen (陈敏捷) +Tested-by: Lisa Chen (陈敏捷) +Signed-off-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20230529223402.1199503-1-vladimir.oltean@nxp.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + drivers/spi/spi-fsl-dspi.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c +index 4339485d202c..674cfe05f411 100644 +--- a/drivers/spi/spi-fsl-dspi.c ++++ b/drivers/spi/spi-fsl-dspi.c +@@ -1002,7 +1002,9 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr, + static int dspi_setup(struct spi_device *spi) + { + struct fsl_dspi *dspi = spi_controller_get_devdata(spi->controller); ++ u32 period_ns = DIV_ROUND_UP(NSEC_PER_SEC, spi->max_speed_hz); + unsigned char br = 0, pbr = 0, pcssck = 0, cssck = 0; ++ u32 quarter_period_ns = DIV_ROUND_UP(period_ns, 4); + u32 cs_sck_delay = 0, sck_cs_delay = 0; + struct fsl_dspi_platform_data *pdata; + unsigned char pasc = 0, asc = 0; +@@ -1031,6 +1033,19 @@ static int dspi_setup(struct spi_device *spi) + sck_cs_delay = pdata->sck_cs_delay; + } + ++ /* Since tCSC and tASC apply to continuous transfers too, avoid SCK ++ * glitches of half a cycle by never allowing tCSC + tASC to go below ++ * half a SCK period. ++ */ ++ if (cs_sck_delay < quarter_period_ns) ++ cs_sck_delay = quarter_period_ns; ++ if (sck_cs_delay < quarter_period_ns) ++ sck_cs_delay = quarter_period_ns; ++ ++ dev_dbg(&spi->dev, ++ "DSPI controller timing params: CS-to-SCK delay %u ns, SCK-to-CS delay %u ns\n", ++ cs_sck_delay, sck_cs_delay); ++ + clkrate = clk_get_rate(dspi->clk); + hz_to_spi_baud(&pbr, &br, spi->max_speed_hz, clkrate); + +-- +2.35.3 + diff --git a/patches.suse/spi-tegra210-quad-Fix-combined-sequence.patch b/patches.suse/spi-tegra210-quad-Fix-combined-sequence.patch new file mode 100644 index 0000000..ad920fe --- /dev/null +++ b/patches.suse/spi-tegra210-quad-Fix-combined-sequence.patch @@ -0,0 +1,33 @@ +From: Krishna Yarlagadda +Date: Sat, 1 Oct 2022 17:51:44 +0530 +Subject: spi: tegra210-quad: Fix combined sequence +Git-commit: 8777dd9dff4020bba66654ec92e4b0ab6367ad30 +Patch-mainline: v6.1-rc3 +References: bsc#1212584 + +Return value should be updated to zero in combined sequence routine +if transfer is completed successfully. Currently it holds timeout value +resulting in errors. + +Signed-off-by: Krishna Yarlagadda +Link: https://lore.kernel.org/r/20221001122148.9158-1-kyarlagadda@nvidia.com +Signed-off-by: Mark Brown +Acked-by: Ivan T. Ivanov +--- + drivers/spi/spi-tegra210-quad.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/spi/spi-tegra210-quad.c ++++ b/drivers/spi/spi-tegra210-quad.c +@@ -1157,6 +1157,11 @@ static int tegra_qspi_combined_seq_xfer( + msg->actual_length += xfer->len; + transfer_phase++; + } ++ if (!xfer->cs_change) { ++ tegra_qspi_transfer_end(spi); ++ spi_transfer_delay_exec(xfer); ++ } ++ ret = 0; + + exit: + msg->status = ret; diff --git a/patches.suse/spi-tegra210-quad-Fix-iterator-outside-loop.patch b/patches.suse/spi-tegra210-quad-Fix-iterator-outside-loop.patch new file mode 100644 index 0000000..d55e250 --- /dev/null +++ b/patches.suse/spi-tegra210-quad-Fix-iterator-outside-loop.patch @@ -0,0 +1,62 @@ +From 2449d436681d40bc63ec2c766fd51b632270d8a7 Mon Sep 17 00:00:00 2001 +From: Krishna Yarlagadda +Date: Tue, 28 Feb 2023 01:34:28 +0530 +Subject: [PATCH] spi: tegra210-quad: Fix iterator outside loop +Git-commit: 2449d436681d40bc63ec2c766fd51b632270d8a7 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Fix warn: iterator used outside loop: 'xfer'. 'xfer' variable contain +invalid value in few conditions. Complete transfer within DATA phase +in successful case and at the end for failed transfer. + +Reported-by: Dan Carpenter +Link:https://lore.kernel.org/all/202210191211.46FkzKmv-lkp@intel.com/ +Fixes: 8777dd9dff40 ("spi: tegra210-quad: Fix combined sequence") + +Signed-off-by: Krishna Yarlagadda +Link: https://lore.kernel.org/r/20230227200428.45832-1-kyarlagadda@nvidia.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + drivers/spi/spi-tegra210-quad.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-tegra210-quad.c b/drivers/spi/spi-tegra210-quad.c +index 9aaca2289c59..0b9bc3b7f53a 100644 +--- a/drivers/spi/spi-tegra210-quad.c ++++ b/drivers/spi/spi-tegra210-quad.c +@@ -1156,6 +1156,10 @@ static int tegra_qspi_combined_seq_xfer(struct tegra_qspi *tqspi, + ret = -EIO; + goto exit; + } ++ if (!xfer->cs_change) { ++ tegra_qspi_transfer_end(spi); ++ spi_transfer_delay_exec(xfer); ++ } + break; + default: + ret = -EINVAL; +@@ -1164,14 +1168,14 @@ static int tegra_qspi_combined_seq_xfer(struct tegra_qspi *tqspi, + msg->actual_length += xfer->len; + transfer_phase++; + } +- if (!xfer->cs_change) { +- tegra_qspi_transfer_end(spi); +- spi_transfer_delay_exec(xfer); +- } + ret = 0; + + exit: + msg->status = ret; ++ if (ret < 0) { ++ tegra_qspi_transfer_end(spi); ++ spi_transfer_delay_exec(xfer); ++ } + + return ret; + } +-- +2.35.3 + diff --git a/patches.suse/spi-tegra210-quad-Multi-cs-support.patch b/patches.suse/spi-tegra210-quad-Multi-cs-support.patch new file mode 100644 index 0000000..cf1558e --- /dev/null +++ b/patches.suse/spi-tegra210-quad-Multi-cs-support.patch @@ -0,0 +1,121 @@ +From: Krishna Yarlagadda +Date: Tue, 7 Jun 2022 17:16:57 +0530 +Subject: spi: tegra210-quad: Multi-cs support +Git-commit: b76134178168b5104851b3c72d9b1092b7414ff9 +Patch-mainline: v6.0-rc1 +References: bsc#1212584 + +Tegra Grace and later chips can support upto 4 chip select lines +for QUAD SPI. Added new compatible for Tegra Grace. + +Signed-off-by: Krishna Yarlagadda +Link: https://lore.kernel.org/r/20220607114659.54314-2-kyarlagadda@nvidia.com +Signed-off-by: Mark Brown +Acked-by: Ivan T. Ivanov +--- + drivers/spi/spi-tegra210-quad.c | 33 +++++++++++++++++++++++++++++++-- + 1 file changed, 31 insertions(+), 2 deletions(-) + +--- a/drivers/spi/spi-tegra210-quad.c ++++ b/drivers/spi/spi-tegra210-quad.c +@@ -37,6 +37,16 @@ + #define QSPI_RX_EN BIT(12) + #define QSPI_CS_SW_VAL BIT(20) + #define QSPI_CS_SW_HW BIT(21) ++ ++#define QSPI_CS_POL_INACTIVE(n) (1 << (22 + (n))) ++#define QSPI_CS_POL_INACTIVE_MASK (0xF << 22) ++#define QSPI_CS_SEL_0 (0 << 26) ++#define QSPI_CS_SEL_1 (1 << 26) ++#define QSPI_CS_SEL_2 (2 << 26) ++#define QSPI_CS_SEL_3 (3 << 26) ++#define QSPI_CS_SEL_MASK (3 << 26) ++#define QSPI_CS_SEL(x) (((x) & 0x3) << 26) ++ + #define QSPI_CONTROL_MODE_0 (0 << 28) + #define QSPI_CONTROL_MODE_3 (3 << 28) + #define QSPI_CONTROL_MODE_MASK (3 << 28) +@@ -154,6 +164,7 @@ + struct tegra_qspi_soc_data { + bool has_dma; + bool cmb_xfer_capable; ++ unsigned int cs_count; + }; + + struct tegra_qspi_client_data { +@@ -812,6 +823,7 @@ static u32 tegra_qspi_setup_transfer_one + tegra_qspi_mask_clear_irq(tqspi); + + command1 = tqspi->def_command1_reg; ++ command1 |= QSPI_CS_SEL(spi->chip_select); + command1 |= QSPI_BIT_LENGTH(bits_per_word - 1); + + command1 &= ~QSPI_CONTROL_MODE_MASK; +@@ -941,10 +953,11 @@ static int tegra_qspi_setup(struct spi_d + + /* keep default cs state to inactive */ + val = tqspi->def_command1_reg; ++ val |= QSPI_CS_SEL(spi->chip_select); + if (spi->mode & SPI_CS_HIGH) +- val &= ~QSPI_CS_SW_VAL; ++ val &= ~QSPI_CS_POL_INACTIVE(spi->chip_select); + else +- val |= QSPI_CS_SW_VAL; ++ val |= QSPI_CS_POL_INACTIVE(spi->chip_select); + + tqspi->def_command1_reg = val; + tegra_qspi_writel(tqspi, tqspi->def_command1_reg, QSPI_COMMAND1); +@@ -1425,16 +1438,25 @@ static irqreturn_t tegra_qspi_isr_thread + static struct tegra_qspi_soc_data tegra210_qspi_soc_data = { + .has_dma = true, + .cmb_xfer_capable = false, ++ .cs_count = 1, + }; + + static struct tegra_qspi_soc_data tegra186_qspi_soc_data = { + .has_dma = true, + .cmb_xfer_capable = true, ++ .cs_count = 1, + }; + + static struct tegra_qspi_soc_data tegra234_qspi_soc_data = { + .has_dma = false, + .cmb_xfer_capable = true, ++ .cs_count = 1, ++}; ++ ++static struct tegra_qspi_soc_data tegra241_qspi_soc_data = { ++ .has_dma = false, ++ .cmb_xfer_capable = true, ++ .cs_count = 4, + }; + + static const struct of_device_id tegra_qspi_of_match[] = { +@@ -1450,6 +1472,9 @@ static const struct of_device_id tegra_q + }, { + .compatible = "nvidia,tegra234-qspi", + .data = &tegra234_qspi_soc_data, ++ }, { ++ .compatible = "nvidia,tegra241-qspi", ++ .data = &tegra241_qspi_soc_data, + }, + {} + }; +@@ -1467,6 +1492,9 @@ static const struct acpi_device_id tegra + }, { + .id = "NVDA1413", + .driver_data = (kernel_ulong_t)&tegra234_qspi_soc_data, ++ }, { ++ .id = "NVDA1513", ++ .driver_data = (kernel_ulong_t)&tegra241_qspi_soc_data, + }, + {} + }; +@@ -1506,6 +1534,7 @@ static int tegra_qspi_probe(struct platf + spin_lock_init(&tqspi->lock); + + tqspi->soc_data = device_get_match_data(&pdev->dev); ++ master->num_chipselect = tqspi->soc_data->cs_count; + r = platform_get_resource(pdev, IORESOURCE_MEM, 0); + tqspi->base = devm_ioremap_resource(&pdev->dev, r); + if (IS_ERR(tqspi->base)) diff --git a/patches.suse/test_firmware-Use-kstrtobool-instead-of-strtobool.patch b/patches.suse/test_firmware-Use-kstrtobool-instead-of-strtobool.patch new file mode 100644 index 0000000..468d42d --- /dev/null +++ b/patches.suse/test_firmware-Use-kstrtobool-instead-of-strtobool.patch @@ -0,0 +1,50 @@ +From f7d85515bd21902b218370a1a6301f76e4e636ff Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sat, 14 Jan 2023 10:22:03 +0100 +Subject: [PATCH] test_firmware: Use kstrtobool() instead of strtobool() +Git-commit: f7d85515bd21902b218370a1a6301f76e4e636ff +Patch-mainline: v6.3-rc1 +References: git-fixes + +strtobool() is the same as kstrtobool(). +However, the latter is more used within the kernel. + +In order to remove strtobool() and slightly simplify kstrtox.h, switch to +the other function name. + +While at it, include the corresponding header file () + +Signed-off-by: Christophe JAILLET +Acked-by: Luis Chamberlain +Link: https://lore.kernel.org/r/34f04735d20e0138695dd4070651bd860a36b81c.1673688120.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + lib/test_firmware.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/lib/test_firmware.c b/lib/test_firmware.c +index 6d7becc7e5d5..05ed84c2fc4c 100644 +--- a/lib/test_firmware.c ++++ b/lib/test_firmware.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -358,7 +359,7 @@ static int test_dev_config_update_bool(const char *buf, size_t size, + int ret; + + mutex_lock(&test_fw_mutex); +- if (strtobool(buf, cfg) < 0) ++ if (kstrtobool(buf, cfg) < 0) + ret = -EINVAL; + else + ret = size; +-- +2.35.3 + diff --git a/patches.suse/test_firmware-prevent-race-conditions-by-a-correct-i.patch b/patches.suse/test_firmware-prevent-race-conditions-by-a-correct-i.patch new file mode 100644 index 0000000..26158da --- /dev/null +++ b/patches.suse/test_firmware-prevent-race-conditions-by-a-correct-i.patch @@ -0,0 +1,259 @@ +From 4acfe3dfde685a5a9eaec5555351918e2d7266a1 Mon Sep 17 00:00:00 2001 +From: Mirsad Goran Todorovac +Date: Tue, 9 May 2023 10:47:45 +0200 +Subject: [PATCH] test_firmware: prevent race conditions by a correct implementation of locking +Git-commit: 4acfe3dfde685a5a9eaec5555351918e2d7266a1 +Patch-mainline: v6.4-rc5 +References: git-fixes + +Dan Carpenter spotted a race condition in a couple of situations like +these in the test_firmware driver: + +static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg) +{ + u8 val; + int ret; + + ret = kstrtou8(buf, 10, &val); + if (ret) + return ret; + + mutex_lock(&test_fw_mutex); + *(u8 *)cfg = val; + mutex_unlock(&test_fw_mutex); + + /* Always return full write size even if we didn't consume all */ + return size; +} + +static ssize_t config_num_requests_store(struct device *dev, + struct device_attribute *attr, + const char *buf, size_t count) +{ + int rc; + + mutex_lock(&test_fw_mutex); + if (test_fw_config->reqs) { + pr_err("Must call release_all_firmware prior to changing config\n"); + rc = -EINVAL; + mutex_unlock(&test_fw_mutex); + goto out; + } + mutex_unlock(&test_fw_mutex); + + rc = test_dev_config_update_u8(buf, count, + &test_fw_config->num_requests); + +Out: return rc; +} + +static ssize_t config_read_fw_idx_store(struct device *dev, + struct device_attribute *attr, + const char *buf, size_t count) +{ + return test_dev_config_update_u8(buf, count, + &test_fw_config->read_fw_idx); +} + +The function test_dev_config_update_u8() is called from both the locked +and the unlocked context, function config_num_requests_store() and +config_read_fw_idx_store() which can both be called asynchronously as +they are driver's methods, while test_dev_config_update_u8() and siblings +change their argument pointed to by u8 *cfg or similar pointer. + +To avoid deadlock on test_fw_mutex, the lock is dropped before calling +test_dev_config_update_u8() and re-acquired within test_dev_config_update_u8() +itself, but alas this creates a race condition. + +Having two locks wouldn't assure a race-proof mutual exclusion. + +This situation is best avoided by the introduction of a new, unlocked +function __test_dev_config_update_u8() which can be called from the locked +context and reducing test_dev_config_update_u8() to: + +static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg) +{ + int ret; + + mutex_lock(&test_fw_mutex); + ret = __test_dev_config_update_u8(buf, size, cfg); + mutex_unlock(&test_fw_mutex); + + return ret; +} + +doing the locking and calling the unlocked primitive, which enables both +locked and unlocked versions without duplication of code. + +The similar approach was applied to all functions called from the locked +and the unlocked context, which safely mitigates both deadlocks and race +conditions in the driver. + +__test_dev_config_update_bool(), __test_dev_config_update_u8() and +__test_dev_config_update_size_t() unlocked versions of the functions +were introduced to be called from the locked contexts as a workaround +without releasing the main driver's lock and thereof causing a race +condition. + +The test_dev_config_update_bool(), test_dev_config_update_u8() and +test_dev_config_update_size_t() locked versions of the functions +are being called from driver methods without the unnecessary multiplying +of the locking and unlocking code for each method, and complicating +the code with saving of the return value across lock. + +Fixes: 7feebfa487b92 ("test_firmware: add support for request_firmware_into_buf") +Cc: Luis Chamberlain +Cc: Greg Kroah-Hartman +Cc: Russ Weight +Cc: Takashi Iwai +Cc: Tianfei Zhang +Cc: Shuah Khan +Cc: Colin Ian King +Cc: Randy Dunlap +Cc: linux-kselftest@vger.kernel.org +Cc: stable@vger.kernel.org # v5.4 +Suggested-by: Dan Carpenter +Signed-off-by: Mirsad Goran Todorovac +Link: https://lore.kernel.org/r/20230509084746.48259-1-mirsad.todorovac@alu.unizg.hr +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + lib/test_firmware.c | 56 ++++++++++++++++++++++++++++++--------------- + 1 file changed, 37 insertions(+), 19 deletions(-) + +diff --git a/lib/test_firmware.c b/lib/test_firmware.c +index 05ed84c2fc4c..35417e0af3f4 100644 +--- a/lib/test_firmware.c ++++ b/lib/test_firmware.c +@@ -353,16 +353,26 @@ static ssize_t config_test_show_str(char *dst, + return len; + } + ++static inline int __test_dev_config_update_bool(const char *buf, size_t size, ++ bool *cfg) ++{ ++ int ret; ++ ++ if (kstrtobool(buf, cfg) < 0) ++ ret = -EINVAL; ++ else ++ ret = size; ++ ++ return ret; ++} ++ + static int test_dev_config_update_bool(const char *buf, size_t size, + bool *cfg) + { + int ret; + + mutex_lock(&test_fw_mutex); +- if (kstrtobool(buf, cfg) < 0) +- ret = -EINVAL; +- else +- ret = size; ++ ret = __test_dev_config_update_bool(buf, size, cfg); + mutex_unlock(&test_fw_mutex); + + return ret; +@@ -373,7 +383,8 @@ static ssize_t test_dev_config_show_bool(char *buf, bool val) + return snprintf(buf, PAGE_SIZE, "%d\n", val); + } + +-static int test_dev_config_update_size_t(const char *buf, ++static int __test_dev_config_update_size_t( ++ const char *buf, + size_t size, + size_t *cfg) + { +@@ -384,9 +395,7 @@ static int test_dev_config_update_size_t(const char *buf, + if (ret) + return ret; + +- mutex_lock(&test_fw_mutex); + *(size_t *)cfg = new; +- mutex_unlock(&test_fw_mutex); + + /* Always return full write size even if we didn't consume all */ + return size; +@@ -402,7 +411,7 @@ static ssize_t test_dev_config_show_int(char *buf, int val) + return snprintf(buf, PAGE_SIZE, "%d\n", val); + } + +-static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg) ++static int __test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg) + { + u8 val; + int ret; +@@ -411,14 +420,23 @@ static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg) + if (ret) + return ret; + +- mutex_lock(&test_fw_mutex); + *(u8 *)cfg = val; +- mutex_unlock(&test_fw_mutex); + + /* Always return full write size even if we didn't consume all */ + return size; + } + ++static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg) ++{ ++ int ret; ++ ++ mutex_lock(&test_fw_mutex); ++ ret = __test_dev_config_update_u8(buf, size, cfg); ++ mutex_unlock(&test_fw_mutex); ++ ++ return ret; ++} ++ + static ssize_t test_dev_config_show_u8(char *buf, u8 val) + { + return snprintf(buf, PAGE_SIZE, "%u\n", val); +@@ -471,10 +489,10 @@ static ssize_t config_num_requests_store(struct device *dev, + mutex_unlock(&test_fw_mutex); + goto out; + } +- mutex_unlock(&test_fw_mutex); + +- rc = test_dev_config_update_u8(buf, count, +- &test_fw_config->num_requests); ++ rc = __test_dev_config_update_u8(buf, count, ++ &test_fw_config->num_requests); ++ mutex_unlock(&test_fw_mutex); + + out: + return rc; +@@ -518,10 +536,10 @@ static ssize_t config_buf_size_store(struct device *dev, + mutex_unlock(&test_fw_mutex); + goto out; + } +- mutex_unlock(&test_fw_mutex); + +- rc = test_dev_config_update_size_t(buf, count, +- &test_fw_config->buf_size); ++ rc = __test_dev_config_update_size_t(buf, count, ++ &test_fw_config->buf_size); ++ mutex_unlock(&test_fw_mutex); + + out: + return rc; +@@ -548,10 +566,10 @@ static ssize_t config_file_offset_store(struct device *dev, + mutex_unlock(&test_fw_mutex); + goto out; + } +- mutex_unlock(&test_fw_mutex); + +- rc = test_dev_config_update_size_t(buf, count, +- &test_fw_config->file_offset); ++ rc = __test_dev_config_update_size_t(buf, count, ++ &test_fw_config->file_offset); ++ mutex_unlock(&test_fw_mutex); + + out: + return rc; +-- +2.35.3 + diff --git a/patches.suse/usb-gadget-udc-renesas_usb3-Fix-use-after-free-bug-i.patch b/patches.suse/usb-gadget-udc-renesas_usb3-Fix-use-after-free-bug-i.patch index db71aef..1517a5a 100644 --- a/patches.suse/usb-gadget-udc-renesas_usb3-Fix-use-after-free-bug-i.patch +++ b/patches.suse/usb-gadget-udc-renesas_usb3-Fix-use-after-free-bug-i.patch @@ -4,7 +4,7 @@ Date: Mon, 20 Mar 2023 14:29:31 +0800 Subject: [PATCH] usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition Git-commit: 2b947f8769be8b8181dc795fd292d3e7120f5204 Patch-mainline: v6.4-rc1 -References: git-fixes +References: git-fixes bsc#1212513 CVE-2023-35828 In renesas_usb3_probe, role_work is bound with renesas_usb3_role_work. renesas_usb3_start will be called to start the work. diff --git a/patches.suse/x86-microcode-Print-previous-version-of-microcode-af.patch b/patches.suse/x86-microcode-Print-previous-version-of-microcode-af.patch new file mode 100644 index 0000000..a029c75 --- /dev/null +++ b/patches.suse/x86-microcode-Print-previous-version-of-microcode-af.patch @@ -0,0 +1,43 @@ +From: Ashok Raj +Date: Mon, 29 Aug 2022 18:10:30 +0000 +Subject: x86/microcode: Print previous version of microcode after reload +Git-commit: 7fce8d6eccbc31a561d07c79f359ad09f0424347 +Patch-mainline: 6.1-rc1 +References: git-fixes + +Print both old and new versions of microcode after a reload is complete +because knowing the previous microcode version is sometimes important +from a debugging perspective. + + [ bp: Massage commit message. ] + +Signed-off-by: Ashok Raj +Signed-off-by: Borislav Petkov +Acked-by: Tony Luck +Link: https://lore.kernel.org/r/20220829181030.722891-1-ashok.raj@intel.com +Signed-off-by: Jiri Slaby +--- + arch/x86/kernel/cpu/microcode/core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/cpu/microcode/core.c ++++ b/arch/x86/kernel/cpu/microcode/core.c +@@ -507,7 +507,7 @@ wait_for_siblings: + */ + static int microcode_reload_late(void) + { +- int ret; ++ int old = boot_cpu_data.microcode, ret; + + atomic_set(&late_cpus_in, 0); + atomic_set(&late_cpus_out, 0); +@@ -516,7 +516,8 @@ static int microcode_reload_late(void) + if (ret == 0) + microcode_check(); + +- pr_info("Reload completed, microcode revision: 0x%x\n", boot_cpu_data.microcode); ++ pr_info("Reload completed, microcode revision: 0x%x -> 0x%x\n", ++ old, boot_cpu_data.microcode); + + return ret; + } diff --git a/patches.suse/x86-microcode-add-a-parameter-to-microcode_check-to-store-cpu-capabilities.patch b/patches.suse/x86-microcode-add-a-parameter-to-microcode_check-to-store-cpu-capabilities.patch index 23ceb11..718d85c 100644 --- a/patches.suse/x86-microcode-add-a-parameter-to-microcode_check-to-store-cpu-capabilities.patch +++ b/patches.suse/x86-microcode-add-a-parameter-to-microcode_check-to-store-cpu-capabilities.patch @@ -3,7 +3,7 @@ Date: Mon, 9 Jan 2023 07:35:50 -0800 Subject: x86/microcode: Add a parameter to microcode_check() to store CPU capabilities Git-commit: ab31c74455c64e69342ddab21fd9426fcbfefde7 -Patch-mainline: v6.3-rc1 +Patch-mainline: 6.3-rc1 References: git-fixes Add a parameter to store CPU capabilities before performing a microcode @@ -14,13 +14,12 @@ update so that CPU capabilities can be compared before and after update. Signed-off-by: Ashok Raj Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20230109153555.4986-2-ashok.raj@intel.com - -Acked-by: Nikolay Borisov +Signed-off-by: Jiri Slaby --- arch/x86/include/asm/processor.h | 2 +- - arch/x86/kernel/cpu/common.c | 19 +++++++++++-------- - arch/x86/kernel/cpu/microcode/core.c | 7 ++++--- - 3 files changed, 16 insertions(+), 12 deletions(-) + arch/x86/kernel/cpu/common.c | 21 +++++++++++++-------- + arch/x86/kernel/cpu/microcode/core.c | 3 ++- + 3 files changed, 16 insertions(+), 10 deletions(-) --- a/arch/x86/include/asm/processor.h +++ b/arch/x86/include/asm/processor.h @@ -35,7 +34,7 @@ Acked-by: Nikolay Borisov L1TF_MITIGATION_OFF, --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c -@@ -2139,30 +2139,33 @@ void cpu_init_secondary(void) +@@ -2156,30 +2156,35 @@ void cpu_init_secondary(void) } #endif @@ -47,6 +46,8 @@ Acked-by: Nikolay Borisov * The microcode loader calls this upon late microcode load to recheck features, * only when microcode has been updated. Caller holds microcode_mutex and CPU * hotplug lock. ++ * ++ * Return: None */ -void microcode_check(void) +void microcode_check(struct cpuinfo_x86 *prev_info) @@ -79,12 +80,10 @@ Acked-by: Nikolay Borisov pr_warn("x86/CPU: CPU features have changed after loading microcode, but might not take effect.\n"); --- a/arch/x86/kernel/cpu/microcode/core.c +++ b/arch/x86/kernel/cpu/microcode/core.c -@@ -599,16 +599,17 @@ wait_for_siblings: - */ +@@ -508,13 +508,14 @@ wait_for_siblings: static int microcode_reload_late(void) { -- int ret; -+ int old = boot_cpu_data.microcode, ret; + int old = boot_cpu_data.microcode, ret; + struct cpuinfo_x86 prev_info; atomic_set(&late_cpus_in, 0); @@ -95,8 +94,5 @@ Acked-by: Nikolay Borisov - microcode_check(); + microcode_check(&prev_info); -- pr_info("Reload completed, microcode revision: 0x%x\n", boot_cpu_data.microcode); -+ pr_info("Reload completed, microcode revision: 0x%x -> 0x%x\n", old, boot_cpu_data.microcode); - - return ret; - } + pr_info("Reload completed, microcode revision: 0x%x -> 0x%x\n", + old, boot_cpu_data.microcode); diff --git a/patches.suse/x86-microcode-adjust-late-loading-result-reporting-message.patch b/patches.suse/x86-microcode-adjust-late-loading-result-reporting-message.patch index 749cf6c..1020025 100644 --- a/patches.suse/x86-microcode-adjust-late-loading-result-reporting-message.patch +++ b/patches.suse/x86-microcode-adjust-late-loading-result-reporting-message.patch @@ -21,12 +21,12 @@ Link: https://lore.kernel.org/lkml/874judpqqd.ffs@tglx/ Acked-by: Nikolay Borisov --- - arch/x86/kernel/cpu/microcode/core.c | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) + arch/x86/kernel/cpu/microcode/core.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) --- a/arch/x86/kernel/cpu/microcode/core.c +++ b/arch/x86/kernel/cpu/microcode/core.c -@@ -612,10 +612,15 @@ static int microcode_reload_late(void) +@@ -520,11 +520,14 @@ static int microcode_reload_late(void) store_cpu_caps(&prev_info); ret = stop_machine_cpuslocked(__reload_late, NULL, cpu_online_mask); @@ -35,12 +35,13 @@ Acked-by: Nikolay Borisov + pr_info("Reload succeeded, microcode revision: 0x%x -> 0x%x\n", + old, boot_cpu_data.microcode); microcode_check(&prev_info); +- +- pr_info("Reload completed, microcode revision: 0x%x -> 0x%x\n", +- old, boot_cpu_data.microcode); + } else { + pr_info("Reload failed, current microcode revision: 0x%x\n", + boot_cpu_data.microcode); + } -- pr_info("Reload completed, microcode revision: 0x%x -> 0x%x\n", old, boot_cpu_data.microcode); - return ret; } diff --git a/patches.suse/x86-microcode-amd-Remove-load_microcode_amd-s-bsp-pa.patch b/patches.suse/x86-microcode-amd-Remove-load_microcode_amd-s-bsp-pa.patch new file mode 100644 index 0000000..31e88f4 --- /dev/null +++ b/patches.suse/x86-microcode-amd-Remove-load_microcode_amd-s-bsp-pa.patch @@ -0,0 +1,83 @@ +From: "Borislav Petkov (AMD)" +Date: Tue, 17 Jan 2023 23:59:24 +0100 +Subject: x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter +Git-commit: 2355370cd941cbb20882cc3f34460f9f2b8f9a18 +Patch-mainline: 6.3-rc1 +References: git-fixes + +It is always the BSP. + +No functional changes. + +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20230130161709.11615-2-bp@alien8.de +Signed-off-by: Jiri Slaby +--- + arch/x86/kernel/cpu/microcode/amd.c | 17 +++++------------ + 1 file changed, 5 insertions(+), 12 deletions(-) + +--- a/arch/x86/kernel/cpu/microcode/amd.c ++++ b/arch/x86/kernel/cpu/microcode/amd.c +@@ -547,8 +547,7 @@ void load_ucode_amd_ap(unsigned int cpui + apply_microcode_early_amd(cpuid_1_eax, cp.data, cp.size, false); + } + +-static enum ucode_state +-load_microcode_amd(bool save, u8 family, const u8 *data, size_t size); ++static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size); + + int __init save_microcode_in_initrd_amd(unsigned int cpuid_1_eax) + { +@@ -566,7 +565,7 @@ int __init save_microcode_in_initrd_amd( + if (!desc.mc) + return -EINVAL; + +- ret = load_microcode_amd(true, x86_family(cpuid_1_eax), desc.data, desc.size); ++ ret = load_microcode_amd(x86_family(cpuid_1_eax), desc.data, desc.size); + if (ret > UCODE_UPDATED) + return -EINVAL; + +@@ -844,8 +843,7 @@ static enum ucode_state __load_microcode + return UCODE_OK; + } + +-static enum ucode_state +-load_microcode_amd(bool save, u8 family, const u8 *data, size_t size) ++static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size) + { + struct ucode_patch *p; + enum ucode_state ret; +@@ -869,10 +867,6 @@ load_microcode_amd(bool save, u8 family, + ret = UCODE_NEW; + } + +- /* save BSP's matching patch for early load */ +- if (!save) +- return ret; +- + memset(amd_ucode_patch, 0, PATCH_MAX_SIZE); + memcpy(amd_ucode_patch, p->data, min_t(u32, p->size, PATCH_MAX_SIZE)); + +@@ -900,12 +894,11 @@ static enum ucode_state request_microcod + { + char fw_name[36] = "amd-ucode/microcode_amd.bin"; + struct cpuinfo_x86 *c = &cpu_data(cpu); +- bool bsp = c->cpu_index == boot_cpu_data.cpu_index; + enum ucode_state ret = UCODE_NFOUND; + const struct firmware *fw; + + /* reload ucode container only on the boot cpu */ +- if (!refresh_fw || !bsp) ++ if (!refresh_fw) + return UCODE_OK; + + if (c->x86 >= 0x15) +@@ -920,7 +913,7 @@ static enum ucode_state request_microcod + if (!verify_container(fw->data, fw->size, false)) + goto fw_release; + +- ret = load_microcode_amd(bsp, c->x86, fw->data, fw->size); ++ ret = load_microcode_amd(c->x86, fw->data, fw->size); + + fw_release: + release_firmware(fw); diff --git a/patches.suse/x86-microcode-amd-fix-mixed-steppings-support.patch b/patches.suse/x86-microcode-amd-fix-mixed-steppings-support.patch index e710b7e..9160dd2 100644 --- a/patches.suse/x86-microcode-amd-fix-mixed-steppings-support.patch +++ b/patches.suse/x86-microcode-amd-fix-mixed-steppings-support.patch @@ -2,7 +2,7 @@ From: "Borislav Petkov (AMD)" Date: Thu, 26 Jan 2023 16:26:17 +0100 Subject: x86/microcode/AMD: Fix mixed steppings support Git-commit: 7ff6edf4fef38ab404ee7861f257e28eaaeed35f -Patch-mainline: v6.3-rc1 +Patch-mainline: 6.3-rc1 References: git-fixes The AMD side of the loader has always claimed to support mixed @@ -21,11 +21,10 @@ Signed-off-by: Borislav Petkov (AMD) Cc: # 2355370cd941 ("x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter") Cc: # a5ad92134bd1 ("x86/microcode/AMD: Add a @cpu parameter to the reloading functions") Link: https://lore.kernel.org/r/20230130161709.11615-4-bp@alien8.de - -Acked-by: Nikolay Borisov +Signed-off-by: Jiri Slaby --- - arch/x86/kernel/cpu/microcode/amd.c | 50 ++++++++++++++++++------------------ - 1 file changed, 25 insertions(+), 25 deletions(-) + arch/x86/kernel/cpu/microcode/amd.c | 34 +++++++++++++++++++++------------- + 1 file changed, 21 insertions(+), 13 deletions(-) --- a/arch/x86/kernel/cpu/microcode/amd.c +++ b/arch/x86/kernel/cpu/microcode/amd.c @@ -49,25 +48,7 @@ Acked-by: Nikolay Borisov #endif desc.cpuid_1_eax = cpuid_1_eax; -@@ -548,7 +550,7 @@ void load_ucode_amd_ap(unsigned int cpui - } - - static enum ucode_state --load_microcode_amd(bool save, u8 family, const u8 *data, size_t size); -+load_microcode_amd(u8 family, const u8 *data, size_t size); - - int __init save_microcode_in_initrd_amd(unsigned int cpuid_1_eax) - { -@@ -566,7 +568,7 @@ int __init save_microcode_in_initrd_amd( - if (!desc.mc) - return -EINVAL; - -- ret = load_microcode_amd(true, x86_family(cpuid_1_eax), desc.data, desc.size); -+ ret = load_microcode_amd(x86_family(cpuid_1_eax), desc.data, desc.size); - if (ret > UCODE_UPDATED) - return -EINVAL; - -@@ -575,10 +577,10 @@ int __init save_microcode_in_initrd_amd( +@@ -574,10 +576,10 @@ int __init save_microcode_in_initrd_amd( void reload_ucode_amd(unsigned int cpu) { @@ -80,20 +61,16 @@ Acked-by: Nikolay Borisov rdmsr(MSR_AMD64_PATCH_LEVEL, rev, dummy); -@@ -844,9 +846,10 @@ static enum ucode_state __load_microcode - return UCODE_OK; - } +@@ -845,6 +847,8 @@ static enum ucode_state __load_microcode --static enum ucode_state --load_microcode_amd(bool save, u8 family, const u8 *data, size_t size) -+static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size) + static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size) { + struct cpuinfo_x86 *c; + unsigned int nid, cpu; struct ucode_patch *p; enum ucode_state ret; -@@ -859,22 +862,20 @@ load_microcode_amd(bool save, u8 family, +@@ -857,18 +861,22 @@ static enum ucode_state load_microcode_a return ret; } @@ -103,9 +80,6 @@ Acked-by: Nikolay Borisov - } else { - if (boot_cpu_data.microcode >= p->patch_id) - return ret; -- -- ret = UCODE_NEW; -- } + for_each_node(nid) { + cpu = cpumask_first(cpumask_of_node(nid)); + c = &cpu_data(cpu); @@ -113,41 +87,18 @@ Acked-by: Nikolay Borisov + p = find_patch(cpu); + if (!p) + continue; - -- /* save BSP's matching patch for early load */ -- if (!save) -- return ret; ++ + if (c->microcode >= p->patch_id) + continue; + ret = UCODE_NEW; +- } + - memset(amd_ucode_patch, 0, PATCH_MAX_SIZE); - memcpy(amd_ucode_patch, p->data, min_t(u32, p->size, PATCH_MAX_SIZE)); -+ memset(amd_ucode_patch, 0, PATCH_MAX_SIZE); -+ memcpy(amd_ucode_patch, p->data, min_t(u32, p->size, PATCH_MAX_SIZE)); ++ memset(&amd_ucode_patch[nid], 0, PATCH_MAX_SIZE); ++ memcpy(&amd_ucode_patch[nid], p->data, min_t(u32, p->size, PATCH_MAX_SIZE)); + } return ret; } -@@ -900,12 +901,11 @@ static enum ucode_state request_microcod - { - char fw_name[36] = "amd-ucode/microcode_amd.bin"; - struct cpuinfo_x86 *c = &cpu_data(cpu); -- bool bsp = c->cpu_index == boot_cpu_data.cpu_index; - enum ucode_state ret = UCODE_NFOUND; - const struct firmware *fw; - - /* reload ucode container only on the boot cpu */ -- if (!refresh_fw || !bsp) -+ if (!refresh_fw) - return UCODE_OK; - - if (c->x86 >= 0x15) -@@ -920,7 +920,7 @@ static enum ucode_state request_microcod - if (!verify_container(fw->data, fw->size, false)) - goto fw_release; - -- ret = load_microcode_amd(bsp, c->x86, fw->data, fw->size); -+ ret = load_microcode_amd(c->x86, fw->data, fw->size); - - fw_release: - release_firmware(fw); diff --git a/patches.suse/x86-mm-fix-poking_init-for-xen-pv-guests.patch b/patches.suse/x86-mm-fix-poking_init-for-xen-pv-guests.patch new file mode 100644 index 0000000..f60232c --- /dev/null +++ b/patches.suse/x86-mm-fix-poking_init-for-xen-pv-guests.patch @@ -0,0 +1,52 @@ +From: Juergen Gross +Date: Mon, 9 Jan 2023 16:09:22 +0100 +Subject: x86/mm: fix poking_init() for Xen PV guests +Git-commit: 26ce6ec364f18d2915923bc05784084e54a5c4cc +Patch-mainline: v6.2-rc4 +References: git-fixes + +Commit 3f4c8211d982 ("x86/mm: Use mm_alloc() in poking_init()") broke +the kernel for running as Xen PV guest. + +It seems as if the new address space is never activated before being +used, resulting in Xen rejecting to accept the new CR3 value (the PGD +isn't pinned). + +Fix that by adding the now missing call of paravirt_arch_dup_mmap() to +poking_init(). That call was previously done by dup_mm()->dup_mmap() and +it is a NOP for all cases but for Xen PV, where it is just doing the +pinning of the PGD. + +Fixes: 3f4c8211d982 ("x86/mm: Use mm_alloc() in poking_init()") +Signed-off-by: Juergen Gross +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20230109150922.10578-1-jgross@suse.com + +Acked-by: Nikolay Borisov +--- + arch/x86/mm/init.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c +index d3987359d441..cb258f58fdc8 100644 +--- a/arch/x86/mm/init.c ++++ b/arch/x86/mm/init.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + /* + * We need to define the tracepoints somewhere, and tlb.c +@@ -804,6 +805,9 @@ void __init poking_init(void) + poking_mm = mm_alloc(); + BUG_ON(!poking_mm); + ++ /* Xen PV guests need the PGD to be pinned. */ ++ paravirt_arch_dup_mmap(NULL, poking_mm); ++ + /* + * Randomize the poking address, but make sure that the following page + * will be mapped at the same PMD. We need 2 pages, so find space for 3, + diff --git a/patches.suse/x86-mm-initialize-text-poking-earlier.patch b/patches.suse/x86-mm-initialize-text-poking-earlier.patch new file mode 100644 index 0000000..9c58165 --- /dev/null +++ b/patches.suse/x86-mm-initialize-text-poking-earlier.patch @@ -0,0 +1,43 @@ +From: Peter Zijlstra +Date: Tue, 25 Oct 2022 21:38:25 +0200 +Subject: x86/mm: Initialize text poking earlier +Git-commit: 5b93a83649c7cba3a15eb7e8959b250841acb1b1 +Patch-mainline: v6.2-rc1 +References: bsc#1212448 + +Move poking_init() up a bunch; specifically move it right after +mm_init() which is right before ftrace_init(). + +This will allow simplifying ftrace text poking which currently has +a bunch of exceptions for early boot. + +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20221025201057.881703081@infradead.org + +Acked-by: Nikolay Borisov +--- + init/main.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/init/main.c b/init/main.c +index f1d1a549e1cc..5372ea243735 100644 +--- a/init/main.c ++++ b/init/main.c +@@ -996,7 +996,7 @@ asmlinkage __visible void __init __no_sanitize_address start_kernel(void) + sort_main_extable(); + trap_init(); + mm_init(); +- ++ poking_init(); + ftrace_init(); + + /* trace_printk can be enabled here */ +@@ -1135,7 +1135,6 @@ asmlinkage __visible void __init __no_sanitize_address start_kernel(void) + taskstats_init_early(); + delayacct_init(); + +- poking_init(); + check_bugs(); + + acpi_subsystem_init(); + diff --git a/patches.suse/x86-mm-use-mm_alloc-in-poking_init.patch b/patches.suse/x86-mm-use-mm_alloc-in-poking_init.patch new file mode 100644 index 0000000..0ccf892 --- /dev/null +++ b/patches.suse/x86-mm-use-mm_alloc-in-poking_init.patch @@ -0,0 +1,57 @@ +From: Peter Zijlstra +Date: Tue, 25 Oct 2022 21:38:21 +0200 +Subject: x86/mm: Use mm_alloc() in poking_init() +Git-commit: 3f4c8211d982099be693be9aa7d6fc4607dff290 +Patch-mainline: v6.2-rc1 +References: bsc#1212448 + +Instead of duplicating init_mm, allocate a fresh mm. The advantage is +that mm_alloc() has much simpler dependencies. Additionally it makes +more conceptual sense, init_mm has no (and must not have) user state +to duplicate. + +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20221025201057.816175235@infradead.org + +Acked-by: Nikolay Borisov +--- + arch/x86/mm/init.c | 2 +- + include/linux/sched/task.h | 1 - + kernel/fork.c | 5 ----- + 3 files changed, 1 insertion(+), 7 deletions(-) + +--- a/arch/x86/mm/init.c ++++ b/arch/x86/mm/init.c +@@ -790,7 +790,7 @@ void __init poking_init(void) + spinlock_t *ptl; + pte_t *ptep; + +- poking_mm = copy_init_mm(); ++ poking_mm = mm_alloc(); + BUG_ON(!poking_mm); + + /* +--- a/include/linux/sched/task.h ++++ b/include/linux/sched/task.h +@@ -88,7 +88,6 @@ extern void exit_itimers(struct task_str + extern pid_t kernel_clone(struct kernel_clone_args *kargs); + struct task_struct *create_io_thread(int (*fn)(void *), void *arg, int node); + struct task_struct *fork_idle(int); +-struct mm_struct *copy_init_mm(void); + extern pid_t kernel_thread(int (*fn)(void *), void *arg, unsigned long flags); + extern long kernel_wait4(pid_t, int __user *, int, struct rusage *); + int kernel_wait(pid_t pid, int *stat); +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -2448,11 +2448,6 @@ struct task_struct * __init fork_idle(in + return task; + } + +-struct mm_struct *copy_init_mm(void) +-{ +- return dup_mm(NULL, &init_mm); +-} +- + /* + * This is like kernel_clone(), but shaved down and tailored to just + * creating io_uring workers. It returns a created task, or an error pointer. diff --git a/series.conf b/series.conf index 4de4b97..e5bb54a 100644 --- a/series.conf +++ b/series.conf @@ -14781,6 +14781,7 @@ patches.suse/regulator-of-Fix-refcount-leak-bug-in-of_get_regulat.patch patches.suse/regulator-core-Fix-off-on-delay-us-for-always-on-boo.patch patches.suse/spi-spi-altera-dfl-Fix-an-error-handling-path.patch + patches.suse/spi-tegra210-quad-Multi-cs-support.patch patches.suse/spi-synquacer-Add-missing-clk_disable_unprepare.patch patches.suse/spi-pxa2xx-Add-support-for-Intel-Meteor-Lake-P.patch patches.suse/spi-dt-bindings-cadence-add-missing-required.patch @@ -16270,6 +16271,7 @@ patches.suse/NFSD-Return-nfserr_serverfault-if-splice_ok-but-buf-.patch patches.suse/NFSD-Cap-rsize_bop-result-based-on-send-buffer-size.patch patches.suse/NFSD-fix-use-after-free-on-source-server-when-doing-.patch + patches.suse/x86-microcode-Print-previous-version-of-microcode-af.patch patches.suse/x86-microcode-amd-track-patch-allocation-size-explicitly.patch patches.suse/net-ethernet-ti-davinci_mdio-Add-workaround-for-erra.patch patches.suse/openvswitch-Fix-double-reporting-of-drops-in-dropwat.patch @@ -16774,6 +16776,7 @@ patches.suse/cgroup-Honor-caller-s-cgroup-NS-when-resolving-path.patch patches.suse/cgroup-cgroup-Honor-caller-s-cgroup-NS-when-resolving-cgroup-id.patch patches.suse/cgroup-Homogenize-cgroup_get_from_id-return-value.patch + patches.suse/cgroup-Use-cgroup_attach_-lock-unlock-from-cgroup_attach_task_all.patch patches.suse/cgroup-cpuset-Enable-update_tasks_cpumask-on-top_cpuset.patch patches.suse/cgroup-Make-cgroup_get_from_id-prettier.patch patches.suse/livepatch-fix-race-between-fork-and-KLP-transition.patch @@ -17039,6 +17042,7 @@ patches.suse/selftests-intel_pstate-fix-build-for-ARCH-x86_64.patch patches.suse/scsi-mpt3sas-re-do-lost-mpt3sas-DMA-mask-fix.patch patches.suse/platform-x86-thinkpad_acpi-Fix-reporting-a-non-prese.patch + patches.suse/spi-tegra210-quad-Fix-combined-sequence.patch patches.suse/media-vivid-s_fbuf-add-more-sanity-checks.patch patches.suse/media-vivid-dev-bitmap_cap-wasn-t-freed-in-all-cases.patch patches.suse/media-v4l2-dv-timings-add-sanity-checks-for-blanking.patch @@ -18349,6 +18353,9 @@ patches.suse/HSI-omap_ssi_core-fix-possible-memory-leak-in-ssi_pr.patch patches.suse/HSI-omap_ssi_core-Fix-error-handling-in-ssi_init.patch patches.suse/x86-mm-Randomize-per-cpu-entry-area.patch + patches.suse/mm-move-mm_cachep-initialization-to-mm_init.patch + patches.suse/x86-mm-use-mm_alloc-in-poking_init.patch + patches.suse/x86-mm-initialize-text-poking-earlier.patch patches.suse/powerpc-xmon-Fix-Wswitch-unreachable-warning-in-bpt_.patch patches.suse/powerpc-xive-add-missing-iounmap-in-error-path-in-xi.patch patches.suse/selftests-powerpc-Move-perror-closer-to-its-use.patch @@ -18621,6 +18628,7 @@ patches.suse/cifs-fix-potential-memory-leaks-in-session-setup.patch patches.suse/cifs-Fix-uninitialized-memory-read-for-smb311-posix-symlink-create.patch patches.suse/x86-boot-Avoid-using-Intel-mnemonics-in-AT-T-syntax-.patch + patches.suse/x86-mm-fix-poking_init-for-xen-pv-guests.patch patches.suse/nilfs2-fix-general-protection-fault-in-nilfs_btree_i.patch patches.suse/tomoyo-fix-broken-dependency-on-.conf.default.patch patches.suse/NFSD-fix-use-after-free-in-nfsd4_ssc_setup_dul.patch @@ -19011,6 +19019,7 @@ patches.suse/x86-microcode-add-a-parameter-to-microcode_check-to-store-cpu-capabilities.patch patches.suse/x86-microcode-check-cpu-capabilities-after-late-microcode-update-correctly.patch patches.suse/x86-microcode-adjust-late-loading-result-reporting-message.patch + patches.suse/x86-microcode-amd-Remove-load_microcode_amd-s-bsp-pa.patch patches.suse/x86-microcode-amd-add-a-cpu-parameter-to-the-reloading-functions.patch patches.suse/x86-microcode-amd-fix-mixed-steppings-support.patch patches.suse/x86-signal-fix-the-value-returned-by-strict_sas_size.patch @@ -19352,6 +19361,7 @@ patches.suse/iio-accel-mma9551_core-Prevent-uninitialized-variabl-64a68158738e.patch patches.suse/firmware-coreboot-Remove-GOOGLE_COREBOOT_TABLE_ACPI-.patch patches.suse/driver-core-fix-potential-null-ptr-deref-in-device_a.patch + patches.suse/test_firmware-Use-kstrtobool-instead-of-strtobool.patch patches.suse/driver-core-fix-resource-leak-in-device_add.patch patches.suse/drivers-base-transport_class-fix-possible-memory-lea.patch patches.suse/drivers-base-transport_class-fix-resource-leak-when-.patch @@ -19487,6 +19497,7 @@ patches.suse/fs-jfs-fix-shift-exponent-db_agl2size-negative.patch patches.suse/regulator-core-Use-ktime_get_boottime-to-determine-h.patch patches.suse/spi-tegra210-quad-Fix-validate-combined-sequence.patch + patches.suse/spi-tegra210-quad-Fix-iterator-outside-loop.patch patches.suse/auxdisplay-hd44780-Fix-potential-memory-leak-in-hd44.patch patches.suse/ceph-update-the-time-stamps-and-try-to-drop-the-suid-sgid.patch patches.suse/watchdog-at91sam9_wdt-use-devm_request_irq-to-avoid-.patch @@ -19843,6 +19854,7 @@ patches.suse/gpio-GPIO_REGMAP-select-REGMAP-instead-of-depending-.patch patches.suse/gpio-davinci-Add-irq-chip-flag-to-skip-set-wake.patch patches.suse/nilfs2-fix-potential-UAF-of-struct-nilfs_sc_info-in-.patch + patches.suse/mm-vmalloc-avoid-warn_alloc-noise-caused-by-fatal-signal.patch patches.suse/mm-take-a-page-reference-when-removing-device-exclusive-entries.patch patches.suse/nilfs2-fix-sysfs-interface-lifetime.patch patches.suse/ftrace-Fix-issue-that-direct-addr-not-restored-in-modify_ftrace_direct.patch @@ -20412,13 +20424,19 @@ patches.suse/powerpc-iommu-DMA-address-offset-is-incorrectly-calc.patch patches.suse/mmc-sdhci-esdhc-imx-make-no-mmc-hs400-works.patch patches.suse/regulator-pca9450-Fix-BUCK2-enable_mask.patch + patches.suse/regulator-Fix-error-checking-for-debugfs_create_dir.patch patches.suse/regulator-mt6359-add-read-check-for-PMIC-MT6359.patch + patches.suse/platform-x86-asus-wmi-Ignore-WMI-events-with-codes-0.patch patches.suse/ALSA-hda-ca0132-add-quirk-for-EVGA-X299-DARK.patch patches.suse/ALSA-hda-Fix-unhandled-register-update-during-auto-s.patch patches.suse/ASoC-lpass-Fix-for-KASAN-use_after_free-out-of-bound.patch patches.suse/ASoC-rt5682-Disable-jack-detection-interrupt-during-.patch + patches.suse/ASoC-soc-pcm-test-if-a-BE-can-be-prepared.patch patches.suse/ASoC-Intel-Skylake-Fix-declaration-of-enum-skl_ch_cf.patch + patches.suse/ASoC-dwc-move-DMA-init-to-snd_soc_dai_driver-probe.patch patches.suse/ALSA-hda-realtek-Enable-headset-onLenovo-M70-M90.patch + patches.suse/power-supply-ab8500-Fix-external_power_changed-race.patch + patches.suse/power-supply-sc27xx-Fix-external_power_changed-race.patch patches.suse/power-supply-leds-Fix-blink-to-LED-on-transition.patch patches.suse/power-supply-bq27xxx-Fix-bq27xxx_battery_update-race.patch patches.suse/power-supply-bq27xxx-Fix-I2C-IRQ-race-on-remove.patch @@ -20427,14 +20445,19 @@ patches.suse/power-supply-bq27xxx-Move-bq27xxx_battery_update-dow.patch patches.suse/power-supply-bq27xxx-Ensure-power_supply_changed-is-.patch patches.suse/power-supply-bq27xxx-After-charger-plug-in-out-wait-.patch + patches.suse/power-supply-bq27xxx-Use-mod_delayed_work-instead-of.patch + patches.suse/power-supply-Ratelimit-no-data-debug-output.patch patches.suse/power-supply-sbs-charger-Fix-INHIBITED-bit-for-Statu.patch + patches.suse/power-supply-Fix-logic-checking-if-system-is-running.patch patches.suse/net-cdc_ncm-Deal-with-too-low-values-of-dwNtbOutMaxS.patch patches.suse/3c589_cs-Fix-an-error-handling-path-in-tc589_probe.patch patches.suse/cifs-fix-smb1-mount-regression.patch patches.suse/smb3-display-debug-information-better-for-encryption.patch patches.suse/cifs-mapchars-mount-option-ignored.patch + patches.suse/drm-amd-amdgpu-Fix-missing-buffer-object-unlock-in-f.patch patches.suse/drm-sched-Remove-redundant-check.patch patches.suse/gpio-mockup-Fix-mode-of-debugfs-files.patch + patches.suse/ARM-dts-vexpress-add-missing-cache-properties.patch patches.suse/dt-binding-cdns-usb3-Fix-cdns-on-chip-buff-size-type.patch patches.suse/firmware-arm_ffa-Check-if-ffa_driver-remove-is-prese.patch patches.suse/firmware-arm_ffa-Set-reserved-MBZ-fields-to-zero-in-.patch @@ -20490,6 +20513,7 @@ patches.suse/iio-imu-inv_icm42600-fix-timestamp-reset.patch patches.suse/misc-fastrpc-return-EPIPE-to-invocations-on-device-r.patch patches.suse/misc-fastrpc-reject-new-invocations-during-device-re.patch + patches.suse/test_firmware-prevent-race-conditions-by-a-correct-i.patch patches.suse/test_firmware-fix-the-memory-leak-of-the-allocated-f.patch patches.suse/KEYS-asymmetric-Copy-sig-and-digest-in-public_key_ve.patch patches.suse/platform-surface-aggregator-Allow-completion-work-it.patch @@ -20509,12 +20533,15 @@ patches.suse/Bluetooth-Fix-l2cap_disconnect_req-deadlock.patch patches.suse/Bluetooth-L2CAP-Add-missing-checks-for-invalid-DCID.patch patches.suse/net-sched-fix-possible-refcount-leak-in-tc_chain_tmp.patch + patches.suse/bpf-Fix-UAF-in-task-local-storage.patch patches.suse/bpf-Add-extra-path-pointer-check-to-d_path-helper.patch patches.suse/batman-adv-Broken-sync-while-rescheduling-delayed-wo.patch patches.suse/bnxt_en-Don-t-issue-AP-reset-during-ethtool-s-reset-.patch patches.suse/bnxt_en-Query-default-VLAN-before-VNIC-setup-on-a-VF.patch patches.suse/bnxt_en-Skip-firmware-fatal-error-recovery-if-chip-i.patch patches.suse/bnxt_en-Implement-.set_port-.unset_port-UDP-tunnel-c.patch + patches.suse/cgroup-fix-missing-cpus_read_-lock-unlock-in-cgroup_transfer_tasks.patch + patches.suse/cgroup-always-put-cset-in-cgroup_css_set_put_fork.patch patches.suse/drm-amd-pm-Fix-power-context-allocation-in-SMU13.patch patches.suse/drm-amdgpu-fix-xclk-freq-on-CHIP_STONEY.patch patches.suse/drm-i915-gt-Use-the-correct-error-value-when-kernel_.patch @@ -20528,6 +20555,8 @@ patches.suse/ASoC-codecs-wsa881x-do-not-set-can_multi_write-flag.patch patches.suse/ALSA-hda-realtek-Enable-4-amplifiers-instead-of-2-on.patch patches.suse/pinctrl-meson-axg-add-missing-GPIOA_18-gpio-group.patch + patches.suse/ceph-fix-use-after-free-bug-for-inodes-when-flushing-.patch + patches.suse/s390-dasd-Use-correct-lock-while-counting-channel-queue-length.patch patches.suse/arm64-dts-qcom-sc7180-lite-Fix-SDRAM-freq-for-miside.patch patches.suse/firmware-arm_ffa-Set-handle-field-to-zero-in-memory-.patch patches.suse/arm64-dts-imx8qm-mek-correct-GPIOs-for-USDHC2-CD-and.patch @@ -20536,16 +20565,21 @@ patches.suse/i2c-mv64xxx-Fix-reading-invalid-status-value-in-atom.patch patches.suse/i2c-sprd-Delete-i2c-adapter-in-.remove-s-error-path.patch patches.suse/eeprom-at24-also-select-REGMAP.patch + patches.suse/nilfs2-fix-incomplete-buffer-cleanup-in-nilfs_btnode.patch patches.suse/powerpc-purgatory-remove-PGO-flags.patch patches.suse/nilfs2-fix-possible-out-of-bounds-segment-allocation.patch patches.suse/dt-bindings-i3c-silvaco-i3c-master-fix-missing-schem.patch + patches.suse/spi-fsl-dspi-avoid-SCK-glitches-with-continuous-tran.patch + patches.suse/net-usb-qmi_wwan-add-support-for-Compal-RXM-G1.patch patches.suse/iavf-remove-mask-from-iavf_irq_enable_queues.patch patches.suse/igc-Clean-the-TX-buffer-and-TX-descriptor-ring.patch patches.suse/igc-Fix-possible-system-crash-when-loading-module.patch patches.suse/igb-fix-nvm.ops.read-error-handling.patch + patches.suse/selftests-ptp-Fix-timestamp-printf-format-for-PTP_SY.patch patches.suse/ALSA-hda-realtek-Add-a-quirk-for-Compaq-N14JP6.patch patches.suse/ALSA-usb-audio-Fix-broken-resume-due-to-UAC3-power-s.patch patches.suse/ALSA-usb-audio-Add-quirk-flag-for-HEM-devices-to-ena.patch + patches.suse/drm-amd-display-edp-do-not-add-non-edid-timings.patch patches.suse/nouveau-fix-client-work-fence-deletion-race.patch patches.suse/drm-nouveau-don-t-detect-DSM-for-non-NVIDIA-device.patch patches.suse/drm-nouveau-dp-check-for-NULL-nv_connector-native_mo.patch @@ -20553,11 +20587,15 @@ patches.suse/serial-lantiq-add-missing-interrupt-ack.patch patches.suse/thunderbolt-dma_test-Use-correct-value-for-absent-ri.patch patches.suse/thunderbolt-Mask-ring-interrupt-on-Intel-hardware-as.patch + patches.suse/USB-serial-option-add-Quectel-EM061KGL-series.patch patches.suse/usb-dwc3-gadget-Reset-num-TRBs-before-giving-back-th.patch patches.suse/USB-dwc3-qcom-fix-NULL-deref-on-suspend.patch patches.suse/USB-dwc3-fix-use-after-free-on-core-driver-unbind.patch patches.suse/usb-typec-ucsi-Fix-command-cancellation.patch patches.suse/staging-octeon-delete-my-name-from-TODO-contact.patch + patches.suse/ACPI-sleep-Avoid-breaking-S3-wakeup-due-to-might_sle.patch + patches.suse/regmap-spi-avmm-Fix-regmap_bus-max_raw_write.patch + patches.suse/regulator-pca9450-Fix-LDO3OUT-and-LDO4OUT-MASK.patch # jejb/scsi for-next patches.suse/scsi-lpfc-Fix-verbose-logging-for-SCSI-commands-issu.patch @@ -20630,6 +20668,7 @@ patches.suse/x86-fpu-remove-cpuinfo-argument-from-init-functions.patch patches.suse/x86-fpu-mark-init-functions-_init.patch patches.suse/x86-fpu-move-fpu-initialization-into-arch_cpu_finalize_init.patch + patches.suse/mm-vmalloc-do-not-output-a-spurious-warning-when-huge-vmalloc-fails.patch ######################################################## # kbuild/module infrastructure fixes @@ -20739,6 +20778,8 @@ # bsc#1210034 patches.suse/mm-page_alloc-skip-regions-with-hugetlbfs-pages-when-allocating-1G-pages.patch + patches.suse/binfmt_elf-takethe-mmap_lock-when-walking-the-VMA-list.patch + ######################################################## # Filesystems ########################################################