diff --git a/blacklist.conf b/blacklist.conf index d86ae93..78bd305 100644 --- a/blacklist.conf +++ b/blacklist.conf @@ -720,3 +720,13 @@ ecec4b20d29c3d6922dafe7d2555254a454272d2 # misattributed. Bug introduced only in 9e624651859214fb2c4e442b059eba0aefcd0801 # already fixed by 74e7e1efdad45580cc3839f2a155174cf158f9b5 9db89b41117024f80b38b15954017fb293133364 # unnecessary, see bsc#1207328 8b05aa26336113c4cea25f1c333ee8cd4fc212a6 # unnecessary, see bsc#1207328 +2cca486cad4bf51da57cdad150697476a702ab69 # cosmetic, not a fix +e591b298d7ecb851e200f65946e3d53fe78a3c4f # only purpose breaks kabi +b5e7b59c3480f355910f9d2c6ece5857922a5e54 # breaks kabi and unnecessary +6e7f90d163afa8fc2efd6ae318e7c20156a5621f # fix for bug we don't have +d19a7af73b5ecaac8168712d18be72b9db166768 # fix for bug we don't have +64158668ac8b31626a8ce48db4cad08496eb8340 # have fix in different form +c265de257f558a05c1859ee9e3fed04883b9ec0e # have fix in different form +da48f267f90d9dc9f930fd9a67753643657b404f # not obviously safe, not really necessary +9fd5a04d8efcbf511286dd36c46fd70a645b167d # cosmetic fix that breaks kABI +3b90954419d4c05651de9cce6d7632bcf6977678 # false positive from stable. Bug introduced in e9e7870f90e3587b712e05db2ded947a3f617119 diff --git a/patches.kabi/NFS-Fix-another-fsync-issue-after-a-server-reboot.patch b/patches.kabi/NFS-Fix-another-fsync-issue-after-a-server-reboot.patch index a80e278..0b28b70 100644 --- a/patches.kabi/NFS-Fix-another-fsync-issue-after-a-server-reboot.patch +++ b/patches.kabi/NFS-Fix-another-fsync-issue-after-a-server-reboot.patch @@ -12,7 +12,7 @@ that applies only to directories. --- a/include/linux/nfs_fs.h +++ b/include/linux/nfs_fs.h -@@ -176,7 +176,6 @@ struct nfs_inode { +@@ -177,7 +177,6 @@ struct nfs_inode { __be32 cookieverf[NFS_DIR_VERIFIER_SIZE]; atomic_long_t nrequests; @@ -20,7 +20,7 @@ that applies only to directories. struct nfs_mds_commit_info commit_info; /* Open contexts for shared mmap writes */ -@@ -184,7 +183,14 @@ struct nfs_inode { +@@ -185,7 +184,14 @@ struct nfs_inode { /* Readers: in-flight sillydelete RPC calls */ /* Writers: rmdir */ @@ -34,4 +34,4 @@ that applies only to directories. +#endif struct mutex commit_mutex; - /* track last access to cached pages */ + /* Keep track of out-of-order replies. diff --git a/patches.kabi/NFS-Further-optimisations-for-ls-l.patch b/patches.kabi/NFS-Further-optimisations-for-ls-l.patch new file mode 100644 index 0000000..c135558 --- /dev/null +++ b/patches.kabi/NFS-Further-optimisations-for-ls-l.patch @@ -0,0 +1,24 @@ +From: NeilBrown +Subject: KABI FIX FOR: NFS: Further optimisations for 'ls -l' +Patch-mainline: Never, kabi +References: git-fixes + +Restore the (now unused) field that was removed from struct nfs_inode. + +Signed-off-by: NeilBrown +--- + include/linux/nfs_fs.h | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/include/linux/nfs_fs.h ++++ b/include/linux/nfs_fs.h +@@ -194,6 +194,9 @@ struct nfs_inode { + #endif + struct mutex commit_mutex; + ++ /* track last access to cached pages */ ++ unsigned long page_index; ++ + #if IS_ENABLED(CONFIG_NFS_V4) + struct nfs4_cached_acl *nfs4_acl; + /* NFSv4 state */ diff --git a/patches.kabi/NFSD-Have-legacy-NFSD-WRITE-decoders-use-xdr_stream_.patch b/patches.kabi/NFSD-Have-legacy-NFSD-WRITE-decoders-use-xdr_stream_.patch new file mode 100644 index 0000000..f5a604f --- /dev/null +++ b/patches.kabi/NFSD-Have-legacy-NFSD-WRITE-decoders-use-xdr_stream_.patch @@ -0,0 +1,89 @@ +From: NeilBrown +Subject: KABI FIX FOR: NFSD: Have legacy NFSD WRITE decoders use xdr_stream_subsegment() +Patch-mainline: Never, kabi +References: git-fixes + +Instead of changing the exported function, create a static-inline +wrapper with the same effect, and use that. + +Signed-off-by: NeilBrown + +--- + fs/nfsd/nfs3proc.c | 2 +- + fs/nfsd/nfs4proc.c | 2 +- + fs/nfsd/nfsproc.c | 2 +- + include/linux/sunrpc/svc.h | 12 +++++++++++- + net/sunrpc/svc.c | 6 ++---- + 5 files changed, 16 insertions(+), 8 deletions(-) + +--- a/fs/nfsd/nfs3proc.c ++++ b/fs/nfsd/nfs3proc.c +@@ -210,7 +210,7 @@ nfsd3_proc_write(struct svc_rqst *rqstp) + + fh_copy(&resp->fh, &argp->fh); + resp->committed = argp->stable; +- nvecs = svc_fill_write_vector(rqstp, &argp->payload); ++ nvecs = svc_fill_write_vector_new(rqstp, &argp->payload); + + resp->status = nfsd_write(rqstp, &resp->fh, argp->offset, + rqstp->rq_vec, nvecs, &cnt, +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1038,7 +1038,7 @@ nfsd4_write(struct svc_rqst *rqstp, stru + + write->wr_how_written = write->wr_stable_how; + +- nvecs = svc_fill_write_vector(rqstp, &write->wr_payload); ++ nvecs = svc_fill_write_vector_new(rqstp, &write->wr_payload); + WARN_ON_ONCE(nvecs > ARRAY_SIZE(rqstp->rq_vec)); + + status = nfsd_vfs_write(rqstp, &cstate->current_fh, nf, +--- a/fs/nfsd/nfsproc.c ++++ b/fs/nfsd/nfsproc.c +@@ -235,7 +235,7 @@ nfsd_proc_write(struct svc_rqst *rqstp) + SVCFH_fmt(&argp->fh), + argp->len, argp->offset); + +- nvecs = svc_fill_write_vector(rqstp, &argp->payload); ++ nvecs = svc_fill_write_vector_new(rqstp, &argp->payload); + + resp->status = nfsd_write(rqstp, fh_copy(&resp->fh, &argp->fh), + argp->offset, rqstp->rq_vec, nvecs, +--- a/include/linux/sunrpc/svc.h ++++ b/include/linux/sunrpc/svc.h +@@ -532,7 +532,17 @@ int svc_encode_result_payload(struct + unsigned int offset, + unsigned int length); + unsigned int svc_fill_write_vector(struct svc_rqst *rqstp, +- struct xdr_buf *payload); ++ struct page **pages, ++ struct kvec *first, size_t total); ++ ++static inline unsigned int svc_fill_write_vector_new( ++ struct svc_rqst *rqstp, ++ struct xdr_buf *payload) ++{ ++ return svc_fill_write_vector(rqstp, payload->pages, ++ payload->head, payload->len); ++} ++ + char *svc_fill_symlink_pathname(struct svc_rqst *rqstp, + struct kvec *first, void *p, + size_t total); +--- a/net/sunrpc/svc.c ++++ b/net/sunrpc/svc.c +@@ -1669,12 +1669,10 @@ EXPORT_SYMBOL_GPL(svc_encode_result_payl + * Fills in rqstp::rq_vec, and returns the number of elements. + */ + unsigned int svc_fill_write_vector(struct svc_rqst *rqstp, +- struct xdr_buf *payload) ++ struct page **pages, ++ struct kvec *first, size_t total) + { +- struct page **pages = payload->pages; +- struct kvec *first = payload->head; + struct kvec *vec = rqstp->rq_vec; +- size_t total = payload->len; + unsigned int i; + + /* Some types of transport can present the write payload diff --git a/patches.kabi/NFSv3-handle-out-of-order-write-replies.patch b/patches.kabi/NFSv3-handle-out-of-order-write-replies.patch new file mode 100644 index 0000000..d4d2219 --- /dev/null +++ b/patches.kabi/NFSv3-handle-out-of-order-write-replies.patch @@ -0,0 +1,73 @@ +From: NeilBrown +Date: Tue, 13 Dec 2022 15:13:35 +1100 +Subject: KABI fix for: NFSv3: handle out-of-order write replies. +Patch-mainline: Never, kabi +References: bsc#1205544 + +Move new additioned to nfs_inode to the end, and hide from the kabi. + +Signed-off-by: NeilBrown +--- + include/linux/nfs_fs.h | 44 +++++++++++++++++++++++--------------------- + 1 file changed, 23 insertions(+), 21 deletions(-) + +--- a/include/linux/nfs_fs.h ++++ b/include/linux/nfs_fs.h +@@ -194,6 +194,29 @@ struct nfs_inode { + #endif + struct mutex commit_mutex; + ++#if IS_ENABLED(CONFIG_NFS_V4) ++ struct nfs4_cached_acl *nfs4_acl; ++ /* NFSv4 state */ ++ struct list_head open_states; ++ struct nfs_delegation __rcu *delegation; ++ struct rw_semaphore rwsem; ++ ++ /* pNFS layout information */ ++ struct pnfs_layout_hdr *layout; ++#endif /* CONFIG_NFS_V4*/ ++ /* how many bytes have been written/read and how many bytes queued up */ ++ __u64 write_io; ++ __u64 read_io; ++#ifdef CONFIG_NFS_FSCACHE ++ struct fscache_cookie *fscache; ++#endif ++ struct inode vfs_inode; ++ ++#ifdef CONFIG_NFS_V4_2 ++ struct nfs4_xattr_cache *xattr_cache; ++#endif ++ ++#ifndef __GENKSYMS__ + /* Keep track of out-of-order replies. + * The ooo array contains start/end pairs of + * numbers from the changeid sequence when +@@ -226,27 +249,6 @@ struct nfs_inode { + u64 start, end; + } gap[16]; + } *ooo; +- +-#if IS_ENABLED(CONFIG_NFS_V4) +- struct nfs4_cached_acl *nfs4_acl; +- /* NFSv4 state */ +- struct list_head open_states; +- struct nfs_delegation __rcu *delegation; +- struct rw_semaphore rwsem; +- +- /* pNFS layout information */ +- struct pnfs_layout_hdr *layout; +-#endif /* CONFIG_NFS_V4*/ +- /* how many bytes have been written/read and how many bytes queued up */ +- __u64 write_io; +- __u64 read_io; +-#ifdef CONFIG_NFS_FSCACHE +- struct fscache_cookie *fscache; +-#endif +- struct inode vfs_inode; +- +-#ifdef CONFIG_NFS_V4_2 +- struct nfs4_xattr_cache *xattr_cache; + #endif + }; + diff --git a/patches.kabi/NFSv4.1-query-for-fs_location-attr-on-a-new-file-sys.patch b/patches.kabi/NFSv4.1-query-for-fs_location-attr-on-a-new-file-sys.patch new file mode 100644 index 0000000..155d058 --- /dev/null +++ b/patches.kabi/NFSv4.1-query-for-fs_location-attr-on-a-new-file-sys.patch @@ -0,0 +1,79 @@ +From: NeilBrown +Subject: KABI FIX FOR: NFSv4.1 query for fs_location attr on a new file system +References: Never, kabi + +Hide the new fields from kabi - it is at the end. +Add a magic cookie so that if some module does define one of these +ops structures, we can tell be the lack of a cooke, and ignore it. + +If a module managed to allocate a structure that was followed +immediately by an invalid address, that would be awkward. I cannot see +it happening though. + +The change to nfs4_mig_recovery_ops is completely local to the nfsv4 +module. Nothing else can notice it. It only affects kabi because there +is a pointer to it in a shared object. +So hide the change - it is irrelevant for practical purposes. + +Signed-off-by: NeilBrown +--- + fs/nfs/client.c | 1 + + fs/nfs/nfs4_fs.h | 5 +++++ + fs/nfs/nfs4proc.c | 1 + + include/linux/nfs_xdr.h | 8 ++++++++ + 4 files changed, 15 insertions(+) + +--- a/fs/nfs/client.c ++++ b/fs/nfs/client.c +@@ -859,6 +859,7 @@ int nfs_probe_fsinfo(struct nfs_server * + } + + if (clp->rpc_ops->discover_trunking != NULL && ++ clp->rpc_ops->trunking_cookie == NFS_TRUNKING_COOKIE && + (server->caps & NFS_CAP_FS_LOCATIONS)) { + error = clp->rpc_ops->discover_trunking(server, mntfh); + if (error < 0) +--- a/fs/nfs/nfs4_fs.h ++++ b/fs/nfs/nfs4_fs.h +@@ -261,8 +261,13 @@ struct nfs4_state_maintenance_ops { + }; + + struct nfs4_mig_recovery_ops { ++#ifdef __GENKSYMS__ ++ int (*get_locations)(struct inode *, struct nfs4_fs_locations *, ++ struct page *, const struct cred *); ++#else + int (*get_locations)(struct nfs_server *, struct nfs_fh *, + struct nfs4_fs_locations *, struct page *, const struct cred *); ++#endif + int (*fsid_present)(struct inode *, const struct cred *); + }; + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -10597,6 +10597,7 @@ const struct nfs_rpc_ops nfs_v4_clientop + .create_server = nfs4_create_server, + .clone_server = nfs_clone_server, + .discover_trunking = nfs4_discover_trunking, ++ .trunking_cookie = NFS_TRUNKING_COOKIE, + }; + + static const struct xattr_handler nfs4_xattr_nfs4_acl_handler = { +--- a/include/linux/nfs_xdr.h ++++ b/include/linux/nfs_xdr.h +@@ -1805,7 +1805,15 @@ struct nfs_rpc_ops { + struct nfs_server *(*create_server)(struct fs_context *); + struct nfs_server *(*clone_server)(struct nfs_server *, struct nfs_fh *, + struct nfs_fattr *, rpc_authflavor_t); ++#ifndef __GENKSYMS__ + int (*discover_trunking)(struct nfs_server *, struct nfs_fh *); ++ /* If trunking_cookie is not correct, this might ++ * be in an external modules and discover_trunking ++ * cannot be trusted. ++ */ ++ unsigned long long trunking_cookie; ++#define NFS_TRUNKING_COOKIE 0xbf18046af9c4dc73ULL ++#endif + }; + + /* diff --git a/patches.kabi/kabi-workaround-for-migrate_vma.fault_page.patch b/patches.kabi/kabi-workaround-for-migrate_vma.fault_page.patch new file mode 100644 index 0000000..909695e --- /dev/null +++ b/patches.kabi/kabi-workaround-for-migrate_vma.fault_page.patch @@ -0,0 +1,241 @@ +From 70c7edc1c6d29aa9aee8b133da3fa8fd1b1248e4 Mon Sep 17 00:00:00 2001 +From: Vlastimil Babka +Date: Tue, 7 Mar 2023 17:54:53 +0100 +Subject: [PATCH] kabi: workaround for migrate_vma.fault_page +Patch-mainline: Never, KABI workaround +References: CVE-2022-3523, bsc#1204363 + +3rd party modules built against the GA KABI will instantiate struct +migrate_vma without the fault_page, so we must not access it in that +case. Their migrate_to_ram callback will also not handle fault_page so +the extra page reference added by do_swap_page() will not be recognized +as the fault_page reference and cause migration to fail. + +To fix the first problem, add MIGRATE_VMA_FAULT_PAGE flag and +migrate_vma_fault_page() wrapper to obtain migrate_vma.fault_page only +if we know it exists. In-tree modules will set the flag. Rename the +field to __fault_page to catch any future backports that need to be +checked. + +To fix the second problem, add PGMAP_MIGRATE_VMA_FAULT_PAGE flag for +pgmap that in-kernel drivers set to make do_swap_page() know they handle +fault_page and so the page reference can be incremented and decremented +there. + +Note in svm_migrate_init() we replace the setting of +MIGRATE_VMA_SELECT_DEVICE_PRIVATE to pgmap flags, which was bogus but +harmless (and removed upstream as part of a larger change). + +Signed-off-by: Vlastimil Babka +--- + drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 6 +++--- + drivers/gpu/drm/nouveau/nouveau_dmem.c | 5 +++-- + include/linux/memremap.h | 1 + + include/linux/migrate.h | 20 +++++++++++++++++++- + lib/test_hmm.c | 4 ++-- + mm/memory.c | 9 +++++++-- + mm/migrate.c | 10 ++++++---- + 7 files changed, 41 insertions(+), 14 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +index 8baacb8554ad..67b2895ece96 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +@@ -617,7 +617,7 @@ svm_migrate_vma_to_ram(struct amdgpu_device *adev, struct svm_range *prange, + migrate.vma = vma; + migrate.start = start; + migrate.end = end; +- migrate.flags = MIGRATE_VMA_SELECT_DEVICE_PRIVATE; ++ migrate.flags = MIGRATE_VMA_SELECT_DEVICE_PRIVATE | MIGRATE_VMA_FAULT_PAGE; + migrate.pgmap_owner = SVM_ADEV_PGMAP_OWNER(adev); + + size = 2 * sizeof(*migrate.src) + sizeof(uint64_t) + sizeof(dma_addr_t); +@@ -628,7 +628,7 @@ svm_migrate_vma_to_ram(struct amdgpu_device *adev, struct svm_range *prange, + + migrate.src = buf; + migrate.dst = migrate.src + npages; +- migrate.fault_page = fault_page; ++ migrate.__fault_page = fault_page; + scratch = (dma_addr_t *)(migrate.dst + npages); + + r = migrate_vma_setup(&migrate); +@@ -913,7 +913,7 @@ int svm_migrate_init(struct amdgpu_device *adev) + pgmap->range.end = res->end; + pgmap->ops = &svm_migrate_pgmap_ops; + pgmap->owner = SVM_ADEV_PGMAP_OWNER(adev); +- pgmap->flags = MIGRATE_VMA_SELECT_DEVICE_PRIVATE; ++ pgmap->flags = PGMAP_MIGRATE_VMA_FAULT_PAGE; + + /* Device manager releases device-specific resources, memory region and + * pgmap when driver disconnects from device. +diff --git a/drivers/gpu/drm/nouveau/nouveau_dmem.c b/drivers/gpu/drm/nouveau/nouveau_dmem.c +index 232d01cb7ad3..eea3deeab981 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_dmem.c ++++ b/drivers/gpu/drm/nouveau/nouveau_dmem.c +@@ -192,8 +192,8 @@ static vm_fault_t nouveau_dmem_migrate_to_ram(struct vm_fault *vmf) + .src = &src, + .dst = &dst, + .pgmap_owner = drm->dev, +- .fault_page = vmf->page, +- .flags = MIGRATE_VMA_SELECT_DEVICE_PRIVATE, ++ .__fault_page = vmf->page, ++ .flags = MIGRATE_VMA_SELECT_DEVICE_PRIVATE | MIGRATE_VMA_FAULT_PAGE, + }; + + /* +@@ -254,6 +254,7 @@ nouveau_dmem_chunk_alloc(struct nouveau_drm *drm, struct page **ppage) + chunk->pagemap.range.end = res->end; + chunk->pagemap.nr_range = 1; + chunk->pagemap.ops = &nouveau_dmem_pagemap_ops; ++ chunk->pagemap.flags = PGMAP_MIGRATE_VMA_FAULT_PAGE; + chunk->pagemap.owner = drm->dev; + + ret = nouveau_bo_new(&drm->client, DMEM_CHUNK_SIZE, 0, +diff --git a/include/linux/memremap.h b/include/linux/memremap.h +index c0e9d35889e8..69c33a5bcf6e 100644 +--- a/include/linux/memremap.h ++++ b/include/linux/memremap.h +@@ -90,6 +90,7 @@ struct dev_pagemap_ops { + }; + + #define PGMAP_ALTMAP_VALID (1 << 0) ++#define PGMAP_MIGRATE_VMA_FAULT_PAGE (1 << 1) + + /** + * struct dev_pagemap - metadata for ZONE_DEVICE mappings +diff --git a/include/linux/migrate.h b/include/linux/migrate.h +index ab4fd50f85d5..b482531448f2 100644 +--- a/include/linux/migrate.h ++++ b/include/linux/migrate.h +@@ -135,6 +135,9 @@ static inline unsigned long migrate_pfn(unsigned long pfn) + enum migrate_vma_direction { + MIGRATE_VMA_SELECT_SYSTEM = 1 << 0, + MIGRATE_VMA_SELECT_DEVICE_PRIVATE = 1 << 1, ++#ifndef __GENKSYMS__ ++ MIGRATE_VMA_FAULT_PAGE = 1 << 2, ++#endif + }; + + struct migrate_vma { +@@ -169,9 +172,24 @@ struct migrate_vma { + * Set to vmf->page if this is being called to migrate a page as part of + * a migrate_to_ram() callback. + */ +- struct page *fault_page; ++#ifndef __GENKSYMS__ ++ struct page *__fault_page; ++#endif + }; + ++/* ++ * KABI workaround for third-party modules built with struct migrate_vma ++ * definition without the new fault_page field. Only touch the field if it's ++ */ ++static inline struct page * ++migrate_vma_fault_page(struct migrate_vma *migrate_vma) ++{ ++ if (migrate_vma->flags & MIGRATE_VMA_FAULT_PAGE) ++ return migrate_vma->__fault_page; ++ ++ return NULL; ++} ++ + int migrate_vma_setup(struct migrate_vma *args); + void migrate_vma_pages(struct migrate_vma *migrate); + void migrate_vma_finalize(struct migrate_vma *migrate); +diff --git a/lib/test_hmm.c b/lib/test_hmm.c +index f24d36a54967..240f7a74ee35 100644 +--- a/lib/test_hmm.c ++++ b/lib/test_hmm.c +@@ -1168,8 +1168,8 @@ static vm_fault_t dmirror_devmem_fault(struct vm_fault *vmf) + args.src = &src_pfns; + args.dst = &dst_pfns; + args.pgmap_owner = dmirror->mdevice; +- args.flags = MIGRATE_VMA_SELECT_DEVICE_PRIVATE; +- args.fault_page = vmf->page; ++ args.flags = MIGRATE_VMA_SELECT_DEVICE_PRIVATE | MIGRATE_VMA_FAULT_PAGE; ++ args.__fault_page = vmf->page; + + if (migrate_vma_setup(&args)) + return VM_FAULT_SIGBUS; +diff --git a/mm/memory.c b/mm/memory.c +index ce6111409a6a..dcbe7688f129 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -3490,6 +3490,8 @@ vm_fault_t do_swap_page(struct vm_fault *vmf) + vmf->page = pfn_swap_entry_to_page(entry); + ret = remove_device_exclusive_entry(vmf); + } else if (is_device_private_entry(entry)) { ++ bool pgmap_has_fault_page; ++ + vmf->page = pfn_swap_entry_to_page(entry); + vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd, + vmf->address, &vmf->ptl); +@@ -3502,10 +3504,13 @@ vm_fault_t do_swap_page(struct vm_fault *vmf) + * Get a page reference while we know the page can't be + * freed. + */ +- get_page(vmf->page); ++ pgmap_has_fault_page = vmf->page->pgmap->flags & PGMAP_MIGRATE_VMA_FAULT_PAGE; ++ if (pgmap_has_fault_page) ++ get_page(vmf->page); + pte_unmap_unlock(vmf->pte, vmf->ptl); + ret = vmf->page->pgmap->ops->migrate_to_ram(vmf); +- put_page(vmf->page); ++ if (pgmap_has_fault_page) ++ put_page(vmf->page); + } else if (is_hwpoison_entry(entry)) { + ret = VM_FAULT_HWPOISON; + } else { +diff --git a/mm/migrate.c b/mm/migrate.c +index 22f3b0bf4baf..a5a8118a1c49 100644 +--- a/mm/migrate.c ++++ b/mm/migrate.c +@@ -2511,7 +2511,7 @@ static void migrate_vma_prepare(struct migrate_vma *migrate) + put_page(page); + } + +- if (!migrate_vma_check_page(page, migrate->fault_page)) { ++ if (!migrate_vma_check_page(page, migrate_vma_fault_page(migrate))) { + if (remap) { + migrate->src[i] &= ~MIGRATE_PFN_MIGRATE; + migrate->cpages--; +@@ -2578,7 +2578,7 @@ static void migrate_vma_unmap(struct migrate_vma *migrate) + goto restore; + } + +- if (migrate_vma_check_page(page, migrate->fault_page)) ++ if (migrate_vma_check_page(page, migrate_vma_fault_page(migrate))) + continue; + + restore: +@@ -2673,6 +2673,7 @@ static void migrate_vma_unmap(struct migrate_vma *migrate) + int migrate_vma_setup(struct migrate_vma *args) + { + long nr_pages = (args->end - args->start) >> PAGE_SHIFT; ++ struct page *fault_page; + + args->start &= PAGE_MASK; + args->end &= PAGE_MASK; +@@ -2688,7 +2689,8 @@ int migrate_vma_setup(struct migrate_vma *args) + return -EINVAL; + if (!args->src || !args->dst) + return -EINVAL; +- if (args->fault_page && !is_device_private_page(args->fault_page)) ++ fault_page = migrate_vma_fault_page(args); ++ if (fault_page && !is_device_private_page(fault_page)) + return -EINVAL; + + memset(args->src, 0, sizeof(*args->src) * nr_pages); +@@ -2922,7 +2924,7 @@ void migrate_vma_pages(struct migrate_vma *migrate) + } + } + +- if (migrate->fault_page == page) ++ if (migrate_vma_fault_page(migrate) == page) + r = migrate_page_extra(mapping, newpage, page, + MIGRATE_SYNC_NO_COPY, 1); + else +-- +2.39.2 + diff --git a/patches.kabi/struct-uvc_device-move-flush_status-new-member-to-en.patch b/patches.kabi/struct-uvc_device-move-flush_status-new-member-to-en.patch new file mode 100644 index 0000000..c165211 --- /dev/null +++ b/patches.kabi/struct-uvc_device-move-flush_status-new-member-to-en.patch @@ -0,0 +1,37 @@ +From ca22149d7f95989a2f29a289bb9c339db9a29d46 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Tue, 7 Mar 2023 13:38:30 +0100 +Subject: [PATCH] struct uvc_device move flush_status new member to end +Patch-mainline: Never (kABI fixup) +References: git-fixes + +Signed-off-by: Oliver Neukum +--- + drivers/media/usb/uvc/uvcvideo.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h +index 74eade782..73dccb5c7 100644 +--- a/drivers/media/usb/uvc/uvcvideo.h ++++ b/drivers/media/usb/uvc/uvcvideo.h +@@ -698,7 +698,6 @@ struct uvc_device { + struct usb_host_endpoint *int_ep; + struct urb *int_urb; + u8 *status; +- bool flush_status; + struct input_dev *input; + char input_phys[64]; + +@@ -711,6 +710,9 @@ struct uvc_device { + } async_ctrl; + + struct uvc_entity *gpio_unit; ++#ifndef __GENKSYMS__ ++ bool flush_status; ++#endif + }; + + enum uvc_handle_state { +-- +2.39.2 + diff --git a/patches.suse/0001-drm-i915-gvt-fix-double-free-bug-in-split_2MB_gtt_en.patch b/patches.suse/0001-drm-i915-gvt-fix-double-free-bug-in-split_2MB_gtt_en.patch index f5427ba..436b62b 100644 --- a/patches.suse/0001-drm-i915-gvt-fix-double-free-bug-in-split_2MB_gtt_en.patch +++ b/patches.suse/0001-drm-i915-gvt-fix-double-free-bug-in-split_2MB_gtt_en.patch @@ -2,7 +2,8 @@ From ae6f406c15c59cc611d6182c90bc42082fe64a27 Mon Sep 17 00:00:00 2001 From: Zheng Wang Date: Fri, 7 Oct 2022 09:37:08 +0800 Subject: drm/i915/gvt: fix double free bug in split_2MB_gtt_entry -Patch-mainline: Submitted, https://lore.kernel.org/dri-devel/20221007013708.1946061-1-zyytlz.wz@163.com/ +Git-commit: 4a61648af68f5ba4884f0e3b494ee1cabc4b6620 +Patch-mainline: v6.2-rc3 References: bsc#1204780, CVE-2022-3707 If intel_gvt_dma_map_guest_page failed, it will call diff --git a/patches.suse/ACPI-NFIT-fix-a-potential-deadlock-during-NFIT-teard.patch b/patches.suse/ACPI-NFIT-fix-a-potential-deadlock-during-NFIT-teard.patch new file mode 100644 index 0000000..89e4993 --- /dev/null +++ b/patches.suse/ACPI-NFIT-fix-a-potential-deadlock-during-NFIT-teard.patch @@ -0,0 +1,75 @@ +From fb6df4366f86dd252bfa3049edffa52d17e7b895 Mon Sep 17 00:00:00 2001 +From: Vishal Verma +Date: Wed, 25 Jan 2023 11:34:18 -0700 +Subject: [PATCH] ACPI: NFIT: fix a potential deadlock during NFIT teardown +Git-commit: fb6df4366f86dd252bfa3049edffa52d17e7b895 +Patch-mainline: v6.2-rc8 +References: git-fixes + +Lockdep reports that acpi_nfit_shutdown() may deadlock against an +opportune acpi_nfit_scrub(). acpi_nfit_scrub () is run from inside a +'work' and therefore has already acquired workqueue-internal locks. It +also acquiires acpi_desc->init_mutex. acpi_nfit_shutdown() first +acquires init_mutex, and was subsequently attempting to cancel any +pending workqueue items. This reversed locking order causes a potential +Deadlock: + + ====================================================== + WARNING: possible circular locking dependency detected + 6.2.0-rc3 #116 Tainted: G O N + ------------------------------------------------------ + libndctl/1958 is trying to acquire lock: + ffff888129b461c0 ((work_completion)(&(&acpi_desc->dwork)->work)){+.+.}-{0:0}, at: __flush_work+0x43/0x450 + + but task is already holding lock: + ffff888129b460e8 (&acpi_desc->init_mutex){+.+.}-{3:3}, at: acpi_nfit_shutdown+0x87/0xd0 [nfit] + + which lock already depends on the new lock. + + ... + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&acpi_desc->init_mutex); + lock((work_completion)(&(&acpi_desc->dwork)->work)); + lock(&acpi_desc->init_mutex); + lock((work_completion)(&(&acpi_desc->dwork)->work)); + + *** DEADLOCK *** + +Since the workqueue manipulation is protected by its own internal locking, +the cancellation of pending work doesn't need to be done under +acpi_desc->init_mutex. Move cancel_delayed_work_sync() outside the +init_mutex to fix the deadlock. Any work that starts after +acpi_nfit_shutdown() drops the lock will see ARS_CANCEL, and the +cancel_delayed_work_sync() will safely flush it out. + +Reported-by: Dan Williams +Signed-off-by: Vishal Verma +Link: https://lore.kernel.org/r/20230112-acpi_nfit_lockdep-v1-1-660be4dd10be@intel.com +Signed-off-by: Dan Williams +Acked-by: Takashi Iwai + +--- + drivers/acpi/nfit/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index f1cc5ec6a3b6..4e48d6db05eb 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -3297,8 +3297,8 @@ void acpi_nfit_shutdown(void *data) + + mutex_lock(&acpi_desc->init_mutex); + set_bit(ARS_CANCEL, &acpi_desc->scrub_flags); +- cancel_delayed_work_sync(&acpi_desc->dwork); + mutex_unlock(&acpi_desc->init_mutex); ++ cancel_delayed_work_sync(&acpi_desc->dwork); + + /* + * Bounce the nvdimm bus lock to make sure any in-flight +-- +2.35.3 + diff --git a/patches.suse/ACPI-battery-Fix-missing-NUL-termination-with-large-.patch b/patches.suse/ACPI-battery-Fix-missing-NUL-termination-with-large-.patch new file mode 100644 index 0000000..abcfd0c --- /dev/null +++ b/patches.suse/ACPI-battery-Fix-missing-NUL-termination-with-large-.patch @@ -0,0 +1,44 @@ +From f2ac14b5f197e4a2dec51e5ceaa56682ff1592bc Mon Sep 17 00:00:00 2001 +From: Armin Wolf +Date: Sat, 14 Jan 2023 09:50:50 +0100 +Subject: [PATCH] ACPI: battery: Fix missing NUL-termination with large strings +Git-commit: f2ac14b5f197e4a2dec51e5ceaa56682ff1592bc +Patch-mainline: v6.3-rc1 +References: git-fixes + +When encountering a string bigger than the destination buffer (32 bytes), +the string is not properly NUL-terminated, causing buffer overreads later. + +This for example happens on the Inspiron 3505, where the battery +model name is larger than 32 bytes, which leads to sysfs showing +the model name together with the serial number string (which is +NUL-terminated and thus prevents worse). + +Fix this by using strscpy() which ensures that the result is +always NUL-terminated. + +Fixes: 106449e870b3 ("ACPI: Battery: Allow extract string from integer") +Signed-off-by: Armin Wolf +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/acpi/battery.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c +index f4badcdde76e..fb64bd217d82 100644 +--- a/drivers/acpi/battery.c ++++ b/drivers/acpi/battery.c +@@ -440,7 +440,7 @@ static int extract_package(struct acpi_battery *battery, + + if (element->type == ACPI_TYPE_STRING || + element->type == ACPI_TYPE_BUFFER) +- strncpy(ptr, element->string.pointer, 32); ++ strscpy(ptr, element->string.pointer, 32); + else if (element->type == ACPI_TYPE_INTEGER) { + strncpy(ptr, (u8 *)&element->integer.value, + sizeof(u64)); +-- +2.35.3 + diff --git a/patches.suse/ACPI-x86-Add-support-for-LPS0-callback-handler.patch b/patches.suse/ACPI-x86-Add-support-for-LPS0-callback-handler.patch new file mode 100644 index 0000000..36c774d --- /dev/null +++ b/patches.suse/ACPI-x86-Add-support-for-LPS0-callback-handler.patch @@ -0,0 +1,130 @@ +From 20e1d6402a71dba7ad2b81f332a3c14c7d3b939b Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Thu, 17 Mar 2022 09:14:42 -0500 +Subject: [PATCH] ACPI / x86: Add support for LPS0 callback handler +Git-commit: 20e1d6402a71dba7ad2b81f332a3c14c7d3b939b +Patch-mainline: v5.18-rc1 +References: git-fixes + +Currenty the latest thing run during a suspend to idle attempt is +the LPS0 `prepare_late` callback and the earliest thing is the +`resume_early` callback. + +There is a desire for the `amd-pmc` driver to suspend later in the +suspend process (ideally the very last thing), so create a callback +that it or any other driver can hook into to do this. + +Signed-off-by: Mario Limonciello +Acked-by: Rafael J. Wysocki +Link: https://lore.kernel.org/r/20220317141445.6498-1-mario.limonciello@amd.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Acked-by: Takashi Iwai + +--- + drivers/acpi/x86/s2idle.c | 40 +++++++++++++++++++++++++++++++++++++++ + include/linux/acpi.h | 10 +++++++++- + 2 files changed, 49 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/x86/s2idle.c b/drivers/acpi/x86/s2idle.c +index abc06e7f89d8..031b20a547f9 100644 +--- a/drivers/acpi/x86/s2idle.c ++++ b/drivers/acpi/x86/s2idle.c +@@ -86,6 +86,8 @@ struct lpi_device_constraint_amd { + int min_dstate; + }; + ++static LIST_HEAD(lps0_s2idle_devops_head); ++ + static struct lpi_constraints *lpi_constraints_table; + static int lpi_constraints_table_size; + static int rev_id; +@@ -444,6 +446,8 @@ static struct acpi_scan_handler lps0_handler = { + + int acpi_s2idle_prepare_late(void) + { ++ struct acpi_s2idle_dev_ops *handler; ++ + if (!lps0_device_handle || sleep_no_lps0) + return 0; + +@@ -474,14 +478,26 @@ int acpi_s2idle_prepare_late(void) + acpi_sleep_run_lps0_dsm(ACPI_LPS0_MS_ENTRY, + lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft); + } ++ ++ list_for_each_entry(handler, &lps0_s2idle_devops_head, list_node) { ++ if (handler->prepare) ++ handler->prepare(); ++ } ++ + return 0; + } + + void acpi_s2idle_restore_early(void) + { ++ struct acpi_s2idle_dev_ops *handler; ++ + if (!lps0_device_handle || sleep_no_lps0) + return; + ++ list_for_each_entry(handler, &lps0_s2idle_devops_head, list_node) ++ if (handler->restore) ++ handler->restore(); ++ + /* Modern standby exit */ + if (lps0_dsm_func_mask_microsoft > 0) + acpi_sleep_run_lps0_dsm(ACPI_LPS0_MS_EXIT, +@@ -524,4 +540,28 @@ void acpi_s2idle_setup(void) + s2idle_set_ops(&acpi_s2idle_ops_lps0); + } + ++int acpi_register_lps0_dev(struct acpi_s2idle_dev_ops *arg) ++{ ++ if (!lps0_device_handle || sleep_no_lps0) ++ return -ENODEV; ++ ++ lock_system_sleep(); ++ list_add(&arg->list_node, &lps0_s2idle_devops_head); ++ unlock_system_sleep(); ++ ++ return 0; ++} ++EXPORT_SYMBOL_GPL(acpi_register_lps0_dev); ++ ++void acpi_unregister_lps0_dev(struct acpi_s2idle_dev_ops *arg) ++{ ++ if (!lps0_device_handle || sleep_no_lps0) ++ return; ++ ++ lock_system_sleep(); ++ list_del(&arg->list_node); ++ unlock_system_sleep(); ++} ++EXPORT_SYMBOL_GPL(acpi_unregister_lps0_dev); ++ + #endif /* CONFIG_SUSPEND */ +diff --git a/include/linux/acpi.h b/include/linux/acpi.h +index 6274758648e3..47c16cdc8e0e 100644 +--- a/include/linux/acpi.h ++++ b/include/linux/acpi.h +@@ -1023,7 +1023,15 @@ void acpi_os_set_prepare_extended_sleep(int (*func)(u8 sleep_state, + + acpi_status acpi_os_prepare_extended_sleep(u8 sleep_state, + u32 val_a, u32 val_b); +- ++#ifdef CONFIG_X86 ++struct acpi_s2idle_dev_ops { ++ struct list_head list_node; ++ void (*prepare)(void); ++ void (*restore)(void); ++}; ++int acpi_register_lps0_dev(struct acpi_s2idle_dev_ops *arg); ++void acpi_unregister_lps0_dev(struct acpi_s2idle_dev_ops *arg); ++#endif /* CONFIG_X86 */ + #ifndef CONFIG_IA64 + void arch_reserve_mem_area(acpi_physical_address addr, size_t size); + #else +-- +2.35.3 + diff --git a/patches.suse/ACPICA-Drop-port-I-O-validation-for-some-regions.patch b/patches.suse/ACPICA-Drop-port-I-O-validation-for-some-regions.patch new file mode 100644 index 0000000..18bb205 --- /dev/null +++ b/patches.suse/ACPICA-Drop-port-I-O-validation-for-some-regions.patch @@ -0,0 +1,75 @@ +From e1d9148582ab2c3dada5c5cf8ca7531ca269fee5 Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Thu, 15 Dec 2022 09:51:20 -0600 +Subject: [PATCH] ACPICA: Drop port I/O validation for some regions +Git-commit: e1d9148582ab2c3dada5c5cf8ca7531ca269fee5 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Microsoft introduced support in Windows XP for blocking port I/O +to various regions. For Windows compatibility ACPICA has adopted +the same protections and will disallow writes to those +(presumably) the same regions. + +On some systems the AML included with the firmware will issue 4 byte +long writes to 0x80. These writes aren't making it over because of this +blockage. The first 4 byte write attempt is rejected, and then +subsequently 1 byte at a time each offset is tried. The first at 0x80 +works, but then the next 3 bytes are rejected. + +This manifests in bizarre failures for devices that expected the AML to +write all 4 bytes. Trying the same AML on Windows 10 or 11 doesn't hit +this failure and all 4 bytes are written. + +Either some of these regions were wrong or some point after Windows XP +some of these regions blocks have been lifted. + +In the last 15 years there doesn't seem to be any reports popping up of +this error in the Windows event viewer anymore. There is no documentation +at Microsoft's developer site indicating that Windows ACPI interpreter +blocks these regions. Between the lack of documentation and the fact that +the writes actually do work in Windows 10 and 11, it's quite likely +Windows doesn't actually enforce this anymore. + +So to help the issue, only enforce Windows XP specific entries if the +latest _OSI supported is Windows XP. Continue to enforce the +ALWAYS_ILLEGAL entries. + +Link: https://github.com/acpica/acpica/pull/817 +Fixes: 7f0719039085 ("ACPICA: New: I/O port protection") +Signed-off-by: Mario Limonciello +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/acpi/acpica/hwvalid.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/acpi/acpica/hwvalid.c b/drivers/acpi/acpica/hwvalid.c +index 915b26448d2c..0d392e7b0747 100644 +--- a/drivers/acpi/acpica/hwvalid.c ++++ b/drivers/acpi/acpica/hwvalid.c +@@ -23,8 +23,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width); + * + * The table is used to implement the Microsoft port access rules that + * first appeared in Windows XP. Some ports are always illegal, and some +- * ports are only illegal if the BIOS calls _OSI with a win_XP string or +- * later (meaning that the BIOS itelf is post-XP.) ++ * ports are only illegal if the BIOS calls _OSI with nothing newer than ++ * the specific _OSI strings. + * + * This provides ACPICA with the desired port protections and + * Microsoft compatibility. +@@ -145,7 +145,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width) + + /* Port illegality may depend on the _OSI calls made by the BIOS */ + +- if (acpi_gbl_osi_data >= port_info->osi_dependency) { ++ if (port_info->osi_dependency == ACPI_ALWAYS_ILLEGAL || ++ acpi_gbl_osi_data == port_info->osi_dependency) { + ACPI_DEBUG_PRINT((ACPI_DB_VALUES, + "Denied AML access to port 0x%8.8X%8.8X/%X (%s 0x%.4X-0x%.4X)\n", + ACPI_FORMAT_UINT64(address), +-- +2.35.3 + diff --git a/patches.suse/ACPICA-nsrepair-handle-cases-without-a-return-value-.patch b/patches.suse/ACPICA-nsrepair-handle-cases-without-a-return-value-.patch new file mode 100644 index 0000000..9012d82 --- /dev/null +++ b/patches.suse/ACPICA-nsrepair-handle-cases-without-a-return-value-.patch @@ -0,0 +1,65 @@ +From ca843a4c79486e99a19b859ef0b9887854afe146 Mon Sep 17 00:00:00 2001 +From: Daniil Tatianin +Date: Sat, 7 Jan 2023 02:53:08 +0300 +Subject: [PATCH] ACPICA: nsrepair: handle cases without a return value correctly +Git-commit: ca843a4c79486e99a19b859ef0b9887854afe146 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Previously acpi_ns_simple_repair() would crash if expected_btypes +contained any combination of ACPI_RTYPE_NONE with a different type, +e.g | ACPI_RTYPE_INTEGER because of slightly incorrect logic in the +!return_object branch, which wouldn't return AE_AML_NO_RETURN_VALUE +for such cases. + +Found by Linux Verification Center (linuxtesting.org) with the SVACE +static analysis tool. + +Link: https://github.com/acpica/acpica/pull/811 +Fixes: 61db45ca2163 ("ACPICA: Restore code that repairs NULL package elements in return values.") +Signed-off-by: Daniil Tatianin +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/acpi/acpica/nsrepair.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/acpi/acpica/nsrepair.c b/drivers/acpi/acpica/nsrepair.c +index 367fcd201f96..ec512e06a48e 100644 +--- a/drivers/acpi/acpica/nsrepair.c ++++ b/drivers/acpi/acpica/nsrepair.c +@@ -181,8 +181,9 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info, + * Try to fix if there was no return object. Warning if failed to fix. + */ + if (!return_object) { +- if (expected_btypes && (!(expected_btypes & ACPI_RTYPE_NONE))) { +- if (package_index != ACPI_NOT_PACKAGE_ELEMENT) { ++ if (expected_btypes) { ++ if (!(expected_btypes & ACPI_RTYPE_NONE) && ++ package_index != ACPI_NOT_PACKAGE_ELEMENT) { + ACPI_WARN_PREDEFINED((AE_INFO, + info->full_pathname, + ACPI_WARN_ALWAYS, +@@ -196,14 +197,15 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info, + if (ACPI_SUCCESS(status)) { + return (AE_OK); /* Repair was successful */ + } +- } else { ++ } ++ ++ if (expected_btypes != ACPI_RTYPE_NONE) { + ACPI_WARN_PREDEFINED((AE_INFO, + info->full_pathname, + ACPI_WARN_ALWAYS, + "Missing expected return value")); ++ return (AE_AML_NO_RETURN_VALUE); + } +- +- return (AE_AML_NO_RETURN_VALUE); + } + } + +-- +2.35.3 + diff --git a/patches.suse/ALSA-hda-Do-not-unset-preset-when-cleaning-up-codec.patch b/patches.suse/ALSA-hda-Do-not-unset-preset-when-cleaning-up-codec.patch new file mode 100644 index 0000000..e503b76 --- /dev/null +++ b/patches.suse/ALSA-hda-Do-not-unset-preset-when-cleaning-up-codec.patch @@ -0,0 +1,70 @@ +From 87978e6ad45a16835cc58234451111091be3c59a Mon Sep 17 00:00:00 2001 +From: Cezary Rojewski +Date: Thu, 19 Jan 2023 15:32:35 +0100 +Subject: [PATCH] ALSA: hda: Do not unset preset when cleaning up codec +Git-commit: 87978e6ad45a16835cc58234451111091be3c59a +Patch-mainline: v6.2-rc7 +References: git-fixes + +Several functions that take part in codec's initialization and removal +are re-used by ASoC codec drivers implementations. Drivers mimic the +behavior of hda_codec_driver_probe/remove() found in +sound/pci/hda/hda_bind.c with their component->probe/remove() instead. + +One of the reasons for that is the expectation of +snd_hda_codec_device_new() to receive a valid pointer to an instance of +struct snd_card. This expectation can be met only once sound card +components probing commences. + +As ASoC sound card may be unbound without codec device being actually +removed from the system, unsetting ->preset in +snd_hda_codec_cleanup_for_unbind() interferes with module unload -> load +scenario causing null-ptr-deref. Preset is assigned only once, during +device/driver matching whereas ASoC codec driver's module reloading may +occur several times throughout the lifetime of an audio stack. + +Suggested-by: Takashi Iwai +Signed-off-by: Cezary Rojewski +Link: https://lore.kernel.org/r/20230119143235.1159814-1-cezary.rojewski@intel.com +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/hda_bind.c | 2 ++ + sound/pci/hda/hda_codec.c | 1 - + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c +index 1a868dd9dc4b..890c2f7c33fc 100644 +--- a/sound/pci/hda/hda_bind.c ++++ b/sound/pci/hda/hda_bind.c +@@ -144,6 +144,7 @@ static int hda_codec_driver_probe(struct device *dev) + + error: + snd_hda_codec_cleanup_for_unbind(codec); ++ codec->preset = NULL; + return err; + } + +@@ -166,6 +167,7 @@ static int hda_codec_driver_remove(struct device *dev) + if (codec->patch_ops.free) + codec->patch_ops.free(codec); + snd_hda_codec_cleanup_for_unbind(codec); ++ codec->preset = NULL; + module_put(dev->driver->owner); + return 0; + } +diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c +index edd653ece70d..ac1cc7c5290e 100644 +--- a/sound/pci/hda/hda_codec.c ++++ b/sound/pci/hda/hda_codec.c +@@ -795,7 +795,6 @@ void snd_hda_codec_cleanup_for_unbind(struct hda_codec *codec) + snd_array_free(&codec->cvt_setups); + snd_array_free(&codec->spdif_out); + snd_array_free(&codec->verbs); +- codec->preset = NULL; + codec->follower_dig_outs = NULL; + codec->spdif_status_reset = 0; + snd_array_free(&codec->mixers); +-- +2.35.3 + diff --git a/patches.suse/ALSA-hda-ca0132-minor-fix-for-allocation-size.patch b/patches.suse/ALSA-hda-ca0132-minor-fix-for-allocation-size.patch new file mode 100644 index 0000000..8b3eb30 --- /dev/null +++ b/patches.suse/ALSA-hda-ca0132-minor-fix-for-allocation-size.patch @@ -0,0 +1,39 @@ +From 3ee0fe7fa39b14d1cea455b7041f2df933bd97d2 Mon Sep 17 00:00:00 2001 +From: "Alexey V. Vissarionov" +Date: Tue, 17 Jan 2023 14:15:23 +0300 +Subject: [PATCH] ALSA: hda/ca0132: minor fix for allocation size +Git-commit: 3ee0fe7fa39b14d1cea455b7041f2df933bd97d2 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Although the "dma_chan" pointer occupies more or equal space compared +to "*dma_chan", the allocation size should use the size of variable +itself. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 01ef7dbffb41 ("ALSA: hda - Update CA0132 codec to load DSP firmware binary") +Signed-off-by: Alexey V. Vissarionov +Link: https://lore.kernel.org/r/20230117111522.GA15213@altlinux.org +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_ca0132.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c +index 0a292bf271f2..acde4cd58785 100644 +--- a/sound/pci/hda/patch_ca0132.c ++++ b/sound/pci/hda/patch_ca0132.c +@@ -2455,7 +2455,7 @@ static int dspio_set_uint_param(struct hda_codec *codec, int mod_id, + static int dspio_alloc_dma_chan(struct hda_codec *codec, unsigned int *dma_chan) + { + int status = 0; +- unsigned int size = sizeof(dma_chan); ++ unsigned int size = sizeof(*dma_chan); + + codec_dbg(codec, " dspio_alloc_dma_chan() -- begin\n"); + status = dspio_scp(codec, MASTERCONTROL, 0x20, +-- +2.35.3 + diff --git a/patches.suse/ALSA-hda-conexant-add-a-new-hda-codec-SN6180.patch b/patches.suse/ALSA-hda-conexant-add-a-new-hda-codec-SN6180.patch new file mode 100644 index 0000000..c499b0e --- /dev/null +++ b/patches.suse/ALSA-hda-conexant-add-a-new-hda-codec-SN6180.patch @@ -0,0 +1,35 @@ +From 18d7e16c917a08f08778ecf2b780d63648d5d923 Mon Sep 17 00:00:00 2001 +From: Bo Liu +Date: Thu, 9 Feb 2023 10:13:48 +0800 +Subject: [PATCH] ALSA: hda/conexant: add a new hda codec SN6180 +Git-commit: 18d7e16c917a08f08778ecf2b780d63648d5d923 +Patch-mainline: v6.2 +References: git-fixes + +The current kernel does not support the SN6180 codec chip. +Add the SN6180 codec configuration item to kernel. + +Signed-off-by: Bo Liu +Cc: +Link: https://lore.kernel.org/r/1675908828-1012-1-git-send-email-bo.liu@senarytech.com +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_conexant.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index 7b1a30a551f6..75e1d00074b9 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -1125,6 +1125,7 @@ static const struct hda_device_id snd_hda_id_conexant[] = { + HDA_CODEC_ENTRY(0x14f11f87, "SN6140", patch_conexant_auto), + HDA_CODEC_ENTRY(0x14f12008, "CX8200", patch_conexant_auto), + HDA_CODEC_ENTRY(0x14f120d0, "CX11970", patch_conexant_auto), ++ HDA_CODEC_ENTRY(0x14f120d1, "SN6180", patch_conexant_auto), + HDA_CODEC_ENTRY(0x14f15045, "CX20549 (Venice)", patch_conexant_auto), + HDA_CODEC_ENTRY(0x14f15047, "CX20551 (Waikiki)", patch_conexant_auto), + HDA_CODEC_ENTRY(0x14f15051, "CX20561 (Hermosa)", patch_conexant_auto), +-- +2.35.3 + diff --git a/patches.suse/ALSA-hda-realtek-fixed-wrong-gpio-assigned.patch b/patches.suse/ALSA-hda-realtek-fixed-wrong-gpio-assigned.patch new file mode 100644 index 0000000..ccd7716 --- /dev/null +++ b/patches.suse/ALSA-hda-realtek-fixed-wrong-gpio-assigned.patch @@ -0,0 +1,36 @@ +From 2bdccfd290d421b50df4ec6a68d832dad1310748 Mon Sep 17 00:00:00 2001 +From: Kailang Yang +Date: Mon, 13 Feb 2023 14:54:22 +0800 +Subject: [PATCH] ALSA: hda/realtek - fixed wrong gpio assigned +Git-commit: 2bdccfd290d421b50df4ec6a68d832dad1310748 +Patch-mainline: v6.2 +References: git-fixes + +GPIO2 PIN use for output. Mask Dir and Data need to assign for 0x4. Not 0x3. +This fixed was for Lenovo Desktop(0x17aa1056). GPIO2 use for AMP enable. + +Signed-off-by: Kailang Yang +Cc: +Link: https://lore.kernel.org/r/8d02bb9ac8134f878cd08607fdf088fd@realtek.com +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/patch_realtek.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 1134a493d225..14b84a1f43d3 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -832,7 +832,7 @@ static int alc_subsystem_id(struct hda_codec *codec, const hda_nid_t *ports) + alc_setup_gpio(codec, 0x02); + break; + case 7: +- alc_setup_gpio(codec, 0x03); ++ alc_setup_gpio(codec, 0x04); + break; + case 5: + default: +-- +2.35.3 + diff --git a/patches.suse/ALSA-ice1712-Delete-unreachable-code-in-aureon_add_c.patch b/patches.suse/ALSA-ice1712-Delete-unreachable-code-in-aureon_add_c.patch new file mode 100644 index 0000000..86044c3 --- /dev/null +++ b/patches.suse/ALSA-ice1712-Delete-unreachable-code-in-aureon_add_c.patch @@ -0,0 +1,41 @@ +From a8e98f3448e1a4b6848f213cf51720e29dcc774b Mon Sep 17 00:00:00 2001 +From: Dmitry Fomin +Date: Sat, 25 Feb 2023 21:43:22 +0300 +Subject: [PATCH] ALSA: ice1712: Delete unreachable code in aureon_add_controls() +Git-commit: a8e98f3448e1a4b6848f213cf51720e29dcc774b +Patch-mainline: v6.3-rc1 +References: git-fixes + +If the check (id != 0x41) fails, then id == 0x41 and +the other check in 'else' branch also +Fails: id & 0x0F = 0b01000001 & 0b00001111 = 0b00000001. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Dmitry Fomin +Link: https://lore.kernel.org/r/20230225184322.6286-2-fomindmitriyfoma@mail.ru +Signed-off-by: Takashi Iwai + +--- + sound/pci/ice1712/aureon.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/sound/pci/ice1712/aureon.c b/sound/pci/ice1712/aureon.c +index 40a0e0095030..24b978234000 100644 +--- a/sound/pci/ice1712/aureon.c ++++ b/sound/pci/ice1712/aureon.c +@@ -1896,10 +1896,6 @@ static int aureon_add_controls(struct snd_ice1712 *ice) + if (id != 0x41) + dev_info(ice->card->dev, + "No CS8415 chip. Skipping CS8415 controls.\n"); +- else if ((id & 0x0F) != 0x01) +- dev_info(ice->card->dev, +- "Detected unsupported CS8415 rev. (%c)\n", +- (char)((id & 0x0F) + 'A' - 1)); + else { + for (i = 0; i < ARRAY_SIZE(cs8415_controls); i++) { + struct snd_kcontrol *kctl; +-- +2.35.3 + diff --git a/patches.suse/ALSA-ice1712-Do-not-left-ice-gpio_mutex-locked-in-au.patch b/patches.suse/ALSA-ice1712-Do-not-left-ice-gpio_mutex-locked-in-au.patch new file mode 100644 index 0000000..c64d9e7 --- /dev/null +++ b/patches.suse/ALSA-ice1712-Do-not-left-ice-gpio_mutex-locked-in-au.patch @@ -0,0 +1,52 @@ +From 951606a14a8901e3551fe4d8d3cedd73fe954ce1 Mon Sep 17 00:00:00 2001 +From: Dmitry Fomin +Date: Sat, 25 Feb 2023 21:43:21 +0300 +Subject: [PATCH] ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls() +Git-commit: 951606a14a8901e3551fe4d8d3cedd73fe954ce1 +Patch-mainline: v6.3-rc1 +References: git-fixes + +If snd_ctl_add() fails in aureon_add_controls(), it immediately returns +and leaves ice->gpio_mutex locked. ice->gpio_mutex locks in +snd_ice1712_save_gpio_status and unlocks in +snd_ice1712_restore_gpio_status(ice). + +It seems that the mutex is required only for aureon_cs8415_get(), +so snd_ice1712_restore_gpio_status(ice) can be placed +just after that. Compile tested only. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Dmitry Fomin +Cc: +Link: https://lore.kernel.org/r/20230225184322.6286-1-fomindmitriyfoma@mail.ru +Signed-off-by: Takashi Iwai + +--- + sound/pci/ice1712/aureon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/ice1712/aureon.c b/sound/pci/ice1712/aureon.c +index 9a30f6d35d13..40a0e0095030 100644 +--- a/sound/pci/ice1712/aureon.c ++++ b/sound/pci/ice1712/aureon.c +@@ -1892,6 +1892,7 @@ static int aureon_add_controls(struct snd_ice1712 *ice) + unsigned char id; + snd_ice1712_save_gpio_status(ice); + id = aureon_cs8415_get(ice, CS8415_ID); ++ snd_ice1712_restore_gpio_status(ice); + if (id != 0x41) + dev_info(ice->card->dev, + "No CS8415 chip. Skipping CS8415 controls.\n"); +@@ -1909,7 +1910,6 @@ static int aureon_add_controls(struct snd_ice1712 *ice) + kctl->id.device = ice->pcm->device; + } + } +- snd_ice1712_restore_gpio_status(ice); + } + + return 0; +-- +2.35.3 + diff --git a/patches.suse/ARM-OMAP1-call-platform_device_put-in-error-case-in-.patch b/patches.suse/ARM-OMAP1-call-platform_device_put-in-error-case-in-.patch new file mode 100644 index 0000000..7f5fee8 --- /dev/null +++ b/patches.suse/ARM-OMAP1-call-platform_device_put-in-error-case-in-.patch @@ -0,0 +1,38 @@ +From 0414a100d6ab32721efa70ab55524540fdfe0ede Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Thu, 19 Jan 2023 11:57:54 +0200 +Subject: [PATCH] ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init() +Git-commit: 0414a100d6ab32721efa70ab55524540fdfe0ede +Patch-mainline: v6.3-rc1 +References: git-fixes + +If platform_device_add() is not called or failed, it should call +platform_device_put() in error case. + +Fixes: 97933d6ced60 ("ARM: OMAP1: dmtimer: conversion to platform devices") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Message-id: <20220701094602.2365099-1-yangyingliang@huawei.com> +Signed-off-by: Tony Lindgren +Acked-by: Takashi Iwai + +--- + arch/arm/mach-omap1/timer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/mach-omap1/timer.c b/arch/arm/mach-omap1/timer.c +index f5cd4bbf7566..81a912c1145a 100644 +--- a/arch/arm/mach-omap1/timer.c ++++ b/arch/arm/mach-omap1/timer.c +@@ -158,7 +158,7 @@ static int __init omap1_dm_timer_init(void) + kfree(pdata); + + err_free_pdev: +- platform_device_unregister(pdev); ++ platform_device_put(pdev); + + return ret; + } +-- +2.35.3 + diff --git a/patches.suse/ARM-OMAP2-Fix-memory-leak-in-realtime_counter_init.patch b/patches.suse/ARM-OMAP2-Fix-memory-leak-in-realtime_counter_init.patch new file mode 100644 index 0000000..89c1ea3 --- /dev/null +++ b/patches.suse/ARM-OMAP2-Fix-memory-leak-in-realtime_counter_init.patch @@ -0,0 +1,36 @@ +From ed8167cbf65c2b6ff6faeb0f96ded4d6d581e1ac Mon Sep 17 00:00:00 2001 +From: Chen Hui +Date: Tue, 8 Nov 2022 22:19:17 +0800 +Subject: [PATCH] ARM: OMAP2+: Fix memory leak in realtime_counter_init() +Git-commit: ed8167cbf65c2b6ff6faeb0f96ded4d6d581e1ac +Patch-mainline: v6.3-rc1 +References: git-fixes + +The "sys_clk" resource is malloced by clk_get(), +it is not released when the function return. + +Fixes: fa6d79d27614 ("ARM: OMAP: Add initialisation for the real-time counter.") +Signed-off-by: Chen Hui +Message-id: <20221108141917.46796-1-judy.chenhui@huawei.com> +Signed-off-by: Tony Lindgren +Acked-by: Takashi Iwai + +--- + arch/arm/mach-omap2/timer.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c +index 620ba69c8f11..5677c4a08f37 100644 +--- a/arch/arm/mach-omap2/timer.c ++++ b/arch/arm/mach-omap2/timer.c +@@ -76,6 +76,7 @@ static void __init realtime_counter_init(void) + } + + rate = clk_get_rate(sys_clk); ++ clk_put(sys_clk); + + if (soc_is_dra7xx()) { + /* +-- +2.35.3 + diff --git a/patches.suse/ARM-bcm2835_defconfig-Enable-the-framebuffer.patch b/patches.suse/ARM-bcm2835_defconfig-Enable-the-framebuffer.patch new file mode 100644 index 0000000..af825f4 --- /dev/null +++ b/patches.suse/ARM-bcm2835_defconfig-Enable-the-framebuffer.patch @@ -0,0 +1,34 @@ +From afc8dd99840b7fb7190e769a893cda673bc3a907 Mon Sep 17 00:00:00 2001 +From: Stefan Wahren +Date: Fri, 13 Jan 2023 21:58:41 +0100 +Subject: [PATCH] ARM: bcm2835_defconfig: Enable the framebuffer +Git-commit: afc8dd99840b7fb7190e769a893cda673bc3a907 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Booting Linux on a Raspberry Pi based on bcm2835_defconfig there is +no display activity. + +Enable CONFIG_FB which is nowadays required for CONFIG_FB_SIMPLE +and CONFIG_FRAMEBUFFER_CONSOLE. + +Fixes: f611b1e7624c ("drm: Avoid circular dependencies for CONFIG_FB") +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20230113205842.17051-1-stefan.wahren@i2se.com +Signed-off-by: Florian Fainelli +Acked-by: Takashi Iwai + +--- + arch/arm/configs/bcm2835_defconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm/configs/bcm2835_defconfig ++++ b/arch/arm/configs/bcm2835_defconfig +@@ -108,6 +108,7 @@ CONFIG_MEDIA_SUPPORT=y + CONFIG_MEDIA_CAMERA_SUPPORT=y + CONFIG_DRM=y + CONFIG_DRM_VC4=y ++CONFIG_FB=y + CONFIG_FB_SIMPLE=y + CONFIG_FRAMEBUFFER_CONSOLE=y + CONFIG_SOUND=y diff --git a/patches.suse/ARM-dts-exynos-correct-HDMI-phy-compatible-in-Exynos.patch b/patches.suse/ARM-dts-exynos-correct-HDMI-phy-compatible-in-Exynos.patch new file mode 100644 index 0000000..a55653e --- /dev/null +++ b/patches.suse/ARM-dts-exynos-correct-HDMI-phy-compatible-in-Exynos.patch @@ -0,0 +1,36 @@ +From af1c89ddb74f170eccd5a57001d7317560b638ea Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Wed, 25 Jan 2023 10:45:05 +0100 +Subject: [PATCH] ARM: dts: exynos: correct HDMI phy compatible in Exynos4 +Git-commit: af1c89ddb74f170eccd5a57001d7317560b638ea +Patch-mainline: v6.3-rc1 +References: git-fixes + +The HDMI phy compatible was missing vendor prefix. + +Fixes: ed80d4cab772 ("ARM: dts: add hdmi related nodes for exynos4 SoCs") +Cc: +Link: https://lore.kernel.org/r/20230125094513.155063-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Acked-by: Takashi Iwai + +--- + arch/arm/boot/dts/exynos4.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos4.dtsi b/arch/arm/boot/dts/exynos4.dtsi +index 55afe9972460..d1adaee2af58 100644 +--- a/arch/arm/boot/dts/exynos4.dtsi ++++ b/arch/arm/boot/dts/exynos4.dtsi +@@ -605,7 +605,7 @@ i2c_8: i2c@138e0000 { + status = "disabled"; + + hdmi_i2c_phy: hdmiphy@38 { +- compatible = "exynos4210-hdmiphy"; ++ compatible = "samsung,exynos4210-hdmiphy"; + reg = <0x38>; + }; + }; +-- +2.35.3 + diff --git a/patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Exynos4.patch b/patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Exynos4.patch new file mode 100644 index 0000000..4998ac2 --- /dev/null +++ b/patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Exynos4.patch @@ -0,0 +1,37 @@ +From 8e4505e617a80f601e2f53a917611777f128f925 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Thu, 9 Feb 2023 11:58:36 +0100 +Subject: [PATCH] ARM: dts: exynos: correct TMU phandle in Exynos4 +Git-commit: 8e4505e617a80f601e2f53a917611777f128f925 +Patch-mainline: v6.3-rc1 +References: git-fixes + +TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing +it must not have an argument to phandle. + +Fixes: 328829a6ad70 ("ARM: dts: define default thermal-zones for exynos4") +Cc: +Link: https://lore.kernel.org/r/20230209105841.779596-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Acked-by: Takashi Iwai + +--- + arch/arm/boot/dts/exynos4-cpu-thermal.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi b/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi +index 021d9fc1b492..27a1a8952665 100644 +--- a/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi ++++ b/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi +@@ -10,7 +10,7 @@ + / { + thermal-zones { + cpu_thermal: cpu-thermal { +- thermal-sensors = <&tmu 0>; ++ thermal-sensors = <&tmu>; + polling-delay-passive = <0>; + polling-delay = <0>; + trips { +-- +2.35.3 + diff --git a/patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Exynos4210.patch b/patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Exynos4210.patch new file mode 100644 index 0000000..ce77cbb --- /dev/null +++ b/patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Exynos4210.patch @@ -0,0 +1,38 @@ +From 408ab6786dbf6dd696488054c9559681112ef994 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Thu, 9 Feb 2023 11:58:37 +0100 +Subject: [PATCH] ARM: dts: exynos: correct TMU phandle in Exynos4210 +Git-commit: 408ab6786dbf6dd696488054c9559681112ef994 +Patch-mainline: v6.3-rc1 +References: git-fixes + +TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing +it must not have an argument to phandle. Since thermal-sensors property is +already defined in included exynos4-cpu-thermal.dtsi, drop it from +exynos4210.dtsi to fix the error and remoev redundancy. + +Fixes: 9843a2236003 ("ARM: dts: Provide dt bindings identical for Exynos TMU") +Cc: +Link: https://lore.kernel.org/r/20230209105841.779596-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Acked-by: Takashi Iwai + +--- + arch/arm/boot/dts/exynos4210.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos4210.dtsi b/arch/arm/boot/dts/exynos4210.dtsi +index 2c25cc37934e..f8c6c5d1906a 100644 +--- a/arch/arm/boot/dts/exynos4210.dtsi ++++ b/arch/arm/boot/dts/exynos4210.dtsi +@@ -393,7 +393,6 @@ &cpu_alert2 { + &cpu_thermal { + polling-delay-passive = <0>; + polling-delay = <0>; +- thermal-sensors = <&tmu 0>; + }; + + &gic { +-- +2.35.3 + diff --git a/patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Exynos5250.patch b/patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Exynos5250.patch new file mode 100644 index 0000000..db52c6d --- /dev/null +++ b/patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Exynos5250.patch @@ -0,0 +1,37 @@ +From 33e2c595e2e4016991ead44933a29d1ef93d5f26 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Thu, 9 Feb 2023 11:58:38 +0100 +Subject: [PATCH] ARM: dts: exynos: correct TMU phandle in Exynos5250 +Git-commit: 33e2c595e2e4016991ead44933a29d1ef93d5f26 +Patch-mainline: v6.3-rc1 +References: git-fixes + +TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing +it must not have an argument to phandle. + +Cc: +Fixes: 9843a2236003 ("ARM: dts: Provide dt bindings identical for Exynos TMU") +Link: https://lore.kernel.org/r/20230209105841.779596-3-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Acked-by: Takashi Iwai + +--- + arch/arm/boot/dts/exynos5250.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi +index 4708dcd575a7..01751706ff96 100644 +--- a/arch/arm/boot/dts/exynos5250.dtsi ++++ b/arch/arm/boot/dts/exynos5250.dtsi +@@ -1107,7 +1107,7 @@ timer { + &cpu_thermal { + polling-delay-passive = <0>; + polling-delay = <0>; +- thermal-sensors = <&tmu 0>; ++ thermal-sensors = <&tmu>; + + cooling-maps { + map0 { +-- +2.35.3 + diff --git a/patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Odroid-HC1.patch b/patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Odroid-HC1.patch new file mode 100644 index 0000000..786d3fd --- /dev/null +++ b/patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Odroid-HC1.patch @@ -0,0 +1,82 @@ +From 2e3d0e20d8456f876607a8af61fdb83dfbf98cb6 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Thu, 9 Feb 2023 11:58:40 +0100 +Subject: [PATCH] ARM: dts: exynos: correct TMU phandle in Odroid HC1 +Git-commit: 2e3d0e20d8456f876607a8af61fdb83dfbf98cb6 +Patch-mainline: v6.3-rc1 +References: git-fixes + +TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing +it must not have an argument to phandle. This was not critical before, +but since rework of thermal Devicetree initialization in the +commit 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree +initialization"), this leads to errors registering thermal zones other +than first one: + + thermal_sys: cpu0-thermal: Failed to read thermal-sensors cells: -2 + thermal_sys: Failed to find thermal zone for tmu id=0 + exynos-tmu 10064000.tmu: Failed to register sensor: -2 + exynos-tmu: probe of 10064000.tmu failed with error -2 + +Fixes: 1ac49427b566 ("ARM: dts: exynos: Add support for Hardkernel's Odroid HC1 board") +Cc: +Link: https://lore.kernel.org/r/20230209105841.779596-5-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Acked-by: Takashi Iwai + +--- + arch/arm/boot/dts/exynos5422-odroidhc1.dts | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/boot/dts/exynos5422-odroidhc1.dts b/arch/arm/boot/dts/exynos5422-odroidhc1.dts +index 3de7019572a2..5e4280393706 100644 +--- a/arch/arm/boot/dts/exynos5422-odroidhc1.dts ++++ b/arch/arm/boot/dts/exynos5422-odroidhc1.dts +@@ -31,7 +31,7 @@ led-1 { + + thermal-zones { + cpu0_thermal: cpu0-thermal { +- thermal-sensors = <&tmu_cpu0 0>; ++ thermal-sensors = <&tmu_cpu0>; + trips { + cpu0_alert0: cpu-alert-0 { + temperature = <70000>; /* millicelsius */ +@@ -86,7 +86,7 @@ map1 { + }; + }; + cpu1_thermal: cpu1-thermal { +- thermal-sensors = <&tmu_cpu1 0>; ++ thermal-sensors = <&tmu_cpu1>; + trips { + cpu1_alert0: cpu-alert-0 { + temperature = <70000>; +@@ -130,7 +130,7 @@ map1 { + }; + }; + cpu2_thermal: cpu2-thermal { +- thermal-sensors = <&tmu_cpu2 0>; ++ thermal-sensors = <&tmu_cpu2>; + trips { + cpu2_alert0: cpu-alert-0 { + temperature = <70000>; +@@ -174,7 +174,7 @@ map1 { + }; + }; + cpu3_thermal: cpu3-thermal { +- thermal-sensors = <&tmu_cpu3 0>; ++ thermal-sensors = <&tmu_cpu3>; + trips { + cpu3_alert0: cpu-alert-0 { + temperature = <70000>; +@@ -218,7 +218,7 @@ map1 { + }; + }; + gpu_thermal: gpu-thermal { +- thermal-sensors = <&tmu_gpu 0>; ++ thermal-sensors = <&tmu_gpu>; + trips { + gpu_alert0: gpu-alert-0 { + temperature = <70000>; +-- +2.35.3 + diff --git a/patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Odroid-XU.patch b/patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Odroid-XU.patch new file mode 100644 index 0000000..c8bda69 --- /dev/null +++ b/patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Odroid-XU.patch @@ -0,0 +1,38 @@ +From 9372eca505e7a19934d750b4b4c89a3652738e66 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Thu, 9 Feb 2023 11:58:39 +0100 +Subject: [PATCH] ARM: dts: exynos: correct TMU phandle in Odroid XU +Git-commit: 9372eca505e7a19934d750b4b4c89a3652738e66 +Patch-mainline: v6.3-rc1 +References: git-fixes + +TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing +it must not have an argument to phandle. Since thermal-sensors property +is already defined in included exynosi5410.dtsi, drop it from +exynos5410-odroidxu.dts to fix the error and remoev redundancy. + +Fixes: 88644b4c750b ("ARM: dts: exynos: Configure PWM, usb3503, PMIC and thermal on Odroid XU board") +Cc: +Link: https://lore.kernel.org/r/20230209105841.779596-4-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Acked-by: Takashi Iwai + +--- + arch/arm/boot/dts/exynos5410-odroidxu.dts | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos5410-odroidxu.dts b/arch/arm/boot/dts/exynos5410-odroidxu.dts +index d1cbc6b8a570..e18110b93875 100644 +--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts ++++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts +@@ -120,7 +120,6 @@ &clock_audss { + }; + + &cpu0_thermal { +- thermal-sensors = <&tmu_cpu0 0>; + polling-delay-passive = <0>; + polling-delay = <0>; + +-- +2.35.3 + diff --git a/patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Odroid-XU3-fam.patch b/patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Odroid-XU3-fam.patch new file mode 100644 index 0000000..d499e02 --- /dev/null +++ b/patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Odroid-XU3-fam.patch @@ -0,0 +1,82 @@ +From a3583e92d188ec6c58c7f603ac5e72dd8a11c21a Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Thu, 9 Feb 2023 11:58:41 +0100 +Subject: [PATCH] ARM: dts: exynos: correct TMU phandle in Odroid XU3 family +Git-commit: a3583e92d188ec6c58c7f603ac5e72dd8a11c21a +Patch-mainline: v6.3-rc1 +References: git-fixes + +TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing +it must not have an argument to phandle. This was not critical before, +but since rework of thermal Devicetree initialization in the +commit 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree +initialization"), this leads to errors registering thermal zones other +than first one: + + thermal_sys: cpu0-thermal: Failed to read thermal-sensors cells: -2 + thermal_sys: Failed to find thermal zone for tmu id=0 + exynos-tmu 10064000.tmu: Failed to register sensor: -2 + exynos-tmu: probe of 10064000.tmu failed with error -2 + +Fixes: f1722d7dd8b8 ("ARM: dts: Define default thermal-zones for exynos5422") +Cc: +Link: https://lore.kernel.org/r/20230209105841.779596-6-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Acked-by: Takashi Iwai + +--- + arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi +index a6961ff24030..e6e7e2ff2a26 100644 +--- a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi ++++ b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi +@@ -50,7 +50,7 @@ fan0: pwm-fan { + + thermal-zones { + cpu0_thermal: cpu0-thermal { +- thermal-sensors = <&tmu_cpu0 0>; ++ thermal-sensors = <&tmu_cpu0>; + polling-delay-passive = <250>; + polling-delay = <0>; + trips { +@@ -139,7 +139,7 @@ cpu0_cooling_map4: map4 { + }; + }; + cpu1_thermal: cpu1-thermal { +- thermal-sensors = <&tmu_cpu1 0>; ++ thermal-sensors = <&tmu_cpu1>; + polling-delay-passive = <250>; + polling-delay = <0>; + trips { +@@ -212,7 +212,7 @@ cpu1_cooling_map4: map4 { + }; + }; + cpu2_thermal: cpu2-thermal { +- thermal-sensors = <&tmu_cpu2 0>; ++ thermal-sensors = <&tmu_cpu2>; + polling-delay-passive = <250>; + polling-delay = <0>; + trips { +@@ -285,7 +285,7 @@ cpu2_cooling_map4: map4 { + }; + }; + cpu3_thermal: cpu3-thermal { +- thermal-sensors = <&tmu_cpu3 0>; ++ thermal-sensors = <&tmu_cpu3>; + polling-delay-passive = <250>; + polling-delay = <0>; + trips { +@@ -358,7 +358,7 @@ cpu3_cooling_map4: map4 { + }; + }; + gpu_thermal: gpu-thermal { +- thermal-sensors = <&tmu_gpu 0>; ++ thermal-sensors = <&tmu_gpu>; + polling-delay-passive = <250>; + polling-delay = <0>; + trips { +-- +2.35.3 + diff --git a/patches.suse/ARM-dts-exynos-correct-wr-active-property-in-Exynos3.patch b/patches.suse/ARM-dts-exynos-correct-wr-active-property-in-Exynos3.patch new file mode 100644 index 0000000..c5e4548 --- /dev/null +++ b/patches.suse/ARM-dts-exynos-correct-wr-active-property-in-Exynos3.patch @@ -0,0 +1,37 @@ +From d15d2a617499882971ddb773a583015bf36fa492 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Fri, 20 Jan 2023 16:53:54 +0100 +Subject: [PATCH] ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato +Git-commit: d15d2a617499882971ddb773a583015bf36fa492 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The property is wr-active: + + exynos3250-rinato.dtb: fimd@11c00000: i80-if-timings: 'wr-act' does not match any of the regexes: 'pinctrl-[0-9]+' + +Fixes: b59b3afb94d4 ("ARM: dts: add fimd device support for exynos3250-rinato") +Link: https://lore.kernel.org/r/20230120155404.323386-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Acked-by: Takashi Iwai + +--- + arch/arm/boot/dts/exynos3250-rinato.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos3250-rinato.dts b/arch/arm/boot/dts/exynos3250-rinato.dts +index 6d2c7bb19184..2eb682009815 100644 +--- a/arch/arm/boot/dts/exynos3250-rinato.dts ++++ b/arch/arm/boot/dts/exynos3250-rinato.dts +@@ -250,7 +250,7 @@ &fimd { + i80-if-timings { + cs-setup = <0>; + wr-setup = <0>; +- wr-act = <1>; ++ wr-active = <1>; + wr-hold = <0>; + }; + }; +-- +2.35.3 + diff --git a/patches.suse/ARM-dts-imx7s-correct-iomuxc-gpr-mux-controller-cell.patch b/patches.suse/ARM-dts-imx7s-correct-iomuxc-gpr-mux-controller-cell.patch new file mode 100644 index 0000000..84bad57 --- /dev/null +++ b/patches.suse/ARM-dts-imx7s-correct-iomuxc-gpr-mux-controller-cell.patch @@ -0,0 +1,36 @@ +From 0e3e1946606a2919b1dda9967ab2e1c5af2fedd6 Mon Sep 17 00:00:00 2001 +From: Peng Fan +Date: Fri, 23 Dec 2022 11:04:33 +0800 +Subject: [PATCH] ARM: dts: imx7s: correct iomuxc gpr mux controller cells +Git-commit: 0e3e1946606a2919b1dda9967ab2e1c5af2fedd6 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Per binding doc reg-mux.yaml, the #mux-control-cells should be 1 + +Signed-off-by: Peng Fan +Reviewed-by: Marco Felsch +Fixes: 94a905a79f2c ("ARM: dts: imx7s: add multiplexer controls") +Signed-off-by: Shawn Guo +Acked-by: Takashi Iwai + +--- + arch/arm/boot/dts/imx7s.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi +index 91a3ba79e525..efe2525b62fa 100644 +--- a/arch/arm/boot/dts/imx7s.dtsi ++++ b/arch/arm/boot/dts/imx7s.dtsi +@@ -513,7 +513,7 @@ gpr: iomuxc-gpr@30340000 { + + mux: mux-controller { + compatible = "mmio-mux"; +- #mux-control-cells = <0>; ++ #mux-control-cells = <1>; + mux-reg-masks = <0x14 0x00000010>; + }; + +-- +2.35.3 + diff --git a/patches.suse/ARM-dts-qcom-sdx55-Add-Qcom-SMMU-500-as-the-fallback.patch b/patches.suse/ARM-dts-qcom-sdx55-Add-Qcom-SMMU-500-as-the-fallback.patch new file mode 100644 index 0000000..1d9423d --- /dev/null +++ b/patches.suse/ARM-dts-qcom-sdx55-Add-Qcom-SMMU-500-as-the-fallback.patch @@ -0,0 +1,39 @@ +From af4ab377543853b690cc85b4c46cf976ab560dc2 Mon Sep 17 00:00:00 2001 +From: Manivannan Sadhasivam +Date: Mon, 23 Jan 2023 18:49:30 +0530 +Subject: [PATCH] ARM: dts: qcom: sdx55: Add Qcom SMMU-500 as the fallback for IOMMU node +Git-commit: af4ab377543853b690cc85b4c46cf976ab560dc2 +Patch-mainline: v6.3-rc1 +References: git-fixes + +SDX55 uses the Qcom version of the SMMU-500 IP. So use "qcom,smmu-500" +compatible as the fallback to the SoC specific compatible. + +Cc: # 5.12 +Fixes: a2bdfdfba2af ("ARM: dts: qcom: sdx55: Enable ARM SMMU") +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230123131931.263024-3-manivannan.sadhasivam@linaro.org +Acked-by: Takashi Iwai + +--- + arch/arm/boot/dts/qcom-sdx55.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/qcom-sdx55.dtsi b/arch/arm/boot/dts/qcom-sdx55.dtsi +index a9433d1e4f54..535d0e6fba9b 100644 +--- a/arch/arm/boot/dts/qcom-sdx55.dtsi ++++ b/arch/arm/boot/dts/qcom-sdx55.dtsi +@@ -579,7 +579,7 @@ pil-reloc@94c { + }; + + apps_smmu: iommu@15000000 { +- compatible = "qcom,sdx55-smmu-500", "arm,mmu-500"; ++ compatible = "qcom,sdx55-smmu-500", "qcom,smmu-500", "arm,mmu-500"; + reg = <0x15000000 0x20000>; + #iommu-cells = <2>; + #global-interrupts = <1>; +-- +2.35.3 + diff --git a/patches.suse/ARM-dts-rockchip-add-power-domains-property-to-dp-no.patch b/patches.suse/ARM-dts-rockchip-add-power-domains-property-to-dp-no.patch new file mode 100644 index 0000000..0914876 --- /dev/null +++ b/patches.suse/ARM-dts-rockchip-add-power-domains-property-to-dp-no.patch @@ -0,0 +1,36 @@ +From 80422339a75088322b4d3884bd12fa0fe5d11050 Mon Sep 17 00:00:00 2001 +From: Johan Jonker +Date: Wed, 28 Dec 2022 21:17:32 +0100 +Subject: [PATCH] ARM: dts: rockchip: add power-domains property to dp node on rk3288 +Git-commit: 80422339a75088322b4d3884bd12fa0fe5d11050 +Patch-mainline: v6.2-rc8 +References: git-fixes + +The clocks in the Rockchip rk3288 DisplayPort node are +included in the power-domain@RK3288_PD_VIO logic, but the +power-domains property in the dp node is missing, so fix it. + +Signed-off-by: Johan Jonker +Link: https://lore.kernel.org/r/dab85bfb-9f55-86a1-5cd5-7388c43e0ec5@gmail.com +Signed-off-by: Heiko Stuebner +Acked-by: Takashi Iwai + +--- + arch/arm/boot/dts/rk3288.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi +index 487b0e03d4b4..2ca76b69add7 100644 +--- a/arch/arm/boot/dts/rk3288.dtsi ++++ b/arch/arm/boot/dts/rk3288.dtsi +@@ -1181,6 +1181,7 @@ edp: dp@ff970000 { + clock-names = "dp", "pclk"; + phys = <&edp_phy>; + phy-names = "dp"; ++ power-domains = <&power RK3288_PD_VIO>; + resets = <&cru SRST_EDP>; + reset-names = "dp"; + rockchip,grf = <&grf>; +-- +2.35.3 + diff --git a/patches.suse/ARM-dts-spear320-hmi-correct-STMPE-GPIO-compatible.patch b/patches.suse/ARM-dts-spear320-hmi-correct-STMPE-GPIO-compatible.patch new file mode 100644 index 0000000..5b0df0c --- /dev/null +++ b/patches.suse/ARM-dts-spear320-hmi-correct-STMPE-GPIO-compatible.patch @@ -0,0 +1,37 @@ +From 33a0c1b850c8c85f400531dab3a0b022cdb164b1 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Sat, 25 Feb 2023 17:22:37 +0100 +Subject: [PATCH] ARM: dts: spear320-hmi: correct STMPE GPIO compatible +Git-commit: 33a0c1b850c8c85f400531dab3a0b022cdb164b1 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The compatible is st,stmpe-gpio. + +Fixes: e2eb69183ec4 ("ARM: SPEAr320: DT: Add SPEAr 320 HMI board support") +Signed-off-by: Krzysztof Kozlowski +Acked-by: Viresh Kumar +Link: https://lore.kernel.org/r/20230225162237.40242-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Arnd Bergmann +Acked-by: Takashi Iwai + +--- + arch/arm/boot/dts/spear320-hmi.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/spear320-hmi.dts b/arch/arm/boot/dts/spear320-hmi.dts +index 34503ac9c51c..721e5ee7b680 100644 +--- a/arch/arm/boot/dts/spear320-hmi.dts ++++ b/arch/arm/boot/dts/spear320-hmi.dts +@@ -241,7 +241,7 @@ stmpe811@41 { + irq-trigger = <0x1>; + + stmpegpio: stmpe-gpio { +- compatible = "stmpe,gpio"; ++ compatible = "st,stmpe-gpio"; + reg = <0>; + gpio-controller; + #gpio-cells = <2>; +-- +2.35.3 + diff --git a/patches.suse/ARM-dts-sun8i-nanopi-duo2-Fix-regulator-GPIO-referen.patch b/patches.suse/ARM-dts-sun8i-nanopi-duo2-Fix-regulator-GPIO-referen.patch new file mode 100644 index 0000000..3894f27 --- /dev/null +++ b/patches.suse/ARM-dts-sun8i-nanopi-duo2-Fix-regulator-GPIO-referen.patch @@ -0,0 +1,40 @@ +From 2177d4ae971f79b4a9a3c411f2fb8ae6113d1430 Mon Sep 17 00:00:00 2001 +From: Samuel Holland +Date: Sat, 31 Dec 2022 16:58:54 -0600 +Subject: [PATCH] ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference +Git-commit: 2177d4ae971f79b4a9a3c411f2fb8ae6113d1430 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The property named in the schema is 'enable-gpios', not 'enable-gpio'. +This makes no difference at runtime, because the regulator is marked as +always-on, but it breaks validation. + +Fixes: 4701fc6e5dd9 ("ARM: dts: sun8i: add FriendlyARM NanoPi Duo2") +Reviewed-by: Andre Przywara +Acked-by: Jernej Skrabec +Signed-off-by: Samuel Holland +Link: https://lore.kernel.org/r/20221231225854.16320-2-samuel@sholland.org +Signed-off-by: Jernej Skrabec +Acked-by: Takashi Iwai + +--- + arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts b/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts +index 43641cb82398..343b02b97155 100644 +--- a/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts ++++ b/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts +@@ -57,7 +57,7 @@ reg_vdd_cpux: vdd-cpux-regulator { + regulator-ramp-delay = <50>; /* 4ms */ + + enable-active-high; +- enable-gpio = <&r_pio 0 8 GPIO_ACTIVE_HIGH>; /* PL8 */ ++ enable-gpios = <&r_pio 0 8 GPIO_ACTIVE_HIGH>; /* PL8 */ + gpios = <&r_pio 0 6 GPIO_ACTIVE_HIGH>; /* PL6 */ + gpios-states = <0x1>; + states = <1100000 0>, <1300000 1>; +-- +2.35.3 + diff --git a/patches.suse/ARM-imx-Call-ida_simple_remove-for-ida_simple_get.patch b/patches.suse/ARM-imx-Call-ida_simple_remove-for-ida_simple_get.patch new file mode 100644 index 0000000..c88c007 --- /dev/null +++ b/patches.suse/ARM-imx-Call-ida_simple_remove-for-ida_simple_get.patch @@ -0,0 +1,102 @@ +From ebeb49f43c8952f12aa20f03f00d7009edc2d1c5 Mon Sep 17 00:00:00 2001 +From: Angus Chen +Date: Thu, 5 Jan 2023 14:11:23 +0800 +Subject: [PATCH] ARM: imx: Call ida_simple_remove() for ida_simple_get +Git-commit: ebeb49f43c8952f12aa20f03f00d7009edc2d1c5 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The function call ida_simple_get maybe fail,we should deal with it. +And if ida_simple_get success ,it need to call ida_simple_remove also. +BTW,devm_kasprintf can handle id is zero for consistency. + +Fixes: e76bdfd7403a ("ARM: imx: Added perf functionality to mmdc driver") +Signed-off-by: Angus Chen +Signed-off-by: Shawn Guo +Acked-by: Takashi Iwai + +--- + arch/arm/mach-imx/mmdc.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/arch/arm/mach-imx/mmdc.c b/arch/arm/mach-imx/mmdc.c +index af12668d0bf5..b9efe9da06e0 100644 +--- a/arch/arm/mach-imx/mmdc.c ++++ b/arch/arm/mach-imx/mmdc.c +@@ -99,6 +99,7 @@ struct mmdc_pmu { + cpumask_t cpu; + struct hrtimer hrtimer; + unsigned int active_events; ++ int id; + struct device *dev; + struct perf_event *mmdc_events[MMDC_NUM_COUNTERS]; + struct hlist_node node; +@@ -433,8 +434,6 @@ static enum hrtimer_restart mmdc_pmu_timer_handler(struct hrtimer *hrtimer) + static int mmdc_pmu_init(struct mmdc_pmu *pmu_mmdc, + void __iomem *mmdc_base, struct device *dev) + { +- int mmdc_num; +- + *pmu_mmdc = (struct mmdc_pmu) { + .pmu = (struct pmu) { + .task_ctx_nr = perf_invalid_context, +@@ -452,15 +451,16 @@ static int mmdc_pmu_init(struct mmdc_pmu *pmu_mmdc, + .active_events = 0, + }; + +- mmdc_num = ida_simple_get(&mmdc_ida, 0, 0, GFP_KERNEL); ++ pmu_mmdc->id = ida_simple_get(&mmdc_ida, 0, 0, GFP_KERNEL); + +- return mmdc_num; ++ return pmu_mmdc->id; + } + + static int imx_mmdc_remove(struct platform_device *pdev) + { + struct mmdc_pmu *pmu_mmdc = platform_get_drvdata(pdev); + ++ ida_simple_remove(&mmdc_ida, pmu_mmdc->id); + cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node); + perf_pmu_unregister(&pmu_mmdc->pmu); + iounmap(pmu_mmdc->mmdc_base); +@@ -474,7 +474,6 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b + { + struct mmdc_pmu *pmu_mmdc; + char *name; +- int mmdc_num; + int ret; + const struct of_device_id *of_id = + of_match_device(imx_mmdc_dt_ids, &pdev->dev); +@@ -497,14 +496,14 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b + cpuhp_mmdc_state = ret; + } + +- mmdc_num = mmdc_pmu_init(pmu_mmdc, mmdc_base, &pdev->dev); +- pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk; +- if (mmdc_num == 0) +- name = "mmdc"; +- else +- name = devm_kasprintf(&pdev->dev, +- GFP_KERNEL, "mmdc%d", mmdc_num); ++ ret = mmdc_pmu_init(pmu_mmdc, mmdc_base, &pdev->dev); ++ if (ret < 0) ++ goto pmu_free; + ++ name = devm_kasprintf(&pdev->dev, ++ GFP_KERNEL, "mmdc%d", ret); ++ ++ pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk; + pmu_mmdc->devtype_data = (struct fsl_mmdc_devtype_data *)of_id->data; + + hrtimer_init(&pmu_mmdc->hrtimer, CLOCK_MONOTONIC, +@@ -525,6 +524,7 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b + + pmu_register_err: + pr_warn("MMDC Perf PMU failed (%d), disabled\n", ret); ++ ida_simple_remove(&mmdc_ida, pmu_mmdc->id); + cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node); + hrtimer_cancel(&pmu_mmdc->hrtimer); + pmu_free: +-- +2.35.3 + diff --git a/patches.suse/ARM-s3c-fix-s3c64xx_set_timer_source-prototype.patch b/patches.suse/ARM-s3c-fix-s3c64xx_set_timer_source-prototype.patch new file mode 100644 index 0000000..1a81268 --- /dev/null +++ b/patches.suse/ARM-s3c-fix-s3c64xx_set_timer_source-prototype.patch @@ -0,0 +1,46 @@ +From 5bf52f5e4d12b8109f348cab60cb7d51092c4270 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Wed, 18 Jan 2023 10:02:12 +0100 +Subject: [PATCH] ARM: s3c: fix s3c64xx_set_timer_source prototype +Git-commit: 5bf52f5e4d12b8109f348cab60cb7d51092c4270 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The prototype does not match the definition, as gcc-13 points +Out: + +arch/arm/mach-s3c/s3c64xx.c:169:13: error: conflicting types for 's3c64xx_set_timer_source' due to enum/integer mismatch; have 'void(unsigned int, unsigned int)' [-Werror=enum-int-mismatch] + 169 | void __init s3c64xx_set_timer_source(unsigned int event, unsigned int source) + | ^~~~~~~~~~~~~~~~~~~~~~~~ +In file included from arch/arm/mach-s3c/s3c64xx.c:50: +arch/arm/mach-s3c/s3c64xx.h:62:20: note: previous declaration of 's3c64xx_set_timer_source' with type 'void(enum s3c64xx_timer_mode, enum s3c64xx_timer_mode)' + 62 | extern void __init s3c64xx_set_timer_source(enum s3c64xx_timer_mode event, + | ^~~~~~~~~~~~~~~~~~~~~~~~ + +Fixes: 4280506ac9bb ("ARM: SAMSUNG: Move all platforms to new clocksource driver") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20230118090224.2162863-1-arnd@kernel.org +Signed-off-by: Krzysztof Kozlowski +Acked-by: Takashi Iwai + +--- + arch/arm/mach-s3c/s3c64xx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-s3c/s3c64xx.c b/arch/arm/mach-s3c/s3c64xx.c +index 0a8116c108fe..dce2b0e95308 100644 +--- a/arch/arm/mach-s3c/s3c64xx.c ++++ b/arch/arm/mach-s3c/s3c64xx.c +@@ -173,7 +173,8 @@ static struct samsung_pwm_variant s3c64xx_pwm_variant = { + .tclk_mask = (1 << 7) | (1 << 6) | (1 << 5), + }; + +-void __init s3c64xx_set_timer_source(unsigned int event, unsigned int source) ++void __init s3c64xx_set_timer_source(enum s3c64xx_timer_mode event, ++ enum s3c64xx_timer_mode source) + { + s3c64xx_pwm_variant.output_mask = BIT(SAMSUNG_PWM_NUM) - 1; + s3c64xx_pwm_variant.output_mask &= ~(BIT(event) | BIT(source)); +-- +2.35.3 + diff --git a/patches.suse/ARM-zynq-Fix-refcount-leak-in-zynq_early_slcr_init.patch b/patches.suse/ARM-zynq-Fix-refcount-leak-in-zynq_early_slcr_init.patch new file mode 100644 index 0000000..5b7fc19 --- /dev/null +++ b/patches.suse/ARM-zynq-Fix-refcount-leak-in-zynq_early_slcr_init.patch @@ -0,0 +1,37 @@ +From 9eedb910a3be0005b88c696a8552c0d4c9937cd4 Mon Sep 17 00:00:00 2001 +From: Qiheng Lin +Date: Tue, 29 Nov 2022 22:05:44 +0800 +Subject: [PATCH] ARM: zynq: Fix refcount leak in zynq_early_slcr_init +Git-commit: 9eedb910a3be0005b88c696a8552c0d4c9937cd4 +Patch-mainline: v6.3-rc1 +References: git-fixes + +of_find_compatible_node() returns a node pointer with refcount incremented, +we should use of_node_put() on error path. +Add missing of_node_put() to avoid refcount leak. + +Fixes: 3329659df030 ("ARM: zynq: Simplify SLCR initialization") +Signed-off-by: Qiheng Lin +Link: https://lore.kernel.org/r/20221129140544.41293-1-linqiheng@huawei.com +Signed-off-by: Michal Simek +Acked-by: Takashi Iwai + +--- + arch/arm/mach-zynq/slcr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-zynq/slcr.c b/arch/arm/mach-zynq/slcr.c +index 37707614885a..9765b3f4c2fc 100644 +--- a/arch/arm/mach-zynq/slcr.c ++++ b/arch/arm/mach-zynq/slcr.c +@@ -213,6 +213,7 @@ int __init zynq_early_slcr_init(void) + zynq_slcr_regmap = syscon_regmap_lookup_by_compatible("xlnx,zynq-slcr"); + if (IS_ERR(zynq_slcr_regmap)) { + pr_err("%s: failed to find zynq-slcr\n", __func__); ++ of_node_put(np); + return -ENODEV; + } + +-- +2.35.3 + diff --git a/patches.suse/ASoC-Intel-sof_cs42l42-always-set-dpcm_capture-for-a.patch b/patches.suse/ASoC-Intel-sof_cs42l42-always-set-dpcm_capture-for-a.patch new file mode 100644 index 0000000..c223fde --- /dev/null +++ b/patches.suse/ASoC-Intel-sof_cs42l42-always-set-dpcm_capture-for-a.patch @@ -0,0 +1,49 @@ +From e0a52220344ab7defe25b9cdd58fe1dc1122e67c Mon Sep 17 00:00:00 2001 +From: Pierre-Louis Bossart +Date: Thu, 19 Jan 2023 18:34:57 +0200 +Subject: [PATCH] ASoC: Intel: sof_cs42l42: always set dpcm_capture for amplifiers +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: e0a52220344ab7defe25b9cdd58fe1dc1122e67c +Patch-mainline: v6.2-rc7 +References: git-fixes + +The amplifier may provide hardware support for I/V feedback, or +alternatively the firmware may generate an echo reference attached to +the SSP and dailink used for the amplifier. + +To avoid any issues with invalid/NULL substreams in the latter case, +always unconditionally set dpcm_capture. + +Link: https://github.com/thesofproject/linux/issues/4083 +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Ranjani Sridharan +Reviewed-by: Péter Ujfalusi +Reviewed-by: Bard Liao +Signed-off-by: Kai Vehmanen +Link: https://lore.kernel.org/r/20230119163459.2235843-3-kai.vehmanen@linux.intel.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/intel/boards/sof_cs42l42.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/intel/boards/sof_cs42l42.c b/sound/soc/intel/boards/sof_cs42l42.c +index e38bd2831e6a..e9d190cb13b0 100644 +--- a/sound/soc/intel/boards/sof_cs42l42.c ++++ b/sound/soc/intel/boards/sof_cs42l42.c +@@ -336,6 +336,9 @@ static int create_spk_amp_dai_links(struct device *dev, + links[*id].platforms = platform_component; + links[*id].num_platforms = ARRAY_SIZE(platform_component); + links[*id].dpcm_playback = 1; ++ /* firmware-generated echo reference */ ++ links[*id].dpcm_capture = 1; ++ + links[*id].no_pcm = 1; + links[*id].cpus = &cpus[*id]; + links[*id].num_cpus = 1; +-- +2.35.3 + diff --git a/patches.suse/ASoC-Intel-sof_rt5682-always-set-dpcm_capture-for-am.patch b/patches.suse/ASoC-Intel-sof_rt5682-always-set-dpcm_capture-for-am.patch new file mode 100644 index 0000000..566ec3d --- /dev/null +++ b/patches.suse/ASoC-Intel-sof_rt5682-always-set-dpcm_capture-for-am.patch @@ -0,0 +1,58 @@ +From 324f065cdbaba1b879a63bf07e61ca156b789537 Mon Sep 17 00:00:00 2001 +From: Pierre-Louis Bossart +Date: Thu, 19 Jan 2023 18:34:56 +0200 +Subject: [PATCH] ASoC: Intel: sof_rt5682: always set dpcm_capture for amplifiers +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 324f065cdbaba1b879a63bf07e61ca156b789537 +Patch-mainline: v6.2-rc7 +References: git-fixes + +The amplifier may provide hardware support for I/V feedback, or +alternatively the firmware may generate an echo reference attached to +the SSP and dailink used for the amplifier. + +To avoid any issues with invalid/NULL substreams in the latter case, +always unconditionally set dpcm_capture. + +Link: https://github.com/thesofproject/linux/issues/4083 +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Ranjani Sridharan +Reviewed-by: Péter Ujfalusi +Reviewed-by: Bard Liao +Signed-off-by: Kai Vehmanen +Link: https://lore.kernel.org/r/20230119163459.2235843-2-kai.vehmanen@linux.intel.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/intel/boards/sof_rt5682.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/boards/sof_rt5682.c b/sound/soc/intel/boards/sof_rt5682.c +index 2eabc4b0fafa..71a11d747622 100644 +--- a/sound/soc/intel/boards/sof_rt5682.c ++++ b/sound/soc/intel/boards/sof_rt5682.c +@@ -761,8 +761,6 @@ static struct snd_soc_dai_link *sof_card_dai_links_create(struct device *dev, + links[id].num_codecs = ARRAY_SIZE(max_98373_components); + links[id].init = max_98373_spk_codec_init; + links[id].ops = &max_98373_ops; +- /* feedback stream */ +- links[id].dpcm_capture = 1; + } else if (sof_rt5682_quirk & + SOF_MAX98360A_SPEAKER_AMP_PRESENT) { + max_98360a_dai_link(&links[id]); +@@ -789,6 +787,9 @@ static struct snd_soc_dai_link *sof_card_dai_links_create(struct device *dev, + links[id].platforms = platform_component; + links[id].num_platforms = ARRAY_SIZE(platform_component); + links[id].dpcm_playback = 1; ++ /* feedback stream or firmware-generated echo reference */ ++ links[id].dpcm_capture = 1; ++ + links[id].no_pcm = 1; + links[id].cpus = &cpus[id]; + links[id].num_cpus = 1; +-- +2.35.3 + diff --git a/patches.suse/ASoC-adau7118-don-t-disable-regulators-on-device-unb.patch b/patches.suse/ASoC-adau7118-don-t-disable-regulators-on-device-unb.patch new file mode 100644 index 0000000..cee5e6f --- /dev/null +++ b/patches.suse/ASoC-adau7118-don-t-disable-regulators-on-device-unb.patch @@ -0,0 +1,61 @@ +From b5bfa7277ee7d944421e0ef193586c6e34d7492c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Nuno=20S=C3=A1?= +Date: Fri, 24 Feb 2023 11:45:51 +0100 +Subject: [PATCH] ASoC: adau7118: don't disable regulators on device unbind +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: b5bfa7277ee7d944421e0ef193586c6e34d7492c +Patch-mainline: v6.3-rc1 +References: git-fixes + +The regulators are supposed to be controlled through the +set_bias_level() component callback. Moreover, the regulators are not +enabled during probe and so, this would lead to a regulator unbalanced +use count. + +Fixes: ca514c0f12b02 ("ASOC: Add ADAU7118 8 Channel PDM-to-I2S/TDM Converter driver") +Signed-off-by: Nuno Sá +Link: https://lore.kernel.org/r/20230224104551.1139981-1-nuno.sa@analog.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/codecs/adau7118.c | 19 +------------------ + 1 file changed, 1 insertion(+), 18 deletions(-) + +--- a/sound/soc/codecs/adau7118.c ++++ b/sound/soc/codecs/adau7118.c +@@ -445,22 +445,6 @@ static const struct snd_soc_component_dr + .non_legacy_dai_naming = 1, + }; + +-static void adau7118_regulator_disable(void *data) +-{ +- struct adau7118_data *st = data; +- int ret; +- /* +- * If we fail to disable DVDD, don't bother in trying IOVDD. We +- * actually don't want to be left in the situation where DVDD +- * is enabled and IOVDD is disabled. +- */ +- ret = regulator_disable(st->dvdd); +- if (ret) +- return; +- +- regulator_disable(st->iovdd); +-} +- + static int adau7118_regulator_setup(struct adau7118_data *st) + { + st->iovdd = devm_regulator_get(st->dev, "iovdd"); +@@ -482,8 +466,7 @@ static int adau7118_regulator_setup(stru + regcache_cache_only(st->map, true); + } + +- return devm_add_action_or_reset(st->dev, adau7118_regulator_disable, +- st); ++ return 0; + } + + static int adau7118_parset_dt(const struct adau7118_data *st) diff --git a/patches.suse/ASoC-cs42l56-fix-DT-probe.patch b/patches.suse/ASoC-cs42l56-fix-DT-probe.patch new file mode 100644 index 0000000..82f9388 --- /dev/null +++ b/patches.suse/ASoC-cs42l56-fix-DT-probe.patch @@ -0,0 +1,56 @@ +From e18c6da62edc780e4f4f3c9ce07bdacd69505182 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Thu, 26 Jan 2023 17:21:24 +0100 +Subject: [PATCH] ASoC: cs42l56: fix DT probe +Git-commit: e18c6da62edc780e4f4f3c9ce07bdacd69505182 +Patch-mainline: v6.2-rc7 +References: git-fixes + +While looking through legacy platform data users, I noticed that +the DT probing never uses data from the DT properties, as the +platform_data structure gets overwritten directly after it +is initialized. + +There have never been any boards defining the platform_data in +the mainline kernel either, so this driver so far only worked +with patched kernels or with the default values. + +For the benefit of possible downstream users, fix the DT probe +by no longer overwriting the data. + +Signed-off-by: Arnd Bergmann +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20230126162203.2986339-1-arnd@kernel.org +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/codecs/cs42l56.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/sound/soc/codecs/cs42l56.c b/sound/soc/codecs/cs42l56.c +index 26066682c983..3b0e715549c9 100644 +--- a/sound/soc/codecs/cs42l56.c ++++ b/sound/soc/codecs/cs42l56.c +@@ -1191,18 +1191,12 @@ static int cs42l56_i2c_probe(struct i2c_client *i2c_client) + if (pdata) { + cs42l56->pdata = *pdata; + } else { +- pdata = devm_kzalloc(&i2c_client->dev, sizeof(*pdata), +- GFP_KERNEL); +- if (!pdata) +- return -ENOMEM; +- + if (i2c_client->dev.of_node) { + ret = cs42l56_handle_of_data(i2c_client, + &cs42l56->pdata); + if (ret != 0) + return ret; + } +- cs42l56->pdata = *pdata; + } + + if (cs42l56->pdata.gpio_nreset) { +-- +2.35.3 + diff --git a/patches.suse/ASoC-dt-bindings-meson-fix-gx-card-codec-node-regex.patch b/patches.suse/ASoC-dt-bindings-meson-fix-gx-card-codec-node-regex.patch new file mode 100644 index 0000000..6feb077 --- /dev/null +++ b/patches.suse/ASoC-dt-bindings-meson-fix-gx-card-codec-node-regex.patch @@ -0,0 +1,33 @@ +From 480b26226873c88e482575ceb0d0a38d76e1be57 Mon Sep 17 00:00:00 2001 +From: Jerome Brunet +Date: Thu, 2 Feb 2023 19:36:46 +0100 +Subject: [PATCH] ASoC: dt-bindings: meson: fix gx-card codec node regex +Git-commit: 480b26226873c88e482575ceb0d0a38d76e1be57 +Patch-mainline: v6.3-rc1 +References: git-fixes + +'codec' is a valid node name when there is a single codec +in the link. Fix the node regular expression to apply this. + +Fixes: fd00366b8e41 ("ASoC: meson: gx: add sound card dt-binding documentation") +Signed-off-by: Jerome Brunet +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230202183653.486216-3-jbrunet@baylibre.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml ++++ b/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml +@@ -61,7 +61,7 @@ patternProperties: + description: phandle of the CPU DAI + + patternProperties: +- "^codec-[0-9]+$": ++ "^codec(-[0-9]+)?$": + type: object + description: |- + Codecs: diff --git a/patches.suse/ASoC-mchp-spdifrx-Fix-uninitialized-use-of-mr-in-mch.patch b/patches.suse/ASoC-mchp-spdifrx-Fix-uninitialized-use-of-mr-in-mch.patch new file mode 100644 index 0000000..761ebf8 --- /dev/null +++ b/patches.suse/ASoC-mchp-spdifrx-Fix-uninitialized-use-of-mr-in-mch.patch @@ -0,0 +1,50 @@ +From 218674a45930c700486d27b765bf2f1b43f8cbf7 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Thu, 2 Feb 2023 09:34:19 -0700 +Subject: [PATCH] ASoC: mchp-spdifrx: Fix uninitialized use of mr in mchp_spdifrx_hw_params() +Git-commit: 218674a45930c700486d27b765bf2f1b43f8cbf7 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Clang warns: + + ../sound/soc/atmel/mchp-spdifrx.c:455:3: error: variable 'mr' is uninitialized when used here [-Werror,-Wuninitialized] + mr |= SPDIFRX_MR_ENDIAN_BIG; + ^~ + ../sound/soc/atmel/mchp-spdifrx.c:432:8: note: initialize the variable 'mr' to silence this warning + u32 mr; + ^ + = 0 + 1 error generated. + +Zero initialize mr so that these bitwise OR and assignment operation +works unconditionally. + +Fixes: fa09fa60385a ("ASoC: mchp-spdifrx: fix controls which rely on rsr register") +Link: https://github.com/ClangBuiltLinux/linux/issues/1797 +Signed-off-by: Nathan Chancellor +Reviewed-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230202-mchp-spdifrx-fix-uninit-mr-v1-1-629a045d7a2f@kernel.org +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/atmel/mchp-spdifrx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c +index 526dd3a17471..eb0c0ef4541e 100644 +--- a/sound/soc/atmel/mchp-spdifrx.c ++++ b/sound/soc/atmel/mchp-spdifrx.c +@@ -429,7 +429,7 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream, + struct snd_soc_dai *dai) + { + struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai); +- u32 mr; ++ u32 mr = 0; + int ret; + + dev_dbg(dev->dev, "%s() rate=%u format=%#x width=%u channels=%u\n", +-- +2.35.3 + diff --git a/patches.suse/ASoC-mchp-spdifrx-disable-all-interrupts-in-mchp_spd.patch b/patches.suse/ASoC-mchp-spdifrx-disable-all-interrupts-in-mchp_spd.patch new file mode 100644 index 0000000..a1ede9a --- /dev/null +++ b/patches.suse/ASoC-mchp-spdifrx-disable-all-interrupts-in-mchp_spd.patch @@ -0,0 +1,38 @@ +From aaecdc32b7e35b4f9b457fb3509414aa9a932589 Mon Sep 17 00:00:00 2001 +From: Claudiu Beznea +Date: Mon, 30 Jan 2023 14:06:43 +0200 +Subject: [PATCH] ASoC: mchp-spdifrx: disable all interrupts in mchp_spdifrx_dai_remove() +Git-commit: aaecdc32b7e35b4f9b457fb3509414aa9a932589 +Patch-mainline: v6.3-rc1 +References: git-fixes + +CSC interrupts which might be used in controls are on bits 8 and 9 of +SPDIFRX_IDR register. Thus disable all the interrupts that are exported +by driver. + +Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230130120647.638049-5-claudiu.beznea@microchip.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/atmel/mchp-spdifrx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c +index 31ffaaf46dec..b81fc77728df 100644 +--- a/sound/soc/atmel/mchp-spdifrx.c ++++ b/sound/soc/atmel/mchp-spdifrx.c +@@ -921,7 +921,7 @@ static int mchp_spdifrx_dai_remove(struct snd_soc_dai *dai) + struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai); + + /* Disable interrupts */ +- regmap_write(dev->regmap, SPDIFRX_IDR, 0xFF); ++ regmap_write(dev->regmap, SPDIFRX_IDR, GENMASK(14, 0)); + + clk_disable_unprepare(dev->pclk); + +-- +2.35.3 + diff --git a/patches.suse/ASoC-mchp-spdifrx-fix-controls-which-rely-on-rsr-reg.patch b/patches.suse/ASoC-mchp-spdifrx-fix-controls-which-rely-on-rsr-reg.patch new file mode 100644 index 0000000..75bf0a2 --- /dev/null +++ b/patches.suse/ASoC-mchp-spdifrx-fix-controls-which-rely-on-rsr-reg.patch @@ -0,0 +1,365 @@ +From fa09fa60385abbf99342494b280da8b4aebbc0e9 Mon Sep 17 00:00:00 2001 +From: Claudiu Beznea +Date: Mon, 30 Jan 2023 14:06:40 +0200 +Subject: [PATCH] ASoC: mchp-spdifrx: fix controls which rely on rsr register +Git-commit: fa09fa60385abbf99342494b280da8b4aebbc0e9 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The SPDIFRX block is clocked by 2 clocks: peripheral and generic clocks. +Peripheral clock feeds user interface (registers) and generic clock feeds +the receiver. + +To enable the receiver the generic clock needs to be enabled and also the +ENABLE bit of MCHP_SPDIFRX_MR register need to be set. + +The signal control exported by mchp-spdifrx driver reports wrong status +when the receiver is disabled. This can happen when requesting the signal +and the capture was not previously started. To solve this the receiver +needs to be enabled (by enabling generic clock and setting ENABLE bit of +MR register) before reading the signal status. + +As with this fix there are 2 paths now that need to control the generic +clock and ENABLE bit of SPDIFRX_MR register (one path though controls, one +path though configuration) a mutex has been introduced. We can't rely on +subsystem locking as the controls are protected by +struct snd_card::controls_rwsem semaphore and configuration is protected +by a different lock (embedded in snd_pcm_stream_lock_irq()). + +The introduction of mutex is also extended to other controls which rely on +SPDIFRX_RSR.ULOCK bit as it has been discovered experimentally that having +both clocks enabled but not the receiver (through ENABLE bit of SPDIFRX.MR) +leads to inconsistent values of SPDIFRX_RSR.ULOCK. Thus on some controls we +rely on software state (dev->trigger_enabled protected by mutex) to +retrieve proper values. + +Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230130120647.638049-2-claudiu.beznea@microchip.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/atmel/mchp-spdifrx.c | 192 ++++++++++++++++++++++++--------- + 1 file changed, 142 insertions(+), 50 deletions(-) + +diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c +index ec0705cc40fa..2d86e0ec930f 100644 +--- a/sound/soc/atmel/mchp-spdifrx.c ++++ b/sound/soc/atmel/mchp-spdifrx.c +@@ -233,11 +233,13 @@ struct mchp_spdifrx_dev { + struct mchp_spdifrx_mixer_control control; + spinlock_t blockend_lock; /* protect access to blockend_refcount */ + int blockend_refcount; ++ struct mutex mlock; + struct device *dev; + struct regmap *regmap; + struct clk *pclk; + struct clk *gclk; + unsigned int fmt; ++ unsigned int trigger_enabled; + unsigned int gclk_enabled:1; + }; + +@@ -353,47 +355,40 @@ static int mchp_spdifrx_trigger(struct snd_pcm_substream *substream, int cmd, + struct snd_soc_dai *dai) + { + struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai); +- u32 mr; +- int running; +- int ret; +- +- regmap_read(dev->regmap, SPDIFRX_MR, &mr); +- running = !!(mr & SPDIFRX_MR_RXEN_ENABLE); ++ int ret = 0; + + switch (cmd) { + case SNDRV_PCM_TRIGGER_START: + case SNDRV_PCM_TRIGGER_RESUME: + case SNDRV_PCM_TRIGGER_PAUSE_RELEASE: +- if (!running) { +- mr &= ~SPDIFRX_MR_RXEN_MASK; +- mr |= SPDIFRX_MR_RXEN_ENABLE; +- /* enable overrun interrupts */ +- regmap_write(dev->regmap, SPDIFRX_IER, +- SPDIFRX_IR_OVERRUN); +- } ++ mutex_lock(&dev->mlock); ++ /* Enable overrun interrupts */ ++ regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_OVERRUN); ++ ++ /* Enable receiver. */ ++ regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK, ++ SPDIFRX_MR_RXEN_ENABLE); ++ dev->trigger_enabled = true; ++ mutex_unlock(&dev->mlock); + break; + case SNDRV_PCM_TRIGGER_STOP: + case SNDRV_PCM_TRIGGER_SUSPEND: + case SNDRV_PCM_TRIGGER_PAUSE_PUSH: +- if (running) { +- mr &= ~SPDIFRX_MR_RXEN_MASK; +- mr |= SPDIFRX_MR_RXEN_DISABLE; +- /* disable overrun interrupts */ +- regmap_write(dev->regmap, SPDIFRX_IDR, +- SPDIFRX_IR_OVERRUN); +- } ++ mutex_lock(&dev->mlock); ++ /* Disable overrun interrupts */ ++ regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_OVERRUN); ++ ++ /* Disable receiver. */ ++ regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK, ++ SPDIFRX_MR_RXEN_DISABLE); ++ dev->trigger_enabled = false; ++ mutex_unlock(&dev->mlock); + break; + default: +- return -EINVAL; ++ ret = -EINVAL; + } + +- ret = regmap_write(dev->regmap, SPDIFRX_MR, mr); +- if (ret) { +- dev_err(dev->dev, "unable to enable/disable RX: %d\n", ret); +- return ret; +- } +- +- return 0; ++ return ret; + } + + static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream, +@@ -413,13 +408,6 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream, + return -EINVAL; + } + +- regmap_read(dev->regmap, SPDIFRX_MR, &mr); +- +- if (mr & SPDIFRX_MR_RXEN_ENABLE) { +- dev_err(dev->dev, "PCM already running\n"); +- return -EBUSY; +- } +- + if (params_channels(params) != SPDIFRX_CHANNELS) { + dev_err(dev->dev, "unsupported number of channels: %d\n", + params_channels(params)); +@@ -445,6 +433,13 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream, + return -EINVAL; + } + ++ mutex_lock(&dev->mlock); ++ if (dev->trigger_enabled) { ++ dev_err(dev->dev, "PCM already running\n"); ++ ret = -EBUSY; ++ goto unlock; ++ } ++ + if (dev->gclk_enabled) { + clk_disable_unprepare(dev->gclk); + dev->gclk_enabled = 0; +@@ -455,19 +450,24 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream, + dev_err(dev->dev, + "unable to set gclk min rate: rate %u * ratio %u + 1\n", + params_rate(params), SPDIFRX_GCLK_RATIO_MIN); +- return ret; ++ goto unlock; + } + ret = clk_prepare_enable(dev->gclk); + if (ret) { + dev_err(dev->dev, "unable to enable gclk: %d\n", ret); +- return ret; ++ goto unlock; + } + dev->gclk_enabled = 1; + + dev_dbg(dev->dev, "GCLK range min set to %d\n", + params_rate(params) * SPDIFRX_GCLK_RATIO_MIN + 1); + +- return regmap_write(dev->regmap, SPDIFRX_MR, mr); ++ ret = regmap_write(dev->regmap, SPDIFRX_MR, mr); ++ ++unlock: ++ mutex_unlock(&dev->mlock); ++ ++ return ret; + } + + static int mchp_spdifrx_hw_free(struct snd_pcm_substream *substream, +@@ -475,10 +475,12 @@ static int mchp_spdifrx_hw_free(struct snd_pcm_substream *substream, + { + struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai); + ++ mutex_lock(&dev->mlock); + if (dev->gclk_enabled) { + clk_disable_unprepare(dev->gclk); + dev->gclk_enabled = 0; + } ++ mutex_unlock(&dev->mlock); + return 0; + } + +@@ -627,10 +629,24 @@ static int mchp_spdifrx_ulock_get(struct snd_kcontrol *kcontrol, + u32 val; + bool ulock_old = ctrl->ulock; + +- regmap_read(dev->regmap, SPDIFRX_RSR, &val); +- ctrl->ulock = !(val & SPDIFRX_RSR_ULOCK); ++ mutex_lock(&dev->mlock); ++ ++ /* ++ * The RSR.ULOCK has wrong value if both pclk and gclk are enabled ++ * and the receiver is disabled. Thus we take into account the ++ * dev->trigger_enabled here to return a real status. ++ */ ++ if (dev->trigger_enabled) { ++ regmap_read(dev->regmap, SPDIFRX_RSR, &val); ++ ctrl->ulock = !(val & SPDIFRX_RSR_ULOCK); ++ } else { ++ ctrl->ulock = 0; ++ } ++ + uvalue->value.integer.value[0] = ctrl->ulock; + ++ mutex_unlock(&dev->mlock); ++ + return ulock_old != ctrl->ulock; + } + +@@ -643,8 +659,22 @@ static int mchp_spdifrx_badf_get(struct snd_kcontrol *kcontrol, + u32 val; + bool badf_old = ctrl->badf; + +- regmap_read(dev->regmap, SPDIFRX_RSR, &val); +- ctrl->badf = !!(val & SPDIFRX_RSR_BADF); ++ mutex_lock(&dev->mlock); ++ ++ /* ++ * The RSR.ULOCK has wrong value if both pclk and gclk are enabled ++ * and the receiver is disabled. Thus we take into account the ++ * dev->trigger_enabled here to return a real status. ++ */ ++ if (dev->trigger_enabled) { ++ regmap_read(dev->regmap, SPDIFRX_RSR, &val); ++ ctrl->badf = !!(val & SPDIFRX_RSR_BADF); ++ } else { ++ ctrl->badf = 0; ++ } ++ ++ mutex_unlock(&dev->mlock); ++ + uvalue->value.integer.value[0] = ctrl->badf; + + return badf_old != ctrl->badf; +@@ -656,11 +686,48 @@ static int mchp_spdifrx_signal_get(struct snd_kcontrol *kcontrol, + struct snd_soc_dai *dai = snd_kcontrol_chip(kcontrol); + struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai); + struct mchp_spdifrx_mixer_control *ctrl = &dev->control; +- u32 val; ++ u32 val = ~0U, loops = 10; ++ int ret; + bool signal_old = ctrl->signal; + +- regmap_read(dev->regmap, SPDIFRX_RSR, &val); +- ctrl->signal = !(val & SPDIFRX_RSR_NOSIGNAL); ++ mutex_lock(&dev->mlock); ++ ++ /* ++ * To get the signal we need to have receiver enabled. This ++ * could be enabled also from trigger() function thus we need to ++ * take care of not disabling the receiver when it runs. ++ */ ++ if (!dev->trigger_enabled) { ++ ret = clk_prepare_enable(dev->gclk); ++ if (ret) ++ goto unlock; ++ ++ regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK, ++ SPDIFRX_MR_RXEN_ENABLE); ++ ++ /* Wait for RSR.ULOCK bit. */ ++ while (--loops) { ++ regmap_read(dev->regmap, SPDIFRX_RSR, &val); ++ if (!(val & SPDIFRX_RSR_ULOCK)) ++ break; ++ usleep_range(100, 150); ++ } ++ ++ regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK, ++ SPDIFRX_MR_RXEN_DISABLE); ++ ++ clk_disable_unprepare(dev->gclk); ++ } else { ++ regmap_read(dev->regmap, SPDIFRX_RSR, &val); ++ } ++ ++unlock: ++ mutex_unlock(&dev->mlock); ++ ++ if (!(val & SPDIFRX_RSR_ULOCK)) ++ ctrl->signal = !(val & SPDIFRX_RSR_NOSIGNAL); ++ else ++ ctrl->signal = 0; + uvalue->value.integer.value[0] = ctrl->signal; + + return signal_old != ctrl->signal; +@@ -685,18 +752,32 @@ static int mchp_spdifrx_rate_get(struct snd_kcontrol *kcontrol, + u32 val; + int rate; + +- regmap_read(dev->regmap, SPDIFRX_RSR, &val); +- +- /* if the receiver is not locked, ISF data is invalid */ +- if (val & SPDIFRX_RSR_ULOCK || !(val & SPDIFRX_RSR_IFS_MASK)) { ++ mutex_lock(&dev->mlock); ++ ++ /* ++ * The RSR.ULOCK has wrong value if both pclk and gclk are enabled ++ * and the receiver is disabled. Thus we take into account the ++ * dev->trigger_enabled here to return a real status. ++ */ ++ if (dev->trigger_enabled) { ++ regmap_read(dev->regmap, SPDIFRX_RSR, &val); ++ /* If the receiver is not locked, ISF data is invalid. */ ++ if (val & SPDIFRX_RSR_ULOCK || !(val & SPDIFRX_RSR_IFS_MASK)) { ++ ucontrol->value.integer.value[0] = 0; ++ goto unlock; ++ } ++ } else { ++ /* Reveicer is not locked, IFS data is invalid. */ + ucontrol->value.integer.value[0] = 0; +- return 0; ++ goto unlock; + } + + rate = clk_get_rate(dev->gclk); + + ucontrol->value.integer.value[0] = rate / (32 * SPDIFRX_RSR_IFS(val)); + ++unlock: ++ mutex_unlock(&dev->mlock); + return 0; + } + +@@ -913,7 +994,18 @@ static int mchp_spdifrx_probe(struct platform_device *pdev) + "failed to get the PMC generated clock: %d\n", err); + return err; + } ++ ++ /* ++ * Signal control need a valid rate on gclk. hw_params() configures ++ * it propertly but requesting signal before any hw_params() has been ++ * called lead to invalid value returned for signal. Thus, configure ++ * gclk at a valid rate, here, in initialization, to simplify the ++ * control path. ++ */ ++ clk_set_min_rate(dev->gclk, 48000 * SPDIFRX_GCLK_RATIO_MIN + 1); ++ + spin_lock_init(&dev->blockend_lock); ++ mutex_init(&dev->mlock); + + dev->dev = &pdev->dev; + dev->regmap = regmap; +-- +2.35.3 + diff --git a/patches.suse/ASoC-rsnd-Remove-unnecessary-rsnd_dbg_dai_call.patch b/patches.suse/ASoC-rsnd-Remove-unnecessary-rsnd_dbg_dai_call.patch new file mode 100644 index 0000000..a6b4857 --- /dev/null +++ b/patches.suse/ASoC-rsnd-Remove-unnecessary-rsnd_dbg_dai_call.patch @@ -0,0 +1,46 @@ +From e5a3c491e194768f4899e8d1746301542cd7c1e8 Mon Sep 17 00:00:00 2001 +From: Kuninori Morimoto +Date: Wed, 1 Feb 2023 01:59:58 +0000 +Subject: [PATCH] ASoC: rsnd: Remove unnecessary rsnd_dbg_dai_call() +Git-commit: e5a3c491e194768f4899e8d1746301542cd7c1e8 +Patch-mainline: v6.3-rc1 +References: git-fixes + +commit b43b8ae87c8e0a8 ("ASoC: rsnd: protect mod->status") removed +RSND_DEBUG_NO_DAI_CALL and rsnd_dbg_dai_call(), but these are still +exist on rsnd.h. This patch removes it. + +Fixes: b43b8ae87c8e ("ASoC: rsnd: protect mod->status") +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/875ycm6t7l.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/sh/rcar/rsnd.h | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h +index f8ef6836ef84..a09b3612b7f9 100644 +--- a/sound/soc/sh/rcar/rsnd.h ++++ b/sound/soc/sh/rcar/rsnd.h +@@ -891,16 +891,6 @@ void rsnd_mod_make_sure(struct rsnd_mod *mod, enum rsnd_mod_type type); + dev_info(dev, param); \ + } while (0) + +-/* +- * If you don't need rsnd_dai_call debug message, +- * define RSND_DEBUG_NO_DAI_CALL as 1 on top of core.c +- * +- * #define RSND_DEBUG_NO_DAI_CALL 1 +- */ +-#define rsnd_dbg_dai_call(dev, param...) \ +- if (!IS_BUILTIN(RSND_DEBUG_NO_DAI_CALL)) \ +- dev_dbg(dev, param) +- + #ifdef CONFIG_DEBUG_FS + int rsnd_debugfs_probe(struct snd_soc_component *component); + void rsnd_debugfs_reg_show(struct seq_file *m, phys_addr_t _addr, +-- +2.35.3 + diff --git a/patches.suse/ASoC-rsnd-fixup-endif-position.patch b/patches.suse/ASoC-rsnd-fixup-endif-position.patch new file mode 100644 index 0000000..669f00f --- /dev/null +++ b/patches.suse/ASoC-rsnd-fixup-endif-position.patch @@ -0,0 +1,44 @@ +From 49123b51cd896e00b256a27c2ce9e6bfe1bbc22f Mon Sep 17 00:00:00 2001 +From: Kuninori Morimoto +Date: Wed, 1 Feb 2023 01:59:52 +0000 +Subject: [PATCH] ASoC: rsnd: fixup #endif position +Git-commit: 49123b51cd896e00b256a27c2ce9e6bfe1bbc22f +Patch-mainline: v6.3-rc1 +References: git-fixes + +commit 1f9c82b5ab83ff2 ("ASoC: rsnd: add debugfs support") added +CONFIG_DEBUG_FS related definitions on rsnd.h, but it should be +added inside of RSND_H. This patch fixup it. + +Fixes: 1f9c82b5ab83 ("ASoC: rsnd: add debugfs support") +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/877cx26t7r.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/sh/rcar/rsnd.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h +index d9cd190d7e19..f8ef6836ef84 100644 +--- a/sound/soc/sh/rcar/rsnd.h ++++ b/sound/soc/sh/rcar/rsnd.h +@@ -901,8 +901,6 @@ void rsnd_mod_make_sure(struct rsnd_mod *mod, enum rsnd_mod_type type); + if (!IS_BUILTIN(RSND_DEBUG_NO_DAI_CALL)) \ + dev_dbg(dev, param) + +-#endif +- + #ifdef CONFIG_DEBUG_FS + int rsnd_debugfs_probe(struct snd_soc_component *component); + void rsnd_debugfs_reg_show(struct seq_file *m, phys_addr_t _addr, +@@ -913,3 +911,5 @@ void rsnd_debugfs_mod_reg_show(struct seq_file *m, struct rsnd_mod *mod, + #else + #define rsnd_debugfs_probe NULL + #endif ++ ++#endif /* RSND_H */ +-- +2.35.3 + diff --git a/patches.suse/ASoC-rt715-sdca-fix-clock-stop-prepare-timeout-issue.patch b/patches.suse/ASoC-rt715-sdca-fix-clock-stop-prepare-timeout-issue.patch new file mode 100644 index 0000000..12f58f7 --- /dev/null +++ b/patches.suse/ASoC-rt715-sdca-fix-clock-stop-prepare-timeout-issue.patch @@ -0,0 +1,36 @@ +From 2036890282d56bcbf7f915ba9e04bf77967ab231 Mon Sep 17 00:00:00 2001 +From: Jack Yu +Date: Mon, 30 Jan 2023 02:43:25 +0000 +Subject: [PATCH] ASoC: rt715-sdca: fix clock stop prepare timeout issue +Git-commit: 2036890282d56bcbf7f915ba9e04bf77967ab231 +Patch-mainline: v6.2-rc8 +References: git-fixes + +Modify clock_stop_timeout value for rt715-sdca according to +the requirement of internal clock trimming. + +Signed-off-by: Jack Yu +Link: https://lore.kernel.org/r/574b6586267a458cac78c5ac4d5b10bd@realtek.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/codecs/rt715-sdca-sdw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt715-sdca-sdw.c b/sound/soc/codecs/rt715-sdca-sdw.c +index 3f981a9e7fb6..c54ecf3e6987 100644 +--- a/sound/soc/codecs/rt715-sdca-sdw.c ++++ b/sound/soc/codecs/rt715-sdca-sdw.c +@@ -167,7 +167,7 @@ static int rt715_sdca_read_prop(struct sdw_slave *slave) + } + + /* set the timeout values */ +- prop->clk_stop_timeout = 20; ++ prop->clk_stop_timeout = 200; + + return 0; + } +-- +2.35.3 + diff --git a/patches.suse/ASoC-soc-compress.c-fixup-private_data-on-snd_soc_ne.patch b/patches.suse/ASoC-soc-compress.c-fixup-private_data-on-snd_soc_ne.patch new file mode 100644 index 0000000..8cde4f1 --- /dev/null +++ b/patches.suse/ASoC-soc-compress.c-fixup-private_data-on-snd_soc_ne.patch @@ -0,0 +1,41 @@ +From ffe4c0f0bfaa571a676a0e946d4a6a0607f94294 Mon Sep 17 00:00:00 2001 +From: Kuninori Morimoto +Date: Mon, 23 Jan 2023 23:17:20 +0000 +Subject: [PATCH] ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress() +Git-commit: ffe4c0f0bfaa571a676a0e946d4a6a0607f94294 +Patch-mainline: v6.3-rc1 +References: git-fixes + +commit d3268a40d4b19f ("ASoC: soc-compress.c: fix NULL dereference") +enables DPCM capture, but it should independent from playback. +This patch fixup it. + +Fixes: d3268a40d4b1 ("ASoC: soc-compress.c: fix NULL dereference") +Link: https://lore.kernel.org/r/87tu0i6j7j.wl-kuninori.morimoto.gx@renesas.com +Acked-by: Charles Keepax +Acked-by: Pierre-Louis Bossart +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/871qnkvo1s.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/soc-compress.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c +index 7bce5088b455..e7aa6f360cab 100644 +--- a/sound/soc/soc-compress.c ++++ b/sound/soc/soc-compress.c +@@ -626,7 +626,7 @@ int snd_soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num) + rtd->fe_compr = 1; + if (rtd->dai_link->dpcm_playback) + be_pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream->private_data = rtd; +- else if (rtd->dai_link->dpcm_capture) ++ if (rtd->dai_link->dpcm_capture) + be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream->private_data = rtd; + memcpy(compr->ops, &soc_compr_dyn_ops, sizeof(soc_compr_dyn_ops)); + } else { +-- +2.35.3 + diff --git a/patches.suse/ASoC-soc-dapm.h-fixup-warning-struct-snd_pcm_substre.patch b/patches.suse/ASoC-soc-dapm.h-fixup-warning-struct-snd_pcm_substre.patch new file mode 100644 index 0000000..a2f96ee --- /dev/null +++ b/patches.suse/ASoC-soc-dapm.h-fixup-warning-struct-snd_pcm_substre.patch @@ -0,0 +1,37 @@ +From fdff966bfde7cf0c85562d2bfb1ff1ba83da5f7b Mon Sep 17 00:00:00 2001 +From: Lucas Tanure +Date: Wed, 15 Feb 2023 13:28:51 +0000 +Subject: [PATCH] ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared +Git-commit: fdff966bfde7cf0c85562d2bfb1ff1ba83da5f7b +Patch-mainline: v6.3-rc1 +References: git-fixes + +Add struct snd_pcm_substream forward declaration + +Fixes: 078a85f2806f ("ASoC: dapm: Only power up active channels from a DAI") +Signed-off-by: Lucas Tanure +Reviewed-by: Charles Keepax +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20230215132851.1626881-1-lucas.tanure@collabora.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + include/sound/soc-dapm.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h +index 77495e5988c1..64915ebd641e 100644 +--- a/include/sound/soc-dapm.h ++++ b/include/sound/soc-dapm.h +@@ -16,6 +16,7 @@ + #include + + struct device; ++struct snd_pcm_substream; + struct snd_soc_pcm_runtime; + struct soc_enum; + +-- +2.35.3 + diff --git a/patches.suse/ASoC-tlv320adcx140-fix-ti-gpio-config-DT-property-in.patch b/patches.suse/ASoC-tlv320adcx140-fix-ti-gpio-config-DT-property-in.patch new file mode 100644 index 0000000..3dbfbc8 --- /dev/null +++ b/patches.suse/ASoC-tlv320adcx140-fix-ti-gpio-config-DT-property-in.patch @@ -0,0 +1,50 @@ +From 771725efe5e2e5396dd9d1220437e5f9d6b9ca9d Mon Sep 17 00:00:00 2001 +From: Steffen Aschbacher +Date: Mon, 13 Feb 2023 09:38:05 +0200 +Subject: [PATCH] ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init +Git-commit: 771725efe5e2e5396dd9d1220437e5f9d6b9ca9d +Patch-mainline: v6.3-rc1 +References: git-fixes + +When the 'ti,gpio-config' property is not defined, the +device_property_count_u32() will return an error, rather than zero. + +The current check, only handles a return value of zero, which assumes that +the property is defined and has nothing defined. + +This change extends the check to also check for an error case (most likely +to be hit by the case that the 'ti,gpio-config' is not defined). + +In case that the 'ti,gpio-config' and the returned 'gpio_count' is not +correct, there is a 'if (gpio_count != ADCX140_NUM_GPIO_CFGS)' check, a few +lines lower that will return -EINVAL. +This means that someone tried to define 'ti,gpio-config', but with the +wrong number of GPIOs. + +Fixes: d5214321498a ("ASoC: tlv320adcx140: Add support for configuring GPIO pin") +Signed-off-by: Steffen Aschbacher +Signed-off-by: Alexandru Ardelean +Link: https://lore.kernel.org/r/20230213073805.14640-1-alex@shruggie.ro +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + sound/soc/codecs/tlv320adcx140.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/tlv320adcx140.c b/sound/soc/codecs/tlv320adcx140.c +index 91a22d927915..530f321d08e9 100644 +--- a/sound/soc/codecs/tlv320adcx140.c ++++ b/sound/soc/codecs/tlv320adcx140.c +@@ -925,7 +925,7 @@ static int adcx140_configure_gpio(struct adcx140_priv *adcx140) + + gpio_count = device_property_count_u32(adcx140->dev, + "ti,gpio-config"); +- if (gpio_count == 0) ++ if (gpio_count <= 0) + return 0; + + if (gpio_count != ADCX140_NUM_GPIO_CFGS) +-- +2.35.3 + diff --git a/patches.suse/Bluetooth-L2CAP-Fix-potential-user-after-free.patch b/patches.suse/Bluetooth-L2CAP-Fix-potential-user-after-free.patch new file mode 100644 index 0000000..13fd548 --- /dev/null +++ b/patches.suse/Bluetooth-L2CAP-Fix-potential-user-after-free.patch @@ -0,0 +1,93 @@ +From df5703348813235874d851934e957c3723d71644 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Wed, 1 Feb 2023 14:01:11 -0800 +Subject: [PATCH] Bluetooth: L2CAP: Fix potential user-after-free +Git-commit: df5703348813235874d851934e957c3723d71644 +Patch-mainline: v6.3-rc1 +References: git-fixes + +This fixes all instances of which requires to allocate a buffer calling +alloc_skb which may release the chan lock and reacquire later which +makes it possible that the chan is disconnected in the meantime. + +Fixes: a6a5568c03c4 ("Bluetooth: Lock the L2CAP channel when sending") +Reported-by: Alexander Coffin +Signed-off-by: Luiz Augusto von Dentz +Acked-by: Takashi Iwai + +--- + net/bluetooth/l2cap_core.c | 24 ------------------------ + net/bluetooth/l2cap_sock.c | 8 ++++++++ + 2 files changed, 8 insertions(+), 24 deletions(-) + +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index a3e0dc6a6e73..adfc3ea06d08 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -2683,14 +2683,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len) + if (IS_ERR(skb)) + return PTR_ERR(skb); + +- /* Channel lock is released before requesting new skb and then +- * reacquired thus we need to recheck channel state. +- */ +- if (chan->state != BT_CONNECTED) { +- kfree_skb(skb); +- return -ENOTCONN; +- } +- + l2cap_do_send(chan, skb); + return len; + } +@@ -2735,14 +2727,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len) + if (IS_ERR(skb)) + return PTR_ERR(skb); + +- /* Channel lock is released before requesting new skb and then +- * reacquired thus we need to recheck channel state. +- */ +- if (chan->state != BT_CONNECTED) { +- kfree_skb(skb); +- return -ENOTCONN; +- } +- + l2cap_do_send(chan, skb); + err = len; + break; +@@ -2763,14 +2747,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len) + */ + err = l2cap_segment_sdu(chan, &seg_queue, msg, len); + +- /* The channel could have been closed while segmenting, +- * check that it is still connected. +- */ +- if (chan->state != BT_CONNECTED) { +- __skb_queue_purge(&seg_queue); +- err = -ENOTCONN; +- } +- + if (err) + break; + +diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c +index ca8f07f3542b..eebe256104bc 100644 +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -1624,6 +1624,14 @@ static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan, + if (!skb) + return ERR_PTR(err); + ++ /* Channel lock is released before requesting new skb and then ++ * reacquired thus we need to recheck channel state. ++ */ ++ if (chan->state != BT_CONNECTED) { ++ kfree_skb(skb); ++ return ERR_PTR(-ENOTCONN); ++ } ++ + skb->priority = sk->sk_priority; + + bt_cb(skb)->l2cap.chan = chan; +-- +2.35.3 + diff --git a/patches.suse/Bluetooth-hci_qca-get-wakeup-status-from-serdev-devi.patch b/patches.suse/Bluetooth-hci_qca-get-wakeup-status-from-serdev-devi.patch new file mode 100644 index 0000000..7db4ff0 --- /dev/null +++ b/patches.suse/Bluetooth-hci_qca-get-wakeup-status-from-serdev-devi.patch @@ -0,0 +1,38 @@ +From 03b0093f7b310493bc944a20f725228cfe0d3fea Mon Sep 17 00:00:00 2001 +From: Zhengping Jiang +Date: Thu, 2 Feb 2023 09:47:01 -0800 +Subject: [PATCH] Bluetooth: hci_qca: get wakeup status from serdev device handle +Git-commit: 03b0093f7b310493bc944a20f725228cfe0d3fea +Patch-mainline: v6.3-rc1 +References: git-fixes + +Bluetooth controller attached via the UART is handled by the serdev driver. +Get the wakeup status from the device handle through serdev, instead of the +parent path. + +Fixes: c1a74160eaf1 ("Bluetooth: hci_qca: Add device_may_wakeup support") +Signed-off-by: Zhengping Jiang +Signed-off-by: Luiz Augusto von Dentz +Acked-by: Takashi Iwai + +--- + drivers/bluetooth/hci_qca.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/bluetooth/hci_qca.c ++++ b/drivers/bluetooth/hci_qca.c +@@ -1582,10 +1582,11 @@ static bool qca_prevent_wake(struct hci_ + struct hci_uart *hu = hci_get_drvdata(hdev); + bool wakeup; + +- /* UART driver handles the interrupt from BT SoC.So we need to use +- * device handle of UART driver to get the status of device may wakeup. ++ /* BT SoC attached through the serial bus is handled by the serdev driver. ++ * So we need to use the device handle of the serdev driver to get the ++ * status of device may wakeup. + */ +- wakeup = device_may_wakeup(hu->serdev->ctrl->dev.parent); ++ wakeup = device_may_wakeup(&hu->serdev->ctrl->dev); + bt_dev_dbg(hu->hdev, "wakeup status : %d", wakeup); + + return !wakeup; diff --git a/patches.suse/Documentation-simplify-and-clarify-DCO-contribution-.patch b/patches.suse/Documentation-simplify-and-clarify-DCO-contribution-.patch new file mode 100644 index 0000000..272be34 --- /dev/null +++ b/patches.suse/Documentation-simplify-and-clarify-DCO-contribution-.patch @@ -0,0 +1,54 @@ +From d4563201f33a022fc0353033d9dfeb1606a88330 Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Sun, 26 Feb 2023 11:25:04 -0800 +Subject: [PATCH] Documentation: simplify and clarify DCO contribution example language +Git-commit: d4563201f33a022fc0353033d9dfeb1606a88330 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Long long ago, in a more innocent time, Greg wrote the clarification for +how the DCO should work and that you couldn't make anonymous +contributions, because the sign-off needed to be something we could +check back with. + +It was 2006, and nobody reacted to the wording, the whole Facebook 'real +name' controversy was a decade in the future, and nobody even thought +about it. And despite the language, we've always accepted nicknames and +that language was never meant to be any kind of exclusionary wording. + +In fact, even when it became a discussion in other adjacent projects, +apparently nobody even thought to just clarify the language in the +kernel docs, and instead we had projects like the CNCF that had long +discussions about it, and wrote their own clarifications [1] of it. + +Just simplify the wording to the point where it shouldn't be causing +unnecessary angst and pain, or scare away people who go by preferred +naming. + +Link: https://github.com/cncf/foundation/blob/659fd32c86dc/dco-guidelines.md [1] +Fixes: af45f32d25cc ("We can not allow anonymous contributions to the kernel") +Acked-by: Greg KH +Acked-by: Michael Dolan +Signed-off-by: Linus Torvalds +Acked-by: Takashi Iwai + +--- + Documentation/process/submitting-patches.rst | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/process/submitting-patches.rst b/Documentation/process/submitting-patches.rst +index 7dc94555417d..fab44ae732e3 100644 +--- a/Documentation/process/submitting-patches.rst ++++ b/Documentation/process/submitting-patches.rst +@@ -407,7 +407,7 @@ then you just add a line saying:: + + Signed-off-by: Random J Developer + +-using your real name (sorry, no pseudonyms or anonymous contributions.) ++using a known identity (sorry, no anonymous contributions.) + This will be done for you automatically if you use ``git commit -s``. + Reverts should also include "Signed-off-by". ``git revert -s`` does that + for you. +-- +2.35.3 + diff --git a/patches.suse/HID-asus-use-spinlock-to-protect-concurrent-accesses.patch b/patches.suse/HID-asus-use-spinlock-to-protect-concurrent-accesses.patch new file mode 100644 index 0000000..919ad18 --- /dev/null +++ b/patches.suse/HID-asus-use-spinlock-to-protect-concurrent-accesses.patch @@ -0,0 +1,102 @@ +From 315c537068a13f0b5681d33dd045a912f4bece6f Mon Sep 17 00:00:00 2001 +From: Pietro Borrello +Date: Sun, 12 Feb 2023 19:00:02 +0000 +Subject: [PATCH] HID: asus: use spinlock to protect concurrent accesses +Git-commit: 315c537068a13f0b5681d33dd045a912f4bece6f +Patch-mainline: v6.3-rc1 +References: git-fixes + +asus driver has a worker that may access data concurrently. +Proct the accesses using a spinlock. + +Fixes: af22a610bc38 ("HID: asus: support backlight on USB keyboards") +Signed-off-by: Pietro Borrello +Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-4-7860c5763c38@diag.uniroma1.it +Signed-off-by: Benjamin Tissoires +Acked-by: Takashi Iwai + +--- + drivers/hid/hid-asus.c | 22 +++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c +index f99752b998f3..9f767baf39fb 100644 +--- a/drivers/hid/hid-asus.c ++++ b/drivers/hid/hid-asus.c +@@ -98,6 +98,7 @@ struct asus_kbd_leds { + struct hid_device *hdev; + struct work_struct work; + unsigned int brightness; ++ spinlock_t lock; + bool removed; + }; + +@@ -495,7 +496,12 @@ static void asus_kbd_backlight_set(struct led_classdev *led_cdev, + { + struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, + cdev); ++ unsigned long flags; ++ ++ spin_lock_irqsave(&led->lock, flags); + led->brightness = brightness; ++ spin_unlock_irqrestore(&led->lock, flags); ++ + schedule_work(&led->work); + } + +@@ -503,8 +509,14 @@ static enum led_brightness asus_kbd_backlight_get(struct led_classdev *led_cdev) + { + struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, + cdev); ++ enum led_brightness brightness; ++ unsigned long flags; + +- return led->brightness; ++ spin_lock_irqsave(&led->lock, flags); ++ brightness = led->brightness; ++ spin_unlock_irqrestore(&led->lock, flags); ++ ++ return brightness; + } + + static void asus_kbd_backlight_work(struct work_struct *work) +@@ -512,11 +524,14 @@ static void asus_kbd_backlight_work(struct work_struct *work) + struct asus_kbd_leds *led = container_of(work, struct asus_kbd_leds, work); + u8 buf[] = { FEATURE_KBD_REPORT_ID, 0xba, 0xc5, 0xc4, 0x00 }; + int ret; ++ unsigned long flags; + + if (led->removed) + return; + ++ spin_lock_irqsave(&led->lock, flags); + buf[4] = led->brightness; ++ spin_unlock_irqrestore(&led->lock, flags); + + ret = asus_kbd_set_report(led->hdev, buf, sizeof(buf)); + if (ret < 0) +@@ -584,6 +599,7 @@ static int asus_kbd_register_leds(struct hid_device *hdev) + drvdata->kbd_backlight->cdev.brightness_set = asus_kbd_backlight_set; + drvdata->kbd_backlight->cdev.brightness_get = asus_kbd_backlight_get; + INIT_WORK(&drvdata->kbd_backlight->work, asus_kbd_backlight_work); ++ spin_lock_init(&drvdata->kbd_backlight->lock); + + ret = devm_led_classdev_register(&hdev->dev, &drvdata->kbd_backlight->cdev); + if (ret < 0) { +@@ -1119,9 +1135,13 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id) + static void asus_remove(struct hid_device *hdev) + { + struct asus_drvdata *drvdata = hid_get_drvdata(hdev); ++ unsigned long flags; + + if (drvdata->kbd_backlight) { ++ spin_lock_irqsave(&drvdata->kbd_backlight->lock, flags); + drvdata->kbd_backlight->removed = true; ++ spin_unlock_irqrestore(&drvdata->kbd_backlight->lock, flags); ++ + cancel_work_sync(&drvdata->kbd_backlight->work); + } + +-- +2.35.3 + diff --git a/patches.suse/HID-asus-use-spinlock-to-safely-schedule-workers.patch b/patches.suse/HID-asus-use-spinlock-to-safely-schedule-workers.patch new file mode 100644 index 0000000..aee5925 --- /dev/null +++ b/patches.suse/HID-asus-use-spinlock-to-safely-schedule-workers.patch @@ -0,0 +1,66 @@ +From 4ab3a086d10eeec1424f2e8a968827a6336203df Mon Sep 17 00:00:00 2001 +From: Pietro Borrello +Date: Sun, 12 Feb 2023 19:00:03 +0000 +Subject: [PATCH] HID: asus: use spinlock to safely schedule workers +Git-commit: 4ab3a086d10eeec1424f2e8a968827a6336203df +Patch-mainline: v6.3-rc1 +References: git-fixes + +Use spinlocks to deal with workers introducing a wrapper +asus_schedule_work(), and several spinlock checks. +Otherwise, asus_kbd_backlight_set() may schedule led->work after the +structure has been freed, causing a use-after-free. + +Fixes: af22a610bc38 ("HID: asus: support backlight on USB keyboards") +Signed-off-by: Pietro Borrello +Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-5-7860c5763c38@diag.uniroma1.it +Signed-off-by: Benjamin Tissoires +Acked-by: Takashi Iwai + +--- + drivers/hid/hid-asus.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c +index 9f767baf39fb..d1094bb1aa42 100644 +--- a/drivers/hid/hid-asus.c ++++ b/drivers/hid/hid-asus.c +@@ -491,6 +491,16 @@ static int rog_nkey_led_init(struct hid_device *hdev) + return ret; + } + ++static void asus_schedule_work(struct asus_kbd_leds *led) ++{ ++ unsigned long flags; ++ ++ spin_lock_irqsave(&led->lock, flags); ++ if (!led->removed) ++ schedule_work(&led->work); ++ spin_unlock_irqrestore(&led->lock, flags); ++} ++ + static void asus_kbd_backlight_set(struct led_classdev *led_cdev, + enum led_brightness brightness) + { +@@ -502,7 +512,7 @@ static void asus_kbd_backlight_set(struct led_classdev *led_cdev, + led->brightness = brightness; + spin_unlock_irqrestore(&led->lock, flags); + +- schedule_work(&led->work); ++ asus_schedule_work(led); + } + + static enum led_brightness asus_kbd_backlight_get(struct led_classdev *led_cdev) +@@ -526,9 +536,6 @@ static void asus_kbd_backlight_work(struct work_struct *work) + int ret; + unsigned long flags; + +- if (led->removed) +- return; +- + spin_lock_irqsave(&led->lock, flags); + buf[4] = led->brightness; + spin_unlock_irqrestore(&led->lock, flags); +-- +2.35.3 + diff --git a/patches.suse/HID-bigben-use-spinlock-to-protect-concurrent-access.patch b/patches.suse/HID-bigben-use-spinlock-to-protect-concurrent-access.patch new file mode 100644 index 0000000..93c0d3d --- /dev/null +++ b/patches.suse/HID-bigben-use-spinlock-to-protect-concurrent-access.patch @@ -0,0 +1,173 @@ +From 9fefb6201c4f8dd9f58c581b2a66e5cde2895ea2 Mon Sep 17 00:00:00 2001 +From: Pietro Borrello +Date: Sun, 12 Feb 2023 18:59:59 +0000 +Subject: [PATCH] HID: bigben: use spinlock to protect concurrent accesses +Git-commit: 9fefb6201c4f8dd9f58c581b2a66e5cde2895ea2 +Patch-mainline: v6.3-rc1 +References: CVE-2023-25012 bsc#1207560 + +bigben driver has a worker that may access data concurrently. +Proct the accesses using a spinlock. + +Fixes: 256a90ed9e46 ("HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad") +Signed-off-by: Pietro Borrello +Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-1-7860c5763c38@diag.uniroma1.it +Signed-off-by: Benjamin Tissoires +Acked-by: Takashi Iwai + +--- + drivers/hid/hid-bigbenff.c | 52 ++++++++++++++++++++++++++++++++++++-- + 1 file changed, 50 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c +index e8b16665860d..ed3d2d7bc1dd 100644 +--- a/drivers/hid/hid-bigbenff.c ++++ b/drivers/hid/hid-bigbenff.c +@@ -174,6 +174,7 @@ static __u8 pid0902_rdesc_fixed[] = { + struct bigben_device { + struct hid_device *hid; + struct hid_report *report; ++ spinlock_t lock; + bool removed; + u8 led_state; /* LED1 = 1 .. LED4 = 8 */ + u8 right_motor_on; /* right motor off/on 0/1 */ +@@ -190,12 +191,27 @@ static void bigben_worker(struct work_struct *work) + struct bigben_device *bigben = container_of(work, + struct bigben_device, worker); + struct hid_field *report_field = bigben->report->field[0]; ++ bool do_work_led = false; ++ bool do_work_ff = false; ++ u8 *buf; ++ u32 len; ++ unsigned long flags; + + if (bigben->removed || !report_field) + return; + ++ buf = hid_alloc_report_buf(bigben->report, GFP_KERNEL); ++ if (!buf) ++ return; ++ ++ len = hid_report_len(bigben->report); ++ ++ /* LED work */ ++ spin_lock_irqsave(&bigben->lock, flags); ++ + if (bigben->work_led) { + bigben->work_led = false; ++ do_work_led = true; + report_field->value[0] = 0x01; /* 1 = led message */ + report_field->value[1] = 0x08; /* reserved value, always 8 */ + report_field->value[2] = bigben->led_state; +@@ -204,11 +220,22 @@ static void bigben_worker(struct work_struct *work) + report_field->value[5] = 0x00; /* padding */ + report_field->value[6] = 0x00; /* padding */ + report_field->value[7] = 0x00; /* padding */ +- hid_hw_request(bigben->hid, bigben->report, HID_REQ_SET_REPORT); ++ hid_output_report(bigben->report, buf); ++ } ++ ++ spin_unlock_irqrestore(&bigben->lock, flags); ++ ++ if (do_work_led) { ++ hid_hw_raw_request(bigben->hid, bigben->report->id, buf, len, ++ bigben->report->type, HID_REQ_SET_REPORT); + } + ++ /* FF work */ ++ spin_lock_irqsave(&bigben->lock, flags); ++ + if (bigben->work_ff) { + bigben->work_ff = false; ++ do_work_ff = true; + report_field->value[0] = 0x02; /* 2 = rumble effect message */ + report_field->value[1] = 0x08; /* reserved value, always 8 */ + report_field->value[2] = bigben->right_motor_on; +@@ -217,8 +244,17 @@ static void bigben_worker(struct work_struct *work) + report_field->value[5] = 0x00; /* padding */ + report_field->value[6] = 0x00; /* padding */ + report_field->value[7] = 0x00; /* padding */ +- hid_hw_request(bigben->hid, bigben->report, HID_REQ_SET_REPORT); ++ hid_output_report(bigben->report, buf); ++ } ++ ++ spin_unlock_irqrestore(&bigben->lock, flags); ++ ++ if (do_work_ff) { ++ hid_hw_raw_request(bigben->hid, bigben->report->id, buf, len, ++ bigben->report->type, HID_REQ_SET_REPORT); + } ++ ++ kfree(buf); + } + + static int hid_bigben_play_effect(struct input_dev *dev, void *data, +@@ -228,6 +264,7 @@ static int hid_bigben_play_effect(struct input_dev *dev, void *data, + struct bigben_device *bigben = hid_get_drvdata(hid); + u8 right_motor_on; + u8 left_motor_force; ++ unsigned long flags; + + if (!bigben) { + hid_err(hid, "no device data\n"); +@@ -242,9 +279,12 @@ static int hid_bigben_play_effect(struct input_dev *dev, void *data, + + if (right_motor_on != bigben->right_motor_on || + left_motor_force != bigben->left_motor_force) { ++ spin_lock_irqsave(&bigben->lock, flags); + bigben->right_motor_on = right_motor_on; + bigben->left_motor_force = left_motor_force; + bigben->work_ff = true; ++ spin_unlock_irqrestore(&bigben->lock, flags); ++ + schedule_work(&bigben->worker); + } + +@@ -259,6 +299,7 @@ static void bigben_set_led(struct led_classdev *led, + struct bigben_device *bigben = hid_get_drvdata(hid); + int n; + bool work; ++ unsigned long flags; + + if (!bigben) { + hid_err(hid, "no device data\n"); +@@ -267,6 +308,7 @@ static void bigben_set_led(struct led_classdev *led, + + for (n = 0; n < NUM_LEDS; n++) { + if (led == bigben->leds[n]) { ++ spin_lock_irqsave(&bigben->lock, flags); + if (value == LED_OFF) { + work = (bigben->led_state & BIT(n)); + bigben->led_state &= ~BIT(n); +@@ -274,6 +316,7 @@ static void bigben_set_led(struct led_classdev *led, + work = !(bigben->led_state & BIT(n)); + bigben->led_state |= BIT(n); + } ++ spin_unlock_irqrestore(&bigben->lock, flags); + + if (work) { + bigben->work_led = true; +@@ -307,8 +350,12 @@ static enum led_brightness bigben_get_led(struct led_classdev *led) + static void bigben_remove(struct hid_device *hid) + { + struct bigben_device *bigben = hid_get_drvdata(hid); ++ unsigned long flags; + ++ spin_lock_irqsave(&bigben->lock, flags); + bigben->removed = true; ++ spin_unlock_irqrestore(&bigben->lock, flags); ++ + cancel_work_sync(&bigben->worker); + hid_hw_stop(hid); + } +@@ -362,6 +409,7 @@ static int bigben_probe(struct hid_device *hid, + set_bit(FF_RUMBLE, hidinput->input->ffbit); + + INIT_WORK(&bigben->worker, bigben_worker); ++ spin_lock_init(&bigben->lock); + + error = input_ff_create_memless(hidinput->input, NULL, + hid_bigben_play_effect); +-- +2.35.3 + diff --git a/patches.suse/HID-bigben-use-spinlock-to-safely-schedule-workers.patch b/patches.suse/HID-bigben-use-spinlock-to-safely-schedule-workers.patch new file mode 100644 index 0000000..efc24c0 --- /dev/null +++ b/patches.suse/HID-bigben-use-spinlock-to-safely-schedule-workers.patch @@ -0,0 +1,83 @@ +From 76ca8da989c7d97a7f76c75d475fe95a584439d7 Mon Sep 17 00:00:00 2001 +From: Pietro Borrello +Date: Sun, 12 Feb 2023 19:00:01 +0000 +Subject: [PATCH] HID: bigben: use spinlock to safely schedule workers +Git-commit: 76ca8da989c7d97a7f76c75d475fe95a584439d7 +Patch-mainline: v6.3-rc1 +References: CVE-2023-25012 bsc#1207560 + +Use spinlocks to deal with workers introducing a wrapper +bigben_schedule_work(), and several spinlock checks. +Otherwise, bigben_set_led() may schedule bigben->worker after the +structure has been freed, causing a use-after-free. + +Fixes: 4eb1b01de5b9 ("HID: hid-bigbenff: fix race condition for scheduled work during removal") +Signed-off-by: Pietro Borrello +Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-3-7860c5763c38@diag.uniroma1.it +Signed-off-by: Benjamin Tissoires +Acked-by: Takashi Iwai + +--- + drivers/hid/hid-bigbenff.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c +index b98c5f31c184..9d6560db762b 100644 +--- a/drivers/hid/hid-bigbenff.c ++++ b/drivers/hid/hid-bigbenff.c +@@ -185,6 +185,15 @@ struct bigben_device { + struct work_struct worker; + }; + ++static inline void bigben_schedule_work(struct bigben_device *bigben) ++{ ++ unsigned long flags; ++ ++ spin_lock_irqsave(&bigben->lock, flags); ++ if (!bigben->removed) ++ schedule_work(&bigben->worker); ++ spin_unlock_irqrestore(&bigben->lock, flags); ++} + + static void bigben_worker(struct work_struct *work) + { +@@ -197,9 +206,6 @@ static void bigben_worker(struct work_struct *work) + u32 len; + unsigned long flags; + +- if (bigben->removed) +- return; +- + buf = hid_alloc_report_buf(bigben->report, GFP_KERNEL); + if (!buf) + return; +@@ -285,7 +291,7 @@ static int hid_bigben_play_effect(struct input_dev *dev, void *data, + bigben->work_ff = true; + spin_unlock_irqrestore(&bigben->lock, flags); + +- schedule_work(&bigben->worker); ++ bigben_schedule_work(bigben); + } + + return 0; +@@ -320,7 +326,7 @@ static void bigben_set_led(struct led_classdev *led, + + if (work) { + bigben->work_led = true; +- schedule_work(&bigben->worker); ++ bigben_schedule_work(bigben); + } + return; + } +@@ -450,7 +456,7 @@ static int bigben_probe(struct hid_device *hid, + bigben->left_motor_force = 0; + bigben->work_led = true; + bigben->work_ff = true; +- schedule_work(&bigben->worker); ++ bigben_schedule_work(bigben); + + hid_info(hid, "LED and force feedback support for BigBen gamepad\n"); + +-- +2.35.3 + diff --git a/patches.suse/HID-bigben_worker-remove-unneeded-check-on-report_fi.patch b/patches.suse/HID-bigben_worker-remove-unneeded-check-on-report_fi.patch new file mode 100644 index 0000000..a5d189b --- /dev/null +++ b/patches.suse/HID-bigben_worker-remove-unneeded-check-on-report_fi.patch @@ -0,0 +1,44 @@ +From 27d2a2fd844ec7da70d19fabb482304fd1e0595b Mon Sep 17 00:00:00 2001 +From: Pietro Borrello +Date: Sun, 12 Feb 2023 19:00:00 +0000 +Subject: [PATCH] HID: bigben_worker() remove unneeded check on report_field +Git-commit: 27d2a2fd844ec7da70d19fabb482304fd1e0595b +Patch-mainline: v6.3-rc1 +References: CVE-2023-25012 bsc#1207560 + +bigben_worker() checks report_field to be non-NULL. +The check has been added in commit +918aa1ef104d ("HID: bigbenff: prevent null pointer dereference") +to prevent a NULL pointer crash. +However, the true root cause was a missing check for output +reports, patched in commit +c7bf714f8755 ("HID: check empty report_list in bigben_probe()"), +where the type-confused report list_entry was overlapping with +a NULL pointer, which was then causing the crash. + +Fixes: 918aa1ef104d ("HID: bigbenff: prevent null pointer dereference") +Signed-off-by: Pietro Borrello +Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-2-7860c5763c38@diag.uniroma1.it +Signed-off-by: Benjamin Tissoires +Acked-by: Takashi Iwai + +--- + drivers/hid/hid-bigbenff.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c +index ed3d2d7bc1dd..b98c5f31c184 100644 +--- a/drivers/hid/hid-bigbenff.c ++++ b/drivers/hid/hid-bigbenff.c +@@ -197,7 +197,7 @@ static void bigben_worker(struct work_struct *work) + u32 len; + unsigned long flags; + +- if (bigben->removed || !report_field) ++ if (bigben->removed) + return; + + buf = hid_alloc_report_buf(bigben->report, GFP_KERNEL); +-- +2.35.3 + diff --git a/patches.suse/HID-core-Fix-deadloop-in-hid_apply_multiplier.patch b/patches.suse/HID-core-Fix-deadloop-in-hid_apply_multiplier.patch new file mode 100644 index 0000000..d480ba8 --- /dev/null +++ b/patches.suse/HID-core-Fix-deadloop-in-hid_apply_multiplier.patch @@ -0,0 +1,63 @@ +From ea427a222d8bdf2bc1a8a6da3ebe247f7dced70c Mon Sep 17 00:00:00 2001 +From: Xin Zhao +Date: Mon, 30 Jan 2023 21:29:47 +0000 +Subject: [PATCH] HID: core: Fix deadloop in hid_apply_multiplier. +Git-commit: ea427a222d8bdf2bc1a8a6da3ebe247f7dced70c +Patch-mainline: v6.2-rc8 +References: git-fixes + +The initial value of hid->collection[].parent_idx if 0. When +Report descriptor doesn't contain "HID Collection", the value +remains as 0. + +In the meanwhile, when the Report descriptor fullfill +all following conditions, it will trigger hid_apply_multiplier +function call. +1. Usage page is Generic Desktop Ctrls (0x01) +2. Usage is RESOLUTION_MULTIPLIER (0x48) +3. Contain any FEATURE items + +The while loop in hid_apply_multiplier will search the top-most +collection by searching parent_idx == -1. Because all parent_idx +is 0. The loop will run forever. + +There is a Report Descriptor triggerring the deadloop +0x05, 0x01, // Usage Page (Generic Desktop Ctrls) +0x09, 0x48, // Usage (0x48) +0x95, 0x01, // Report Count (1) +0x75, 0x08, // Report Size (8) +0xB1, 0x01, // Feature + +Signed-off-by: Xin Zhao +Link: https://lore.kernel.org/r/20230130212947.1315941-1-xnzhao@google.com +Signed-off-by: Benjamin Tissoires +Acked-by: Takashi Iwai + +--- + drivers/hid/hid-core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 3e1803592bd4..5c72aef3d3dd 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1202,6 +1202,7 @@ int hid_open_report(struct hid_device *device) + __u8 *end; + __u8 *next; + int ret; ++ int i; + static int (*dispatch_type[])(struct hid_parser *parser, + struct hid_item *item) = { + hid_parser_main, +@@ -1252,6 +1253,8 @@ int hid_open_report(struct hid_device *device) + goto err; + } + device->collection_size = HID_DEFAULT_NUM_COLLECTIONS; ++ for (i = 0; i < HID_DEFAULT_NUM_COLLECTIONS; i++) ++ device->collection[i].parent_idx = -1; + + ret = -EINVAL; + while ((next = fetch_item(start, end, &item)) != NULL) { +-- +2.35.3 + diff --git a/patches.suse/HID-elecom-add-support-for-TrackBall-056E-011C.patch b/patches.suse/HID-elecom-add-support-for-TrackBall-056E-011C.patch new file mode 100644 index 0000000..c83b78d --- /dev/null +++ b/patches.suse/HID-elecom-add-support-for-TrackBall-056E-011C.patch @@ -0,0 +1,106 @@ +From 29f316a1d7e0a570be9a47fa283ece53a67cebb7 Mon Sep 17 00:00:00 2001 +From: Takahiro Fujii +Date: Fri, 20 Jan 2023 03:30:02 +0900 +Subject: [PATCH] HID: elecom: add support for TrackBall 056E:011C +Git-commit: 29f316a1d7e0a570be9a47fa283ece53a67cebb7 +Patch-mainline: v6.2-rc8 +References: git-fixes + +Make function buttons on ELECOM M-HT1DRBK trackball mouse work. This model +has two devices with different device IDs (010D and 011C). Both of +them misreports the number of buttons as 5 in the report descriptor, even +though they have 8 buttons. hid-elecom overwrites the report to fix them, +but supports only on 010D and does not work on 011C. This patch fixes +011C in the similar way but with specialized position parameters. +In fact, it is sufficient to rewrite only 17th byte (05 -> 08). However I +followed the existing way. + +Signed-off-by: Takahiro Fujii +Signed-off-by: Jiri Kosina +Acked-by: Takashi Iwai + +--- + drivers/hid/hid-elecom.c | 16 ++++++++++++++-- + drivers/hid/hid-ids.h | 3 ++- + drivers/hid/hid-quirks.c | 3 ++- + 3 files changed, 18 insertions(+), 4 deletions(-) + +diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c +index e59e9911fc37..4fa45ee77503 100644 +--- a/drivers/hid/hid-elecom.c ++++ b/drivers/hid/hid-elecom.c +@@ -12,6 +12,7 @@ + * Copyright (c) 2017 Alex Manoussakis + * Copyright (c) 2017 Tomasz Kramkowski + * Copyright (c) 2020 YOSHIOKA Takuma ++ * Copyright (c) 2022 Takahiro Fujii + */ + + /* +@@ -89,7 +90,7 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc, + case USB_DEVICE_ID_ELECOM_M_DT1URBK: + case USB_DEVICE_ID_ELECOM_M_DT1DRBK: + case USB_DEVICE_ID_ELECOM_M_HT1URBK: +- case USB_DEVICE_ID_ELECOM_M_HT1DRBK: ++ case USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D: + /* + * Report descriptor format: + * 12: button bit count +@@ -99,6 +100,16 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc, + */ + mouse_button_fixup(hdev, rdesc, *rsize, 12, 30, 14, 20, 8); + break; ++ case USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C: ++ /* ++ * Report descriptor format: ++ * 22: button bit count ++ * 30: padding bit count ++ * 24: button report size ++ * 16: button usage maximum ++ */ ++ mouse_button_fixup(hdev, rdesc, *rsize, 22, 30, 24, 16, 8); ++ break; + } + return rdesc; + } +@@ -112,7 +123,8 @@ static const struct hid_device_id elecom_devices[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) }, + { } + }; + MODULE_DEVICE_TABLE(hid, elecom_devices); +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 0f8c11842a3a..d01d798ebedc 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -428,7 +428,8 @@ + #define USB_DEVICE_ID_ELECOM_M_DT1URBK 0x00fe + #define USB_DEVICE_ID_ELECOM_M_DT1DRBK 0x00ff + #define USB_DEVICE_ID_ELECOM_M_HT1URBK 0x010c +-#define USB_DEVICE_ID_ELECOM_M_HT1DRBK 0x010d ++#define USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D 0x010d ++#define USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C 0x011c + + #define USB_VENDOR_ID_DREAM_CHEEKY 0x1d34 + #define USB_DEVICE_ID_DREAM_CHEEKY_WN 0x0004 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index be3ad02573de..5bc91f68b374 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -393,7 +393,8 @@ static const struct hid_device_id hid_have_special_driver[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) }, + #endif + #if IS_ENABLED(CONFIG_HID_ELO) + { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) }, +-- +2.35.3 + diff --git a/patches.suse/Input-ads7846-always-set-last-command-to-PWRDOWN.patch b/patches.suse/Input-ads7846-always-set-last-command-to-PWRDOWN.patch new file mode 100644 index 0000000..a925889 --- /dev/null +++ b/patches.suse/Input-ads7846-always-set-last-command-to-PWRDOWN.patch @@ -0,0 +1,59 @@ +From 13f82ca3878db8284a70ef9711d7f710a31eb562 Mon Sep 17 00:00:00 2001 +From: Luca Ellero +Date: Thu, 26 Jan 2023 11:52:26 +0100 +Subject: [PATCH] Input: ads7846 - always set last command to PWRDOWN +Git-commit: 13f82ca3878db8284a70ef9711d7f710a31eb562 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Controllers that report pressure (e.g. ADS7846) use 5 commands and the +correct sequence is READ_X, READ_Y, READ_Z1, READ_Z2, PWRDOWN. + +Controllers that don't report pressure (e.g. ADS7845/ADS7843) use only 3 +commands and the correct sequence should be READ_X, READ_Y, PWRDOWN. But +the sequence sent was incorrect: READ_X, READ_Y, READ_Z1. + +Fix this by setting the third (and last) command to PWRDOWN. + +Fixes: ffa458c1bd9b ("spi: ads7846 driver") +Signed-off-by: Luca Ellero +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20230126105227.47648-3-l.ellero@asem.it +Signed-off-by: Dmitry Torokhov +Acked-by: Takashi Iwai + +--- + drivers/input/touchscreen/ads7846.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c +index f11b444f2138..15da1047a577 100644 +--- a/drivers/input/touchscreen/ads7846.c ++++ b/drivers/input/touchscreen/ads7846.c +@@ -1066,6 +1066,9 @@ static int ads7846_setup_spi_msg(struct ads7846 *ts, + struct ads7846_buf_layout *l = &packet->l[cmd_idx]; + unsigned int max_count; + ++ if (cmd_idx == packet->cmds - 1) ++ cmd_idx = ADS7846_PWDOWN; ++ + if (ads7846_cmd_need_settle(cmd_idx)) + max_count = packet->count + packet->count_skip; + else +@@ -1102,7 +1105,12 @@ static int ads7846_setup_spi_msg(struct ads7846 *ts, + + for (cmd_idx = 0; cmd_idx < packet->cmds; cmd_idx++) { + struct ads7846_buf_layout *l = &packet->l[cmd_idx]; +- u8 cmd = ads7846_get_cmd(cmd_idx, vref); ++ u8 cmd; ++ ++ if (cmd_idx == packet->cmds - 1) ++ cmd_idx = ADS7846_PWDOWN; ++ ++ cmd = ads7846_get_cmd(cmd_idx, vref); + + for (b = 0; b < l->count; b++) + packet->tx[l->offset + b].cmd = cmd; +-- +2.35.3 + diff --git a/patches.suse/Input-ads7846-don-t-check-penirq-immediately-for-784.patch b/patches.suse/Input-ads7846-don-t-check-penirq-immediately-for-784.patch new file mode 100644 index 0000000..0553787 --- /dev/null +++ b/patches.suse/Input-ads7846-don-t-check-penirq-immediately-for-784.patch @@ -0,0 +1,46 @@ +From fa9f4275b20ec7b2a8fb05c66362d10b36f9efec Mon Sep 17 00:00:00 2001 +From: Luca Ellero +Date: Thu, 26 Jan 2023 11:52:27 +0100 +Subject: [PATCH] Input: ads7846 - don't check penirq immediately for 7845 +Git-commit: fa9f4275b20ec7b2a8fb05c66362d10b36f9efec +Patch-mainline: v6.3-rc1 +References: git-fixes + +To discard false readings, one should use "ti,penirq-recheck-delay-usecs". +Checking get_pendown_state() at the beginning, most of the time fails +causing malfunctioning. + +Fixes: ffa458c1bd9b ("spi: ads7846 driver") +Signed-off-by: Luca Ellero +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20230126105227.47648-4-l.ellero@asem.it +Signed-off-by: Dmitry Torokhov +Acked-by: Takashi Iwai + +--- + drivers/input/touchscreen/ads7846.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c +index 15da1047a577..17f11bce8113 100644 +--- a/drivers/input/touchscreen/ads7846.c ++++ b/drivers/input/touchscreen/ads7846.c +@@ -843,14 +843,8 @@ static void ads7846_report_state(struct ads7846 *ts) + if (x == MAX_12BIT) + x = 0; + +- if (ts->model == 7843) { ++ if (ts->model == 7843 || ts->model == 7845) { + Rt = ts->pressure_max / 2; +- } else if (ts->model == 7845) { +- if (get_pendown_state(ts)) +- Rt = ts->pressure_max / 2; +- else +- Rt = 0; +- dev_vdbg(&ts->spi->dev, "x/y: %d/%d, PD %d\n", x, y, Rt); + } else if (likely(x && z1)) { + /* compute touch pressure resistance using equation #2 */ + Rt = z2; +-- +2.35.3 + diff --git a/patches.suse/Input-ads7846-don-t-report-pressure-for-ads7845.patch b/patches.suse/Input-ads7846-don-t-report-pressure-for-ads7845.patch new file mode 100644 index 0000000..4b1db18 --- /dev/null +++ b/patches.suse/Input-ads7846-don-t-report-pressure-for-ads7845.patch @@ -0,0 +1,42 @@ +From d50584d783313c8b05b84d0b07a2142f1bde46dd Mon Sep 17 00:00:00 2001 +From: Luca Ellero +Date: Thu, 26 Jan 2023 11:52:25 +0100 +Subject: [PATCH] Input: ads7846 - don't report pressure for ads7845 +Git-commit: d50584d783313c8b05b84d0b07a2142f1bde46dd +Patch-mainline: v6.3-rc1 +References: git-fixes + +ADS7845 doesn't support pressure. +Avoid the following error reported by libinput-list-devices: +"ADS7845 Touchscreen: kernel bug: device has min == max on ABS_PRESSURE". + +Fixes: ffa458c1bd9b ("spi: ads7846 driver") +Signed-off-by: Luca Ellero +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20230126105227.47648-2-l.ellero@asem.it +Signed-off-by: Dmitry Torokhov +Acked-by: Takashi Iwai + +--- + drivers/input/touchscreen/ads7846.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c +index 4c3dd01902d0..f11b444f2138 100644 +--- a/drivers/input/touchscreen/ads7846.c ++++ b/drivers/input/touchscreen/ads7846.c +@@ -1316,8 +1316,9 @@ static int ads7846_probe(struct spi_device *spi) + pdata->y_min ? : 0, + pdata->y_max ? : MAX_12BIT, + 0, 0); +- input_set_abs_params(input_dev, ABS_PRESSURE, +- pdata->pressure_min, pdata->pressure_max, 0, 0); ++ if (ts->model != 7845) ++ input_set_abs_params(input_dev, ABS_PRESSURE, ++ pdata->pressure_min, pdata->pressure_max, 0, 0); + + /* + * Parse common framework properties. Must be done here to ensure the +-- +2.35.3 + diff --git a/patches.suse/Input-iqs269a-configure-device-with-a-single-block-w.patch b/patches.suse/Input-iqs269a-configure-device-with-a-single-block-w.patch new file mode 100644 index 0000000..5b3902b --- /dev/null +++ b/patches.suse/Input-iqs269a-configure-device-with-a-single-block-w.patch @@ -0,0 +1,315 @@ +From 3689abfc4e369a643d758a02fb9ad0b2403d6d6d Mon Sep 17 00:00:00 2001 +From: Jeff LaBundy +Date: Tue, 3 Jan 2023 11:59:12 -0600 +Subject: [PATCH] Input: iqs269a - configure device with a single block write +Git-commit: 3689abfc4e369a643d758a02fb9ad0b2403d6d6d +Patch-mainline: v6.3-rc1 +References: git-fixes + +Unless it is being done as part of servicing a soft reset interrupt, +configuring channels on-the-fly (as is the case when writing to the +ati_trigger attribute) may cause GPIO3 (which reflects the state of +touch for a selected channel) to be inadvertently asserted. + +To solve this problem, follow the vendor's recommendation and write +all channel configuration as well as the REDO_ATI register field as +part of a single block write. This ensures the device has been told +to re-calibrate itself following an I2C stop condition, after which +sensing resumes and GPIO3 may be asserted. + +Fixes: 04e49867fad1 ("Input: add support for Azoteq IQS269A") +Signed-off-by: Jeff LaBundy +Reviewed-by: Mattijs Korpershoek +Link: https://lore.kernel.org/r/Y7Rs8GyV7g0nF5Yy@nixie71 +Signed-off-by: Dmitry Torokhov +Acked-by: Takashi Iwai + +--- + drivers/input/misc/iqs269a.c | 98 ++++++++++++++---------------------- + 1 file changed, 39 insertions(+), 59 deletions(-) + +diff --git a/drivers/input/misc/iqs269a.c b/drivers/input/misc/iqs269a.c +index e299b22b6fdb..07eda05d783e 100644 +--- a/drivers/input/misc/iqs269a.c ++++ b/drivers/input/misc/iqs269a.c +@@ -96,8 +96,6 @@ + #define IQS269_MISC_B_TRACKING_UI_ENABLE BIT(4) + #define IQS269_MISC_B_FILT_STR_SLIDER GENMASK(1, 0) + +-#define IQS269_CHx_SETTINGS 0x8C +- + #define IQS269_CHx_ENG_A_MEAS_CAP_SIZE BIT(15) + #define IQS269_CHx_ENG_A_RX_GND_INACTIVE BIT(13) + #define IQS269_CHx_ENG_A_LOCAL_CAP_SIZE BIT(12) +@@ -245,6 +243,18 @@ struct iqs269_ver_info { + u8 padding; + } __packed; + ++struct iqs269_ch_reg { ++ u8 rx_enable; ++ u8 tx_enable; ++ __be16 engine_a; ++ __be16 engine_b; ++ __be16 ati_comp; ++ u8 thresh[3]; ++ u8 hyst; ++ u8 assoc_select; ++ u8 assoc_weight; ++} __packed; ++ + struct iqs269_sys_reg { + __be16 general; + u8 active; +@@ -266,18 +276,7 @@ struct iqs269_sys_reg { + u8 timeout_swipe; + u8 thresh_swipe; + u8 redo_ati; +-} __packed; +- +-struct iqs269_ch_reg { +- u8 rx_enable; +- u8 tx_enable; +- __be16 engine_a; +- __be16 engine_b; +- __be16 ati_comp; +- u8 thresh[3]; +- u8 hyst; +- u8 assoc_select; +- u8 assoc_weight; ++ struct iqs269_ch_reg ch_reg[IQS269_NUM_CH]; + } __packed; + + struct iqs269_flags { +@@ -292,7 +291,6 @@ struct iqs269_private { + struct regmap *regmap; + struct mutex lock; + struct iqs269_switch_desc switches[ARRAY_SIZE(iqs269_events)]; +- struct iqs269_ch_reg ch_reg[IQS269_NUM_CH]; + struct iqs269_sys_reg sys_reg; + struct input_dev *keypad; + struct input_dev *slider[IQS269_NUM_SL]; +@@ -307,6 +305,7 @@ struct iqs269_private { + static int iqs269_ati_mode_set(struct iqs269_private *iqs269, + unsigned int ch_num, unsigned int mode) + { ++ struct iqs269_ch_reg *ch_reg = iqs269->sys_reg.ch_reg; + u16 engine_a; + + if (ch_num >= IQS269_NUM_CH) +@@ -317,12 +316,12 @@ static int iqs269_ati_mode_set(struct iqs269_private *iqs269, + + mutex_lock(&iqs269->lock); + +- engine_a = be16_to_cpu(iqs269->ch_reg[ch_num].engine_a); ++ engine_a = be16_to_cpu(ch_reg[ch_num].engine_a); + + engine_a &= ~IQS269_CHx_ENG_A_ATI_MODE_MASK; + engine_a |= (mode << IQS269_CHx_ENG_A_ATI_MODE_SHIFT); + +- iqs269->ch_reg[ch_num].engine_a = cpu_to_be16(engine_a); ++ ch_reg[ch_num].engine_a = cpu_to_be16(engine_a); + iqs269->ati_current = false; + + mutex_unlock(&iqs269->lock); +@@ -333,13 +332,14 @@ static int iqs269_ati_mode_set(struct iqs269_private *iqs269, + static int iqs269_ati_mode_get(struct iqs269_private *iqs269, + unsigned int ch_num, unsigned int *mode) + { ++ struct iqs269_ch_reg *ch_reg = iqs269->sys_reg.ch_reg; + u16 engine_a; + + if (ch_num >= IQS269_NUM_CH) + return -EINVAL; + + mutex_lock(&iqs269->lock); +- engine_a = be16_to_cpu(iqs269->ch_reg[ch_num].engine_a); ++ engine_a = be16_to_cpu(ch_reg[ch_num].engine_a); + mutex_unlock(&iqs269->lock); + + engine_a &= IQS269_CHx_ENG_A_ATI_MODE_MASK; +@@ -351,6 +351,7 @@ static int iqs269_ati_mode_get(struct iqs269_private *iqs269, + static int iqs269_ati_base_set(struct iqs269_private *iqs269, + unsigned int ch_num, unsigned int base) + { ++ struct iqs269_ch_reg *ch_reg = iqs269->sys_reg.ch_reg; + u16 engine_b; + + if (ch_num >= IQS269_NUM_CH) +@@ -379,12 +380,12 @@ static int iqs269_ati_base_set(struct iqs269_private *iqs269, + + mutex_lock(&iqs269->lock); + +- engine_b = be16_to_cpu(iqs269->ch_reg[ch_num].engine_b); ++ engine_b = be16_to_cpu(ch_reg[ch_num].engine_b); + + engine_b &= ~IQS269_CHx_ENG_B_ATI_BASE_MASK; + engine_b |= base; + +- iqs269->ch_reg[ch_num].engine_b = cpu_to_be16(engine_b); ++ ch_reg[ch_num].engine_b = cpu_to_be16(engine_b); + iqs269->ati_current = false; + + mutex_unlock(&iqs269->lock); +@@ -395,13 +396,14 @@ static int iqs269_ati_base_set(struct iqs269_private *iqs269, + static int iqs269_ati_base_get(struct iqs269_private *iqs269, + unsigned int ch_num, unsigned int *base) + { ++ struct iqs269_ch_reg *ch_reg = iqs269->sys_reg.ch_reg; + u16 engine_b; + + if (ch_num >= IQS269_NUM_CH) + return -EINVAL; + + mutex_lock(&iqs269->lock); +- engine_b = be16_to_cpu(iqs269->ch_reg[ch_num].engine_b); ++ engine_b = be16_to_cpu(ch_reg[ch_num].engine_b); + mutex_unlock(&iqs269->lock); + + switch (engine_b & IQS269_CHx_ENG_B_ATI_BASE_MASK) { +@@ -429,6 +431,7 @@ static int iqs269_ati_base_get(struct iqs269_private *iqs269, + static int iqs269_ati_target_set(struct iqs269_private *iqs269, + unsigned int ch_num, unsigned int target) + { ++ struct iqs269_ch_reg *ch_reg = iqs269->sys_reg.ch_reg; + u16 engine_b; + + if (ch_num >= IQS269_NUM_CH) +@@ -439,12 +442,12 @@ static int iqs269_ati_target_set(struct iqs269_private *iqs269, + + mutex_lock(&iqs269->lock); + +- engine_b = be16_to_cpu(iqs269->ch_reg[ch_num].engine_b); ++ engine_b = be16_to_cpu(ch_reg[ch_num].engine_b); + + engine_b &= ~IQS269_CHx_ENG_B_ATI_TARGET_MASK; + engine_b |= target / 32; + +- iqs269->ch_reg[ch_num].engine_b = cpu_to_be16(engine_b); ++ ch_reg[ch_num].engine_b = cpu_to_be16(engine_b); + iqs269->ati_current = false; + + mutex_unlock(&iqs269->lock); +@@ -455,13 +458,14 @@ static int iqs269_ati_target_set(struct iqs269_private *iqs269, + static int iqs269_ati_target_get(struct iqs269_private *iqs269, + unsigned int ch_num, unsigned int *target) + { ++ struct iqs269_ch_reg *ch_reg = iqs269->sys_reg.ch_reg; + u16 engine_b; + + if (ch_num >= IQS269_NUM_CH) + return -EINVAL; + + mutex_lock(&iqs269->lock); +- engine_b = be16_to_cpu(iqs269->ch_reg[ch_num].engine_b); ++ engine_b = be16_to_cpu(ch_reg[ch_num].engine_b); + mutex_unlock(&iqs269->lock); + + *target = (engine_b & IQS269_CHx_ENG_B_ATI_TARGET_MASK) * 32; +@@ -531,13 +535,7 @@ static int iqs269_parse_chan(struct iqs269_private *iqs269, + if (fwnode_property_present(ch_node, "azoteq,slider1-select")) + iqs269->sys_reg.slider_select[1] |= BIT(reg); + +- ch_reg = &iqs269->ch_reg[reg]; +- +- error = regmap_raw_read(iqs269->regmap, +- IQS269_CHx_SETTINGS + reg * sizeof(*ch_reg) / 2, +- ch_reg, sizeof(*ch_reg)); +- if (error) +- return error; ++ ch_reg = &iqs269->sys_reg.ch_reg[reg]; + + error = iqs269_parse_mask(ch_node, "azoteq,rx-enable", + &ch_reg->rx_enable); +@@ -1042,10 +1040,8 @@ static int iqs269_parse_prop(struct iqs269_private *iqs269) + + static int iqs269_dev_init(struct iqs269_private *iqs269) + { +- struct iqs269_sys_reg *sys_reg = &iqs269->sys_reg; +- struct iqs269_ch_reg *ch_reg; + unsigned int val; +- int error, i; ++ int error; + + mutex_lock(&iqs269->lock); + +@@ -1055,27 +1051,8 @@ static int iqs269_dev_init(struct iqs269_private *iqs269) + if (error) + goto err_mutex; + +- for (i = 0; i < IQS269_NUM_CH; i++) { +- if (!(sys_reg->active & BIT(i))) +- continue; +- +- ch_reg = &iqs269->ch_reg[i]; +- +- error = regmap_raw_write(iqs269->regmap, +- IQS269_CHx_SETTINGS + i * +- sizeof(*ch_reg) / 2, ch_reg, +- sizeof(*ch_reg)); +- if (error) +- goto err_mutex; +- } +- +- /* +- * The REDO-ATI and ATI channel selection fields must be written in the +- * same block write, so every field between registers 0x80 through 0x8B +- * (inclusive) must be written as well. +- */ +- error = regmap_raw_write(iqs269->regmap, IQS269_SYS_SETTINGS, sys_reg, +- sizeof(*sys_reg)); ++ error = regmap_raw_write(iqs269->regmap, IQS269_SYS_SETTINGS, ++ &iqs269->sys_reg, sizeof(iqs269->sys_reg)); + if (error) + goto err_mutex; + +@@ -1349,6 +1326,7 @@ static ssize_t hall_bin_show(struct device *dev, + struct device_attribute *attr, char *buf) + { + struct iqs269_private *iqs269 = dev_get_drvdata(dev); ++ struct iqs269_ch_reg *ch_reg = iqs269->sys_reg.ch_reg; + struct i2c_client *client = iqs269->client; + unsigned int val; + int error; +@@ -1363,8 +1341,8 @@ static ssize_t hall_bin_show(struct device *dev, + if (error) + return error; + +- switch (iqs269->ch_reg[IQS269_CHx_HALL_ACTIVE].rx_enable & +- iqs269->ch_reg[IQS269_CHx_HALL_INACTIVE].rx_enable) { ++ switch (ch_reg[IQS269_CHx_HALL_ACTIVE].rx_enable & ++ ch_reg[IQS269_CHx_HALL_INACTIVE].rx_enable) { + case IQS269_HALL_PAD_R: + val &= IQS269_CAL_DATA_A_HALL_BIN_R_MASK; + val >>= IQS269_CAL_DATA_A_HALL_BIN_R_SHIFT; +@@ -1444,9 +1422,10 @@ static ssize_t rx_enable_show(struct device *dev, + struct device_attribute *attr, char *buf) + { + struct iqs269_private *iqs269 = dev_get_drvdata(dev); ++ struct iqs269_ch_reg *ch_reg = iqs269->sys_reg.ch_reg; + + return scnprintf(buf, PAGE_SIZE, "%u\n", +- iqs269->ch_reg[iqs269->ch_num].rx_enable); ++ ch_reg[iqs269->ch_num].rx_enable); + } + + static ssize_t rx_enable_store(struct device *dev, +@@ -1454,6 +1433,7 @@ static ssize_t rx_enable_store(struct device *dev, + size_t count) + { + struct iqs269_private *iqs269 = dev_get_drvdata(dev); ++ struct iqs269_ch_reg *ch_reg = iqs269->sys_reg.ch_reg; + unsigned int val; + int error; + +@@ -1466,7 +1446,7 @@ static ssize_t rx_enable_store(struct device *dev, + + mutex_lock(&iqs269->lock); + +- iqs269->ch_reg[iqs269->ch_num].rx_enable = val; ++ ch_reg[iqs269->ch_num].rx_enable = val; + iqs269->ati_current = false; + + mutex_unlock(&iqs269->lock); +-- +2.35.3 + diff --git a/patches.suse/Input-iqs269a-drop-unused-device-node-references.patch b/patches.suse/Input-iqs269a-drop-unused-device-node-references.patch new file mode 100644 index 0000000..f2c0596 --- /dev/null +++ b/patches.suse/Input-iqs269a-drop-unused-device-node-references.patch @@ -0,0 +1,72 @@ +From 59bc9cb3b80abaa42643abede0d5db8477901d9c Mon Sep 17 00:00:00 2001 +From: Jeff LaBundy +Date: Tue, 3 Jan 2023 11:58:31 -0600 +Subject: [PATCH] Input: iqs269a - drop unused device node references +Git-commit: 59bc9cb3b80abaa42643abede0d5db8477901d9c +Patch-mainline: v6.3-rc1 +References: git-fixes + +Each call to device/fwnode_get_named_child_node() must be matched +with a call to fwnode_handle_put() once the corresponding node is +no longer in use. This ensures a reference count remains balanced +in the case of dynamic device tree support. + +Currently, the driver does not call fwnode_handle_put() on nested +event nodes. This patch solves this problem by adding the missing +instances of fwnode_handle_put(). + +As part of this change, the logic which parses each channel's key +code is gently refactored in order to reduce the number of places +from which fwnode_handle_put() is called. + +Fixes: 04e49867fad1 ("Input: add support for Azoteq IQS269A") +Signed-off-by: Jeff LaBundy +Link: https://lore.kernel.org/r/Y7Rsx68k/gvDVXAt@nixie71 +Signed-off-by: Dmitry Torokhov +Acked-by: Takashi Iwai + +--- + drivers/input/misc/iqs269a.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/input/misc/iqs269a.c b/drivers/input/misc/iqs269a.c +index 8348d8c85e1d..7cda4a9a8560 100644 +--- a/drivers/input/misc/iqs269a.c ++++ b/drivers/input/misc/iqs269a.c +@@ -694,6 +694,7 @@ static int iqs269_parse_chan(struct iqs269_private *iqs269, + dev_err(&client->dev, + "Invalid channel %u threshold: %u\n", + reg, val); ++ fwnode_handle_put(ev_node); + return -EINVAL; + } + +@@ -707,6 +708,7 @@ static int iqs269_parse_chan(struct iqs269_private *iqs269, + dev_err(&client->dev, + "Invalid channel %u hysteresis: %u\n", + reg, val); ++ fwnode_handle_put(ev_node); + return -EINVAL; + } + +@@ -721,8 +723,16 @@ static int iqs269_parse_chan(struct iqs269_private *iqs269, + } + } + +- if (fwnode_property_read_u32(ev_node, "linux,code", &val)) ++ error = fwnode_property_read_u32(ev_node, "linux,code", &val); ++ fwnode_handle_put(ev_node); ++ if (error == -EINVAL) { + continue; ++ } else if (error) { ++ dev_err(&client->dev, ++ "Failed to read channel %u code: %d\n", reg, ++ error); ++ return error; ++ } + + switch (reg) { + case IQS269_CHx_HALL_ACTIVE: +-- +2.35.3 + diff --git a/patches.suse/Input-iqs269a-increase-interrupt-handler-return-dela.patch b/patches.suse/Input-iqs269a-increase-interrupt-handler-return-dela.patch new file mode 100644 index 0000000..54a9090 --- /dev/null +++ b/patches.suse/Input-iqs269a-increase-interrupt-handler-return-dela.patch @@ -0,0 +1,42 @@ +From e023cc4abde3c01b895660b0e5a8488deb36b8c1 Mon Sep 17 00:00:00 2001 +From: Jeff LaBundy +Date: Tue, 3 Jan 2023 11:58:59 -0600 +Subject: [PATCH] Input: iqs269a - increase interrupt handler return delay +Git-commit: e023cc4abde3c01b895660b0e5a8488deb36b8c1 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The time the device takes to deassert its RDY output following an +I2C stop condition scales with the core clock frequency. + +To prevent level-triggered interrupts from being reasserted after +the interrupt handler returns, increase the time before returning +to account for the worst-case delay (~140 us) plus margin. + +Fixes: 04e49867fad1 ("Input: add support for Azoteq IQS269A") +Signed-off-by: Jeff LaBundy +Reviewed-by: Mattijs Korpershoek +Link: https://lore.kernel.org/r/Y7Rs484ypy4dab5G@nixie71 +Signed-off-by: Dmitry Torokhov +Acked-by: Takashi Iwai + +--- + drivers/input/misc/iqs269a.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/input/misc/iqs269a.c b/drivers/input/misc/iqs269a.c +index 7cda4a9a8560..e299b22b6fdb 100644 +--- a/drivers/input/misc/iqs269a.c ++++ b/drivers/input/misc/iqs269a.c +@@ -153,7 +153,7 @@ + #define IQS269_PWR_MODE_POLL_SLEEP_US IQS269_ATI_POLL_SLEEP_US + #define IQS269_PWR_MODE_POLL_TIMEOUT_US IQS269_ATI_POLL_TIMEOUT_US + +-#define iqs269_irq_wait() usleep_range(100, 150) ++#define iqs269_irq_wait() usleep_range(200, 250) + + enum iqs269_local_cap_size { + IQS269_LOCAL_CAP_SIZE_0, +-- +2.35.3 + diff --git a/patches.suse/Input-iqs626a-drop-unused-device-node-references.patch b/patches.suse/Input-iqs626a-drop-unused-device-node-references.patch new file mode 100644 index 0000000..a7ee583 --- /dev/null +++ b/patches.suse/Input-iqs626a-drop-unused-device-node-references.patch @@ -0,0 +1,321 @@ +From 4d3d2694e168c542b088eef5059d31498f679020 Mon Sep 17 00:00:00 2001 +From: Jeff LaBundy +Date: Fri, 27 Jan 2023 16:29:41 -0600 +Subject: [PATCH] Input: iqs626a - drop unused device node references +Git-commit: 4d3d2694e168c542b088eef5059d31498f679020 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Each call to device/fwnode_get_named_child_node() must be matched +with a call to fwnode_handle_put() once the corresponding node is +no longer in use. This ensures a reference count remains balanced +in the case of dynamic device tree support. + +Currently, the driver never calls fwnode_handle_put(); this patch +adds the missing calls. Because fwnode_handle_put() does not take +a const *fwnode_handle, the const qualifier is removed across all +corresponding *fwnode_handle instances. + +As part of this change, trackpad channel touch thresholds and ATI +base values are now specified under single trackpad channel child +nodes. This enhancement moves both properties to scalar values as +opposed to arrays, making their types consistent across bindings. + +Fixes: f1d2809de97a ("Input: Add support for Azoteq IQS626A") +Signed-off-by: Jeff LaBundy +Link: https://lore.kernel.org/r/Y9RQVe/V1Hnw1oly@nixie71 +Signed-off-by: Dmitry Torokhov +Acked-by: Takashi Iwai + +--- + drivers/input/misc/iqs626a.c | 156 ++++++++++++++++------------------- + 1 file changed, 73 insertions(+), 83 deletions(-) + +diff --git a/drivers/input/misc/iqs626a.c b/drivers/input/misc/iqs626a.c +index 4727e6b95e41..90f997a905b5 100644 +--- a/drivers/input/misc/iqs626a.c ++++ b/drivers/input/misc/iqs626a.c +@@ -458,18 +458,15 @@ struct iqs626_private { + + static noinline_for_stack int + iqs626_parse_events(struct iqs626_private *iqs626, +- const struct fwnode_handle *ch_node, +- enum iqs626_ch_id ch_id) ++ struct fwnode_handle *ch_node, enum iqs626_ch_id ch_id) + { + struct iqs626_sys_reg *sys_reg = &iqs626->sys_reg; + struct i2c_client *client = iqs626->client; +- const struct fwnode_handle *ev_node; ++ struct fwnode_handle *ev_node; + const char *ev_name; + u8 *thresh, *hyst; +- unsigned int thresh_tp[IQS626_NUM_CH_TP_3]; + unsigned int val; +- int num_ch = iqs626_channels[ch_id].num_ch; +- int error, i, j; ++ int i; + + switch (ch_id) { + case IQS626_CH_ULP_0: +@@ -509,7 +506,7 @@ iqs626_parse_events(struct iqs626_private *iqs626, + * Trackpad touch events are simply described under the + * trackpad child node. + */ +- ev_node = ch_node; ++ ev_node = fwnode_handle_get(ch_node); + } else { + ev_name = iqs626_events[i].name; + ev_node = fwnode_get_named_child_node(ch_node, ev_name); +@@ -533,6 +530,7 @@ iqs626_parse_events(struct iqs626_private *iqs626, + dev_err(&client->dev, + "Invalid input type: %u\n", + val); ++ fwnode_handle_put(ev_node); + return -EINVAL; + } + +@@ -547,6 +545,7 @@ iqs626_parse_events(struct iqs626_private *iqs626, + dev_err(&client->dev, + "Invalid %s channel hysteresis: %u\n", + fwnode_get_name(ch_node), val); ++ fwnode_handle_put(ev_node); + return -EINVAL; + } + +@@ -567,6 +566,7 @@ iqs626_parse_events(struct iqs626_private *iqs626, + dev_err(&client->dev, + "Invalid %s channel threshold: %u\n", + fwnode_get_name(ch_node), val); ++ fwnode_handle_put(ev_node); + return -EINVAL; + } + +@@ -574,32 +574,9 @@ iqs626_parse_events(struct iqs626_private *iqs626, + *thresh = val; + else + *(thresh + iqs626_events[i].th_offs) = val; +- +- continue; +- } +- +- if (!fwnode_property_present(ev_node, "azoteq,thresh")) +- continue; +- +- error = fwnode_property_read_u32_array(ev_node, "azoteq,thresh", +- thresh_tp, num_ch); +- if (error) { +- dev_err(&client->dev, +- "Failed to read %s channel thresholds: %d\n", +- fwnode_get_name(ch_node), error); +- return error; + } + +- for (j = 0; j < num_ch; j++) { +- if (thresh_tp[j] > IQS626_CHx_THRESH_MAX) { +- dev_err(&client->dev, +- "Invalid %s channel threshold: %u\n", +- fwnode_get_name(ch_node), thresh_tp[j]); +- return -EINVAL; +- } +- +- sys_reg->tp_grp_reg.ch_reg_tp[j].thresh = thresh_tp[j]; +- } ++ fwnode_handle_put(ev_node); + } + + return 0; +@@ -607,16 +584,13 @@ iqs626_parse_events(struct iqs626_private *iqs626, + + static noinline_for_stack int + iqs626_parse_ati_target(struct iqs626_private *iqs626, +- const struct fwnode_handle *ch_node, +- enum iqs626_ch_id ch_id) ++ struct fwnode_handle *ch_node, enum iqs626_ch_id ch_id) + { + struct iqs626_sys_reg *sys_reg = &iqs626->sys_reg; + struct i2c_client *client = iqs626->client; +- unsigned int ati_base[IQS626_NUM_CH_TP_3]; + unsigned int val; + u8 *ati_target; +- int num_ch = iqs626_channels[ch_id].num_ch; +- int error, i; ++ int i; + + switch (ch_id) { + case IQS626_CH_ULP_0: +@@ -683,40 +657,13 @@ iqs626_parse_ati_target(struct iqs626_private *iqs626, + + *ati_target &= ~IQS626_CHx_ATI_BASE_MASK; + *ati_target |= val; +- +- return 0; +- } +- +- if (!fwnode_property_present(ch_node, "azoteq,ati-base")) +- return 0; +- +- error = fwnode_property_read_u32_array(ch_node, "azoteq,ati-base", +- ati_base, num_ch); +- if (error) { +- dev_err(&client->dev, +- "Failed to read %s channel ATI bases: %d\n", +- fwnode_get_name(ch_node), error); +- return error; +- } +- +- for (i = 0; i < num_ch; i++) { +- if (ati_base[i] < IQS626_TPx_ATI_BASE_MIN || +- ati_base[i] > IQS626_TPx_ATI_BASE_MAX) { +- dev_err(&client->dev, +- "Invalid %s channel ATI base: %u\n", +- fwnode_get_name(ch_node), ati_base[i]); +- return -EINVAL; +- } +- +- ati_base[i] -= IQS626_TPx_ATI_BASE_MIN; +- sys_reg->tp_grp_reg.ch_reg_tp[i].ati_base = ati_base[i]; + } + + return 0; + } + + static int iqs626_parse_pins(struct iqs626_private *iqs626, +- const struct fwnode_handle *ch_node, ++ struct fwnode_handle *ch_node, + const char *propname, u8 *enable) + { + struct i2c_client *client = iqs626->client; +@@ -764,13 +711,14 @@ static int iqs626_parse_pins(struct iqs626_private *iqs626, + } + + static int iqs626_parse_trackpad(struct iqs626_private *iqs626, +- const struct fwnode_handle *ch_node) ++ struct fwnode_handle *ch_node, ++ enum iqs626_ch_id ch_id) + { + struct iqs626_sys_reg *sys_reg = &iqs626->sys_reg; + struct i2c_client *client = iqs626->client; + u8 *hyst = &sys_reg->tp_grp_reg.hyst; ++ int error, count, i; + unsigned int val; +- int error, count; + + if (!fwnode_property_read_u32(ch_node, "azoteq,lta-update", &val)) { + if (val > IQS626_MISC_A_TPx_LTA_UPDATE_MAX) { +@@ -823,6 +771,48 @@ static int iqs626_parse_trackpad(struct iqs626_private *iqs626, + *hyst |= (val << IQS626_FILT_STR_LP_TPx_SHIFT); + } + ++ for (i = 0; i < iqs626_channels[ch_id].num_ch; i++) { ++ u8 *ati_base = &sys_reg->tp_grp_reg.ch_reg_tp[i].ati_base; ++ u8 *thresh = &sys_reg->tp_grp_reg.ch_reg_tp[i].thresh; ++ struct fwnode_handle *tc_node; ++ char tc_name[10]; ++ ++ snprintf(tc_name, sizeof(tc_name), "channel-%d", i); ++ ++ tc_node = fwnode_get_named_child_node(ch_node, tc_name); ++ if (!tc_node) ++ continue; ++ ++ if (!fwnode_property_read_u32(tc_node, "azoteq,ati-base", ++ &val)) { ++ if (val < IQS626_TPx_ATI_BASE_MIN || ++ val > IQS626_TPx_ATI_BASE_MAX) { ++ dev_err(&client->dev, ++ "Invalid %s %s ATI base: %u\n", ++ fwnode_get_name(ch_node), tc_name, val); ++ fwnode_handle_put(tc_node); ++ return -EINVAL; ++ } ++ ++ *ati_base = val - IQS626_TPx_ATI_BASE_MIN; ++ } ++ ++ if (!fwnode_property_read_u32(tc_node, "azoteq,thresh", ++ &val)) { ++ if (val > IQS626_CHx_THRESH_MAX) { ++ dev_err(&client->dev, ++ "Invalid %s %s threshold: %u\n", ++ fwnode_get_name(ch_node), tc_name, val); ++ fwnode_handle_put(tc_node); ++ return -EINVAL; ++ } ++ ++ *thresh = val; ++ } ++ ++ fwnode_handle_put(tc_node); ++ } ++ + if (!fwnode_property_present(ch_node, "linux,keycodes")) + return 0; + +@@ -889,8 +879,7 @@ static int iqs626_parse_trackpad(struct iqs626_private *iqs626, + + static noinline_for_stack int + iqs626_parse_channel(struct iqs626_private *iqs626, +- const struct fwnode_handle *ch_node, +- enum iqs626_ch_id ch_id) ++ struct fwnode_handle *ch_node, enum iqs626_ch_id ch_id) + { + struct iqs626_sys_reg *sys_reg = &iqs626->sys_reg; + struct i2c_client *client = iqs626->client; +@@ -924,6 +913,20 @@ iqs626_parse_channel(struct iqs626_private *iqs626, + return -EINVAL; + } + ++ error = iqs626_parse_ati_target(iqs626, ch_node, ch_id); ++ if (error) ++ return error; ++ ++ error = iqs626_parse_events(iqs626, ch_node, ch_id); ++ if (error) ++ return error; ++ ++ if (!fwnode_property_present(ch_node, "azoteq,ati-exclude")) ++ sys_reg->redo_ati |= iqs626_channels[ch_id].active; ++ ++ if (!fwnode_property_present(ch_node, "azoteq,reseed-disable")) ++ sys_reg->reseed |= iqs626_channels[ch_id].active; ++ + *engine |= IQS626_CHx_ENG_0_MEAS_CAP_SIZE; + if (fwnode_property_present(ch_node, "azoteq,meas-cap-decrease")) + *engine &= ~IQS626_CHx_ENG_0_MEAS_CAP_SIZE; +@@ -1057,7 +1060,7 @@ iqs626_parse_channel(struct iqs626_private *iqs626, + *(engine + 1) |= IQS626_CHx_ENG_1_ATI_BAND_TIGHTEN; + + if (ch_id == IQS626_CH_TP_2 || ch_id == IQS626_CH_TP_3) +- return iqs626_parse_trackpad(iqs626, ch_node); ++ return iqs626_parse_trackpad(iqs626, ch_node, ch_id); + + if (ch_id == IQS626_CH_ULP_0) { + sys_reg->ch_reg_ulp.hyst &= ~IQS626_ULP_PROJ_ENABLE; +@@ -1378,23 +1381,10 @@ static int iqs626_parse_prop(struct iqs626_private *iqs626) + continue; + + error = iqs626_parse_channel(iqs626, ch_node, i); ++ fwnode_handle_put(ch_node); + if (error) + return error; + +- error = iqs626_parse_ati_target(iqs626, ch_node, i); +- if (error) +- return error; +- +- error = iqs626_parse_events(iqs626, ch_node, i); +- if (error) +- return error; +- +- if (!fwnode_property_present(ch_node, "azoteq,ati-exclude")) +- sys_reg->redo_ati |= iqs626_channels[i].active; +- +- if (!fwnode_property_present(ch_node, "azoteq,reseed-disable")) +- sys_reg->reseed |= iqs626_channels[i].active; +- + sys_reg->active |= iqs626_channels[i].active; + } + +-- +2.35.3 + diff --git a/patches.suse/NFS-Always-initialise-fattr-label-in-nfs_fattr_alloc.patch b/patches.suse/NFS-Always-initialise-fattr-label-in-nfs_fattr_alloc.patch new file mode 100644 index 0000000..0abcc14 --- /dev/null +++ b/patches.suse/NFS-Always-initialise-fattr-label-in-nfs_fattr_alloc.patch @@ -0,0 +1,31 @@ +From: Trond Myklebust +Date: Thu, 4 Nov 2021 18:03:26 -0400 +Subject: [PATCH] NFS: Always initialise fattr->label in nfs_fattr_alloc() +Git-commit: d4a95a7e5a4d3b68b26f70668cf77324a11b5718 +Patch-mainline: v5.16 +References: git-fixes + +We're about to add a check in nfs_free_fattr() for whether or not the +label is non-zero. + +Signed-off-by: Trond Myklebust +Acked-by: NeilBrown + +--- + fs/nfs/inode.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -1584,8 +1584,10 @@ struct nfs_fattr *nfs_alloc_fattr(void) + struct nfs_fattr *fattr; + + fattr = kmalloc(sizeof(*fattr), GFP_NOFS); +- if (fattr != NULL) ++ if (fattr != NULL) { + nfs_fattr_init(fattr); ++ fattr->label = NULL; ++ } + return fattr; + } + EXPORT_SYMBOL_GPL(nfs_alloc_fattr); diff --git a/patches.suse/NFS-Avoid-duplicate-uncached-readdir-calls-on-eof.patch b/patches.suse/NFS-Avoid-duplicate-uncached-readdir-calls-on-eof.patch index 4103049..46d01a6 100644 --- a/patches.suse/NFS-Avoid-duplicate-uncached-readdir-calls-on-eof.patch +++ b/patches.suse/NFS-Avoid-duplicate-uncached-readdir-calls-on-eof.patch @@ -21,15 +21,15 @@ Acked-by: NeilBrown --- a/fs/nfs/dir.c +++ b/fs/nfs/dir.c -@@ -78,6 +78,7 @@ static struct nfs_open_dir_context *allo - ctx->attr_gencount = nfsi->attr_gencount; +@@ -79,6 +79,7 @@ static struct nfs_open_dir_context *allo ctx->dir_cookie = 0; ctx->dup_cookie = 0; + ctx->page_index = 0; + ctx->eof = false; spin_lock(&dir->i_lock); if (list_empty(&nfsi->open_files) && (nfsi->cache_validity & NFS_INO_DATA_INVAL_DEFER)) -@@ -165,6 +166,7 @@ struct nfs_readdir_descriptor { +@@ -167,6 +168,7 @@ struct nfs_readdir_descriptor { unsigned int cache_entry_index; signed char duped; bool plus; @@ -37,7 +37,7 @@ Acked-by: NeilBrown bool eof; }; -@@ -996,7 +998,7 @@ static void nfs_do_filldir(struct nfs_re +@@ -995,7 +997,7 @@ static void nfs_do_filldir(struct nfs_re ent = &array->array[i]; if (!dir_emit(desc->ctx, ent->name, ent->name_len, nfs_compat_user_ino64(ent->ino), ent->d_type)) { @@ -46,7 +46,7 @@ Acked-by: NeilBrown break; } memcpy(desc->verf, verf, sizeof(desc->verf)); -@@ -1012,7 +1014,7 @@ static void nfs_do_filldir(struct nfs_re +@@ -1011,7 +1013,7 @@ static void nfs_do_filldir(struct nfs_re desc->duped = 1; } if (array->page_is_eof) @@ -55,7 +55,7 @@ Acked-by: NeilBrown kunmap(desc->page); dfprintk(DIRCACHE, "NFS: nfs_do_filldir() filling ended @ cookie %llu\n", -@@ -1055,7 +1057,7 @@ static int uncached_readdir(struct nfs_r +@@ -1054,7 +1056,7 @@ static int uncached_readdir(struct nfs_r status = nfs_readdir_xdr_to_array(desc, desc->verf, verf, arrays, sz); @@ -64,9 +64,9 @@ Acked-by: NeilBrown desc->page = arrays[i]; nfs_do_filldir(desc, verf); } -@@ -1112,9 +1114,15 @@ static int nfs_readdir(struct file *file - desc->dup_cookie = dir_ctx->dup_cookie; +@@ -1113,9 +1115,15 @@ static int nfs_readdir(struct file *file desc->duped = dir_ctx->duped; + page_index = dir_ctx->page_index; desc->attr_gencount = dir_ctx->attr_gencount; + desc->eof = dir_ctx->eof; memcpy(desc->verf, dir_ctx->verf, sizeof(desc->verf)); @@ -77,10 +77,10 @@ Acked-by: NeilBrown + goto out_free; + } + - do { - res = readdir_search_pagecache(desc); - -@@ -1144,16 +1152,17 @@ static int nfs_readdir(struct file *file + if (test_and_clear_bit(NFS_INO_FORCE_READDIR, &nfsi->flags) && + list_is_singular(&nfsi->open_files)) + invalidate_mapping_pages(inode->i_mapping, page_index + 1, -1); +@@ -1149,7 +1157,7 @@ static int nfs_readdir(struct file *file nfs_do_filldir(desc, nfsi->cookieverf); nfs_readdir_page_unlock_and_put_cached(desc); @@ -89,8 +89,9 @@ Acked-by: NeilBrown spin_lock(&file->f_lock); dir_ctx->dir_cookie = desc->dir_cookie; - dir_ctx->dup_cookie = desc->dup_cookie; +@@ -1157,9 +1165,10 @@ static int nfs_readdir(struct file *file dir_ctx->duped = desc->duped; + dir_ctx->page_index = desc->page_index; dir_ctx->attr_gencount = desc->attr_gencount; + dir_ctx->eof = desc->eof; memcpy(dir_ctx->verf, desc->verf, sizeof(dir_ctx->verf)); @@ -100,7 +101,7 @@ Acked-by: NeilBrown kfree(desc); out: -@@ -1195,6 +1204,7 @@ static loff_t nfs_llseek_dir(struct file +@@ -1201,6 +1210,7 @@ static loff_t nfs_llseek_dir(struct file if (offset == 0) memset(dir_ctx->verf, 0, sizeof(dir_ctx->verf)); dir_ctx->duped = 0; @@ -110,9 +111,9 @@ Acked-by: NeilBrown return offset; --- a/include/linux/nfs_fs.h +++ b/include/linux/nfs_fs.h -@@ -99,6 +99,7 @@ struct nfs_open_dir_context { - __u64 dir_cookie; +@@ -102,6 +102,7 @@ struct nfs_open_dir_context { __u64 dup_cookie; + pgoff_t page_index; signed char duped; + bool eof; }; diff --git a/patches.suse/NFS-Create-a-new-nfs_alloc_fattr_with_label-function.patch b/patches.suse/NFS-Create-a-new-nfs_alloc_fattr_with_label-function.patch new file mode 100644 index 0000000..9ec389f --- /dev/null +++ b/patches.suse/NFS-Create-a-new-nfs_alloc_fattr_with_label-function.patch @@ -0,0 +1,160 @@ +From: Anna Schumaker +Date: Fri, 22 Oct 2021 13:11:00 -0400 +Subject: [PATCH] NFS: Create a new nfs_alloc_fattr_with_label() function +Git-commit: d755ad8dc752d44545613ea04d660aed674e540d +Patch-mainline: v5.16 +References: git-fixes + +For creating fattrs with the label field already allocated for us. I +also update nfs_free_fattr() to free the label in the end. + +Signed-off-by: Anna Schumaker +Signed-off-by: Trond Myklebust +Acked-by: NeilBrown + +--- + fs/nfs/getroot.c | 17 ++++++----------- + fs/nfs/inode.c | 17 +++++++++++++++++ + fs/nfs/internal.h | 9 --------- + include/linux/nfs_fs.h | 13 +++++++++++++ + 4 files changed, 36 insertions(+), 20 deletions(-) + +--- a/fs/nfs/getroot.c ++++ b/fs/nfs/getroot.c +@@ -80,18 +80,15 @@ int nfs_get_root(struct super_block *s, + goto out; + + /* get the actual root for this mount */ +- fsinfo.fattr = nfs_alloc_fattr(); ++ fsinfo.fattr = nfs_alloc_fattr_with_label(server); + if (fsinfo.fattr == NULL) + goto out_name; + +- fsinfo.fattr->label = nfs4_label_alloc(server, GFP_KERNEL); +- if (IS_ERR(fsinfo.fattr->label)) +- goto out_fattr; + error = server->nfs_client->rpc_ops->getroot(server, ctx->mntfh, &fsinfo); + if (error < 0) { + dprintk("nfs_get_root: getattr error = %d\n", -error); + nfs_errorf(fc, "NFS: Couldn't getattr on root"); +- goto out_label; ++ goto out_fattr; + } + + inode = nfs_fhget(s, ctx->mntfh, fsinfo.fattr, NULL); +@@ -99,12 +96,12 @@ int nfs_get_root(struct super_block *s, + dprintk("nfs_get_root: get root inode failed\n"); + error = PTR_ERR(inode); + nfs_errorf(fc, "NFS: Couldn't get root inode"); +- goto out_label; ++ goto out_fattr; + } + + error = nfs_superblock_set_dummy_root(s, inode); + if (error != 0) +- goto out_label; ++ goto out_fattr; + + /* root dentries normally start off anonymous and get spliced in later + * if the dentry tree reaches them; however if the dentry already +@@ -115,7 +112,7 @@ int nfs_get_root(struct super_block *s, + dprintk("nfs_get_root: get root dentry failed\n"); + error = PTR_ERR(root); + nfs_errorf(fc, "NFS: Couldn't get root dentry"); +- goto out_label; ++ goto out_fattr; + } + + security_d_instantiate(root, inode); +@@ -154,8 +151,6 @@ int nfs_get_root(struct super_block *s, + nfs_setsecurity(inode, fsinfo.fattr, fsinfo.fattr->label); + error = 0; + +-out_label: +- nfs4_label_free(fsinfo.fattr->label); + out_fattr: + nfs_free_fattr(fsinfo.fattr); + out_name: +@@ -165,5 +160,5 @@ out: + error_splat_root: + dput(fc->root); + fc->root = NULL; +- goto out_label; ++ goto out_fattr; + } +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -1592,6 +1592,23 @@ struct nfs_fattr *nfs_alloc_fattr(void) + } + EXPORT_SYMBOL_GPL(nfs_alloc_fattr); + ++struct nfs_fattr *nfs_alloc_fattr_with_label(struct nfs_server *server) ++{ ++ struct nfs_fattr *fattr = nfs_alloc_fattr(); ++ ++ if (!fattr) ++ return NULL; ++ ++ fattr->label = nfs4_label_alloc(server, GFP_NOFS); ++ if (IS_ERR(fattr->label)) { ++ kfree(fattr); ++ return NULL; ++ } ++ ++ return fattr; ++} ++EXPORT_SYMBOL_GPL(nfs_alloc_fattr_with_label); ++ + struct nfs_fh *nfs_alloc_fhandle(void) + { + struct nfs_fh *fh; +--- a/fs/nfs/internal.h ++++ b/fs/nfs/internal.h +@@ -349,14 +349,6 @@ nfs4_label_copy(struct nfs4_label *dst, + + return dst; + } +-static inline void nfs4_label_free(struct nfs4_label *label) +-{ +- if (label) { +- kfree(label->label); +- kfree(label); +- } +- return; +-} + + static inline void nfs_zap_label_cache_locked(struct nfs_inode *nfsi) + { +@@ -365,7 +357,6 @@ static inline void nfs_zap_label_cache_l + } + #else + static inline struct nfs4_label *nfs4_label_alloc(struct nfs_server *server, gfp_t flags) { return NULL; } +-static inline void nfs4_label_free(void *label) {} + static inline void nfs_zap_label_cache_locked(struct nfs_inode *nfsi) + { + } +--- a/include/linux/nfs_fs.h ++++ b/include/linux/nfs_fs.h +@@ -467,9 +467,22 @@ extern void nfs_fattr_set_barrier(struct + extern unsigned long nfs_inc_attr_generation_counter(void); + + extern struct nfs_fattr *nfs_alloc_fattr(void); ++extern struct nfs_fattr *nfs_alloc_fattr_with_label(struct nfs_server *server); ++ ++static inline void nfs4_label_free(struct nfs4_label *label) ++{ ++#ifdef CONFIG_NFS_V4_SECURITY_LABEL ++ if (label) { ++ kfree(label->label); ++ kfree(label); ++ } ++#endif ++} + + static inline void nfs_free_fattr(const struct nfs_fattr *fattr) + { ++ if (fattr) ++ nfs4_label_free(fattr->label); + kfree(fattr); + } + diff --git a/patches.suse/NFS-Don-t-allocate-nfs_fattr-on-the-stack-in-__nfs42.patch b/patches.suse/NFS-Don-t-allocate-nfs_fattr-on-the-stack-in-__nfs42.patch new file mode 100644 index 0000000..75da78d --- /dev/null +++ b/patches.suse/NFS-Don-t-allocate-nfs_fattr-on-the-stack-in-__nfs42.patch @@ -0,0 +1,59 @@ +From: Trond Myklebust +Date: Fri, 5 Nov 2021 14:23:30 -0400 +Subject: [PATCH] NFS: Don't allocate nfs_fattr on the stack in + __nfs42_ssc_open() +Git-commit: 156cd28562a4e8ca454d11b234d9f634a45d6390 +Patch-mainline: v5.16 +References: git-fixes + +The preferred behaviour is always to allocate struct nfs_fattr from the +slab. + +Signed-off-by: Trond Myklebust +Acked-by: NeilBrown + +--- + fs/nfs/nfs4file.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/fs/nfs/nfs4file.c ++++ b/fs/nfs/nfs4file.c +@@ -319,7 +319,7 @@ static int read_name_gen = 1; + static struct file *__nfs42_ssc_open(struct vfsmount *ss_mnt, + struct nfs_fh *src_fh, nfs4_stateid *stateid) + { +- struct nfs_fattr fattr; ++ struct nfs_fattr *fattr = nfs_alloc_fattr(); + struct file *filep, *res; + struct nfs_server *server; + struct inode *r_ino = NULL; +@@ -330,9 +330,10 @@ static struct file *__nfs42_ssc_open(str + + server = NFS_SERVER(ss_mnt->mnt_root->d_inode); + +- nfs_fattr_init(&fattr); ++ if (!fattr) ++ return ERR_PTR(-ENOMEM); + +- status = nfs4_proc_getattr(server, src_fh, &fattr, NULL, NULL); ++ status = nfs4_proc_getattr(server, src_fh, fattr, NULL, NULL); + if (status < 0) { + res = ERR_PTR(status); + goto out; +@@ -345,7 +346,7 @@ static struct file *__nfs42_ssc_open(str + goto out; + snprintf(read_name, len, SSC_READ_NAME_BODY, read_name_gen++); + +- r_ino = nfs_fhget(ss_mnt->mnt_root->d_inode->i_sb, src_fh, &fattr, ++ r_ino = nfs_fhget(ss_mnt->mnt_root->d_inode->i_sb, src_fh, fattr, + NULL); + if (IS_ERR(r_ino)) { + res = ERR_CAST(r_ino); +@@ -390,6 +391,7 @@ static struct file *__nfs42_ssc_open(str + out_free_name: + kfree(read_name); + out: ++ nfs_free_fattr(fattr); + return res; + out_stateowner: + nfs4_put_state_owner(sp); diff --git a/patches.suse/NFS-Further-optimisations-for-ls-l.patch b/patches.suse/NFS-Further-optimisations-for-ls-l.patch new file mode 100644 index 0000000..7bdcf9d --- /dev/null +++ b/patches.suse/NFS-Further-optimisations-for-ls-l.patch @@ -0,0 +1,126 @@ +From: Trond Myklebust +Date: Tue, 28 Sep 2021 14:33:44 -0400 +Subject: [PATCH] NFS: Further optimisations for 'ls -l' +Git-commit: ff81dfb5d721fff87bd516c558847f6effb70031 +Patch-mainline: v5.16 +References: git-fixes + +If a user is doing 'ls -l', we have a heuristic in GETATTR that tells +the readdir code to try to use READDIRPLUS in order to refresh the inode +attributes. In certain cirumstances, we also try to invalidate the +remaining directory entries in order to ensure this refresh. + +If there are multiple readers of the directory, we probably should avoid +invalidating the page cache, since the heuristic breaks down in that +situation anyway. + +Signed-off-by: Trond Myklebust +Tested-by: Benjamin Coddington +Reviewed-by: Benjamin Coddington +Acked-by: NeilBrown + +--- + fs/nfs/dir.c | 16 +++++++++++----- + include/linux/nfs_fs.h | 5 ++--- + 2 files changed, 13 insertions(+), 8 deletions(-) + +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -78,6 +78,7 @@ static struct nfs_open_dir_context *allo + ctx->attr_gencount = nfsi->attr_gencount; + ctx->dir_cookie = 0; + ctx->dup_cookie = 0; ++ ctx->page_index = 0; + spin_lock(&dir->i_lock); + if (list_empty(&nfsi->open_files) && + (nfsi->cache_validity & NFS_INO_DATA_INVAL_DEFER)) +@@ -85,6 +86,7 @@ static struct nfs_open_dir_context *allo + NFS_INO_INVALID_DATA | + NFS_INO_REVAL_FORCED); + list_add(&ctx->list, &nfsi->open_files); ++ clear_bit(NFS_INO_FORCE_READDIR, &nfsi->flags); + spin_unlock(&dir->i_lock); + return ctx; + } +@@ -626,8 +628,7 @@ void nfs_force_use_readdirplus(struct in + if (nfs_server_capable(dir, NFS_CAP_READDIRPLUS) && + !list_empty(&nfsi->open_files)) { + set_bit(NFS_INO_ADVISE_RDPLUS, &nfsi->flags); +- invalidate_mapping_pages(dir->i_mapping, +- nfsi->page_index + 1, -1); ++ set_bit(NFS_INO_FORCE_READDIR, &nfsi->flags); + } + } + +@@ -937,10 +938,8 @@ static int find_and_lock_cache_page(stru + sizeof(nfsi->cookieverf)); + } + res = nfs_readdir_search_array(desc); +- if (res == 0) { +- nfsi->page_index = desc->page_index; ++ if (res == 0) + return 0; +- } + nfs_readdir_page_unlock_and_put_cached(desc); + return res; + } +@@ -1079,6 +1078,7 @@ static int nfs_readdir(struct file *file + struct nfs_inode *nfsi = NFS_I(inode); + struct nfs_open_dir_context *dir_ctx = file->private_data; + struct nfs_readdir_descriptor *desc; ++ pgoff_t page_index; + int res; + + dfprintk(FILE, "NFS: readdir(%pD2) starting at cookie %llu\n", +@@ -1109,10 +1109,15 @@ static int nfs_readdir(struct file *file + desc->dir_cookie = dir_ctx->dir_cookie; + desc->dup_cookie = dir_ctx->dup_cookie; + desc->duped = dir_ctx->duped; ++ page_index = dir_ctx->page_index; + desc->attr_gencount = dir_ctx->attr_gencount; + memcpy(desc->verf, dir_ctx->verf, sizeof(desc->verf)); + spin_unlock(&file->f_lock); + ++ if (test_and_clear_bit(NFS_INO_FORCE_READDIR, &nfsi->flags) && ++ list_is_singular(&nfsi->open_files)) ++ invalidate_mapping_pages(inode->i_mapping, page_index + 1, -1); ++ + do { + res = readdir_search_pagecache(desc); + +@@ -1148,6 +1153,7 @@ static int nfs_readdir(struct file *file + dir_ctx->dir_cookie = desc->dir_cookie; + dir_ctx->dup_cookie = desc->dup_cookie; + dir_ctx->duped = desc->duped; ++ dir_ctx->page_index = desc->page_index; + dir_ctx->attr_gencount = desc->attr_gencount; + memcpy(dir_ctx->verf, desc->verf, sizeof(dir_ctx->verf)); + spin_unlock(&file->f_lock); +--- a/include/linux/nfs_fs.h ++++ b/include/linux/nfs_fs.h +@@ -98,6 +98,7 @@ struct nfs_open_dir_context { + __be32 verf[NFS_DIR_VERIFIER_SIZE]; + __u64 dir_cookie; + __u64 dup_cookie; ++ pgoff_t page_index; + signed char duped; + }; + +@@ -176,9 +177,6 @@ struct nfs_inode { + struct rw_semaphore rmdir_sem; + struct mutex commit_mutex; + +- /* track last access to cached pages */ +- unsigned long page_index; +- + #if IS_ENABLED(CONFIG_NFS_V4) + struct nfs4_cached_acl *nfs4_acl; + /* NFSv4 state */ +@@ -267,6 +265,7 @@ struct nfs4_copy_state { + #define NFS_INO_INVALIDATING (3) /* inode is being invalidated */ + #define NFS_INO_FSCACHE (5) /* inode can be cached by FS-Cache */ + #define NFS_INO_FSCACHE_LOCK (6) /* FS-Cache cookie management lock */ ++#define NFS_INO_FORCE_READDIR (7) /* force readdirplus */ + #define NFS_INO_LAYOUTCOMMIT (9) /* layoutcommit required */ + #define NFS_INO_LAYOUTCOMMITTING (10) /* layoutcommit inflight */ + #define NFS_INO_LAYOUTSTATS (11) /* layoutstats inflight */ diff --git a/patches.suse/NFSD-COMMIT-operations-must-not-return-NFS-ERR_INVAL.patch b/patches.suse/NFSD-COMMIT-operations-must-not-return-NFS-ERR_INVAL.patch new file mode 100644 index 0000000..1c26e95 --- /dev/null +++ b/patches.suse/NFSD-COMMIT-operations-must-not-return-NFS-ERR_INVAL.patch @@ -0,0 +1,170 @@ +From: Chuck Lever +Date: Mon, 24 Jan 2022 15:50:31 -0500 +Subject: [PATCH] NFSD: COMMIT operations must not return NFS?ERR_INVAL +Git-commit: 3f965021c8bc38965ecb1924f570c4842b33d408 +Patch-mainline: v5.17 +References: git-fixes + +Since, well, forever, the Linux NFS server's nfsd_commit() function +has returned nfserr_inval when the passed-in byte range arguments +were non-sensical. + +However, according to RFC 1813 section 3.3.21, NFSv3 COMMIT requests +are permitted to return only the following non-zero status codes: + + NFS3ERR_IO + NFS3ERR_STALE + NFS3ERR_BADHANDLE + NFS3ERR_SERVERFAULT + +NFS3ERR_INVAL is not included in that list. Likewise, NFS4ERR_INVAL +is not listed in the COMMIT row of Table 6 in RFC 8881. + +RFC 7530 does permit COMMIT to return NFS4ERR_INVAL, but does not +specify when it can or should be used. + +Instead of dropping or failing a COMMIT request in a byte range that +is not supported, turn it into a valid request by treating one or +both arguments as zero. Offset zero means start-of-file, count zero +means until-end-of-file, so we only ever extend the commit range. +NFS servers are always allowed to commit more and sooner than +requested. + +The range check is no longer bounded by NFS_OFFSET_MAX, but rather +by the value that is returned in the maxfilesize field of the NFSv3 +FSINFO procedure or the NFSv4 maxfilesize file attribute. + +Note that this change results in a new pynfs failure: + +CMT4 st_commit.testCommitOverflow : RUNNING +CMT4 st_commit.testCommitOverflow : FAILURE + COMMIT with offset + count overflow should return + NFS4ERR_INVAL, instead got NFS4_OK + +IMO the test is not correct as written: RFC 8881 does not allow the +COMMIT operation to return NFS4ERR_INVAL. + +Reported-by: Dan Aloni +Cc: stable@vger.kernel.org +Signed-off-by: Chuck Lever +Reviewed-by: Bruce Fields +Acked-by: NeilBrown + +--- + fs/nfsd/nfs3proc.c | 6 ------ + fs/nfsd/vfs.c | 53 ++++++++++++++++++++++++++++++++++++----------------- + fs/nfsd/vfs.h | 4 ++-- + 3 files changed, 38 insertions(+), 25 deletions(-) + +--- a/fs/nfsd/nfs3proc.c ++++ b/fs/nfsd/nfs3proc.c +@@ -661,15 +661,9 @@ nfsd3_proc_commit(struct svc_rqst *rqstp + argp->count, + (unsigned long long) argp->offset); + +- if (argp->offset > NFS_OFFSET_MAX) { +- resp->status = nfserr_inval; +- goto out; +- } +- + fh_copy(&resp->fh, &argp->fh); + resp->status = nfsd_commit(rqstp, &resp->fh, argp->offset, + argp->count, resp->verf); +-out: + return rpc_success; + } + +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -1134,42 +1134,61 @@ out: + } + + #ifdef CONFIG_NFSD_V3 +-/* +- * Commit all pending writes to stable storage. ++/** ++ * nfsd_commit - Commit pending writes to stable storage ++ * @rqstp: RPC request being processed ++ * @fhp: NFS filehandle ++ * @offset: raw offset from beginning of file ++ * @count: raw count of bytes to sync ++ * @verf: filled in with the server's current write verifier + * +- * Note: we only guarantee that data that lies within the range specified +- * by the 'offset' and 'count' parameters will be synced. ++ * Note: we guarantee that data that lies within the range specified ++ * by the 'offset' and 'count' parameters will be synced. The server ++ * is permitted to sync data that lies outside this range at the ++ * same time. + * + * Unfortunately we cannot lock the file to make sure we return full WCC + * data to the client, as locking happens lower down in the filesystem. ++ * ++ * Return values: ++ * An nfsstat value in network byte order. + */ + __be32 +-nfsd_commit(struct svc_rqst *rqstp, struct svc_fh *fhp, +- loff_t offset, unsigned long count, __be32 *verf) ++nfsd_commit(struct svc_rqst *rqstp, struct svc_fh *fhp, u64 offset, ++ u32 count, __be32 *verf) + { ++ u64 maxbytes; ++ loff_t start, end; + struct nfsd_net *nn; + struct nfsd_file *nf; +- loff_t end = LLONG_MAX; +- __be32 err = nfserr_inval; +- +- if (offset < 0) +- goto out; +- if (count != 0) { +- end = offset + (loff_t)count - 1; +- if (end < offset) +- goto out; +- } ++ __be32 err; + + err = nfsd_file_acquire(rqstp, fhp, + NFSD_MAY_WRITE|NFSD_MAY_NOT_BREAK_LEASE, &nf); + if (err) + goto out; ++ ++ /* ++ * Convert the client-provided (offset, count) range to a ++ * (start, end) range. If the client-provided range falls ++ * outside the maximum file size of the underlying FS, ++ * clamp the sync range appropriately. ++ */ ++ start = 0; ++ end = LLONG_MAX; ++ maxbytes = (u64)fhp->fh_dentry->d_sb->s_maxbytes; ++ if (offset < maxbytes) { ++ start = offset; ++ if (count && (offset + count - 1 < maxbytes)) ++ end = offset + count - 1; ++ } ++ + nn = net_generic(nf->nf_net, nfsd_net_id); + if (EX_ISSYNC(fhp->fh_export)) { + errseq_t since = READ_ONCE(nf->nf_file->f_wb_err); + int err2; + +- err2 = vfs_fsync_range(nf->nf_file, offset, end, 0); ++ err2 = vfs_fsync_range(nf->nf_file, start, end, 0); + switch (err2) { + case 0: + nfsd_copy_boot_verifier(verf, nn); +--- a/fs/nfsd/vfs.h ++++ b/fs/nfsd/vfs.h +@@ -73,8 +73,8 @@ __be32 do_nfsd_create(struct svc_rqst * + char *name, int len, struct iattr *attrs, + struct svc_fh *res, int createmode, + u32 *verifier, bool *truncp, bool *created); +-__be32 nfsd_commit(struct svc_rqst *, struct svc_fh *, +- loff_t, unsigned long, __be32 *verf); ++__be32 nfsd_commit(struct svc_rqst *rqst, struct svc_fh *fhp, ++ u64 offset, u32 count, __be32 *verf); + #endif /* CONFIG_NFSD_V3 */ + #ifdef CONFIG_NFSD_V4 + __be32 nfsd_getxattr(struct svc_rqst *rqstp, struct svc_fh *fhp, diff --git a/patches.suse/NFSD-Clamp-WRITE-offsets.patch b/patches.suse/NFSD-Clamp-WRITE-offsets.patch index 4398e4b..5c9d932 100644 --- a/patches.suse/NFSD-Clamp-WRITE-offsets.patch +++ b/patches.suse/NFSD-Clamp-WRITE-offsets.patch @@ -33,7 +33,7 @@ Acked-by: NeilBrown + fh_copy(&resp->fh, &argp->fh); resp->committed = argp->stable; - nvecs = svc_fill_write_vector(rqstp, rqstp->rq_arg.pages, + nvecs = svc_fill_write_vector(rqstp, &argp->payload); --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1022,8 +1022,9 @@ nfsd4_write(struct svc_rqst *rqstp, stru diff --git a/patches.suse/NFSD-De-duplicate-net_generic-nf-nf_net-nfsd_net_id.patch b/patches.suse/NFSD-De-duplicate-net_generic-nf-nf_net-nfsd_net_id.patch new file mode 100644 index 0000000..cdfc85e --- /dev/null +++ b/patches.suse/NFSD-De-duplicate-net_generic-nf-nf_net-nfsd_net_id.patch @@ -0,0 +1,60 @@ +From: Chuck Lever +Date: Tue, 28 Dec 2021 14:26:03 -0500 +Subject: [PATCH] NFSD: De-duplicate net_generic(nf->nf_net, nfsd_net_id) +Git-commit: 2c445a0e72cb1fbfbdb7f9473c53556ee27c1d90 +Patch-mainline: v5.17 +References: git-fixes + +Since this pointer is used repeatedly, move it to a stack variable. + +Signed-off-by: Chuck Lever +Acked-by: NeilBrown + +--- + fs/nfsd/vfs.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -1143,6 +1143,7 @@ __be32 + nfsd_commit(struct svc_rqst *rqstp, struct svc_fh *fhp, + loff_t offset, unsigned long count, __be32 *verf) + { ++ struct nfsd_net *nn; + struct nfsd_file *nf; + loff_t end = LLONG_MAX; + __be32 err = nfserr_inval; +@@ -1159,6 +1160,7 @@ nfsd_commit(struct svc_rqst *rqstp, stru + NFSD_MAY_WRITE|NFSD_MAY_NOT_BREAK_LEASE, &nf); + if (err) + goto out; ++ nn = net_generic(nf->nf_net, nfsd_net_id); + if (EX_ISSYNC(fhp->fh_export)) { + errseq_t since = READ_ONCE(nf->nf_file->f_wb_err); + int err2; +@@ -1166,8 +1168,7 @@ nfsd_commit(struct svc_rqst *rqstp, stru + err2 = vfs_fsync_range(nf->nf_file, offset, end, 0); + switch (err2) { + case 0: +- nfsd_copy_boot_verifier(verf, net_generic(nf->nf_net, +- nfsd_net_id)); ++ nfsd_copy_boot_verifier(verf, nn); + err2 = filemap_check_wb_err(nf->nf_file->f_mapping, + since); + break; +@@ -1175,13 +1176,11 @@ nfsd_commit(struct svc_rqst *rqstp, stru + err = nfserr_notsupp; + break; + default: +- nfsd_reset_boot_verifier(net_generic(nf->nf_net, +- nfsd_net_id)); ++ nfsd_reset_boot_verifier(nn); + } + err = nfserrno(err2); + } else +- nfsd_copy_boot_verifier(verf, net_generic(nf->nf_net, +- nfsd_net_id)); ++ nfsd_copy_boot_verifier(verf, nn); + + nfsd_file_put(nf); + out: diff --git a/patches.suse/NFSD-Fix-nfsd_breaker_owns_lease-return-values.patch b/patches.suse/NFSD-Fix-nfsd_breaker_owns_lease-return-values.patch new file mode 100644 index 0000000..074d97f --- /dev/null +++ b/patches.suse/NFSD-Fix-nfsd_breaker_owns_lease-return-values.patch @@ -0,0 +1,51 @@ +From: Chuck Lever +Date: Mon, 14 Feb 2022 15:30:13 -0500 +Subject: [PATCH] NFSD: Fix nfsd_breaker_owns_lease() return values +Git-commit: 50719bf3442dd6cd05159e9c98d020b3919ce978 +Patch-mainline: v5.18 +References: git-fixes + +These have been incorrect since the function was introduced. + +A proper kerneldoc comment is added since this function, though +static, is part of an external interface. + +Reported-by: Dai Ngo +Signed-off-by: Chuck Lever +Acked-by: NeilBrown + +--- + fs/nfsd/nfs4state.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -4819,6 +4819,14 @@ nfsd_break_deleg_cb(struct file_lock *fl + return ret; + } + ++/** ++ * nfsd_breaker_owns_lease - Check if lease conflict was resolved ++ * @fl: Lock state to check ++ * ++ * Return values: ++ * %true: Lease conflict was resolved ++ * %false: Lease conflict was not resolved. ++ */ + static bool nfsd_breaker_owns_lease(struct file_lock *fl) + { + struct nfs4_delegation *dl = fl->fl_owner; +@@ -4826,11 +4834,11 @@ static bool nfsd_breaker_owns_lease(stru + struct nfs4_client *clp; + + if (!i_am_nfsd()) +- return NULL; ++ return false; + rqst = kthread_data(current); + /* Note rq_prog == NFS_ACL_PROGRAM is also possible: */ + if (rqst->rq_prog != NFS_PROGRAM || rqst->rq_vers < 4) +- return NULL; ++ return false; + clp = *(rqst->rq_lease_breaker); + return dl->dl_stid.sc_client == clp; + } diff --git a/patches.suse/NFSD-Fix-zero-length-NFSv3-WRITEs.patch b/patches.suse/NFSD-Fix-zero-length-NFSv3-WRITEs.patch index c48c814..d935c51 100644 --- a/patches.suse/NFSD-Fix-zero-length-NFSv3-WRITEs.patch +++ b/patches.suse/NFSD-Fix-zero-length-NFSv3-WRITEs.patch @@ -43,10 +43,10 @@ Acked-by: NeilBrown --- a/fs/nfsd/nfs3proc.c +++ b/fs/nfsd/nfs3proc.c -@@ -203,15 +203,11 @@ nfsd3_proc_write(struct svc_rqst *rqstp) +@@ -202,15 +202,11 @@ nfsd3_proc_write(struct svc_rqst *rqstp) + fh_copy(&resp->fh, &argp->fh); resp->committed = argp->stable; - nvecs = svc_fill_write_vector(rqstp, rqstp->rq_arg.pages, - &argp->first, cnt); + nvecs = svc_fill_write_vector(rqstp, &argp->payload); - if (!nvecs) { - resp->status = nfserr_io; - goto out; @@ -62,10 +62,10 @@ Acked-by: NeilBrown --- a/fs/nfsd/nfsproc.c +++ b/fs/nfsd/nfsproc.c -@@ -236,10 +236,6 @@ nfsd_proc_write(struct svc_rqst *rqstp) +@@ -235,10 +235,6 @@ nfsd_proc_write(struct svc_rqst *rqstp) + argp->len, argp->offset); - nvecs = svc_fill_write_vector(rqstp, rqstp->rq_arg.pages, - &argp->first, cnt); + nvecs = svc_fill_write_vector(rqstp, &argp->payload); - if (!nvecs) { - resp->status = nfserr_io; - goto out; @@ -73,7 +73,7 @@ Acked-by: NeilBrown resp->status = nfsd_write(rqstp, fh_copy(&resp->fh, &argp->fh), argp->offset, rqstp->rq_vec, nvecs, -@@ -248,7 +244,6 @@ nfsd_proc_write(struct svc_rqst *rqstp) +@@ -247,7 +243,6 @@ nfsd_proc_write(struct svc_rqst *rqstp) resp->status = fh_getattr(&resp->fh, &resp->stat); else if (resp->status == nfserr_jukebox) return rpc_drop_reply; diff --git a/patches.suse/NFSD-Have-legacy-NFSD-WRITE-decoders-use-xdr_stream_.patch b/patches.suse/NFSD-Have-legacy-NFSD-WRITE-decoders-use-xdr_stream_.patch new file mode 100644 index 0000000..c8ec93e --- /dev/null +++ b/patches.suse/NFSD-Have-legacy-NFSD-WRITE-decoders-use-xdr_stream_.patch @@ -0,0 +1,191 @@ +From: Chuck Lever +Date: Thu, 30 Sep 2021 17:06:21 -0400 +Subject: [PATCH] NFSD: Have legacy NFSD WRITE decoders use + xdr_stream_subsegment() +Git-commit: dae9a6cab8009e526570e7477ce858dcdfeb256e +Patch-mainline: v5.16 +References: git-fixes + +Refactor. + +Now that the NFSv2 and NFSv3 XDR decoders have been converted to +use xdr_streams, the WRITE decoder functions can use +xdr_stream_subsegment() to extract the WRITE payload into its own +xdr_buf, just as the NFSv4 WRITE XDR decoder currently does. + +That makes it possible to pass the first kvec, pages array + length, +page_base, and total payload length via a single function parameter. + +The payload's page_base is not yet assigned or used, but will be in +subsequent patches. + +Signed-off-by: Chuck Lever +Signed-off-by: J. Bruce Fields +Acked-by: NeilBrown + +--- + fs/nfsd/nfs3proc.c | 3 +-- + fs/nfsd/nfs3xdr.c | 12 ++---------- + fs/nfsd/nfs4proc.c | 3 +-- + fs/nfsd/nfsproc.c | 3 +-- + fs/nfsd/nfsxdr.c | 9 +-------- + fs/nfsd/xdr.h | 2 +- + fs/nfsd/xdr3.h | 2 +- + include/linux/sunrpc/svc.h | 3 +-- + net/sunrpc/svc.c | 11 ++++++----- + 9 files changed, 15 insertions(+), 33 deletions(-) + +--- a/fs/nfsd/nfs3proc.c ++++ b/fs/nfsd/nfs3proc.c +@@ -201,8 +201,7 @@ nfsd3_proc_write(struct svc_rqst *rqstp) + + fh_copy(&resp->fh, &argp->fh); + resp->committed = argp->stable; +- nvecs = svc_fill_write_vector(rqstp, rqstp->rq_arg.pages, +- &argp->first, cnt); ++ nvecs = svc_fill_write_vector(rqstp, &argp->payload); + if (!nvecs) { + resp->status = nfserr_io; + goto out; +--- a/fs/nfsd/nfs3xdr.c ++++ b/fs/nfsd/nfs3xdr.c +@@ -621,9 +621,6 @@ nfs3svc_decode_writeargs(struct svc_rqst + struct xdr_stream *xdr = &rqstp->rq_arg_stream; + struct nfsd3_writeargs *args = rqstp->rq_argp; + u32 max_blocksize = svc_max_payload(rqstp); +- struct kvec *head = rqstp->rq_arg.head; +- struct kvec *tail = rqstp->rq_arg.tail; +- size_t remaining; + + if (!svcxdr_decode_nfs_fh3(xdr, &args->fh)) + return 0; +@@ -641,17 +638,12 @@ nfs3svc_decode_writeargs(struct svc_rqst + /* request sanity */ + if (args->count != args->len) + return 0; +- remaining = head->iov_len + rqstp->rq_arg.page_len + tail->iov_len; +- remaining -= xdr_stream_pos(xdr); +- if (remaining < xdr_align_size(args->len)) +- return 0; + if (args->count > max_blocksize) { + args->count = max_blocksize; + args->len = max_blocksize; + } +- +- args->first.iov_base = xdr->p; +- args->first.iov_len = head->iov_len - xdr_stream_pos(xdr); ++ if (!xdr_stream_subsegment(xdr, &args->payload, args->count)) ++ return 0; + + return 1; + } +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1033,8 +1033,7 @@ nfsd4_write(struct svc_rqst *rqstp, stru + + write->wr_how_written = write->wr_stable_how; + +- nvecs = svc_fill_write_vector(rqstp, write->wr_payload.pages, +- write->wr_payload.head, write->wr_buflen); ++ nvecs = svc_fill_write_vector(rqstp, &write->wr_payload); + WARN_ON_ONCE(nvecs > ARRAY_SIZE(rqstp->rq_vec)); + + status = nfsd_vfs_write(rqstp, &cstate->current_fh, nf, +--- a/fs/nfsd/nfsproc.c ++++ b/fs/nfsd/nfsproc.c +@@ -234,8 +234,7 @@ nfsd_proc_write(struct svc_rqst *rqstp) + SVCFH_fmt(&argp->fh), + argp->len, argp->offset); + +- nvecs = svc_fill_write_vector(rqstp, rqstp->rq_arg.pages, +- &argp->first, cnt); ++ nvecs = svc_fill_write_vector(rqstp, &argp->payload); + if (!nvecs) { + resp->status = nfserr_io; + goto out; +--- a/fs/nfsd/nfsxdr.c ++++ b/fs/nfsd/nfsxdr.c +@@ -325,10 +325,7 @@ nfssvc_decode_writeargs(struct svc_rqst + { + struct xdr_stream *xdr = &rqstp->rq_arg_stream; + struct nfsd_writeargs *args = rqstp->rq_argp; +- struct kvec *head = rqstp->rq_arg.head; +- struct kvec *tail = rqstp->rq_arg.tail; + u32 beginoffset, totalcount; +- size_t remaining; + + if (!svcxdr_decode_fhandle(xdr, &args->fh)) + return 0; +@@ -346,12 +343,8 @@ nfssvc_decode_writeargs(struct svc_rqst + return 0; + if (args->len > NFSSVC_MAXBLKSIZE_V2) + return 0; +- remaining = head->iov_len + rqstp->rq_arg.page_len + tail->iov_len; +- remaining -= xdr_stream_pos(xdr); +- if (remaining < xdr_align_size(args->len)) ++ if (!xdr_stream_subsegment(xdr, &args->payload, args->len)) + return 0; +- args->first.iov_base = xdr->p; +- args->first.iov_len = head->iov_len - xdr_stream_pos(xdr); + + return 1; + } +--- a/fs/nfsd/xdr.h ++++ b/fs/nfsd/xdr.h +@@ -33,7 +33,7 @@ struct nfsd_writeargs { + svc_fh fh; + __u32 offset; + int len; +- struct kvec first; ++ struct xdr_buf payload; + }; + + struct nfsd_createargs { +--- a/fs/nfsd/xdr3.h ++++ b/fs/nfsd/xdr3.h +@@ -40,7 +40,7 @@ struct nfsd3_writeargs { + __u32 count; + int stable; + __u32 len; +- struct kvec first; ++ struct xdr_buf payload; + }; + + struct nfsd3_createargs { +--- a/include/linux/sunrpc/svc.h ++++ b/include/linux/sunrpc/svc.h +@@ -528,8 +528,7 @@ int svc_encode_result_payload(struct + unsigned int offset, + unsigned int length); + unsigned int svc_fill_write_vector(struct svc_rqst *rqstp, +- struct page **pages, +- struct kvec *first, size_t total); ++ struct xdr_buf *payload); + char *svc_fill_symlink_pathname(struct svc_rqst *rqstp, + struct kvec *first, void *p, + size_t total); +--- a/net/sunrpc/svc.c ++++ b/net/sunrpc/svc.c +@@ -1664,16 +1664,17 @@ EXPORT_SYMBOL_GPL(svc_encode_result_payl + /** + * svc_fill_write_vector - Construct data argument for VFS write call + * @rqstp: svc_rqst to operate on +- * @pages: list of pages containing data payload +- * @first: buffer containing first section of write payload +- * @total: total number of bytes of write payload ++ * @payload: xdr_buf containing only the write data payload + * + * Fills in rqstp::rq_vec, and returns the number of elements. + */ +-unsigned int svc_fill_write_vector(struct svc_rqst *rqstp, struct page **pages, +- struct kvec *first, size_t total) ++unsigned int svc_fill_write_vector(struct svc_rqst *rqstp, ++ struct xdr_buf *payload) + { ++ struct page **pages = payload->pages; ++ struct kvec *first = payload->head; + struct kvec *vec = rqstp->rq_vec; ++ size_t total = payload->len; + unsigned int i; + + /* Some types of transport can present the write payload diff --git a/patches.suse/NFSD-prevent-underflow-in-nfssvc_decode_writeargs.patch b/patches.suse/NFSD-prevent-underflow-in-nfssvc_decode_writeargs.patch index 7e23b6b..6a8aa91 100644 --- a/patches.suse/NFSD-prevent-underflow-in-nfssvc_decode_writeargs.patch +++ b/patches.suse/NFSD-prevent-underflow-in-nfssvc_decode_writeargs.patch @@ -41,6 +41,6 @@ Acked-by: NeilBrown __u32 offset; - int len; + __u32 len; - struct kvec first; + struct xdr_buf payload; }; diff --git a/patches.suse/NFSD-restore-EINVAL-error-translation-in-nfsd_commit.patch b/patches.suse/NFSD-restore-EINVAL-error-translation-in-nfsd_commit.patch index 821a444..4a2b479 100644 --- a/patches.suse/NFSD-restore-EINVAL-error-translation-in-nfsd_commit.patch +++ b/patches.suse/NFSD-restore-EINVAL-error-translation-in-nfsd_commit.patch @@ -22,21 +22,20 @@ Acked-by: NeilBrown --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c -@@ -1174,6 +1174,7 @@ nfsd_commit(struct svc_rqst *rqstp, stru - nfsd_net_id)); +@@ -1175,14 +1175,15 @@ nfsd_commit(struct svc_rqst *rqstp, stru + nfsd_copy_boot_verifier(verf, nn); err2 = filemap_check_wb_err(nf->nf_file->f_mapping, since); + err = nfserrno(err2); break; case -EINVAL: err = nfserr_notsupp; -@@ -1181,8 +1182,8 @@ nfsd_commit(struct svc_rqst *rqstp, stru + break; default: - nfsd_reset_boot_verifier(net_generic(nf->nf_net, - nfsd_net_id)); + nfsd_reset_boot_verifier(nn); + err = nfserrno(err2); } - err = nfserrno(err2); } else - nfsd_copy_boot_verifier(verf, net_generic(nf->nf_net, - nfsd_net_id)); + nfsd_copy_boot_verifier(verf, nn); + diff --git a/patches.suse/NFSv3-handle-out-of-order-write-replies.patch b/patches.suse/NFSv3-handle-out-of-order-write-replies.patch new file mode 100644 index 0000000..54934dd --- /dev/null +++ b/patches.suse/NFSv3-handle-out-of-order-write-replies.patch @@ -0,0 +1,330 @@ +From: NeilBrown +Date: Tue, 13 Dec 2022 15:13:35 +1100 +Subject: [PATCH] NFSv3: handle out-of-order write replies. +Patch-mainline: Submitted, Thu, 16 Feb 2023 07:32:25 +1100 - +References: bsc#1205544 + +NFSv3 includes pre/post wcc attributes which allow the client to +determine if all changes to the file have been made by the client +itself, or if any might have been made by some other client. + +If there are gaps in the pre/post ctime sequence it must be assumed that +some other client changed the file in that gap and the local cache must +be suspect. The next time the file is opened the cache should be +invalidated. + +Since Commit 1c341b777501 ("NFS: Add deferred cache invalidation for +close-to-open consistency violations") in linux 5.3 the Linux client has +been triggering this invalidation. The chunk in nfs_update_inode() in +particularly triggers. + +Unfortunately Linux NFS assumes that all replies will be processed in +the order sent, and will arrive in the order processed. This is not +true in general. Consequently Linux NFS might ignore the wcc info in a +WRITE reply because the reply is in response to a WRITE that was sent +before some other request for which a reply has already been seen. This +is detected by Linux using the gencount tests in nfs_inode_attr_cmp(). + +Also, when the gencount tests pass it is still possible that the request +were processed on the server in a different order, and a gap seen in +the ctime sequence might be filled in by a subsequent reply, so gaps +should not immediately trigger delayed invalidation. + +The net result is that writing to a server and then reading the file +back can result in going to the server for the read rather than serving +it from cache - all because a couple of replies arrived out-of-order. +This is a performance regression over kernels before 5.3, though the +change in 5.3 is a correctness improvement. + +This has been seen with Linux writing to a Netapp server which +occasionally re-orders requests. In testing the majority of requests +were in-order, but a few (maybe 2 or three at a time) could be +re-ordered. + +This patch addresses the problem by recording any gaps seen in the +pre/post ctime sequence and not triggering invalidation until either +there are too many gaps to fit in the table, or until there are no more +active writes and the remaining gaps cannot be resolved. + +We allocate a table of 16 gaps on demand. If the allocation fails we +revert to current behaviour which is of little cost as we are unlikely +to be able to cache the writes anyway. + +In the table we store "start->end" pair when iversion is updated and +"end<-start" pairs pre/post pairs reported by the server. Usually these +exactly cancel out and so nothing is stored. When there are +out-of-order replies we do store gaps and these will eventually be +cancelled against later replies when this client is the only writer. + +If the final write is out-of-order there may be one gap remaining when +the file is closed. This will be noticed and if there is precisely on +gap and if the iversion can be advanced to match it, then we do so. + +This patch makes no attempt to handle directories correctly. The same +problem potentially exists in the out-of-order replies to create/unlink +requests can cause future lookup requires to be sent to the server +unnecessarily. A similar scheme using the same primitives could be used +to notice and handle out-of-order replies. + +Signed-off-by: NeilBrown +Acked-by: NeilBrown + +--- + fs/nfs/inode.c | 112 ++++++++++++++++++++++++++++++++++++++++++------- + include/linux/nfs_fs.h | 47 ++++++++++++++++++++ + 2 files changed, 144 insertions(+), 15 deletions(-) + +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -214,11 +214,12 @@ void nfs_set_cache_invalid(struct inode + + nfsi->cache_validity |= flags; + +- if (inode->i_mapping->nrpages == 0) +- nfsi->cache_validity &= ~(NFS_INO_INVALID_DATA | +- NFS_INO_DATA_INVAL_DEFER); +- else if (nfsi->cache_validity & NFS_INO_INVALID_DATA) +- nfsi->cache_validity &= ~NFS_INO_DATA_INVAL_DEFER; ++ if (inode->i_mapping->nrpages == 0) { ++ nfsi->cache_validity &= ~NFS_INO_INVALID_DATA; ++ nfs_ooo_clear(nfsi); ++ } else if (nfsi->cache_validity & NFS_INO_INVALID_DATA) { ++ nfs_ooo_clear(nfsi); ++ } + } + EXPORT_SYMBOL_GPL(nfs_set_cache_invalid); + +@@ -673,9 +674,10 @@ static int nfs_vmtruncate(struct inode * + + i_size_write(inode, offset); + /* Optimisation */ +- if (offset == 0) +- NFS_I(inode)->cache_validity &= ~(NFS_INO_INVALID_DATA | +- NFS_INO_DATA_INVAL_DEFER); ++ if (offset == 0) { ++ NFS_I(inode)->cache_validity &= ~NFS_INO_INVALID_DATA; ++ nfs_ooo_clear(NFS_I(inode)); ++ } + NFS_I(inode)->cache_validity &= ~NFS_INO_INVALID_SIZE; + + spin_unlock(&inode->i_lock); +@@ -1092,7 +1094,7 @@ void nfs_inode_attach_open_context(struc + + spin_lock(&inode->i_lock); + if (list_empty(&nfsi->open_files) && +- (nfsi->cache_validity & NFS_INO_DATA_INVAL_DEFER)) ++ nfs_ooo_test(nfsi)) + nfs_set_cache_invalid(inode, NFS_INO_INVALID_DATA | + NFS_INO_REVAL_FORCED); + list_add_tail_rcu(&ctx->list, &nfsi->open_files); +@@ -1344,8 +1346,8 @@ int nfs_clear_invalid_mapping(struct add + + set_bit(NFS_INO_INVALIDATING, bitlock); + smp_wmb(); +- nfsi->cache_validity &= +- ~(NFS_INO_INVALID_DATA | NFS_INO_DATA_INVAL_DEFER); ++ nfsi->cache_validity &= ~NFS_INO_INVALID_DATA; ++ nfs_ooo_clear(nfsi); + spin_unlock(&inode->i_lock); + trace_nfs_invalidate_mapping_enter(inode); + ret = nfs_invalidate_mapping(inode, mapping); +@@ -1789,6 +1791,66 @@ static int nfs_inode_finish_partial_attr + return 0; + } + ++static void nfs_ooo_merge(struct nfs_inode *nfsi, ++ u64 start, u64 end) ++{ ++ int i, cnt; ++ ++ if (nfsi->cache_validity & NFS_INO_DATA_INVAL_DEFER) ++ /* No point merging anything */ ++ return; ++ ++ if (!nfsi->ooo) { ++ nfsi->ooo = kmalloc(sizeof(*nfsi->ooo), GFP_ATOMIC); ++ if (!nfsi->ooo) { ++ nfsi->cache_validity |= NFS_INO_DATA_INVAL_DEFER; ++ return; ++ } ++ nfsi->ooo->cnt = 0; ++ } ++ ++ /* add this range, merging if possible */ ++ cnt = nfsi->ooo->cnt; ++ for (i = 0; i < cnt; i++) { ++ if (end == nfsi->ooo->gap[i].start) ++ end = nfsi->ooo->gap[i].end; ++ else if (start == nfsi->ooo->gap[i].end) ++ start = nfsi->ooo->gap[i].start; ++ else ++ continue; ++ /* Remove 'i' from table and loop to insert the new range */ ++ cnt -= 1; ++ nfsi->ooo->gap[i] = nfsi->ooo->gap[cnt]; ++ i = -1; ++ } ++ if (start != end) { ++ if (cnt >= ARRAY_SIZE(nfsi->ooo->gap)) { ++ nfsi->cache_validity |= NFS_INO_DATA_INVAL_DEFER; ++ kfree(nfsi->ooo); ++ nfsi->ooo = NULL; ++ return; ++ } ++ nfsi->ooo->gap[cnt].start = start; ++ nfsi->ooo->gap[cnt].end = end; ++ cnt += 1; ++ } ++ nfsi->ooo->cnt = cnt; ++} ++ ++static void nfs_ooo_record(struct nfs_inode *nfsi, ++ struct nfs_fattr *fattr) ++{ ++ /* This reply was out-of-order, so record in the ++ * pre/post change id, possibly cancelling ++ * gaps created when iversion was jumpped forward. ++ */ ++ if ((fattr->valid & NFS_ATTR_FATTR_CHANGE) && ++ (fattr->valid & NFS_ATTR_FATTR_PRECHANGE)) ++ nfs_ooo_merge(nfsi, ++ fattr->change_attr, ++ fattr->pre_change_attr); ++} ++ + static int nfs_refresh_inode_locked(struct inode *inode, + struct nfs_fattr *fattr) + { +@@ -1799,8 +1861,12 @@ static int nfs_refresh_inode_locked(stru + + if (attr_cmp > 0 || nfs_inode_finish_partial_attr_update(fattr, inode)) + ret = nfs_update_inode(inode, fattr); +- else if (attr_cmp == 0) +- ret = nfs_check_inode_attributes(inode, fattr); ++ else { ++ nfs_ooo_record(NFS_I(inode), fattr); ++ ++ if (attr_cmp == 0) ++ ret = nfs_check_inode_attributes(inode, fattr); ++ } + + trace_nfs_refresh_inode_exit(inode, ret); + return ret; +@@ -1891,6 +1957,8 @@ int nfs_post_op_update_inode_force_wcc_l + if (attr_cmp < 0) + return 0; + if ((fattr->valid & NFS_ATTR_FATTR) == 0 || !attr_cmp) { ++ /* Record the pre/post change info before clearing PRECHANGE */ ++ nfs_ooo_record(NFS_I(inode), fattr); + fattr->valid &= ~(NFS_ATTR_FATTR_PRECHANGE + | NFS_ATTR_FATTR_PRESIZE + | NFS_ATTR_FATTR_PREMTIME +@@ -2045,6 +2113,15 @@ static int nfs_update_inode(struct inode + + /* More cache consistency checks */ + if (fattr->valid & NFS_ATTR_FATTR_CHANGE) { ++ if (!have_writers && nfsi->ooo && nfsi->ooo->cnt == 1 && ++ nfsi->ooo->gap[0].end == inode_peek_iversion_raw(inode)) { ++ /* There is one remaining gap that hasn't been ++ * merged into iversion - do that now. ++ */ ++ inode_set_iversion_raw(inode, nfsi->ooo->gap[0].start); ++ kfree(nfsi->ooo); ++ nfsi->ooo = NULL; ++ } + if (!inode_eq_iversion_raw(inode, fattr->change_attr)) { + /* Could it be a race with writeback? */ + if (!(have_writers || have_delegation)) { +@@ -2066,8 +2143,11 @@ static int nfs_update_inode(struct inode + dprintk("NFS: change_attr change on server for file %s/%ld\n", + inode->i_sb->s_id, + inode->i_ino); +- } else if (!have_delegation) +- nfsi->cache_validity |= NFS_INO_DATA_INVAL_DEFER; ++ } else if (!have_delegation) { ++ nfs_ooo_record(nfsi, fattr); ++ nfs_ooo_merge(nfsi, inode_peek_iversion_raw(inode), ++ fattr->change_attr); ++ } + inode_set_iversion_raw(inode, fattr->change_attr); + } + } else { +@@ -2229,6 +2309,7 @@ struct inode *nfs_alloc_inode(struct sup + return NULL; + nfsi->flags = 0UL; + nfsi->cache_validity = 0UL; ++ nfsi->ooo = NULL; + #if IS_ENABLED(CONFIG_NFS_V4) + nfsi->nfs4_acl = NULL; + #endif /* CONFIG_NFS_V4 */ +@@ -2241,6 +2322,7 @@ EXPORT_SYMBOL_GPL(nfs_alloc_inode); + + void nfs_free_inode(struct inode *inode) + { ++ kfree(NFS_I(inode)->ooo); + kmem_cache_free(nfs_inode_cachep, NFS_I(inode)); + } + EXPORT_SYMBOL_GPL(nfs_free_inode); +--- a/include/linux/nfs_fs.h ++++ b/include/linux/nfs_fs.h +@@ -182,6 +182,39 @@ struct nfs_inode { + struct rw_semaphore rmdir_sem; + struct mutex commit_mutex; + ++ /* Keep track of out-of-order replies. ++ * The ooo array contains start/end pairs of ++ * numbers from the changeid sequence when ++ * the inode's iversion has been updated. ++ * It also contains end/start pair (i.e. reverse order) ++ * of sections of the changeid sequence that have ++ * been seen in replies from the server. ++ * Normally these should match and when both ++ * A:B and B:A are found in ooo, they are both removed. ++ * And if a reply with A:B causes an iversion update ++ * of A:B, then neither are added. ++ * When a reply has pre_change that doesn't match ++ * iversion, then the changeid pair and any consequent ++ * change in iversion ARE added. Later replies ++ * might fill in the gaps, or possibly a gap is caused ++ * by a change from another client. ++ * When a file or directory is opened, if the ooo table ++ * is not empty, then we assume the gaps were due to ++ * another client and we invalidate the cached data. ++ * ++ * We can only track a limited number of concurrent gaps. ++ * Currently that limit is 16. ++ * We allocate the table on demand. If there is insufficient ++ * memory, then we probably cannot cache the file anyway ++ * so there is no loss. ++ */ ++ struct { ++ int cnt; ++ struct { ++ u64 start, end; ++ } gap[16]; ++ } *ooo; ++ + #if IS_ENABLED(CONFIG_NFS_V4) + struct nfs4_cached_acl *nfs4_acl; + /* NFSv4 state */ +@@ -603,6 +636,20 @@ nfs_fileid_to_ino_t(u64 fileid) + return ino; + } + ++static inline void nfs_ooo_clear(struct nfs_inode *nfsi) ++{ ++ nfsi->cache_validity &= ~NFS_INO_INVALID_DATA; ++ kfree(nfsi->ooo); ++ nfsi->ooo = NULL; ++} ++ ++static inline bool nfs_ooo_test(struct nfs_inode *nfsi) ++{ ++ return (nfsi->cache_validity & NFS_INO_DATA_INVAL_DEFER) || ++ (nfsi->ooo && nfsi->ooo->cnt > 0); ++ ++} ++ + #define NFS_JUKEBOX_RETRY_TIME (5 * HZ) + + diff --git a/patches.suse/NFSv4-Protect-the-state-recovery-thread-against-dire.patch b/patches.suse/NFSv4-Protect-the-state-recovery-thread-against-dire.patch new file mode 100644 index 0000000..8ed7263 --- /dev/null +++ b/patches.suse/NFSv4-Protect-the-state-recovery-thread-against-dire.patch @@ -0,0 +1,71 @@ +From: Trond Myklebust +Date: Sat, 29 Jan 2022 13:32:45 -0500 +Subject: [PATCH] NFSv4: Protect the state recovery thread against direct + reclaim +Git-commit: 3e17898aca293a24dae757a440a50aa63ca29671 +Patch-mainline: v5.18 +References: git-fixes + +If memory allocation triggers a direct reclaim from the state recovery +thread, then we can deadlock. Use memalloc_nofs_save/restore to ensure +that doesn't happen. + +Signed-off-by: Trond Myklebust +Acked-by: NeilBrown + +--- + fs/nfs/nfs4state.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -49,6 +49,7 @@ + #include + #include + #include ++#include + + #include + +@@ -2576,9 +2577,17 @@ static void nfs4_layoutreturn_any_run(st + + static void nfs4_state_manager(struct nfs_client *clp) + { ++ unsigned int memflags; + int status = 0; + const char *section = "", *section_sep = ""; + ++ /* ++ * State recovery can deadlock if the direct reclaim code tries ++ * start NFS writeback. So ensure memory allocations are all ++ * GFP_NOFS. ++ */ ++ memflags = memalloc_nofs_save(); ++ + /* Ensure exclusive access to NFSv4 state */ + do { + trace_nfs4_state_mgr(clp); +@@ -2673,6 +2682,7 @@ static void nfs4_state_manager(struct nf + clear_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state); + } + ++ memalloc_nofs_restore(memflags); + nfs4_end_drain_session(clp); + nfs4_clear_state_manager_bit(clp); + +@@ -2690,6 +2700,7 @@ static void nfs4_state_manager(struct nf + return; + if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0) + return; ++ memflags = memalloc_nofs_save(); + } while (refcount_read(&clp->cl_count) > 1 && !signalled()); + goto out_drain; + +@@ -2702,6 +2713,7 @@ out_error: + clp->cl_hostname, -status); + ssleep(1); + out_drain: ++ memalloc_nofs_restore(memflags); + nfs4_end_drain_session(clp); + nfs4_clear_state_manager_bit(clp); + } diff --git a/patches.suse/NFSv4-expose-nfs_parse_server_name-function.patch b/patches.suse/NFSv4-expose-nfs_parse_server_name-function.patch new file mode 100644 index 0000000..1f794f2 --- /dev/null +++ b/patches.suse/NFSv4-expose-nfs_parse_server_name-function.patch @@ -0,0 +1,43 @@ +From: Olga Kornievskaia +Date: Thu, 9 Dec 2021 14:53:32 -0500 +Subject: [PATCH] NFSv4 expose nfs_parse_server_name function +Git-commit: f5b27cc6761e27ee6387a24df1a99ca77b360fea +Patch-mainline: v5.17 +References: git-fixes + +Make nfs_parse_server_name available outside of nfs4namespace.c. + +Signed-off-by: Olga Kornievskaia +Signed-off-by: Anna Schumaker +Acked-by: NeilBrown + +--- + fs/nfs/nfs4_fs.h | 3 ++- + fs/nfs/nfs4namespace.c | 4 ++-- + 2 files changed, 4 insertions(+), 3 deletions(-) + +--- a/fs/nfs/nfs4_fs.h ++++ b/fs/nfs/nfs4_fs.h +@@ -281,7 +281,8 @@ struct rpc_clnt *nfs4_negotiate_security + int nfs4_submount(struct fs_context *, struct nfs_server *); + int nfs4_replace_transport(struct nfs_server *server, + const struct nfs4_fs_locations *locations); +- ++size_t nfs_parse_server_name(char *string, size_t len, struct sockaddr *sa, ++ size_t salen, struct net *net); + /* nfs4proc.c */ + extern int nfs4_handle_exception(struct nfs_server *, int, struct nfs4_exception *); + extern int nfs4_async_handle_error(struct rpc_task *task, +--- a/fs/nfs/nfs4namespace.c ++++ b/fs/nfs/nfs4namespace.c +@@ -164,8 +164,8 @@ static int nfs4_validate_fspath(struct d + return 0; + } + +-static size_t nfs_parse_server_name(char *string, size_t len, +- struct sockaddr *sa, size_t salen, struct net *net) ++size_t nfs_parse_server_name(char *string, size_t len, struct sockaddr *sa, ++ size_t salen, struct net *net) + { + ssize_t ret; + diff --git a/patches.suse/NFSv4-handle-port-presence-in-fs_location-server-str.patch b/patches.suse/NFSv4-handle-port-presence-in-fs_location-server-str.patch new file mode 100644 index 0000000..263e8fd --- /dev/null +++ b/patches.suse/NFSv4-handle-port-presence-in-fs_location-server-str.patch @@ -0,0 +1,78 @@ +From: Olga Kornievskaia +Date: Thu, 9 Dec 2021 14:53:33 -0500 +Subject: [PATCH] NFSv4 handle port presence in fs_location server string +Git-commit: a8d54baba7c65db2d3278873def61f8d3753d766 +Patch-mainline: v5.17 +References: git-fixes + +An fs_location attribute returns a string that can be ipv4, ipv6, +or DNS name. An ip location can have a port appended to it and if +no port is present a default port needs to be set. If rpc_pton() +fails to parse, try calling rpc_uaddr2socaddr() that can convert +an universal address. + +Signed-off-by: Olga Kornievskaia +Signed-off-by: Anna Schumaker +Acked-by: NeilBrown + +--- + fs/nfs/nfs4_fs.h | 2 +- + fs/nfs/nfs4namespace.c | 17 +++++++++++------ + 2 files changed, 12 insertions(+), 7 deletions(-) + +--- a/fs/nfs/nfs4_fs.h ++++ b/fs/nfs/nfs4_fs.h +@@ -282,7 +282,7 @@ int nfs4_submount(struct fs_context *, s + int nfs4_replace_transport(struct nfs_server *server, + const struct nfs4_fs_locations *locations); + size_t nfs_parse_server_name(char *string, size_t len, struct sockaddr *sa, +- size_t salen, struct net *net); ++ size_t salen, struct net *net, int port); + /* nfs4proc.c */ + extern int nfs4_handle_exception(struct nfs_server *, int, struct nfs4_exception *); + extern int nfs4_async_handle_error(struct rpc_task *task, +--- a/fs/nfs/nfs4namespace.c ++++ b/fs/nfs/nfs4namespace.c +@@ -165,15 +165,20 @@ static int nfs4_validate_fspath(struct d + } + + size_t nfs_parse_server_name(char *string, size_t len, struct sockaddr *sa, +- size_t salen, struct net *net) ++ size_t salen, struct net *net, int port) + { + ssize_t ret; + + ret = rpc_pton(net, string, len, sa, salen); + if (ret == 0) { +- ret = nfs_dns_resolve_name(net, string, len, sa, salen); +- if (ret < 0) +- ret = 0; ++ ret = rpc_uaddr2sockaddr(net, string, len, sa, salen); ++ if (ret == 0) { ++ ret = nfs_dns_resolve_name(net, string, len, sa, salen); ++ if (ret < 0) ++ ret = 0; ++ } ++ } else if (port) { ++ rpc_set_port(sa, port); + } + return ret; + } +@@ -328,7 +333,7 @@ static int try_location(struct fs_contex + nfs_parse_server_name(buf->data, buf->len, + &ctx->nfs_server.address, + sizeof(ctx->nfs_server._address), +- fc->net_ns); ++ fc->net_ns, 0); + if (ctx->nfs_server.addrlen == 0) + continue; + +@@ -496,7 +501,7 @@ static int nfs4_try_replacing_one_locati + continue; + + salen = nfs_parse_server_name(buf->data, buf->len, +- sap, addr_bufsize, net); ++ sap, addr_bufsize, net, 0); + if (salen == 0) + continue; + rpc_set_port(sap, NFS_PORT); diff --git a/patches.suse/NFSv4-only-print-the-label-when-its-queried.patch b/patches.suse/NFSv4-only-print-the-label-when-its-queried.patch new file mode 100644 index 0000000..8444a03 --- /dev/null +++ b/patches.suse/NFSv4-only-print-the-label-when-its-queried.patch @@ -0,0 +1,36 @@ +From: Olga Kornievskaia +Date: Mon, 29 Nov 2021 15:33:56 -0500 +Subject: [PATCH] NFSv4 only print the label when its queried +Git-commit: 2c52c8376db7160a1dd8a681c61c9258405ef143 +Patch-mainline: v5.17 +References: git-fixes + +When the bitmask of the attributes doesn't include the security label, +don't bother printing it. Since the label might not be null terminated, +adjust the printing format accordingly. + +Signed-off-by: Olga Kornievskaia +Signed-off-by: Anna Schumaker +Acked-by: NeilBrown + +--- + fs/nfs/nfs4xdr.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/fs/nfs/nfs4xdr.c ++++ b/fs/nfs/nfs4xdr.c +@@ -4200,10 +4200,11 @@ static int decode_attr_security_label(st + } else + printk(KERN_WARNING "%s: label too long (%u)!\n", + __func__, len); ++ if (label && label->label) ++ dprintk("%s: label=%.*s, len=%d, PI=%d, LFS=%d\n", ++ __func__, label->len, (char *)label->label, ++ label->len, label->pi, label->lfs); + } +- if (label && label->label) +- dprintk("%s: label=%s, len=%d, PI=%d, LFS=%d\n", __func__, +- (char *)label->label, label->len, label->pi, label->lfs); + return status; + } + diff --git a/patches.suse/NFSv4-pNFS-Fix-another-issue-with-a-list-iterator-po.patch b/patches.suse/NFSv4-pNFS-Fix-another-issue-with-a-list-iterator-po.patch index 9d2c710..0abced3 100644 --- a/patches.suse/NFSv4-pNFS-Fix-another-issue-with-a-list-iterator-po.patch +++ b/patches.suse/NFSv4-pNFS-Fix-another-issue-with-a-list-iterator-po.patch @@ -36,7 +36,7 @@ Acked-by: NeilBrown { struct cb_devicenotifyargs *args = argp; + const struct pnfs_layoutdriver_type *ld = NULL; - int i; + uint32_t i; __be32 res = 0; - struct nfs_client *clp = cps->clp; - struct nfs_server *server = NULL; diff --git a/patches.suse/NFSv4-remove-zero-number-of-fs_locations-entries-err.patch b/patches.suse/NFSv4-remove-zero-number-of-fs_locations-entries-err.patch new file mode 100644 index 0000000..6593495 --- /dev/null +++ b/patches.suse/NFSv4-remove-zero-number-of-fs_locations-entries-err.patch @@ -0,0 +1,42 @@ +From: Olga Kornievskaia +Date: Thu, 9 Dec 2021 14:53:29 -0500 +Subject: [PATCH] NFSv4 remove zero number of fs_locations entries error check +Git-commit: 90e12a3191040bd3854d3e236c35921e4e92a044 +Patch-mainline: v5.17 +References: git-fixes + +Remove the check for the zero length fs_locations reply in the +xdr decoding, and instead check for that in the migration code. + +Signed-off-by: Olga Kornievskaia +Signed-off-by: Anna Schumaker +Acked-by: NeilBrown + +--- + fs/nfs/nfs4state.c | 3 +++ + fs/nfs/nfs4xdr.c | 2 -- + 2 files changed, 3 insertions(+), 2 deletions(-) + +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -2122,6 +2122,9 @@ static int nfs4_try_migration(struct nfs + } + + result = -NFS4ERR_NXIO; ++ if (!locations->nlocations) ++ goto out; ++ + if (!(locations->fattr.valid & NFS_ATTR_FATTR_V4_LOCATIONS)) { + dprintk("<-- %s: No fs_locations data, migration skipped\n", + __func__); +--- a/fs/nfs/nfs4xdr.c ++++ b/fs/nfs/nfs4xdr.c +@@ -3696,8 +3696,6 @@ static int decode_attr_fs_locations(stru + if (unlikely(!p)) + goto out_eio; + n = be32_to_cpup(p); +- if (n <= 0) +- goto out_eio; + for (res->nlocations = 0; res->nlocations < n; res->nlocations++) { + u32 m; + struct nfs4_fs_location *loc; diff --git a/patches.suse/NFSv4-store-server-support-for-fs_location-attribute.patch b/patches.suse/NFSv4-store-server-support-for-fs_location-attribute.patch new file mode 100644 index 0000000..71f9420 --- /dev/null +++ b/patches.suse/NFSv4-store-server-support-for-fs_location-attribute.patch @@ -0,0 +1,39 @@ +From: Olga Kornievskaia +Date: Thu, 9 Dec 2021 14:53:30 -0500 +Subject: [PATCH] NFSv4 store server support for fs_location attribute +Git-commit: 8a59bb93b7e3cca389af44781a429ac12ac49be6 +Patch-mainline: v5.17 +References: git-fixes + +Define and store if server returns it supports fs_locations attribute +as a capability. + +Signed-off-by: Olga Kornievskaia +Signed-off-by: Anna Schumaker +Acked-by: NeilBrown + +--- + fs/nfs/nfs4proc.c | 2 ++ + include/linux/nfs_fs_sb.h | 2 +- + 2 files changed, 3 insertions(+), 1 deletion(-) + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -3893,6 +3893,8 @@ static int _nfs4_server_capabilities(str + if (res.attr_bitmask[2] & FATTR4_WORD2_SECURITY_LABEL) + server->caps |= NFS_CAP_SECURITY_LABEL; + #endif ++ if (res.attr_bitmask[0] & FATTR4_WORD0_FS_LOCATIONS) ++ server->caps |= NFS_CAP_FS_LOCATIONS; + if (!(res.attr_bitmask[0] & FATTR4_WORD0_FILEID)) + server->fattr_valid &= ~NFS_ATTR_FATTR_FILEID; + if (!(res.attr_bitmask[1] & FATTR4_WORD1_MODE)) +--- a/include/linux/nfs_fs_sb.h ++++ b/include/linux/nfs_fs_sb.h +@@ -286,5 +286,5 @@ struct nfs_server { + #define NFS_CAP_COPY_NOTIFY (1U << 27) + #define NFS_CAP_XATTR (1U << 28) + #define NFS_CAP_READ_PLUS (1U << 29) +- ++#define NFS_CAP_FS_LOCATIONS (1U << 30) + #endif diff --git a/patches.suse/NFSv4.1-Fix-uninitialised-variable-in-devicenotify.patch b/patches.suse/NFSv4.1-Fix-uninitialised-variable-in-devicenotify.patch new file mode 100644 index 0000000..1dafa73 --- /dev/null +++ b/patches.suse/NFSv4.1-Fix-uninitialised-variable-in-devicenotify.patch @@ -0,0 +1,96 @@ +From: Trond Myklebust +Date: Mon, 3 Jan 2022 14:50:16 -0500 +Subject: [PATCH] NFSv4.1: Fix uninitialised variable in devicenotify +Git-commit: b05bf5c63b326ce1da84ef42498d8e0e292e694c +Patch-mainline: v5.17 +References: git-fixes + +When decode_devicenotify_args() exits with no entries, we need to +ensure that the struct cb_devicenotifyargs is initialised to +{ 0, NULL } in order to avoid problems in +nfs4_callback_devicenotify(). + +Reported-by: +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Acked-by: NeilBrown + +--- + fs/nfs/callback.h | 2 +- + fs/nfs/callback_proc.c | 2 +- + fs/nfs/callback_xdr.c | 18 +++++++++--------- + 3 files changed, 11 insertions(+), 11 deletions(-) + +--- a/fs/nfs/callback.h ++++ b/fs/nfs/callback.h +@@ -170,7 +170,7 @@ struct cb_devicenotifyitem { + }; + + struct cb_devicenotifyargs { +- int ndevs; ++ uint32_t ndevs; + struct cb_devicenotifyitem *devs; + }; + +--- a/fs/nfs/callback_proc.c ++++ b/fs/nfs/callback_proc.c +@@ -358,7 +358,7 @@ __be32 nfs4_callback_devicenotify(void * + struct cb_process_state *cps) + { + struct cb_devicenotifyargs *args = argp; +- int i; ++ uint32_t i; + __be32 res = 0; + struct nfs_client *clp = cps->clp; + struct nfs_server *server = NULL; +--- a/fs/nfs/callback_xdr.c ++++ b/fs/nfs/callback_xdr.c +@@ -259,11 +259,9 @@ __be32 decode_devicenotify_args(struct s + void *argp) + { + struct cb_devicenotifyargs *args = argp; ++ uint32_t tmp, n, i; + __be32 *p; + __be32 status = 0; +- u32 tmp; +- int n, i; +- args->ndevs = 0; + + /* Num of device notifications */ + p = xdr_inline_decode(xdr, sizeof(uint32_t)); +@@ -272,7 +270,7 @@ __be32 decode_devicenotify_args(struct s + goto out; + } + n = ntohl(*p++); +- if (n <= 0) ++ if (n == 0) + goto out; + if (n > ULONG_MAX / sizeof(*args->devs)) { + status = htonl(NFS4ERR_BADXDR); +@@ -331,19 +329,21 @@ __be32 decode_devicenotify_args(struct s + dev->cbd_immediate = 0; + } + +- args->ndevs++; +- + dprintk("%s: type %d layout 0x%x immediate %d\n", + __func__, dev->cbd_notify_type, dev->cbd_layout_type, + dev->cbd_immediate); + } ++ args->ndevs = n; ++ dprintk("%s: ndevs %d\n", __func__, args->ndevs); ++ return 0; ++err: ++ kfree(args->devs); + out: ++ args->devs = NULL; ++ args->ndevs = 0; + dprintk("%s: status %d ndevs %d\n", + __func__, ntohl(status), args->ndevs); + return status; +-err: +- kfree(args->devs); +- goto out; + } + + static __be32 decode_sessionid(struct xdr_stream *xdr, diff --git a/patches.suse/NFSv4.1-mark-qualified-async-operations-as-MOVEABLE-.patch b/patches.suse/NFSv4.1-mark-qualified-async-operations-as-MOVEABLE-.patch index fc5058b..e212a4d 100644 --- a/patches.suse/NFSv4.1-mark-qualified-async-operations-as-MOVEABLE-.patch +++ b/patches.suse/NFSv4.1-mark-qualified-async-operations-as-MOVEABLE-.patch @@ -41,7 +41,7 @@ Acked-by: NeilBrown task_setup_data.flags |= RPC_TASK_MOVEABLE; kref_get(&data->kref); -@@ -3761,7 +3761,7 @@ int nfs4_do_close(struct nfs4_state *sta +@@ -3760,7 +3760,7 @@ int nfs4_do_close(struct nfs4_state *sta }; int status = -ENOMEM; @@ -50,7 +50,7 @@ Acked-by: NeilBrown task_setup_data.flags |= RPC_TASK_MOVEABLE; nfs4_state_protect(server->nfs_client, NFS_SP4_MACH_CRED_CLEANUP, -@@ -4325,7 +4325,7 @@ static int _nfs4_proc_lookup(struct rpc_ +@@ -4326,7 +4326,7 @@ static int _nfs4_proc_lookup(struct rpc_ }; unsigned short task_flags = 0; @@ -59,7 +59,7 @@ Acked-by: NeilBrown task_flags = RPC_TASK_MOVEABLE; /* Is this is an attribute revalidation, subject to softreval? */ -@@ -6563,10 +6563,13 @@ static int _nfs4_proc_delegreturn(struct +@@ -6564,10 +6564,13 @@ static int _nfs4_proc_delegreturn(struct .rpc_client = server->client, .rpc_message = &msg, .callback_ops = &nfs4_delegreturn_ops, @@ -74,7 +74,7 @@ Acked-by: NeilBrown data = kzalloc(sizeof(*data), GFP_NOFS); if (data == NULL) return -ENOMEM; -@@ -6881,10 +6884,8 @@ static struct rpc_task *nfs4_do_unlck(st +@@ -6882,10 +6885,8 @@ static struct rpc_task *nfs4_do_unlck(st .workqueue = nfsiod_workqueue, .flags = RPC_TASK_ASYNC, }; @@ -86,7 +86,7 @@ Acked-by: NeilBrown task_setup_data.flags |= RPC_TASK_MOVEABLE; nfs4_state_protect(NFS_SERVER(lsp->ls_state->inode)->nfs_client, -@@ -7160,9 +7161,8 @@ static int _nfs4_do_setlk(struct nfs4_st +@@ -7161,9 +7162,8 @@ static int _nfs4_do_setlk(struct nfs4_st .flags = RPC_TASK_ASYNC | RPC_TASK_CRED_NOREF, }; int ret; @@ -97,7 +97,7 @@ Acked-by: NeilBrown task_setup_data.flags |= RPC_TASK_MOVEABLE; dprintk("%s: begin!\n", __func__); -@@ -10360,7 +10360,8 @@ static const struct nfs4_minor_version_o +@@ -10361,7 +10361,8 @@ static const struct nfs4_minor_version_o | NFS_CAP_POSIX_LOCK | NFS_CAP_STATEID_NFSV41 | NFS_CAP_ATOMIC_OPEN_V1 @@ -107,7 +107,7 @@ Acked-by: NeilBrown .init_client = nfs41_init_client, .shutdown_client = nfs41_shutdown_client, .match_stateid = nfs41_match_stateid, -@@ -10395,7 +10396,8 @@ static const struct nfs4_minor_version_o +@@ -10396,7 +10397,8 @@ static const struct nfs4_minor_version_o | NFS_CAP_LAYOUTSTATS | NFS_CAP_CLONE | NFS_CAP_LAYOUTERROR @@ -171,6 +171,6 @@ Acked-by: NeilBrown @@ -287,4 +287,5 @@ struct nfs_server { #define NFS_CAP_XATTR (1U << 28) #define NFS_CAP_READ_PLUS (1U << 29) - + #define NFS_CAP_FS_LOCATIONS (1U << 30) +#define NFS_CAP_MOVEABLE (1U << 31) #endif diff --git a/patches.suse/NFSv4.1-query-for-fs_location-attr-on-a-new-file-sys.patch b/patches.suse/NFSv4.1-query-for-fs_location-attr-on-a-new-file-sys.patch new file mode 100644 index 0000000..b9a233e --- /dev/null +++ b/patches.suse/NFSv4.1-query-for-fs_location-attr-on-a-new-file-sys.patch @@ -0,0 +1,231 @@ +From: Olga Kornievskaia +Date: Wed, 12 Jan 2022 10:27:38 -0500 +Subject: [PATCH] NFSv4.1 query for fs_location attr on a new file system +Git-commit: 1976b2b31462151403c9fc110204fcc2a77bdfd1 +Patch-mainline: v5.17 +References: git-fixes + +Query the server for other possible trunkable locations for a given +file system on a 4.1+ mount. + +V2: +-- added missing static to nfs4_discover_trunking, +reported by the kernel test robot + +Signed-off-by: Olga Kornievskaia +Signed-off-by: Anna Schumaker +Acked-by: NeilBrown + +--- + fs/nfs/client.c | 7 ++++ + fs/nfs/nfs4_fs.h | 9 +++-- + fs/nfs/nfs4proc.c | 76 +++++++++++++++++++++++++++++++++++++++++------- + fs/nfs/nfs4state.c | 3 + + include/linux/nfs_xdr.h | 1 + 5 files changed, 81 insertions(+), 15 deletions(-) + +--- a/fs/nfs/client.c ++++ b/fs/nfs/client.c +@@ -858,6 +858,13 @@ int nfs_probe_fsinfo(struct nfs_server * + server->namelen = pathinfo.max_namelen; + } + ++ if (clp->rpc_ops->discover_trunking != NULL && ++ (server->caps & NFS_CAP_FS_LOCATIONS)) { ++ error = clp->rpc_ops->discover_trunking(server, mntfh); ++ if (error < 0) ++ return error; ++ } ++ + return 0; + } + EXPORT_SYMBOL_GPL(nfs_probe_fsinfo); +--- a/fs/nfs/nfs4_fs.h ++++ b/fs/nfs/nfs4_fs.h +@@ -261,8 +261,8 @@ struct nfs4_state_maintenance_ops { + }; + + struct nfs4_mig_recovery_ops { +- int (*get_locations)(struct inode *, struct nfs4_fs_locations *, +- struct page *, const struct cred *); ++ int (*get_locations)(struct nfs_server *, struct nfs_fh *, ++ struct nfs4_fs_locations *, struct page *, const struct cred *); + int (*fsid_present)(struct inode *, const struct cred *); + }; + +@@ -303,8 +303,9 @@ extern int nfs4_do_close(struct nfs4_sta + extern int nfs4_server_capabilities(struct nfs_server *server, struct nfs_fh *fhandle); + extern int nfs4_proc_fs_locations(struct rpc_clnt *, struct inode *, const struct qstr *, + struct nfs4_fs_locations *, struct page *); +-extern int nfs4_proc_get_locations(struct inode *, struct nfs4_fs_locations *, +- struct page *page, const struct cred *); ++extern int nfs4_proc_get_locations(struct nfs_server *, struct nfs_fh *, ++ struct nfs4_fs_locations *, ++ struct page *page, const struct cred *); + extern int nfs4_proc_fsid_present(struct inode *, const struct cred *); + extern struct rpc_clnt *nfs4_proc_lookup_mountpoint(struct inode *, + struct dentry *, +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -3967,6 +3967,60 @@ int nfs4_server_capabilities(struct nfs_ + return err; + } + ++static int _nfs4_discover_trunking(struct nfs_server *server, ++ struct nfs_fh *fhandle) ++{ ++ struct nfs4_fs_locations *locations = NULL; ++ struct page *page; ++ const struct cred *cred; ++ struct nfs_client *clp = server->nfs_client; ++ const struct nfs4_state_maintenance_ops *ops = ++ clp->cl_mvops->state_renewal_ops; ++ int status = -ENOMEM; ++ ++ cred = ops->get_state_renewal_cred(clp); ++ if (cred == NULL) { ++ cred = nfs4_get_clid_cred(clp); ++ if (cred == NULL) ++ return -ENOKEY; ++ } ++ ++ page = alloc_page(GFP_KERNEL); ++ locations = kmalloc(sizeof(struct nfs4_fs_locations), GFP_KERNEL); ++ if (page == NULL || locations == NULL) ++ goto out; ++ ++ status = nfs4_proc_get_locations(server, fhandle, locations, page, ++ cred); ++ if (status) ++ goto out; ++out: ++ if (page) ++ __free_page(page); ++ kfree(locations); ++ return status; ++} ++ ++static int nfs4_discover_trunking(struct nfs_server *server, ++ struct nfs_fh *fhandle) ++{ ++ struct nfs4_exception exception = { ++ .interruptible = true, ++ }; ++ struct nfs_client *clp = server->nfs_client; ++ int err = 0; ++ ++ if (!nfs4_has_session(clp)) ++ goto out; ++ do { ++ err = nfs4_handle_exception(server, ++ _nfs4_discover_trunking(server, fhandle), ++ &exception); ++ } while (exception.retry); ++out: ++ return err; ++} ++ + static int _nfs4_lookup_root(struct nfs_server *server, struct nfs_fh *fhandle, + struct nfs_fsinfo *info) + { +@@ -7905,18 +7959,18 @@ int nfs4_proc_fs_locations(struct rpc_cl + * appended to this compound to identify the client ID which is + * performing recovery. + */ +-static int _nfs40_proc_get_locations(struct inode *inode, ++static int _nfs40_proc_get_locations(struct nfs_server *server, ++ struct nfs_fh *fhandle, + struct nfs4_fs_locations *locations, + struct page *page, const struct cred *cred) + { +- struct nfs_server *server = NFS_SERVER(inode); + struct rpc_clnt *clnt = server->client; + u32 bitmask[2] = { + [0] = FATTR4_WORD0_FSID | FATTR4_WORD0_FS_LOCATIONS, + }; + struct nfs4_fs_locations_arg args = { + .clientid = server->nfs_client->cl_clientid, +- .fh = NFS_FH(inode), ++ .fh = fhandle, + .page = page, + .bitmask = bitmask, + .migration = 1, /* skip LOOKUP */ +@@ -7962,17 +8016,17 @@ static int _nfs40_proc_get_locations(str + * When the client supports GETATTR(fs_locations_info), it can + * be plumbed in here. + */ +-static int _nfs41_proc_get_locations(struct inode *inode, ++static int _nfs41_proc_get_locations(struct nfs_server *server, ++ struct nfs_fh *fhandle, + struct nfs4_fs_locations *locations, + struct page *page, const struct cred *cred) + { +- struct nfs_server *server = NFS_SERVER(inode); + struct rpc_clnt *clnt = server->client; + u32 bitmask[2] = { + [0] = FATTR4_WORD0_FSID | FATTR4_WORD0_FS_LOCATIONS, + }; + struct nfs4_fs_locations_arg args = { +- .fh = NFS_FH(inode), ++ .fh = fhandle, + .page = page, + .bitmask = bitmask, + .migration = 1, /* skip LOOKUP */ +@@ -8021,11 +8075,11 @@ static int _nfs41_proc_get_locations(str + * -NFS4ERR_LEASE_MOVED is returned if the server still has leases + * from this client that require migration recovery. + */ +-int nfs4_proc_get_locations(struct inode *inode, ++int nfs4_proc_get_locations(struct nfs_server *server, ++ struct nfs_fh *fhandle, + struct nfs4_fs_locations *locations, + struct page *page, const struct cred *cred) + { +- struct nfs_server *server = NFS_SERVER(inode); + struct nfs_client *clp = server->nfs_client; + const struct nfs4_mig_recovery_ops *ops = + clp->cl_mvops->mig_recovery_ops; +@@ -8038,10 +8092,11 @@ int nfs4_proc_get_locations(struct inode + (unsigned long long)server->fsid.major, + (unsigned long long)server->fsid.minor, + clp->cl_hostname); +- nfs_display_fhandle(NFS_FH(inode), __func__); ++ nfs_display_fhandle(fhandle, __func__); + + do { +- status = ops->get_locations(inode, locations, page, cred); ++ status = ops->get_locations(server, fhandle, locations, page, ++ cred); + if (status != -NFS4ERR_DELAY) + break; + nfs4_handle_exception(server, status, &exception); +@@ -10541,6 +10596,7 @@ const struct nfs_rpc_ops nfs_v4_clientop + .free_client = nfs4_free_client, + .create_server = nfs4_create_server, + .clone_server = nfs_clone_server, ++ .discover_trunking = nfs4_discover_trunking, + }; + + static const struct xattr_handler nfs4_xattr_nfs4_acl_handler = { +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -2114,7 +2114,8 @@ static int nfs4_try_migration(struct nfs + } + + inode = d_inode(server->super->s_root); +- result = nfs4_proc_get_locations(inode, locations, page, cred); ++ result = nfs4_proc_get_locations(server, NFS_FH(inode), locations, ++ page, cred); + if (result) { + dprintk("<-- %s: failed to retrieve fs_locations: %d\n", + __func__, result); +--- a/include/linux/nfs_xdr.h ++++ b/include/linux/nfs_xdr.h +@@ -1805,6 +1805,7 @@ struct nfs_rpc_ops { + struct nfs_server *(*create_server)(struct fs_context *); + struct nfs_server *(*clone_server)(struct nfs_server *, struct nfs_fh *, + struct nfs_fattr *, rpc_authflavor_t); ++ int (*discover_trunking)(struct nfs_server *, struct nfs_fh *); + }; + + /* diff --git a/patches.suse/NFSv4.2-fix-problems-with-__nfs42_ssc_open.patch b/patches.suse/NFSv4.2-fix-problems-with-__nfs42_ssc_open.patch index 24ad4b9..330b99f 100644 --- a/patches.suse/NFSv4.2-fix-problems-with-__nfs42_ssc_open.patch +++ b/patches.suse/NFSv4.2-fix-problems-with-__nfs42_ssc_open.patch @@ -23,11 +23,11 @@ Acked-by: NeilBrown --- a/fs/nfs/nfs4file.c +++ b/fs/nfs/nfs4file.c -@@ -340,6 +340,11 @@ static struct file *__nfs42_ssc_open(str +@@ -341,6 +341,11 @@ static struct file *__nfs42_ssc_open(str goto out; } -+ if (!S_ISREG(fattr.mode)) { ++ if (!S_ISREG(fattr->mode)) { + res = ERR_PTR(-EBADF); + goto out; + } @@ -35,7 +35,7 @@ Acked-by: NeilBrown res = ERR_PTR(-ENOMEM); len = strlen(SSC_READ_NAME_BODY) + 16; read_name = kzalloc(len, GFP_NOFS); -@@ -358,6 +363,7 @@ static struct file *__nfs42_ssc_open(str +@@ -359,6 +364,7 @@ static struct file *__nfs42_ssc_open(str r_ino->i_fop); if (IS_ERR(filep)) { res = ERR_CAST(filep); diff --git a/patches.suse/NFSv4.2-fix-reference-count-leaks-in-_nfs42_proc_cop.patch b/patches.suse/NFSv4.2-fix-reference-count-leaks-in-_nfs42_proc_cop.patch new file mode 100644 index 0000000..044d38d --- /dev/null +++ b/patches.suse/NFSv4.2-fix-reference-count-leaks-in-_nfs42_proc_cop.patch @@ -0,0 +1,61 @@ +From: Xin Xiong +Date: Tue, 25 Jan 2022 21:10:45 +0800 +Subject: [PATCH] NFSv4.2: fix reference count leaks in + _nfs42_proc_copy_notify() +Git-commit: b7f114edd54326f730a754547e7cfb197b5bc132 +Patch-mainline: v5.18 +References: git-fixes + +[You don't often get email from xiongx18@fudan.edu.cn. Learn why this is important at http://aka.ms/LearnAboutSenderIdentification.] + +The reference counting issue happens in two error paths in the +function _nfs42_proc_copy_notify(). In both error paths, the function +simply returns the error code and forgets to balance the refcount of +object `ctx`, bumped by get_nfs_open_context() earlier, which may +cause refcount leaks. + +Fix it by balancing refcount of the `ctx` object before the function +returns in both error paths. + +Signed-off-by: Xin Xiong +Signed-off-by: Xiyu Yang +Signed-off-by: Xin Tan +Signed-off-by: Trond Myklebust +Acked-by: NeilBrown + +--- + fs/nfs/nfs42proc.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/fs/nfs/nfs42proc.c ++++ b/fs/nfs/nfs42proc.c +@@ -591,8 +591,10 @@ static int _nfs42_proc_copy_notify(struc + + ctx = get_nfs_open_context(nfs_file_open_context(src)); + l_ctx = nfs_get_lock_context(ctx); +- if (IS_ERR(l_ctx)) +- return PTR_ERR(l_ctx); ++ if (IS_ERR(l_ctx)) { ++ status = PTR_ERR(l_ctx); ++ goto out; ++ } + + status = nfs4_set_rw_stateid(&args->cna_src_stateid, ctx, l_ctx, + FMODE_READ); +@@ -600,7 +602,7 @@ static int _nfs42_proc_copy_notify(struc + if (status) { + if (status == -EAGAIN) + status = -NFS4ERR_BAD_STATEID; +- return status; ++ goto out; + } + + status = nfs4_call_sync(src_server->client, src_server, &msg, +@@ -608,6 +610,7 @@ static int _nfs42_proc_copy_notify(struc + if (status == -ENOTSUPP) + src_server->caps &= ~NFS_CAP_COPY_NOTIFY; + ++out: + put_nfs_open_context(nfs_file_open_context(src)); + return status; + } diff --git a/patches.suse/PCI-Fix-dropping-valid-root-bus-resources-with-.end-.patch b/patches.suse/PCI-Fix-dropping-valid-root-bus-resources-with-.end-.patch new file mode 100644 index 0000000..5c35526 --- /dev/null +++ b/patches.suse/PCI-Fix-dropping-valid-root-bus-resources-with-.end-.patch @@ -0,0 +1,74 @@ +From 9d8ba74a181b1c81def21168795ed96cbe6f05ed Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Fri, 10 Feb 2023 14:46:39 +0100 +Subject: [PATCH] PCI: Fix dropping valid root bus resources with .end = zero +Git-commit: 9d8ba74a181b1c81def21168795ed96cbe6f05ed +Patch-mainline: v6.3-rc1 +References: git-fixes + +On r8a7791/koelsch: + + kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak) + # cat /sys/kernel/debug/kmemleak + unreferenced object 0xc3a34e00 (size 64): + comm "swapper/0", pid 1, jiffies 4294937460 (age 199.080s) + hex dump (first 32 bytes): + b4 5d 81 f0 b4 5d 81 f0 c0 b0 a2 c3 00 00 00 00 .]...].......... + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [] __kmalloc+0xf0/0x140 + [<34bd6bc0>] resource_list_create_entry+0x18/0x38 + [<767046bc>] pci_add_resource_offset+0x20/0x68 + [] devm_of_pci_get_host_bridge_resources.constprop.0+0xb0/0x390 + +When coalescing two resources for a contiguous aperture, the second +resource is enlarged to cover the full contiguous range, while the first +resource is marked invalid. This invalidation is done by clearing the +flags, start, and end members. + +When adding the initial resources to the bus later, invalid resources are +skipped. Unfortunately, the check for an invalid resource considers only +the end member, causing false positives. + +E.g. on r8a7791/koelsch, root bus resource 0 ("bus 00") is skipped, and no +longer registered with pci_bus_insert_busn_res() (causing the memory leak), +nor printed: + + pci-rcar-gen2 ee090000.pci: host bridge /soc/pci@ee090000 ranges: + pci-rcar-gen2 ee090000.pci: MEM 0x00ee080000..0x00ee08ffff -> 0x00ee080000 + pci-rcar-gen2 ee090000.pci: PCI: revision 11 + pci-rcar-gen2 ee090000.pci: PCI host bridge to bus 0000:00 + -pci_bus 0000:00: root bus resource [bus 00] + pci_bus 0000:00: root bus resource [mem 0xee080000-0xee08ffff] + +Fix this by only skipping resources where all of the flags, start, and end +members are zero. + +Fixes: 7c3855c423b17f6c ("PCI: Coalesce host bridge contiguous apertures") +Link: https://lore.kernel.org/r/da0fcd5e86c74239be79c7cb03651c0fce31b515.1676036673.git.geert+renesas@glider.be +Tested-by: Niklas Schnelle +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Bjorn Helgaas +Acked-by: Kai-Heng Feng +Acked-by: Takashi Iwai + +--- + drivers/pci/probe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index 1779582fb500..598858482548 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -996,7 +996,7 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge) + resource_list_for_each_entry_safe(window, n, &resources) { + offset = window->offset; + res = window->res; +- if (!res->end) ++ if (!res->flags && !res->start && !res->end) + continue; + + list_move_tail(&window->node, &bridge->windows); +-- +2.35.3 + diff --git a/patches.suse/PCI-IOV-Enlarge-virtfn-sysfs-name-buffer.patch b/patches.suse/PCI-IOV-Enlarge-virtfn-sysfs-name-buffer.patch new file mode 100644 index 0000000..f53b0f4 --- /dev/null +++ b/patches.suse/PCI-IOV-Enlarge-virtfn-sysfs-name-buffer.patch @@ -0,0 +1,41 @@ +From ea0b5aa5f184cf8293c93163f0fb00505190d431 Mon Sep 17 00:00:00 2001 +From: "Alexey V. Vissarionov" +Date: Sun, 18 Dec 2022 06:33:47 +0300 +Subject: [PATCH] PCI/IOV: Enlarge virtfn sysfs name buffer +Git-commit: ea0b5aa5f184cf8293c93163f0fb00505190d431 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The sysfs link name "virtfn%u" constructed by pci_iov_sysfs_link() requires +17 bytes to contain the longest possible string. Increase VIRTFN_ID_LEN to +accommodate that. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +[bhelgaas: commit log, comment at #define] +Fixes: dd7cc44d0bce ("PCI: add SR-IOV API for Physical Function driver") +Link: https://lore.kernel.org/r/20221218033347.23743-1-gremlin@altlinux.org +Signed-off-by: Alexey V. Vissarionov +Signed-off-by: Bjorn Helgaas +Acked-by: Takashi Iwai + +--- + drivers/pci/iov.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c +index 952217572113..b2e8322755c1 100644 +--- a/drivers/pci/iov.c ++++ b/drivers/pci/iov.c +@@ -14,7 +14,7 @@ + #include + #include "pci.h" + +-#define VIRTFN_ID_LEN 16 ++#define VIRTFN_ID_LEN 17 /* "virtfn%u\0" for 2^32 - 1 */ + + int pci_iov_virtfn_bus(struct pci_dev *dev, int vf_id) + { +-- +2.35.3 + diff --git a/patches.suse/PCI-PM-Observe-reset-delay-irrespective-of-bridge_d3.patch b/patches.suse/PCI-PM-Observe-reset-delay-irrespective-of-bridge_d3.patch new file mode 100644 index 0000000..3416f7b --- /dev/null +++ b/patches.suse/PCI-PM-Observe-reset-delay-irrespective-of-bridge_d3.patch @@ -0,0 +1,62 @@ +From 8ef0217227b42e2c34a18de316cee3da16c9bf1e Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Sun, 15 Jan 2023 09:20:31 +0100 +Subject: [PATCH] PCI/PM: Observe reset delay irrespective of bridge_d3 +Git-commit: 8ef0217227b42e2c34a18de316cee3da16c9bf1e +Patch-mainline: v6.3-rc1 +References: git-fixes + +If a PCI bridge is suspended to D3cold upon entering system sleep, +resuming it entails a Fundamental Reset per PCIe r6.0 sec 5.8. + +The delay prescribed after a Fundamental Reset in PCIe r6.0 sec 6.6.1 +is sought to be observed by: + + pci_pm_resume_noirq() + pci_pm_bridge_power_up_actions() + pci_bridge_wait_for_secondary_bus() + +However, pci_bridge_wait_for_secondary_bus() bails out if the bridge_d3 +flag is not set. That flag indicates whether a bridge is allowed to +suspend to D3cold at *runtime*. + +Hence *no* delay is observed on resume from system sleep if runtime +D3cold is forbidden. That doesn't make any sense, so drop the bridge_d3 +check from pci_bridge_wait_for_secondary_bus(). + +The purpose of the bridge_d3 check was probably to avoid delays if a +bridge remained in D0 during suspend. However the sole caller of +pci_bridge_wait_for_secondary_bus(), pci_pm_bridge_power_up_actions(), +is only invoked if the previous power state was D3cold. Hence the +additional bridge_d3 check seems superfluous. + +Fixes: ad9001f2f411 ("PCI/PM: Add missing link delays required by the PCIe spec") +Link: https://lore.kernel.org/r/eb37fa345285ec8bacabbf06b020b803f77bdd3d.1673769517.git.lukas@wunner.de +Tested-by: Ravi Kishore Koppuravuri +Signed-off-by: Lukas Wunner +Signed-off-by: Bjorn Helgaas +Reviewed-by: Mika Westerberg +Reviewed-by: Kuppuswamy Sathyanarayanan +Cc: stable@vger.kernel.org # v5.5+ +Acked-by: Takashi Iwai + +--- + drivers/pci/pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index fba95486caaf..f43f3e84f634 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -4964,7 +4964,7 @@ void pci_bridge_wait_for_secondary_bus(struct pci_dev *dev) + if (pci_dev_is_disconnected(dev)) + return; + +- if (!pci_is_bridge(dev) || !dev->bridge_d3) ++ if (!pci_is_bridge(dev)) + return; + + down_read(&pci_bus_sem); +-- +2.35.3 + diff --git a/patches.suse/PCI-hotplug-Allow-marking-devices-as-disconnected-du.patch b/patches.suse/PCI-hotplug-Allow-marking-devices-as-disconnected-du.patch new file mode 100644 index 0000000..7924638 --- /dev/null +++ b/patches.suse/PCI-hotplug-Allow-marking-devices-as-disconnected-du.patch @@ -0,0 +1,141 @@ +From 74ff8864cc842be994853095dba6db48e716400a Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Fri, 20 Jan 2023 10:19:02 +0100 +Subject: [PATCH] PCI: hotplug: Allow marking devices as disconnected during bind/unbind +Git-commit: 74ff8864cc842be994853095dba6db48e716400a +Patch-mainline: v6.3-rc1 +References: git-fixes + +On surprise removal, pciehp_unconfigure_device() and acpiphp's +trim_stale_devices() call pci_dev_set_disconnected() to mark removed +devices as permanently offline. Thereby, the PCI core and drivers know +to skip device accesses. + +However pci_dev_set_disconnected() takes the device_lock and thus waits for +a concurrent driver bind or unbind to complete. As a result, the driver's +->probe and ->remove hooks have no chance to learn that the device is gone. + +That doesn't make any sense, so drop the device_lock and instead use atomic +xchg() and cmpxchg() operations to update the device state. + +As a byproduct, an AB-BA deadlock reported by Anatoli is fixed which occurs +on surprise removal with AER concurrently performing a bus reset. + +AER bus reset: + + INFO: task irq/26-aerdrv:95 blocked for more than 120 seconds. + Tainted: G W 6.2.0-rc3-custom-norework-jan11+ + schedule + rwsem_down_write_slowpath + down_write_nested + pciehp_reset_slot # acquires reset_lock + pci_reset_hotplug_slot + pci_slot_reset # acquires device_lock + pci_bus_error_reset + aer_root_reset + pcie_do_recovery + aer_process_err_devices + aer_isr + +pciehp surprise removal: + + INFO: task irq/26-pciehp:96 blocked for more than 120 seconds. + Tainted: G W 6.2.0-rc3-custom-norework-jan11+ + schedule_preempt_disabled + __mutex_lock + mutex_lock_nested + pci_dev_set_disconnected # acquires device_lock + pci_walk_bus + pciehp_unconfigure_device + pciehp_disable_slot + pciehp_handle_presence_or_link_change + pciehp_ist # acquires reset_lock + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215590 +Fixes: a6bd101b8f84 ("PCI: Unify device inaccessible") +Link: https://lore.kernel.org/r/3dc88ea82bdc0e37d9000e413d5ebce481cbd629.1674205689.git.lukas@wunner.de +Reported-by: Anatoli Antonovitch +Signed-off-by: Lukas Wunner +Signed-off-by: Bjorn Helgaas +Cc: stable@vger.kernel.org # v4.20+ +Cc: Keith Busch +Acked-by: Takashi Iwai + +--- + drivers/pci/pci.h | 43 +++++++++++++------------------------------ + 1 file changed, 13 insertions(+), 30 deletions(-) + +diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h +index 9ed3b5550043..5d5a44aaafe8 100644 +--- a/drivers/pci/pci.h ++++ b/drivers/pci/pci.h +@@ -310,53 +310,36 @@ struct pci_sriov { + * @dev: PCI device to set new error_state + * @new: the state we want dev to be in + * +- * Must be called with device_lock held. ++ * If the device is experiencing perm_failure, it has to remain in that state. ++ * Any other transition is allowed. + * + * Returns true if state has been changed to the requested state. + */ + static inline bool pci_dev_set_io_state(struct pci_dev *dev, + pci_channel_state_t new) + { +- bool changed = false; ++ pci_channel_state_t old; + +- device_lock_assert(&dev->dev); + switch (new) { + case pci_channel_io_perm_failure: +- switch (dev->error_state) { +- case pci_channel_io_frozen: +- case pci_channel_io_normal: +- case pci_channel_io_perm_failure: +- changed = true; +- break; +- } +- break; ++ xchg(&dev->error_state, pci_channel_io_perm_failure); ++ return true; + case pci_channel_io_frozen: +- switch (dev->error_state) { +- case pci_channel_io_frozen: +- case pci_channel_io_normal: +- changed = true; +- break; +- } +- break; ++ old = cmpxchg(&dev->error_state, pci_channel_io_normal, ++ pci_channel_io_frozen); ++ return old != pci_channel_io_perm_failure; + case pci_channel_io_normal: +- switch (dev->error_state) { +- case pci_channel_io_frozen: +- case pci_channel_io_normal: +- changed = true; +- break; +- } +- break; ++ old = cmpxchg(&dev->error_state, pci_channel_io_frozen, ++ pci_channel_io_normal); ++ return old != pci_channel_io_perm_failure; ++ default: ++ return false; + } +- if (changed) +- dev->error_state = new; +- return changed; + } + + static inline int pci_dev_set_disconnected(struct pci_dev *dev, void *unused) + { +- device_lock(&dev->dev); + pci_dev_set_io_state(dev, pci_channel_io_perm_failure); +- device_unlock(&dev->dev); + + return 0; + } +-- +2.35.3 + diff --git a/patches.suse/PCI-switchtec-Return-EFAULT-for-copy_to_user-errors.patch b/patches.suse/PCI-switchtec-Return-EFAULT-for-copy_to_user-errors.patch new file mode 100644 index 0000000..28216c7 --- /dev/null +++ b/patches.suse/PCI-switchtec-Return-EFAULT-for-copy_to_user-errors.patch @@ -0,0 +1,52 @@ +From ddc10938e08cd7aac63d8385f7305f7889df5179 Mon Sep 17 00:00:00 2001 +From: Bjorn Helgaas +Date: Fri, 16 Dec 2022 10:21:26 -0600 +Subject: [PATCH] PCI: switchtec: Return -EFAULT for copy_to_user() errors +Git-commit: ddc10938e08cd7aac63d8385f7305f7889df5179 +Patch-mainline: v6.3-rc1 +References: git-fixes + +switchtec_dev_read() didn't handle copy_to_user() errors correctly: it +assigned "rc = -EFAULT", but actually returned either "size", -ENXIO, or +-EBADMSG instead. + +Update the failure cases to unlock mrpc_mutex and return -EFAULT directly. + +Link: https://lore.kernel.org/r/20221216162126.207863-3-helgaas@kernel.org +Fixes: 080b47def5e5 ("MicroSemi Switchtec management interface driver") +Signed-off-by: Bjorn Helgaas +Reviewed-by: Logan Gunthorpe +Acked-by: Takashi Iwai + +--- + drivers/pci/switch/switchtec.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/drivers/pci/switch/switchtec.c ++++ b/drivers/pci/switch/switchtec.c +@@ -552,21 +552,20 @@ static ssize_t switchtec_dev_read(struct + rc = copy_to_user(data, &stuser->return_code, + sizeof(stuser->return_code)); + if (rc) { +- rc = -EFAULT; +- goto out; ++ mutex_unlock(&stdev->mrpc_mutex); ++ return -EFAULT; + } + + data += sizeof(stuser->return_code); + rc = copy_to_user(data, &stuser->data, + size - sizeof(stuser->return_code)); + if (rc) { +- rc = -EFAULT; +- goto out; ++ mutex_unlock(&stdev->mrpc_mutex); ++ return -EFAULT; + } + + stuser_set_state(stuser, MRPC_IDLE); + +-out: + mutex_unlock(&stdev->mrpc_mutex); + + if (stuser->status == SWITCHTEC_MRPC_STATUS_DONE) diff --git a/patches.suse/Revert-HID-logitech-hidpp-add-a-module-parameter-to-.patch b/patches.suse/Revert-HID-logitech-hidpp-add-a-module-parameter-to-.patch new file mode 100644 index 0000000..c7b3ef3 --- /dev/null +++ b/patches.suse/Revert-HID-logitech-hidpp-add-a-module-parameter-to-.patch @@ -0,0 +1,57 @@ +From cae253d6033da885e71c29c1591b22838a52de76 Mon Sep 17 00:00:00 2001 +From: Bastien Nocera +Date: Tue, 20 Dec 2022 16:43:43 +0100 +Subject: [PATCH] Revert "HID: logitech-hidpp: add a module parameter to keep firmware gestures" +Git-commit: cae253d6033da885e71c29c1591b22838a52de76 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Now that we're in 2022, and the majority of desktop environments can and +should support touchpad gestures through libinput, remove the legacy +module parameter that made it possible to use gestures implemented in +firmware. + +This will eventually allow simplifying the driver's initialisation code. + +This reverts commit 9188dbaed68a4b23dc96eba165265c08caa7dc2a. + +Signed-off-by: Bastien Nocera +Signed-off-by: Benjamin Tissoires +Link: https://lore.kernel.org/r/20221220154345.474596-1-hadess@hadess.net +Acked-by: Takashi Iwai + +--- + drivers/hid/hid-logitech-hidpp.c | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index fa026e9107c5..5da9f9be034a 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -31,11 +31,6 @@ MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Benjamin Tissoires "); + MODULE_AUTHOR("Nestor Lopez Casado "); + +-static bool disable_raw_mode; +-module_param(disable_raw_mode, bool, 0644); +-MODULE_PARM_DESC(disable_raw_mode, +- "Disable Raw mode reporting for touchpads and keep firmware gestures."); +- + static bool disable_tap_to_click; + module_param(disable_tap_to_click, bool, 0644); + MODULE_PARM_DESC(disable_tap_to_click, +@@ -4141,11 +4136,6 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) + hidpp_application_equals(hdev, HID_GD_KEYBOARD)) + hidpp->quirks |= HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS; + +- if (disable_raw_mode) { +- hidpp->quirks &= ~HIDPP_QUIRK_CLASS_WTP; +- hidpp->quirks &= ~HIDPP_QUIRK_NO_HIDINPUT; +- } +- + if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP) { + ret = wtp_allocate(hdev, id); + if (ret) +-- +2.35.3 + diff --git a/patches.suse/Revert-char-pcmcia-cm4000_cs-Replace-mdelay-with-usl.patch b/patches.suse/Revert-char-pcmcia-cm4000_cs-Replace-mdelay-with-usl.patch new file mode 100644 index 0000000..4bca55d --- /dev/null +++ b/patches.suse/Revert-char-pcmcia-cm4000_cs-Replace-mdelay-with-usl.patch @@ -0,0 +1,60 @@ +From 70fae37a09268455b8ab4f64647086b61da6f39c Mon Sep 17 00:00:00 2001 +From: Duoming Zhou +Date: Wed, 18 Jan 2023 22:10:00 +0800 +Subject: [PATCH] Revert "char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in set_protocol" +Git-commit: 70fae37a09268455b8ab4f64647086b61da6f39c +Patch-mainline: v6.3-rc1 +References: git-fixes + +This reverts commit be826ada52f1fcabed5b5217c94609ebf5967211. + +The function monitor_card() is a timer handler that runs in an +atomic context, but it calls usleep_range() that can sleep. +As a result, the sleep-in-atomic-context bugs will happen. +The process is shown below: + + (atomic context) +monitor_card() + set_protocol() + usleep_range() //sleep + +The origin commit c1986ee9bea3 ("[PATCH] New Omnikey Cardman +4000 driver") works fine. + +Fixes: be826ada52f1 ("char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in set_protocol") +Signed-off-by: Duoming Zhou +Link: https://lore.kernel.org/r/20230118141000.5580-1-duoming@zju.edu.cn +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/char/pcmcia/cm4000_cs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c +index adaec8fd4b16..e656f42a28ac 100644 +--- a/drivers/char/pcmcia/cm4000_cs.c ++++ b/drivers/char/pcmcia/cm4000_cs.c +@@ -529,7 +529,8 @@ static int set_protocol(struct cm4000_dev *dev, struct ptsreq *ptsreq) + DEBUGP(5, dev, "NumRecBytes is valid\n"); + break; + } +- usleep_range(10000, 11000); ++ /* can not sleep as this is in atomic context */ ++ mdelay(10); + } + if (i == 100) { + DEBUGP(5, dev, "Timeout waiting for NumRecBytes getting " +@@ -549,7 +550,8 @@ static int set_protocol(struct cm4000_dev *dev, struct ptsreq *ptsreq) + } + break; + } +- usleep_range(10000, 11000); ++ /* can not sleep as this is in atomic context */ ++ mdelay(10); + } + + /* check whether it is a short PTS reply? */ +-- +2.35.3 + diff --git a/patches.suse/Revert-crypto-rsa-pkcs1pad-Replace-GFP_ATOMIC-with-G.patch b/patches.suse/Revert-crypto-rsa-pkcs1pad-Replace-GFP_ATOMIC-with-G.patch new file mode 100644 index 0000000..1d729ff --- /dev/null +++ b/patches.suse/Revert-crypto-rsa-pkcs1pad-Replace-GFP_ATOMIC-with-G.patch @@ -0,0 +1,38 @@ +From d52b0c780c1f8cdd0cef9c6e683ab568d04bb19d Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Mon, 23 Jan 2023 18:08:56 +0800 +Subject: [PATCH] Revert "crypto: rsa-pkcs1pad - Replace GFP_ATOMIC with GFP_KERNEL in pkcs1pad_encrypt_sign_complete" +Git-commit: d52b0c780c1f8cdd0cef9c6e683ab568d04bb19d +Patch-mainline: v6.3-rc1 +References: git-fixes + +This reverts commit 1ca2809897155f1adc43e4859b4a3582e235c09a. + +While the akcipher API as a whole is designed to be called only +from thread context, its completion path is still called from +softirq context as usual. Therefore we must not use GFP_KERNEL +on that path. + +Signed-off-by: Herbert Xu +Acked-by: Takashi Iwai + +--- + crypto/rsa-pkcs1pad.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c +index 6ee5b8a060c0..141f7e08df6a 100644 +--- a/crypto/rsa-pkcs1pad.c ++++ b/crypto/rsa-pkcs1pad.c +@@ -190,7 +190,7 @@ static int pkcs1pad_encrypt_sign_complete(struct akcipher_request *req, int err) + if (likely(!pad_len)) + goto out; + +- out_buf = kzalloc(ctx->key_size, GFP_KERNEL); ++ out_buf = kzalloc(ctx->key_size, GFP_ATOMIC); + err = -ENOMEM; + if (!out_buf) + goto out; +-- +2.35.3 + diff --git a/patches.suse/SUNRPC-Fix-socket-waits-for-write-buffer-space.patch b/patches.suse/SUNRPC-Fix-socket-waits-for-write-buffer-space.patch new file mode 100644 index 0000000..8da0d7a --- /dev/null +++ b/patches.suse/SUNRPC-Fix-socket-waits-for-write-buffer-space.patch @@ -0,0 +1,122 @@ +From: Trond Myklebust +Date: Mon, 14 Mar 2022 21:02:10 -0400 +Subject: [PATCH] SUNRPC: Fix socket waits for write buffer space +Git-commit: 7496b59f588dd52886fdbac7633608097543a0a5 +Patch-mainline: v5.18 +References: git-fixes + +The socket layer requires that we use the socket lock to protect changes +to the sock->sk_write_pending field and others. + +Reported-by: Chuck Lever +Signed-off-by: Trond Myklebust +Acked-by: NeilBrown + +--- + net/sunrpc/xprtsock.c | 54 ++++++++++++++++++++++++++++++++++++-------------- + 1 file changed, 39 insertions(+), 15 deletions(-) + +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -763,12 +763,12 @@ xs_stream_start_connect(struct sock_xprt + /** + * xs_nospace - handle transmit was incomplete + * @req: pointer to RPC request ++ * @transport: pointer to struct sock_xprt + * + */ +-static int xs_nospace(struct rpc_rqst *req) ++static int xs_nospace(struct rpc_rqst *req, struct sock_xprt *transport) + { +- struct rpc_xprt *xprt = req->rq_xprt; +- struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt); ++ struct rpc_xprt *xprt = &transport->xprt; + struct sock *sk = transport->inet; + int ret = -EAGAIN; + +@@ -779,25 +779,49 @@ static int xs_nospace(struct rpc_rqst *r + + /* Don't race with disconnect */ + if (xprt_connected(xprt)) { ++ struct socket_wq *wq; ++ ++ rcu_read_lock(); ++ wq = rcu_dereference(sk->sk_wq); ++ set_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags); ++ rcu_read_unlock(); ++ + /* wait for more buffer space */ ++ set_bit(SOCK_NOSPACE, &sk->sk_socket->flags); + sk->sk_write_pending++; + xprt_wait_for_buffer_space(xprt); + } else + ret = -ENOTCONN; + + spin_unlock(&xprt->transport_lock); ++ return ret; ++} + +- /* Race breaker in case memory is freed before above code is called */ +- if (ret == -EAGAIN) { +- struct socket_wq *wq; ++static int xs_sock_nospace(struct rpc_rqst *req) ++{ ++ struct sock_xprt *transport = ++ container_of(req->rq_xprt, struct sock_xprt, xprt); ++ struct sock *sk = transport->inet; ++ int ret = -EAGAIN; + +- rcu_read_lock(); +- wq = rcu_dereference(sk->sk_wq); +- set_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags); +- rcu_read_unlock(); ++ lock_sock(sk); ++ if (!sock_writeable(sk)) ++ ret = xs_nospace(req, transport); ++ release_sock(sk); ++ return ret; ++} + +- sk->sk_write_space(sk); +- } ++static int xs_stream_nospace(struct rpc_rqst *req) ++{ ++ struct sock_xprt *transport = ++ container_of(req->rq_xprt, struct sock_xprt, xprt); ++ struct sock *sk = transport->inet; ++ int ret = -EAGAIN; ++ ++ lock_sock(sk); ++ if (!sk_stream_memory_free(sk)) ++ ret = xs_nospace(req, transport); ++ release_sock(sk); + return ret; + } + +@@ -887,7 +911,7 @@ static int xs_local_send_request(struct + case -ENOBUFS: + break; + case -EAGAIN: +- status = xs_nospace(req); ++ status = xs_stream_nospace(req); + break; + default: + dprintk("RPC: sendmsg returned unrecognized error %d\n", +@@ -963,7 +987,7 @@ process_status: + /* Should we call xs_close() here? */ + break; + case -EAGAIN: +- status = xs_nospace(req); ++ status = xs_sock_nospace(req); + break; + case -ENETUNREACH: + case -ENOBUFS: +@@ -1083,7 +1107,7 @@ static int xs_tcp_send_request(struct rp + /* Should we call xs_close() here? */ + break; + case -EAGAIN: +- status = xs_nospace(req); ++ status = xs_stream_nospace(req); + break; + case -ECONNRESET: + case -ECONNREFUSED: diff --git a/patches.suse/SUNRPC-allow-for-unspecified-transport-time-in-rpc_c.patch b/patches.suse/SUNRPC-allow-for-unspecified-transport-time-in-rpc_c.patch new file mode 100644 index 0000000..9f22111 --- /dev/null +++ b/patches.suse/SUNRPC-allow-for-unspecified-transport-time-in-rpc_c.patch @@ -0,0 +1,42 @@ +From: Olga Kornievskaia +Date: Thu, 9 Dec 2021 14:53:34 -0500 +Subject: [PATCH] SUNRPC allow for unspecified transport time in + rpc_clnt_add_xprt +Git-commit: b8a09619a56334414cbd7f935a0796240d0cc07e +Patch-mainline: v5.17 +References: git-fixes + +If the supplied argument doesn't specify the transport type, use the +type of the existing rpc clnt and its existing transport. + +Signed-off-by: Olga Kornievskaia +Signed-off-by: Anna Schumaker +Acked-by: NeilBrown + +--- + net/sunrpc/clnt.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -2941,7 +2941,7 @@ int rpc_clnt_add_xprt(struct rpc_clnt *c + unsigned long connect_timeout; + unsigned long reconnect_timeout; + unsigned char resvport, reuseport; +- int ret = 0; ++ int ret = 0, ident; + + rcu_read_lock(); + xps = xprt_switch_get(rcu_dereference(clnt->cl_xpi.xpi_xpswitch)); +@@ -2955,8 +2955,11 @@ int rpc_clnt_add_xprt(struct rpc_clnt *c + reuseport = xprt->reuseport; + connect_timeout = xprt->connect_timeout; + reconnect_timeout = xprt->max_reconnect_timeout; ++ ident = xprt->xprt_class->ident; + rcu_read_unlock(); + ++ if (!xprtargs->ident) ++ xprtargs->ident = ident; + xprt = xprt_create_transport(xprtargs); + if (IS_ERR(xprt)) { + ret = PTR_ERR(xprt); diff --git a/patches.suse/USB-core-Don-t-hold-device-lock-while-reading-the-de.patch b/patches.suse/USB-core-Don-t-hold-device-lock-while-reading-the-de.patch new file mode 100644 index 0000000..431b07f --- /dev/null +++ b/patches.suse/USB-core-Don-t-hold-device-lock-while-reading-the-de.patch @@ -0,0 +1,80 @@ +From 45bf39f8df7f05efb83b302c65ae3b9bc92b7065 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Tue, 31 Jan 2023 15:49:04 -0500 +Subject: [PATCH] USB: core: Don't hold device lock while reading the "descriptors" sysfs file +Git-commit: 45bf39f8df7f05efb83b302c65ae3b9bc92b7065 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Ever since commit 83e83ecb79a8 ("usb: core: get config and string +descriptors for unauthorized devices") was merged in 2013, there has +been no mechanism for reallocating the rawdescriptors buffers in +struct usb_device after the initial enumeration. Before that commit, +the buffers would be deallocated when a device was deauthorized and +reallocated when it was authorized and enumerated. + +This means that the locking in the read_descriptors() routine is not +needed, since the buffers it reads will never be reallocated while the +routine is running. This locking can interfere with user programs +trying to read a hub's descriptors via sysfs while new child devices +of the hub are being initialized, since the hub is locked during this +procedure. + +Since the locking in read_descriptors() hasn't been needed for over +nine years, we can remove it. + +Reported-and-tested-by: Troels Liebe Bentsen +Signed-off-by: Alan Stern +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/Y9l+wDTRbuZABzsE@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/core/hub.c | 5 ++--- + drivers/usb/core/sysfs.c | 5 ----- + 2 files changed, 2 insertions(+), 8 deletions(-) + +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 9eca403af2a8..97a0f8faea6e 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -2389,9 +2389,8 @@ static int usb_enumerate_device_otg(struct usb_device *udev) + * usb_enumerate_device - Read device configs/intfs/otg (usbcore-internal) + * @udev: newly addressed device (in ADDRESS state) + * +- * This is only called by usb_new_device() and usb_authorize_device() +- * and FIXME -- all comments that apply to them apply here wrt to +- * environment. ++ * This is only called by usb_new_device() -- all comments that apply there ++ * apply here wrt to environment. + * + * If the device is WUSB and not authorized, we don't attempt to read + * the string descriptors, as they will be errored out by the device +diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c +index 8217032dfb85..b63f78e48c74 100644 +--- a/drivers/usb/core/sysfs.c ++++ b/drivers/usb/core/sysfs.c +@@ -869,11 +869,7 @@ read_descriptors(struct file *filp, struct kobject *kobj, + size_t srclen, n; + int cfgno; + void *src; +- int retval; + +- retval = usb_lock_device_interruptible(udev); +- if (retval < 0) +- return -EINTR; + /* The binary attribute begins with the device descriptor. + * Following that are the raw descriptor entries for all the + * configurations (config plus subsidiary descriptors). +@@ -898,7 +894,6 @@ read_descriptors(struct file *filp, struct kobject *kobj, + off -= srclen; + } + } +- usb_unlock_device(udev); + return count - nleft; + } + +-- +2.35.3 + diff --git a/patches.suse/USB-serial-option-add-support-for-VW-Skoda-Carstick-.patch b/patches.suse/USB-serial-option-add-support-for-VW-Skoda-Carstick-.patch new file mode 100644 index 0000000..0ca6f54 --- /dev/null +++ b/patches.suse/USB-serial-option-add-support-for-VW-Skoda-Carstick-.patch @@ -0,0 +1,57 @@ +From 617c331d91077f896111044628c096802551dc66 Mon Sep 17 00:00:00 2001 +From: Florian Zumbiehl +Date: Mon, 6 Feb 2023 02:04:28 +0100 +Subject: [PATCH] USB: serial: option: add support for VW/Skoda "Carstick LTE" +Git-commit: 617c331d91077f896111044628c096802551dc66 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Add support for VW/Skoda "Carstick LTE" + +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1c9e ProdID=7605 Rev=02.00 +S: Manufacturer=USB Modem +S: Product=USB Modem +C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) + +The stick has AT command interfaces on interfaces 1, 2, and 3, and does PPP +on interface 3. + +Signed-off-by: Florian Zumbiehl +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Acked-by: Takashi Iwai + +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index ee5ac4ef7e16..e6d8d9b35ad0 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -402,6 +402,8 @@ static void option_instat_callback(struct urb *urb); + #define LONGCHEER_VENDOR_ID 0x1c9e + + /* 4G Systems products */ ++/* This one was sold as the VW and Skoda "Carstick LTE" */ ++#define FOUR_G_SYSTEMS_PRODUCT_CARSTICK_LTE 0x7605 + /* This is the 4G XS Stick W14 a.k.a. Mobilcom Debitel Surf-Stick * + * It seems to contain a Qualcomm QSC6240/6290 chipset */ + #define FOUR_G_SYSTEMS_PRODUCT_W14 0x9603 +@@ -1976,6 +1978,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = RSVD(2) }, + { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) }, + { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) }, ++ { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_CARSTICK_LTE), ++ .driver_info = RSVD(0) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14), + .driver_info = NCTRL(0) | NCTRL(1) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W100), +-- +2.35.3 + diff --git a/patches.suse/VFS-filename_create-fix-incorrect-intent.patch b/patches.suse/VFS-filename_create-fix-incorrect-intent.patch new file mode 100644 index 0000000..c1414b1 --- /dev/null +++ b/patches.suse/VFS-filename_create-fix-incorrect-intent.patch @@ -0,0 +1,102 @@ +From: NeilBrown +Date: Thu, 14 Apr 2022 13:57:35 +1000 +Subject: [PATCH] VFS: filename_create(): fix incorrect intent. +Git-commit: b3d4650d82c71b9c9a8184de9e8bb656012b289e +Patch-mainline: v5.18 +References: bsc#1197534 + +When asked to create a path ending '/', but which is not to be a +directory (LOOKUP_DIRECTORY not set), filename_create() will never try +to create the file. If it doesn't exist, -ENOENT is reported. + +However, it still passes LOOKUP_CREATE|LOOKUP_EXCL to the filesystems +->lookup() function, even though there is no intent to create. This is +misleading and can cause incorrect behaviour. + +If you try + + ln -s foo /path/dir/ + +where 'dir' is a directory on an NFS filesystem which is not currently +known in the dcache, this will fail with ENOENT. + +But as the name is not in the dcache, nfs_lookup gets called with +LOOKUP_CREATE|LOOKUP_EXCL and so it returns NULL without performing any +lookup, with the expectation that a subsequent call to create the target +will be made, and the lookup can be combined with the creation. In the +case with a trailing '/' and no LOOKUP_DIRECTORY, that call is never +made. Instead filename_create() sees that the dentry is not (yet) +positive and returns -ENOENT - even though the directory actually +exists. + +So only set LOOKUP_CREATE|LOOKUP_EXCL if there really is an intent to +create, and use the absence of these flags to decide if -ENOENT should +be returned. + +Note that filename_parentat() is only interested in LOOKUP_REVAL, so we +split that out and store it in 'reval_flag'. __lookup_hash() then gets +reval_flag combined with whatever create flags were determined to be +needed. + +Reviewed-by: David Disseldorp +Reviewed-by: Jeff Layton +Signed-off-by: NeilBrown +Cc: Al Viro +Signed-off-by: Linus Torvalds +Acked-by: NeilBrown + +--- + fs/namei.c | 22 ++++++++++------------ + 1 file changed, 10 insertions(+), 12 deletions(-) + +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -3630,18 +3630,14 @@ static struct dentry *filename_create(in + { + struct dentry *dentry = ERR_PTR(-EEXIST); + struct qstr last; ++ bool want_dir = lookup_flags & LOOKUP_DIRECTORY; ++ unsigned int reval_flag = lookup_flags & LOOKUP_REVAL; ++ unsigned int create_flags = LOOKUP_CREATE | LOOKUP_EXCL; + int type; + int err2; + int error; +- bool is_dir = (lookup_flags & LOOKUP_DIRECTORY); + +- /* +- * Note that only LOOKUP_REVAL and LOOKUP_DIRECTORY matter here. Any +- * other flags passed in are ignored! +- */ +- lookup_flags &= LOOKUP_REVAL; +- +- name = filename_parentat(dfd, name, lookup_flags, path, &last, &type); ++ name = filename_parentat(dfd, name, reval_flag, path, &last, &type); + if (IS_ERR(name)) + return ERR_CAST(name); + +@@ -3655,11 +3651,13 @@ static struct dentry *filename_create(in + /* don't fail immediately if it's r/o, at least try to report other errors */ + err2 = mnt_want_write(path->mnt); + /* +- * Do the final lookup. ++ * Do the final lookup. Suppress 'create' if there is a trailing ++ * '/', and a directory wasn't requested. + */ +- lookup_flags |= LOOKUP_CREATE | LOOKUP_EXCL; ++ if (last.name[last.len] && !want_dir) ++ create_flags = 0; + inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT); +- dentry = __lookup_hash(&last, path->dentry, lookup_flags); ++ dentry = __lookup_hash(&last, path->dentry, reval_flag | create_flags); + if (IS_ERR(dentry)) + goto unlock; + +@@ -3673,7 +3671,7 @@ static struct dentry *filename_create(in + * all is fine. Let's be bastards - you had / on the end, you've + * been asking for (non-existent) directory. -ENOENT for you. + */ +- if (unlikely(!is_dir && last.name[last.len])) { ++ if (unlikely(!create_flags)) { + error = -ENOENT; + goto fail; + } diff --git a/patches.suse/VMCI-check-context-notify_page-after-call-to-get_use.patch b/patches.suse/VMCI-check-context-notify_page-after-call-to-get_use.patch new file mode 100644 index 0000000..ed58fb0 --- /dev/null +++ b/patches.suse/VMCI-check-context-notify_page-after-call-to-get_use.patch @@ -0,0 +1,53 @@ +From 1a726cb47fd204109c767409fa9ca15a96328f14 Mon Sep 17 00:00:00 2001 +From: George Kennedy +Date: Mon, 28 Nov 2022 15:18:25 -0500 +Subject: [PATCH] VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF +Git-commit: 1a726cb47fd204109c767409fa9ca15a96328f14 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The call to get_user_pages_fast() in vmci_host_setup_notify() can return +NULL context->notify_page causing a GPF. To avoid GPF check if +context->notify_page == NULL and return error if so. + +general protection fault, probably for non-canonical address + 0xe0009d1000000060: 0000 [#1] PREEMPT SMP KASAN NOPTI +Kasan: maybe wild-memory-access in range [0x0005088000000300- 0x0005088000000307] +Cpu: 2 PID: 26180 Comm: repro_34802241 Not tainted 6.1.0-rc4 #1 +Hardware name: Red Hat KVM, BIOS 1.15.0-2.module+el8.6.0 04/01/2014 +Rip: 0010:vmci_ctx_check_signal_notify+0x91/0xe0 +Call Trace: + + vmci_host_unlocked_ioctl+0x362/0x1f40 + __x64_sys_ioctl+0x1a1/0x230 + do_syscall_64+0x3a/0x90 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Fixes: a1d88436d53a ("VMCI: Fix two UVA mapping bugs") +Reported-by: syzkaller +Signed-off-by: George Kennedy +Reviewed-by: Vishnu Dasa +Link: https://lore.kernel.org/r/1669666705-24012-1-git-send-email-george.kennedy@oracle.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/misc/vmw_vmci/vmci_host.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c +index da1e2a773823..857b9851402a 100644 +--- a/drivers/misc/vmw_vmci/vmci_host.c ++++ b/drivers/misc/vmw_vmci/vmci_host.c +@@ -242,6 +242,8 @@ static int vmci_host_setup_notify(struct vmci_ctx *context, + context->notify_page = NULL; + return VMCI_ERROR_GENERIC; + } ++ if (context->notify_page == NULL) ++ return VMCI_ERROR_UNAVAILABLE; + + /* + * Map the locked page and set up notify pointer. +-- +2.35.3 + diff --git a/patches.suse/applicom-Fix-PCI-device-refcount-leak-in-applicom_in.patch b/patches.suse/applicom-Fix-PCI-device-refcount-leak-in-applicom_in.patch new file mode 100644 index 0000000..d317058 --- /dev/null +++ b/patches.suse/applicom-Fix-PCI-device-refcount-leak-in-applicom_in.patch @@ -0,0 +1,53 @@ +From ce4273d89c52167d6fe20572136c58117eae0657 Mon Sep 17 00:00:00 2001 +From: Xiongfeng Wang +Date: Tue, 22 Nov 2022 19:40:35 +0800 +Subject: [PATCH] applicom: Fix PCI device refcount leak in applicom_init() +Git-commit: ce4273d89c52167d6fe20572136c58117eae0657 +Patch-mainline: v6.3-rc1 +References: git-fixes + +As comment of pci_get_class() says, it returns a pci_device with its +refcount increased and decreased the refcount for the input parameter +@from if it is not NULL. + +If we break the loop in applicom_init() with 'dev' not NULL, we need to +call pci_dev_put() to decrease the refcount. Add the missing +pci_dev_put() to avoid refcount leak. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Xiongfeng Wang +Link: https://lore.kernel.org/r/20221122114035.24194-1-wangxiongfeng2@huawei.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/char/applicom.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c +index 36203d3fa6ea..69314532f38c 100644 +--- a/drivers/char/applicom.c ++++ b/drivers/char/applicom.c +@@ -197,8 +197,10 @@ static int __init applicom_init(void) + if (!pci_match_id(applicom_pci_tbl, dev)) + continue; + +- if (pci_enable_device(dev)) ++ if (pci_enable_device(dev)) { ++ pci_dev_put(dev); + return -EIO; ++ } + + RamIO = ioremap(pci_resource_start(dev, 0), LEN_RAM_IO); + +@@ -207,6 +209,7 @@ static int __init applicom_init(void) + "space at 0x%llx\n", + (unsigned long long)pci_resource_start(dev, 0)); + pci_disable_device(dev); ++ pci_dev_put(dev); + return -EIO; + } + +-- +2.35.3 + diff --git a/patches.suse/arm64-dts-amlogic-meson-sm1-odroid-hc4-fix-active-fa.patch b/patches.suse/arm64-dts-amlogic-meson-sm1-odroid-hc4-fix-active-fa.patch new file mode 100644 index 0000000..2f3e271 --- /dev/null +++ b/patches.suse/arm64-dts-amlogic-meson-sm1-odroid-hc4-fix-active-fa.patch @@ -0,0 +1,49 @@ +From 1d2f14117aa7773efff50f832b85fc7779e586e0 Mon Sep 17 00:00:00 2001 +From: Neil Armstrong +Date: Tue, 24 Jan 2023 12:39:08 +0100 +Subject: [PATCH] arm64: dts: amlogic: meson-sm1-odroid-hc4: fix active fan thermal trip +Git-commit: 1d2f14117aa7773efff50f832b85fc7779e586e0 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Add an active trip tied to the on-board fan cooling device, which is better +than describing it along the passive cooling maps. + +Fixes: 33b14f663df8 ("arm64: dts: meson: add initial device-tree for ODROID-HC4") +Reported-by: Ricardo Pardini +Link: https://lore.kernel.org/r/20230124-topic-odroid-hc4-upstream-fix-fan-trip-v1-1-b0c6aa355d93@linaro.org +Tested-by: Ricardo Pardini +[narmstrong: added Ricardo's tested-by from off-list chat] +Signed-off-by: Neil Armstrong +Acked-by: Takashi Iwai + +--- + arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts +index e3486f60645a..3d642d739c35 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts +@@ -76,9 +76,17 @@ sound { + }; + + &cpu_thermal { ++ trips { ++ cpu_active: cpu-active { ++ temperature = <60000>; /* millicelsius */ ++ hysteresis = <2000>; /* millicelsius */ ++ type = "active"; ++ }; ++ }; ++ + cooling-maps { + map { +- trip = <&cpu_passive>; ++ trip = <&cpu_active>; + cooling-device = <&fan0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + }; +-- +2.35.3 + diff --git a/patches.suse/arm64-dts-imx8m-Align-SoC-unique-ID-node-unit-addres.patch b/patches.suse/arm64-dts-imx8m-Align-SoC-unique-ID-node-unit-addres.patch new file mode 100644 index 0000000..97ecf7b --- /dev/null +++ b/patches.suse/arm64-dts-imx8m-Align-SoC-unique-ID-node-unit-addres.patch @@ -0,0 +1,78 @@ +From ee0d68f219be8618f53d3f8808952e20525e3f30 Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Fri, 2 Dec 2022 17:23:50 +0100 +Subject: [PATCH] arm64: dts: imx8m: Align SoC unique ID node unit address +Git-commit: ee0d68f219be8618f53d3f8808952e20525e3f30 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Align the SoC unique ID DT node unit address with its reg property. + +Reviewed-by: Peng Fan +Fixes: cbff23797fa1 ("arm64: dts: imx8m: add NVMEM provider and consumer to read soc unique ID") +Signed-off-by: Marek Vasut +Signed-off-by: Shawn Guo +Acked-by: Takashi Iwai + +--- + arch/arm64/boot/dts/freescale/imx8mm.dtsi | 2 +- + arch/arm64/boot/dts/freescale/imx8mn.dtsi | 2 +- + arch/arm64/boot/dts/freescale/imx8mp.dtsi | 2 +- + arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +- + 4 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi +index 4ee89fdcf59b..b45852e8087a 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi +@@ -563,7 +563,7 @@ ocotp: efuse@30350000 { + #address-cells = <1>; + #size-cells = <1>; + +- imx8mm_uid: unique-id@410 { ++ imx8mm_uid: unique-id@4 { + reg = <0x4 0x8>; + }; + +diff --git a/arch/arm64/boot/dts/freescale/imx8mn.dtsi b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +index b7d91df71cc2..7601a031f85a 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +@@ -564,7 +564,7 @@ ocotp: efuse@30350000 { + #address-cells = <1>; + #size-cells = <1>; + +- imx8mn_uid: unique-id@410 { ++ imx8mn_uid: unique-id@4 { + reg = <0x4 0x8>; + }; + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +index 7a6e6221f421..7cddfa7a0d56 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +@@ -425,7 +425,7 @@ ocotp: efuse@30350000 { + #address-cells = <1>; + #size-cells = <1>; + +- imx8mp_uid: unique-id@420 { ++ imx8mp_uid: unique-id@8 { + reg = <0x8 0x8>; + }; + +diff --git a/arch/arm64/boot/dts/freescale/imx8mq.dtsi b/arch/arm64/boot/dts/freescale/imx8mq.dtsi +index 7ce99c084e54..6eb5a98bb1bd 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mq.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mq.dtsi +@@ -593,7 +593,7 @@ ocotp: efuse@30350000 { + #address-cells = <1>; + #size-cells = <1>; + +- imx8mq_uid: soc-uid@410 { ++ imx8mq_uid: soc-uid@4 { + reg = <0x4 0x8>; + }; + +-- +2.35.3 + diff --git a/patches.suse/arm64-dts-mediatek-mt7622-Add-missing-pwm-cells-to-p.patch b/patches.suse/arm64-dts-mediatek-mt7622-Add-missing-pwm-cells-to-p.patch new file mode 100644 index 0000000..881057d --- /dev/null +++ b/patches.suse/arm64-dts-mediatek-mt7622-Add-missing-pwm-cells-to-p.patch @@ -0,0 +1,35 @@ +From 22925af785fa3470efdf566339616d801119d348 Mon Sep 17 00:00:00 2001 +From: AngeloGioacchino Del Regno +Date: Mon, 28 Nov 2022 12:20:27 +0100 +Subject: [PATCH] arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node +Git-commit: 22925af785fa3470efdf566339616d801119d348 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Specify #pwm-cells on pwm@11006000 to make it actually usable. + +Fixes: ae457b7679c4 ("arm64: dts: mt7622: add SoC and peripheral related device nodes") +Signed-off-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20221128112028.58021-2-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Acked-by: Takashi Iwai + +--- + arch/arm64/boot/dts/mediatek/mt7622.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7622.dtsi b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +index 62487a3c4db1..20129bc98e21 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +@@ -435,6 +435,7 @@ uart3: serial@11005000 { + pwm: pwm@11006000 { + compatible = "mediatek,mt7622-pwm"; + reg = <0 0x11006000 0 0x1000>; ++ #pwm-cells = <2>; + interrupts = ; + clocks = <&topckgen CLK_TOP_PWM_SEL>, + <&pericfg CLK_PERI_PWM_PD>, +-- +2.35.3 + diff --git a/patches.suse/arm64-dts-mediatek-mt8183-Fix-systimer-13-MHz-clock-.patch b/patches.suse/arm64-dts-mediatek-mt8183-Fix-systimer-13-MHz-clock-.patch new file mode 100644 index 0000000..9a473b7 --- /dev/null +++ b/patches.suse/arm64-dts-mediatek-mt8183-Fix-systimer-13-MHz-clock-.patch @@ -0,0 +1,60 @@ +From ce8a06b5bac75ccce99c0cf91b96b767d64f28a7 Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Thu, 1 Dec 2022 16:42:26 +0800 +Subject: [PATCH] arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description +Git-commit: ce8a06b5bac75ccce99c0cf91b96b767d64f28a7 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The systimer block derives its 13 MHz clock by dividing the main 26 MHz +oscillator clock by 2 internally, not through the TOPCKGEN clock +controller. + +On the MT8183 this divider is set either by power-on-reset or by the +bootloader. The bootloader may then make the divider unconfigurable to, +but can be read out by, the operating system. + +Making the systimer block take the 26 MHz clock directly requires +changing the implementations. As an ABI compatible fix, change the +input clock of the systimer block a fixed factor divide-by-2 clock +that takes the 26 MHz oscillator as its input. + +Fixes: 5bc8e2875ffb ("arm64: dts: mt8183: add systimer0 device node") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20221201084229.3464449-2-wenst@chromium.org +Signed-off-by: Matthias Brugger +Acked-by: Takashi Iwai + +--- + arch/arm64/boot/dts/mediatek/mt8183.dtsi | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi +@@ -299,6 +299,15 @@ + method = "smc"; + }; + ++ clk13m: fixed-factor-clock-13m { ++ compatible = "fixed-factor-clock"; ++ #clock-cells = <0>; ++ clocks = <&clk26m>; ++ clock-div = <2>; ++ clock-mult = <1>; ++ clock-output-names = "clk13m"; ++ }; ++ + clk26m: oscillator { + compatible = "fixed-clock"; + #clock-cells = <0>; +@@ -610,8 +619,7 @@ + "mediatek,mt6765-timer"; + reg = <0 0x10017000 0 0x1000>; + interrupts = ; +- clocks = <&topckgen CLK_TOP_CLK13M>; +- clock-names = "clk13m"; ++ clocks = <&clk13m>; + }; + + iommu: iommu@10205000 { diff --git a/patches.suse/arm64-dts-meson-bananapi-m5-switch-VDDIO_C-pin-to-OP.patch b/patches.suse/arm64-dts-meson-bananapi-m5-switch-VDDIO_C-pin-to-OP.patch new file mode 100644 index 0000000..39f444d --- /dev/null +++ b/patches.suse/arm64-dts-meson-bananapi-m5-switch-VDDIO_C-pin-to-OP.patch @@ -0,0 +1,45 @@ +From 856968e066bd77b113965f1a355ec7401edff65f Mon Sep 17 00:00:00 2001 +From: Christian Hewitt +Date: Fri, 27 Jan 2023 14:22:17 +0000 +Subject: [PATCH] arm64: dts: meson: bananapi-m5: switch VDDIO_C pin to OPEN_DRAIN +Git-commit: 856968e066bd77b113965f1a355ec7401edff65f +Patch-mainline: v6.3-rc1 +References: git-fixes + +For proper warm (re)boot from SD card the BPI-M5 board requires TFLASH_VDD_EN +and VDDIO_C pins to be switched to high impedance mode. This can be achieved +using OPEN_DRAIN instead of ACTIVE_HIGH to leave the GPIO pins in input mode +and retain high state (pin has the pull-up). + +This change is inspired by meson-sm1-odroid.dtsi where OPEN_DRAIN has been +used to resolve similar problems with the Odroid C4 board (TF_IO in the C4 +dts is the equivalent regulator). + +Fixes: 976e920183e4 ("arm64: dts: meson-sm1: add Banana PI BPI-M5 board dts") +Suggested-by: Neil Armstrong +Signed-off-by: Christian Hewitt +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20230127142221.3718184-2-christianshewitt@gmail.com +Signed-off-by: Neil Armstrong +Acked-by: Takashi Iwai + +--- + arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts +index bfc500df9dcb..b5866cb996c0 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts +@@ -123,7 +123,7 @@ vddio_c: regulator-vddio_c { + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <3300000>; + +- enable-gpio = <&gpio_ao GPIOE_2 GPIO_ACTIVE_HIGH>; ++ enable-gpio = <&gpio_ao GPIOE_2 GPIO_OPEN_DRAIN>; + enable-active-high; + regulator-always-on; + +-- +2.35.3 + diff --git a/patches.suse/arm64-dts-meson-g12a-Fix-internal-Ethernet-PHY-unit-.patch b/patches.suse/arm64-dts-meson-g12a-Fix-internal-Ethernet-PHY-unit-.patch new file mode 100644 index 0000000..009f764 --- /dev/null +++ b/patches.suse/arm64-dts-meson-g12a-Fix-internal-Ethernet-PHY-unit-.patch @@ -0,0 +1,41 @@ +From e7303651bbc76c848007f1cfac1fbeaa65f600d1 Mon Sep 17 00:00:00 2001 +From: Martin Blumenstingl +Date: Wed, 11 Jan 2023 22:13:49 +0100 +Subject: [PATCH] arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name +Git-commit: e7303651bbc76c848007f1cfac1fbeaa65f600d1 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Documentation/devicetree/bindings/net/ethernet-phy.yaml defines that the +node name for Ethernet PHYs should match the following pattern: + ^ethernet-phy(@[a-f0-9]+)?$ + +Replace the underscore with a hyphen to adhere to this binding. + +Fixes: 280c17df8fbf ("arm64: dts: meson: g12a: add mdio multiplexer") +Signed-off-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20230111211350.1461860-6-martin.blumenstingl@googlemail.com +Signed-off-by: Neil Armstrong +Acked-by: Takashi Iwai + +--- + arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi +index 585dd70f6cd5..1a931d5c2715 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi +@@ -1694,7 +1694,7 @@ int_mdio: mdio@1 { + #address-cells = <1>; + #size-cells = <0>; + +- internal_ephy: ethernet_phy@8 { ++ internal_ephy: ethernet-phy@8 { + compatible = "ethernet-phy-id0180.3301", + "ethernet-phy-ieee802.3-c22"; + interrupts = ; +-- +2.35.3 + diff --git a/patches.suse/arm64-dts-meson-gx-Fix-Ethernet-MAC-address-unit-nam.patch b/patches.suse/arm64-dts-meson-gx-Fix-Ethernet-MAC-address-unit-nam.patch new file mode 100644 index 0000000..eae0a89 --- /dev/null +++ b/patches.suse/arm64-dts-meson-gx-Fix-Ethernet-MAC-address-unit-nam.patch @@ -0,0 +1,39 @@ +From 8ed5310356bfa47cc6bb4221ae6b21258c52e3d1 Mon Sep 17 00:00:00 2001 +From: Martin Blumenstingl +Date: Wed, 11 Jan 2023 22:13:48 +0100 +Subject: [PATCH] arm64: dts: meson-gx: Fix Ethernet MAC address unit name +Git-commit: 8ed5310356bfa47cc6bb4221ae6b21258c52e3d1 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Unit names should use hyphens instead of underscores to not cause +warnings. + +Fixes: bfe59f92d306 ("ARM64: dts: amlogic: gxbb: Enable NVMEM") +Suggested-by: Vyacheslav Bocharov +Signed-off-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20230111211350.1461860-5-martin.blumenstingl@googlemail.com +Signed-off-by: Neil Armstrong +Acked-by: Takashi Iwai + +--- + arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +index e3c12e0be99d..f8b115cd6775 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +@@ -233,7 +233,7 @@ sn: sn@14 { + reg = <0x14 0x10>; + }; + +- eth_mac: eth_mac@34 { ++ eth_mac: eth-mac@34 { + reg = <0x34 0x10>; + }; + +-- +2.35.3 + diff --git a/patches.suse/arm64-dts-meson-gx-Fix-the-SCPI-DVFS-node-name-and-u.patch b/patches.suse/arm64-dts-meson-gx-Fix-the-SCPI-DVFS-node-name-and-u.patch new file mode 100644 index 0000000..9d9ce16 --- /dev/null +++ b/patches.suse/arm64-dts-meson-gx-Fix-the-SCPI-DVFS-node-name-and-u.patch @@ -0,0 +1,40 @@ +From f189c869ad92787ddd753558bcbae89d75825bb6 Mon Sep 17 00:00:00 2001 +From: Martin Blumenstingl +Date: Wed, 11 Jan 2023 22:13:50 +0100 +Subject: [PATCH] arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address +Git-commit: f189c869ad92787ddd753558bcbae89d75825bb6 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Node names should be generic and use hyphens instead of underscores to +not cause warnings. Also nodes without a reg property should not have a +unit-address. Change the scpi_dvfs node to use clock-controller as node +name without a unit address (since it does not have a reg property). + +Fixes: 70db166a2baa ("ARM64: dts: meson-gxbb: Add SCPI with cpufreq & sensors Nodes") +Signed-off-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20230111211350.1461860-7-martin.blumenstingl@googlemail.com +Signed-off-by: Neil Armstrong +Acked-by: Takashi Iwai + +--- + arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +index f8b115cd6775..a79a35e84281 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +@@ -250,7 +250,7 @@ scpi { + scpi_clocks: clocks { + compatible = "arm,scpi-clocks"; + +- scpi_dvfs: scpi_clocks@0 { ++ scpi_dvfs: clock-controller { + compatible = "arm,scpi-dvfs-clocks"; + #clock-cells = <1>; + clock-indices = <0>; +-- +2.35.3 + diff --git a/patches.suse/arm64-dts-meson-remove-CPU-opps-below-1GHz-for-G12A-.patch b/patches.suse/arm64-dts-meson-remove-CPU-opps-below-1GHz-for-G12A-.patch new file mode 100644 index 0000000..e194358 --- /dev/null +++ b/patches.suse/arm64-dts-meson-remove-CPU-opps-below-1GHz-for-G12A-.patch @@ -0,0 +1,59 @@ +From 3cbd431c2b34d84605d358c8c57654193fd661fb Mon Sep 17 00:00:00 2001 +From: Christian Hewitt +Date: Thu, 19 Jan 2023 05:30:31 +0000 +Subject: [PATCH] arm64: dts: meson: remove CPU opps below 1GHz for G12A boards +Git-commit: 3cbd431c2b34d84605d358c8c57654193fd661fb +Patch-mainline: v6.3-rc1 +References: git-fixes + +Amlogic G12A devices experience CPU stalls and random board wedges when +the system idles and CPU cores clock down to lower opp points. Recent +vendor kernels include a change to remove 100-250MHz and other distro +sources also remove the 500/667MHz points. Unless all 100-667Mhz opps +are removed or the CPU governor forced to performance stalls are still +observed, so let's remove them to improve stability and uptime. + +Fixes: b190056fa9ee ("arm64: dts: meson-g12a: add cpus OPP table") +Signed-off-by: Christian Hewitt +Link: https://lore.kernel.org/r/20230119053031.21400-1-christianshewitt@gmail.com +Signed-off-by: Neil Armstrong +Acked-by: Takashi Iwai + +--- + arch/arm64/boot/dts/amlogic/meson-g12a.dtsi | 20 -------------------- + 1 file changed, 20 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi +index 7677764eeee6..f58fd2a6fe61 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi +@@ -58,26 +58,6 @@ cpu_opp_table: opp-table { + compatible = "operating-points-v2"; + opp-shared; + +- opp-100000000 { +- opp-hz = /bits/ 64 <100000000>; +- opp-microvolt = <731000>; +- }; +- +- opp-250000000 { +- opp-hz = /bits/ 64 <250000000>; +- opp-microvolt = <731000>; +- }; +- +- opp-500000000 { +- opp-hz = /bits/ 64 <500000000>; +- opp-microvolt = <731000>; +- }; +- +- opp-667000000 { +- opp-hz = /bits/ 64 <666666666>; +- opp-microvolt = <731000>; +- }; +- + opp-1000000000 { + opp-hz = /bits/ 64 <1000000000>; + opp-microvolt = <731000>; +-- +2.35.3 + diff --git a/patches.suse/arm64-dts-mt8192-Fix-CPU-map-for-single-cluster-SoC.patch b/patches.suse/arm64-dts-mt8192-Fix-CPU-map-for-single-cluster-SoC.patch new file mode 100644 index 0000000..3bc8136 --- /dev/null +++ b/patches.suse/arm64-dts-mt8192-Fix-CPU-map-for-single-cluster-SoC.patch @@ -0,0 +1,53 @@ +From 160ce54d635455ffb5e9b42c5ba9cb9aaa98cdb2 Mon Sep 17 00:00:00 2001 +From: AngeloGioacchino Del Regno +Date: Thu, 26 Jan 2023 11:35:22 +0100 +Subject: [PATCH] arm64: dts: mt8192: Fix CPU map for single-cluster SoC +Git-commit: 160ce54d635455ffb5e9b42c5ba9cb9aaa98cdb2 +Patch-mainline: v6.3-rc1 +References: git-fixes + +MT8192 features the ARM DynamIQ technology and combines both four +Cortex-A76 (big) and four Cortex-A55 (LITTLE) CPUs in one cluster: +fix the CPU map to reflect that. + +Signed-off-by: AngeloGioacchino Del Regno +Fixes: 48489980e27e ("arm64: dts: Add Mediatek SoC MT8192 and evaluation board dts and Makefile") +Link: https://lore.kernel.org/r/20230126103526.417039-3-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Acked-by: Takashi Iwai + +--- + arch/arm64/boot/dts/mediatek/mt8192.dtsi | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +index ef4fcefa2bfc..eb46cbadd310 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +@@ -206,19 +206,16 @@ core2 { + core3 { + cpu = <&cpu3>; + }; +- }; +- +- cluster1 { +- core0 { ++ core4 { + cpu = <&cpu4>; + }; +- core1 { ++ core5 { + cpu = <&cpu5>; + }; +- core2 { ++ core6 { + cpu = <&cpu6>; + }; +- core3 { ++ core7 { + cpu = <&cpu7>; + }; + }; +-- +2.35.3 + diff --git a/patches.suse/arm64-dts-qcom-ipq8074-correct-Gen2-PCIe-ranges.patch b/patches.suse/arm64-dts-qcom-ipq8074-correct-Gen2-PCIe-ranges.patch new file mode 100644 index 0000000..4254167 --- /dev/null +++ b/patches.suse/arm64-dts-qcom-ipq8074-correct-Gen2-PCIe-ranges.patch @@ -0,0 +1,41 @@ +From 2055cb7dccea16bafa3adf9c5e3216949512c34a Mon Sep 17 00:00:00 2001 +From: Robert Marko +Date: Fri, 13 Jan 2023 17:44:43 +0100 +Subject: [PATCH] arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges +Git-commit: 2055cb7dccea16bafa3adf9c5e3216949512c34a +Patch-mainline: v6.3-rc1 +References: git-fixes + +Current ranges property set in Gen2 PCIe node is incorrect, replace it +with the downstream 5.4 QCA kernel value. + +Fixes: 33057e1672fe ("ARM: dts: ipq8074: Add pcie nodes") +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230113164449.906002-3-robimarko@gmail.com +Acked-by: Takashi Iwai + +--- + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +index cbf8f3e698d3..bb9768b9becc 100644 +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -773,9 +773,9 @@ pcie1: pci@10000000 { + phy-names = "pciephy"; + + ranges = <0x81000000 0 0x10200000 0x10200000 +- 0 0x100000 /* downstream I/O */ +- 0x82000000 0 0x10300000 0x10300000 +- 0 0xd00000>; /* non-prefetchable memory */ ++ 0 0x10000>, /* downstream I/O */ ++ <0x82000000 0 0x10220000 0x10220000 ++ 0 0xfde0000>; /* non-prefetchable memory */ + + interrupts = ; + interrupt-names = "msi"; +-- +2.35.3 + diff --git a/patches.suse/arm64-dts-qcom-ipq8074-correct-USB3-QMP-PHY-s-clock-.patch b/patches.suse/arm64-dts-qcom-ipq8074-correct-USB3-QMP-PHY-s-clock-.patch new file mode 100644 index 0000000..8083bb3 --- /dev/null +++ b/patches.suse/arm64-dts-qcom-ipq8074-correct-USB3-QMP-PHY-s-clock-.patch @@ -0,0 +1,53 @@ +From 877cff3568c0f54511d77918ae16b2d6e9a0dfce Mon Sep 17 00:00:00 2001 +From: Robert Marko +Date: Sun, 8 Jan 2023 14:04:40 +0100 +Subject: [PATCH] arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output names +Git-commit: 877cff3568c0f54511d77918ae16b2d6e9a0dfce +Patch-mainline: v6.3-rc1 +References: git-fixes + +It seems that clock-output-names for the USB3 QMP PHY-s where set without +actually checking what is the GCC clock driver expecting, so clock core +could never actually find the parents for usb0_pipe_clk_src and +usb1_pipe_clk_src clocks in the GCC driver. + +So, correct the names to be what the driver expects so that parenting +works. + +Before: +gcc_usb0_pipe_clk_src 0 0 0 125000000 0 0 50000 Y +gcc_usb1_pipe_clk_src 0 0 0 125000000 0 0 50000 Y + +After: usb3phy_0_cc_pipe_clk 1 1 0 125000000 0 0 50000 Y usb0_pipe_clk_src 1 1 0 125000000 0 0 50000 Y gcc_usb0_pipe_clk 1 1 0 125000000 0 0 50000 Y usb3phy_1_cc_pipe_clk 1 1 0 125000000 0 0 50000 Y usb1_pipe_clk_src 1 1 0 125000000 0 0 50000 Y gcc_usb1_pipe_clk 1 1 0 125000000 0 0 50000 Y + +Fixes: 5e09bc51d07b ("arm64: dts: ipq8074: enable USB support") +Signed-off-by: Robert Marko +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230108130440.670181-2-robimarko@gmail.com +Acked-by: Takashi Iwai + +--- + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -108,7 +108,7 @@ + #phy-cells = <0>; + clocks = <&gcc GCC_USB1_PIPE_CLK>; + clock-names = "pipe0"; +- clock-output-names = "gcc_usb1_pipe_clk_src"; ++ clock-output-names = "usb3phy_1_cc_pipe_clk"; + }; + }; + +@@ -151,7 +151,7 @@ + #phy-cells = <0>; + clocks = <&gcc GCC_USB0_PIPE_CLK>; + clock-names = "pipe0"; +- clock-output-names = "gcc_usb0_pipe_clk_src"; ++ clock-output-names = "usb3phy_0_cc_pipe_clk"; + }; + }; + diff --git a/patches.suse/arm64-dts-qcom-ipq8074-fix-Gen3-PCIe-node.patch b/patches.suse/arm64-dts-qcom-ipq8074-fix-Gen3-PCIe-node.patch new file mode 100644 index 0000000..d35c036 --- /dev/null +++ b/patches.suse/arm64-dts-qcom-ipq8074-fix-Gen3-PCIe-node.patch @@ -0,0 +1,109 @@ +From 3e83a9c41ab0244a45a4a2800b9adb8de0d15f82 Mon Sep 17 00:00:00 2001 +From: Robert Marko +Date: Fri, 13 Jan 2023 17:44:48 +0100 +Subject: [PATCH] arm64: dts: qcom: ipq8074: fix Gen3 PCIe node +Git-commit: 3e83a9c41ab0244a45a4a2800b9adb8de0d15f82 +Patch-mainline: v6.3-rc1 +References: git-fixes + +IPQ8074 comes in 2 silicon versions: +* v1 with 2x Gen2 PCIe ports and QMP PHY-s +* v2 with 1x Gen3 and 1x Gen2 PCIe ports and QMP PHY-s + +v2 is the final and production version that is actually supported by the +kernel, however it looks like PCIe related nodes were added for the v1 SoC. + +Finish the PCIe fixup by using the correct compatible, adding missing ATU +register space, declaring max-link-speed, use correct ranges, add missing +clocks and resets. + +Fixes: 33057e1672fe ("ARM: dts: ipq8074: Add pcie nodes") +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230113164449.906002-8-robimarko@gmail.com +Acked-by: Takashi Iwai + +--- + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 30 +++++++++++++++------------ + 1 file changed, 17 insertions(+), 13 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +index 96533bc54ac6..bbe4eb029a9b 100644 +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -819,16 +819,18 @@ IRQ_TYPE_LEVEL_HIGH>, /* int_c */ + }; + + pcie0: pci@20000000 { +- compatible = "qcom,pcie-ipq8074"; ++ compatible = "qcom,pcie-ipq8074-gen3"; + reg = <0x20000000 0xf1d>, + <0x20000f20 0xa8>, +- <0x00080000 0x2000>, ++ <0x20001000 0x1000>, ++ <0x00080000 0x4000>, + <0x20100000 0x1000>; +- reg-names = "dbi", "elbi", "parf", "config"; ++ reg-names = "dbi", "elbi", "atu", "parf", "config"; + device_type = "pci"; + linux,pci-domain = <0>; + bus-range = <0x00 0xff>; + num-lanes = <1>; ++ max-link-speed = <3>; + #address-cells = <3>; + #size-cells = <2>; + +@@ -836,9 +838,9 @@ pcie0: pci@20000000 { + phy-names = "pciephy"; + + ranges = <0x81000000 0 0x20200000 0x20200000 +- 0 0x100000 /* downstream I/O */ +- 0x82000000 0 0x20300000 0x20300000 +- 0 0xd00000>; /* non-prefetchable memory */ ++ 0 0x10000>, /* downstream I/O */ ++ <0x82000000 0 0x20220000 0x20220000 ++ 0 0xfde0000>; /* non-prefetchable memory */ + + interrupts = ; + interrupt-names = "msi"; +@@ -856,28 +858,30 @@ IRQ_TYPE_LEVEL_HIGH>, /* int_c */ + clocks = <&gcc GCC_SYS_NOC_PCIE0_AXI_CLK>, + <&gcc GCC_PCIE0_AXI_M_CLK>, + <&gcc GCC_PCIE0_AXI_S_CLK>, +- <&gcc GCC_PCIE0_AHB_CLK>, +- <&gcc GCC_PCIE0_AUX_CLK>; +- ++ <&gcc GCC_PCIE0_AXI_S_BRIDGE_CLK>, ++ <&gcc GCC_PCIE0_RCHNG_CLK>; + clock-names = "iface", + "axi_m", + "axi_s", +- "ahb", +- "aux"; ++ "axi_bridge", ++ "rchng"; ++ + resets = <&gcc GCC_PCIE0_PIPE_ARES>, + <&gcc GCC_PCIE0_SLEEP_ARES>, + <&gcc GCC_PCIE0_CORE_STICKY_ARES>, + <&gcc GCC_PCIE0_AXI_MASTER_ARES>, + <&gcc GCC_PCIE0_AXI_SLAVE_ARES>, + <&gcc GCC_PCIE0_AHB_ARES>, +- <&gcc GCC_PCIE0_AXI_MASTER_STICKY_ARES>; ++ <&gcc GCC_PCIE0_AXI_MASTER_STICKY_ARES>, ++ <&gcc GCC_PCIE0_AXI_SLAVE_STICKY_ARES>; + reset-names = "pipe", + "sleep", + "sticky", + "axi_m", + "axi_s", + "ahb", +- "axi_m_sticky"; ++ "axi_m_sticky", ++ "axi_s_sticky"; + status = "disabled"; + }; + }; +-- +2.35.3 + diff --git a/patches.suse/arm64-dts-qcom-qcs404-use-symbol-names-for-PCIe-rese.patch b/patches.suse/arm64-dts-qcom-qcs404-use-symbol-names-for-PCIe-rese.patch new file mode 100644 index 0000000..a3a85de --- /dev/null +++ b/patches.suse/arm64-dts-qcom-qcs404-use-symbol-names-for-PCIe-rese.patch @@ -0,0 +1,58 @@ +From 41a37d157a613444c97e8f71a5fb2a21116b70d7 Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Mon, 26 Dec 2022 06:21:51 +0200 +Subject: [PATCH] arm64: dts: qcom: qcs404: use symbol names for PCIe resets +Git-commit: 41a37d157a613444c97e8f71a5fb2a21116b70d7 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The commit e5bbbff5b7d7 ("clk: gcc-qcs404: Add PCIe resets") added names +for PCIe resets, but it did not change the existing qcs404.dtsi to use +these names. Do it now and use symbol names to make it easier to check +and modify the dtsi in future. + +Fixes: e5bbbff5b7d7 ("clk: gcc-qcs404: Add PCIe resets") +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221226042154.2666748-14-dmitry.baryshkov@linaro.org +Acked-by: Takashi Iwai + +--- + arch/arm64/boot/dts/qcom/qcs404.dtsi | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/qcs404.dtsi b/arch/arm64/boot/dts/qcom/qcs404.dtsi +index a5324eecb50a..502dd6db491e 100644 +--- a/arch/arm64/boot/dts/qcom/qcs404.dtsi ++++ b/arch/arm64/boot/dts/qcom/qcs404.dtsi +@@ -806,7 +806,7 @@ pcie_phy: phy@7786000 { + + clocks = <&gcc GCC_PCIE_0_PIPE_CLK>; + resets = <&gcc GCC_PCIEPHY_0_PHY_BCR>, +- <&gcc 21>; ++ <&gcc GCC_PCIE_0_PIPE_ARES>; + reset-names = "phy", "pipe"; + + clock-output-names = "pcie_0_pipe_clk"; +@@ -1336,12 +1336,12 @@ pcie: pci@10000000 { + <&gcc GCC_PCIE_0_SLV_AXI_CLK>; + clock-names = "iface", "aux", "master_bus", "slave_bus"; + +- resets = <&gcc 18>, +- <&gcc 17>, +- <&gcc 15>, +- <&gcc 19>, ++ resets = <&gcc GCC_PCIE_0_AXI_MASTER_ARES>, ++ <&gcc GCC_PCIE_0_AXI_SLAVE_ARES>, ++ <&gcc GCC_PCIE_0_AXI_MASTER_STICKY_ARES>, ++ <&gcc GCC_PCIE_0_CORE_STICKY_ARES>, + <&gcc GCC_PCIE_0_BCR>, +- <&gcc 16>; ++ <&gcc GCC_PCIE_0_AHB_ARES>; + reset-names = "axi_m", + "axi_s", + "axi_m_sticky", +-- +2.35.3 + diff --git a/patches.suse/arm64-dts-qcom-sc7180-correct-SPMI-bus-address-cells.patch b/patches.suse/arm64-dts-qcom-sc7180-correct-SPMI-bus-address-cells.patch new file mode 100644 index 0000000..b54ed80 --- /dev/null +++ b/patches.suse/arm64-dts-qcom-sc7180-correct-SPMI-bus-address-cells.patch @@ -0,0 +1,43 @@ +From 1f75745537222172f84783d369bbd1fb2d4b6414 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 13 Dec 2022 11:19:17 +0100 +Subject: [PATCH] arm64: dts: qcom: sc7180: correct SPMI bus address cells +Git-commit: 1f75745537222172f84783d369bbd1fb2d4b6414 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The SPMI bus uses two address cells and zero size cells (second reg +entry - SPMI_USID - is not the size): + + spmi@c440000: #address-cells:0:0: 2 was expected + +Fixes: 0f9dc5f09fbd ("arm64: dts: qcom: sc7180: Add SPMI PMIC arbiter device") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Reviewed-by: Stephen Boyd +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221213101921.47924-1-krzysztof.kozlowski@linaro.org +Acked-by: Takashi Iwai + +--- + arch/arm64/boot/dts/qcom/sc7180.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi +index 20cf045eb0f9..8e449ddea1f2 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi +@@ -3276,8 +3276,8 @@ spmi_bus: spmi@c440000 { + interrupts-extended = <&pdc 1 IRQ_TYPE_LEVEL_HIGH>; + qcom,ee = <0>; + qcom,channel = <0>; +- #address-cells = <1>; +- #size-cells = <1>; ++ #address-cells = <2>; ++ #size-cells = <0>; + interrupt-controller; + #interrupt-cells = <4>; + cell-index = <0>; +-- +2.35.3 + diff --git a/patches.suse/arm64-dts-qcom-sc7280-correct-SPMI-bus-address-cells.patch b/patches.suse/arm64-dts-qcom-sc7280-correct-SPMI-bus-address-cells.patch new file mode 100644 index 0000000..264edd0 --- /dev/null +++ b/patches.suse/arm64-dts-qcom-sc7280-correct-SPMI-bus-address-cells.patch @@ -0,0 +1,43 @@ +From 8da3786a91e56fe0c4aeb2c2209744474af6e517 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 13 Dec 2022 11:19:18 +0100 +Subject: [PATCH] arm64: dts: qcom: sc7280: correct SPMI bus address cells +Git-commit: 8da3786a91e56fe0c4aeb2c2209744474af6e517 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The SPMI bus uses two address cells and zero size cells (second reg +entry - SPMI_USID - is not the size): + + spmi@c440000: #address-cells:0:0: 2 was expected + +Fixes: 14abf8dfe364 ("arm64: dts: qcom: sc7280: Add SPMI PMIC arbiter device for SC7280") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Reviewed-by: Stephen Boyd +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221213101921.47924-2-krzysztof.kozlowski@linaro.org +Acked-by: Takashi Iwai + +--- + arch/arm64/boot/dts/qcom/sc7280.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi +index 9c1413491ee5..ff6dc6593ebe 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi +@@ -4250,8 +4250,8 @@ spmi_bus: spmi@c440000 { + interrupts-extended = <&pdc 1 IRQ_TYPE_LEVEL_HIGH>; + qcom,ee = <0>; + qcom,channel = <0>; +- #address-cells = <1>; +- #size-cells = <1>; ++ #address-cells = <2>; ++ #size-cells = <0>; + interrupt-controller; + #interrupt-cells = <4>; + }; +-- +2.35.3 + diff --git a/patches.suse/arm64-dts-qcom-sdm845-db845c-fix-audio-codec-interru.patch b/patches.suse/arm64-dts-qcom-sdm845-db845c-fix-audio-codec-interru.patch new file mode 100644 index 0000000..3dbfeb7 --- /dev/null +++ b/patches.suse/arm64-dts-qcom-sdm845-db845c-fix-audio-codec-interru.patch @@ -0,0 +1,40 @@ +From 740862bb5f59b93efb390a417995f88a64bdc323 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Thu, 22 Dec 2022 16:13:16 +0100 +Subject: [PATCH] arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name +Git-commit: 740862bb5f59b93efb390a417995f88a64bdc323 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The pin config entry should have a string, not number, for the GPIO used +as WCD9340 audio codec interrupt. + +Fixes: 89a32a4e769c ("arm64: dts: qcom: db845c: add analog audio support") +Reported-by: Doug Anderson +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Douglas Anderson +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221222151319.122398-1-krzysztof.kozlowski@linaro.org +Acked-by: Takashi Iwai + +--- + arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts +index 1892c6537850..7c67e2f07fe3 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts ++++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts +@@ -974,7 +974,7 @@ sdc2_card_det_n: sd-card-det-n { + }; + + wcd_intr_default: wcd_intr_default { +- pins = <54>; ++ pins = "gpio54"; + function = "gpio"; + + input-enable; +-- +2.35.3 + diff --git a/patches.suse/arm64-dts-qcom-sm8150-kumano-Panel-framebuffer-is-2..patch b/patches.suse/arm64-dts-qcom-sm8150-kumano-Panel-framebuffer-is-2..patch new file mode 100644 index 0000000..9b4f33c --- /dev/null +++ b/patches.suse/arm64-dts-qcom-sm8150-kumano-Panel-framebuffer-is-2..patch @@ -0,0 +1,47 @@ +From be8de06dc397c45cb0f3fe04084089c3f06c419f Mon Sep 17 00:00:00 2001 +From: Marijn Suijten +Date: Fri, 9 Dec 2022 20:17:33 +0100 +Subject: [PATCH] arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k instead of 4k +Git-commit: be8de06dc397c45cb0f3fe04084089c3f06c419f +Patch-mainline: v6.3-rc1 +References: git-fixes + +The framebuffer configuration for kumano griffin, written in kumano dtsi +(which is overwritten in bahamut dts for its smaller panel) has to use a +1096x2560 configuration as this is what the panel (and framebuffer area) +has been initialized to. Downstream userspace also has access to (and +uses) this 2.5k mode by default, and only switches the panel to 4k when +requested. + +Fixes: d0a6ce59ea4e ("arm64: dts: qcom: sm8150: Add support for SONY Xperia 1 / 5 (Kumano platform)") +Signed-off-by: Marijn Suijten +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221209191733.1458031-1-marijn.suijten@somainline.org +Acked-by: Takashi Iwai + +--- + arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi b/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi +index c958a8b16730..fd8c0097072a 100644 +--- a/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi +@@ -33,9 +33,10 @@ chosen { + framebuffer: framebuffer@9c000000 { + compatible = "simple-framebuffer"; + reg = <0 0x9c000000 0 0x2300000>; +- width = <1644>; +- height = <3840>; +- stride = <(1644 * 4)>; ++ /* Griffin BL initializes in 2.5k mode, not 4k */ ++ width = <1096>; ++ height = <2560>; ++ stride = <(1096 * 4)>; + format = "a8r8g8b8"; + /* + * That's (going to be) a lot of clocks, but it's necessary due +-- +2.35.3 + diff --git a/patches.suse/arm64-dts-renesas-beacon-renesom-Fix-gpio-expander-r.patch b/patches.suse/arm64-dts-renesas-beacon-renesom-Fix-gpio-expander-r.patch new file mode 100644 index 0000000..8388241 --- /dev/null +++ b/patches.suse/arm64-dts-renesas-beacon-renesom-Fix-gpio-expander-r.patch @@ -0,0 +1,76 @@ +From d7f9492dfc03153ac56ab59066a196558748f575 Mon Sep 17 00:00:00 2001 +From: Adam Ford +Date: Sat, 14 Jan 2023 16:56:45 -0600 +Subject: [PATCH] arm64: dts: renesas: beacon-renesom: Fix gpio expander reference +Git-commit: d7f9492dfc03153ac56ab59066a196558748f575 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The board used to originally introduce the Beacon Embedded RZ/G2[M/N/H] +boards had a GPIO expander with address 20, but this was changed when +the final board went to production. + +The production boards changed both the part itself and the address. +With the incorrect address, the LCD cannot come up. If the LCD fails, +the rcar-du driver fails to come up, and that also breaks HDMI. + +Pre-release board were not shipped to the general public, so it should +be safe to push this as a fix. Anyone with a production board would +have video fail due to this GPIO expander change. + +Fixes: a1d8a344f1ca ("arm64: dts: renesas: Introduce r8a774a1-beacon-rzg2m-kit") +Signed-off-by: Adam Ford +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230114225647.227972-1-aford173@gmail.com +Signed-off-by: Geert Uytterhoeven +Acked-by: Takashi Iwai + +--- + .../dts/renesas/beacon-renesom-baseboard.dtsi | 24 ++++++++----------- + 1 file changed, 10 insertions(+), 14 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi b/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi +index d3ec8c45d5af..3f8b6d7b2124 100644 +--- a/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi ++++ b/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi +@@ -437,20 +437,6 @@ wm8962_endpoint: endpoint { + }; + }; + +- /* 0 - lcd_reset */ +- /* 1 - lcd_pwr */ +- /* 2 - lcd_select */ +- /* 3 - backlight-enable */ +- /* 4 - Touch_shdwn */ +- /* 5 - LCD_H_pol */ +- /* 6 - lcd_V_pol */ +- gpio_exp1: gpio@20 { +- compatible = "onnn,pca9654"; +- reg = <0x20>; +- gpio-controller; +- #gpio-cells = <2>; +- }; +- + touchscreen@26 { + compatible = "ilitek,ili2117"; + reg = <0x26>; +@@ -482,6 +468,16 @@ hd3ss3220_out_ep: endpoint { + }; + }; + }; ++ ++ gpio_exp1: gpio@70 { ++ compatible = "nxp,pca9538"; ++ reg = <0x70>; ++ gpio-controller; ++ #gpio-cells = <2>; ++ gpio-line-names = "lcd_reset", "lcd_pwr", "lcd_select", ++ "backlight-enable", "Touch_shdwn", ++ "LCD_H_pol", "lcd_V_pol"; ++ }; + }; + + &lvds0 { +-- +2.35.3 + diff --git a/patches.suse/arm64-dts-rockchip-drop-unused-LED-mode-property-fro.patch b/patches.suse/arm64-dts-rockchip-drop-unused-LED-mode-property-fro.patch new file mode 100644 index 0000000..7ed36e7 --- /dev/null +++ b/patches.suse/arm64-dts-rockchip-drop-unused-LED-mode-property-fro.patch @@ -0,0 +1,44 @@ +From 1692bffec674551163a7a4be32f59fdde04ecd27 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Fri, 25 Nov 2022 15:41:34 +0100 +Subject: [PATCH] arm64: dts: rockchip: drop unused LED mode property from rk3328-roc-cc +Git-commit: 1692bffec674551163a7a4be32f59fdde04ecd27 +Patch-mainline: v6.2-rc8 +References: git-fixes + +GPIO LEDs do not have a 'mode' property: + + rockchip/rk3328-roc-pc.dtb: leds: led-0: Unevaluated properties are not allowed ('mode' was unexpected) + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20221125144135.477144-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Heiko Stuebner +Acked-by: Takashi Iwai + +--- + arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts +index aa22a0c22265..5d5d9574088c 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts +@@ -96,7 +96,6 @@ power_led: led-0 { + linux,default-trigger = "heartbeat"; + gpios = <&rk805 1 GPIO_ACTIVE_LOW>; + default-state = "on"; +- mode = <0x23>; + }; + + user_led: led-1 { +@@ -104,7 +103,6 @@ user_led: led-1 { + linux,default-trigger = "mmc1"; + gpios = <&rk805 0 GPIO_ACTIVE_LOW>; + default-state = "off"; +- mode = <0x05>; + }; + }; + }; +-- +2.35.3 + diff --git a/patches.suse/arm64-dts-ti-k3-j7200-Fix-wakeup-pinmux-range.patch b/patches.suse/arm64-dts-ti-k3-j7200-Fix-wakeup-pinmux-range.patch new file mode 100644 index 0000000..3758c83 --- /dev/null +++ b/patches.suse/arm64-dts-ti-k3-j7200-Fix-wakeup-pinmux-range.patch @@ -0,0 +1,90 @@ +From 9ae21ac445e911e3541985c20052fc05d60f6879 Mon Sep 17 00:00:00 2001 +From: Vaishnav Achath +Date: Thu, 19 Jan 2023 09:56:22 +0530 +Subject: [PATCH] arm64: dts: ti: k3-j7200: Fix wakeup pinmux range +Git-commit: 9ae21ac445e911e3541985c20052fc05d60f6879 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The WKUP_PADCONFIG register region in J7200 has multiple non-addressable +regions, split the existing wkup_pmx region as follows to avoid the +non-addressable regions and include all valid WKUP_PADCONFIG registers. +Also update references to old nodes with new ones. + +wkup_pmx0 -> 13 pins (WKUP_PADCONFIG 0 - 12) +wkup_pmx1 -> 2 pins (WKUP_PADCONFIG 14 - 15) +wkup_pmx2 -> 59 pins (WKUP_PADCONFIG 26 - 84) +wkup_pmx3 -> 8 pins (WKUP_PADCONFIG 93 - 100) + +J7200 Datasheet (Table 6-106, Section 6.4 Pin Multiplexing) : + https://www.ti.com/lit/ds/symlink/dra821u.pdf + +Fixes: d361ed88455f ("arm64: dts: ti: Add support for J7200 SoC") + +Signed-off-by: Vaishnav Achath +Reviewed-by: Jayesh Choudhary +Signed-off-by: Vignesh Raghavendra +Link: https://lore.kernel.org/r/20230119042622.22310-1-vaishnav.a@ti.com +Acked-by: Takashi Iwai + +--- + .../dts/ti/k3-j7200-common-proc-board.dts | 2 +- + .../boot/dts/ti/k3-j7200-mcu-wakeup.dtsi | 29 ++++++++++++++++++- + 2 files changed, 29 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts +index 6240856e4863..0d39d6b8cc0c 100644 +--- a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts ++++ b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts +@@ -80,7 +80,7 @@ vdd_sd_dv: gpio-regulator-TLV71033 { + }; + }; + +-&wkup_pmx0 { ++&wkup_pmx2 { + mcu_cpsw_pins_default: mcu-cpsw-pins-default { + pinctrl-single,pins = < + J721E_WKUP_IOPAD(0x0068, PIN_OUTPUT, 0) /* MCU_RGMII1_TX_CTL */ +diff --git a/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi +index fe669deba489..de56a0165bd0 100644 +--- a/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi +@@ -56,7 +56,34 @@ chipid@43000014 { + wkup_pmx0: pinctrl@4301c000 { + compatible = "pinctrl-single"; + /* Proxy 0 addressing */ +- reg = <0x00 0x4301c000 0x00 0x178>; ++ reg = <0x00 0x4301c000 0x00 0x34>; ++ #pinctrl-cells = <1>; ++ pinctrl-single,register-width = <32>; ++ pinctrl-single,function-mask = <0xffffffff>; ++ }; ++ ++ wkup_pmx1: pinctrl@0x4301c038 { ++ compatible = "pinctrl-single"; ++ /* Proxy 0 addressing */ ++ reg = <0x00 0x4301c038 0x00 0x8>; ++ #pinctrl-cells = <1>; ++ pinctrl-single,register-width = <32>; ++ pinctrl-single,function-mask = <0xffffffff>; ++ }; ++ ++ wkup_pmx2: pinctrl@0x4301c068 { ++ compatible = "pinctrl-single"; ++ /* Proxy 0 addressing */ ++ reg = <0x00 0x4301c068 0x00 0xec>; ++ #pinctrl-cells = <1>; ++ pinctrl-single,register-width = <32>; ++ pinctrl-single,function-mask = <0xffffffff>; ++ }; ++ ++ wkup_pmx3: pinctrl@0x4301c174 { ++ compatible = "pinctrl-single"; ++ /* Proxy 0 addressing */ ++ reg = <0x00 0x4301c174 0x00 0x20>; + #pinctrl-cells = <1>; + pinctrl-single,register-width = <32>; + pinctrl-single,function-mask = <0xffffffff>; +-- +2.35.3 + diff --git a/patches.suse/arm64-efi-Make-efi_rt_lock-a-raw_spinlock.patch b/patches.suse/arm64-efi-Make-efi_rt_lock-a-raw_spinlock.patch new file mode 100644 index 0000000..d9593fa --- /dev/null +++ b/patches.suse/arm64-efi-Make-efi_rt_lock-a-raw_spinlock.patch @@ -0,0 +1,93 @@ +From 0e68b5517d3767562889f1d83fdb828c26adb24f Mon Sep 17 00:00:00 2001 +From: Pierre Gondois +Date: Wed, 15 Feb 2023 17:10:47 +0100 +Subject: [PATCH] arm64: efi: Make efi_rt_lock a raw_spinlock +Git-commit: 0e68b5517d3767562889f1d83fdb828c26adb24f +Patch-mainline: v6.3-rc1 +References: git-fixes + +Running a rt-kernel base on 6.2.0-rc3-rt1 on an Ampere Altra outputs +the following: + BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46 + in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 9, name: kworker/u320:0 + preempt_count: 2, expected: 0 + RCU nest depth: 0, expected: 0 + 3 locks held by kworker/u320:0/9: + #0: ffff3fff8c27d128 ((wq_completion)efi_rts_wq){+.+.}-{0:0}, at: process_one_work (./include/linux/atomic/atomic-long.h:41) + #1: ffff80000861bdd0 ((work_completion)(&efi_rts_work.work)){+.+.}-{0:0}, at: process_one_work (./include/linux/atomic/atomic-long.h:41) + #2: ffffdf7e1ed3e460 (efi_rt_lock){+.+.}-{3:3}, at: efi_call_rts (drivers/firmware/efi/runtime-wrappers.c:101) + Preemption disabled at: + efi_virtmap_load (./arch/arm64/include/asm/mmu_context.h:248) + CPU: 0 PID: 9 Comm: kworker/u320:0 Tainted: G W 6.2.0-rc3-rt1 + Hardware name: WIWYNN Mt.Jade Server System B81.03001.0005/Mt.Jade Motherboard, BIOS 1.08.20220218 (SCP: 1.08.20220218) 2022/02/18 + Workqueue: efi_rts_wq efi_call_rts + Call trace: + dump_backtrace (arch/arm64/kernel/stacktrace.c:158) + show_stack (arch/arm64/kernel/stacktrace.c:165) + dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4)) + dump_stack (lib/dump_stack.c:114) + __might_resched (kernel/sched/core.c:10134) + rt_spin_lock (kernel/locking/rtmutex.c:1769 (discriminator 4)) + efi_call_rts (drivers/firmware/efi/runtime-wrappers.c:101) + [...] + +This seems to come from commit ff7a167961d1 ("arm64: efi: Execute +runtime services from a dedicated stack") which adds a spinlock. This +spinlock is taken through: +efi_call_rts() +\-efi_call_virt() + \-efi_call_virt_pointer() + \-arch_efi_call_virt_setup() + +Make 'efi_rt_lock' a raw_spinlock to avoid being preempted. + +[ardb: The EFI runtime services are called with a different set of translation tables, and are permitted to use the SIMD registers. The context switch code preserves/restores neither, and so EFI calls must be made with preemption disabled, rather than only disabling migration.] + +Fixes: ff7a167961d1 ("arm64: efi: Execute runtime services from a dedicated stack") +Signed-off-by: Pierre Gondois +Cc: # v6.1+ +Signed-off-by: Ard Biesheuvel +Acked-by: Takashi Iwai + +--- + arch/arm64/include/asm/efi.h | 6 +++--- + arch/arm64/kernel/efi.c | 2 +- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/arm64/include/asm/efi.h ++++ b/arch/arm64/include/asm/efi.h +@@ -26,7 +26,7 @@ int efi_set_mapping_permissions(struct m + ({ \ + efi_virtmap_load(); \ + __efi_fpsimd_begin(); \ +- spin_lock(&efi_rt_lock); \ ++ raw_spin_lock(&efi_rt_lock); \ + }) + + #define arch_efi_call_virt(p, f, args...) \ +@@ -38,12 +38,12 @@ int efi_set_mapping_permissions(struct m + + #define arch_efi_call_virt_teardown() \ + ({ \ +- spin_unlock(&efi_rt_lock); \ ++ raw_spin_unlock(&efi_rt_lock); \ + __efi_fpsimd_end(); \ + efi_virtmap_unload(); \ + }) + +-extern spinlock_t efi_rt_lock; ++extern raw_spinlock_t efi_rt_lock; + efi_status_t __efi_rt_asm_wrapper(void *, const char *, ...); + + #define ARCH_EFI_IRQ_FLAGS_MASK (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT) +--- a/arch/arm64/kernel/efi.c ++++ b/arch/arm64/kernel/efi.c +@@ -145,7 +145,7 @@ asmlinkage efi_status_t efi_handle_corru + return s; + } + +-DEFINE_SPINLOCK(efi_rt_lock); ++DEFINE_RAW_SPINLOCK(efi_rt_lock); + + asmlinkage u64 *efi_rt_stack_top __ro_after_init; + diff --git a/patches.suse/audit-update-the-mailing-list-in-MAINTAINERS.patch b/patches.suse/audit-update-the-mailing-list-in-MAINTAINERS.patch new file mode 100644 index 0000000..e51df79 --- /dev/null +++ b/patches.suse/audit-update-the-mailing-list-in-MAINTAINERS.patch @@ -0,0 +1,40 @@ +From 6c6cd913accd77008f74a1a9d57b816db3651daa Mon Sep 17 00:00:00 2001 +From: Paul Moore +Date: Tue, 7 Feb 2023 10:21:47 -0500 +Subject: [PATCH] audit: update the mailing list in MAINTAINERS +Git-commit: 6c6cd913accd77008f74a1a9d57b816db3651daa +Patch-mainline: v6.3-rc1 +References: git-fixes + +We've moved the upstream Linux Kernel audit subsystem discussions to +a new mailing list, this patch updates the MAINTAINERS info with the +new list address. + +Marking this for stable inclusion to help speed uptake of the new +list across all of the supported kernel releases. This is a doc only +patch so the risk should be close to nil. + +Cc: stable@vger.kernel.org +Signed-off-by: Paul Moore +Acked-by: Takashi Iwai + +--- + MAINTAINERS | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/MAINTAINERS b/MAINTAINERS +index 7f86d02cb427..b686c3af313f 100644 +--- a/MAINTAINERS ++++ b/MAINTAINERS +@@ -3511,7 +3511,7 @@ F: drivers/net/ieee802154/atusb.h + AUDIT SUBSYSTEM + M: Paul Moore + M: Eric Paris +-L: linux-audit@redhat.com (moderated for non-subscribers) ++L: audit@vger.kernel.org + S: Supported + W: https://github.com/linux-audit + T: git git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git +-- +2.35.3 + diff --git a/patches.suse/auxdisplay-hd44780-Fix-potential-memory-leak-in-hd44.patch b/patches.suse/auxdisplay-hd44780-Fix-potential-memory-leak-in-hd44.patch new file mode 100644 index 0000000..468093c --- /dev/null +++ b/patches.suse/auxdisplay-hd44780-Fix-potential-memory-leak-in-hd44.patch @@ -0,0 +1,45 @@ +From ddf75a86aba2cfb7ec4497e8692b60c8c8fe0ee7 Mon Sep 17 00:00:00 2001 +From: Jianglei Nie +Date: Tue, 29 Nov 2022 16:15:42 +0800 +Subject: [PATCH] auxdisplay: hd44780: Fix potential memory leak in hd44780_remove() +Git-commit: ddf75a86aba2cfb7ec4497e8692b60c8c8fe0ee7 +Patch-mainline: v6.3-rc1 +References: git-fixes + +hd44780_probe() allocates a memory chunk for hd with kzalloc() and +makes "lcd->drvdata->hd44780" point to it. When we call hd44780_remove(), +we should release all relevant memory and resource. But "lcd->drvdata +->hd44780" is not released, which will lead to a memory leak. + +We should release the "lcd->drvdata->hd44780" in hd44780_remove() to fix +the memory leak bug. + +Fixes: 718e05ed92ec ("auxdisplay: Introduce hd44780_common.[ch]") +Reviewed-by: Andy Shevchenko +Reported-by: kernel test robot +Signed-off-by: Jianglei Nie +Signed-off-by: Miguel Ojeda +Acked-by: Takashi Iwai + +--- + drivers/auxdisplay/hd44780.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/auxdisplay/hd44780.c b/drivers/auxdisplay/hd44780.c +index 8b2a0eb3f32a..d56a5d508ccd 100644 +--- a/drivers/auxdisplay/hd44780.c ++++ b/drivers/auxdisplay/hd44780.c +@@ -322,8 +322,10 @@ static int hd44780_probe(struct platform_device *pdev) + static int hd44780_remove(struct platform_device *pdev) + { + struct charlcd *lcd = platform_get_drvdata(pdev); ++ struct hd44780_common *hdc = lcd->drvdata; + + charlcd_unregister(lcd); ++ kfree(hdc->hd44780); + kfree(lcd->drvdata); + + kfree(lcd); +-- +2.35.3 + diff --git a/patches.suse/backlight-backlight-Fix-doc-for-backlight_device_get.patch b/patches.suse/backlight-backlight-Fix-doc-for-backlight_device_get.patch new file mode 100644 index 0000000..629ba6e --- /dev/null +++ b/patches.suse/backlight-backlight-Fix-doc-for-backlight_device_get.patch @@ -0,0 +1,38 @@ +From 3755b46a1bf47a6778f4ce33def1e6122796f57c Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Thu, 15 Dec 2022 11:19:01 +0400 +Subject: [PATCH] backlight: backlight: Fix doc for backlight_device_get_by_name +Git-commit: 3755b46a1bf47a6778f4ce33def1e6122796f57c +Patch-mainline: v6.3-rc1 +References: git-fixes + +backlight_put() has been dropped, we should call put_device() to drop +the reference taken by backlight_device_get_by_name(). + +Fixes: 0f6a3256fd81 ("backlight: backlight: Drop backlight_put()") +Signed-off-by: Miaoqian Lin +Reviewed-by: Daniel Thompson +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20221215071902.424005-1-linmq006@gmail.com +Acked-by: Takashi Iwai + +--- + drivers/video/backlight/backlight.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/video/backlight/backlight.c b/drivers/video/backlight/backlight.c +index b788ff3d0f45..6eea72aa8dbf 100644 +--- a/drivers/video/backlight/backlight.c ++++ b/drivers/video/backlight/backlight.c +@@ -501,7 +501,7 @@ EXPORT_SYMBOL(backlight_device_get_by_type); + * + * This function looks up a backlight device by its name. It obtains a reference + * on the backlight device and it is the caller's responsibility to drop the +- * reference by calling backlight_put(). ++ * reference by calling put_device(). + * + * Returns: + * A pointer to the backlight device if found, otherwise NULL. +-- +2.35.3 + diff --git a/patches.suse/cifs-Check-the-lease-context-if-we-actually-got-a-lease.patch b/patches.suse/cifs-Check-the-lease-context-if-we-actually-got-a-lease.patch new file mode 100644 index 0000000..9a928e8 --- /dev/null +++ b/patches.suse/cifs-Check-the-lease-context-if-we-actually-got-a-lease.patch @@ -0,0 +1,78 @@ +From: Ronnie Sahlberg +Date: Fri, 17 Feb 2023 13:35:00 +1000 +Subject: [PATCH] cifs: Check the lease context if we actually got a lease +Git-commit: 66d45ca1350a3bb8d5f4db8879ccad3ed492337a +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +Some servers may return that we got a lease in rsp->OplockLevel +but then in the lease context contradict this and say we got no lease +at all. Thus we need to check the context if we have a lease. +Additionally, If we do not get a lease we need to make sure we close +the handle before we return an error to the caller. + +Signed-off-by: Ronnie Sahlberg +Cc: stable@vger.kernel.org +Reviewed-by: Bharath SM +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/cached_dir.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/fs/cifs/cached_dir.c b/fs/cifs/cached_dir.c +index b36ae64034a3..d5e5d757fc56 100644 +--- a/fs/cifs/cached_dir.c ++++ b/fs/cifs/cached_dir.c +@@ -221,8 +221,7 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + } + goto oshr_free; + } +- +- atomic_inc(&tcon->num_remote_opens); ++ cfid->is_open = true; + + o_rsp = (struct smb2_create_rsp *)rsp_iov[0].iov_base; + oparms.fid->persistent_fid = o_rsp->PersistentFileId; +@@ -239,7 +238,8 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + &oparms.fid->epoch, + oparms.fid->lease_key, &oplock, + NULL, NULL); +- ++ if (!(oplock & SMB2_LEASE_READ_CACHING_HE)) ++ goto oshr_free; + qi_rsp = (struct smb2_query_info_rsp *)rsp_iov[1].iov_base; + if (le32_to_cpu(qi_rsp->OutputBufferLength) < sizeof(struct smb2_file_all_info)) + goto oshr_free; +@@ -262,7 +262,6 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + cfid->dentry = dentry; + cfid->tcon = tcon; + cfid->time = jiffies; +- cfid->is_open = true; + cfid->has_lease = true; + + oshr_free: +@@ -282,12 +281,17 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + } + spin_unlock(&cfids->cfid_list_lock); + if (rc) { ++ if (cfid->is_open) ++ SMB2_close(0, cfid->tcon, cfid->fid.persistent_fid, ++ cfid->fid.volatile_fid); + free_cached_dir(cfid); + cfid = NULL; + } + +- if (rc == 0) ++ if (rc == 0) { + *ret_cfid = cfid; ++ atomic_inc(&tcon->num_remote_opens); ++ } + + return rc; + } +-- +2.39.2 + + diff --git a/patches.suse/cifs-Convert-struct-fealist-away-from-1-element-array.patch b/patches.suse/cifs-Convert-struct-fealist-away-from-1-element-array.patch new file mode 100644 index 0000000..ef5c07f --- /dev/null +++ b/patches.suse/cifs-Convert-struct-fealist-away-from-1-element-array.patch @@ -0,0 +1,119 @@ +From: Kees Cook +Date: Tue, 14 Feb 2023 16:08:39 -0800 +Subject: [PATCH] cifs: Convert struct fealist away from 1-element array +Git-commit: 398d5843c03261a2b68730f2f00643826bcec6ba +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +The kernel is globally removing the ambiguous 0-length and 1-element +arrays in favor of flexible arrays, so that we can gain both compile-time +and run-time array bounds checking[1]. + +While struct fealist is defined as a "fake" flexible array (via a +1-element array), it is only used for examination of the first array +element. Walking the list is performed separately, so there is no reason +to treat the "list" member of struct fealist as anything other than a +single entry. Adjust the struct and code to match. + +Additionally, struct fea uses the "name" member either as a dynamic +string, or is manually calculated from the start of the struct. Redefine +the member as a flexible array. + +No machine code output differences are produced after these changes. + +[1] For lots of details, see both: + https://docs.kernel.org/process/deprecated.html#zero-length-and-one-element-arrays + https://people.kernel.org/kees/bounded-flexible-arrays-in-c + +Cc: Steve French +Cc: Paulo Alcantara +Cc: Ronnie Sahlberg +Cc: Shyam Prasad N +Cc: Tom Talpey +Cc: linux-cifs@vger.kernel.org +Cc: samba-technical@lists.samba.org +Signed-off-by: Kees Cook +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/cifspdu.h | 4 ++-- + fs/cifs/cifssmb.c | 16 ++++++++-------- + 2 files changed, 10 insertions(+), 10 deletions(-) + +diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h +index 623caece2b10..add73be4902c 100644 +--- a/fs/cifs/cifspdu.h ++++ b/fs/cifs/cifspdu.h +@@ -2583,7 +2583,7 @@ struct fea { + unsigned char EA_flags; + __u8 name_len; + __le16 value_len; +- char name[1]; ++ char name[]; + /* optionally followed by value */ + } __attribute__((packed)); + /* flags for _FEA.fEA */ +@@ -2591,7 +2591,7 @@ struct fea { + + struct fealist { + __le32 list_len; +- struct fea list[1]; ++ struct fea list; + } __attribute__((packed)); + + /* used to hold an arbitrary blob of data */ +diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c +index 8c014a3ff9e0..c32bfe68212b 100644 +--- a/fs/cifs/cifssmb.c ++++ b/fs/cifs/cifssmb.c +@@ -5787,7 +5787,7 @@ CIFSSMBQAllEAs(const unsigned int xid, struct cifs_tcon *tcon, + + /* account for ea list len */ + list_len -= 4; +- temp_fea = ea_response_data->list; ++ temp_fea = &ea_response_data->list; + temp_ptr = (char *)temp_fea; + while (list_len > 0) { + unsigned int name_len; +@@ -5902,7 +5902,7 @@ CIFSSMBSetEA(const unsigned int xid, struct cifs_tcon *tcon, + else + name_len = strnlen(ea_name, 255); + +- count = sizeof(*parm_data) + ea_value_len + name_len; ++ count = sizeof(*parm_data) + 1 + ea_value_len + name_len; + pSMB->MaxParameterCount = cpu_to_le16(2); + /* BB find max SMB PDU from sess */ + pSMB->MaxDataCount = cpu_to_le16(1000); +@@ -5926,14 +5926,14 @@ CIFSSMBSetEA(const unsigned int xid, struct cifs_tcon *tcon, + byte_count = 3 /* pad */ + params + count; + pSMB->DataCount = cpu_to_le16(count); + parm_data->list_len = cpu_to_le32(count); +- parm_data->list[0].EA_flags = 0; ++ parm_data->list.EA_flags = 0; + /* we checked above that name len is less than 255 */ +- parm_data->list[0].name_len = (__u8)name_len; ++ parm_data->list.name_len = (__u8)name_len; + /* EA names are always ASCII */ + if (ea_name) +- strncpy(parm_data->list[0].name, ea_name, name_len); +- parm_data->list[0].name[name_len] = 0; +- parm_data->list[0].value_len = cpu_to_le16(ea_value_len); ++ strncpy(parm_data->list.name, ea_name, name_len); ++ parm_data->list.name[name_len] = '\0'; ++ parm_data->list.value_len = cpu_to_le16(ea_value_len); + /* caller ensures that ea_value_len is less than 64K but + we need to ensure that it fits within the smb */ + +@@ -5941,7 +5941,7 @@ CIFSSMBSetEA(const unsigned int xid, struct cifs_tcon *tcon, + negotiated SMB buffer size BB */ + /* if (ea_value_len > buffer_size - 512 (enough for header)) */ + if (ea_value_len) +- memcpy(parm_data->list[0].name+name_len+1, ++ memcpy(parm_data->list.name + name_len + 1, + ea_value, ea_value_len); + + pSMB->TotalDataCount = pSMB->DataCount; +-- +2.39.2 + + diff --git a/patches.suse/cifs-Fix-lost-destroy-smbd-connection-when-MR-allocate-failed.patch b/patches.suse/cifs-Fix-lost-destroy-smbd-connection-when-MR-allocate-failed.patch new file mode 100644 index 0000000..dbb5eeb --- /dev/null +++ b/patches.suse/cifs-Fix-lost-destroy-smbd-connection-when-MR-allocate-failed.patch @@ -0,0 +1,42 @@ +From: Zhang Xiaoxu +Date: Fri, 18 Nov 2022 16:42:07 +0800 +Subject: [PATCH] cifs: Fix lost destroy smbd connection when MR allocate + failed +Git-commit: e9d3401d95d62a9531082cd2453ed42f2740e3fd +References: git-fixes +Patch-mainline: v6.3-rc1 + +If the MR allocate failed, the smb direct connection info is NULL, +then smbd_destroy() will directly return, then the connection info +will be leaked. + +Let's set the smb direct connection info to the server before call +smbd_destroy(). + +Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration") +Signed-off-by: Zhang Xiaoxu +Acked-by: Paulo Alcantara (SUSE) +Reviewed-by: David Howells +Reviewed-by: Tom Talpey +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/smbdirect.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c +index 8c816b25ce7c..101dab87cad1 100644 +--- a/fs/cifs/smbdirect.c ++++ b/fs/cifs/smbdirect.c +@@ -1700,6 +1700,7 @@ static struct smbd_connection *_smbd_get_connection( + + allocate_mr_failed: + /* At this point, need to a full transport shutdown */ ++ server->smbd_conn = info; + smbd_destroy(server); + return NULL; + +-- +2.39.2 + + diff --git a/patches.suse/cifs-Fix-oops-due-to-uncleared-server-smbd_conn-in-reconnect.patch b/patches.suse/cifs-Fix-oops-due-to-uncleared-server-smbd_conn-in-reconnect.patch new file mode 100644 index 0000000..4442231 --- /dev/null +++ b/patches.suse/cifs-Fix-oops-due-to-uncleared-server-smbd_conn-in-reconnect.patch @@ -0,0 +1,42 @@ +From: David Howells +Date: Wed, 25 Jan 2023 14:02:13 +0000 +Subject: [PATCH] cifs: Fix oops due to uncleared server->smbd_conn in + reconnect +Git-commit: b7ab9161cf5ddc42a288edf9d1a61f3bdffe17c7 +References: git-fixes +Patch-mainline: v6.2-rc6 + +In smbd_destroy(), clear the server->smbd_conn pointer after freeing the +smbd_connection struct that it points to so that reconnection doesn't get +confused. + +Fixes: 8ef130f9ec27 ("CIFS: SMBD: Implement function to destroy a SMB Direct connection") +Cc: stable@vger.kernel.org +Reviewed-by: Paulo Alcantara (SUSE) +Acked-by: Tom Talpey +Signed-off-by: David Howells +Cc: Long Li +Cc: Pavel Shilovsky +Cc: Ronnie Sahlberg +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/smbdirect.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c +index 90789aaa6567..8c816b25ce7c 100644 +--- a/fs/cifs/smbdirect.c ++++ b/fs/cifs/smbdirect.c +@@ -1405,6 +1405,7 @@ void smbd_destroy(struct TCP_Server_Info *server) + destroy_workqueue(info->workqueue); + log_rdma_event(INFO, "rdma session destroyed\n"); + kfree(info); ++ server->smbd_conn = NULL; + } + + /* +-- +2.39.2 + + diff --git a/patches.suse/cifs-Fix-uninitialized-memory-read-in-smb3_qfs_tcon-.patch b/patches.suse/cifs-Fix-uninitialized-memory-read-in-smb3_qfs_tcon-.patch new file mode 100644 index 0000000..177b357 --- /dev/null +++ b/patches.suse/cifs-Fix-uninitialized-memory-read-in-smb3_qfs_tcon-.patch @@ -0,0 +1,46 @@ +From: Volker Lendecke +Date: Wed, 11 Jan 2023 12:37:58 +0100 +Subject: [PATCH] cifs: Fix uninitialized memory read in smb3_qfs_tcon() +Git-commit: d447e794a37288ec7a080aa1b044a8d9deebbab7 +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +oparms was not fully initialized + +Signed-off-by: Volker Lendecke +Reviewed-by: Paulo Alcantara (SUSE) +Cc: stable@vger.kernel.org +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/smb2ops.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 157a19f371d6..f22d36019ff4 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -729,12 +729,13 @@ smb3_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon, + struct cifs_fid fid; + struct cached_fid *cfid = NULL; + +- oparms.tcon = tcon; +- oparms.desired_access = FILE_READ_ATTRIBUTES; +- oparms.disposition = FILE_OPEN; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = FILE_READ_ATTRIBUTES, ++ .disposition = FILE_OPEN, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .fid = &fid, ++ }; + + rc = open_cached_dir(xid, tcon, "", cifs_sb, false, &cfid); + if (rc == 0) +-- +2.39.2 + + diff --git a/patches.suse/cifs-Fix-uninitialized-memory-reads-for-oparms-mode.patch b/patches.suse/cifs-Fix-uninitialized-memory-reads-for-oparms-mode.patch new file mode 100644 index 0000000..f9a97b1 --- /dev/null +++ b/patches.suse/cifs-Fix-uninitialized-memory-reads-for-oparms-mode.patch @@ -0,0 +1,811 @@ +From: Volker Lendecke +Date: Wed, 11 Jan 2023 12:37:58 +0100 +Subject: [PATCH] cifs: Fix uninitialized memory reads for oparms.mode +Git-commit: de036dcaca65cf94bf7ff09c571c077f02bc92b4 +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +Use a struct assignment with implicit member initialization + +Signed-off-by: Volker Lendecke +Cc: stable@vger.kernel.org +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/cached_dir.c | 13 +-- + fs/cifs/cifsacl.c | 34 ++++---- + fs/cifs/cifssmb.c | 17 ++-- + fs/cifs/dir.c | 19 +++-- + fs/cifs/file.c | 35 ++++---- + fs/cifs/inode.c | 53 ++++++------ + fs/cifs/link.c | 66 ++++++++------- + fs/cifs/smb1ops.c | 72 ++++++++-------- + fs/cifs/smb2inode.c | 17 ++-- + fs/cifs/smb2ops.c | 191 +++++++++++++++++++++++-------------------- + 10 files changed, 274 insertions(+), 243 deletions(-) + +diff --git a/fs/cifs/cached_dir.c b/fs/cifs/cached_dir.c +index 60399081046a..b36ae64034a3 100644 +--- a/fs/cifs/cached_dir.c ++++ b/fs/cifs/cached_dir.c +@@ -181,12 +181,13 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + rqst[0].rq_iov = open_iov; + rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE; + +- oparms.tcon = tcon; +- oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_FILE); +- oparms.desired_access = FILE_READ_ATTRIBUTES; +- oparms.disposition = FILE_OPEN; +- oparms.fid = pfid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .create_options = cifs_create_options(cifs_sb, CREATE_NOT_FILE), ++ .desired_access = FILE_READ_ATTRIBUTES, ++ .disposition = FILE_OPEN, ++ .fid = pfid, ++ }; + + rc = SMB2_open_init(tcon, server, + &rqst[0], &oplock, &oparms, utf16_path); +diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c +index bbf58c2439da..3cc3471199f5 100644 +--- a/fs/cifs/cifsacl.c ++++ b/fs/cifs/cifsacl.c +@@ -1428,14 +1428,15 @@ static struct cifs_ntsd *get_cifs_acl_by_path(struct cifs_sb_info *cifs_sb, + tcon = tlink_tcon(tlink); + xid = get_xid(); + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = READ_CONTROL; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.disposition = FILE_OPEN; +- oparms.path = path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = READ_CONTROL, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .disposition = FILE_OPEN, ++ .path = path, ++ .fid = &fid, ++ }; + + rc = CIFS_open(xid, &oparms, &oplock, NULL); + if (!rc) { +@@ -1494,14 +1495,15 @@ int set_cifs_acl(struct cifs_ntsd *pnntsd, __u32 acllen, + else + access_flags = WRITE_DAC; + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = access_flags; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.disposition = FILE_OPEN; +- oparms.path = path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = access_flags, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .disposition = FILE_OPEN, ++ .path = path, ++ .fid = &fid, ++ }; + + rc = CIFS_open(xid, &oparms, &oplock, NULL); + if (rc) { +diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c +index 23f10e0d6e7e..8c014a3ff9e0 100644 +--- a/fs/cifs/cifssmb.c ++++ b/fs/cifs/cifssmb.c +@@ -5372,14 +5372,15 @@ CIFSSMBSetPathInfoFB(const unsigned int xid, struct cifs_tcon *tcon, + struct cifs_fid fid; + int rc; + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = GENERIC_WRITE; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.disposition = FILE_OPEN; +- oparms.path = fileName; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = GENERIC_WRITE, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .disposition = FILE_OPEN, ++ .path = fileName, ++ .fid = &fid, ++ }; + + rc = CIFS_open(xid, &oparms, &oplock, NULL); + if (rc) +diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c +index ad4208bf1e32..1bf61778f44c 100644 +--- a/fs/cifs/dir.c ++++ b/fs/cifs/dir.c +@@ -304,15 +304,16 @@ static int cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned + if (!tcon->unix_ext && (mode & S_IWUGO) == 0) + create_options |= CREATE_OPTION_READONLY; + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = desired_access; +- oparms.create_options = cifs_create_options(cifs_sb, create_options); +- oparms.disposition = disposition; +- oparms.path = full_path; +- oparms.fid = fid; +- oparms.reconnect = false; +- oparms.mode = mode; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = desired_access, ++ .create_options = cifs_create_options(cifs_sb, create_options), ++ .disposition = disposition, ++ .path = full_path, ++ .fid = fid, ++ .mode = mode, ++ }; + rc = server->ops->open(xid, &oparms, oplock, buf); + if (rc) { + cifs_dbg(FYI, "cifs_create returned 0x%x\n", rc); +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index 7eb476a23701..e216bc9b7abf 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -260,14 +260,15 @@ static int cifs_nt_open(const char *full_path, struct inode *inode, struct cifs_ + if (f_flags & O_DIRECT) + create_options |= CREATE_NO_BUFFER; + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = desired_access; +- oparms.create_options = cifs_create_options(cifs_sb, create_options); +- oparms.disposition = disposition; +- oparms.path = full_path; +- oparms.fid = fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = desired_access, ++ .create_options = cifs_create_options(cifs_sb, create_options), ++ .disposition = disposition, ++ .path = full_path, ++ .fid = fid, ++ }; + + rc = server->ops->open(xid, &oparms, oplock, buf); + if (rc) +@@ -848,14 +849,16 @@ cifs_reopen_file(struct cifsFileInfo *cfile, bool can_flush) + if (server->ops->get_lease_key) + server->ops->get_lease_key(inode, &cfile->fid); + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = desired_access; +- oparms.create_options = cifs_create_options(cifs_sb, create_options); +- oparms.disposition = disposition; +- oparms.path = full_path; +- oparms.fid = &cfile->fid; +- oparms.reconnect = true; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = desired_access, ++ .create_options = cifs_create_options(cifs_sb, create_options), ++ .disposition = disposition, ++ .path = full_path, ++ .fid = &cfile->fid, ++ .reconnect = true, ++ }; + + /* + * Can not refresh inode by passing in file_info buf to be returned by +diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c +index f145a59af89b..7d0cc39d2921 100644 +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -508,14 +508,15 @@ cifs_sfu_type(struct cifs_fattr *fattr, const char *path, + return PTR_ERR(tlink); + tcon = tlink_tcon(tlink); + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = GENERIC_READ; +- oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); +- oparms.disposition = FILE_OPEN; +- oparms.path = path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = GENERIC_READ, ++ .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), ++ .disposition = FILE_OPEN, ++ .path = path, ++ .fid = &fid, ++ }; + + if (tcon->ses->server->oplocks) + oplock = REQ_OPLOCK; +@@ -1518,14 +1519,15 @@ cifs_rename_pending_delete(const char *full_path, struct dentry *dentry, + goto out; + } + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = DELETE | FILE_WRITE_ATTRIBUTES; +- oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); +- oparms.disposition = FILE_OPEN; +- oparms.path = full_path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = DELETE | FILE_WRITE_ATTRIBUTES, ++ .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), ++ .disposition = FILE_OPEN, ++ .path = full_path, ++ .fid = &fid, ++ }; + + rc = CIFS_open(xid, &oparms, &oplock, NULL); + if (rc != 0) +@@ -2112,15 +2114,16 @@ cifs_do_rename(const unsigned int xid, struct dentry *from_dentry, + if (to_dentry->d_parent != from_dentry->d_parent) + goto do_rename_exit; + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- /* open the file to be renamed -- we need DELETE perms */ +- oparms.desired_access = DELETE; +- oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); +- oparms.disposition = FILE_OPEN; +- oparms.path = from_path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ /* open the file to be renamed -- we need DELETE perms */ ++ .desired_access = DELETE, ++ .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), ++ .disposition = FILE_OPEN, ++ .path = from_path, ++ .fid = &fid, ++ }; + + rc = CIFS_open(xid, &oparms, &oplock, NULL); + if (rc == 0) { +diff --git a/fs/cifs/link.c b/fs/cifs/link.c +index a5a097a69983..d937eedd74fb 100644 +--- a/fs/cifs/link.c ++++ b/fs/cifs/link.c +@@ -271,14 +271,15 @@ cifs_query_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, + int buf_type = CIFS_NO_BUFFER; + FILE_ALL_INFO file_info; + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = GENERIC_READ; +- oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); +- oparms.disposition = FILE_OPEN; +- oparms.path = path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = GENERIC_READ, ++ .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), ++ .disposition = FILE_OPEN, ++ .path = path, ++ .fid = &fid, ++ }; + + rc = CIFS_open(xid, &oparms, &oplock, &file_info); + if (rc) +@@ -313,14 +314,15 @@ cifs_create_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, + struct cifs_open_parms oparms; + struct cifs_io_parms io_parms = {0}; + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = GENERIC_WRITE; +- oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); +- oparms.disposition = FILE_CREATE; +- oparms.path = path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = GENERIC_WRITE, ++ .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), ++ .disposition = FILE_CREATE, ++ .path = path, ++ .fid = &fid, ++ }; + + rc = CIFS_open(xid, &oparms, &oplock, NULL); + if (rc) +@@ -355,13 +357,14 @@ smb3_query_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, + __u8 oplock = SMB2_OPLOCK_LEVEL_NONE; + struct smb2_file_all_info *pfile_info = NULL; + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = GENERIC_READ; +- oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); +- oparms.disposition = FILE_OPEN; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = GENERIC_READ, ++ .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), ++ .disposition = FILE_OPEN, ++ .fid = &fid, ++ }; + + utf16_path = cifs_convert_path_to_utf16(path, cifs_sb); + if (utf16_path == NULL) +@@ -421,14 +424,15 @@ smb3_create_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, + if (!utf16_path) + return -ENOMEM; + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = GENERIC_WRITE; +- oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); +- oparms.disposition = FILE_CREATE; +- oparms.fid = &fid; +- oparms.reconnect = false; +- oparms.mode = 0644; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = GENERIC_WRITE, ++ .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), ++ .disposition = FILE_CREATE, ++ .fid = &fid, ++ .mode = 0644, ++ }; + + rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL, + NULL, NULL); +diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c +index 4cb364454e13..abda6148be10 100644 +--- a/fs/cifs/smb1ops.c ++++ b/fs/cifs/smb1ops.c +@@ -576,14 +576,15 @@ static int cifs_query_path_info(const unsigned int xid, struct cifs_tcon *tcon, + if (!(le32_to_cpu(fi.Attributes) & ATTR_REPARSE)) + return 0; + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = FILE_READ_ATTRIBUTES; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.disposition = FILE_OPEN; +- oparms.path = full_path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = FILE_READ_ATTRIBUTES, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .disposition = FILE_OPEN, ++ .path = full_path, ++ .fid = &fid, ++ }; + + /* Need to check if this is a symbolic link or not */ + tmprc = CIFS_open(xid, &oparms, &oplock, NULL); +@@ -823,14 +824,15 @@ smb_set_file_info(struct inode *inode, const char *full_path, + goto out; + } + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = SYNCHRONIZE | FILE_WRITE_ATTRIBUTES; +- oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); +- oparms.disposition = FILE_OPEN; +- oparms.path = full_path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = SYNCHRONIZE | FILE_WRITE_ATTRIBUTES, ++ .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), ++ .disposition = FILE_OPEN, ++ .path = full_path, ++ .fid = &fid, ++ }; + + cifs_dbg(FYI, "calling SetFileInfo since SetPathInfo for times not supported by this server\n"); + rc = CIFS_open(xid, &oparms, &oplock, NULL); +@@ -998,15 +1000,16 @@ cifs_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, + goto out; + } + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = FILE_READ_ATTRIBUTES; +- oparms.create_options = cifs_create_options(cifs_sb, +- OPEN_REPARSE_POINT); +- oparms.disposition = FILE_OPEN; +- oparms.path = full_path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = FILE_READ_ATTRIBUTES, ++ .create_options = cifs_create_options(cifs_sb, ++ OPEN_REPARSE_POINT), ++ .disposition = FILE_OPEN, ++ .path = full_path, ++ .fid = &fid, ++ }; + + rc = CIFS_open(xid, &oparms, &oplock, NULL); + if (rc) +@@ -1115,15 +1118,16 @@ cifs_make_node(unsigned int xid, struct inode *inode, + + cifs_dbg(FYI, "sfu compat create special file\n"); + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = GENERIC_WRITE; +- oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR | +- CREATE_OPTION_SPECIAL); +- oparms.disposition = FILE_CREATE; +- oparms.path = full_path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = GENERIC_WRITE, ++ .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR | ++ CREATE_OPTION_SPECIAL), ++ .disposition = FILE_CREATE, ++ .path = full_path, ++ .fid = &fid, ++ }; + + if (tcon->ses->server->oplocks) + oplock = REQ_OPLOCK; +diff --git a/fs/cifs/smb2inode.c b/fs/cifs/smb2inode.c +index 8521adf9ce79..37b4cd59245d 100644 +--- a/fs/cifs/smb2inode.c ++++ b/fs/cifs/smb2inode.c +@@ -105,14 +105,15 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, + goto finished; + } + +- vars->oparms.tcon = tcon; +- vars->oparms.desired_access = desired_access; +- vars->oparms.disposition = create_disposition; +- vars->oparms.create_options = cifs_create_options(cifs_sb, create_options); +- vars->oparms.fid = &fid; +- vars->oparms.reconnect = false; +- vars->oparms.mode = mode; +- vars->oparms.cifs_sb = cifs_sb; ++ vars->oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = desired_access, ++ .disposition = create_disposition, ++ .create_options = cifs_create_options(cifs_sb, create_options), ++ .fid = &fid, ++ .mode = mode, ++ .cifs_sb = cifs_sb, ++ }; + + rqst[num_rqst].rq_iov = &vars->open_iov[0]; + rqst[num_rqst].rq_nvec = SMB2_CREATE_IOV_SIZE; +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index f22d36019ff4..43beec54710f 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -772,12 +772,13 @@ smb2_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon, + struct cifs_open_parms oparms; + struct cifs_fid fid; + +- oparms.tcon = tcon; +- oparms.desired_access = FILE_READ_ATTRIBUTES; +- oparms.disposition = FILE_OPEN; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = FILE_READ_ATTRIBUTES, ++ .disposition = FILE_OPEN, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .fid = &fid, ++ }; + + rc = SMB2_open(xid, &oparms, &srch_path, &oplock, NULL, NULL, + NULL, NULL); +@@ -817,12 +818,13 @@ smb2_is_path_accessible(const unsigned int xid, struct cifs_tcon *tcon, + if (!utf16_path) + return -ENOMEM; + +- oparms.tcon = tcon; +- oparms.desired_access = FILE_READ_ATTRIBUTES; +- oparms.disposition = FILE_OPEN; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = FILE_READ_ATTRIBUTES, ++ .disposition = FILE_OPEN, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .fid = &fid, ++ }; + + rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL, + &err_iov, &err_buftype); +@@ -1098,13 +1100,13 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, + rqst[0].rq_iov = open_iov; + rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE; + +- memset(&oparms, 0, sizeof(oparms)); +- oparms.tcon = tcon; +- oparms.desired_access = FILE_WRITE_EA; +- oparms.disposition = FILE_OPEN; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = FILE_WRITE_EA, ++ .disposition = FILE_OPEN, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .fid = &fid, ++ }; + + rc = SMB2_open_init(tcon, server, + &rqst[0], &oplock, &oparms, utf16_path); +@@ -1454,12 +1456,12 @@ smb2_ioctl_query_info(const unsigned int xid, + rqst[0].rq_iov = &vars->open_iov[0]; + rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE; + +- memset(&oparms, 0, sizeof(oparms)); +- oparms.tcon = tcon; +- oparms.disposition = FILE_OPEN; +- oparms.create_options = cifs_create_options(cifs_sb, create_options); +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .disposition = FILE_OPEN, ++ .create_options = cifs_create_options(cifs_sb, create_options), ++ .fid = &fid, ++ }; + + if (qi.flags & PASSTHRU_FSCTL) { + switch (qi.info_type & FSCTL_DEVICE_ACCESS_MASK) { +@@ -2089,12 +2091,13 @@ smb3_notify(const unsigned int xid, struct file *pfile, + } + + tcon = cifs_sb_master_tcon(cifs_sb); +- oparms.tcon = tcon; +- oparms.desired_access = FILE_READ_ATTRIBUTES | FILE_READ_DATA; +- oparms.disposition = FILE_OPEN; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = FILE_READ_ATTRIBUTES | FILE_READ_DATA, ++ .disposition = FILE_OPEN, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .fid = &fid, ++ }; + + rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL, NULL, + NULL); +@@ -2160,12 +2163,13 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon, + rqst[0].rq_iov = open_iov; + rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE; + +- oparms.tcon = tcon; +- oparms.desired_access = FILE_READ_ATTRIBUTES | FILE_READ_DATA; +- oparms.disposition = FILE_OPEN; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.fid = fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = FILE_READ_ATTRIBUTES | FILE_READ_DATA, ++ .disposition = FILE_OPEN, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .fid = fid, ++ }; + + rc = SMB2_open_init(tcon, server, + &rqst[0], &oplock, &oparms, utf16_path); +@@ -2491,12 +2495,13 @@ smb2_query_info_compound(const unsigned int xid, struct cifs_tcon *tcon, + rqst[0].rq_iov = open_iov; + rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE; + +- oparms.tcon = tcon; +- oparms.desired_access = desired_access; +- oparms.disposition = FILE_OPEN; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = desired_access, ++ .disposition = FILE_OPEN, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .fid = &fid, ++ }; + + rc = SMB2_open_init(tcon, server, + &rqst[0], &oplock, &oparms, utf16_path); +@@ -2624,12 +2629,13 @@ smb311_queryfs(const unsigned int xid, struct cifs_tcon *tcon, + if (!tcon->posix_extensions) + return smb2_queryfs(xid, tcon, cifs_sb, buf); + +- oparms.tcon = tcon; +- oparms.desired_access = FILE_READ_ATTRIBUTES; +- oparms.disposition = FILE_OPEN; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = FILE_READ_ATTRIBUTES, ++ .disposition = FILE_OPEN, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .fid = &fid, ++ }; + + rc = SMB2_open(xid, &oparms, &srch_path, &oplock, NULL, NULL, + NULL, NULL); +@@ -2917,13 +2923,13 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, + rqst[0].rq_iov = open_iov; + rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE; + +- memset(&oparms, 0, sizeof(oparms)); +- oparms.tcon = tcon; +- oparms.desired_access = FILE_READ_ATTRIBUTES; +- oparms.disposition = FILE_OPEN; +- oparms.create_options = cifs_create_options(cifs_sb, create_options); +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = FILE_READ_ATTRIBUTES, ++ .disposition = FILE_OPEN, ++ .create_options = cifs_create_options(cifs_sb, create_options), ++ .fid = &fid, ++ }; + + rc = SMB2_open_init(tcon, server, + &rqst[0], &oplock, &oparms, utf16_path); +@@ -3057,13 +3063,13 @@ smb2_query_reparse_tag(const unsigned int xid, struct cifs_tcon *tcon, + rqst[0].rq_iov = open_iov; + rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE; + +- memset(&oparms, 0, sizeof(oparms)); +- oparms.tcon = tcon; +- oparms.desired_access = FILE_READ_ATTRIBUTES; +- oparms.disposition = FILE_OPEN; +- oparms.create_options = cifs_create_options(cifs_sb, OPEN_REPARSE_POINT); +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = FILE_READ_ATTRIBUTES, ++ .disposition = FILE_OPEN, ++ .create_options = cifs_create_options(cifs_sb, OPEN_REPARSE_POINT), ++ .fid = &fid, ++ }; + + rc = SMB2_open_init(tcon, server, + &rqst[0], &oplock, &oparms, utf16_path); +@@ -3197,17 +3203,20 @@ get_smb2_acl_by_path(struct cifs_sb_info *cifs_sb, + return ERR_PTR(rc); + } + +- oparms.tcon = tcon; +- oparms.desired_access = READ_CONTROL; +- oparms.disposition = FILE_OPEN; +- /* +- * When querying an ACL, even if the file is a symlink we want to open +- * the source not the target, and so the protocol requires that the +- * client specify this flag when opening a reparse point +- */ +- oparms.create_options = cifs_create_options(cifs_sb, 0) | OPEN_REPARSE_POINT; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = READ_CONTROL, ++ .disposition = FILE_OPEN, ++ /* ++ * When querying an ACL, even if the file is a symlink ++ * we want to open the source not the target, and so ++ * the protocol requires that the client specify this ++ * flag when opening a reparse point ++ */ ++ .create_options = cifs_create_options(cifs_sb, 0) | ++ OPEN_REPARSE_POINT, ++ .fid = &fid, ++ }; + + if (info & SACL_SECINFO) + oparms.desired_access |= SYSTEM_SECURITY; +@@ -3266,13 +3275,14 @@ set_smb2_acl(struct cifs_ntsd *pnntsd, __u32 acllen, + return rc; + } + +- oparms.tcon = tcon; +- oparms.desired_access = access_flags; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.disposition = FILE_OPEN; +- oparms.path = path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = access_flags, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .disposition = FILE_OPEN, ++ .path = path, ++ .fid = &fid, ++ }; + + rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL, + NULL, NULL); +@@ -5139,15 +5149,16 @@ smb2_make_node(unsigned int xid, struct inode *inode, + + cifs_dbg(FYI, "sfu compat create special file\n"); + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = GENERIC_WRITE; +- oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR | +- CREATE_OPTION_SPECIAL); +- oparms.disposition = FILE_CREATE; +- oparms.path = full_path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = GENERIC_WRITE, ++ .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR | ++ CREATE_OPTION_SPECIAL), ++ .disposition = FILE_CREATE, ++ .path = full_path, ++ .fid = &fid, ++ }; + + if (tcon->ses->server->oplocks) + oplock = REQ_OPLOCK; +-- +2.39.2 + + diff --git a/patches.suse/cifs-Fix-use-after-free-in-rdata-read_into_pages-.patch b/patches.suse/cifs-Fix-use-after-free-in-rdata-read_into_pages-.patch new file mode 100644 index 0000000..12f9748 --- /dev/null +++ b/patches.suse/cifs-Fix-use-after-free-in-rdata-read_into_pages-.patch @@ -0,0 +1,127 @@ +From: ZhaoLong Wang +Date: Mon, 6 Feb 2023 09:10:09 +0800 +Subject: [PATCH] cifs: Fix use-after-free in rdata->read_into_pages() +Git-commit: aa5465aeca3c66fecdf7efcf554aed79b4c4b211 +References: git-fixes +Patch-mainline: v6.2-rc8 + +When the network status is unstable, use-after-free may occur when +read data from the server. + + BUG: KASAN: use-after-free in readpages_fill_pages+0x14c/0x7e0 + + Call Trace: + + dump_stack_lvl+0x38/0x4c + print_report+0x16f/0x4a6 + kasan_report+0xb7/0x130 + readpages_fill_pages+0x14c/0x7e0 + cifs_readv_receive+0x46d/0xa40 + cifs_demultiplex_thread+0x121c/0x1490 + kthread+0x16b/0x1a0 + ret_from_fork+0x2c/0x50 + + + Allocated by task 2535: + kasan_save_stack+0x22/0x50 + kasan_set_track+0x25/0x30 + __kasan_kmalloc+0x82/0x90 + cifs_readdata_direct_alloc+0x2c/0x110 + cifs_readdata_alloc+0x2d/0x60 + cifs_readahead+0x393/0xfe0 + read_pages+0x12f/0x470 + page_cache_ra_unbounded+0x1b1/0x240 + filemap_get_pages+0x1c8/0x9a0 + filemap_read+0x1c0/0x540 + cifs_strict_readv+0x21b/0x240 + vfs_read+0x395/0x4b0 + ksys_read+0xb8/0x150 + do_syscall_64+0x3f/0x90 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + + Freed by task 79: + kasan_save_stack+0x22/0x50 + kasan_set_track+0x25/0x30 + kasan_save_free_info+0x2e/0x50 + __kasan_slab_free+0x10e/0x1a0 + __kmem_cache_free+0x7a/0x1a0 + cifs_readdata_release+0x49/0x60 + process_one_work+0x46c/0x760 + worker_thread+0x2a4/0x6f0 + kthread+0x16b/0x1a0 + ret_from_fork+0x2c/0x50 + + Last potentially related work creation: + kasan_save_stack+0x22/0x50 + __kasan_record_aux_stack+0x95/0xb0 + insert_work+0x2b/0x130 + __queue_work+0x1fe/0x660 + queue_work_on+0x4b/0x60 + smb2_readv_callback+0x396/0x800 + cifs_abort_connection+0x474/0x6a0 + cifs_reconnect+0x5cb/0xa50 + cifs_readv_from_socket.cold+0x22/0x6c + cifs_read_page_from_socket+0xc1/0x100 + readpages_fill_pages.cold+0x2f/0x46 + cifs_readv_receive+0x46d/0xa40 + cifs_demultiplex_thread+0x121c/0x1490 + kthread+0x16b/0x1a0 + ret_from_fork+0x2c/0x50 + +The following function calls will cause UAF of the rdata pointer. + +readpages_fill_pages + cifs_read_page_from_socket + cifs_readv_from_socket + cifs_reconnect + __cifs_reconnect + cifs_abort_connection + mid->callback() --> smb2_readv_callback + queue_work(&rdata->work) # if the worker completes first, + # the rdata is freed + cifs_readv_complete + kref_put + cifs_readdata_release + kfree(rdata) + return rdata->... # UAF in readpages_fill_pages() + +Similarly, this problem also occurs in the uncache_fill_pages(). + +Fix this by adjusts the order of condition judgment in the return +statement. + +Signed-off-by: ZhaoLong Wang +Cc: stable@vger.kernel.org +Acked-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/file.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index 22dfc1f8b4f1..b8d1cbadb689 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -3889,7 +3889,7 @@ uncached_fill_pages(struct TCP_Server_Info *server, + rdata->got_bytes += result; + } + +- return rdata->got_bytes > 0 && result != -ECONNABORTED ? ++ return result != -ECONNABORTED && rdata->got_bytes > 0 ? + rdata->got_bytes : result; + } + +@@ -4665,7 +4665,7 @@ readpages_fill_pages(struct TCP_Server_Info *server, + rdata->got_bytes += result; + } + +- return rdata->got_bytes > 0 && result != -ECONNABORTED ? ++ return result != -ECONNABORTED && rdata->got_bytes > 0 ? + rdata->got_bytes : result; + } + +-- +2.39.2 + + diff --git a/patches.suse/cifs-Fix-warning-and-UAF-when-destroy-the-MR-list.patch b/patches.suse/cifs-Fix-warning-and-UAF-when-destroy-the-MR-list.patch new file mode 100644 index 0000000..4871e0a --- /dev/null +++ b/patches.suse/cifs-Fix-warning-and-UAF-when-destroy-the-MR-list.patch @@ -0,0 +1,132 @@ +From: Zhang Xiaoxu +Date: Fri, 18 Nov 2022 16:42:08 +0800 +Subject: [PATCH] cifs: Fix warning and UAF when destroy the MR list +Git-commit: 3e161c2791f8e661eed24a2c624087084d910215 +References: git-fixes +Patch-mainline: v6.3-rc1 + +If the MR allocate failed, the MR recovery work not initialized +and list not cleared. Then will be warning and UAF when release +the MR: + + WARNING: CPU: 4 PID: 824 at kernel/workqueue.c:3066 __flush_work.isra.0+0xf7/0x110 + CPU: 4 PID: 824 Comm: mount.cifs Not tainted 6.1.0-rc5+ #82 + RIP: 0010:__flush_work.isra.0+0xf7/0x110 + Call Trace: + + __cancel_work_timer+0x2ba/0x2e0 + smbd_destroy+0x4e1/0x990 + _smbd_get_connection+0x1cbd/0x2110 + smbd_get_connection+0x21/0x40 + cifs_get_tcp_session+0x8ef/0xda0 + mount_get_conns+0x60/0x750 + cifs_mount+0x103/0xd00 + cifs_smb3_do_mount+0x1dd/0xcb0 + smb3_get_tree+0x1d5/0x300 + vfs_get_tree+0x41/0xf0 + path_mount+0x9b3/0xdd0 + __x64_sys_mount+0x190/0x1d0 + do_syscall_64+0x35/0x80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + + BUG: KASAN: use-after-free in smbd_destroy+0x4fc/0x990 + Read of size 8 at addr ffff88810b156a08 by task mount.cifs/824 + CPU: 4 PID: 824 Comm: mount.cifs Tainted: G W 6.1.0-rc5+ #82 + Call Trace: + dump_stack_lvl+0x34/0x44 + print_report+0x171/0x472 + kasan_report+0xad/0x130 + smbd_destroy+0x4fc/0x990 + _smbd_get_connection+0x1cbd/0x2110 + smbd_get_connection+0x21/0x40 + cifs_get_tcp_session+0x8ef/0xda0 + mount_get_conns+0x60/0x750 + cifs_mount+0x103/0xd00 + cifs_smb3_do_mount+0x1dd/0xcb0 + smb3_get_tree+0x1d5/0x300 + vfs_get_tree+0x41/0xf0 + path_mount+0x9b3/0xdd0 + __x64_sys_mount+0x190/0x1d0 + do_syscall_64+0x35/0x80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + + Allocated by task 824: + kasan_save_stack+0x1e/0x40 + kasan_set_track+0x21/0x30 + __kasan_kmalloc+0x7a/0x90 + _smbd_get_connection+0x1b6f/0x2110 + smbd_get_connection+0x21/0x40 + cifs_get_tcp_session+0x8ef/0xda0 + mount_get_conns+0x60/0x750 + cifs_mount+0x103/0xd00 + cifs_smb3_do_mount+0x1dd/0xcb0 + smb3_get_tree+0x1d5/0x300 + vfs_get_tree+0x41/0xf0 + path_mount+0x9b3/0xdd0 + __x64_sys_mount+0x190/0x1d0 + do_syscall_64+0x35/0x80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + + Freed by task 824: + kasan_save_stack+0x1e/0x40 + kasan_set_track+0x21/0x30 + kasan_save_free_info+0x2a/0x40 + ____kasan_slab_free+0x143/0x1b0 + __kmem_cache_free+0xc8/0x330 + _smbd_get_connection+0x1c6a/0x2110 + smbd_get_connection+0x21/0x40 + cifs_get_tcp_session+0x8ef/0xda0 + mount_get_conns+0x60/0x750 + cifs_mount+0x103/0xd00 + cifs_smb3_do_mount+0x1dd/0xcb0 + smb3_get_tree+0x1d5/0x300 + vfs_get_tree+0x41/0xf0 + path_mount+0x9b3/0xdd0 + __x64_sys_mount+0x190/0x1d0 + do_syscall_64+0x35/0x80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Let's initialize the MR recovery work before MR allocate to prevent +the warning, remove the MRs from the list to prevent the UAF. + +Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration") +Acked-by: Paulo Alcantara (SUSE) +Reviewed-by: Tom Talpey +Signed-off-by: Zhang Xiaoxu +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/smbdirect.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c +index 101dab87cad1..cf923f211c51 100644 +--- a/fs/cifs/smbdirect.c ++++ b/fs/cifs/smbdirect.c +@@ -2218,6 +2218,7 @@ static int allocate_mr_list(struct smbd_connection *info) + atomic_set(&info->mr_ready_count, 0); + atomic_set(&info->mr_used_count, 0); + init_waitqueue_head(&info->wait_for_mr_cleanup); ++ INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work); + /* Allocate more MRs (2x) than hardware responder_resources */ + for (i = 0; i < info->responder_resources * 2; i++) { + smbdirect_mr = kzalloc(sizeof(*smbdirect_mr), GFP_KERNEL); +@@ -2245,13 +2246,13 @@ static int allocate_mr_list(struct smbd_connection *info) + list_add_tail(&smbdirect_mr->list, &info->mr_list); + atomic_inc(&info->mr_ready_count); + } +- INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work); + return 0; + + out: + kfree(smbdirect_mr); + + list_for_each_entry_safe(smbdirect_mr, tmp, &info->mr_list, list) { ++ list_del(&smbdirect_mr->list); + ib_dereg_mr(smbdirect_mr->mr); + kfree(smbdirect_mr->sgl); + kfree(smbdirect_mr); +-- +2.39.2 + + diff --git a/patches.suse/cifs-Get-rid-of-unneeded-conditional-in-the-smb2_get_aead_req-.patch b/patches.suse/cifs-Get-rid-of-unneeded-conditional-in-the-smb2_get_aead_req-.patch new file mode 100644 index 0000000..3063211 --- /dev/null +++ b/patches.suse/cifs-Get-rid-of-unneeded-conditional-in-the-smb2_get_aead_req-.patch @@ -0,0 +1,66 @@ +From: Andy Shevchenko +Date: Fri, 20 Jan 2023 14:08:57 +0200 +Subject: [PATCH] cifs: Get rid of unneeded conditional in the + smb2_get_aead_req() +Git-commit: d4fba63fe1f78dba749cf7aa04c1dff4b8666eb1 +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +In the smb2_get_aead_req() the skip variable is used only for +the very first iteration of the two nested loops, which means +it's basically in invariant to those loops. Hence, instead of +using conditional on each iteration, unconditionally assign +the 'skip' variable before the loops and at the end of the +inner loop. + +Signed-off-by: Andy Shevchenko +Reviewed-by: Paulo Alcantara (SUSE) +Reviewed-by: David Howells +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/smb2ops.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index e6bcd2baf446..157a19f371d6 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -4274,6 +4274,12 @@ static void *smb2_get_aead_req(struct crypto_aead *tfm, const struct smb_rqst *r + sg_init_table(*sgl, num_sgs); + sg = *sgl; + ++ /* ++ * The first rqst has a transform header where the ++ * first 20 bytes are not part of the encrypted blob. ++ */ ++ skip = 20; ++ + /* Assumes the first rqst has a transform header as the first iov. + * I.e. + * rqst[0].rq_iov[0] is transform header +@@ -4281,17 +4287,15 @@ static void *smb2_get_aead_req(struct crypto_aead *tfm, const struct smb_rqst *r + * rqst[1+].rq_iov[0+] data to be encrypted/decrypted + */ + for (i = 0; i < num_rqst; i++) { +- /* +- * The first rqst has a transform header where the +- * first 20 bytes are not part of the encrypted blob. +- */ + for (j = 0; j < rqst[i].rq_nvec; j++) { + struct kvec *iov = &rqst[i].rq_iov[j]; + +- skip = (i == 0) && (j == 0) ? 20 : 0; + addr = (unsigned long)iov->iov_base + skip; + len = iov->iov_len - skip; + sg = cifs_sg_set_buf(sg, (void *)addr, len); ++ ++ /* See the above comment on the 'skip' assignment */ ++ skip = 0; + } + for (j = 0; j < rqst[i].rq_npages; j++) { + rqst_page_get_length(&rqst[i], j, &len, &off); +-- +2.39.2 + + diff --git a/patches.suse/cifs-Replace-remaining-1-element-arrays.patch b/patches.suse/cifs-Replace-remaining-1-element-arrays.patch new file mode 100644 index 0000000..c27c70b --- /dev/null +++ b/patches.suse/cifs-Replace-remaining-1-element-arrays.patch @@ -0,0 +1,535 @@ +From: Kees Cook +Date: Tue, 14 Feb 2023 16:09:45 -0800 +Subject: [PATCH] cifs: Replace remaining 1-element arrays +Git-commit: 35235e19b393b54db0e0d7c424d658ba45f20468 +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +The kernel is globally removing the ambiguous 0-length and 1-element +arrays in favor of flexible arrays, so that we can gain both compile-time +and run-time array bounds checking[1]. + +Replace the trailing 1-element array with a flexible array in the +following structures: + + struct cifs_spnego_msg + struct cifs_quota_data + struct get_dfs_referral_rsp + struct file_alt_name_info + NEGOTIATE_RSP + SESSION_SETUP_ANDX + TCONX_REQ + TCONX_RSP + TCONX_RSP_EXT + ECHO_REQ + ECHO_RSP + OPEN_REQ + OPENX_REQ + LOCK_REQ + RENAME_REQ + COPY_REQ + COPY_RSP + NT_RENAME_REQ + DELETE_FILE_REQ + DELETE_DIRECTORY_REQ + CREATE_DIRECTORY_REQ + QUERY_INFORMATION_REQ + SETATTR_REQ + TRANSACT_IOCTL_REQ + TRANSACT_CHANGE_NOTIFY_REQ + TRANSACTION2_QPI_REQ + TRANSACTION2_SPI_REQ + TRANSACTION2_FFIRST_REQ + TRANSACTION2_GET_DFS_REFER_REQ + FILE_UNIX_LINK_INFO + FILE_DIRECTORY_INFO + FILE_FULL_DIRECTORY_INFO + SEARCH_ID_FULL_DIR_INFO + FILE_BOTH_DIRECTORY_INFO + FIND_FILE_STANDARD_INFO + +Replace the trailing 1-element array with a flexible array, but leave +the existing structure padding: + + FILE_ALL_INFO + FILE_UNIX_INFO + +Remove unused structures: + + struct gea + struct gealist + +Adjust all related size calculations to match the changes to sizeof(). + +No machine code output differences are produced after these changes. + +[1] For lots of details, see both: + https://docs.kernel.org/process/deprecated.html#zero-length-and-one-element-arrays + https://people.kernel.org/kees/bounded-flexible-arrays-in-c + +Cc: Steve French +Cc: Paulo Alcantara +Cc: Ronnie Sahlberg +Cc: Shyam Prasad N +Cc: linux-cifs@vger.kernel.org +Cc: samba-technical@lists.samba.org +Signed-off-by: Kees Cook +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/cifs_spnego.h | 2 +- + fs/cifs/cifspdu.h | 94 +++++++++++++++++++++---------------------- + fs/cifs/readdir.c | 6 +-- + fs/cifs/smb2pdu.c | 4 +- + fs/cifs/smb2pdu.h | 2 +- + 5 files changed, 52 insertions(+), 56 deletions(-) + +diff --git a/fs/cifs/cifs_spnego.h b/fs/cifs/cifs_spnego.h +index 7f102ffeb675..e4d751b0c812 100644 +--- a/fs/cifs/cifs_spnego.h ++++ b/fs/cifs/cifs_spnego.h +@@ -24,7 +24,7 @@ struct cifs_spnego_msg { + uint32_t flags; + uint32_t sesskey_len; + uint32_t secblob_len; +- uint8_t data[1]; ++ uint8_t data[]; + }; + + #ifdef __KERNEL__ +diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h +index add73be4902c..445e3eaebcc1 100644 +--- a/fs/cifs/cifspdu.h ++++ b/fs/cifs/cifspdu.h +@@ -562,7 +562,7 @@ typedef union smb_com_session_setup_andx { + __u32 Reserved; + __le32 Capabilities; /* see below */ + __le16 ByteCount; +- unsigned char SecurityBlob[1]; /* followed by */ ++ unsigned char SecurityBlob[]; /* followed by */ + /* STRING NativeOS */ + /* STRING NativeLanMan */ + } __attribute__((packed)) req; /* NTLM request format (with +@@ -582,7 +582,7 @@ typedef union smb_com_session_setup_andx { + __u32 Reserved; /* see below */ + __le32 Capabilities; + __le16 ByteCount; +- unsigned char CaseInsensitivePassword[1]; /* followed by: */ ++ unsigned char CaseInsensitivePassword[]; /* followed by: */ + /* unsigned char * CaseSensitivePassword; */ + /* STRING AccountName */ + /* STRING PrimaryDomain */ +@@ -599,7 +599,7 @@ typedef union smb_com_session_setup_andx { + __le16 Action; /* see below */ + __le16 SecurityBlobLength; + __u16 ByteCount; +- unsigned char SecurityBlob[1]; /* followed by */ ++ unsigned char SecurityBlob[]; /* followed by */ + /* unsigned char * NativeOS; */ + /* unsigned char * NativeLanMan; */ + /* unsigned char * PrimaryDomain; */ +@@ -618,7 +618,7 @@ typedef union smb_com_session_setup_andx { + __le16 PasswordLength; + __u32 Reserved; /* encrypt key len and offset */ + __le16 ByteCount; +- unsigned char AccountPassword[1]; /* followed by */ ++ unsigned char AccountPassword[]; /* followed by */ + /* STRING AccountName */ + /* STRING PrimaryDomain */ + /* STRING NativeOS */ +@@ -632,7 +632,7 @@ typedef union smb_com_session_setup_andx { + __le16 AndXOffset; + __le16 Action; /* see below */ + __u16 ByteCount; +- unsigned char NativeOS[1]; /* followed by */ ++ unsigned char NativeOS[]; /* followed by */ + /* unsigned char * NativeLanMan; */ + /* unsigned char * PrimaryDomain; */ + } __attribute__((packed)) old_resp; /* pre-NTLM (LANMAN2.1) response */ +@@ -693,7 +693,7 @@ typedef struct smb_com_tconx_req { + __le16 Flags; /* see below */ + __le16 PasswordLength; + __le16 ByteCount; +- unsigned char Password[1]; /* followed by */ ++ unsigned char Password[]; /* followed by */ + /* STRING Path *//* \\server\share name */ + /* STRING Service */ + } __attribute__((packed)) TCONX_REQ; +@@ -705,7 +705,7 @@ typedef struct smb_com_tconx_rsp { + __le16 AndXOffset; + __le16 OptionalSupport; /* see below */ + __u16 ByteCount; +- unsigned char Service[1]; /* always ASCII, not Unicode */ ++ unsigned char Service[]; /* always ASCII, not Unicode */ + /* STRING NativeFileSystem */ + } __attribute__((packed)) TCONX_RSP; + +@@ -718,7 +718,7 @@ typedef struct smb_com_tconx_rsp_ext { + __le32 MaximalShareAccessRights; + __le32 GuestMaximalShareAccessRights; + __u16 ByteCount; +- unsigned char Service[1]; /* always ASCII, not Unicode */ ++ unsigned char Service[]; /* always ASCII, not Unicode */ + /* STRING NativeFileSystem */ + } __attribute__((packed)) TCONX_RSP_EXT; + +@@ -755,14 +755,14 @@ typedef struct smb_com_echo_req { + struct smb_hdr hdr; + __le16 EchoCount; + __le16 ByteCount; +- char Data[1]; ++ char Data[]; + } __attribute__((packed)) ECHO_REQ; + + typedef struct smb_com_echo_rsp { + struct smb_hdr hdr; + __le16 SequenceNumber; + __le16 ByteCount; +- char Data[1]; ++ char Data[]; + } __attribute__((packed)) ECHO_RSP; + + typedef struct smb_com_logoff_andx_req { +@@ -862,7 +862,7 @@ typedef struct smb_com_open_req { /* also handles create */ + __le32 ImpersonationLevel; + __u8 SecurityFlags; + __le16 ByteCount; +- char fileName[1]; ++ char fileName[]; + } __attribute__((packed)) OPEN_REQ; + + /* open response: oplock levels */ +@@ -937,7 +937,7 @@ typedef struct smb_com_openx_req { + __le32 Timeout; + __le32 Reserved; + __le16 ByteCount; /* file name follows */ +- char fileName[1]; ++ char fileName[]; + } __attribute__((packed)) OPENX_REQ; + + typedef struct smb_com_openx_rsp { +@@ -1085,7 +1085,7 @@ typedef struct smb_com_lock_req { + __le16 NumberOfUnlocks; + __le16 NumberOfLocks; + __le16 ByteCount; +- LOCKING_ANDX_RANGE Locks[1]; ++ LOCKING_ANDX_RANGE Locks[]; + } __attribute__((packed)) LOCK_REQ; + + /* lock type */ +@@ -1114,7 +1114,7 @@ typedef struct smb_com_rename_req { + __le16 SearchAttributes; /* target file attributes */ + __le16 ByteCount; + __u8 BufferFormat; /* 4 = ASCII or Unicode */ +- unsigned char OldFileName[1]; ++ unsigned char OldFileName[]; + /* followed by __u8 BufferFormat2 */ + /* followed by NewFileName */ + } __attribute__((packed)) RENAME_REQ; +@@ -1134,7 +1134,7 @@ typedef struct smb_com_copy_req { + __le16 Flags; + __le16 ByteCount; + __u8 BufferFormat; /* 4 = ASCII or Unicode */ +- unsigned char OldFileName[1]; ++ unsigned char OldFileName[]; + /* followed by __u8 BufferFormat2 */ + /* followed by NewFileName string */ + } __attribute__((packed)) COPY_REQ; +@@ -1144,7 +1144,7 @@ typedef struct smb_com_copy_rsp { + __le16 CopyCount; /* number of files copied */ + __u16 ByteCount; /* may be zero */ + __u8 BufferFormat; /* 0x04 - only present if errored file follows */ +- unsigned char ErrorFileName[1]; /* only present if error in copy */ ++ unsigned char ErrorFileName[]; /* only present if error in copy */ + } __attribute__((packed)) COPY_RSP; + + #define CREATE_HARD_LINK 0x103 +@@ -1158,7 +1158,7 @@ typedef struct smb_com_nt_rename_req { /* A5 - also used for create hardlink */ + __le32 ClusterCount; + __le16 ByteCount; + __u8 BufferFormat; /* 4 = ASCII or Unicode */ +- unsigned char OldFileName[1]; ++ unsigned char OldFileName[]; + /* followed by __u8 BufferFormat2 */ + /* followed by NewFileName */ + } __attribute__((packed)) NT_RENAME_REQ; +@@ -1173,7 +1173,7 @@ typedef struct smb_com_delete_file_req { + __le16 SearchAttributes; + __le16 ByteCount; + __u8 BufferFormat; /* 4 = ASCII */ +- unsigned char fileName[1]; ++ unsigned char fileName[]; + } __attribute__((packed)) DELETE_FILE_REQ; + + typedef struct smb_com_delete_file_rsp { +@@ -1185,7 +1185,7 @@ typedef struct smb_com_delete_directory_req { + struct smb_hdr hdr; /* wct = 0 */ + __le16 ByteCount; + __u8 BufferFormat; /* 4 = ASCII */ +- unsigned char DirName[1]; ++ unsigned char DirName[]; + } __attribute__((packed)) DELETE_DIRECTORY_REQ; + + typedef struct smb_com_delete_directory_rsp { +@@ -1197,7 +1197,7 @@ typedef struct smb_com_create_directory_req { + struct smb_hdr hdr; /* wct = 0 */ + __le16 ByteCount; + __u8 BufferFormat; /* 4 = ASCII */ +- unsigned char DirName[1]; ++ unsigned char DirName[]; + } __attribute__((packed)) CREATE_DIRECTORY_REQ; + + typedef struct smb_com_create_directory_rsp { +@@ -1209,7 +1209,7 @@ typedef struct smb_com_query_information_req { + struct smb_hdr hdr; /* wct = 0 */ + __le16 ByteCount; /* 1 + namelen + 1 */ + __u8 BufferFormat; /* 4 = ASCII */ +- unsigned char FileName[1]; ++ unsigned char FileName[]; + } __attribute__((packed)) QUERY_INFORMATION_REQ; + + typedef struct smb_com_query_information_rsp { +@@ -1229,7 +1229,7 @@ typedef struct smb_com_setattr_req { + __le16 reserved[5]; /* must be zero */ + __u16 ByteCount; + __u8 BufferFormat; /* 4 = ASCII */ +- unsigned char fileName[1]; ++ unsigned char fileName[]; + } __attribute__((packed)) SETATTR_REQ; + + typedef struct smb_com_setattr_rsp { +@@ -1311,7 +1311,7 @@ typedef struct smb_com_transaction_ioctl_req { + __u8 IsRootFlag; /* 1 = apply command to root of share (must be DFS) */ + __le16 ByteCount; + __u8 Pad[3]; +- __u8 Data[1]; ++ __u8 Data[]; + } __attribute__((packed)) TRANSACT_IOCTL_REQ; + + typedef struct smb_com_transaction_compr_ioctl_req { +@@ -1430,7 +1430,7 @@ typedef struct smb_com_transaction_change_notify_req { + __u8 Reserved2; + __le16 ByteCount; + /* __u8 Pad[3];*/ +-/* __u8 Data[1];*/ ++/* __u8 Data[];*/ + } __attribute__((packed)) TRANSACT_CHANGE_NOTIFY_REQ; + + /* BB eventually change to use generic ntransact rsp struct +@@ -1519,7 +1519,7 @@ struct cifs_quota_data { + __u64 space_used; + __u64 soft_limit; + __u64 hard_limit; +- char sid[1]; /* variable size? */ ++ char sid[]; /* variable size? */ + } __attribute__((packed)); + + /* quota sub commands */ +@@ -1671,7 +1671,7 @@ typedef struct smb_com_transaction2_qpi_req { + __u8 Pad; + __le16 InformationLevel; + __u32 Reserved4; +- char FileName[1]; ++ char FileName[]; + } __attribute__((packed)) TRANSACTION2_QPI_REQ; + + typedef struct smb_com_transaction2_qpi_rsp { +@@ -1704,7 +1704,7 @@ typedef struct smb_com_transaction2_spi_req { + __u16 Pad1; + __le16 InformationLevel; + __u32 Reserved4; +- char FileName[1]; ++ char FileName[]; + } __attribute__((packed)) TRANSACTION2_SPI_REQ; + + typedef struct smb_com_transaction2_spi_rsp { +@@ -1809,7 +1809,7 @@ typedef struct smb_com_transaction2_ffirst_req { + __le16 SearchFlags; + __le16 InformationLevel; + __le32 SearchStorageType; +- char FileName[1]; ++ char FileName[]; + } __attribute__((packed)) TRANSACTION2_FFIRST_REQ; + + typedef struct smb_com_transaction2_ffirst_rsp { +@@ -2020,7 +2020,7 @@ typedef struct smb_com_transaction2_get_dfs_refer_req { + perhaps?) followed by one byte pad - doesn't + seem to matter though */ + __le16 MaxReferralLevel; +- char RequestFileName[1]; ++ char RequestFileName[]; + } __attribute__((packed)) TRANSACTION2_GET_DFS_REFER_REQ; + + #define DFS_VERSION cpu_to_le16(0x0003) +@@ -2049,7 +2049,7 @@ struct get_dfs_referral_rsp { + __le16 PathConsumed; + __le16 NumberOfReferrals; + __le32 DFSFlags; +- REFERRAL3 referrals[1]; /* array of level 3 dfs_referral structures */ ++ REFERRAL3 referrals[]; /* array of level 3 dfs_referral structures */ + /* followed by the strings pointed to by the referral structures */ + } __packed; + +@@ -2284,7 +2284,10 @@ typedef struct { /* data block encoding of response to level 263 QPathInfo */ + __le32 Mode; + __le32 AlignmentRequirement; + __le32 FileNameLength; +- char FileName[1]; ++ union { ++ char __pad; ++ DECLARE_FLEX_ARRAY(char, FileName); ++ }; + } __attribute__((packed)) FILE_ALL_INFO; /* level 0x107 QPathInfo */ + + typedef struct { +@@ -2322,7 +2325,7 @@ typedef struct { + } __attribute__((packed)) FILE_UNIX_BASIC_INFO; /* level 0x200 QPathInfo */ + + typedef struct { +- char LinkDest[1]; ++ DECLARE_FLEX_ARRAY(char, LinkDest); + } __attribute__((packed)) FILE_UNIX_LINK_INFO; /* level 0x201 QPathInfo */ + + /* The following three structures are needed only for +@@ -2371,7 +2374,7 @@ struct file_end_of_file_info { + } __attribute__((packed)); /* size info, level 0x104 for set, 0x106 for query */ + + struct file_alt_name_info { +- __u8 alt_name[1]; ++ DECLARE_FLEX_ARRAY(__u8, alt_name); + } __attribute__((packed)); /* level 0x0108 */ + + struct file_stream_info { +@@ -2480,7 +2483,10 @@ typedef struct { + __le32 NextEntryOffset; + __u32 ResumeKey; /* as with FileIndex - no need to convert */ + FILE_UNIX_BASIC_INFO basic; +- char FileName[1]; ++ union { ++ char __pad; ++ DECLARE_FLEX_ARRAY(char, FileName); ++ }; + } __attribute__((packed)) FILE_UNIX_INFO; /* level 0x202 */ + + typedef struct { +@@ -2494,7 +2500,7 @@ typedef struct { + __le64 AllocationSize; + __le32 ExtFileAttributes; + __le32 FileNameLength; +- char FileName[1]; ++ char FileName[]; + } __attribute__((packed)) FILE_DIRECTORY_INFO; /* level 0x101 FF resp data */ + + typedef struct { +@@ -2509,7 +2515,7 @@ typedef struct { + __le32 ExtFileAttributes; + __le32 FileNameLength; + __le32 EaSize; /* length of the xattrs */ +- char FileName[1]; ++ char FileName[]; + } __attribute__((packed)) FILE_FULL_DIRECTORY_INFO; /* level 0x102 rsp data */ + + typedef struct { +@@ -2526,7 +2532,7 @@ typedef struct { + __le32 EaSize; /* EA size */ + __le32 Reserved; + __le64 UniqueId; /* inode num - le since Samba puts ino in low 32 bit*/ +- char FileName[1]; ++ char FileName[]; + } __attribute__((packed)) SEARCH_ID_FULL_DIR_INFO; /* level 0x105 FF rsp data */ + + typedef struct { +@@ -2544,7 +2550,7 @@ typedef struct { + __u8 ShortNameLength; + __u8 Reserved; + __u8 ShortName[24]; +- char FileName[1]; ++ char FileName[]; + } __attribute__((packed)) FILE_BOTH_DIRECTORY_INFO; /* level 0x104 FFrsp data */ + + typedef struct { +@@ -2559,7 +2565,7 @@ typedef struct { + __le32 AllocationSize; + __le16 Attributes; /* verify not u32 */ + __u8 FileNameLength; +- char FileName[1]; ++ char FileName[]; + } __attribute__((packed)) FIND_FILE_STANDARD_INFO; /* level 0x1 FF resp data */ + + +@@ -2569,16 +2575,6 @@ struct win_dev { + __le64 minor; + } __attribute__((packed)); + +-struct gea { +- unsigned char name_len; +- char name[1]; +-} __attribute__((packed)); +- +-struct gealist { +- unsigned long list_len; +- struct gea list[1]; +-} __attribute__((packed)); +- + struct fea { + unsigned char EA_flags; + __u8 name_len; +diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c +index 2d75ba5aaa8a..ef638086d734 100644 +--- a/fs/cifs/readdir.c ++++ b/fs/cifs/readdir.c +@@ -495,7 +495,7 @@ static char *nxt_dir_entry(char *old_entry, char *end_of_smb, int level) + FIND_FILE_STANDARD_INFO *pfData; + pfData = (FIND_FILE_STANDARD_INFO *)pDirInfo; + +- new_entry = old_entry + sizeof(FIND_FILE_STANDARD_INFO) + ++ new_entry = old_entry + sizeof(FIND_FILE_STANDARD_INFO) + 1 + + pfData->FileNameLength; + } else { + u32 next_offset = le32_to_cpu(pDirInfo->NextEntryOffset); +@@ -513,9 +513,9 @@ static char *nxt_dir_entry(char *old_entry, char *end_of_smb, int level) + new_entry, end_of_smb, old_entry); + return NULL; + } else if (((level == SMB_FIND_FILE_INFO_STANDARD) && +- (new_entry + sizeof(FIND_FILE_STANDARD_INFO) > end_of_smb)) ++ (new_entry + sizeof(FIND_FILE_STANDARD_INFO) + 1 > end_of_smb)) + || ((level != SMB_FIND_FILE_INFO_STANDARD) && +- (new_entry + sizeof(FILE_DIRECTORY_INFO) > end_of_smb))) { ++ (new_entry + sizeof(FILE_DIRECTORY_INFO) + 1 > end_of_smb))) { + cifs_dbg(VFS, "search entry %p extends after end of SMB %p\n", + new_entry, end_of_smb); + return NULL; +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index b16b41d35560..3bc0aa8a18b2 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -5011,10 +5011,10 @@ smb2_parse_query_directory(struct cifs_tcon *tcon, + + switch (srch_inf->info_level) { + case SMB_FIND_FILE_DIRECTORY_INFO: +- info_buf_size = sizeof(FILE_DIRECTORY_INFO) - 1; ++ info_buf_size = sizeof(FILE_DIRECTORY_INFO); + break; + case SMB_FIND_FILE_ID_FULL_DIR_INFO: +- info_buf_size = sizeof(SEARCH_ID_FULL_DIR_INFO) - 1; ++ info_buf_size = sizeof(SEARCH_ID_FULL_DIR_INFO); + break; + case SMB_FIND_FILE_POSIX_INFO: + /* note that posix payload are variable size */ +diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h +index 1237bb86e93a..3ad7ec44317c 100644 +--- a/fs/cifs/smb2pdu.h ++++ b/fs/cifs/smb2pdu.h +@@ -371,7 +371,7 @@ struct smb2_file_id_extd_directory_info { + __le32 EaSize; /* EA size */ + __le32 ReparsePointTag; /* valid if FILE_ATTR_REPARSE_POINT set in FileAttributes */ + __le64 UniqueId; /* inode num - le since Samba puts ino in low 32 bit */ +- char FileName[1]; ++ char FileName[]; + } __packed; /* level 60 */ + + extern char smb2_padding[7]; +-- +2.39.2 + + diff --git a/patches.suse/cifs-Replace-zero-length-arrays-with-flexible-array-members.patch b/patches.suse/cifs-Replace-zero-length-arrays-with-flexible-array-members.patch new file mode 100644 index 0000000..c64baf9 --- /dev/null +++ b/patches.suse/cifs-Replace-zero-length-arrays-with-flexible-array-members.patch @@ -0,0 +1,53 @@ +From: "Gustavo A. R. Silva" +Date: Mon, 9 Jan 2023 19:39:00 -0600 +Subject: [PATCH] cifs: Replace zero-length arrays with flexible-array members +Git-commit: 4e551dbdba7015b67f1e7db25a10954d5dc2d123 +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +Zero-length arrays are deprecated[1] and we are moving towards +adopting C99 flexible-array members instead. So, replace zero-length +arrays in a couple of structures with flex-array members. + +This helps with the ongoing efforts to tighten the FORTIFY_SOURCE +routines on memcpy() and help us make progress towards globally +enabling -fstrict-flex-arrays=3 [2]. + +Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays [1] +Link: https://gcc.gnu.org/pipermail/gcc-patches/2022-October/602902.html [2] +Link: https://github.com/KSPP/linux/issues/78 +Signed-off-by: Gustavo A. R. Silva +Reviewed-by: Kees Cook +Reviewed-by: Paulo Alcantara +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/ntlmssp.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/cifs/ntlmssp.h b/fs/cifs/ntlmssp.h +index 55758b9ec877..2c5dde2ece58 100644 +--- a/fs/cifs/ntlmssp.h ++++ b/fs/cifs/ntlmssp.h +@@ -83,7 +83,7 @@ typedef struct _NEGOTIATE_MESSAGE { + SECURITY_BUFFER WorkstationName; /* RFC 1001 and ASCII */ + /* SECURITY_BUFFER for version info not present since we + do not set the version is present flag */ +- char DomainString[0]; ++ char DomainString[]; + /* followed by WorkstationString */ + } __attribute__((packed)) NEGOTIATE_MESSAGE, *PNEGOTIATE_MESSAGE; + +@@ -135,7 +135,7 @@ typedef struct _AUTHENTICATE_MESSAGE { + __le32 NegotiateFlags; + /* SECURITY_BUFFER for version info not present since we + do not set the version is present flag */ +- char UserString[0]; ++ char UserString[]; + } __attribute__((packed)) AUTHENTICATE_MESSAGE, *PAUTHENTICATE_MESSAGE; + + /* +-- +2.39.2 + + diff --git a/patches.suse/cifs-Use-kstrtobool-instead-of-strtobool-.patch b/patches.suse/cifs-Use-kstrtobool-instead-of-strtobool-.patch new file mode 100644 index 0000000..5197fa8 --- /dev/null +++ b/patches.suse/cifs-Use-kstrtobool-instead-of-strtobool-.patch @@ -0,0 +1,57 @@ +From: Christophe JAILLET +Date: Sat, 14 Jan 2023 09:58:15 +0100 +Subject: [PATCH] cifs: Use kstrtobool() instead of strtobool() +Git-commit: 9f5d1a8cf8a137c4be180560b796e73b2707e337 +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +strtobool() is the same as kstrtobool(). +However, the latter is more used within the kernel. + +In order to remove strtobool() and slightly simplify kstrtox.h, switch to +the other function name. + +While at it, include the corresponding header file () + +Signed-off-by: Christophe JAILLET +Reviewed-by: Paulo Alcantara +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/cifs_debug.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c +index 56b23def4c95..612f0bb284c9 100644 +--- a/fs/cifs/cifs_debug.c ++++ b/fs/cifs/cifs_debug.c +@@ -8,6 +8,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -787,7 +788,7 @@ static ssize_t cifsFYI_proc_write(struct file *file, const char __user *buffer, + rc = get_user(c[0], buffer); + if (rc) + return rc; +- if (strtobool(c, &bv) == 0) ++ if (kstrtobool(c, &bv) == 0) + cifsFYI = bv; + else if ((c[0] > '1') && (c[0] <= '9')) + cifsFYI = (int) (c[0] - '0'); /* see cifs_debug.h for meanings */ +@@ -947,7 +948,7 @@ static ssize_t cifs_security_flags_proc_write(struct file *file, + + if (count < 3) { + /* single char or single char followed by null */ +- if (strtobool(flags_string, &bv) == 0) { ++ if (kstrtobool(flags_string, &bv) == 0) { + global_secflags = bv ? CIFSSEC_MAX : CIFSSEC_DEF; + return count; + } else if (!isdigit(flags_string[0])) { +-- +2.39.2 + + diff --git a/patches.suse/cifs-don-t-try-to-use-rdma-offload-on-encrypted-connections.patch b/patches.suse/cifs-don-t-try-to-use-rdma-offload-on-encrypted-connections.patch new file mode 100644 index 0000000..fe84b7a --- /dev/null +++ b/patches.suse/cifs-don-t-try-to-use-rdma-offload-on-encrypted-connections.patch @@ -0,0 +1,52 @@ +From: Stefan Metzmacher +Date: Wed, 1 Feb 2023 16:21:41 +0100 +Subject: [PATCH] cifs: don't try to use rdma offload on encrypted connections +Git-commit: 3891f6c7655a39065e44980f51ba46bb32be3133 +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +The aim of using encryption on a connection is to keep +the data confidential, so we must not use plaintext rdma offload +for that data! + +It seems that current windows servers and ksmbd would allow +this, but that's no reason to expose the users data in plaintext! +And servers hopefully reject this in future. + +Note modern windows servers support signed or encrypted offload, +see MS-SMB2 2.2.3.1.6 SMB2_RDMA_TRANSFORM_CAPABILITIES, but we don't +support that yet. + +Signed-off-by: Stefan Metzmacher +Cc: Steve French +Cc: Tom Talpey +Cc: Long Li +Cc: Namjae Jeon +Cc: David Howells +Cc: linux-cifs@vger.kernel.org +Cc: stable@vger.kernel.org +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/smb2pdu.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 6a4d621241dd..c5cb2639b3f1 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -4081,6 +4081,10 @@ static inline bool smb3_use_rdma_offload(struct cifs_io_parms *io_parms) + if (server->sign) + return false; + ++ /* we don't support encrypted offload yet */ ++ if (smb3_encryption_required(tcon)) ++ return false; ++ + /* offload also has its overhead, so only do it if desired */ + if (io_parms->length < server->smbd_conn->rdma_readwrite_threshold) + return false; +-- +2.39.2 + + diff --git a/patches.suse/cifs-fix-mount-on-old-smb-servers.patch b/patches.suse/cifs-fix-mount-on-old-smb-servers.patch new file mode 100644 index 0000000..ec12080 --- /dev/null +++ b/patches.suse/cifs-fix-mount-on-old-smb-servers.patch @@ -0,0 +1,142 @@ +From: Paulo Alcantara +Date: Thu, 16 Feb 2023 15:33:22 -0300 +Subject: [PATCH] cifs: fix mount on old smb servers +Git-commit: d99e86ebde2d7b3a04190f8d14de5bf6814bf10f +References: boo#1206935 +Patch-mainline: v6.3-rc1 + +The client was sending rfc1002 session request packet with a wrong +length field set, therefore failing to mount shares against old SMB +servers over port 139. + +Fix this by calculating the correct length as specified in rfc1002. + +Fixes: d7173623bf0b ("cifs: use ALIGN() and round_up() macros") +Cc: stable@vger.kernel.org +Signed-off-by: Paulo Alcantara (SUSE) +Reviewed-by: Ronnie Sahlberg +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/connect.c | 100 ++++++++++++++++++---------------------------- + 1 file changed, 38 insertions(+), 62 deletions(-) + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index b2a04b4e89a5..af49ae53aaf4 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -2843,72 +2843,48 @@ ip_rfc1001_connect(struct TCP_Server_Info *server) + * negprot - BB check reconnection in case where second + * sessinit is sent but no second negprot + */ +- struct rfc1002_session_packet *ses_init_buf; +- unsigned int req_noscope_len; +- struct smb_hdr *smb_buf; ++ struct rfc1002_session_packet req = {}; ++ struct smb_hdr *smb_buf = (struct smb_hdr *)&req; ++ unsigned int len; ++ ++ req.trailer.session_req.called_len = sizeof(req.trailer.session_req.called_name); ++ ++ if (server->server_RFC1001_name[0] != 0) ++ rfc1002mangle(req.trailer.session_req.called_name, ++ server->server_RFC1001_name, ++ RFC1001_NAME_LEN_WITH_NULL); ++ else ++ rfc1002mangle(req.trailer.session_req.called_name, ++ DEFAULT_CIFS_CALLED_NAME, ++ RFC1001_NAME_LEN_WITH_NULL); ++ ++ req.trailer.session_req.calling_len = sizeof(req.trailer.session_req.calling_name); ++ ++ /* calling name ends in null (byte 16) from old smb convention */ ++ if (server->workstation_RFC1001_name[0] != 0) ++ rfc1002mangle(req.trailer.session_req.calling_name, ++ server->workstation_RFC1001_name, ++ RFC1001_NAME_LEN_WITH_NULL); ++ else ++ rfc1002mangle(req.trailer.session_req.calling_name, ++ "LINUX_CIFS_CLNT", ++ RFC1001_NAME_LEN_WITH_NULL); + +- ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet), +- GFP_KERNEL); +- +- if (ses_init_buf) { +- ses_init_buf->trailer.session_req.called_len = 32; +- +- if (server->server_RFC1001_name[0] != 0) +- rfc1002mangle(ses_init_buf->trailer. +- session_req.called_name, +- server->server_RFC1001_name, +- RFC1001_NAME_LEN_WITH_NULL); +- else +- rfc1002mangle(ses_init_buf->trailer. +- session_req.called_name, +- DEFAULT_CIFS_CALLED_NAME, +- RFC1001_NAME_LEN_WITH_NULL); +- +- ses_init_buf->trailer.session_req.calling_len = 32; +- +- /* +- * calling name ends in null (byte 16) from old smb +- * convention. +- */ +- if (server->workstation_RFC1001_name[0] != 0) +- rfc1002mangle(ses_init_buf->trailer. +- session_req.calling_name, +- server->workstation_RFC1001_name, +- RFC1001_NAME_LEN_WITH_NULL); +- else +- rfc1002mangle(ses_init_buf->trailer. +- session_req.calling_name, +- "LINUX_CIFS_CLNT", +- RFC1001_NAME_LEN_WITH_NULL); +- +- ses_init_buf->trailer.session_req.scope1 = 0; +- ses_init_buf->trailer.session_req.scope2 = 0; +- smb_buf = (struct smb_hdr *)ses_init_buf; +- +- /* sizeof RFC1002_SESSION_REQUEST with no scopes */ +- req_noscope_len = sizeof(struct rfc1002_session_packet) - 2; ++ /* ++ * As per rfc1002, @len must be the number of bytes that follows the ++ * length field of a rfc1002 session request payload. ++ */ ++ len = sizeof(req) - offsetof(struct rfc1002_session_packet, trailer.session_req); + +- /* == cpu_to_be32(0x81000044) */ +- smb_buf->smb_buf_length = +- cpu_to_be32((RFC1002_SESSION_REQUEST << 24) | req_noscope_len); +- rc = smb_send(server, smb_buf, 0x44); +- kfree(ses_init_buf); +- /* +- * RFC1001 layer in at least one server +- * requires very short break before negprot +- * presumably because not expecting negprot +- * to follow so fast. This is a simple +- * solution that works without +- * complicating the code and causes no +- * significant slowing down on mount +- * for everyone else +- */ +- usleep_range(1000, 2000); +- } ++ smb_buf->smb_buf_length = cpu_to_be32((RFC1002_SESSION_REQUEST << 24) | len); ++ rc = smb_send(server, smb_buf, len); + /* +- * else the negprot may still work without this +- * even though malloc failed ++ * RFC1001 layer in at least one server requires very short break before ++ * negprot presumably because not expecting negprot to follow so fast. ++ * This is a simple solution that works without complicating the code ++ * and causes no significant slowing down on mount for everyone else + */ ++ usleep_range(1000, 2000); + + return rc; + } +-- +2.39.2 + + diff --git a/patches.suse/cifs-get-rid-of-dns-resolve-worker.patch b/patches.suse/cifs-get-rid-of-dns-resolve-worker.patch new file mode 100644 index 0000000..e1d11ae --- /dev/null +++ b/patches.suse/cifs-get-rid-of-dns-resolve-worker.patch @@ -0,0 +1,173 @@ +From: Paulo Alcantara +Date: Mon, 20 Feb 2023 16:36:54 -0300 +Subject: [PATCH] cifs: get rid of dns resolve worker +Git-commit: 0e9bd27b2a635d54665fcc1d6398a5f6aeb6b0cb +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +We already upcall to resolve hostnames during reconnect by calling +reconn_set_ipaddr_from_hostname(), so there is no point in having a +worker to periodically call it. + +Signed-off-by: Paulo Alcantara (SUSE) +Reviewed-by +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/cifsglob.h | 5 ----- + fs/cifs/connect.c | 53 ++++++---------------------------------------- + fs/cifs/sess.c | 1 - + 3 files changed, 6 insertions(+), 53 deletions(-) + +diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h +index b26e824d6a0c..00ee5e7f79c6 100644 +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -77,10 +77,6 @@ + #define SMB_ECHO_INTERVAL_MAX 600 + #define SMB_ECHO_INTERVAL_DEFAULT 60 + +-/* dns resolution intervals in seconds */ +-#define SMB_DNS_RESOLVE_INTERVAL_MIN 120 +-#define SMB_DNS_RESOLVE_INTERVAL_DEFAULT 600 +- + /* smb multichannel query server interfaces interval in seconds */ + #define SMB_INTERFACE_POLL_INTERVAL 600 + +@@ -691,7 +687,6 @@ struct TCP_Server_Info { + /* point to the SMBD connection if RDMA is used instead of socket */ + struct smbd_connection *smbd_conn; + struct delayed_work echo; /* echo ping workqueue job */ +- struct delayed_work resolve; /* dns resolution workqueue job */ + char *smallbuf; /* pointer to current "small" buffer */ + char *bigbuf; /* pointer to current "big" buffer */ + /* Total size of this PDU. Only valid from cifs_demultiplex_thread */ +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index af49ae53aaf4..150666e143ce 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -79,8 +79,6 @@ static int reconn_set_ipaddr_from_hostname(struct TCP_Server_Info *server) + int len; + char *unc; + struct sockaddr_storage ss; +- time64_t expiry, now; +- unsigned long ttl = SMB_DNS_RESOLVE_INTERVAL_DEFAULT; + + if (!server->hostname) + return -EINVAL; +@@ -102,29 +100,19 @@ static int reconn_set_ipaddr_from_hostname(struct TCP_Server_Info *server) + ss = server->dstaddr; + spin_unlock(&server->srv_lock); + +- rc = dns_resolve_server_name_to_ip(unc, (struct sockaddr *)&ss, &expiry); ++ rc = dns_resolve_server_name_to_ip(unc, (struct sockaddr *)&ss, NULL); + kfree(unc); + + if (rc < 0) { + cifs_dbg(FYI, "%s: failed to resolve server part of %s to IP: %d\n", + __func__, server->hostname, rc); +- goto requeue_resolve; ++ } else { ++ spin_lock(&server->srv_lock); ++ memcpy(&server->dstaddr, &ss, sizeof(server->dstaddr)); ++ spin_unlock(&server->srv_lock); ++ rc = 0; + } + +- spin_lock(&server->srv_lock); +- memcpy(&server->dstaddr, &ss, sizeof(server->dstaddr)); +- spin_unlock(&server->srv_lock); +- +- now = ktime_get_real_seconds(); +- if (expiry && expiry > now) +- /* To make sure we don't use the cached entry, retry 1s */ +- ttl = max_t(unsigned long, expiry - now, SMB_DNS_RESOLVE_INTERVAL_MIN) + 1; +- +-requeue_resolve: +- cifs_dbg(FYI, "%s: next dns resolution scheduled for %lu seconds in the future\n", +- __func__, ttl); +- mod_delayed_work(cifsiod_wq, &server->resolve, (ttl * HZ)); +- + return rc; + } + +@@ -148,26 +136,6 @@ static void smb2_query_server_interfaces(struct work_struct *work) + (SMB_INTERFACE_POLL_INTERVAL * HZ)); + } + +-static void cifs_resolve_server(struct work_struct *work) +-{ +- int rc; +- struct TCP_Server_Info *server = container_of(work, +- struct TCP_Server_Info, resolve.work); +- +- cifs_server_lock(server); +- +- /* +- * Resolve the hostname again to make sure that IP address is up-to-date. +- */ +- rc = reconn_set_ipaddr_from_hostname(server); +- if (rc) { +- cifs_dbg(FYI, "%s: failed to resolve hostname: %d\n", +- __func__, rc); +- } +- +- cifs_server_unlock(server); +-} +- + /* + * Update the tcpStatus for the server. + * This is used to signal the cifsd thread to call cifs_reconnect +@@ -925,7 +893,6 @@ static void clean_demultiplex_info(struct TCP_Server_Info *server) + spin_unlock(&server->srv_lock); + + cancel_delayed_work_sync(&server->echo); +- cancel_delayed_work_sync(&server->resolve); + + spin_lock(&server->srv_lock); + server->tcpStatus = CifsExiting; +@@ -1549,7 +1516,6 @@ cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect) + cifs_put_tcp_session(server->primary_server, from_reconnect); + + cancel_delayed_work_sync(&server->echo); +- cancel_delayed_work_sync(&server->resolve); + + if (from_reconnect) + /* +@@ -1655,7 +1621,6 @@ cifs_get_tcp_session(struct smb3_fs_context *ctx, + INIT_LIST_HEAD(&tcp_ses->tcp_ses_list); + INIT_LIST_HEAD(&tcp_ses->smb_ses_list); + INIT_DELAYED_WORK(&tcp_ses->echo, cifs_echo_request); +- INIT_DELAYED_WORK(&tcp_ses->resolve, cifs_resolve_server); + INIT_DELAYED_WORK(&tcp_ses->reconnect, smb2_reconnect_server); + mutex_init(&tcp_ses->reconnect_mutex); + #ifdef CONFIG_CIFS_DFS_UPCALL +@@ -1744,12 +1709,6 @@ cifs_get_tcp_session(struct smb3_fs_context *ctx, + /* queue echo request delayed work */ + queue_delayed_work(cifsiod_wq, &tcp_ses->echo, tcp_ses->echo_interval); + +- /* queue dns resolution delayed work */ +- cifs_dbg(FYI, "%s: next dns resolution scheduled for %d seconds in the future\n", +- __func__, SMB_DNS_RESOLVE_INTERVAL_DEFAULT); +- +- queue_delayed_work(cifsiod_wq, &tcp_ses->resolve, (SMB_DNS_RESOLVE_INTERVAL_DEFAULT * HZ)); +- + return tcp_ses; + + out_err_crypto_release: +diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c +index c47b254f0d1e..d2cbae4b5d21 100644 +--- a/fs/cifs/sess.c ++++ b/fs/cifs/sess.c +@@ -480,7 +480,6 @@ cifs_ses_add_channel(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses, + * remove this channel + */ + cancel_delayed_work_sync(&chan->server->echo); +- cancel_delayed_work_sync(&chan->server->resolve); + cancel_delayed_work_sync(&chan->server->reconnect); + + spin_lock(&ses->chan_lock); +-- +2.39.2 + + diff --git a/patches.suse/cifs-get-rid-of-unneeded-conditional-in-cifs_get_num_sgs-.patch b/patches.suse/cifs-get-rid-of-unneeded-conditional-in-cifs_get_num_sgs-.patch new file mode 100644 index 0000000..82e91ca --- /dev/null +++ b/patches.suse/cifs-get-rid-of-unneeded-conditional-in-cifs_get_num_sgs-.patch @@ -0,0 +1,62 @@ +From: Paulo Alcantara +Date: Tue, 31 Jan 2023 13:22:07 -0300 +Subject: [PATCH] cifs: get rid of unneeded conditional in cifs_get_num_sgs() +Git-commit: 89542781737a783d94ace958548caa0651bfbc5e +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +Just have @skip set to 0 after first iterations of the two nested +loops. + +Signed-off-by: Paulo Alcantara (SUSE) +Reviewed-by: David Howells +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/cifsglob.h | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h +index cfdd5bf701a1..b26e824d6a0c 100644 +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -2162,6 +2162,12 @@ static inline unsigned int cifs_get_num_sgs(const struct smb_rqst *rqst, + unsigned long addr; + int i, j; + ++ /* ++ * The first rqst has a transform header where the first 20 bytes are ++ * not part of the encrypted blob. ++ */ ++ skip = 20; ++ + /* Assumes the first rqst has a transform header as the first iov. + * I.e. + * rqst[0].rq_iov[0] is transform header +@@ -2169,14 +2175,9 @@ static inline unsigned int cifs_get_num_sgs(const struct smb_rqst *rqst, + * rqst[1+].rq_iov[0+] data to be encrypted/decrypted + */ + for (i = 0; i < num_rqst; i++) { +- /* +- * The first rqst has a transform header where the +- * first 20 bytes are not part of the encrypted blob. +- */ + for (j = 0; j < rqst[i].rq_nvec; j++) { + struct kvec *iov = &rqst[i].rq_iov[j]; + +- skip = (i == 0) && (j == 0) ? 20 : 0; + addr = (unsigned long)iov->iov_base + skip; + if (unlikely(is_vmalloc_addr((void *)addr))) { + len = iov->iov_len - skip; +@@ -2185,6 +2186,7 @@ static inline unsigned int cifs_get_num_sgs(const struct smb_rqst *rqst, + } else { + nents++; + } ++ skip = 0; + } + nents += rqst[i].rq_npages; + } +-- +2.39.2 + + diff --git a/patches.suse/cifs-improve-checking-of-DFS-links-over-STATUS_OBJECT_NAME_INVALID.patch b/patches.suse/cifs-improve-checking-of-DFS-links-over-STATUS_OBJECT_NAME_INVALID.patch new file mode 100644 index 0000000..7f7f6a5 --- /dev/null +++ b/patches.suse/cifs-improve-checking-of-DFS-links-over-STATUS_OBJECT_NAME_INVALID.patch @@ -0,0 +1,243 @@ +From: Paulo Alcantara +Date: Tue, 28 Feb 2023 19:01:54 -0300 +Subject: [PATCH] cifs: improve checking of DFS links over + STATUS_OBJECT_NAME_INVALID +Git-commit: b9ee2e307c6b06384b6f9e393a9b8e048e8fc277 +References: git-fixes +Patch-mainline: v6.3-rc1 + +Do not map STATUS_OBJECT_NAME_INVALID to -EREMOTE under non-DFS +shares, or 'nodfs' mounts or CONFIG_CIFS_DFS_UPCALL=n builds. +Otherwise, in the slow path, get a referral to figure out whether it +is an actual DFS link. + +This could be simply reproduced under a non-DFS share by running the +following + + $ mount.cifs //srv/share /mnt -o ... + $ cat /mnt/$(printf '\U110000') + cat: '/mnt/'$'\364\220\200\200': Object is remote + +Fixes: c877ce47e137 ("cifs: reduce roundtrips on create/qinfo requests") +CC: stable@vger.kernel.org # 6.2 +Signed-off-by: Paulo Alcantara (SUSE) +Reviewed-by: Ronnie Sahlberg +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/cifsproto.h | 20 ++++++++++---- + fs/cifs/misc.c | 67 +++++++++++++++++++++++++++++++++++++++++++++ + fs/cifs/smb2inode.c | 21 +++++++------- + fs/cifs/smb2ops.c | 23 +++++++++------- + 4 files changed, 106 insertions(+), 25 deletions(-) + +diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h +index b7a36ebd0f2f..20a2f0f3f682 100644 +--- a/fs/cifs/cifsproto.h ++++ b/fs/cifs/cifsproto.h +@@ -667,11 +667,21 @@ static inline int get_dfs_path(const unsigned int xid, struct cifs_ses *ses, + int match_target_ip(struct TCP_Server_Info *server, + const char *share, size_t share_len, + bool *result); +- +-int cifs_dfs_query_info_nonascii_quirk(const unsigned int xid, +- struct cifs_tcon *tcon, +- struct cifs_sb_info *cifs_sb, +- const char *dfs_link_path); ++int cifs_inval_name_dfs_link_error(const unsigned int xid, ++ struct cifs_tcon *tcon, ++ struct cifs_sb_info *cifs_sb, ++ const char *full_path, ++ bool *islink); ++#else ++static inline int cifs_inval_name_dfs_link_error(const unsigned int xid, ++ struct cifs_tcon *tcon, ++ struct cifs_sb_info *cifs_sb, ++ const char *full_path, ++ bool *islink) ++{ ++ *islink = false; ++ return 0; ++} + #endif + + static inline int cifs_create_options(struct cifs_sb_info *cifs_sb, int options) +diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c +index 2905734eb289..0c6c1fc8dae9 100644 +--- a/fs/cifs/misc.c ++++ b/fs/cifs/misc.c +@@ -21,6 +21,7 @@ + #include "cifsfs.h" + #ifdef CONFIG_CIFS_DFS_UPCALL + #include "dns_resolve.h" ++#include "dfs_cache.h" + #endif + #include "fs_context.h" + #include "cached_dir.h" +@@ -1198,4 +1199,70 @@ int cifs_update_super_prepath(struct cifs_sb_info *cifs_sb, char *prefix) + cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH; + return 0; + } ++ ++/* ++ * Handle weird Windows SMB server behaviour. It responds with ++ * STATUS_OBJECT_NAME_INVALID code to SMB2 QUERY_INFO request for ++ * "\\\" DFS reference, where contains ++ * non-ASCII unicode symbols. ++ */ ++int cifs_inval_name_dfs_link_error(const unsigned int xid, ++ struct cifs_tcon *tcon, ++ struct cifs_sb_info *cifs_sb, ++ const char *full_path, ++ bool *islink) ++{ ++ struct cifs_ses *ses = tcon->ses; ++ size_t len; ++ char *path; ++ char *ref_path; ++ ++ *islink = false; ++ ++ /* ++ * Fast path - skip check when @full_path doesn't have a prefix path to ++ * look up or tcon is not DFS. ++ */ ++ if (strlen(full_path) < 2 || !cifs_sb || ++ (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_DFS) || ++ !is_tcon_dfs(tcon) || !ses->server->origin_fullpath) ++ return 0; ++ ++ /* ++ * Slow path - tcon is DFS and @full_path has prefix path, so attempt ++ * to get a referral to figure out whether it is an DFS link. ++ */ ++ len = strnlen(tcon->tree_name, MAX_TREE_SIZE + 1) + strlen(full_path) + 1; ++ path = kmalloc(len, GFP_KERNEL); ++ if (!path) ++ return -ENOMEM; ++ ++ scnprintf(path, len, "%s%s", tcon->tree_name, full_path); ++ ref_path = dfs_cache_canonical_path(path + 1, cifs_sb->local_nls, ++ cifs_remap(cifs_sb)); ++ kfree(path); ++ ++ if (IS_ERR(ref_path)) { ++ if (PTR_ERR(ref_path) != -EINVAL) ++ return PTR_ERR(ref_path); ++ } else { ++ struct dfs_info3_param *refs = NULL; ++ int num_refs = 0; ++ ++ /* ++ * XXX: we are not using dfs_cache_find() here because we might ++ * end filling all the DFS cache and thus potentially ++ * removing cached DFS targets that the client would eventually ++ * need during failover. ++ */ ++ if (ses->server->ops->get_dfs_refer && ++ !ses->server->ops->get_dfs_refer(xid, ses, ref_path, &refs, ++ &num_refs, cifs_sb->local_nls, ++ cifs_remap(cifs_sb))) ++ *islink = refs[0].server_type == DFS_TYPE_LINK; ++ free_dfs_info_array(refs, num_refs); ++ kfree(ref_path); ++ } ++ return 0; ++} + #endif +diff --git a/fs/cifs/smb2inode.c b/fs/cifs/smb2inode.c +index 37b4cd59245d..9b956294e864 100644 +--- a/fs/cifs/smb2inode.c ++++ b/fs/cifs/smb2inode.c +@@ -527,12 +527,13 @@ int smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon, + struct cifs_sb_info *cifs_sb, const char *full_path, + struct cifs_open_info_data *data, bool *adjust_tz, bool *reparse) + { +- int rc; + __u32 create_options = 0; + struct cifsFileInfo *cfile; + struct cached_fid *cfid = NULL; + struct kvec err_iov[3] = {}; + int err_buftype[3] = {}; ++ bool islink; ++ int rc, rc2; + + *adjust_tz = false; + *reparse = false; +@@ -580,15 +581,15 @@ int smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon, + SMB2_OP_QUERY_INFO, cfile, NULL, NULL, + NULL, NULL); + goto out; +- } else if (rc != -EREMOTE && IS_ENABLED(CONFIG_CIFS_DFS_UPCALL) && +- hdr->Status == STATUS_OBJECT_NAME_INVALID) { +- /* +- * Handle weird Windows SMB server behaviour. It responds with +- * STATUS_OBJECT_NAME_INVALID code to SMB2 QUERY_INFO request +- * for "\\\" DFS reference, +- * where contains non-ASCII unicode symbols. +- */ +- rc = -EREMOTE; ++ } else if (rc != -EREMOTE && hdr->Status == STATUS_OBJECT_NAME_INVALID) { ++ rc2 = cifs_inval_name_dfs_link_error(xid, tcon, cifs_sb, ++ full_path, &islink); ++ if (rc2) { ++ rc = rc2; ++ goto out; ++ } ++ if (islink) ++ rc = -EREMOTE; + } + if (rc == -EREMOTE && IS_ENABLED(CONFIG_CIFS_DFS_UPCALL) && cifs_sb && + (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_DFS)) +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index f79b075f2992..6dfb865ee9d7 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -796,7 +796,6 @@ static int + smb2_is_path_accessible(const unsigned int xid, struct cifs_tcon *tcon, + struct cifs_sb_info *cifs_sb, const char *full_path) + { +- int rc; + __le16 *utf16_path; + __u8 oplock = SMB2_OPLOCK_LEVEL_NONE; + int err_buftype = CIFS_NO_BUFFER; +@@ -804,6 +803,8 @@ smb2_is_path_accessible(const unsigned int xid, struct cifs_tcon *tcon, + struct kvec err_iov = {}; + struct cifs_fid fid; + struct cached_fid *cfid; ++ bool islink; ++ int rc, rc2; + + rc = open_cached_dir(xid, tcon, full_path, cifs_sb, true, &cfid); + if (!rc) { +@@ -833,15 +834,17 @@ smb2_is_path_accessible(const unsigned int xid, struct cifs_tcon *tcon, + + if (unlikely(!hdr || err_buftype == CIFS_NO_BUFFER)) + goto out; +- /* +- * Handle weird Windows SMB server behaviour. It responds with +- * STATUS_OBJECT_NAME_INVALID code to SMB2 QUERY_INFO request +- * for "\\\" DFS reference, +- * where contains non-ASCII unicode symbols. +- */ +- if (rc != -EREMOTE && IS_ENABLED(CONFIG_CIFS_DFS_UPCALL) && +- hdr->Status == STATUS_OBJECT_NAME_INVALID) +- rc = -EREMOTE; ++ ++ if (rc != -EREMOTE && hdr->Status == STATUS_OBJECT_NAME_INVALID) { ++ rc2 = cifs_inval_name_dfs_link_error(xid, tcon, cifs_sb, ++ full_path, &islink); ++ if (rc2) { ++ rc = rc2; ++ goto out; ++ } ++ if (islink) ++ rc = -EREMOTE; ++ } + if (rc == -EREMOTE && IS_ENABLED(CONFIG_CIFS_DFS_UPCALL) && cifs_sb && + (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_DFS)) + rc = -EOPNOTSUPP; +-- +2.39.2 + + diff --git a/patches.suse/cifs-introduce-cifs_io_parms-in-smb2_async_writev-.patch b/patches.suse/cifs-introduce-cifs_io_parms-in-smb2_async_writev-.patch new file mode 100644 index 0000000..342e2d5 --- /dev/null +++ b/patches.suse/cifs-introduce-cifs_io_parms-in-smb2_async_writev-.patch @@ -0,0 +1,142 @@ +From: Stefan Metzmacher +Date: Wed, 1 Feb 2023 16:21:39 +0100 +Subject: [PATCH] cifs: introduce cifs_io_parms in smb2_async_writev() +Git-commit: d643a8a446fc46c06837d08a056f69da2ff16025 +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +This will simplify the following changes and makes it easy to get +in passed in from the caller in future. + +Signed-off-by: Stefan Metzmacher +Cc: Steve French +Cc: Tom Talpey +Cc: Long Li +Cc: Namjae Jeon +Cc: David Howells +Cc: linux-cifs@vger.kernel.org +Cc: stable@vger.kernel.org +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/smb2pdu.c | 53 ++++++++++++++++++++++++++++++++++------------- + 1 file changed, 39 insertions(+), 14 deletions(-) + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 2d5c3df2277d..64e2c8b438f4 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -4504,10 +4504,27 @@ smb2_async_writev(struct cifs_writedata *wdata, + struct kvec iov[1]; + struct smb_rqst rqst = { }; + unsigned int total_len; ++ struct cifs_io_parms _io_parms; ++ struct cifs_io_parms *io_parms = NULL; + + if (!wdata->server) + server = wdata->server = cifs_pick_channel(tcon->ses); + ++ /* ++ * in future we may get cifs_io_parms passed in from the caller, ++ * but for now we construct it here... ++ */ ++ _io_parms = (struct cifs_io_parms) { ++ .tcon = tcon, ++ .server = server, ++ .offset = wdata->offset, ++ .length = wdata->bytes, ++ .persistent_fid = wdata->cfile->fid.persistent_fid, ++ .volatile_fid = wdata->cfile->fid.volatile_fid, ++ .pid = wdata->pid, ++ }; ++ io_parms = &_io_parms; ++ + rc = smb2_plain_req_init(SMB2_WRITE, tcon, server, + (void **) &req, &total_len); + if (rc) +@@ -4517,26 +4534,31 @@ smb2_async_writev(struct cifs_writedata *wdata, + flags |= CIFS_TRANSFORM_REQ; + + shdr = (struct smb2_hdr *)req; +- shdr->Id.SyncId.ProcessId = cpu_to_le32(wdata->cfile->pid); ++ shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); + +- req->PersistentFileId = wdata->cfile->fid.persistent_fid; +- req->VolatileFileId = wdata->cfile->fid.volatile_fid; ++ req->PersistentFileId = io_parms->persistent_fid; ++ req->VolatileFileId = io_parms->volatile_fid; + req->WriteChannelInfoOffset = 0; + req->WriteChannelInfoLength = 0; + req->Channel = 0; +- req->Offset = cpu_to_le64(wdata->offset); ++ req->Offset = cpu_to_le64(io_parms->offset); + req->DataOffset = cpu_to_le16( + offsetof(struct smb2_write_req, Buffer)); + req->RemainingBytes = 0; + +- trace_smb3_write_enter(0 /* xid */, wdata->cfile->fid.persistent_fid, +- tcon->tid, tcon->ses->Suid, wdata->offset, wdata->bytes); ++ trace_smb3_write_enter(0 /* xid */, ++ io_parms->persistent_fid, ++ io_parms->tcon->tid, ++ io_parms->tcon->ses->Suid, ++ io_parms->offset, ++ io_parms->length); ++ + #ifdef CONFIG_CIFS_SMB_DIRECT + /* + * If we want to do a server RDMA read, fill in and append + * smbd_buffer_descriptor_v1 to the end of write request + */ +- if (server->rdma && !server->sign && wdata->bytes >= ++ if (server->rdma && !server->sign && io_parms->length >= + server->smbd_conn->rdma_readwrite_threshold) { + + struct smbd_buffer_descriptor_v1 *v1; +@@ -4590,14 +4612,14 @@ smb2_async_writev(struct cifs_writedata *wdata, + } + #endif + cifs_dbg(FYI, "async write at %llu %u bytes\n", +- wdata->offset, wdata->bytes); ++ io_parms->offset, io_parms->length); + + #ifdef CONFIG_CIFS_SMB_DIRECT + /* For RDMA read, I/O size is in RemainingBytes not in Length */ + if (!wdata->mr) +- req->Length = cpu_to_le32(wdata->bytes); ++ req->Length = cpu_to_le32(io_parms->length); + #else +- req->Length = cpu_to_le32(wdata->bytes); ++ req->Length = cpu_to_le32(io_parms->length); + #endif + + if (wdata->credits.value > 0) { +@@ -4605,7 +4627,7 @@ smb2_async_writev(struct cifs_writedata *wdata, + SMB2_MAX_BUFFER_SIZE)); + shdr->CreditRequest = cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 8); + +- rc = adjust_credits(server, &wdata->credits, wdata->bytes); ++ rc = adjust_credits(server, &wdata->credits, io_parms->length); + if (rc) + goto async_writev_out; + +@@ -4618,9 +4640,12 @@ smb2_async_writev(struct cifs_writedata *wdata, + + if (rc) { + trace_smb3_write_err(0 /* no xid */, +- req->PersistentFileId, +- tcon->tid, tcon->ses->Suid, wdata->offset, +- wdata->bytes, rc); ++ io_parms->persistent_fid, ++ io_parms->tcon->tid, ++ io_parms->tcon->ses->Suid, ++ io_parms->offset, ++ io_parms->length, ++ rc); + kref_put(&wdata->refcount, release); + cifs_stats_fail_inc(tcon, SMB2_WRITE_HE); + } +-- +2.39.2 + + diff --git a/patches.suse/cifs-match-even-the-scope-id-for-ipv6-addresses.patch b/patches.suse/cifs-match-even-the-scope-id-for-ipv6-addresses.patch new file mode 100644 index 0000000..de13477 --- /dev/null +++ b/patches.suse/cifs-match-even-the-scope-id-for-ipv6-addresses.patch @@ -0,0 +1,36 @@ +From: Shyam Prasad N +Date: Tue, 27 Dec 2022 14:04:29 +0000 +Subject: [PATCH] cifs: match even the scope id for ipv6 addresses +Git-commit: a21be1f5df85831147d5a1cbb5f2a13ec8c6852b +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +match_address function matches the scope id for ipv6 addresses, +but cifs_match_ipaddr (which is another function used for comparison) +does not use scope id. Doing so with this change. + +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/connect.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index ec020d860be3..5dabd8dc3e8e 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -1294,7 +1294,8 @@ cifs_match_ipaddr(struct sockaddr *srcaddr, struct sockaddr *rhs) + case AF_INET6: { + struct sockaddr_in6 *saddr6 = (struct sockaddr_in6 *)srcaddr; + struct sockaddr_in6 *vaddr6 = (struct sockaddr_in6 *)rhs; +- return ipv6_addr_equal(&saddr6->sin6_addr, &vaddr6->sin6_addr); ++ return (ipv6_addr_equal(&saddr6->sin6_addr, &vaddr6->sin6_addr) ++ && saddr6->sin6_scope_id == vaddr6->sin6_scope_id); + } + default: + WARN_ON(1); +-- +2.39.2 + + diff --git a/patches.suse/cifs-prevent-data-race-in-cifs_reconnect_tcon-.patch b/patches.suse/cifs-prevent-data-race-in-cifs_reconnect_tcon-.patch new file mode 100644 index 0000000..cd5c4da --- /dev/null +++ b/patches.suse/cifs-prevent-data-race-in-cifs_reconnect_tcon-.patch @@ -0,0 +1,253 @@ +From: Paulo Alcantara +Date: Tue, 28 Feb 2023 19:01:55 -0300 +Subject: [PATCH] cifs: prevent data race in cifs_reconnect_tcon() +Git-commit: 1bcd548d935a33c6fc58331405eb1b82fd6150de +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +Make sure to get an up-to-date TCP_Server_Info::nr_targets value prior +to waiting the server to be reconnected in cifs_reconnect_tcon(). It +is set in cifs_tcp_ses_needs_reconnect() and protected by +TCP_Server_Info::srv_lock. + +Create a new cifs_wait_for_server_reconnect() helper that can be used +by both SMB2+ and CIFS reconnect code. + +Signed-off-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/cifsproto.h | 1 + + fs/cifs/cifssmb.c | 43 ++---------------------- + fs/cifs/misc.c | 44 ++++++++++++++++++++++++ + fs/cifs/smb2pdu.c | 82 ++++++++++++--------------------------------- + 4 files changed, 69 insertions(+), 101 deletions(-) + +diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h +index 20a2f0f3f682..e2eff66eefab 100644 +--- a/fs/cifs/cifsproto.h ++++ b/fs/cifs/cifsproto.h +@@ -694,5 +694,6 @@ static inline int cifs_create_options(struct cifs_sb_info *cifs_sb, int options) + + struct super_block *cifs_get_tcon_super(struct cifs_tcon *tcon); + void cifs_put_tcon_super(struct super_block *sb); ++int cifs_wait_for_server_reconnect(struct TCP_Server_Info *server, bool retry); + + #endif /* _CIFSPROTO_H */ +diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c +index a24e4ddf8043..a43c78396dd8 100644 +--- a/fs/cifs/cifssmb.c ++++ b/fs/cifs/cifssmb.c +@@ -72,7 +72,6 @@ cifs_reconnect_tcon(struct cifs_tcon *tcon, int smb_command) + struct cifs_ses *ses; + struct TCP_Server_Info *server; + struct nls_table *nls_codepage; +- int retries; + + /* + * SMBs NegProt, SessSetup, uLogoff do not have tcon yet so check for +@@ -102,45 +101,9 @@ cifs_reconnect_tcon(struct cifs_tcon *tcon, int smb_command) + } + spin_unlock(&tcon->tc_lock); + +- retries = server->nr_targets; +- +- /* +- * Give demultiplex thread up to 10 seconds to each target available for +- * reconnect -- should be greater than cifs socket timeout which is 7 +- * seconds. +- */ +- while (server->tcpStatus == CifsNeedReconnect) { +- rc = wait_event_interruptible_timeout(server->response_q, +- (server->tcpStatus != CifsNeedReconnect), +- 10 * HZ); +- if (rc < 0) { +- cifs_dbg(FYI, "%s: aborting reconnect due to a received signal by the process\n", +- __func__); +- return -ERESTARTSYS; +- } +- +- /* are we still trying to reconnect? */ +- spin_lock(&server->srv_lock); +- if (server->tcpStatus != CifsNeedReconnect) { +- spin_unlock(&server->srv_lock); +- break; +- } +- spin_unlock(&server->srv_lock); +- +- if (retries && --retries) +- continue; +- +- /* +- * on "soft" mounts we wait once. Hard mounts keep +- * retrying until process is killed or server comes +- * back on-line +- */ +- if (!tcon->retry) { +- cifs_dbg(FYI, "gave up waiting on reconnect in smb_init\n"); +- return -EHOSTDOWN; +- } +- retries = server->nr_targets; +- } ++ rc = cifs_wait_for_server_reconnect(server, tcon->retry); ++ if (rc) ++ return rc; + + spin_lock(&ses->chan_lock); + if (!cifs_chan_needs_reconnect(ses, server) && !tcon->need_reconnect) { +diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c +index 0c6c1fc8dae9..a0d286ee723d 100644 +--- a/fs/cifs/misc.c ++++ b/fs/cifs/misc.c +@@ -1266,3 +1266,47 @@ int cifs_inval_name_dfs_link_error(const unsigned int xid, + return 0; + } + #endif ++ ++int cifs_wait_for_server_reconnect(struct TCP_Server_Info *server, bool retry) ++{ ++ int timeout = 10; ++ int rc; ++ ++ spin_lock(&server->srv_lock); ++ if (server->tcpStatus != CifsNeedReconnect) { ++ spin_unlock(&server->srv_lock); ++ return 0; ++ } ++ timeout *= server->nr_targets; ++ spin_unlock(&server->srv_lock); ++ ++ /* ++ * Give demultiplex thread up to 10 seconds to each target available for ++ * reconnect -- should be greater than cifs socket timeout which is 7 ++ * seconds. ++ * ++ * On "soft" mounts we wait once. Hard mounts keep retrying until ++ * process is killed or server comes back on-line. ++ */ ++ do { ++ rc = wait_event_interruptible_timeout(server->response_q, ++ (server->tcpStatus != CifsNeedReconnect), ++ timeout * HZ); ++ if (rc < 0) { ++ cifs_dbg(FYI, "%s: aborting reconnect due to received signal\n", ++ __func__); ++ return -ERESTARTSYS; ++ } ++ ++ /* are we still trying to reconnect? */ ++ spin_lock(&server->srv_lock); ++ if (server->tcpStatus != CifsNeedReconnect) { ++ spin_unlock(&server->srv_lock); ++ return 0; ++ } ++ spin_unlock(&server->srv_lock); ++ } while (retry); ++ ++ cifs_dbg(FYI, "%s: gave up waiting on reconnect\n", __func__); ++ return -EHOSTDOWN; ++} +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index ca9d7110ddcb..0e53265e1462 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -139,66 +139,6 @@ smb2_hdr_assemble(struct smb2_hdr *shdr, __le16 smb2_cmd, + return; + } + +-static int wait_for_server_reconnect(struct TCP_Server_Info *server, +- __le16 smb2_command, bool retry) +-{ +- int timeout = 10; +- int rc; +- +- spin_lock(&server->srv_lock); +- if (server->tcpStatus != CifsNeedReconnect) { +- spin_unlock(&server->srv_lock); +- return 0; +- } +- timeout *= server->nr_targets; +- spin_unlock(&server->srv_lock); +- +- /* +- * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE +- * here since they are implicitly done when session drops. +- */ +- switch (smb2_command) { +- /* +- * BB Should we keep oplock break and add flush to exceptions? +- */ +- case SMB2_TREE_DISCONNECT: +- case SMB2_CANCEL: +- case SMB2_CLOSE: +- case SMB2_OPLOCK_BREAK: +- return -EAGAIN; +- } +- +- /* +- * Give demultiplex thread up to 10 seconds to each target available for +- * reconnect -- should be greater than cifs socket timeout which is 7 +- * seconds. +- * +- * On "soft" mounts we wait once. Hard mounts keep retrying until +- * process is killed or server comes back on-line. +- */ +- do { +- rc = wait_event_interruptible_timeout(server->response_q, +- (server->tcpStatus != CifsNeedReconnect), +- timeout * HZ); +- if (rc < 0) { +- cifs_dbg(FYI, "%s: aborting reconnect due to received signal\n", +- __func__); +- return -ERESTARTSYS; +- } +- +- /* are we still trying to reconnect? */ +- spin_lock(&server->srv_lock); +- if (server->tcpStatus != CifsNeedReconnect) { +- spin_unlock(&server->srv_lock); +- return 0; +- } +- spin_unlock(&server->srv_lock); +- } while (retry); +- +- cifs_dbg(FYI, "%s: gave up waiting on reconnect\n", __func__); +- return -EHOSTDOWN; +-} +- + static int + smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + struct TCP_Server_Info *server) +@@ -243,7 +183,27 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + (!tcon->ses->server) || !server) + return -EIO; + +- rc = wait_for_server_reconnect(server, smb2_command, tcon->retry); ++ spin_lock(&server->srv_lock); ++ if (server->tcpStatus == CifsNeedReconnect) { ++ /* ++ * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE ++ * here since they are implicitly done when session drops. ++ */ ++ switch (smb2_command) { ++ /* ++ * BB Should we keep oplock break and add flush to exceptions? ++ */ ++ case SMB2_TREE_DISCONNECT: ++ case SMB2_CANCEL: ++ case SMB2_CLOSE: ++ case SMB2_OPLOCK_BREAK: ++ spin_unlock(&server->srv_lock); ++ return -EAGAIN; ++ } ++ } ++ spin_unlock(&server->srv_lock); ++ ++ rc = cifs_wait_for_server_reconnect(server, tcon->retry); + if (rc) + return rc; + +-- +2.39.2 + + diff --git a/patches.suse/cifs-prevent-data-race-in-smb2_reconnect-.patch b/patches.suse/cifs-prevent-data-race-in-smb2_reconnect-.patch new file mode 100644 index 0000000..b6d4b71 --- /dev/null +++ b/patches.suse/cifs-prevent-data-race-in-smb2_reconnect-.patch @@ -0,0 +1,168 @@ +From: Paulo Alcantara +Date: Mon, 30 Jan 2023 20:33:29 -0300 +Subject: [PATCH] cifs: prevent data race in smb2_reconnect() +Git-commit: 3c0070f54b3128de498c2dd9934a21f0dd867111 +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +Make sure to get an up-to-date TCP_Server_Info::nr_targets value prior +to waiting the server to be reconnected in smb2_reconnect(). It is +set in cifs_tcp_ses_needs_reconnect() and protected by +TCP_Server_Info::srv_lock. + +Signed-off-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/smb2pdu.c | 119 +++++++++++++++++++++++++--------------------- + 1 file changed, 64 insertions(+), 55 deletions(-) + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 2c9ffa921e6f..2d5c3df2277d 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -139,6 +139,66 @@ smb2_hdr_assemble(struct smb2_hdr *shdr, __le16 smb2_cmd, + return; + } + ++static int wait_for_server_reconnect(struct TCP_Server_Info *server, ++ __le16 smb2_command, bool retry) ++{ ++ int timeout = 10; ++ int rc; ++ ++ spin_lock(&server->srv_lock); ++ if (server->tcpStatus != CifsNeedReconnect) { ++ spin_unlock(&server->srv_lock); ++ return 0; ++ } ++ timeout *= server->nr_targets; ++ spin_unlock(&server->srv_lock); ++ ++ /* ++ * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE ++ * here since they are implicitly done when session drops. ++ */ ++ switch (smb2_command) { ++ /* ++ * BB Should we keep oplock break and add flush to exceptions? ++ */ ++ case SMB2_TREE_DISCONNECT: ++ case SMB2_CANCEL: ++ case SMB2_CLOSE: ++ case SMB2_OPLOCK_BREAK: ++ return -EAGAIN; ++ } ++ ++ /* ++ * Give demultiplex thread up to 10 seconds to each target available for ++ * reconnect -- should be greater than cifs socket timeout which is 7 ++ * seconds. ++ * ++ * On "soft" mounts we wait once. Hard mounts keep retrying until ++ * process is killed or server comes back on-line. ++ */ ++ do { ++ rc = wait_event_interruptible_timeout(server->response_q, ++ (server->tcpStatus != CifsNeedReconnect), ++ timeout * HZ); ++ if (rc < 0) { ++ cifs_dbg(FYI, "%s: aborting reconnect due to received signal\n", ++ __func__); ++ return -ERESTARTSYS; ++ } ++ ++ /* are we still trying to reconnect? */ ++ spin_lock(&server->srv_lock); ++ if (server->tcpStatus != CifsNeedReconnect) { ++ spin_unlock(&server->srv_lock); ++ return 0; ++ } ++ spin_unlock(&server->srv_lock); ++ } while (retry); ++ ++ cifs_dbg(FYI, "%s: gave up waiting on reconnect\n", __func__); ++ return -EHOSTDOWN; ++} ++ + static int + smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + struct TCP_Server_Info *server) +@@ -146,7 +206,6 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + int rc = 0; + struct nls_table *nls_codepage; + struct cifs_ses *ses; +- int retries; + + /* + * SMB2s NegProt, SessSetup, Logoff do not have tcon yet so +@@ -184,61 +243,11 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + (!tcon->ses->server) || !server) + return -EIO; + ++ rc = wait_for_server_reconnect(server, smb2_command, tcon->retry); ++ if (rc) ++ return rc; ++ + ses = tcon->ses; +- retries = server->nr_targets; +- +- /* +- * Give demultiplex thread up to 10 seconds to each target available for +- * reconnect -- should be greater than cifs socket timeout which is 7 +- * seconds. +- */ +- while (server->tcpStatus == CifsNeedReconnect) { +- /* +- * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE +- * here since they are implicitly done when session drops. +- */ +- switch (smb2_command) { +- /* +- * BB Should we keep oplock break and add flush to exceptions? +- */ +- case SMB2_TREE_DISCONNECT: +- case SMB2_CANCEL: +- case SMB2_CLOSE: +- case SMB2_OPLOCK_BREAK: +- return -EAGAIN; +- } +- +- rc = wait_event_interruptible_timeout(server->response_q, +- (server->tcpStatus != CifsNeedReconnect), +- 10 * HZ); +- if (rc < 0) { +- cifs_dbg(FYI, "%s: aborting reconnect due to a received signal by the process\n", +- __func__); +- return -ERESTARTSYS; +- } +- +- /* are we still trying to reconnect? */ +- spin_lock(&server->srv_lock); +- if (server->tcpStatus != CifsNeedReconnect) { +- spin_unlock(&server->srv_lock); +- break; +- } +- spin_unlock(&server->srv_lock); +- +- if (retries && --retries) +- continue; +- +- /* +- * on "soft" mounts we wait once. Hard mounts keep +- * retrying until process is killed or server comes +- * back on-line +- */ +- if (!tcon->retry) { +- cifs_dbg(FYI, "gave up waiting on reconnect in smb_init\n"); +- return -EHOSTDOWN; +- } +- retries = server->nr_targets; +- } + + spin_lock(&ses->chan_lock); + if (!cifs_chan_needs_reconnect(ses, server) && !tcon->need_reconnect) { +-- +2.39.2 + + diff --git a/patches.suse/cifs-print-last-update-time-for-interface-list.patch b/patches.suse/cifs-print-last-update-time-for-interface-list.patch new file mode 100644 index 0000000..0342fd7 --- /dev/null +++ b/patches.suse/cifs-print-last-update-time-for-interface-list.patch @@ -0,0 +1,39 @@ +From: Shyam Prasad N +Date: Fri, 23 Dec 2022 10:41:25 +0000 +Subject: [PATCH] cifs: print last update time for interface list +Git-commit: 05844bd661d9fd478df1175b6639bf2d9398becb +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +We store the last updated time for interface list while +parsing the interfaces. This change is to just print that +info in DebugData. + +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/cifs_debug.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c +index 612f0bb284c9..1911f7016fa1 100644 +--- a/fs/cifs/cifs_debug.c ++++ b/fs/cifs/cifs_debug.c +@@ -456,8 +456,10 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v) + + spin_lock(&ses->iface_lock); + if (ses->iface_count) +- seq_printf(m, "\n\n\tServer interfaces: %zu", +- ses->iface_count); ++ seq_printf(m, "\n\n\tServer interfaces: %zu" ++ "\tLast updated: %lu seconds ago", ++ ses->iface_count, ++ (jiffies - ses->iface_last_update) / HZ); + j = 0; + list_for_each_entry(iface, &ses->iface_list, + iface_head) { +-- +2.39.2 + + diff --git a/patches.suse/cifs-remove-unneeded-2bytes-of-padding-from-smb2-tree-connect.patch b/patches.suse/cifs-remove-unneeded-2bytes-of-padding-from-smb2-tree-connect.patch new file mode 100644 index 0000000..bb48de2 --- /dev/null +++ b/patches.suse/cifs-remove-unneeded-2bytes-of-padding-from-smb2-tree-connect.patch @@ -0,0 +1,55 @@ +From: Namjae Jeon +Date: Wed, 8 Feb 2023 18:34:37 +0900 +Subject: [PATCH] cifs: remove unneeded 2bytes of padding from smb2 tree + connect +Git-commit: 5574920c7a6b0ce7f3d0888ccf1efb9b7870b928 +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +Due to the 2bytes of padding from the smb2 tree connect request, +there is an unneeded difference between the rfc1002 length and the actual +frame length. In the case of windows client, it is sent by matching it +exactly. + +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/smb2pdu.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index c5cb2639b3f1..b16b41d35560 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -1867,12 +1867,12 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, + if (unc_path == NULL) + return -ENOMEM; + +- unc_path_len = cifs_strtoUTF16(unc_path, tree, strlen(tree), cp) + 1; ++ unc_path_len = cifs_strtoUTF16(unc_path, tree, strlen(tree), cp); ++ if (unc_path_len <= 0) { ++ kfree(unc_path); ++ return -EINVAL; ++ } + unc_path_len *= 2; +- if (unc_path_len < 2) { +- kfree(unc_path); +- return -EINVAL; +- } + + /* SMB2 TREE_CONNECT request must be called with TreeId == 0 */ + tcon->tid = 0; +@@ -1894,7 +1894,7 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, + /* Testing shows that buffer offset must be at location of Buffer[0] */ + req->PathOffset = cpu_to_le16(sizeof(struct smb2_tree_connect_req) + - 1 /* pad */); +- req->PathLength = cpu_to_le16(unc_path_len - 2); ++ req->PathLength = cpu_to_le16(unc_path_len); + iov[1].iov_base = unc_path; + iov[1].iov_len = unc_path_len; + +-- +2.39.2 + + diff --git a/patches.suse/cifs-return-a-single-use-cfid-if-we-did-not-get-a-lease.patch b/patches.suse/cifs-return-a-single-use-cfid-if-we-did-not-get-a-lease.patch new file mode 100644 index 0000000..7c08d8c --- /dev/null +++ b/patches.suse/cifs-return-a-single-use-cfid-if-we-did-not-get-a-lease.patch @@ -0,0 +1,99 @@ +From: Ronnie Sahlberg +Date: Fri, 17 Feb 2023 13:35:01 +1000 +Subject: [PATCH] cifs: return a single-use cfid if we did not get a lease +Git-commit: 8e843bf38f7be0766642a91523cfa65f2b021a8a +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +If we did not get a lease we can still return a single use cfid to the caller. +The cfid will not have has_lease set and will thus not be shared with any +other concurrent users and will be freed immediately when the caller +drops the handle. + +This avoids extra roundtrips for servers that do not support directory leases +where they would first fail to get a cfid with a lease and then fallback +to try a normal SMB2_open() + +Signed-off-by: Ronnie Sahlberg +Cc: stable@vger.kernel.org +Reviewed-by: Bharath SM +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/cached_dir.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/fs/cifs/cached_dir.c b/fs/cifs/cached_dir.c +index d5e5d757fc56..75d5e06306ea 100644 +--- a/fs/cifs/cached_dir.c ++++ b/fs/cifs/cached_dir.c +@@ -14,6 +14,7 @@ + + static struct cached_fid *init_cached_dir(const char *path); + static void free_cached_dir(struct cached_fid *cfid); ++static void smb2_close_cached_fid(struct kref *ref); + + static struct cached_fid *find_or_create_cached_dir(struct cached_fids *cfids, + const char *path, +@@ -221,6 +222,7 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + } + goto oshr_free; + } ++ cfid->tcon = tcon; + cfid->is_open = true; + + o_rsp = (struct smb2_create_rsp *)rsp_iov[0].iov_base; +@@ -233,7 +235,6 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + if (o_rsp->OplockLevel != SMB2_OPLOCK_LEVEL_LEASE) + goto oshr_free; + +- + smb2_parse_contexts(server, o_rsp, + &oparms.fid->epoch, + oparms.fid->lease_key, &oplock, +@@ -260,7 +261,6 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + } + } + cfid->dentry = dentry; +- cfid->tcon = tcon; + cfid->time = jiffies; + cfid->has_lease = true; + +@@ -271,7 +271,7 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + free_rsp_buf(resp_buftype[0], rsp_iov[0].iov_base); + free_rsp_buf(resp_buftype[1], rsp_iov[1].iov_base); + spin_lock(&cfids->cfid_list_lock); +- if (!cfid->has_lease) { ++ if (rc && !cfid->has_lease) { + if (cfid->on_list) { + list_del(&cfid->entry); + cfid->on_list = false; +@@ -280,6 +280,15 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + rc = -ENOENT; + } + spin_unlock(&cfids->cfid_list_lock); ++ if (!rc && !cfid->has_lease) { ++ /* ++ * We are guaranteed to have two references at this point. ++ * One for the caller and one for a potential lease. ++ * Release the Lease-ref so that the directory will be closed ++ * when the caller closes the cached handle. ++ */ ++ kref_put(&cfid->refcount, smb2_close_cached_fid); ++ } + if (rc) { + if (cfid->is_open) + SMB2_close(0, cfid->tcon, cfid->fid.persistent_fid, +@@ -340,6 +349,7 @@ smb2_close_cached_fid(struct kref *ref) + if (cfid->is_open) { + SMB2_close(0, cfid->tcon, cfid->fid.persistent_fid, + cfid->fid.volatile_fid); ++ atomic_dec(&cfid->tcon->num_remote_opens); + } + + free_cached_dir(cfid); +-- +2.39.2 + + diff --git a/patches.suse/cifs-reuse-cifs_match_ipaddr-for-comparison-of-dstaddr-too.patch b/patches.suse/cifs-reuse-cifs_match_ipaddr-for-comparison-of-dstaddr-too.patch new file mode 100644 index 0000000..06a63c3 --- /dev/null +++ b/patches.suse/cifs-reuse-cifs_match_ipaddr-for-comparison-of-dstaddr-too.patch @@ -0,0 +1,61 @@ +From: Shyam Prasad N +Date: Tue, 27 Dec 2022 14:09:32 +0000 +Subject: [PATCH] cifs: reuse cifs_match_ipaddr for comparison of dstaddr too +Git-commit: 410612b0726b2ee68808da7bd27103d96b4cf898 +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +We have two pieces of code that does pretty much the same +comparison. This change reuses cifs_match_ipaddr within +match_address. + +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/connect.c | 28 ++-------------------------- + 1 file changed, 2 insertions(+), 26 deletions(-) + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 5dabd8dc3e8e..5233f14f0636 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -1344,32 +1344,8 @@ match_port(struct TCP_Server_Info *server, struct sockaddr *addr) + + static bool match_server_address(struct TCP_Server_Info *server, struct sockaddr *addr) + { +- switch (addr->sa_family) { +- case AF_INET: { +- struct sockaddr_in *addr4 = (struct sockaddr_in *)addr; +- struct sockaddr_in *srv_addr4 = +- (struct sockaddr_in *)&server->dstaddr; +- +- if (addr4->sin_addr.s_addr != srv_addr4->sin_addr.s_addr) +- return false; +- break; +- } +- case AF_INET6: { +- struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)addr; +- struct sockaddr_in6 *srv_addr6 = +- (struct sockaddr_in6 *)&server->dstaddr; +- +- if (!ipv6_addr_equal(&addr6->sin6_addr, +- &srv_addr6->sin6_addr)) +- return false; +- if (addr6->sin6_scope_id != srv_addr6->sin6_scope_id) +- return false; +- break; +- } +- default: +- WARN_ON(1); +- return false; /* don't expect to be here */ +- } ++ if (!cifs_match_ipaddr(addr, (struct sockaddr *)&server->dstaddr)) ++ return false; + + return true; + } +-- +2.39.2 + + diff --git a/patches.suse/cifs-split-out-smb3_use_rdma_offload-helper.patch b/patches.suse/cifs-split-out-smb3_use_rdma_offload-helper.patch new file mode 100644 index 0000000..7b6bce7 --- /dev/null +++ b/patches.suse/cifs-split-out-smb3_use_rdma_offload-helper.patch @@ -0,0 +1,87 @@ +From: Stefan Metzmacher +Date: Wed, 1 Feb 2023 16:21:40 +0100 +Subject: [PATCH] cifs: split out smb3_use_rdma_offload() helper +Git-commit: a6559cc1d35d3eeafb0296aca347b2f745a28a74 +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +We should have the logic to decide if we want rdma offload +in a single spot in order to advance it in future. + +Signed-off-by: Stefan Metzmacher +Cc: Steve French +Cc: Tom Talpey +Cc: Long Li +Cc: Namjae Jeon +Cc: David Howells +Cc: linux-cifs@vger.kernel.org +Cc: stable@vger.kernel.org +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/smb2pdu.c | 34 ++++++++++++++++++++++++++++------ + 1 file changed, 28 insertions(+), 6 deletions(-) + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 64e2c8b438f4..6a4d621241dd 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -4063,6 +4063,32 @@ SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, + return rc; + } + ++#ifdef CONFIG_CIFS_SMB_DIRECT ++static inline bool smb3_use_rdma_offload(struct cifs_io_parms *io_parms) ++{ ++ struct TCP_Server_Info *server = io_parms->server; ++ struct cifs_tcon *tcon = io_parms->tcon; ++ ++ /* we can only offload if we're connected */ ++ if (!server || !tcon) ++ return false; ++ ++ /* we can only offload on an rdma connection */ ++ if (!server->rdma || !server->smbd_conn) ++ return false; ++ ++ /* we don't support signed offload yet */ ++ if (server->sign) ++ return false; ++ ++ /* offload also has its overhead, so only do it if desired */ ++ if (io_parms->length < server->smbd_conn->rdma_readwrite_threshold) ++ return false; ++ ++ return true; ++} ++#endif /* CONFIG_CIFS_SMB_DIRECT */ ++ + /* + * To form a chain of read requests, any read requests after the first should + * have the end_of_chain boolean set to true. +@@ -4106,9 +4132,7 @@ smb2_new_read_req(void **buf, unsigned int *total_len, + * If we want to do a RDMA write, fill in and append + * smbd_buffer_descriptor_v1 to the end of read request + */ +- if (server->rdma && rdata && !server->sign && +- rdata->bytes >= server->smbd_conn->rdma_readwrite_threshold) { +- ++ if (smb3_use_rdma_offload(io_parms)) { + struct smbd_buffer_descriptor_v1 *v1; + bool need_invalidate = server->dialect == SMB30_PROT_ID; + +@@ -4558,9 +4582,7 @@ smb2_async_writev(struct cifs_writedata *wdata, + * If we want to do a server RDMA read, fill in and append + * smbd_buffer_descriptor_v1 to the end of write request + */ +- if (server->rdma && !server->sign && io_parms->length >= +- server->smbd_conn->rdma_readwrite_threshold) { +- ++ if (smb3_use_rdma_offload(io_parms)) { + struct smbd_buffer_descriptor_v1 *v1; + bool need_invalidate = server->dialect == SMB30_PROT_ID; + +-- +2.39.2 + + diff --git a/patches.suse/cifs-update-internal-module-number-fdbf8072.patch b/patches.suse/cifs-update-internal-module-number-fdbf8072.patch new file mode 100644 index 0000000..a03e859 --- /dev/null +++ b/patches.suse/cifs-update-internal-module-number-fdbf8072.patch @@ -0,0 +1,30 @@ +From: Steve French +Date: Thu, 19 Jan 2023 15:20:21 -0600 +Subject: [PATCH] update internal module version number for cifs.ko +Git-commit: fdbf807215250217c83f1cb715b883cd910102fa +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +From 2.41 to 2.42 + +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/cifsfs.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h +index ea628da503c6..845a0dda5864 100644 +--- a/fs/cifs/cifsfs.h ++++ b/fs/cifs/cifsfs.h +@@ -160,5 +160,5 @@ extern const struct export_operations cifs_export_ops; + + /* when changing internal version - update following two lines at same time */ + #define SMB3_PRODUCT_BUILD 41 +-#define CIFS_VERSION "2.41" ++#define CIFS_VERSION "2.42" + #endif /* _CIFSFS_H */ +-- +2.39.2 + + diff --git a/patches.suse/cifs-update-ip_addr-for-ses-only-for-primary-chan-setup.patch b/patches.suse/cifs-update-ip_addr-for-ses-only-for-primary-chan-setup.patch new file mode 100644 index 0000000..176560d --- /dev/null +++ b/patches.suse/cifs-update-ip_addr-for-ses-only-for-primary-chan-setup.patch @@ -0,0 +1,62 @@ +From: Shyam Prasad N +Date: Fri, 10 Feb 2023 17:41:17 +0000 +Subject: [PATCH] cifs: update ip_addr for ses only for primary chan setup +Git-commit: e77978de4765229e09c8fabcf4f8419ff367317f +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +We update ses->ip_addr whenever we do a session setup. +But this should happen only for primary channel in mchan +scenario. + +Signed-off-by: Shyam Prasad N +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/connect.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 6831eb8cea7c..61872db5d775 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -3708,16 +3708,12 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses, + struct nls_table *nls_info) + { + int rc = -ENOSYS; +- struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr; +- struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr; ++ struct TCP_Server_Info *pserver = CIFS_SERVER_IS_CHAN(server) ? server->primary_server : server; ++ struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&pserver->dstaddr; ++ struct sockaddr_in *addr = (struct sockaddr_in *)&pserver->dstaddr; + bool is_binding = false; + + spin_lock(&ses->ses_lock); +- if (server->dstaddr.ss_family == AF_INET6) +- scnprintf(ses->ip_addr, sizeof(ses->ip_addr), "%pI6", &addr6->sin6_addr); +- else +- scnprintf(ses->ip_addr, sizeof(ses->ip_addr), "%pI4", &addr->sin_addr); +- + if (ses->ses_status != SES_GOOD && + ses->ses_status != SES_NEW && + ses->ses_status != SES_NEED_RECON) { +@@ -3741,6 +3737,14 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses, + ses->ses_status = SES_IN_SETUP; + spin_unlock(&ses->ses_lock); + ++ /* update ses ip_addr only for primary chan */ ++ if (server == pserver) { ++ if (server->dstaddr.ss_family == AF_INET6) ++ scnprintf(ses->ip_addr, sizeof(ses->ip_addr), "%pI6", &addr6->sin6_addr); ++ else ++ scnprintf(ses->ip_addr, sizeof(ses->ip_addr), "%pI4", &addr->sin_addr); ++ } ++ + if (!is_binding) { + ses->capabilities = server->capabilities; + if (!linuxExtEnabled) +-- +2.39.2 + + diff --git a/patches.suse/cifs-use-tcon-allocation-functions-even-for-dummy-tcon.patch b/patches.suse/cifs-use-tcon-allocation-functions-even-for-dummy-tcon.patch new file mode 100644 index 0000000..2d6dd79 --- /dev/null +++ b/patches.suse/cifs-use-tcon-allocation-functions-even-for-dummy-tcon.patch @@ -0,0 +1,46 @@ +From: Shyam Prasad N +Date: Fri, 10 Feb 2023 16:34:31 +0000 +Subject: [PATCH] cifs: use tcon allocation functions even for dummy tcon +Git-commit: df57109bd50b9ed6911f3c2aa914189fe4c1fe2c +References: git-fixes +Patch-mainline: v6.3-rc1 + +In smb2_reconnect_server, we allocate a dummy tcon for +calling reconnect for just the session. This should be +allocated using tconInfoAlloc, and not kmalloc. + +Fixes: 3663c9045f51 ("cifs: check reconnects for channels of active tcons too") +Signed-off-by: Shyam Prasad N +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/smb2pdu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 0954fedfd1bc..ca9d7110ddcb 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -3906,7 +3906,7 @@ void smb2_reconnect_server(struct work_struct *work) + goto done; + + /* allocate a dummy tcon struct used for reconnect */ +- tcon = kzalloc(sizeof(struct cifs_tcon), GFP_KERNEL); ++ tcon = tconInfoAlloc(); + if (!tcon) { + resched = true; + list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) { +@@ -3929,7 +3929,7 @@ void smb2_reconnect_server(struct work_struct *work) + list_del_init(&ses->rlist); + cifs_put_smb_ses(ses); + } +- kfree(tcon); ++ tconInfoFree(tcon); + + done: + cifs_dbg(FYI, "Reconnecting tcons and channels finished\n"); +-- +2.39.2 + + diff --git a/patches.suse/cifs-use-the-least-loaded-channel-for-sending-requests.patch b/patches.suse/cifs-use-the-least-loaded-channel-for-sending-requests.patch new file mode 100644 index 0000000..5f897dd --- /dev/null +++ b/patches.suse/cifs-use-the-least-loaded-channel-for-sending-requests.patch @@ -0,0 +1,82 @@ +From: Shyam Prasad N +Date: Mon, 19 Dec 2022 05:40:44 +0000 +Subject: [PATCH] cifs: use the least loaded channel for sending requests +Git-commit: ea90708d3cf3d0d92c02afe445ad463fb3c6bf10 +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +Till now, we've used a simple round robin approach to +distribute the requests between the channels. This does +not work well if the channels consume the requests at +different speeds, even if the advertised speeds are the +same. + +This change will allow the client to pick the channel +with least number of requests currently in-flight. This +will disregard the link speed, and select a channel +based on the current load of the channels. + +For cases when all the channels are equally loaded, +fall back to the old round robin method. + +Signed-off-by: Shyam Prasad N +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/transport.c | 33 +++++++++++++++++++++++++++++---- + 1 file changed, 29 insertions(+), 4 deletions(-) + +diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c +index 520397a09616..b42050c68e6c 100644 +--- a/fs/cifs/transport.c ++++ b/fs/cifs/transport.c +@@ -1007,15 +1007,40 @@ cifs_cancelled_callback(struct mid_q_entry *mid) + struct TCP_Server_Info *cifs_pick_channel(struct cifs_ses *ses) + { + uint index = 0; ++ unsigned int min_in_flight = UINT_MAX, max_in_flight = 0; ++ struct TCP_Server_Info *server = NULL; ++ int i; + + if (!ses) + return NULL; + +- /* round robin */ +- index = (uint)atomic_inc_return(&ses->chan_seq); +- + spin_lock(&ses->chan_lock); +- index %= ses->chan_count; ++ for (i = 0; i < ses->chan_count; i++) { ++ server = ses->chans[i].server; ++ if (!server) ++ continue; ++ ++ /* ++ * strictly speaking, we should pick up req_lock to read ++ * server->in_flight. But it shouldn't matter much here if we ++ * race while reading this data. The worst that can happen is ++ * that we could use a channel that's not least loaded. Avoiding ++ * taking the lock could help reduce wait time, which is ++ * important for this function ++ */ ++ if (server->in_flight < min_in_flight) { ++ min_in_flight = server->in_flight; ++ index = i; ++ } ++ if (server->in_flight > max_in_flight) ++ max_in_flight = server->in_flight; ++ } ++ ++ /* if all channels are equally loaded, fall back to round-robin */ ++ if (min_in_flight == max_in_flight) { ++ index = (uint)atomic_inc_return(&ses->chan_seq); ++ index %= ses->chan_count; ++ } + spin_unlock(&ses->chan_lock); + + return ses->chans[index].server; +-- +2.39.2 + + diff --git a/patches.suse/clk-Honor-CLK_OPS_PARENT_ENABLE-in-clk_core_is_enabl.patch b/patches.suse/clk-Honor-CLK_OPS_PARENT_ENABLE-in-clk_core_is_enabl.patch new file mode 100644 index 0000000..ae2edea --- /dev/null +++ b/patches.suse/clk-Honor-CLK_OPS_PARENT_ENABLE-in-clk_core_is_enabl.patch @@ -0,0 +1,68 @@ +From 79200d5851c8e7179f68a4a6f162d8f1bde4986f Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Tue, 3 Jan 2023 17:23:30 +0800 +Subject: [PATCH] clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled() +Git-commit: 79200d5851c8e7179f68a4a6f162d8f1bde4986f +Patch-mainline: v6.3-rc1 +References: git-fixes + +In the previous commits that added CLK_OPS_PARENT_ENABLE, support for +this flag was only added to rate change operations (rate setting and +reparent) and disabling unused subtree. It was not added to the +clock gate related operations. Any hardware driver that needs it for +these operations will either see bogus results, or worse, hang. + +This has been seen on MT8192 and MT8195, where the imp_ii2_* clk +drivers set this, but dumping debugfs clk_summary would cause it +to hang. + +Prepare parent on prepare and enable parent on enable dependencies are +already handled automatically by the core as part of its sequencing. +Whether the case for "enable parent on prepare" should be supported by +this flag or not is not clear, and thus ignored for now. + +This change solely fixes the handling of clk_core_is_enabled, i.e. +enabling the parent clock when reading the hardware state. Unfortunately +clk_core_is_enabled is called in a variety of places, sometimes with +the enable clock already held. To avoid deadlocking, the core will +ignore readouts and just return false if CLK_OPS_PARENT_ENABLE is set +but the parent isn't currently enabled. + +Fixes: fc8726a2c021 ("clk: core: support clocks which requires parents enable (part 2)") +Fixes: a4b3518d146f ("clk: core: support clocks which requires parents enable (part 1)") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20230103092330.494102-1-wenst@chromium.org +Tested-by: AngeloGioacchino Del Regno +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Stephen Boyd +Acked-by: Takashi Iwai + +--- + drivers/clk/clk.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index e62552a75f08..496b86e2753c 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -244,6 +244,17 @@ static bool clk_core_is_enabled(struct clk_core *core) + } + } + ++ /* ++ * This could be called with the enable lock held, or from atomic ++ * context. If the parent isn't enabled already, we can't do ++ * anything here. We can also assume this clock isn't enabled. ++ */ ++ if ((core->flags & CLK_OPS_PARENT_ENABLE) && core->parent) ++ if (!clk_core_is_enabled(core->parent)) { ++ ret = false; ++ goto done; ++ } ++ + ret = core->ops->is_enabled(core->hw); + done: + if (core->rpm_enabled) +-- +2.35.3 + diff --git a/patches.suse/clk-imx-avoid-memory-leak.patch b/patches.suse/clk-imx-avoid-memory-leak.patch new file mode 100644 index 0000000..3c8ead2 --- /dev/null +++ b/patches.suse/clk-imx-avoid-memory-leak.patch @@ -0,0 +1,41 @@ +From f4419db4086e8c31821da14140e81498516a3c75 Mon Sep 17 00:00:00 2001 +From: Peng Fan +Date: Wed, 4 Jan 2023 19:00:29 +0800 +Subject: [PATCH] clk: imx: avoid memory leak +Git-commit: f4419db4086e8c31821da14140e81498516a3c75 +Patch-mainline: v6.3-rc1 +References: git-fixes + +In case imx_register_uart_clocks return early, the imx_uart_clocks +memory will be no freed. So execute kfree always to avoid memory leak. + +Fixes: 379c9a24cc23 ("clk: imx: Fix reparenting of UARTs not associated with stdout") +Signed-off-by: Peng Fan +Reviewed-by: Abel Vesa +Signed-off-by: Abel Vesa +Link: https://lore.kernel.org/r/20230104110032.1220721-2-peng.fan@oss.nxp.com +Acked-by: Takashi Iwai + +--- + drivers/clk/imx/clk.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/imx/clk.c b/drivers/clk/imx/clk.c +index b636cc099d96..5b73a477f11f 100644 +--- a/drivers/clk/imx/clk.c ++++ b/drivers/clk/imx/clk.c +@@ -205,9 +205,10 @@ static int __init imx_clk_disable_uart(void) + clk_disable_unprepare(imx_uart_clocks[i]); + clk_put(imx_uart_clocks[i]); + } +- kfree(imx_uart_clocks); + } + ++ kfree(imx_uart_clocks); ++ + return 0; + } + late_initcall_sync(imx_clk_disable_uart); +-- +2.35.3 + diff --git a/patches.suse/clk-mxl-Add-option-to-override-gate-clks.patch b/patches.suse/clk-mxl-Add-option-to-override-gate-clks.patch new file mode 100644 index 0000000..28273d9 --- /dev/null +++ b/patches.suse/clk-mxl-Add-option-to-override-gate-clks.patch @@ -0,0 +1,72 @@ +From a5d49bd369b8588c0ee9d4d0a2c0160558a3ab69 Mon Sep 17 00:00:00 2001 +From: Rahul Tanwar +Date: Thu, 13 Oct 2022 14:48:32 +0800 +Subject: [PATCH] clk: mxl: Add option to override gate clks +Git-commit: a5d49bd369b8588c0ee9d4d0a2c0160558a3ab69 +Patch-mainline: v6.2-rc1 +References: git-fixes + +In MxL's LGM SoC, gate clocks can be controlled either from CGU clk driver +i.e. this driver or directly from power management driver/daemon. It is +dependent on the power policy/profile requirements of the end product. + +To support such use cases, provide option to override gate clks enable/disable +by adding a flag GATE_CLK_HW which controls if these gate clks are controlled +by HW i.e. this driver or overridden in order to allow it to be controlled +by power profiles instead. + +Reviewed-by: Yi xin Zhu +Signed-off-by: Rahul Tanwar +Link: https://lore.kernel.org/r/bdc9c89317b5d338a6c4f1d49386b696e947a672.1665642720.git.rtanwar@maxlinear.com +[sboyd@kernel.org: Add braces on many line if-else] +Signed-off-by: Stephen Boyd +Acked-by: Takashi Iwai + +--- + drivers/clk/x86/clk-cgu.c | 16 +++++++++++++++- + drivers/clk/x86/clk-cgu.h | 1 + + 2 files changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/x86/clk-cgu.c b/drivers/clk/x86/clk-cgu.c +index 1f7e93de67bc..4278a687076c 100644 +--- a/drivers/clk/x86/clk-cgu.c ++++ b/drivers/clk/x86/clk-cgu.c +@@ -354,8 +354,22 @@ int lgm_clk_register_branches(struct lgm_clk_provider *ctx, + hw = lgm_clk_register_fixed_factor(ctx, list); + break; + case CLK_TYPE_GATE: +- hw = lgm_clk_register_gate(ctx, list); ++ if (list->gate_flags & GATE_CLK_HW) { ++ hw = lgm_clk_register_gate(ctx, list); ++ } else { ++ /* ++ * GATE_CLKs can be controlled either from ++ * CGU clk driver i.e. this driver or directly ++ * from power management driver/daemon. It is ++ * dependent on the power policy/profile requirements ++ * of the end product. To override control of gate ++ * clks from this driver, provide NULL for this index ++ * of gate clk provider. ++ */ ++ hw = NULL; ++ } + break; ++ + default: + dev_err(ctx->dev, "invalid clk type\n"); + return -EINVAL; +diff --git a/drivers/clk/x86/clk-cgu.h b/drivers/clk/x86/clk-cgu.h +index 0aa0f35d63a0..73ce84345f81 100644 +--- a/drivers/clk/x86/clk-cgu.h ++++ b/drivers/clk/x86/clk-cgu.h +@@ -197,6 +197,7 @@ struct lgm_clk_branch { + /* clock flags definition */ + #define CLOCK_FLAG_VAL_INIT BIT(16) + #define MUX_CLK_SW BIT(17) ++#define GATE_CLK_HW BIT(18) + + #define LGM_MUX(_id, _name, _pdata, _f, _reg, \ + _shift, _width, _cf, _v) \ +-- +2.35.3 + diff --git a/patches.suse/clk-mxl-Fix-a-clk-entry-by-adding-relevant-flags.patch b/patches.suse/clk-mxl-Fix-a-clk-entry-by-adding-relevant-flags.patch new file mode 100644 index 0000000..0abc2e9 --- /dev/null +++ b/patches.suse/clk-mxl-Fix-a-clk-entry-by-adding-relevant-flags.patch @@ -0,0 +1,75 @@ +From 106ef3bda21006fe37b62c85931230a6355d78d3 Mon Sep 17 00:00:00 2001 +From: Rahul Tanwar +Date: Thu, 13 Oct 2022 14:48:33 +0800 +Subject: [PATCH] clk: mxl: Fix a clk entry by adding relevant flags +Git-commit: 106ef3bda21006fe37b62c85931230a6355d78d3 +Patch-mainline: v6.2-rc1 +References: git-fixes + +One of the clock entry "dcl" clk has some HW limitations. One is that +its rate can only by changed by changing its parent clk's rate & two is +that HW does not support enable/disable for this clk. + +Handle above two limitations by adding relevant flags. Add standard flag +CLK_SET_RATE_PARENT to handle rate change and add driver internal flag +DIV_CLK_NO_MASK to handle enable/disable. + +Fixes: d058fd9e8984 ("clk: intel: Add CGU clock driver for a new SoC") +Reviewed-by: Yi xin Zhu +Signed-off-by: Rahul Tanwar +Link: https://lore.kernel.org/r/a4770e7225f8a0c03c8ab2ba80434a4e8e9afb17.1665642720.git.rtanwar@maxlinear.com +Signed-off-by: Stephen Boyd +Acked-by: Takashi Iwai + +--- + drivers/clk/x86/clk-cgu.c | 5 +++-- + drivers/clk/x86/clk-cgu.h | 1 + + drivers/clk/x86/clk-lgm.c | 4 ++-- + 3 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/x86/clk-cgu.c b/drivers/clk/x86/clk-cgu.c +index 4278a687076c..89b53f280aee 100644 +--- a/drivers/clk/x86/clk-cgu.c ++++ b/drivers/clk/x86/clk-cgu.c +@@ -164,8 +164,9 @@ static int lgm_clk_divider_enable_disable(struct clk_hw *hw, int enable) + { + struct lgm_clk_divider *div = to_lgm_clk_divider(hw); + +- lgm_set_clk_val(div->membase, div->reg, div->shift_gate, +- div->width_gate, enable); ++ if (div->flags != DIV_CLK_NO_MASK) ++ lgm_set_clk_val(div->membase, div->reg, div->shift_gate, ++ div->width_gate, enable); + return 0; + } + +diff --git a/drivers/clk/x86/clk-cgu.h b/drivers/clk/x86/clk-cgu.h +index 73ce84345f81..bcaf8aec94e5 100644 +--- a/drivers/clk/x86/clk-cgu.h ++++ b/drivers/clk/x86/clk-cgu.h +@@ -198,6 +198,7 @@ struct lgm_clk_branch { + #define CLOCK_FLAG_VAL_INIT BIT(16) + #define MUX_CLK_SW BIT(17) + #define GATE_CLK_HW BIT(18) ++#define DIV_CLK_NO_MASK BIT(19) + + #define LGM_MUX(_id, _name, _pdata, _f, _reg, \ + _shift, _width, _cf, _v) \ +diff --git a/drivers/clk/x86/clk-lgm.c b/drivers/clk/x86/clk-lgm.c +index e312af42e97a..4de77b2c750d 100644 +--- a/drivers/clk/x86/clk-lgm.c ++++ b/drivers/clk/x86/clk-lgm.c +@@ -255,8 +255,8 @@ static const struct lgm_clk_branch lgm_branch_clks[] = { + LGM_FIXED(LGM_CLK_SLIC, "slic", NULL, 0, CGU_IF_CLK1, + 8, 2, CLOCK_FLAG_VAL_INIT, 8192000, 2), + LGM_FIXED(LGM_CLK_DOCSIS, "v_docsis", NULL, 0, 0, 0, 0, 0, 16000000, 0), +- LGM_DIV(LGM_CLK_DCL, "dcl", "v_ifclk", 0, CGU_PCMCR, +- 25, 3, 0, 0, 0, 0, dcl_div), ++ LGM_DIV(LGM_CLK_DCL, "dcl", "v_ifclk", CLK_SET_RATE_PARENT, CGU_PCMCR, ++ 25, 3, 0, 0, DIV_CLK_NO_MASK, 0, dcl_div), + LGM_MUX(LGM_CLK_PCM, "pcm", pcm_p, 0, CGU_C55_PCMCR, + 0, 1, CLK_MUX_ROUND_CLOSEST, 0), + LGM_FIXED_FACTOR(LGM_CLK_DDR_PHY, "ddr_phy", "ddr", +-- +2.35.3 + diff --git a/patches.suse/clk-mxl-Remove-redundant-spinlocks.patch b/patches.suse/clk-mxl-Remove-redundant-spinlocks.patch new file mode 100644 index 0000000..715d751 --- /dev/null +++ b/patches.suse/clk-mxl-Remove-redundant-spinlocks.patch @@ -0,0 +1,514 @@ +From eaabee88a88a26b108be8d120fc072dfaf462cef Mon Sep 17 00:00:00 2001 +From: Rahul Tanwar +Date: Thu, 13 Oct 2022 14:48:31 +0800 +Subject: [PATCH] clk: mxl: Remove redundant spinlocks +Git-commit: eaabee88a88a26b108be8d120fc072dfaf462cef +Patch-mainline: v6.2-rc1 +References: git-fixes + +Patch 1/4 of this patch series switches from direct readl/writel +based register access to regmap based register access. Instead +of using direct readl/writel, regmap API's are used to read, write +& read-modify-write clk registers. Regmap API's already use their +own spinlocks to serialize the register accesses across multiple +cores in which case additional driver spinlocks becomes redundant. + +Hence, remove redundant spinlocks from driver in this patch 2/4. + +Reviewed-by: Yi xin Zhu +Signed-off-by: Rahul Tanwar +Link: https://lore.kernel.org/r/a8a02c8773b88924503a9fdaacd37dd2e6488bf3.1665642720.git.rtanwar@maxlinear.com +Signed-off-by: Stephen Boyd +Acked-by: Takashi Iwai + +--- + drivers/clk/x86/clk-cgu-pll.c | 13 ------ + drivers/clk/x86/clk-cgu.c | 80 ++++------------------------------- + drivers/clk/x86/clk-cgu.h | 6 --- + drivers/clk/x86/clk-lgm.c | 1 - + 4 files changed, 9 insertions(+), 91 deletions(-) + +diff --git a/drivers/clk/x86/clk-cgu-pll.c b/drivers/clk/x86/clk-cgu-pll.c +index c83083affe88..409dbf55f4ca 100644 +--- a/drivers/clk/x86/clk-cgu-pll.c ++++ b/drivers/clk/x86/clk-cgu-pll.c +@@ -41,13 +41,10 @@ static unsigned long lgm_pll_recalc_rate(struct clk_hw *hw, unsigned long prate) + { + struct lgm_clk_pll *pll = to_lgm_clk_pll(hw); + unsigned int div, mult, frac; +- unsigned long flags; + +- spin_lock_irqsave(&pll->lock, flags); + mult = lgm_get_clk_val(pll->membase, PLL_REF_DIV(pll->reg), 0, 12); + div = lgm_get_clk_val(pll->membase, PLL_REF_DIV(pll->reg), 18, 6); + frac = lgm_get_clk_val(pll->membase, pll->reg, 2, 24); +- spin_unlock_irqrestore(&pll->lock, flags); + + if (pll->type == TYPE_LJPLL) + div *= 4; +@@ -58,12 +55,9 @@ static unsigned long lgm_pll_recalc_rate(struct clk_hw *hw, unsigned long prate) + static int lgm_pll_is_enabled(struct clk_hw *hw) + { + struct lgm_clk_pll *pll = to_lgm_clk_pll(hw); +- unsigned long flags; + unsigned int ret; + +- spin_lock_irqsave(&pll->lock, flags); + ret = lgm_get_clk_val(pll->membase, pll->reg, 0, 1); +- spin_unlock_irqrestore(&pll->lock, flags); + + return ret; + } +@@ -71,16 +65,13 @@ static int lgm_pll_is_enabled(struct clk_hw *hw) + static int lgm_pll_enable(struct clk_hw *hw) + { + struct lgm_clk_pll *pll = to_lgm_clk_pll(hw); +- unsigned long flags; + u32 val; + int ret; + +- spin_lock_irqsave(&pll->lock, flags); + lgm_set_clk_val(pll->membase, pll->reg, 0, 1, 1); + ret = regmap_read_poll_timeout_atomic(pll->membase, pll->reg, + val, (val & 0x1), 1, 100); + +- spin_unlock_irqrestore(&pll->lock, flags); + + return ret; + } +@@ -88,11 +79,8 @@ static int lgm_pll_enable(struct clk_hw *hw) + static void lgm_pll_disable(struct clk_hw *hw) + { + struct lgm_clk_pll *pll = to_lgm_clk_pll(hw); +- unsigned long flags; + +- spin_lock_irqsave(&pll->lock, flags); + lgm_set_clk_val(pll->membase, pll->reg, 0, 1, 0); +- spin_unlock_irqrestore(&pll->lock, flags); + } + + static const struct clk_ops lgm_pll_ops = { +@@ -123,7 +111,6 @@ lgm_clk_register_pll(struct lgm_clk_provider *ctx, + return ERR_PTR(-ENOMEM); + + pll->membase = ctx->membase; +- pll->lock = ctx->lock; + pll->reg = list->reg; + pll->flags = list->flags; + pll->type = list->type; +diff --git a/drivers/clk/x86/clk-cgu.c b/drivers/clk/x86/clk-cgu.c +index f5f30a18f486..1f7e93de67bc 100644 +--- a/drivers/clk/x86/clk-cgu.c ++++ b/drivers/clk/x86/clk-cgu.c +@@ -25,14 +25,10 @@ + static struct clk_hw *lgm_clk_register_fixed(struct lgm_clk_provider *ctx, + const struct lgm_clk_branch *list) + { +- unsigned long flags; + +- if (list->div_flags & CLOCK_FLAG_VAL_INIT) { +- spin_lock_irqsave(&ctx->lock, flags); ++ if (list->div_flags & CLOCK_FLAG_VAL_INIT) + lgm_set_clk_val(ctx->membase, list->div_off, list->div_shift, + list->div_width, list->div_val); +- spin_unlock_irqrestore(&ctx->lock, flags); +- } + + return clk_hw_register_fixed_rate(NULL, list->name, + list->parent_data[0].name, +@@ -42,33 +38,27 @@ static struct clk_hw *lgm_clk_register_fixed(struct lgm_clk_provider *ctx, + static u8 lgm_clk_mux_get_parent(struct clk_hw *hw) + { + struct lgm_clk_mux *mux = to_lgm_clk_mux(hw); +- unsigned long flags; + u32 val; + +- spin_lock_irqsave(&mux->lock, flags); + if (mux->flags & MUX_CLK_SW) + val = mux->reg; + else + val = lgm_get_clk_val(mux->membase, mux->reg, mux->shift, + mux->width); +- spin_unlock_irqrestore(&mux->lock, flags); + return clk_mux_val_to_index(hw, NULL, mux->flags, val); + } + + static int lgm_clk_mux_set_parent(struct clk_hw *hw, u8 index) + { + struct lgm_clk_mux *mux = to_lgm_clk_mux(hw); +- unsigned long flags; + u32 val; + + val = clk_mux_index_to_val(NULL, mux->flags, index); +- spin_lock_irqsave(&mux->lock, flags); + if (mux->flags & MUX_CLK_SW) + mux->reg = val; + else + lgm_set_clk_val(mux->membase, mux->reg, mux->shift, + mux->width, val); +- spin_unlock_irqrestore(&mux->lock, flags); + + return 0; + } +@@ -91,7 +81,7 @@ static struct clk_hw * + lgm_clk_register_mux(struct lgm_clk_provider *ctx, + const struct lgm_clk_branch *list) + { +- unsigned long flags, cflags = list->mux_flags; ++ unsigned long cflags = list->mux_flags; + struct device *dev = ctx->dev; + u8 shift = list->mux_shift; + u8 width = list->mux_width; +@@ -112,7 +102,6 @@ lgm_clk_register_mux(struct lgm_clk_provider *ctx, + init.num_parents = list->num_parents; + + mux->membase = ctx->membase; +- mux->lock = ctx->lock; + mux->reg = reg; + mux->shift = shift; + mux->width = width; +@@ -124,11 +113,8 @@ lgm_clk_register_mux(struct lgm_clk_provider *ctx, + if (ret) + return ERR_PTR(ret); + +- if (cflags & CLOCK_FLAG_VAL_INIT) { +- spin_lock_irqsave(&mux->lock, flags); ++ if (cflags & CLOCK_FLAG_VAL_INIT) + lgm_set_clk_val(mux->membase, reg, shift, width, list->mux_val); +- spin_unlock_irqrestore(&mux->lock, flags); +- } + + return hw; + } +@@ -137,13 +123,10 @@ static unsigned long + lgm_clk_divider_recalc_rate(struct clk_hw *hw, unsigned long parent_rate) + { + struct lgm_clk_divider *divider = to_lgm_clk_divider(hw); +- unsigned long flags; + unsigned int val; + +- spin_lock_irqsave(÷r->lock, flags); + val = lgm_get_clk_val(divider->membase, divider->reg, + divider->shift, divider->width); +- spin_unlock_irqrestore(÷r->lock, flags); + + return divider_recalc_rate(hw, parent_rate, val, divider->table, + divider->flags, divider->width); +@@ -164,7 +147,6 @@ lgm_clk_divider_set_rate(struct clk_hw *hw, unsigned long rate, + unsigned long prate) + { + struct lgm_clk_divider *divider = to_lgm_clk_divider(hw); +- unsigned long flags; + int value; + + value = divider_get_val(rate, prate, divider->table, +@@ -172,10 +154,8 @@ lgm_clk_divider_set_rate(struct clk_hw *hw, unsigned long rate, + if (value < 0) + return value; + +- spin_lock_irqsave(÷r->lock, flags); + lgm_set_clk_val(divider->membase, divider->reg, + divider->shift, divider->width, value); +- spin_unlock_irqrestore(÷r->lock, flags); + + return 0; + } +@@ -183,12 +163,9 @@ lgm_clk_divider_set_rate(struct clk_hw *hw, unsigned long rate, + static int lgm_clk_divider_enable_disable(struct clk_hw *hw, int enable) + { + struct lgm_clk_divider *div = to_lgm_clk_divider(hw); +- unsigned long flags; + +- spin_lock_irqsave(&div->lock, flags); + lgm_set_clk_val(div->membase, div->reg, div->shift_gate, + div->width_gate, enable); +- spin_unlock_irqrestore(&div->lock, flags); + return 0; + } + +@@ -214,7 +191,7 @@ static struct clk_hw * + lgm_clk_register_divider(struct lgm_clk_provider *ctx, + const struct lgm_clk_branch *list) + { +- unsigned long flags, cflags = list->div_flags; ++ unsigned long cflags = list->div_flags; + struct device *dev = ctx->dev; + struct lgm_clk_divider *div; + struct clk_init_data init = {}; +@@ -237,7 +214,6 @@ lgm_clk_register_divider(struct lgm_clk_provider *ctx, + init.num_parents = 1; + + div->membase = ctx->membase; +- div->lock = ctx->lock; + div->reg = reg; + div->shift = shift; + div->width = width; +@@ -252,11 +228,8 @@ lgm_clk_register_divider(struct lgm_clk_provider *ctx, + if (ret) + return ERR_PTR(ret); + +- if (cflags & CLOCK_FLAG_VAL_INIT) { +- spin_lock_irqsave(&div->lock, flags); ++ if (cflags & CLOCK_FLAG_VAL_INIT) + lgm_set_clk_val(div->membase, reg, shift, width, list->div_val); +- spin_unlock_irqrestore(&div->lock, flags); +- } + + return hw; + } +@@ -265,7 +238,6 @@ static struct clk_hw * + lgm_clk_register_fixed_factor(struct lgm_clk_provider *ctx, + const struct lgm_clk_branch *list) + { +- unsigned long flags; + struct clk_hw *hw; + + hw = clk_hw_register_fixed_factor(ctx->dev, list->name, +@@ -274,12 +246,9 @@ lgm_clk_register_fixed_factor(struct lgm_clk_provider *ctx, + if (IS_ERR(hw)) + return ERR_CAST(hw); + +- if (list->div_flags & CLOCK_FLAG_VAL_INIT) { +- spin_lock_irqsave(&ctx->lock, flags); ++ if (list->div_flags & CLOCK_FLAG_VAL_INIT) + lgm_set_clk_val(ctx->membase, list->div_off, list->div_shift, + list->div_width, list->div_val); +- spin_unlock_irqrestore(&ctx->lock, flags); +- } + + return hw; + } +@@ -287,13 +256,10 @@ lgm_clk_register_fixed_factor(struct lgm_clk_provider *ctx, + static int lgm_clk_gate_enable(struct clk_hw *hw) + { + struct lgm_clk_gate *gate = to_lgm_clk_gate(hw); +- unsigned long flags; + unsigned int reg; + +- spin_lock_irqsave(&gate->lock, flags); + reg = GATE_HW_REG_EN(gate->reg); + lgm_set_clk_val(gate->membase, reg, gate->shift, 1, 1); +- spin_unlock_irqrestore(&gate->lock, flags); + + return 0; + } +@@ -301,25 +267,19 @@ static int lgm_clk_gate_enable(struct clk_hw *hw) + static void lgm_clk_gate_disable(struct clk_hw *hw) + { + struct lgm_clk_gate *gate = to_lgm_clk_gate(hw); +- unsigned long flags; + unsigned int reg; + +- spin_lock_irqsave(&gate->lock, flags); + reg = GATE_HW_REG_DIS(gate->reg); + lgm_set_clk_val(gate->membase, reg, gate->shift, 1, 1); +- spin_unlock_irqrestore(&gate->lock, flags); + } + + static int lgm_clk_gate_is_enabled(struct clk_hw *hw) + { + struct lgm_clk_gate *gate = to_lgm_clk_gate(hw); + unsigned int reg, ret; +- unsigned long flags; + +- spin_lock_irqsave(&gate->lock, flags); + reg = GATE_HW_REG_STAT(gate->reg); + ret = lgm_get_clk_val(gate->membase, reg, gate->shift, 1); +- spin_unlock_irqrestore(&gate->lock, flags); + + return ret; + } +@@ -334,7 +294,7 @@ static struct clk_hw * + lgm_clk_register_gate(struct lgm_clk_provider *ctx, + const struct lgm_clk_branch *list) + { +- unsigned long flags, cflags = list->gate_flags; ++ unsigned long cflags = list->gate_flags; + const char *pname = list->parent_data[0].name; + struct device *dev = ctx->dev; + u8 shift = list->gate_shift; +@@ -355,7 +315,6 @@ lgm_clk_register_gate(struct lgm_clk_provider *ctx, + init.num_parents = pname ? 1 : 0; + + gate->membase = ctx->membase; +- gate->lock = ctx->lock; + gate->reg = reg; + gate->shift = shift; + gate->flags = cflags; +@@ -367,9 +326,7 @@ lgm_clk_register_gate(struct lgm_clk_provider *ctx, + return ERR_PTR(ret); + + if (cflags & CLOCK_FLAG_VAL_INIT) { +- spin_lock_irqsave(&gate->lock, flags); + lgm_set_clk_val(gate->membase, reg, shift, 1, list->gate_val); +- spin_unlock_irqrestore(&gate->lock, flags); + } + + return hw; +@@ -444,24 +401,18 @@ lgm_clk_ddiv_recalc_rate(struct clk_hw *hw, unsigned long parent_rate) + static int lgm_clk_ddiv_enable(struct clk_hw *hw) + { + struct lgm_clk_ddiv *ddiv = to_lgm_clk_ddiv(hw); +- unsigned long flags; + +- spin_lock_irqsave(&ddiv->lock, flags); + lgm_set_clk_val(ddiv->membase, ddiv->reg, ddiv->shift_gate, + ddiv->width_gate, 1); +- spin_unlock_irqrestore(&ddiv->lock, flags); + return 0; + } + + static void lgm_clk_ddiv_disable(struct clk_hw *hw) + { + struct lgm_clk_ddiv *ddiv = to_lgm_clk_ddiv(hw); +- unsigned long flags; + +- spin_lock_irqsave(&ddiv->lock, flags); + lgm_set_clk_val(ddiv->membase, ddiv->reg, ddiv->shift_gate, + ddiv->width_gate, 0); +- spin_unlock_irqrestore(&ddiv->lock, flags); + } + + static int +@@ -498,32 +449,25 @@ lgm_clk_ddiv_set_rate(struct clk_hw *hw, unsigned long rate, + { + struct lgm_clk_ddiv *ddiv = to_lgm_clk_ddiv(hw); + u32 div, ddiv1, ddiv2; +- unsigned long flags; + + div = DIV_ROUND_CLOSEST_ULL((u64)prate, rate); + +- spin_lock_irqsave(&ddiv->lock, flags); + if (lgm_get_clk_val(ddiv->membase, ddiv->reg, ddiv->shift2, 1)) { + div = DIV_ROUND_CLOSEST_ULL((u64)div, 5); + div = div * 2; + } + +- if (div <= 0) { +- spin_unlock_irqrestore(&ddiv->lock, flags); ++ if (div <= 0) + return -EINVAL; +- } + +- if (lgm_clk_get_ddiv_val(div, &ddiv1, &ddiv2)) { +- spin_unlock_irqrestore(&ddiv->lock, flags); ++ if (lgm_clk_get_ddiv_val(div, &ddiv1, &ddiv2)) + return -EINVAL; +- } + + lgm_set_clk_val(ddiv->membase, ddiv->reg, ddiv->shift0, ddiv->width0, + ddiv1 - 1); + + lgm_set_clk_val(ddiv->membase, ddiv->reg, ddiv->shift1, ddiv->width1, + ddiv2 - 1); +- spin_unlock_irqrestore(&ddiv->lock, flags); + + return 0; + } +@@ -534,18 +478,15 @@ lgm_clk_ddiv_round_rate(struct clk_hw *hw, unsigned long rate, + { + struct lgm_clk_ddiv *ddiv = to_lgm_clk_ddiv(hw); + u32 div, ddiv1, ddiv2; +- unsigned long flags; + u64 rate64; + + div = DIV_ROUND_CLOSEST_ULL((u64)*prate, rate); + + /* if predivide bit is enabled, modify div by factor of 2.5 */ +- spin_lock_irqsave(&ddiv->lock, flags); + if (lgm_get_clk_val(ddiv->membase, ddiv->reg, ddiv->shift2, 1)) { + div = div * 2; + div = DIV_ROUND_CLOSEST_ULL((u64)div, 5); + } +- spin_unlock_irqrestore(&ddiv->lock, flags); + + if (div <= 0) + return *prate; +@@ -559,12 +500,10 @@ lgm_clk_ddiv_round_rate(struct clk_hw *hw, unsigned long rate, + do_div(rate64, ddiv2); + + /* if predivide bit is enabled, modify rounded rate by factor of 2.5 */ +- spin_lock_irqsave(&ddiv->lock, flags); + if (lgm_get_clk_val(ddiv->membase, ddiv->reg, ddiv->shift2, 1)) { + rate64 = rate64 * 2; + rate64 = DIV_ROUND_CLOSEST_ULL(rate64, 5); + } +- spin_unlock_irqrestore(&ddiv->lock, flags); + + return rate64; + } +@@ -601,7 +540,6 @@ int lgm_clk_register_ddiv(struct lgm_clk_provider *ctx, + init.num_parents = 1; + + ddiv->membase = ctx->membase; +- ddiv->lock = ctx->lock; + ddiv->reg = list->reg; + ddiv->shift0 = list->shift0; + ddiv->width0 = list->width0; +diff --git a/drivers/clk/x86/clk-cgu.h b/drivers/clk/x86/clk-cgu.h +index dbcb66468797..0aa0f35d63a0 100644 +--- a/drivers/clk/x86/clk-cgu.h ++++ b/drivers/clk/x86/clk-cgu.h +@@ -18,7 +18,6 @@ struct lgm_clk_mux { + u8 shift; + u8 width; + unsigned long flags; +- spinlock_t lock; + }; + + struct lgm_clk_divider { +@@ -31,7 +30,6 @@ struct lgm_clk_divider { + u8 width_gate; + unsigned long flags; + const struct clk_div_table *table; +- spinlock_t lock; + }; + + struct lgm_clk_ddiv { +@@ -49,7 +47,6 @@ struct lgm_clk_ddiv { + unsigned int mult; + unsigned int div; + unsigned long flags; +- spinlock_t lock; + }; + + struct lgm_clk_gate { +@@ -58,7 +55,6 @@ struct lgm_clk_gate { + unsigned int reg; + u8 shift; + unsigned long flags; +- spinlock_t lock; + }; + + enum lgm_clk_type { +@@ -82,7 +78,6 @@ struct lgm_clk_provider { + struct device_node *np; + struct device *dev; + struct clk_hw_onecell_data clk_data; +- spinlock_t lock; + }; + + enum pll_type { +@@ -97,7 +92,6 @@ struct lgm_clk_pll { + unsigned int reg; + unsigned long flags; + enum pll_type type; +- spinlock_t lock; + }; + + /** +diff --git a/drivers/clk/x86/clk-lgm.c b/drivers/clk/x86/clk-lgm.c +index 4fa2bcaf71c8..e312af42e97a 100644 +--- a/drivers/clk/x86/clk-lgm.c ++++ b/drivers/clk/x86/clk-lgm.c +@@ -444,7 +444,6 @@ static int lgm_cgu_probe(struct platform_device *pdev) + + ctx->np = np; + ctx->dev = dev; +- spin_lock_init(&ctx->lock); + + ret = lgm_clk_register_plls(ctx, lgm_pll_clks, + ARRAY_SIZE(lgm_pll_clks)); +-- +2.35.3 + diff --git a/patches.suse/clk-mxl-Switch-from-direct-readl-writel-based-IO-to-.patch b/patches.suse/clk-mxl-Switch-from-direct-readl-writel-based-IO-to-.patch new file mode 100644 index 0000000..5b0f7ac --- /dev/null +++ b/patches.suse/clk-mxl-Switch-from-direct-readl-writel-based-IO-to-.patch @@ -0,0 +1,244 @@ +From 036177310bac5534de44ff6a7b60a4d2c0b6567c Mon Sep 17 00:00:00 2001 +From: Rahul Tanwar +Date: Thu, 13 Oct 2022 14:48:30 +0800 +Subject: [PATCH] clk: mxl: Switch from direct readl/writel based IO to regmap based IO +Git-commit: 036177310bac5534de44ff6a7b60a4d2c0b6567c +Patch-mainline: v6.2-rc1 +References: git-fixes + +Earlier version of driver used direct io remapped register read +writes using readl/writel. But we need secure boot access which +is only possible when registers are read & written using regmap. +This is because the security bus/hook is written & coupled only +with regmap layer. + +Switch the driver from direct readl/writel based register accesses +to regmap based register accesses. + +Additionally, update the license headers to latest status. + +Reviewed-by: Yi xin Zhu +Signed-off-by: Rahul Tanwar +Link: https://lore.kernel.org/r/2610331918206e0e3bd18babb39393a558fb34f9.1665642720.git.rtanwar@maxlinear.com +Signed-off-by: Stephen Boyd +Acked-by: Takashi Iwai + +--- + drivers/clk/x86/Kconfig | 5 +++-- + drivers/clk/x86/clk-cgu-pll.c | 10 +++++---- + drivers/clk/x86/clk-cgu.c | 5 +++-- + drivers/clk/x86/clk-cgu.h | 38 +++++++++++++++++++---------------- + drivers/clk/x86/clk-lgm.c | 13 ++++++++---- + 5 files changed, 42 insertions(+), 29 deletions(-) + +diff --git a/drivers/clk/x86/Kconfig b/drivers/clk/x86/Kconfig +index 69642e15fcc1..ced99e082e3d 100644 +--- a/drivers/clk/x86/Kconfig ++++ b/drivers/clk/x86/Kconfig +@@ -1,8 +1,9 @@ + # SPDX-License-Identifier: GPL-2.0-only + config CLK_LGM_CGU + depends on OF && HAS_IOMEM && (X86 || COMPILE_TEST) ++ select MFD_SYSCON + select OF_EARLY_FLATTREE + bool "Clock driver for Lightning Mountain(LGM) platform" + help +- Clock Generation Unit(CGU) driver for Intel Lightning Mountain(LGM) +- network processor SoC. ++ Clock Generation Unit(CGU) driver for MaxLinear's x86 based ++ Lightning Mountain(LGM) network processor SoC. +diff --git a/drivers/clk/x86/clk-cgu-pll.c b/drivers/clk/x86/clk-cgu-pll.c +index 3179557b5f78..c83083affe88 100644 +--- a/drivers/clk/x86/clk-cgu-pll.c ++++ b/drivers/clk/x86/clk-cgu-pll.c +@@ -1,8 +1,9 @@ + // SPDX-License-Identifier: GPL-2.0 + /* ++ * Copyright (C) 2020-2022 MaxLinear, Inc. + * Copyright (C) 2020 Intel Corporation. +- * Zhu YiXin +- * Rahul Tanwar ++ * Zhu Yixin ++ * Rahul Tanwar + */ + + #include +@@ -76,8 +77,9 @@ static int lgm_pll_enable(struct clk_hw *hw) + + spin_lock_irqsave(&pll->lock, flags); + lgm_set_clk_val(pll->membase, pll->reg, 0, 1, 1); +- ret = readl_poll_timeout_atomic(pll->membase + pll->reg, +- val, (val & 0x1), 1, 100); ++ ret = regmap_read_poll_timeout_atomic(pll->membase, pll->reg, ++ val, (val & 0x1), 1, 100); ++ + spin_unlock_irqrestore(&pll->lock, flags); + + return ret; +diff --git a/drivers/clk/x86/clk-cgu.c b/drivers/clk/x86/clk-cgu.c +index 33de600e0c38..f5f30a18f486 100644 +--- a/drivers/clk/x86/clk-cgu.c ++++ b/drivers/clk/x86/clk-cgu.c +@@ -1,8 +1,9 @@ + // SPDX-License-Identifier: GPL-2.0 + /* ++ * Copyright (C) 2020-2022 MaxLinear, Inc. + * Copyright (C) 2020 Intel Corporation. +- * Zhu YiXin +- * Rahul Tanwar ++ * Zhu Yixin ++ * Rahul Tanwar + */ + #include + #include +diff --git a/drivers/clk/x86/clk-cgu.h b/drivers/clk/x86/clk-cgu.h +index 4e22bfb22312..dbcb66468797 100644 +--- a/drivers/clk/x86/clk-cgu.h ++++ b/drivers/clk/x86/clk-cgu.h +@@ -1,18 +1,19 @@ + /* SPDX-License-Identifier: GPL-2.0 */ + /* +- * Copyright(c) 2020 Intel Corporation. +- * Zhu YiXin +- * Rahul Tanwar ++ * Copyright (C) 2020-2022 MaxLinear, Inc. ++ * Copyright (C) 2020 Intel Corporation. ++ * Zhu Yixin ++ * Rahul Tanwar + */ + + #ifndef __CLK_CGU_H + #define __CLK_CGU_H + +-#include ++#include + + struct lgm_clk_mux { + struct clk_hw hw; +- void __iomem *membase; ++ struct regmap *membase; + unsigned int reg; + u8 shift; + u8 width; +@@ -22,7 +23,7 @@ struct lgm_clk_mux { + + struct lgm_clk_divider { + struct clk_hw hw; +- void __iomem *membase; ++ struct regmap *membase; + unsigned int reg; + u8 shift; + u8 width; +@@ -35,7 +36,7 @@ struct lgm_clk_divider { + + struct lgm_clk_ddiv { + struct clk_hw hw; +- void __iomem *membase; ++ struct regmap *membase; + unsigned int reg; + u8 shift0; + u8 width0; +@@ -53,7 +54,7 @@ struct lgm_clk_ddiv { + + struct lgm_clk_gate { + struct clk_hw hw; +- void __iomem *membase; ++ struct regmap *membase; + unsigned int reg; + u8 shift; + unsigned long flags; +@@ -77,7 +78,7 @@ enum lgm_clk_type { + * @clk_data: array of hw clocks and clk number. + */ + struct lgm_clk_provider { +- void __iomem *membase; ++ struct regmap *membase; + struct device_node *np; + struct device *dev; + struct clk_hw_onecell_data clk_data; +@@ -92,7 +93,7 @@ enum pll_type { + + struct lgm_clk_pll { + struct clk_hw hw; +- void __iomem *membase; ++ struct regmap *membase; + unsigned int reg; + unsigned long flags; + enum pll_type type; +@@ -300,29 +301,32 @@ struct lgm_clk_branch { + .div = _d, \ + } + +-static inline void lgm_set_clk_val(void __iomem *membase, u32 reg, ++static inline void lgm_set_clk_val(struct regmap *membase, u32 reg, + u8 shift, u8 width, u32 set_val) + { + u32 mask = (GENMASK(width - 1, 0) << shift); +- u32 regval; + +- regval = readl(membase + reg); +- regval = (regval & ~mask) | ((set_val << shift) & mask); +- writel(regval, membase + reg); ++ regmap_update_bits(membase, reg, mask, set_val << shift); + } + +-static inline u32 lgm_get_clk_val(void __iomem *membase, u32 reg, ++static inline u32 lgm_get_clk_val(struct regmap *membase, u32 reg, + u8 shift, u8 width) + { + u32 mask = (GENMASK(width - 1, 0) << shift); + u32 val; + +- val = readl(membase + reg); ++ if (regmap_read(membase, reg, &val)) { ++ WARN_ONCE(1, "Failed to read clk reg: 0x%x\n", reg); ++ return 0; ++ } ++ + val = (val & mask) >> shift; + + return val; + } + ++ ++ + int lgm_clk_register_branches(struct lgm_clk_provider *ctx, + const struct lgm_clk_branch *list, + unsigned int nr_clk); +diff --git a/drivers/clk/x86/clk-lgm.c b/drivers/clk/x86/clk-lgm.c +index 020f4e83a5cc..4fa2bcaf71c8 100644 +--- a/drivers/clk/x86/clk-lgm.c ++++ b/drivers/clk/x86/clk-lgm.c +@@ -1,10 +1,12 @@ + // SPDX-License-Identifier: GPL-2.0 + /* ++ * Copyright (C) 2020-2022 MaxLinear, Inc. + * Copyright (C) 2020 Intel Corporation. +- * Zhu YiXin +- * Rahul Tanwar ++ * Zhu Yixin ++ * Rahul Tanwar + */ + #include ++#include + #include + #include + #include +@@ -433,9 +435,12 @@ static int lgm_cgu_probe(struct platform_device *pdev) + + ctx->clk_data.num = CLK_NR_CLKS; + +- ctx->membase = devm_platform_ioremap_resource(pdev, 0); +- if (IS_ERR(ctx->membase)) ++ ctx->membase = syscon_node_to_regmap(np); ++ if (IS_ERR_OR_NULL(ctx->membase)) { ++ dev_err(dev, "Failed to get clk CGU iomem\n"); + return PTR_ERR(ctx->membase); ++ } ++ + + ctx->np = np; + ctx->dev = dev; +-- +2.35.3 + diff --git a/patches.suse/clk-mxl-syscon_node_to_regmap-returns-error-pointers.patch b/patches.suse/clk-mxl-syscon_node_to_regmap-returns-error-pointers.patch new file mode 100644 index 0000000..6e759e9 --- /dev/null +++ b/patches.suse/clk-mxl-syscon_node_to_regmap-returns-error-pointers.patch @@ -0,0 +1,43 @@ +From 7256d1f4618b40792d1e9b9b6cb1406a13cad2dd Mon Sep 17 00:00:00 2001 +From: Rahul Tanwar +Date: Tue, 25 Oct 2022 19:03:57 +0800 +Subject: [PATCH] clk: mxl: syscon_node_to_regmap() returns error pointers +Git-commit: 7256d1f4618b40792d1e9b9b6cb1406a13cad2dd +Patch-mainline: v6.2-rc1 +References: git-fixes + +Commit 036177310bac ("clk: mxl: Switch from direct readl/writel based IO +to regmap based IO") introduced code resulting in below warning issued +by the smatch static checker. + + drivers/clk/x86/clk-lgm.c:441 lgm_cgu_probe() warn: passing zero to 'PTR_ERR' + +Fix the warning by replacing incorrect IS_ERR_OR_NULL() with IS_ERR(). + +Fixes: 036177310bac ("clk: mxl: Switch from direct readl/writel based IO to regmap based IO") +Reported-by: Dan Carpenter +Signed-off-by: Rahul Tanwar +Link: https://lore.kernel.org/r/49e339d4739e4ae4c92b00c1b2918af0755d4122.1666695221.git.rtanwar@maxlinear.com +Signed-off-by: Stephen Boyd +Acked-by: Takashi Iwai + +--- + drivers/clk/x86/clk-lgm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/x86/clk-lgm.c b/drivers/clk/x86/clk-lgm.c +index 4de77b2c750d..f69455dd1c98 100644 +--- a/drivers/clk/x86/clk-lgm.c ++++ b/drivers/clk/x86/clk-lgm.c +@@ -436,7 +436,7 @@ static int lgm_cgu_probe(struct platform_device *pdev) + ctx->clk_data.num = CLK_NR_CLKS; + + ctx->membase = syscon_node_to_regmap(np); +- if (IS_ERR_OR_NULL(ctx->membase)) { ++ if (IS_ERR(ctx->membase)) { + dev_err(dev, "Failed to get clk CGU iomem\n"); + return PTR_ERR(ctx->membase); + } +-- +2.35.3 + diff --git a/patches.suse/clk-qcom-gcc-qcs404-disable-gpll-04-_out_aux-parents.patch b/patches.suse/clk-qcom-gcc-qcs404-disable-gpll-04-_out_aux-parents.patch new file mode 100644 index 0000000..e68830e --- /dev/null +++ b/patches.suse/clk-qcom-gcc-qcs404-disable-gpll-04-_out_aux-parents.patch @@ -0,0 +1,146 @@ +From 712c64caf31374de57aa193a9dff57172b2f6f82 Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Mon, 26 Dec 2022 06:21:43 +0200 +Subject: [PATCH] clk: qcom: gcc-qcs404: disable gpll[04]_out_aux parents +Git-commit: 712c64caf31374de57aa193a9dff57172b2f6f82 +Patch-mainline: v6.3-rc1 +References: git-fixes + +On the QCS404 platform the driver for the Global Clock Controller +doens't define gpll0_out_aux and gpll4_out_aux clocks, so it's not +possible to use them as parents. Remove entries for these clocks. + +Note: backporting this patch to earlier kernels would also require a +previous patch which switches the gcc driver to use ARRAY_SIZE for +parent data arrays. + +Fixes: 652f1813c113 ("clk: qcom: gcc: Add global clock controller driver for QCS404") +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221226042154.2666748-6-dmitry.baryshkov@linaro.org +Acked-by: Takashi Iwai + +--- + drivers/clk/qcom/gcc-qcs404.c | 16 ---------------- + 1 file changed, 16 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-qcs404.c b/drivers/clk/qcom/gcc-qcs404.c +index f60a0ab42da1..507c42d7f753 100644 +--- a/drivers/clk/qcom/gcc-qcs404.c ++++ b/drivers/clk/qcom/gcc-qcs404.c +@@ -25,11 +25,9 @@ enum { + P_CORE_BI_PLL_TEST_SE, + P_DSI0_PHY_PLL_OUT_BYTECLK, + P_DSI0_PHY_PLL_OUT_DSICLK, +- P_GPLL0_OUT_AUX, + P_GPLL0_OUT_MAIN, + P_GPLL1_OUT_MAIN, + P_GPLL3_OUT_MAIN, +- P_GPLL4_OUT_AUX, + P_GPLL4_OUT_MAIN, + P_GPLL6_OUT_AUX, + P_HDMI_PHY_PLL_CLK, +@@ -109,28 +107,24 @@ static const char * const gcc_parent_names_4[] = { + static const struct parent_map gcc_parent_map_5[] = { + { P_XO, 0 }, + { P_DSI0_PHY_PLL_OUT_BYTECLK, 1 }, +- { P_GPLL0_OUT_AUX, 2 }, + { P_CORE_BI_PLL_TEST_SE, 7 }, + }; + + static const char * const gcc_parent_names_5[] = { + "cxo", + "dsi0pll_byteclk_src", +- "gpll0_out_aux", + "core_bi_pll_test_se", + }; + + static const struct parent_map gcc_parent_map_6[] = { + { P_XO, 0 }, + { P_DSI0_PHY_PLL_OUT_BYTECLK, 2 }, +- { P_GPLL0_OUT_AUX, 3 }, + { P_CORE_BI_PLL_TEST_SE, 7 }, + }; + + static const char * const gcc_parent_names_6[] = { + "cxo", + "dsi0_phy_pll_out_byteclk", +- "gpll0_out_aux", + "core_bi_pll_test_se", + }; + +@@ -139,7 +133,6 @@ static const struct parent_map gcc_parent_map_7[] = { + { P_GPLL0_OUT_MAIN, 1 }, + { P_GPLL3_OUT_MAIN, 2 }, + { P_GPLL6_OUT_AUX, 3 }, +- { P_GPLL4_OUT_AUX, 4 }, + { P_CORE_BI_PLL_TEST_SE, 7 }, + }; + +@@ -148,7 +141,6 @@ static const char * const gcc_parent_names_7[] = { + "gpll0_out_main", + "gpll3_out_main", + "gpll6_out_aux", +- "gpll4_out_aux", + "core_bi_pll_test_se", + }; + +@@ -207,14 +199,12 @@ static const char * const gcc_parent_names_11[] = { + static const struct parent_map gcc_parent_map_12[] = { + { P_XO, 0 }, + { P_DSI0_PHY_PLL_OUT_DSICLK, 1 }, +- { P_GPLL0_OUT_AUX, 2 }, + { P_CORE_BI_PLL_TEST_SE, 7 }, + }; + + static const char * const gcc_parent_names_12[] = { + "cxo", + "dsi0pll_pclk_src", +- "gpll0_out_aux", + "core_bi_pll_test_se", + }; + +@@ -237,40 +227,34 @@ static const char * const gcc_parent_names_13[] = { + static const struct parent_map gcc_parent_map_14[] = { + { P_XO, 0 }, + { P_GPLL0_OUT_MAIN, 1 }, +- { P_GPLL4_OUT_AUX, 2 }, + { P_CORE_BI_PLL_TEST_SE, 7 }, + }; + + static const char * const gcc_parent_names_14[] = { + "cxo", + "gpll0_out_main", +- "gpll4_out_aux", + "core_bi_pll_test_se", + }; + + static const struct parent_map gcc_parent_map_15[] = { + { P_XO, 0 }, +- { P_GPLL0_OUT_AUX, 2 }, + { P_CORE_BI_PLL_TEST_SE, 7 }, + }; + + static const char * const gcc_parent_names_15[] = { + "cxo", +- "gpll0_out_aux", + "core_bi_pll_test_se", + }; + + static const struct parent_map gcc_parent_map_16[] = { + { P_XO, 0 }, + { P_GPLL0_OUT_MAIN, 1 }, +- { P_GPLL0_OUT_AUX, 2 }, + { P_CORE_BI_PLL_TEST_SE, 7 }, + }; + + static const char * const gcc_parent_names_16[] = { + "cxo", + "gpll0_out_main", +- "gpll0_out_aux", + "core_bi_pll_test_se", + }; + +-- +2.35.3 + diff --git a/patches.suse/clk-qcom-gcc-qcs404-fix-names-of-the-DSI-clocks-used.patch b/patches.suse/clk-qcom-gcc-qcs404-fix-names-of-the-DSI-clocks-used.patch new file mode 100644 index 0000000..404763d --- /dev/null +++ b/patches.suse/clk-qcom-gcc-qcs404-fix-names-of-the-DSI-clocks-used.patch @@ -0,0 +1,66 @@ +From 47d94d30cd3dcc743241b4208b1eec7247610c84 Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Mon, 26 Dec 2022 06:21:44 +0200 +Subject: [PATCH] clk: qcom: gcc-qcs404: fix names of the DSI clocks used as parents +Git-commit: 47d94d30cd3dcc743241b4208b1eec7247610c84 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The QCS404 uses 28nm LPM DSI PHY, which registers dsi0pll and +dsi0pllbyte clocks. Fix all DSI PHY clock names used as parents inside +the GCC driver. + +Fixes: 652f1813c113 ("clk: qcom: gcc: Add global clock controller driver for QCS404") +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221226042154.2666748-7-dmitry.baryshkov@linaro.org +Acked-by: Takashi Iwai + +--- + drivers/clk/qcom/gcc-qcs404.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-qcs404.c b/drivers/clk/qcom/gcc-qcs404.c +index 507c42d7f753..67a180d688c3 100644 +--- a/drivers/clk/qcom/gcc-qcs404.c ++++ b/drivers/clk/qcom/gcc-qcs404.c +@@ -112,7 +112,7 @@ static const struct parent_map gcc_parent_map_5[] = { + + static const char * const gcc_parent_names_5[] = { + "cxo", +- "dsi0pll_byteclk_src", ++ "dsi0pllbyte", + "core_bi_pll_test_se", + }; + +@@ -124,7 +124,7 @@ static const struct parent_map gcc_parent_map_6[] = { + + static const char * const gcc_parent_names_6[] = { + "cxo", +- "dsi0_phy_pll_out_byteclk", ++ "dsi0pllbyte", + "core_bi_pll_test_se", + }; + +@@ -167,7 +167,7 @@ static const struct parent_map gcc_parent_map_9[] = { + static const char * const gcc_parent_names_9[] = { + "cxo", + "gpll0_out_main", +- "dsi0_phy_pll_out_dsiclk", ++ "dsi0pll", + "gpll6_out_aux", + "core_bi_pll_test_se", + }; +@@ -204,7 +204,7 @@ static const struct parent_map gcc_parent_map_12[] = { + + static const char * const gcc_parent_names_12[] = { + "cxo", +- "dsi0pll_pclk_src", ++ "dsi0pll", + "core_bi_pll_test_se", + }; + +-- +2.35.3 + diff --git a/patches.suse/clk-ralink-fix-mt7621_gate_is_enabled-function.patch b/patches.suse/clk-ralink-fix-mt7621_gate_is_enabled-function.patch new file mode 100644 index 0000000..91ce348 --- /dev/null +++ b/patches.suse/clk-ralink-fix-mt7621_gate_is_enabled-function.patch @@ -0,0 +1,87 @@ +From 35dcae535afc153fa83f2fe51c0812536c192c58 Mon Sep 17 00:00:00 2001 +From: Sergio Paracuellos +Date: Mon, 6 Feb 2023 09:33:05 +0100 +Subject: [PATCH] clk: ralink: fix 'mt7621_gate_is_enabled()' function +Git-commit: 35dcae535afc153fa83f2fe51c0812536c192c58 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Compiling clock driver with CONFIG_UBSAN enabled shows the following trace: + +Ubsan: shift-out-of-bounds in drivers/clk/ralink/clk-mt7621.c:121:15 +shift exponent 131072 is too large for 32-bit type 'long unsigned int' +Cpu: 1 PID: 1 Comm: swapper/0 Not tainted 5.15.86 #0 +Stack : ... + +Call Trace: +[<80009a58>] show_stack+0x38/0x118 +[<8045ce04>] dump_stack_lvl+0x60/0x80 +[<80458868>] ubsan_epilogue+0x10/0x54 +[<804590e0>] __ubsan_handle_shift_out_of_bounds+0x118/0x190 +[<804c9a10>] mt7621_gate_is_enabled+0x98/0xa0 +[<804bb774>] clk_core_is_enabled+0x34/0x90 +[<80aad73c>] clk_disable_unused_subtree+0x98/0x1e4 +[<80aad6d4>] clk_disable_unused_subtree+0x30/0x1e4 +[<80aad6d4>] clk_disable_unused_subtree+0x30/0x1e4 +[<80aad900>] clk_disable_unused+0x78/0x120 +[<80002030>] do_one_initcall+0x54/0x1f0 +[<80a922a4>] kernel_init_freeable+0x280/0x31c +[<808047c4>] kernel_init+0x20/0x118 +[<80003e58>] ret_from_kernel_thread+0x14/0x1c + +Shifting a value (131032) larger than the type (32 bit unsigned integer) +is undefined behaviour in C. + +The problem is in 'mt7621_gate_is_enabled()' function which is using the +'BIT()' kernel macro with the bit index for the clock gate to check if the +bit is set. When the clock gates structure is created driver is already +setting 'bit_idx' using 'BIT()' macro, so we are wrongly applying an extra +'BIT()' mask here. Removing it solve the problem and makes this function +correct. However when clock gating is correctly working, the kernel starts +disabling those clocks that are not requested. Some drivers for this SoC +are older than this clock driver itself. So to avoid the kernel to disable +clocks that have been enabled until now, we must apply 'CLK_IS_CRITICAL' +flag on gates initialization code. + +Fixes: 48df7a26f470 ("clk: ralink: add clock driver for mt7621 SoC") +Signed-off-by: Sergio Paracuellos +Link: https://lore.kernel.org/r/20230206083305.147582-1-sergio.paracuellos@gmail.com +Signed-off-by: Stephen Boyd +Acked-by: Takashi Iwai + +--- + drivers/clk/ralink/clk-mt7621.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/ralink/clk-mt7621.c b/drivers/clk/ralink/clk-mt7621.c +index 99256659dd96..d95a33293b0a 100644 +--- a/drivers/clk/ralink/clk-mt7621.c ++++ b/drivers/clk/ralink/clk-mt7621.c +@@ -121,7 +121,7 @@ static int mt7621_gate_is_enabled(struct clk_hw *hw) + if (regmap_read(sysc, SYSC_REG_CLKCFG1, &val)) + return 0; + +- return val & BIT(clk_gate->bit_idx); ++ return val & clk_gate->bit_idx; + } + + static const struct clk_ops mt7621_gate_ops = { +@@ -133,8 +133,14 @@ static const struct clk_ops mt7621_gate_ops = { + static int mt7621_gate_ops_init(struct device *dev, + struct mt7621_gate *sclk) + { ++ /* ++ * There are drivers for this SoC that are older ++ * than clock driver and are not prepared for the clock. ++ * We don't want the kernel to disable anything so we ++ * add CLK_IS_CRITICAL flag here. ++ */ + struct clk_init_data init = { +- .flags = CLK_SET_RATE_PARENT, ++ .flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL, + .num_parents = 1, + .parent_names = &sclk->parent_name, + .ops = &mt7621_gate_ops, +-- +2.35.3 + diff --git a/patches.suse/clk-renesas-cpg-mssr-Fix-use-after-free-if-cpg_mssr_.patch b/patches.suse/clk-renesas-cpg-mssr-Fix-use-after-free-if-cpg_mssr_.patch new file mode 100644 index 0000000..0d3aeb7 --- /dev/null +++ b/patches.suse/clk-renesas-cpg-mssr-Fix-use-after-free-if-cpg_mssr_.patch @@ -0,0 +1,49 @@ +From fbfd614aeaa2853c2c575299dfe2458db8eff67e Mon Sep 17 00:00:00 2001 +From: Alexey Khoroshilov +Date: Fri, 23 Dec 2022 17:40:17 +0300 +Subject: [PATCH] clk: renesas: cpg-mssr: Fix use after free if cpg_mssr_common_init() failed +Git-commit: fbfd614aeaa2853c2c575299dfe2458db8eff67e +Patch-mainline: v6.3-rc1 +References: git-fixes + +If cpg_mssr_common_init() fails after assigning priv to global variable +cpg_mssr_priv, it deallocates priv, but cpg_mssr_priv keeps dangling +pointer that potentially can be used later. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 1f7db7bbf031 ("clk: renesas: cpg-mssr: Add early clock support") +Signed-off-by: Alexey Khoroshilov +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/1671806417-32623-1-git-send-email-khoroshilov@ispras.ru +Signed-off-by: Geert Uytterhoeven +Acked-by: Takashi Iwai + +--- + drivers/clk/renesas/renesas-cpg-mssr.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/renesas/renesas-cpg-mssr.c b/drivers/clk/renesas/renesas-cpg-mssr.c +index 1a0cdf001b2f..5dce9779324d 100644 +--- a/drivers/clk/renesas/renesas-cpg-mssr.c ++++ b/drivers/clk/renesas/renesas-cpg-mssr.c +@@ -989,7 +989,6 @@ static int __init cpg_mssr_common_init(struct device *dev, + goto out_err; + } + +- cpg_mssr_priv = priv; + priv->num_core_clks = info->num_total_core_clks; + priv->num_mod_clks = info->num_hw_mod_clks; + priv->last_dt_core_clk = info->last_dt_core_clk; +@@ -1019,6 +1018,8 @@ static int __init cpg_mssr_common_init(struct device *dev, + if (error) + goto out_err; + ++ cpg_mssr_priv = priv; ++ + return 0; + + out_err: +-- +2.35.3 + diff --git a/patches.suse/clk-renesas-cpg-mssr-Remove-superfluous-check-in-res.patch b/patches.suse/clk-renesas-cpg-mssr-Remove-superfluous-check-in-res.patch new file mode 100644 index 0000000..a6582f9 --- /dev/null +++ b/patches.suse/clk-renesas-cpg-mssr-Remove-superfluous-check-in-res.patch @@ -0,0 +1,40 @@ +From 1c052043c79af5f70e80e2acd4dd70904ae08666 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Wed, 11 Jan 2023 09:23:34 +0100 +Subject: [PATCH] clk: renesas: cpg-mssr: Remove superfluous check in resume code +Git-commit: 1c052043c79af5f70e80e2acd4dd70904ae08666 +Patch-mainline: v6.3-rc1 +References: git-fixes + +When the code flow arrives at printing the error message in +cpg_mssr_resume_noirq(), we know for sure that we are not running on an +RZ/A Soc, as the code checked for that before. + +Fixes: ace342097768e35f ("clk: renesas: cpg-mssr: Fix STBCR suspend/resume handling") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/144a3e66d748c0c17f3524ac8fa6ece5bf5b6f1e.1673425314.git.geert+renesas@glider.be +Acked-by: Takashi Iwai + +--- + drivers/clk/renesas/renesas-cpg-mssr.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/clk/renesas/renesas-cpg-mssr.c b/drivers/clk/renesas/renesas-cpg-mssr.c +index 5dce9779324d..202aeb232044 100644 +--- a/drivers/clk/renesas/renesas-cpg-mssr.c ++++ b/drivers/clk/renesas/renesas-cpg-mssr.c +@@ -943,9 +943,8 @@ static int cpg_mssr_resume_noirq(struct device *dev) + } + + if (!i) +- dev_warn(dev, "Failed to enable %s%u[0x%x]\n", +- priv->reg_layout == CLK_REG_LAYOUT_RZ_A ? +- "STB" : "SMSTP", reg, oldval & mask); ++ dev_warn(dev, "Failed to enable SMSTP%u[0x%x]\n", reg, ++ oldval & mask); + } + + return 0; +-- +2.35.3 + diff --git a/patches.suse/comedi-use-menuconfig-for-main-Comedi-menu.patch b/patches.suse/comedi-use-menuconfig-for-main-Comedi-menu.patch new file mode 100644 index 0000000..db372c1 --- /dev/null +++ b/patches.suse/comedi-use-menuconfig-for-main-Comedi-menu.patch @@ -0,0 +1,42 @@ +From 28ecbbae9ea459a0504e243668dae7c86eeedf9a Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Mon, 9 Jan 2023 22:48:44 -0800 +Subject: [PATCH] comedi: use menuconfig for main Comedi menu +Git-commit: 28ecbbae9ea459a0504e243668dae7c86eeedf9a +Patch-mainline: v6.3-rc1 +References: git-fixes + +Bring the Comedi menu in line with most other device drivers +by using "menuconfig" instead of "config" for the top-level entry. +This also fixes a menu presentation issue with xconfig. + +Fixes: ed9eccbe8970 ("Staging: add comedi core") +Signed-off-by: Randy Dunlap +Cc: Ian Abbott +Cc: H Hartley Sweeten +Cc: David Schleef +Cc: Shawn Bohrer +Cc: Frank Mori Hess +Cc: Greg Kroah-Hartman +Link: https://lore.kernel.org/r/20230110064844.18533-1-rdunlap@infradead.org +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/comedi/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/comedi/Kconfig b/drivers/comedi/Kconfig +index 3cb61fa2c5c3..9af280735cba 100644 +--- a/drivers/comedi/Kconfig ++++ b/drivers/comedi/Kconfig +@@ -1,5 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0 +-config COMEDI ++menuconfig COMEDI + tristate "Data acquisition support (comedi)" + help + Enable support for a wide range of data acquisition devices +-- +2.35.3 + diff --git a/patches.suse/crypto-ccp-Avoid-page-allocation-failure-warning-for.patch b/patches.suse/crypto-ccp-Avoid-page-allocation-failure-warning-for.patch new file mode 100644 index 0000000..61ff645 --- /dev/null +++ b/patches.suse/crypto-ccp-Avoid-page-allocation-failure-warning-for.patch @@ -0,0 +1,52 @@ +From 91dfd98216d817ec5f1c55890bacb7b4fe9b068a Mon Sep 17 00:00:00 2001 +From: David Rientjes +Date: Fri, 30 Dec 2022 14:18:46 -0800 +Subject: [PATCH] crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2 +Git-commit: 91dfd98216d817ec5f1c55890bacb7b4fe9b068a +Patch-mainline: v6.3-rc1 +References: git-fixes + +For SEV_GET_ID2, the user provided length does not have a specified +limitation because the length of the ID may change in the future. The +kernel memory allocation, however, is implicitly limited to 4MB on x86 by +the page allocator, otherwise the kzalloc() will fail. + +When this happens, it is best not to spam the kernel log with the warning. +Simply fail the allocation and return ENOMEM to the user. + +Fixes: d6112ea0cb34 ("crypto: ccp - introduce SEV_GET_ID2 command") +Reported-by: Andy Nguyen +Reported-by: Peter Gonda +Suggested-by: Herbert Xu +Signed-off-by: David Rientjes +Acked-by: Tom Lendacky +Signed-off-by: Herbert Xu +Acked-by: Takashi Iwai + +--- + drivers/crypto/ccp/sev-dev.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c +index 06fc7156c04f..56998bc579d6 100644 +--- a/drivers/crypto/ccp/sev-dev.c ++++ b/drivers/crypto/ccp/sev-dev.c +@@ -881,7 +881,14 @@ static int sev_ioctl_do_get_id2(struct sev_issue_cmd *argp) + input_address = (void __user *)input.address; + + if (input.address && input.length) { +- id_blob = kzalloc(input.length, GFP_KERNEL); ++ /* ++ * The length of the ID shouldn't be assumed by software since ++ * it may change in the future. The allocation size is limited ++ * to 1 << (PAGE_SHIFT + MAX_ORDER - 1) by the page allocator. ++ * If the allocation fails, simply return ENOMEM rather than ++ * warning in the kernel log. ++ */ ++ id_blob = kzalloc(input.length, GFP_KERNEL | __GFP_NOWARN); + if (!id_blob) + return -ENOMEM; + +-- +2.35.3 + diff --git a/patches.suse/crypto-ccp-Failure-on-re-initialization-due-to-dupli.patch b/patches.suse/crypto-ccp-Failure-on-re-initialization-due-to-dupli.patch new file mode 100644 index 0000000..47b0469 --- /dev/null +++ b/patches.suse/crypto-ccp-Failure-on-re-initialization-due-to-dupli.patch @@ -0,0 +1,114 @@ +From 299bf602b3f92f1456aef59c6413591fb02e762a Mon Sep 17 00:00:00 2001 +From: Koba Ko +Date: Mon, 9 Jan 2023 10:15:02 +0800 +Subject: [PATCH] crypto: ccp - Failure on re-initialization due to duplicate sysfs filename +Git-commit: 299bf602b3f92f1456aef59c6413591fb02e762a +Patch-mainline: v6.3-rc1 +References: git-fixes + +The following warning appears during the CCP module re-initialization: + +[ 140.965403] sysfs: cannot create duplicate filename +'/devices/pci0000:00/0000:00:07.1/0000:03:00.2/dma/dma0chan0' +[ 140.975736] CPU: 0 PID: 388 Comm: kworker/0:2 Kdump: loaded Not +tainted 6.2.0-0.rc2.18.eln124.x86_64 #1 +[ 140.985185] Hardware name: HPE ProLiant DL325 Gen10/ProLiant DL325 +Gen10, BIOS A41 07/17/2020 +[ 140.993761] Workqueue: events work_for_cpu_fn +[ 140.998151] Call Trace: +[ 141.000613] +[ 141.002726] dump_stack_lvl+0x33/0x46 +[ 141.006415] sysfs_warn_dup.cold+0x17/0x23 +[ 141.010542] sysfs_create_dir_ns+0xba/0xd0 +[ 141.014670] kobject_add_internal+0xba/0x260 +[ 141.018970] kobject_add+0x81/0xb0 +[ 141.022395] device_add+0xdc/0x7e0 +[ 141.025822] ? complete_all+0x20/0x90 +[ 141.029510] __dma_async_device_channel_register+0xc9/0x130 +[ 141.035119] dma_async_device_register+0x19e/0x3b0 +[ 141.039943] ccp_dmaengine_register+0x334/0x3f0 [ccp] +[ 141.045042] ccp5_init+0x662/0x6a0 [ccp] +[ 141.049000] ? devm_kmalloc+0x40/0xd0 +[ 141.052688] ccp_dev_init+0xbb/0xf0 [ccp] +[ 141.056732] ? __pci_set_master+0x56/0xd0 +[ 141.060768] sp_init+0x70/0x90 [ccp] +[ 141.064377] sp_pci_probe+0x186/0x1b0 [ccp] +[ 141.068596] local_pci_probe+0x41/0x80 +[ 141.072374] work_for_cpu_fn+0x16/0x20 +[ 141.076145] process_one_work+0x1c8/0x380 +[ 141.080181] worker_thread+0x1ab/0x380 +[ 141.083953] ? __pfx_worker_thread+0x10/0x10 +[ 141.088250] kthread+0xda/0x100 +[ 141.091413] ? __pfx_kthread+0x10/0x10 +[ 141.095185] ret_from_fork+0x2c/0x50 +[ 141.098788] +[ 141.100996] kobject_add_internal failed for dma0chan0 with -EEXIST, +don't try to register things with the same name in the same directory. +[ 141.113703] ccp 0000:03:00.2: ccp initialization failed + +The /dma/dma0chan0 sysfs file is not removed since dma_chan object +has been released in ccp_dma_release() before releasing dma device. +A correct procedure would be: release dma channels first => unregister +dma device => release ccp dma object. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216888 +Fixes: 68dbe80f5b51 ("crypto: ccp - Release dma channels before dmaengine unrgister") +Tested-by: Vladis Dronov +Signed-off-by: Koba Ko +Reviewed-by: Vladis Dronov +Acked-by: Tom Lendacky +Signed-off-by: Herbert Xu +Acked-by: Takashi Iwai + +--- + drivers/crypto/ccp/ccp-dmaengine.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c +index 9f753cb4f5f1..b386a7063818 100644 +--- a/drivers/crypto/ccp/ccp-dmaengine.c ++++ b/drivers/crypto/ccp/ccp-dmaengine.c +@@ -642,14 +642,26 @@ static void ccp_dma_release(struct ccp_device *ccp) + chan = ccp->ccp_dma_chan + i; + dma_chan = &chan->dma_chan; + +- if (dma_chan->client_count) +- dma_release_channel(dma_chan); +- + tasklet_kill(&chan->cleanup_tasklet); + list_del_rcu(&dma_chan->device_node); + } + } + ++static void ccp_dma_release_channels(struct ccp_device *ccp) ++{ ++ struct ccp_dma_chan *chan; ++ struct dma_chan *dma_chan; ++ unsigned int i; ++ ++ for (i = 0; i < ccp->cmd_q_count; i++) { ++ chan = ccp->ccp_dma_chan + i; ++ dma_chan = &chan->dma_chan; ++ ++ if (dma_chan->client_count) ++ dma_release_channel(dma_chan); ++ } ++} ++ + int ccp_dmaengine_register(struct ccp_device *ccp) + { + struct ccp_dma_chan *chan; +@@ -770,8 +782,9 @@ void ccp_dmaengine_unregister(struct ccp_device *ccp) + if (!dmaengine) + return; + +- ccp_dma_release(ccp); ++ ccp_dma_release_channels(ccp); + dma_async_device_unregister(dma_dev); ++ ccp_dma_release(ccp); + + kmem_cache_destroy(ccp->dma_desc_cache); + kmem_cache_destroy(ccp->dma_cmd_cache); +-- +2.35.3 + diff --git a/patches.suse/crypto-crypto4xx-Call-dma_unmap_page-when-done.patch b/patches.suse/crypto-crypto4xx-Call-dma_unmap_page-when-done.patch new file mode 100644 index 0000000..3197ff5 --- /dev/null +++ b/patches.suse/crypto-crypto4xx-Call-dma_unmap_page-when-done.patch @@ -0,0 +1,63 @@ +From bcdda4301bdc4955d45f7e1ffefb6207967b067e Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Mon, 6 Feb 2023 14:01:53 +0800 +Subject: [PATCH] crypto: crypto4xx - Call dma_unmap_page when done +Git-commit: bcdda4301bdc4955d45f7e1ffefb6207967b067e +Patch-mainline: v6.3-rc1 +References: git-fixes + +In crypto4xx_cipher_done, we should be unmapping the dst page, not +mapping it. + +This was flagged by a sparse warning about the unused addr variable. +While we're at it, also fix a sparse warning regarding the unused +ctx variable in crypto4xx_ahash_done (by actually using it). + +Fixes: 049359d65527 ("crypto: amcc - Add crypt4xx driver") +Signed-off-by: Herbert Xu +Tested-by: Christian Lamparter +Acked-by: Takashi Iwai + +--- + drivers/crypto/amcc/crypto4xx_core.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c +index 280f4b0e7133..50dc783821b6 100644 +--- a/drivers/crypto/amcc/crypto4xx_core.c ++++ b/drivers/crypto/amcc/crypto4xx_core.c +@@ -522,7 +522,6 @@ static void crypto4xx_cipher_done(struct crypto4xx_device *dev, + { + struct skcipher_request *req; + struct scatterlist *dst; +- dma_addr_t addr; + + req = skcipher_request_cast(pd_uinfo->async_req); + +@@ -531,8 +530,8 @@ static void crypto4xx_cipher_done(struct crypto4xx_device *dev, + req->cryptlen, req->dst); + } else { + dst = pd_uinfo->dest_va; +- addr = dma_map_page(dev->core_dev->device, sg_page(dst), +- dst->offset, dst->length, DMA_FROM_DEVICE); ++ dma_unmap_page(dev->core_dev->device, pd->dest, dst->length, ++ DMA_FROM_DEVICE); + } + + if (pd_uinfo->sa_va->sa_command_0.bf.save_iv == SA_SAVE_IV) { +@@ -557,10 +556,9 @@ static void crypto4xx_ahash_done(struct crypto4xx_device *dev, + struct ahash_request *ahash_req; + + ahash_req = ahash_request_cast(pd_uinfo->async_req); +- ctx = crypto_tfm_ctx(ahash_req->base.tfm); ++ ctx = crypto_ahash_ctx(crypto_ahash_reqtfm(ahash_req)); + +- crypto4xx_copy_digest_to_dst(ahash_req->result, pd_uinfo, +- crypto_tfm_ctx(ahash_req->base.tfm)); ++ crypto4xx_copy_digest_to_dst(ahash_req->result, pd_uinfo, ctx); + crypto4xx_ret_sg_desc(dev, pd_uinfo); + + if (pd_uinfo->state & PD_ENTRY_BUSY) +-- +2.35.3 + diff --git a/patches.suse/crypto-essiv-Handle-EBUSY-correctly.patch b/patches.suse/crypto-essiv-Handle-EBUSY-correctly.patch new file mode 100644 index 0000000..49e410d --- /dev/null +++ b/patches.suse/crypto-essiv-Handle-EBUSY-correctly.patch @@ -0,0 +1,54 @@ +From b5a772adf45a32c68bef28e60621f12617161556 Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Fri, 13 Jan 2023 18:24:09 +0800 +Subject: [PATCH] crypto: essiv - Handle EBUSY correctly +Git-commit: b5a772adf45a32c68bef28e60621f12617161556 +Patch-mainline: v6.3-rc1 +References: git-fixes + +As it is essiv only handles the special return value of EINPROGERSS, +which means that in all other cases it will free data related to the +request. + +However, as the caller of essiv may specify MAY_BACKLOG, we also need +to expect EBUSY and treat it in the same way. Otherwise backlogged +requests will trigger a use-after-free. + +Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template...") +Signed-off-by: Herbert Xu +Acked-by: Ard Biesheuvel +Acked-by: Takashi Iwai + +--- + crypto/essiv.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/crypto/essiv.c b/crypto/essiv.c +index e33369df9034..307eba74b901 100644 +--- a/crypto/essiv.c ++++ b/crypto/essiv.c +@@ -171,7 +171,12 @@ static void essiv_aead_done(struct crypto_async_request *areq, int err) + struct aead_request *req = areq->data; + struct essiv_aead_request_ctx *rctx = aead_request_ctx(req); + ++ if (err == -EINPROGRESS) ++ goto out; ++ + kfree(rctx->assoc); ++ ++out: + aead_request_complete(req, err); + } + +@@ -247,7 +252,7 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) + err = enc ? crypto_aead_encrypt(subreq) : + crypto_aead_decrypt(subreq); + +- if (rctx->assoc && err != -EINPROGRESS) ++ if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY) + kfree(rctx->assoc); + return err; + } +-- +2.35.3 + diff --git a/patches.suse/crypto-qat-fix-out-of-bounds-read.patch b/patches.suse/crypto-qat-fix-out-of-bounds-read.patch new file mode 100644 index 0000000..0f21ac1 --- /dev/null +++ b/patches.suse/crypto-qat-fix-out-of-bounds-read.patch @@ -0,0 +1,66 @@ +From f6044cc3030e139f60c281386f28bda6e3049d66 Mon Sep 17 00:00:00 2001 +From: Giovanni Cabiddu +Date: Wed, 1 Feb 2023 15:59:44 +0000 +Subject: [PATCH] crypto: qat - fix out-of-bounds read +Git-commit: f6044cc3030e139f60c281386f28bda6e3049d66 +Patch-mainline: v6.3-rc1 +References: git-fixes + +When preparing an AER-CTR request, the driver copies the key provided by +the user into a data structure that is accessible by the firmware. +If the target device is QAT GEN4, the key size is rounded up by 16 since +a rounded up size is expected by the device. +If the key size is rounded up before the copy, the size used for copying +the key might be bigger than the size of the region containing the key, +causing an out-of-bounds read. + +Fix by doing the copy first and then update the keylen. + +This is to fix the following warning reported by KASAN: + + [ 138.150574] BUG: KASAN: global-out-of-bounds in qat_alg_skcipher_init_com.isra.0+0x197/0x250 [intel_qat] + [ 138.150641] Read of size 32 at addr ffffffff88c402c0 by task cryptomgr_test/2340 + + [ 138.150651] CPU: 15 PID: 2340 Comm: cryptomgr_test Not tainted 6.2.0-rc1+ #45 + [ 138.150659] Hardware name: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.86B.0087.D13.2208261706 08/26/2022 + [ 138.150663] Call Trace: + [ 138.150668] + [ 138.150922] kasan_check_range+0x13a/0x1c0 + [ 138.150931] memcpy+0x1f/0x60 + [ 138.150940] qat_alg_skcipher_init_com.isra.0+0x197/0x250 [intel_qat] + [ 138.151006] qat_alg_skcipher_init_sessions+0xc1/0x240 [intel_qat] + [ 138.151073] crypto_skcipher_setkey+0x82/0x160 + [ 138.151085] ? prepare_keybuf+0xa2/0xd0 + [ 138.151095] test_skcipher_vec_cfg+0x2b8/0x800 + +Fixes: 67916c951689 ("crypto: qat - add AES-CTR support for QAT GEN4 devices") +Cc: +Reported-by: Vladis Dronov +Signed-off-by: Giovanni Cabiddu +Reviewed-by: Fiona Trahe +Reviewed-by: Vladis Dronov +Tested-by: Vladis Dronov +Signed-off-by: Herbert Xu +Acked-by: Takashi Iwai + +--- + drivers/crypto/qat/qat_common/qat_algs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c +index b4b9f0aa59b9..b61ada559158 100644 +--- a/drivers/crypto/qat/qat_common/qat_algs.c ++++ b/drivers/crypto/qat/qat_common/qat_algs.c +@@ -435,8 +435,8 @@ static void qat_alg_skcipher_init_com(struct qat_alg_skcipher_ctx *ctx, + } else if (aes_v2_capable && mode == ICP_QAT_HW_CIPHER_CTR_MODE) { + ICP_QAT_FW_LA_SLICE_TYPE_SET(header->serv_specif_flags, + ICP_QAT_FW_LA_USE_UCS_SLICE_TYPE); +- keylen = round_up(keylen, 16); + memcpy(cd->ucs_aes.key, key, keylen); ++ keylen = round_up(keylen, 16); + } else { + memcpy(cd->aes.key, key, keylen); + } +-- +2.35.3 + diff --git a/patches.suse/crypto-rsa-pkcs1pad-Use-akcipher_request_complete.patch b/patches.suse/crypto-rsa-pkcs1pad-Use-akcipher_request_complete.patch new file mode 100644 index 0000000..5b64aec --- /dev/null +++ b/patches.suse/crypto-rsa-pkcs1pad-Use-akcipher_request_complete.patch @@ -0,0 +1,91 @@ +From 564cabc0ca0bdfa8f0fc1ae74b24d0a7554522c5 Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Tue, 31 Jan 2023 16:02:04 +0800 +Subject: [PATCH] crypto: rsa-pkcs1pad - Use akcipher_request_complete +Git-commit: 564cabc0ca0bdfa8f0fc1ae74b24d0a7554522c5 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Use the akcipher_request_complete helper instead of calling the +completion function directly. In fact the previous code was buggy +in that EINPROGRESS was never passed back to the original caller. + +Fixes: 3d5b1ecdea6f ("crypto: rsa - RSA padding algorithm") +Signed-off-by: Herbert Xu +Acked-by: Takashi Iwai + +--- + crypto/rsa-pkcs1pad.c | 34 +++++++++++++++------------------- + 1 file changed, 15 insertions(+), 19 deletions(-) + +diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c +index 141f7e08df6a..02028670331d 100644 +--- a/crypto/rsa-pkcs1pad.c ++++ b/crypto/rsa-pkcs1pad.c +@@ -214,16 +214,14 @@ static void pkcs1pad_encrypt_sign_complete_cb( + struct crypto_async_request *child_async_req, int err) + { + struct akcipher_request *req = child_async_req->data; +- struct crypto_async_request async_req; + + if (err == -EINPROGRESS) +- return; ++ goto out; ++ ++ err = pkcs1pad_encrypt_sign_complete(req, err); + +- async_req.data = req->base.data; +- async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req)); +- async_req.flags = child_async_req->flags; +- req->base.complete(&async_req, +- pkcs1pad_encrypt_sign_complete(req, err)); ++out: ++ akcipher_request_complete(req, err); + } + + static int pkcs1pad_encrypt(struct akcipher_request *req) +@@ -332,15 +330,14 @@ static void pkcs1pad_decrypt_complete_cb( + struct crypto_async_request *child_async_req, int err) + { + struct akcipher_request *req = child_async_req->data; +- struct crypto_async_request async_req; + + if (err == -EINPROGRESS) +- return; ++ goto out; ++ ++ err = pkcs1pad_decrypt_complete(req, err); + +- async_req.data = req->base.data; +- async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req)); +- async_req.flags = child_async_req->flags; +- req->base.complete(&async_req, pkcs1pad_decrypt_complete(req, err)); ++out: ++ akcipher_request_complete(req, err); + } + + static int pkcs1pad_decrypt(struct akcipher_request *req) +@@ -513,15 +510,14 @@ static void pkcs1pad_verify_complete_cb( + struct crypto_async_request *child_async_req, int err) + { + struct akcipher_request *req = child_async_req->data; +- struct crypto_async_request async_req; + + if (err == -EINPROGRESS) +- return; ++ goto out; + +- async_req.data = req->base.data; +- async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req)); +- async_req.flags = child_async_req->flags; +- req->base.complete(&async_req, pkcs1pad_verify_complete(req, err)); ++ err = pkcs1pad_verify_complete(req, err); ++ ++out: ++ akcipher_request_complete(req, err); + } + + /* +-- +2.35.3 + diff --git a/patches.suse/crypto-seqiv-Handle-EBUSY-correctly.patch b/patches.suse/crypto-seqiv-Handle-EBUSY-correctly.patch new file mode 100644 index 0000000..d333b36 --- /dev/null +++ b/patches.suse/crypto-seqiv-Handle-EBUSY-correctly.patch @@ -0,0 +1,40 @@ +From 32e62025e5e52fbe4812ef044759de7010b15dbc Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Fri, 13 Jan 2023 18:27:51 +0800 +Subject: [PATCH] crypto: seqiv - Handle EBUSY correctly +Git-commit: 32e62025e5e52fbe4812ef044759de7010b15dbc +Patch-mainline: v6.3-rc1 +References: git-fixes + +As it is seqiv only handles the special return value of EINPROGERSS, +which means that in all other cases it will free data related to the +request. + +However, as the caller of seqiv may specify MAY_BACKLOG, we also need +to expect EBUSY and treat it in the same way. Otherwise backlogged +requests will trigger a use-after-free. + +Fixes: 0a270321dbf9 ("[CRYPTO] seqiv: Add Sequence Number IV Generator") +Signed-off-by: Herbert Xu +Acked-by: Takashi Iwai + +--- + crypto/seqiv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/crypto/seqiv.c b/crypto/seqiv.c +index 0899d527c284..b1bcfe537daf 100644 +--- a/crypto/seqiv.c ++++ b/crypto/seqiv.c +@@ -23,7 +23,7 @@ static void seqiv_aead_encrypt_complete2(struct aead_request *req, int err) + struct aead_request *subreq = aead_request_ctx(req); + struct crypto_aead *geniv; + +- if (err == -EINPROGRESS) ++ if (err == -EINPROGRESS || err == -EBUSY) + return; + + if (err) +-- +2.35.3 + diff --git a/patches.suse/crypto-x86-ghash-fix-unaligned-access-in-ghash_setke.patch b/patches.suse/crypto-x86-ghash-fix-unaligned-access-in-ghash_setke.patch new file mode 100644 index 0000000..35926bf --- /dev/null +++ b/patches.suse/crypto-x86-ghash-fix-unaligned-access-in-ghash_setke.patch @@ -0,0 +1,52 @@ +From 116db2704c193fff6d73ea6c2219625f0c9bdfc8 Mon Sep 17 00:00:00 2001 +From: Eric Biggers +Date: Mon, 19 Dec 2022 21:40:40 -0800 +Subject: [PATCH] crypto: x86/ghash - fix unaligned access in ghash_setkey() +Git-commit: 116db2704c193fff6d73ea6c2219625f0c9bdfc8 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The key can be unaligned, so use the unaligned memory access helpers. + +Fixes: 8ceee72808d1 ("crypto: ghash-clmulni-intel - use C implementation for setkey()") +Signed-off-by: Eric Biggers +Signed-off-by: Herbert Xu +Acked-by: Takashi Iwai + +--- + arch/x86/crypto/ghash-clmulni-intel_glue.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/crypto/ghash-clmulni-intel_glue.c b/arch/x86/crypto/ghash-clmulni-intel_glue.c +index 1f1a95f3dd0c..c0ab0ff4af65 100644 +--- a/arch/x86/crypto/ghash-clmulni-intel_glue.c ++++ b/arch/x86/crypto/ghash-clmulni-intel_glue.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + + #define GHASH_BLOCK_SIZE 16 + #define GHASH_DIGEST_SIZE 16 +@@ -54,15 +55,14 @@ static int ghash_setkey(struct crypto_shash *tfm, + const u8 *key, unsigned int keylen) + { + struct ghash_ctx *ctx = crypto_shash_ctx(tfm); +- be128 *x = (be128 *)key; + u64 a, b; + + if (keylen != GHASH_BLOCK_SIZE) + return -EINVAL; + + /* perform multiplication by 'x' in GF(2^128) */ +- a = be64_to_cpu(x->a); +- b = be64_to_cpu(x->b); ++ a = get_unaligned_be64(key); ++ b = get_unaligned_be64(key + 8); + + ctx->shash.a = (b << 1) | (a >> 63); + ctx->shash.b = (a << 1) | (b >> 63); +-- +2.35.3 + diff --git a/patches.suse/crypto-xts-Handle-EBUSY-correctly.patch b/patches.suse/crypto-xts-Handle-EBUSY-correctly.patch new file mode 100644 index 0000000..048d853 --- /dev/null +++ b/patches.suse/crypto-xts-Handle-EBUSY-correctly.patch @@ -0,0 +1,62 @@ +From 51c082514c2dedf2711c99d93c196cc4eedceb40 Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Sun, 22 Jan 2023 16:07:37 +0800 +Subject: [PATCH] crypto: xts - Handle EBUSY correctly +Git-commit: 51c082514c2dedf2711c99d93c196cc4eedceb40 +Patch-mainline: v6.3-rc1 +References: git-fixes + +As it is xts only handles the special return value of EINPROGRESS, +which means that in all other cases it will free data related to the +request. + +However, as the caller of xts may specify MAY_BACKLOG, we also need +to expect EBUSY and treat it in the same way. Otherwise backlogged +requests will trigger a use-after-free. + +Fixes: 8083b1bf8163 ("crypto: xts - add support for ciphertext stealing") +Signed-off-by: Herbert Xu +Acked-by: Ard Biesheuvel +Acked-by: Takashi Iwai + +--- + crypto/xts.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/crypto/xts.c b/crypto/xts.c +index 63c85b9e64e0..de6cbcf69bbd 100644 +--- a/crypto/xts.c ++++ b/crypto/xts.c +@@ -203,12 +203,12 @@ static void xts_encrypt_done(struct crypto_async_request *areq, int err) + if (!err) { + struct xts_request_ctx *rctx = skcipher_request_ctx(req); + +- rctx->subreq.base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP; ++ rctx->subreq.base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG; + err = xts_xor_tweak_post(req, true); + + if (!err && unlikely(req->cryptlen % XTS_BLOCK_SIZE)) { + err = xts_cts_final(req, crypto_skcipher_encrypt); +- if (err == -EINPROGRESS) ++ if (err == -EINPROGRESS || err == -EBUSY) + return; + } + } +@@ -223,12 +223,12 @@ static void xts_decrypt_done(struct crypto_async_request *areq, int err) + if (!err) { + struct xts_request_ctx *rctx = skcipher_request_ctx(req); + +- rctx->subreq.base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP; ++ rctx->subreq.base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG; + err = xts_xor_tweak_post(req, false); + + if (!err && unlikely(req->cryptlen % XTS_BLOCK_SIZE)) { + err = xts_cts_final(req, crypto_skcipher_decrypt); +- if (err == -EINPROGRESS) ++ if (err == -EINPROGRESS || err == -EBUSY) + return; + } + } +-- +2.35.3 + diff --git a/patches.suse/dmaengine-dw-axi-dmac-Do-not-dereference-NULL-struct.patch b/patches.suse/dmaengine-dw-axi-dmac-Do-not-dereference-NULL-struct.patch new file mode 100644 index 0000000..2083d99 --- /dev/null +++ b/patches.suse/dmaengine-dw-axi-dmac-Do-not-dereference-NULL-struct.patch @@ -0,0 +1,47 @@ +From be4d46edeee4b2459d2f53f37ada88bbfb634b6c Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Fri, 27 Jan 2023 14:36:27 -0800 +Subject: [PATCH] dmaengine: dw-axi-dmac: Do not dereference NULL structure +Git-commit: be4d46edeee4b2459d2f53f37ada88bbfb634b6c +Patch-mainline: v6.3-rc1 +References: git-fixes + +If "vdesc" is NULL, it cannot be used with vd_to_axi_desc(). Leave +"bytes" unchanged at 0. Seen under GCC 13 with -Warray-bounds: + +../drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c: In function 'dma_chan_tx_status': +../drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c:329:46: warning: array subscript 0 is outside array bounds of 'struct +virt_dma_desc[46116860184273879]' [-Warray-bounds=] + 329 | bytes = vd_to_axi_desc(vdesc)->length; + | ^~ + +Fixes: 8e55444da65c ("dmaengine: dw-axi-dmac: Support burst residue granularity") +Cc: Eugeniy Paltsev +Cc: Vinod Koul +Cc: dmaengine@vger.kernel.org +Signed-off-by: Kees Cook +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20230127223623.never.507-kees@kernel.org +Signed-off-by: Vinod Koul +Acked-by: Takashi Iwai + +--- + drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +index 3dec8adfc4ea..d0de8b032d49 100644 +--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c ++++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +@@ -325,8 +325,6 @@ dma_chan_tx_status(struct dma_chan *dchan, dma_cookie_t cookie, + len = vd_to_axi_desc(vdesc)->hw_desc[0].len; + completed_length = completed_blocks * len; + bytes = length - completed_length; +- } else { +- bytes = vd_to_axi_desc(vdesc)->length; + } + + spin_unlock_irqrestore(&chan->vc.lock, flags); +-- +2.35.3 + diff --git a/patches.suse/dmaengine-dw-edma-Don-t-permit-non-inc-interleaved-x.patch b/patches.suse/dmaengine-dw-edma-Don-t-permit-non-inc-interleaved-x.patch new file mode 100644 index 0000000..2b73c14 --- /dev/null +++ b/patches.suse/dmaengine-dw-edma-Don-t-permit-non-inc-interleaved-x.patch @@ -0,0 +1,68 @@ +From c8ed49182286cb9c64f0c503b98090bd11a3fb60 Mon Sep 17 00:00:00 2001 +From: Serge Semin +Date: Fri, 13 Jan 2023 20:13:47 +0300 +Subject: [PATCH] dmaengine: dw-edma: Don't permit non-inc interleaved xfers +Git-commit: c8ed49182286cb9c64f0c503b98090bd11a3fb60 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The DW eDMA controller always increments both source and destination +addresses. Permitting DMA interleaved transfers with no src_inc/dst_inc +flags set may lead to unexpected behaviour for the device users. + +Terminate interleaved transfers if at least one of the +dma_interleaved_template.{src_inc,dst_inc} flag is initialized to "false". + +Note that in addition, we need to increase the source and destination +addresses after each iteration. + +Link: https://lore.kernel.org/r/20230113171409.30470-6-Sergey.Semin@baikalelectronics.ru +Fixes: 85e7518f42c8 ("dmaengine: dw-edma: Add device_prep_interleave_dma() support") +Tested-by: Manivannan Sadhasivam +Signed-off-by: Serge Semin +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Acked-by: Vinod Koul +Acked-by: Takashi Iwai + +--- + drivers/dma/dw-edma/dw-edma-core.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c +index 778d91d9fc1b..35588e14f79a 100644 +--- a/drivers/dma/dw-edma/dw-edma-core.c ++++ b/drivers/dma/dw-edma/dw-edma-core.c +@@ -385,6 +385,8 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer) + return NULL; + if (xfer->xfer.il->numf > 0 && xfer->xfer.il->frame_size > 0) + return NULL; ++ if (!xfer->xfer.il->src_inc || !xfer->xfer.il->dst_inc) ++ return NULL; + } else { + return NULL; + } +@@ -484,15 +486,13 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer) + struct dma_interleaved_template *il = xfer->xfer.il; + struct data_chunk *dc = &il->sgl[i]; + +- if (il->src_sgl) { +- src_addr += burst->sz; ++ src_addr += burst->sz; ++ if (il->src_sgl) + src_addr += dmaengine_get_src_icg(il, dc); +- } + +- if (il->dst_sgl) { +- dst_addr += burst->sz; ++ dst_addr += burst->sz; ++ if (il->dst_sgl) + dst_addr += dmaengine_get_dst_icg(il, dc); +- } + } + } + +-- +2.35.3 + diff --git a/patches.suse/dmaengine-dw-edma-Drop-chancnt-initialization.patch b/patches.suse/dmaengine-dw-edma-Drop-chancnt-initialization.patch new file mode 100644 index 0000000..ccb856a --- /dev/null +++ b/patches.suse/dmaengine-dw-edma-Drop-chancnt-initialization.patch @@ -0,0 +1,44 @@ +From 2271216e0aac2409f2cd9a0650c460b89f7d2446 Mon Sep 17 00:00:00 2001 +From: Serge Semin +Date: Fri, 13 Jan 2023 20:13:51 +0300 +Subject: [PATCH] dmaengine: dw-edma: Drop chancnt initialization +Git-commit: 2271216e0aac2409f2cd9a0650c460b89f7d2446 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The DMA engine core manages dma_device.chancnt itself, e.g., in +dma_async_device_register(). DMA device drivers should not initialize +chancnt because it causes the wrong number of channels printed in the +device summary. + +Drop the dw-edma chancnt initialization. + +Link: https://lore.kernel.org/r/20230113171409.30470-10-Sergey.Semin@baikalelectronics.ru +Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver") +Tested-by: Manivannan Sadhasivam +Signed-off-by: Serge Semin +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Acked-by: Vinod Koul +Acked-by: Takashi Iwai + +--- + drivers/dma/dw-edma/dw-edma-core.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c +index 6c9f95a8e397..ecd3e8f7ac5d 100644 +--- a/drivers/dma/dw-edma/dw-edma-core.c ++++ b/drivers/dma/dw-edma/dw-edma-core.c +@@ -817,7 +817,6 @@ static int dw_edma_channel_setup(struct dw_edma *dw, bool write, + dma->src_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES); + dma->dst_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES); + dma->residue_granularity = DMA_RESIDUE_GRANULARITY_DESCRIPTOR; +- dma->chancnt = cnt; + + /* Set DMA channel callbacks */ + dma->dev = chip->dev; +-- +2.35.3 + diff --git a/patches.suse/dmaengine-dw-edma-Fix-invalid-interleaved-xfers-sema.patch b/patches.suse/dmaengine-dw-edma-Fix-invalid-interleaved-xfers-sema.patch new file mode 100644 index 0000000..080e195 --- /dev/null +++ b/patches.suse/dmaengine-dw-edma-Fix-invalid-interleaved-xfers-sema.patch @@ -0,0 +1,117 @@ +From 7ad06f218491bf30f13fd88933bb807de5330cdd Mon Sep 17 00:00:00 2001 +From: Serge Semin +Date: Fri, 13 Jan 2023 20:13:48 +0300 +Subject: [PATCH] dmaengine: dw-edma: Fix invalid interleaved xfers semantics +Git-commit: 7ad06f218491bf30f13fd88933bb807de5330cdd +Patch-mainline: v6.3-rc1 +References: git-fixes + +The interleaved DMA transfer support added by 85e7518f42c8 ("dmaengine: +Dw-edma: Add device_prep_interleave_dma() support") seems contradictory to +what the DMA engine defines. The next conditional statements: + + if (!xfer->xfer.il->numf) + return NULL; + if (xfer->xfer.il->numf > 0 && xfer->xfer.il->frame_size > 0) + return NULL; + +mean that numf can't be zero and frame_size must always be zero, otherwise +the transfer won't be executed. Furthermore, the transfer execution method +takes the frame size from the dma_interleaved_template.sgl[] array for each +frame. That array in accordance with [1] is supposed to be of +dma_interleaved_template.frame_size size, which as we discovered before the +code expects to be zero. So judging by the dw_edma_device_transfer() +implementation, the method implies the dma_interleaved_template.sgl[] array +being of dma_interleaved_template.numf size, which is wrong. Since the +dw_edma_device_transfer() method doesn't permit +dma_interleaved_template.frame_size being non-zero, the multi-chunk +interleaved transfer turns to be unsupported even though the code implies +having it supported. + +Add fully functioning support of interleaved DMA transfers. + +First of all, dma_interleaved_template.frame_size is supposed to be greater +or equal to one thus having at least simple linear chunked frames. +Secondly, we can create a walk-through over all the chunks and frames by +initializing the number of the eDMA burst transactions as a multiple of +dma_interleaved_template.numf and dma_interleaved_template.frame_size and +getting the frame_size-modulo of the iteration step as an index of the +dma_interleaved_template.sgl[] array. + +[1] include/linux/dmaengine.h: doc struct dma_interleaved_template + +Link: https://lore.kernel.org/r/20230113171409.30470-7-Sergey.Semin@baikalelectronics.ru +Fixes: 85e7518f42c8 ("dmaengine: dw-edma: Add device_prep_interleave_dma() support") +Tested-by: Manivannan Sadhasivam +Signed-off-by: Serge Semin +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Acked-by: Vinod Koul +Acked-by: Takashi Iwai + +--- + drivers/dma/dw-edma/dw-edma-core.c | 18 +++++++----------- + 1 file changed, 7 insertions(+), 11 deletions(-) + +diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c +index 35588e14f79a..d5c4192141ef 100644 +--- a/drivers/dma/dw-edma/dw-edma-core.c ++++ b/drivers/dma/dw-edma/dw-edma-core.c +@@ -332,6 +332,7 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer) + struct dw_edma_chunk *chunk; + struct dw_edma_burst *burst; + struct dw_edma_desc *desc; ++ size_t fsz = 0; + u32 cnt = 0; + int i; + +@@ -381,9 +382,7 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer) + if (xfer->xfer.sg.len < 1) + return NULL; + } else if (xfer->type == EDMA_XFER_INTERLEAVED) { +- if (!xfer->xfer.il->numf) +- return NULL; +- if (xfer->xfer.il->numf > 0 && xfer->xfer.il->frame_size > 0) ++ if (!xfer->xfer.il->numf || xfer->xfer.il->frame_size < 1) + return NULL; + if (!xfer->xfer.il->src_inc || !xfer->xfer.il->dst_inc) + return NULL; +@@ -413,10 +412,8 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer) + cnt = xfer->xfer.sg.len; + sg = xfer->xfer.sg.sgl; + } else if (xfer->type == EDMA_XFER_INTERLEAVED) { +- if (xfer->xfer.il->numf > 0) +- cnt = xfer->xfer.il->numf; +- else +- cnt = xfer->xfer.il->frame_size; ++ cnt = xfer->xfer.il->numf * xfer->xfer.il->frame_size; ++ fsz = xfer->xfer.il->frame_size; + } + + for (i = 0; i < cnt; i++) { +@@ -438,7 +435,7 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer) + else if (xfer->type == EDMA_XFER_SCATTER_GATHER) + burst->sz = sg_dma_len(sg); + else if (xfer->type == EDMA_XFER_INTERLEAVED) +- burst->sz = xfer->xfer.il->sgl[i].size; ++ burst->sz = xfer->xfer.il->sgl[i % fsz].size; + + chunk->ll_region.sz += burst->sz; + desc->alloc_sz += burst->sz; +@@ -481,10 +478,9 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer) + + if (xfer->type == EDMA_XFER_SCATTER_GATHER) { + sg = sg_next(sg); +- } else if (xfer->type == EDMA_XFER_INTERLEAVED && +- xfer->xfer.il->frame_size > 0) { ++ } else if (xfer->type == EDMA_XFER_INTERLEAVED) { + struct dma_interleaved_template *il = xfer->xfer.il; +- struct data_chunk *dc = &il->sgl[i]; ++ struct data_chunk *dc = &il->sgl[i % fsz]; + + src_addr += burst->sz; + if (il->src_sgl) +-- +2.35.3 + diff --git a/patches.suse/dmaengine-dw-edma-Fix-missing-src-dst-address-of-int.patch b/patches.suse/dmaengine-dw-edma-Fix-missing-src-dst-address-of-int.patch new file mode 100644 index 0000000..a99cd55 --- /dev/null +++ b/patches.suse/dmaengine-dw-edma-Fix-missing-src-dst-address-of-int.patch @@ -0,0 +1,56 @@ +From 13b6299cf66165a442089fa895a7f70250703584 Mon Sep 17 00:00:00 2001 +From: Serge Semin +Date: Fri, 13 Jan 2023 20:13:46 +0300 +Subject: [PATCH] dmaengine: dw-edma: Fix missing src/dst address of interleaved xfers +Git-commit: 13b6299cf66165a442089fa895a7f70250703584 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Interleaved DMA transfer support was added by 85e7518f42c8 ("dmaengine: +Dw-edma: Add device_prep_interleave_dma() support"), but depending on the +selected channel, either source or destination address are left +uninitialized which was obviously wrong. + +Initialize the destination address of the eDMA burst descriptors for +DEV_TO_MEM interleaved operations and the source address for MEM_TO_DEV +operations. + +Link: https://lore.kernel.org/r/20230113171409.30470-5-Sergey.Semin@baikalelectronics.ru +Fixes: 85e7518f42c8 ("dmaengine: dw-edma: Add device_prep_interleave_dma() support") +Tested-by: Manivannan Sadhasivam +Signed-off-by: Serge Semin +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Acked-by: Vinod Koul +Acked-by: Takashi Iwai + +--- + drivers/dma/dw-edma/dw-edma-core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c +index a8c1bd9c7ae9..778d91d9fc1b 100644 +--- a/drivers/dma/dw-edma/dw-edma-core.c ++++ b/drivers/dma/dw-edma/dw-edma-core.c +@@ -455,6 +455,8 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer) + * and destination addresses are increased + * by the same portion (data length) + */ ++ } else if (xfer->type == EDMA_XFER_INTERLEAVED) { ++ burst->dar = dst_addr; + } + } else { + burst->dar = dst_addr; +@@ -470,6 +472,8 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer) + * and destination addresses are increased + * by the same portion (data length) + */ ++ } else if (xfer->type == EDMA_XFER_INTERLEAVED) { ++ burst->sar = src_addr; + } + } + +-- +2.35.3 + diff --git a/patches.suse/dmaengine-dw-edma-Fix-readq_ch-return-value-truncati.patch b/patches.suse/dmaengine-dw-edma-Fix-readq_ch-return-value-truncati.patch new file mode 100644 index 0000000..29f029b --- /dev/null +++ b/patches.suse/dmaengine-dw-edma-Fix-readq_ch-return-value-truncati.patch @@ -0,0 +1,35 @@ +From 5fdca4a995bcd4cf61bda40af154a730589dc524 Mon Sep 17 00:00:00 2001 +From: Serge Semin +Date: Wed, 25 Jan 2023 18:19:00 +0300 +Subject: [PATCH] dmaengine: dw-edma: Fix readq_ch() return value truncation +Git-commit: 5fdca4a995bcd4cf61bda40af154a730589dc524 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Previously, readq_ch() did a 64-bit readq(), but truncated the result by +storing it in the u32 "value". Change "value" to u64 to avoid the +truncation. + +Note: the method is currently unused, so the bug hasn't caused any problem +so far. + +Fixes: 04e0a39fc10f ("dmaengine: dw-edma: Add writeq() and readq() for 64 bits architectures") +Signed-off-by: Serge Semin +Signed-off-by: Bjorn Helgaas +Acked-by: Takashi Iwai + +--- + drivers/dma/dw-edma/dw-edma-v0-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/dma/dw-edma/dw-edma-v0-core.c ++++ b/drivers/dma/dw-edma/dw-edma-v0-core.c +@@ -192,7 +192,7 @@ static inline void writeq_ch(struct dw_e + static inline u64 readq_ch(struct dw_edma *dw, enum dw_edma_dir dir, u16 ch, + const void __iomem *addr) + { +- u32 value; ++ u64 value; + + if (dw->mf == EDMA_MF_EDMA_LEGACY) { + u32 viewport_sel; diff --git a/patches.suse/dmaengine-idxd-Set-traffic-class-values-in-GRPCFG-on.patch b/patches.suse/dmaengine-idxd-Set-traffic-class-values-in-GRPCFG-on.patch new file mode 100644 index 0000000..8ac71ae --- /dev/null +++ b/patches.suse/dmaengine-idxd-Set-traffic-class-values-in-GRPCFG-on.patch @@ -0,0 +1,79 @@ +From 9735bde36487da43d3c3fc910df49639f72decbf Mon Sep 17 00:00:00 2001 +From: Fenghua Yu +Date: Fri, 9 Dec 2022 09:21:41 -0800 +Subject: [PATCH] dmaengine: idxd: Set traffic class values in GRPCFG on DSA 2.0 +Git-commit: 9735bde36487da43d3c3fc910df49639f72decbf +Patch-mainline: v6.3-rc1 +References: git-fixes + +On DSA/IAX 1.0, TC-A and TC-B in GRPCFG are set as 1 to have best +performance and cannot be changed through sysfs knobs unless override +option is given. + +The same values should be set on DSA 2.0 as well. + +Fixes: ea7c8f598c32 ("dmaengine: idxd: restore traffic class defaults after wq reset") +Fixes: ade8a86b512c ("dmaengine: idxd: Set defaults for GRPCFG traffic class") +Signed-off-by: Fenghua Yu +Reviewed-by: Dave Jiang +Link: https://lore.kernel.org/r/20221209172141.562648-1-fenghua.yu@intel.com +Signed-off-by: Vinod Koul +Acked-by: Takashi Iwai + +--- + drivers/dma/idxd/device.c | 2 +- + drivers/dma/idxd/init.c | 2 +- + drivers/dma/idxd/sysfs.c | 4 ++-- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c +index 06f5d3783d77..19ab3e55033e 100644 +--- a/drivers/dma/idxd/device.c ++++ b/drivers/dma/idxd/device.c +@@ -701,7 +701,7 @@ static void idxd_groups_clear_state(struct idxd_device *idxd) + group->use_rdbuf_limit = false; + group->rdbufs_allowed = 0; + group->rdbufs_reserved = 0; +- if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override) { ++ if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override) { + group->tc_a = 1; + group->tc_b = 1; + } else { +diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c +index 529ea09c9094..e63b0c674d88 100644 +--- a/drivers/dma/idxd/init.c ++++ b/drivers/dma/idxd/init.c +@@ -295,7 +295,7 @@ static int idxd_setup_groups(struct idxd_device *idxd) + } + + idxd->groups[i] = group; +- if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override) { ++ if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override) { + group->tc_a = 1; + group->tc_b = 1; + } else { +diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c +index 3229dfc78650..18cd8151dee0 100644 +--- a/drivers/dma/idxd/sysfs.c ++++ b/drivers/dma/idxd/sysfs.c +@@ -387,7 +387,7 @@ static ssize_t group_traffic_class_a_store(struct device *dev, + if (idxd->state == IDXD_DEV_ENABLED) + return -EPERM; + +- if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override) ++ if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override) + return -EPERM; + + if (val < 0 || val > 7) +@@ -429,7 +429,7 @@ static ssize_t group_traffic_class_b_store(struct device *dev, + if (idxd->state == IDXD_DEV_ENABLED) + return -EPERM; + +- if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override) ++ if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override) + return -EPERM; + + if (val < 0 || val > 7) +-- +2.35.3 + diff --git a/patches.suse/dmaengine-ptdma-check-for-null-desc-before-calling-p.patch b/patches.suse/dmaengine-ptdma-check-for-null-desc-before-calling-p.patch new file mode 100644 index 0000000..a6fb7e0 --- /dev/null +++ b/patches.suse/dmaengine-ptdma-check-for-null-desc-before-calling-p.patch @@ -0,0 +1,43 @@ +From 928469986171a6f763b34b039427f5667ba3fd50 Mon Sep 17 00:00:00 2001 +From: Eric Pilmore +Date: Thu, 9 Feb 2023 23:51:43 -0800 +Subject: [PATCH] dmaengine: ptdma: check for null desc before calling pt_cmd_callback +Git-commit: 928469986171a6f763b34b039427f5667ba3fd50 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Resolves a panic that can occur on AMD systems, typically during host +shutdown, after the PTDMA driver had been exercised. The issue was +the pt_issue_pending() function is mistakenly assuming that there will +be at least one descriptor in the Submitted queue when the function +is called. However, it is possible that both the Submitted and Issued +queues could be empty, which could result in pt_cmd_callback() being +mistakenly called with a NULL pointer. +Ref: Bugzilla Bug 216856. + +Fixes: 6fa7e0e836e2 ("dmaengine: ptdma: fix concurrency issue with multiple dma transfer") +Signed-off-by: Eric Pilmore +Link: https://lore.kernel.org/r/20230210075142.58253-1-epilmore@gigaio.com +Signed-off-by: Vinod Koul +Acked-by: Takashi Iwai + +--- + drivers/dma/ptdma/ptdma-dmaengine.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/ptdma/ptdma-dmaengine.c b/drivers/dma/ptdma/ptdma-dmaengine.c +index cc22d162ce25..1aa65e5de0f3 100644 +--- a/drivers/dma/ptdma/ptdma-dmaengine.c ++++ b/drivers/dma/ptdma/ptdma-dmaengine.c +@@ -254,7 +254,7 @@ static void pt_issue_pending(struct dma_chan *dma_chan) + spin_unlock_irqrestore(&chan->vc.lock, flags); + + /* If there was nothing active, start processing */ +- if (engine_is_idle) ++ if (engine_is_idle && desc) + pt_cmd_callback(desc, 0); + } + +-- +2.35.3 + diff --git a/patches.suse/docs-ftrace-fix-a-issue-with-duplicated-subtitle-num.patch b/patches.suse/docs-ftrace-fix-a-issue-with-duplicated-subtitle-num.patch new file mode 100644 index 0000000..c9feb27 --- /dev/null +++ b/patches.suse/docs-ftrace-fix-a-issue-with-duplicated-subtitle-num.patch @@ -0,0 +1,47 @@ +From 71240f94f17db5e5d7efa997b858301ed14d3dce Mon Sep 17 00:00:00 2001 +From: Donglin Peng +Date: Thu, 8 Dec 2022 18:51:19 -0800 +Subject: [PATCH] docs: ftrace: fix a issue with duplicated subtitle number +Git-commit: 71240f94f17db5e5d7efa997b858301ed14d3dce +Patch-mainline: v6.3-rc1 +References: git-fixes + +The subtitle "5.3 Clearing filters" and "5.3 Subsystem filters" has +the same index number, let's fix it. + +Fixes: 95b696088c1c ("tracing/filters: add filter Documentation") +Signed-off-by: Donglin Peng +Acked-by: Steven Rostedt (Google) +Link: https://lore.kernel.org/r/20221209025119.1371570-1-dolinux.peng@gmail.com +Signed-off-by: Jonathan Corbet +Acked-by: Takashi Iwai + +--- + Documentation/trace/events.rst | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/Documentation/trace/events.rst b/Documentation/trace/events.rst +index c47f381d0c00..8f86eef1bada 100644 +--- a/Documentation/trace/events.rst ++++ b/Documentation/trace/events.rst +@@ -258,7 +258,7 @@ file. + To clear the filters for all events in a subsystem, write a '0' to the + subsystem's filter file. + +-5.3 Subsystem filters ++5.4 Subsystem filters + --------------------- + + For convenience, filters for every event in a subsystem can be set or +@@ -305,7 +305,7 @@ their old filters):: + # cat sched_wakeup/filter + common_pid == 0 + +-5.4 PID filtering ++5.5 PID filtering + ----------------- + + The set_event_pid file in the same directory as the top events directory +-- +2.35.3 + diff --git a/patches.suse/docs-gdbmacros-print-newest-record.patch b/patches.suse/docs-gdbmacros-print-newest-record.patch new file mode 100644 index 0000000..4d2cbaf --- /dev/null +++ b/patches.suse/docs-gdbmacros-print-newest-record.patch @@ -0,0 +1,47 @@ +From f2e4cca2f670c8e52fbb551a295f2afc9aa2bd72 Mon Sep 17 00:00:00 2001 +From: John Ogness +Date: Thu, 29 Dec 2022 14:49:39 +0106 +Subject: [PATCH] docs: gdbmacros: print newest record +Git-commit: f2e4cca2f670c8e52fbb551a295f2afc9aa2bd72 +Patch-mainline: v6.3-rc1 +References: git-fixes + +@head_id points to the newest record, but the printing loop +exits when it increments to this value (before printing). + +Exit the printing loop after the newest record has been printed. + +The python-based function in scripts/gdb/linux/dmesg.py already +does this correctly. + +Fixes: e60768311af8 ("scripts/gdb: update for lockless printk ringbuffer") +Cc: stable@vger.kernel.org +Signed-off-by: John Ogness +Reviewed-by: Petr Mladek +Signed-off-by: Petr Mladek +Link: https://lore.kernel.org/r/20221229134339.197627-1-john.ogness@linutronix.de +Acked-by: Takashi Iwai + +--- + Documentation/admin-guide/kdump/gdbmacros.txt | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/admin-guide/kdump/gdbmacros.txt b/Documentation/admin-guide/kdump/gdbmacros.txt +index 82aecdcae8a6..030de95e3e6b 100644 +--- a/Documentation/admin-guide/kdump/gdbmacros.txt ++++ b/Documentation/admin-guide/kdump/gdbmacros.txt +@@ -312,10 +312,10 @@ define dmesg + set var $prev_flags = $info->flags + end + +- set var $id = ($id + 1) & $id_mask + if ($id == $end_id) + loop_break + end ++ set var $id = ($id + 1) & $id_mask + end + end + document dmesg +-- +2.35.3 + diff --git a/patches.suse/driver-core-fix-potential-null-ptr-deref-in-device_a.patch b/patches.suse/driver-core-fix-potential-null-ptr-deref-in-device_a.patch new file mode 100644 index 0000000..baa87c5 --- /dev/null +++ b/patches.suse/driver-core-fix-potential-null-ptr-deref-in-device_a.patch @@ -0,0 +1,72 @@ +From f6837f34a34973ef6600c08195ed300e24e97317 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Mon, 5 Dec 2022 11:49:04 +0800 +Subject: [PATCH] driver core: fix potential null-ptr-deref in device_add() +Git-commit: f6837f34a34973ef6600c08195ed300e24e97317 +Patch-mainline: v6.3-rc1 +References: git-fixes + +I got the following null-ptr-deref report while doing fault injection test: + +Bug: kernel NULL pointer dereference, address: 0000000000000058 +Cpu: 2 PID: 278 Comm: 37-i2c-ds2482 Tainted: G B W N 6.1.0-rc3+ +Rip: 0010:klist_put+0x2d/0xd0 +Call Trace: + + klist_remove+0xf1/0x1c0 + device_release_driver_internal+0x196/0x210 + bus_remove_device+0x1bd/0x240 + device_add+0xd3d/0x1100 + w1_add_master_device+0x476/0x490 [wire] + ds2482_probe+0x303/0x3e0 [ds2482] + +This is how it happened: + +w1_alloc_dev() + // The dev->driver is set to w1_master_driver. + memcpy(&dev->dev, device, sizeof(struct device)); + device_add() + bus_add_device() + dpm_sysfs_add() // It fails, calls bus_remove_device. + + // error path + bus_remove_device() + // The dev->driver is not null, but driver is not bound. + __device_release_driver() + klist_remove(&dev->p->knode_driver) <-- It causes null-ptr-deref. + + // normal path + bus_probe_device() // It's not called yet. + device_bind_driver() + +If dev->driver is set, in the error path after calling bus_add_device() +in device_add(), bus_remove_device() is called, then the device will be +detached from driver. But device_bind_driver() is not called yet, so it +causes null-ptr-deref while access the 'knode_driver'. To fix this, set +dev->driver to null in the error path before calling bus_remove_device(). + +Fixes: 57eee3d23e88 ("Driver core: Call device_pm_add() after bus_add_device() in device_add()") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221205034904.2077765-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/base/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index a3e14143ec0c..506289e6b04d 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -3513,6 +3513,7 @@ int device_add(struct device *dev) + device_pm_remove(dev); + dpm_sysfs_remove(dev); + DPMError: ++ dev->driver = NULL; + bus_remove_device(dev); + BusError: + device_remove_attrs(dev); +-- +2.35.3 + diff --git a/patches.suse/driver-core-fix-resource-leak-in-device_add.patch b/patches.suse/driver-core-fix-resource-leak-in-device_add.patch new file mode 100644 index 0000000..a6431c8 --- /dev/null +++ b/patches.suse/driver-core-fix-resource-leak-in-device_add.patch @@ -0,0 +1,79 @@ +From 6977b1a5d67097eaa4d02b0c126c04cc6e8917c0 Mon Sep 17 00:00:00 2001 +From: Zhengchao Shao +Date: Wed, 23 Nov 2022 09:20:42 +0800 +Subject: [PATCH] driver core: fix resource leak in device_add() +Git-commit: 6977b1a5d67097eaa4d02b0c126c04cc6e8917c0 +Patch-mainline: v6.3-rc1 +References: git-fixes + +When calling kobject_add() failed in device_add(), it will call +cleanup_glue_dir() to free resource. But in kobject_add(), +dev->kobj.parent has been set to NULL. This will cause resource leak. + +The process is as follows: +device_add() + get_device_parent() + class_dir_create_and_add() + kobject_add() //kobject_get() + ... + dev->kobj.parent = kobj; + ... + kobject_add() //failed, but set dev->kobj.parent = NULL + ... + glue_dir = get_glue_dir(dev) //glue_dir = NULL, and goto + //"Error" label + ... + cleanup_glue_dir() //becaues glue_dir is NULL, not call + //kobject_put() + +The preceding problem may cause insmod mac80211_hwsim.ko to failed. +Sysfs: cannot create duplicate filename '/devices/virtual/mac80211_hwsim' +Call Trace: + +dump_stack_lvl+0x8e/0xd1 +sysfs_warn_dup.cold+0x1c/0x29 +sysfs_create_dir_ns+0x224/0x280 +kobject_add_internal+0x2aa/0x880 +kobject_add+0x135/0x1a0 +get_device_parent+0x3d7/0x590 +device_add+0x2aa/0x1cb0 +device_create_groups_vargs+0x1eb/0x260 +device_create+0xdc/0x110 +mac80211_hwsim_new_radio+0x31e/0x4790 [mac80211_hwsim] +init_mac80211_hwsim+0x48d/0x1000 [mac80211_hwsim] +do_one_initcall+0x10f/0x630 +do_init_module+0x19f/0x5e0 +load_module+0x64b7/0x6eb0 +__do_sys_finit_module+0x140/0x200 +do_syscall_64+0x35/0x80 +entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +kobject_add_internal failed for mac80211_hwsim with -EEXIST, don't try to +register things with the same name in the same directory. + +Fixes: cebf8fd16900 ("driver core: fix race between creating/querying glue dir and its cleanup") +Signed-off-by: Zhengchao Shao +Link: https://lore.kernel.org/r/20221123012042.335252-1-shaozhengchao@huawei.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/base/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index 110dbd4fb570..39dbd532cfb3 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -3413,7 +3413,7 @@ int device_add(struct device *dev) + /* we require the name to be set before, and pass NULL */ + error = kobject_add(&dev->kobj, dev->kobj.parent, NULL); + if (error) { +- glue_dir = get_glue_dir(dev); ++ glue_dir = kobj; + goto Error; + } + +-- +2.35.3 + diff --git a/patches.suse/driver-core-fw_devlink-Add-DL_FLAG_CYCLE-support-to-.patch b/patches.suse/driver-core-fw_devlink-Add-DL_FLAG_CYCLE-support-to-.patch new file mode 100644 index 0000000..50eb57b --- /dev/null +++ b/patches.suse/driver-core-fw_devlink-Add-DL_FLAG_CYCLE-support-to-.patch @@ -0,0 +1,162 @@ +From 67cad5c67019c38126b749621665b6723d3ae7e6 Mon Sep 17 00:00:00 2001 +From: Saravana Kannan +Date: Mon, 6 Feb 2023 17:41:57 -0800 +Subject: [PATCH] driver core: fw_devlink: Add DL_FLAG_CYCLE support to device links +Git-commit: 67cad5c67019c38126b749621665b6723d3ae7e6 +Patch-mainline: v6.3-rc1 +References: git-fixes + +fw_devlink uses DL_FLAG_SYNC_STATE_ONLY device link flag for two +Purposes: + +1. To allow a parent device to proxy its child device's dependency on a + supplier so that the supplier doesn't get its sync_state() callback + before the child device/consumer can be added and probed. In this + usage scenario, we need to ignore cycles for ensure correctness of + sync_state() callbacks. + +2. When there are dependency cycles in firmware, we don't know which of + those dependencies are valid. So, we have to ignore them all wrt + probe ordering while still making sure the sync_state() callbacks + come correctly. + +However, when detecting dependency cycles, there can be multiple +dependency cycles between two devices that we need to detect. For +Example: + +A -> B -> A and A -> C -> B -> A. + +To detect multiple cycles correct, we need to be able to differentiate +DL_FLAG_SYNC_STATE_ONLY device links used for (1) vs (2) above. + +To allow this differentiation, add a DL_FLAG_CYCLE that can be use to +mark use case (2). We can then use the DL_FLAG_CYCLE to decide which +DL_FLAG_SYNC_STATE_ONLY device links to follow when looking for +dependency cycles. + +Fixes: 2de9d8e0d2fe ("driver core: fw_devlink: Improve handling of cyclic dependencies") +Signed-off-by: Saravana Kannan +Tested-by: Colin Foster +Tested-by: Sudeep Holla +Tested-by: Douglas Anderson +Tested-by: Geert Uytterhoeven +Tested-by: Luca Weiss # qcom/sm7225-fairphone-fp4 +Link: https://lore.kernel.org/r/20230207014207.1678715-6-saravanak@google.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/base/core.c | 28 ++++++++++++++++++---------- + include/linux/device.h | 1 + + 2 files changed, 19 insertions(+), 10 deletions(-) + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index 3daaa7ffe751..ac19752422e0 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -322,6 +322,12 @@ static bool device_is_ancestor(struct device *dev, struct device *target) + return false; + } + ++static inline bool device_link_flag_is_sync_state_only(u32 flags) ++{ ++ return (flags & ~(DL_FLAG_INFERRED | DL_FLAG_CYCLE)) == ++ (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED); ++} ++ + /** + * device_is_dependent - Check if one device depends on another one + * @dev: Device to check dependencies for. +@@ -348,8 +354,7 @@ int device_is_dependent(struct device *dev, void *target) + return ret; + + list_for_each_entry(link, &dev->links.consumers, s_node) { +- if ((link->flags & ~DL_FLAG_INFERRED) == +- (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED)) ++ if (device_link_flag_is_sync_state_only(link->flags)) + continue; + + if (link->consumer == target) +@@ -422,8 +427,7 @@ static int device_reorder_to_tail(struct device *dev, void *not_used) + + device_for_each_child(dev, NULL, device_reorder_to_tail); + list_for_each_entry(link, &dev->links.consumers, s_node) { +- if ((link->flags & ~DL_FLAG_INFERRED) == +- (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED)) ++ if (device_link_flag_is_sync_state_only(link->flags)) + continue; + device_reorder_to_tail(link->consumer, NULL); + } +@@ -684,7 +688,8 @@ postcore_initcall(devlink_class_init); + DL_FLAG_AUTOREMOVE_SUPPLIER | \ + DL_FLAG_AUTOPROBE_CONSUMER | \ + DL_FLAG_SYNC_STATE_ONLY | \ +- DL_FLAG_INFERRED) ++ DL_FLAG_INFERRED | \ ++ DL_FLAG_CYCLE) + + #define DL_ADD_VALID_FLAGS (DL_MANAGED_LINK_FLAGS | DL_FLAG_STATELESS | \ + DL_FLAG_PM_RUNTIME | DL_FLAG_RPM_ACTIVE) +@@ -753,8 +758,6 @@ struct device_link *device_link_add(struct device *consumer, + if (!consumer || !supplier || consumer == supplier || + flags & ~DL_ADD_VALID_FLAGS || + (flags & DL_FLAG_STATELESS && flags & DL_MANAGED_LINK_FLAGS) || +- (flags & DL_FLAG_SYNC_STATE_ONLY && +- (flags & ~DL_FLAG_INFERRED) != DL_FLAG_SYNC_STATE_ONLY) || + (flags & DL_FLAG_AUTOPROBE_CONSUMER && + flags & (DL_FLAG_AUTOREMOVE_CONSUMER | + DL_FLAG_AUTOREMOVE_SUPPLIER))) +@@ -770,6 +773,10 @@ struct device_link *device_link_add(struct device *consumer, + if (!(flags & DL_FLAG_STATELESS)) + flags |= DL_FLAG_MANAGED; + ++ if (flags & DL_FLAG_SYNC_STATE_ONLY && ++ !device_link_flag_is_sync_state_only(flags)) ++ return NULL; ++ + device_links_write_lock(); + device_pm_lock(); + +@@ -1729,7 +1736,7 @@ static void fw_devlink_relax_link(struct device_link *link) + if (!(link->flags & DL_FLAG_INFERRED)) + return; + +- if (link->flags == (DL_FLAG_MANAGED | FW_DEVLINK_FLAGS_PERMISSIVE)) ++ if (device_link_flag_is_sync_state_only(link->flags)) + return; + + pm_runtime_drop_link(link); +@@ -1853,8 +1860,8 @@ static int fw_devlink_relax_cycle(struct device *con, void *sup) + return ret; + + list_for_each_entry(link, &con->links.consumers, s_node) { +- if ((link->flags & ~DL_FLAG_INFERRED) == +- (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED)) ++ if (!(link->flags & DL_FLAG_CYCLE) && ++ device_link_flag_is_sync_state_only(link->flags)) + continue; + + if (!fw_devlink_relax_cycle(link->consumer, sup)) +@@ -1863,6 +1870,7 @@ static int fw_devlink_relax_cycle(struct device *con, void *sup) + ret = 1; + + fw_devlink_relax_link(link); ++ link->flags |= DL_FLAG_CYCLE; + } + return ret; + } +diff --git a/include/linux/device.h b/include/linux/device.h +index 90aaf308c259..1508e637bb26 100644 +--- a/include/linux/device.h ++++ b/include/linux/device.h +@@ -328,6 +328,7 @@ enum device_link_state { + #define DL_FLAG_MANAGED BIT(6) + #define DL_FLAG_SYNC_STATE_ONLY BIT(7) + #define DL_FLAG_INFERRED BIT(8) ++#define DL_FLAG_CYCLE BIT(9) + + /** + * enum dl_dev_state - Device driver presence tracking information. +-- +2.35.3 + diff --git a/patches.suse/drivers-base-transport_class-fix-possible-memory-lea.patch b/patches.suse/drivers-base-transport_class-fix-possible-memory-lea.patch new file mode 100644 index 0000000..a6ae596 --- /dev/null +++ b/patches.suse/drivers-base-transport_class-fix-possible-memory-lea.patch @@ -0,0 +1,48 @@ +From a86367803838b369fe5486ac18771d14723c258c Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Thu, 10 Nov 2022 18:23:07 +0800 +Subject: [PATCH] drivers: base: transport_class: fix possible memory leak +Git-commit: a86367803838b369fe5486ac18771d14723c258c +Patch-mainline: v6.3-rc1 +References: git-fixes + +Current some drivers(like iscsi) call transport_register_device() +failed, they don't call transport_destroy_device() to release the +memory allocated in transport_setup_device(), because they don't +know what was done, it should be internal thing to release the +resource in register function. So fix this leak by calling destroy +function inside register function. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221110102307.3492557-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + include/linux/transport_class.h | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/include/linux/transport_class.h b/include/linux/transport_class.h +index 63076fb835e3..2efc271a96fa 100644 +--- a/include/linux/transport_class.h ++++ b/include/linux/transport_class.h +@@ -70,8 +70,14 @@ void transport_destroy_device(struct device *); + static inline int + transport_register_device(struct device *dev) + { ++ int ret; ++ + transport_setup_device(dev); +- return transport_add_device(dev); ++ ret = transport_add_device(dev); ++ if (ret) ++ transport_destroy_device(dev); ++ ++ return ret; + } + + static inline void +-- +2.35.3 + diff --git a/patches.suse/drivers-base-transport_class-fix-resource-leak-when-.patch b/patches.suse/drivers-base-transport_class-fix-resource-leak-when-.patch new file mode 100644 index 0000000..6fc0758 --- /dev/null +++ b/patches.suse/drivers-base-transport_class-fix-resource-leak-when-.patch @@ -0,0 +1,72 @@ +From e5da06b27ff5a148e42265c8e306670a9d913969 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Tue, 15 Nov 2022 11:16:38 +0800 +Subject: [PATCH] drivers: base: transport_class: fix resource leak when transport_add_device() fails +Git-commit: e5da06b27ff5a148e42265c8e306670a9d913969 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The normal call sequence of using transport class is: + +Add path: +transport_setup_device() + transport_setup_classdev() // call sas_host_setup() here +transport_add_device() // if fails, need call transport_destroy_device() +transport_configure_device() + +Remove path: +transport_remove_device() + transport_remove_classdev // call sas_host_remove() here +transport_destroy_device() + +If transport_add_device() fails, need call transport_destroy_device() +to free memory, but in this case, ->remove() is not called, and the +resources allocated in ->setup() are leaked. So fix these leaks by +calling ->remove() in transport_add_class_device() if it returns error. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221115031638.3816551-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/base/transport_class.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/base/transport_class.c b/drivers/base/transport_class.c +index ccc86206e508..09ee2a1e35bb 100644 +--- a/drivers/base/transport_class.c ++++ b/drivers/base/transport_class.c +@@ -155,12 +155,27 @@ static int transport_add_class_device(struct attribute_container *cont, + struct device *dev, + struct device *classdev) + { ++ struct transport_class *tclass = class_to_transport_class(cont->class); + int error = attribute_container_add_class_device(classdev); + struct transport_container *tcont = + attribute_container_to_transport_container(cont); + +- if (!error && tcont->statistics) ++ if (error) ++ goto err_remove; ++ ++ if (tcont->statistics) { + error = sysfs_create_group(&classdev->kobj, tcont->statistics); ++ if (error) ++ goto err_del; ++ } ++ ++ return 0; ++ ++err_del: ++ attribute_container_class_device_del(classdev); ++err_remove: ++ if (tclass->remove) ++ tclass->remove(tcont, dev, classdev); + + return error; + } +-- +2.35.3 + diff --git a/patches.suse/drm-Fix-potential-null-ptr-deref-due-to-drmm_mode_co.patch b/patches.suse/drm-Fix-potential-null-ptr-deref-due-to-drmm_mode_co.patch new file mode 100644 index 0000000..4e82277 --- /dev/null +++ b/patches.suse/drm-Fix-potential-null-ptr-deref-due-to-drmm_mode_co.patch @@ -0,0 +1,80 @@ +From 834c23e4f798dcdc8af251b3c428ceef94741991 Mon Sep 17 00:00:00 2001 +From: Shang XiaoJing +Date: Fri, 18 Nov 2022 10:16:51 +0800 +Subject: [PATCH] drm: Fix potential null-ptr-deref due to drmm_mode_config_init() +Git-commit: 834c23e4f798dcdc8af251b3c428ceef94741991 +Patch-mainline: v6.3-rc1 +References: git-fixes + +drmm_mode_config_init() will call drm_mode_create_standard_properties() +and won't check the ret value. When drm_mode_create_standard_properties() +failed due to alloc, property will be a NULL pointer and may causes the +null-ptr-deref. Fix the null-ptr-deref by adding the ret value check. + +Found null-ptr-deref while testing insert module bochs: +general protection fault, probably for non-canonical address + 0xdffffc000000000c: 0000 [#1] SMP KASAN PTI +Kasan: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] +Cpu: 3 PID: 249 Comm: modprobe Not tainted 6.1.0-rc1+ #364 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS +rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 +Rip: 0010:drm_object_attach_property+0x73/0x3c0 [drm] +Call Trace: + + __drm_connector_init+0xb6c/0x1100 [drm] + bochs_pci_probe.cold.11+0x4cb/0x7fe [bochs] + pci_device_probe+0x17d/0x340 + really_probe+0x1db/0x5d0 + __driver_probe_device+0x1e7/0x250 + driver_probe_device+0x4a/0x120 + __driver_attach+0xcd/0x2c0 + bus_for_each_dev+0x11a/0x1b0 + bus_add_driver+0x3d7/0x500 + driver_register+0x18e/0x320 + do_one_initcall+0xc4/0x3e0 + do_init_module+0x1b4/0x630 + load_module+0x5dca/0x7230 + __do_sys_finit_module+0x100/0x170 + do_syscall_64+0x3f/0x90 + entry_SYSCALL_64_after_hwframe+0x63/0xcd +Rip: 0033:0x7ff65af9f839 + +Fixes: 6b4959f43a04 ("drm/atomic: atomic plane properties") +Signed-off-by: Shang XiaoJing +Signed-off-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/20221118021651.2460-1-shangxiaojing@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/drm_mode_config.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_mode_config.c b/drivers/gpu/drm/drm_mode_config.c +index 688c8afe0bf1..8525ef851540 100644 +--- a/drivers/gpu/drm/drm_mode_config.c ++++ b/drivers/gpu/drm/drm_mode_config.c +@@ -399,6 +399,8 @@ static void drm_mode_config_init_release(struct drm_device *dev, void *ptr) + */ + int drmm_mode_config_init(struct drm_device *dev) + { ++ int ret; ++ + mutex_init(&dev->mode_config.mutex); + drm_modeset_lock_init(&dev->mode_config.connection_mutex); + mutex_init(&dev->mode_config.idr_mutex); +@@ -420,7 +422,11 @@ int drmm_mode_config_init(struct drm_device *dev) + init_llist_head(&dev->mode_config.connector_free_list); + INIT_WORK(&dev->mode_config.connector_free_work, drm_connector_free_work_fn); + +- drm_mode_create_standard_properties(dev); ++ ret = drm_mode_create_standard_properties(dev); ++ if (ret) { ++ drm_mode_config_cleanup(dev); ++ return ret; ++ } + + /* Just to be sure */ + dev->mode_config.num_fb = 0; +-- +2.35.3 + diff --git a/patches.suse/drm-amd-display-Properly-handle-additional-cases-whe.patch b/patches.suse/drm-amd-display-Properly-handle-additional-cases-whe.patch new file mode 100644 index 0000000..6aba355 --- /dev/null +++ b/patches.suse/drm-amd-display-Properly-handle-additional-cases-whe.patch @@ -0,0 +1,50 @@ +From 6fc547a5a2ef5ce05b16924106663ab92f8f87a7 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 25 Jan 2023 14:35:16 -0500 +Subject: [PATCH] drm/amd/display: Properly handle additional cases where DCN is not supported +Git-commit: 6fc547a5a2ef5ce05b16924106663ab92f8f87a7 +Patch-mainline: v6.2-rc7 +References: git-fixes + +There could be boards with DCN listed in IP discovery, but no +display hardware actually wired up. In this case the vbios +display table will not be populated. Detect this case and +skip loading DM when we detect it. + +V2: Mark DCN as harvested as well so other display checks +elsewhere in the driver are handled properly. + +Cc: Aurabindo Pillai +Reviewed-by: Aurabindo Pillai +Signed-off-by: Alex Deucher +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index af37bc6ed1f5..31bce529f685 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -4501,6 +4501,17 @@ DEVICE_ATTR_WO(s3_debug); + static int dm_early_init(void *handle) + { + struct amdgpu_device *adev = (struct amdgpu_device *)handle; ++ struct amdgpu_mode_info *mode_info = &adev->mode_info; ++ struct atom_context *ctx = mode_info->atom_context; ++ int index = GetIndexIntoMasterTable(DATA, Object_Header); ++ u16 data_offset; ++ ++ /* if there is no object header, skip DM */ ++ if (!amdgpu_atom_parse_data_header(ctx, index, NULL, NULL, NULL, &data_offset)) { ++ adev->harvest_ip_mask |= AMD_HARVEST_IP_DMU_MASK; ++ dev_info(adev->dev, "No object header, skipping DM\n"); ++ return -ENOENT; ++ } + + switch (adev->asic_type) { + #if defined(CONFIG_DRM_AMD_DC_SI) +-- +2.35.3 + diff --git a/patches.suse/drm-amd-display-reduce-else-if-to-else-in-dcn10_blan.patch b/patches.suse/drm-amd-display-reduce-else-if-to-else-in-dcn10_blan.patch new file mode 100644 index 0000000..ed06b1e --- /dev/null +++ b/patches.suse/drm-amd-display-reduce-else-if-to-else-in-dcn10_blan.patch @@ -0,0 +1,46 @@ +From 67cdd3a5cc03591a98a303e5e2086a470650967f Mon Sep 17 00:00:00 2001 +From: Tom Rix +Date: Thu, 26 Jan 2023 17:38:23 -0800 +Subject: [PATCH] drm/amd/display: reduce else-if to else in dcn10_blank_pixel_data() +Git-commit: 67cdd3a5cc03591a98a303e5e2086a470650967f +Patch-mainline: v6.3-rc1 +References: git-fixes + +checkpatch reports +drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c:2902:13: style: + Expression is always true because 'else if' condition is opposite to previous condition at line 2895. [multiCondition] + } else if (blank) { + ^ +drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c:2895:6: note: first condition + if (!blank) { + ^ +drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c:2902:13: note: else if condition is opposite to first condition + } else if (blank) { + +It is not necessary to explicitly the check != condition, an else is simplier. + +Fixes: aa5a57773042 ("drm/amd/display: Vari-bright looks disabled near end of MM14") +Signed-off-by: Tom Rix +Signed-off-by: Alex Deucher +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +index bb155734ac93..f735ae5e045f 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +@@ -2899,7 +2899,7 @@ void dcn10_blank_pixel_data( + dc->hwss.set_pipe(pipe_ctx); + stream_res->abm->funcs->set_abm_level(stream_res->abm, stream->abm_level); + } +- } else if (blank) { ++ } else { + dc->hwss.set_abm_immediate_disable(pipe_ctx); + if (stream_res->tg->funcs->set_blank) { + stream_res->tg->funcs->wait_for_state(stream_res->tg, CRTC_STATE_VBLANK); +-- +2.35.3 + diff --git a/patches.suse/drm-amdgpu-fix-enum-odm_combine_mode-mismatch.patch b/patches.suse/drm-amdgpu-fix-enum-odm_combine_mode-mismatch.patch new file mode 100644 index 0000000..eccab89 --- /dev/null +++ b/patches.suse/drm-amdgpu-fix-enum-odm_combine_mode-mismatch.patch @@ -0,0 +1,144 @@ +From 087bad7eb1f6945f8232f132953ecc2bda8bd38d Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 6 Feb 2023 20:36:02 +0100 +Subject: [PATCH] drm/amdgpu: fix enum odm_combine_mode mismatch +Git-commit: 087bad7eb1f6945f8232f132953ecc2bda8bd38d +Patch-mainline: v6.3-rc1 +References: git-fixes + +A conversion from 'bool' to 'enum odm_combine_mode' was incomplete, +and gcc warns about this with many instances of + +display/dc/dml/dcn20/display_mode_vba_20.c:3899:44: warning: implicit conversion from 'enum ' to 'enum +odm_combine_mode' [-Wenum-conversion] + 3899 | locals->ODMCombineEnablePerState[i][k] = false; + +Change the ones that we get a warning for, using the same numerical +values to leave the behavior unchanged. + +Fixes: 5fc11598166d ("drm/amd/display: expand dml structs") +Link: https://lore.kernel.org/all/20201026210039.3884312-3-arnd@kernel.org/ +Link: https://lore.kernel.org/all/20210927100659.1431744-1-arnd@kernel.org/ +Signed-off-by: Arnd Bergmann +Signed-off-by: Alex Deucher +Acked-by: Takashi Iwai + +--- + .../amd/display/dc/dml/dcn20/display_mode_vba_20.c | 8 ++++---- + .../amd/display/dc/dml/dcn20/display_mode_vba_20v2.c | 10 +++++----- + .../amd/display/dc/dml/dcn21/display_mode_vba_21.c | 12 ++++++------ + 3 files changed, 15 insertions(+), 15 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c +index d3b5b6fedf04..6266b0788387 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c +@@ -3897,14 +3897,14 @@ void dml20_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l + mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine = mode_lib->vba.PixelClock[k] / 2 + * (1 + mode_lib->vba.DISPCLKDPPCLKDSCCLKDownSpreading / 100.0); + +- locals->ODMCombineEnablePerState[i][k] = false; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithoutODMCombine; + if (mode_lib->vba.ODMCapability) { + if (locals->PlaneRequiredDISPCLKWithoutODMCombine > mode_lib->vba.MaxDispclkRoundedDownToDFSGranularity) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } else if (locals->HActive[k] > DCN20_MAX_420_IMAGE_WIDTH && locals->OutputFormat[k] == dm_420) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } + } +@@ -3957,7 +3957,7 @@ void dml20_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l + locals->RequiredDISPCLK[i][j] = 0.0; + locals->DISPCLK_DPPCLK_Support[i][j] = true; + for (k = 0; k <= mode_lib->vba.NumberOfActivePlanes - 1; k++) { +- locals->ODMCombineEnablePerState[i][k] = false; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; + if (locals->SwathWidthYSingleDPP[k] <= locals->MaximumSwathWidth[k]) { + locals->NoOfDPP[i][j][k] = 1; + locals->RequiredDPPCLK[i][j][k] = locals->MinDPPCLKUsingSingleDPP[k] +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c +index edd098c7eb92..989d83ee3842 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c +@@ -4008,17 +4008,17 @@ void dml20v2_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode + mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine = mode_lib->vba.PixelClock[k] / 2 + * (1 + mode_lib->vba.DISPCLKDPPCLKDSCCLKDownSpreading / 100.0); + +- locals->ODMCombineEnablePerState[i][k] = false; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithoutODMCombine; + if (mode_lib->vba.ODMCapability) { + if (locals->PlaneRequiredDISPCLKWithoutODMCombine > MaxMaxDispclkRoundedDown) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } else if (locals->DSCEnabled[k] && (locals->HActive[k] > DCN20_MAX_DSC_IMAGE_WIDTH)) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } else if (locals->HActive[k] > DCN20_MAX_420_IMAGE_WIDTH && locals->OutputFormat[k] == dm_420) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } + } +@@ -4071,7 +4071,7 @@ void dml20v2_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode + locals->RequiredDISPCLK[i][j] = 0.0; + locals->DISPCLK_DPPCLK_Support[i][j] = true; + for (k = 0; k <= mode_lib->vba.NumberOfActivePlanes - 1; k++) { +- locals->ODMCombineEnablePerState[i][k] = false; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; + if (locals->SwathWidthYSingleDPP[k] <= locals->MaximumSwathWidth[k]) { + locals->NoOfDPP[i][j][k] = 1; + locals->RequiredDPPCLK[i][j][k] = locals->MinDPPCLKUsingSingleDPP[k] +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c +index 1d84ae50311d..b7c2844d0cbe 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c +@@ -4102,17 +4102,17 @@ void dml21_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l + mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine = mode_lib->vba.PixelClock[k] / 2 + * (1 + mode_lib->vba.DISPCLKDPPCLKDSCCLKDownSpreading / 100.0); + +- locals->ODMCombineEnablePerState[i][k] = false; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithoutODMCombine; + if (mode_lib->vba.ODMCapability) { + if (locals->PlaneRequiredDISPCLKWithoutODMCombine > MaxMaxDispclkRoundedDown) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } else if (locals->DSCEnabled[k] && (locals->HActive[k] > DCN21_MAX_DSC_IMAGE_WIDTH)) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } else if (locals->HActive[k] > DCN21_MAX_420_IMAGE_WIDTH && locals->OutputFormat[k] == dm_420) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } + } +@@ -4165,7 +4165,7 @@ void dml21_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l + locals->RequiredDISPCLK[i][j] = 0.0; + locals->DISPCLK_DPPCLK_Support[i][j] = true; + for (k = 0; k <= mode_lib->vba.NumberOfActivePlanes - 1; k++) { +- locals->ODMCombineEnablePerState[i][k] = false; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; + if (locals->SwathWidthYSingleDPP[k] <= locals->MaximumSwathWidth[k]) { + locals->NoOfDPP[i][j][k] = 1; + locals->RequiredDPPCLK[i][j][k] = locals->MinDPPCLKUsingSingleDPP[k] +@@ -5230,7 +5230,7 @@ void dml21_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l + mode_lib->vba.ODMCombineEnabled[k] = + locals->ODMCombineEnablePerState[mode_lib->vba.VoltageLevel][k]; + } else { +- mode_lib->vba.ODMCombineEnabled[k] = false; ++ mode_lib->vba.ODMCombineEnabled[k] = dm_odm_combine_mode_disabled; + } + mode_lib->vba.DSCEnabled[k] = + locals->RequiresDSC[mode_lib->vba.VoltageLevel][k]; +-- +2.35.3 + diff --git a/patches.suse/drm-bridge-lt8912b-Add-hot-plug-detection.patch b/patches.suse/drm-bridge-lt8912b-Add-hot-plug-detection.patch new file mode 100644 index 0000000..224e14b --- /dev/null +++ b/patches.suse/drm-bridge-lt8912b-Add-hot-plug-detection.patch @@ -0,0 +1,68 @@ +From 3b0a01a6a5224ed9b3f69f44edaa889b2e2b9779 Mon Sep 17 00:00:00 2001 +From: Stefan Eichenberger +Date: Mon, 28 Nov 2022 12:23:20 +0100 +Subject: [PATCH] drm/bridge: lt8912b: Add hot plug detection +Git-commit: 3b0a01a6a5224ed9b3f69f44edaa889b2e2b9779 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Enable hot plug detection when it is available on the HDMI port. +Without this connecting to a different monitor with incompatible timing +before the 10 seconds poll period will lead to a broken display output. + +Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge") +Signed-off-by: Stefan Eichenberger +Signed-off-by: Francesco Dolcini +Reviewed-by: Adrien Grassein +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20221128112320.25708-1-francesco@dolcini.it +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/bridge/lontium-lt8912b.c | 21 +++++++++++++++++++-- + 1 file changed, 19 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/bridge/lontium-lt8912b.c ++++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c +@@ -518,14 +518,27 @@ static void lt8912_detach_dsi(struct lt8 + mipi_dsi_device_unregister(lt->dsi); + } + ++static void lt8912_bridge_hpd_cb(void *data, enum drm_connector_status status) ++{ ++ struct lt8912 *lt = data; ++ ++ if (lt->bridge.dev) ++ drm_helper_hpd_irq_event(lt->bridge.dev); ++} ++ + static int lt8912_bridge_connector_init(struct drm_bridge *bridge) + { + int ret; + struct lt8912 *lt = bridge_to_lt8912(bridge); + struct drm_connector *connector = <->connector; + +- connector->polled = DRM_CONNECTOR_POLL_CONNECT | +- DRM_CONNECTOR_POLL_DISCONNECT; ++ if (lt->hdmi_port->ops & DRM_BRIDGE_OP_HPD) { ++ drm_bridge_hpd_enable(lt->hdmi_port, lt8912_bridge_hpd_cb, lt); ++ connector->polled = DRM_CONNECTOR_POLL_HPD; ++ } else { ++ connector->polled = DRM_CONNECTOR_POLL_CONNECT | ++ DRM_CONNECTOR_POLL_DISCONNECT; ++ } + + ret = drm_connector_init(bridge->dev, connector, + <8912_connector_funcs, +@@ -584,6 +597,10 @@ static void lt8912_bridge_detach(struct + if (lt->is_attached) { + lt8912_detach_dsi(lt); + lt8912_hard_power_off(lt); ++ ++ if (lt->hdmi_port->ops & DRM_BRIDGE_OP_HPD) ++ drm_bridge_hpd_disable(lt->hdmi_port); ++ + drm_connector_unregister(<->connector); + drm_connector_cleanup(<->connector); + } diff --git a/patches.suse/drm-bridge-lt9611-fix-HPD-reenablement.patch b/patches.suse/drm-bridge-lt9611-fix-HPD-reenablement.patch new file mode 100644 index 0000000..6106bb0 --- /dev/null +++ b/patches.suse/drm-bridge-lt9611-fix-HPD-reenablement.patch @@ -0,0 +1,52 @@ +From a7790f6bd38f3642b60ae3504a2c749135b89451 Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Wed, 18 Jan 2023 10:16:47 +0200 +Subject: [PATCH] drm/bridge: lt9611: fix HPD reenablement +Git-commit: a7790f6bd38f3642b60ae3504a2c749135b89451 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The driver will reset the bridge in the atomic_pre_enable(). However +this will also drop the HPD interrupt state. Instead of resetting the +bridge, properly wake it up. This fixes the HPD interrupt delivery after +the disable/enable cycle. + +Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") +Reviewed-by: Neil Armstrong +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-3-dmitry.baryshkov@linaro.org +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/bridge/lontium-lt9611.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c +index 95a962e62ae4..fc5869116cdb 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9611.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c +@@ -857,12 +857,18 @@ static enum drm_mode_status lt9611_bridge_mode_valid(struct drm_bridge *bridge, + static void lt9611_bridge_pre_enable(struct drm_bridge *bridge) + { + struct lt9611 *lt9611 = bridge_to_lt9611(bridge); ++ static const struct reg_sequence reg_cfg[] = { ++ { 0x8102, 0x12 }, ++ { 0x8123, 0x40 }, ++ { 0x8130, 0xea }, ++ { 0x8011, 0xfa }, ++ }; + + if (!lt9611->sleep) + return; + +- lt9611_reset(lt9611); +- regmap_write(lt9611->regmap, 0x80ee, 0x01); ++ regmap_multi_reg_write(lt9611->regmap, ++ reg_cfg, ARRAY_SIZE(reg_cfg)); + + lt9611->sleep = false; + } +-- +2.35.3 + diff --git a/patches.suse/drm-bridge-lt9611-fix-clock-calculation.patch b/patches.suse/drm-bridge-lt9611-fix-clock-calculation.patch new file mode 100644 index 0000000..10a2b20 --- /dev/null +++ b/patches.suse/drm-bridge-lt9611-fix-clock-calculation.patch @@ -0,0 +1,106 @@ +From 2576eb26494eb0509dd9ceb0cd27771a7a5e3674 Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Wed, 18 Jan 2023 10:16:50 +0200 +Subject: [PATCH] drm/bridge: lt9611: fix clock calculation +Git-commit: 2576eb26494eb0509dd9ceb0cd27771a7a5e3674 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Instead of having several fixed values for the pcr register, calculate +it before programming. This allows the bridge to support most of the +display modes. + +Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") +Reviewed-by: Neil Armstrong +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-6-dmitry.baryshkov@linaro.org +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/bridge/lontium-lt9611.c | 32 +++++++++++-------------- + 1 file changed, 14 insertions(+), 18 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c +index 7605c5b17657..fb72cf7fb80f 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9611.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c +@@ -192,8 +192,9 @@ static void lt9611_mipi_video_setup(struct lt9611 *lt9611, + regmap_write(lt9611->regmap, 0x831b, (u8)(hsync_porch % 256)); + } + +-static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode) ++static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode, unsigned int postdiv) + { ++ unsigned int pcr_m = mode->clock * 5 * postdiv / 27000; + const struct reg_sequence reg_cfg[] = { + { 0x830b, 0x01 }, + { 0x830c, 0x10 }, +@@ -236,24 +237,14 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod + else + regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg)); + +- switch (mode->hdisplay) { +- case 640: +- regmap_write(lt9611->regmap, 0x8326, 0x14); +- break; +- case 1920: +- regmap_write(lt9611->regmap, 0x8326, 0x37); +- break; +- case 3840: +- regmap_write(lt9611->regmap, 0x8326, 0x37); +- break; +- } ++ regmap_write(lt9611->regmap, 0x8326, pcr_m); + + /* pcr rst */ + regmap_write(lt9611->regmap, 0x8011, 0x5a); + regmap_write(lt9611->regmap, 0x8011, 0xfa); + } + +-static int lt9611_pll_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode) ++static int lt9611_pll_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode, unsigned int *postdiv) + { + unsigned int pclk = mode->clock; + const struct reg_sequence reg_cfg[] = { +@@ -272,12 +263,16 @@ static int lt9611_pll_setup(struct lt9611 *lt9611, const struct drm_display_mode + + regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg)); + +- if (pclk > 150000) ++ if (pclk > 150000) { + regmap_write(lt9611->regmap, 0x812d, 0x88); +- else if (pclk > 70000) ++ *postdiv = 1; ++ } else if (pclk > 70000) { + regmap_write(lt9611->regmap, 0x812d, 0x99); +- else ++ *postdiv = 2; ++ } else { + regmap_write(lt9611->regmap, 0x812d, 0xaa); ++ *postdiv = 4; ++ } + + /* + * first divide pclk by 2 first +@@ -896,14 +891,15 @@ static void lt9611_bridge_mode_set(struct drm_bridge *bridge, + { + struct lt9611 *lt9611 = bridge_to_lt9611(bridge); + struct hdmi_avi_infoframe avi_frame; ++ unsigned int postdiv; + int ret; + + lt9611_bridge_pre_enable(bridge); + + lt9611_mipi_input_digital(lt9611, mode); +- lt9611_pll_setup(lt9611, mode); ++ lt9611_pll_setup(lt9611, mode, &postdiv); + lt9611_mipi_video_setup(lt9611, mode); +- lt9611_pcr_setup(lt9611, mode); ++ lt9611_pcr_setup(lt9611, mode, postdiv); + + ret = drm_hdmi_avi_infoframe_from_display_mode(&avi_frame, + <9611->connector, +-- +2.35.3 + diff --git a/patches.suse/drm-bridge-lt9611-fix-polarity-programming.patch b/patches.suse/drm-bridge-lt9611-fix-polarity-programming.patch new file mode 100644 index 0000000..b22dda9 --- /dev/null +++ b/patches.suse/drm-bridge-lt9611-fix-polarity-programming.patch @@ -0,0 +1,68 @@ +From 0b157efa384ea417304b1da284ee2f603c607fc3 Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Wed, 18 Jan 2023 10:16:48 +0200 +Subject: [PATCH] drm/bridge: lt9611: fix polarity programming +Git-commit: 0b157efa384ea417304b1da284ee2f603c607fc3 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Fix programming of hsync and vsync polarities + +Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") +Reviewed-by: Neil Armstrong +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-4-dmitry.baryshkov@linaro.org +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/bridge/lontium-lt9611.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c +index fc5869116cdb..d6c08c888f03 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9611.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c +@@ -207,7 +207,6 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod + + /* stage 2 */ + { 0x834a, 0x40 }, +- { 0x831d, 0x10 }, + + /* MK limit */ + { 0x832d, 0x38 }, +@@ -222,11 +221,19 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod + { 0x8325, 0x00 }, + { 0x832a, 0x01 }, + { 0x834a, 0x10 }, +- { 0x831d, 0x10 }, +- { 0x8326, 0x37 }, + }; ++ u8 pol = 0x10; + +- regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg)); ++ if (mode->flags & DRM_MODE_FLAG_NHSYNC) ++ pol |= 0x2; ++ if (mode->flags & DRM_MODE_FLAG_NVSYNC) ++ pol |= 0x1; ++ regmap_write(lt9611->regmap, 0x831d, pol); ++ ++ if (mode->hdisplay == 3840) ++ regmap_multi_reg_write(lt9611->regmap, reg_cfg2, ARRAY_SIZE(reg_cfg2)); ++ else ++ regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg)); + + switch (mode->hdisplay) { + case 640: +@@ -236,7 +243,7 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod + regmap_write(lt9611->regmap, 0x8326, 0x37); + break; + case 3840: +- regmap_multi_reg_write(lt9611->regmap, reg_cfg2, ARRAY_SIZE(reg_cfg2)); ++ regmap_write(lt9611->regmap, 0x8326, 0x37); + break; + } + +-- +2.35.3 + diff --git a/patches.suse/drm-bridge-lt9611-fix-programming-of-video-modes.patch b/patches.suse/drm-bridge-lt9611-fix-programming-of-video-modes.patch new file mode 100644 index 0000000..e7c053b --- /dev/null +++ b/patches.suse/drm-bridge-lt9611-fix-programming-of-video-modes.patch @@ -0,0 +1,38 @@ +From ad188aa47edaa033a270e1a3efae43836ff47569 Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Wed, 18 Jan 2023 10:16:49 +0200 +Subject: [PATCH] drm/bridge: lt9611: fix programming of video modes +Git-commit: ad188aa47edaa033a270e1a3efae43836ff47569 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Program the upper part of the hfront_porch into the proper register. + +Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") +Reviewed-by: Neil Armstrong +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-5-dmitry.baryshkov@linaro.org +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/bridge/lontium-lt9611.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c +index d6c08c888f03..7605c5b17657 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9611.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c +@@ -187,7 +187,8 @@ static void lt9611_mipi_video_setup(struct lt9611 *lt9611, + + regmap_write(lt9611->regmap, 0x8319, (u8)(hfront_porch % 256)); + +- regmap_write(lt9611->regmap, 0x831a, (u8)(hsync_porch / 256)); ++ regmap_write(lt9611->regmap, 0x831a, (u8)(hsync_porch / 256) | ++ ((hfront_porch / 256) << 4)); + regmap_write(lt9611->regmap, 0x831b, (u8)(hsync_porch % 256)); + } + +-- +2.35.3 + diff --git a/patches.suse/drm-bridge-lt9611-fix-sleep-mode-setup.patch b/patches.suse/drm-bridge-lt9611-fix-sleep-mode-setup.patch new file mode 100644 index 0000000..4cc36ad --- /dev/null +++ b/patches.suse/drm-bridge-lt9611-fix-sleep-mode-setup.patch @@ -0,0 +1,46 @@ +From ae2d329f104b75a0a78dcaded29fe6283289cdf9 Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Wed, 18 Jan 2023 10:16:46 +0200 +Subject: [PATCH] drm/bridge: lt9611: fix sleep mode setup +Git-commit: ae2d329f104b75a0a78dcaded29fe6283289cdf9 +Patch-mainline: v6.3-rc1 +References: git-fixes + +On atomic_post_disable the bridge goes to the low power state. However +the code disables too much of the chip, so the HPD event is not being +detected and delivered to the host. Reduce the power saving in order to +get the HPD event. + +Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") +Reviewed-by: Neil Armstrong +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-2-dmitry.baryshkov@linaro.org +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/bridge/lontium-lt9611.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c +index 3ce4e495aee5..95a962e62ae4 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9611.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c +@@ -449,12 +449,11 @@ static void lt9611_sleep_setup(struct lt9611 *lt9611) + { 0x8023, 0x01 }, + { 0x8157, 0x03 }, /* set addr pin as output */ + { 0x8149, 0x0b }, +- { 0x8151, 0x30 }, /* disable IRQ */ ++ + { 0x8102, 0x48 }, /* MIPI Rx power down */ + { 0x8123, 0x80 }, + { 0x8130, 0x00 }, +- { 0x8100, 0x01 }, /* bandgap power down */ +- { 0x8101, 0x00 }, /* system clk power down */ ++ { 0x8011, 0x0a }, + }; + + regmap_multi_reg_write(lt9611->regmap, +-- +2.35.3 + diff --git a/patches.suse/drm-bridge-lt9611-pass-a-pointer-to-the-of-node.patch b/patches.suse/drm-bridge-lt9611-pass-a-pointer-to-the-of-node.patch new file mode 100644 index 0000000..e267838 --- /dev/null +++ b/patches.suse/drm-bridge-lt9611-pass-a-pointer-to-the-of-node.patch @@ -0,0 +1,32 @@ +From b0a7f8736789935f62d6df32d441cdf05a5c05d2 Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Wed, 18 Jan 2023 10:16:51 +0200 +Subject: [PATCH] drm/bridge: lt9611: pass a pointer to the of node +Git-commit: b0a7f8736789935f62d6df32d441cdf05a5c05d2 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Pass a pointer to the OF node while registering lt9611 MIPI device. + +Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") +Reviewed-by: Neil Armstrong +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-7-dmitry.baryshkov@linaro.org +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/bridge/lontium-lt9611.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/bridge/lontium-lt9611.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c +@@ -759,7 +759,7 @@ static const struct drm_connector_funcs + static struct mipi_dsi_device *lt9611_attach_dsi(struct lt9611 *lt9611, + struct device_node *dsi_node) + { +- const struct mipi_dsi_device_info info = { "lt9611", 0, NULL }; ++ const struct mipi_dsi_device_info info = { "lt9611", 0, lt9611->dev->of_node}; + struct mipi_dsi_device *dsi; + struct mipi_dsi_host *host; + int ret; diff --git a/patches.suse/drm-bridge-megachips-Fix-error-handling-in-i2c_regis.patch b/patches.suse/drm-bridge-megachips-Fix-error-handling-in-i2c_regis.patch new file mode 100644 index 0000000..4dd1be9 --- /dev/null +++ b/patches.suse/drm-bridge-megachips-Fix-error-handling-in-i2c_regis.patch @@ -0,0 +1,65 @@ +From 4ecff954c370b82bce45bdca2846c5c5563e8a8a Mon Sep 17 00:00:00 2001 +From: Yuan Can +Date: Tue, 8 Nov 2022 09:12:26 +0000 +Subject: [PATCH] drm/bridge: megachips: Fix error handling in i2c_register_driver() +Git-commit: 4ecff954c370b82bce45bdca2846c5c5563e8a8a +Patch-mainline: v6.3-rc1 +References: git-fixes + +A problem about insmod megachips-stdpxxxx-ge-b850v3-fw.ko failed is +triggered with the following log given: + +[ 4497.981497] Error: Driver 'stdp4028-ge-b850v3-fw' is already registered, aborting... +Insmod: ERROR: could not insert module megachips-stdpxxxx-ge-b850v3-fw.ko: Device or resource busy + +The reason is that stdpxxxx_ge_b850v3_init() returns i2c_add_driver() +directly without checking its return value, if i2c_add_driver() failed, +it returns without calling i2c_del_driver() on the previous i2c driver, +resulting the megachips-stdpxxxx-ge-b850v3-fw can never be installed +later. +A simple call graph is shown as below: + + stdpxxxx_ge_b850v3_init() + i2c_add_driver(&stdp4028_ge_b850v3_fw_driver) + i2c_add_driver(&stdp2690_ge_b850v3_fw_driver) + i2c_register_driver() + driver_register() + bus_add_driver() + priv = kzalloc(...) # OOM happened + # return without delete stdp4028_ge_b850v3_fw_driver + +Fix by calling i2c_del_driver() on stdp4028_ge_b850v3_fw_driver when +i2c_add_driver() returns error. + +Fixes: fcfa0ddc18ed ("drm/bridge: Drivers for megachips-stdpxxxx-ge-b850v3-fw (LVDS-DP++)") +Signed-off-by: Yuan Can +Reviewed-by: Andrzej Hajda +Tested-by: Ian Ray +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20221108091226.114524-1-yuancan@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c +index 97359f807bfc..cbfa05a6767b 100644 +--- a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c ++++ b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c +@@ -440,7 +440,11 @@ static int __init stdpxxxx_ge_b850v3_init(void) + if (ret) + return ret; + +- return i2c_add_driver(&stdp2690_ge_b850v3_fw_driver); ++ ret = i2c_add_driver(&stdp2690_ge_b850v3_fw_driver); ++ if (ret) ++ i2c_del_driver(&stdp4028_ge_b850v3_fw_driver); ++ ++ return ret; + } + module_init(stdpxxxx_ge_b850v3_init); + +-- +2.35.3 + diff --git a/patches.suse/drm-fourcc-Add-missing-big-endian-XRGB1555-and-RGB56.patch b/patches.suse/drm-fourcc-Add-missing-big-endian-XRGB1555-and-RGB56.patch new file mode 100644 index 0000000..09fb445 --- /dev/null +++ b/patches.suse/drm-fourcc-Add-missing-big-endian-XRGB1555-and-RGB56.patch @@ -0,0 +1,50 @@ +From 6fb6c979ca628583d4d0c59a0f8ff977e581ecc0 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Wed, 23 Nov 2022 17:43:10 +0100 +Subject: [PATCH] drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats +Git-commit: 6fb6c979ca628583d4d0c59a0f8ff977e581ecc0 +Patch-mainline: v6.3-rc1 +References: git-fixes + +As of commit eae06120f1974e1a ("drm: refuse ADDFB2 ioctl for broken +bigendian drivers"), drivers must set the +quirk_addfb_prefer_host_byte_order quirk to make the drm_mode_addfb() +compat code work correctly on big-endian machines. + +While that works fine for big-endian XRGB8888 and ARGB8888, which are +mapped to the existing little-endian BGRX8888 and BGRA8888 formats, it +does not work for big-endian XRGB1555 and RGB565, as the latter are not +listed in the format database. + +Fix this by adding the missing formats. Limit this to big-endian +platforms, as there is currently no need to support these formats on +little-endian platforms. + +Fixes: 6960e6da9cec3f66 ("drm: fix drm_mode_addfb() on big endian machines.") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/3ee1f8144feb96c28742b22384189f1f83bcfc1a.1669221671.git.geert@linux-m68k.org +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/drm_fourcc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/drm_fourcc.c b/drivers/gpu/drm/drm_fourcc.c +index 6242dfbe9240..0f17dfa8702b 100644 +--- a/drivers/gpu/drm/drm_fourcc.c ++++ b/drivers/gpu/drm/drm_fourcc.c +@@ -190,6 +190,10 @@ const struct drm_format_info *__drm_format_info(u32 format) + { .format = DRM_FORMAT_BGRA5551, .depth = 15, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1, .has_alpha = true }, + { .format = DRM_FORMAT_RGB565, .depth = 16, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 }, + { .format = DRM_FORMAT_BGR565, .depth = 16, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 }, ++#ifdef __BIG_ENDIAN ++ { .format = DRM_FORMAT_XRGB1555 | DRM_FORMAT_BIG_ENDIAN, .depth = 15, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 }, ++ { .format = DRM_FORMAT_RGB565 | DRM_FORMAT_BIG_ENDIAN, .depth = 16, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 }, ++#endif + { .format = DRM_FORMAT_RGB888, .depth = 24, .num_planes = 1, .cpp = { 3, 0, 0 }, .hsub = 1, .vsub = 1 }, + { .format = DRM_FORMAT_BGR888, .depth = 24, .num_planes = 1, .cpp = { 3, 0, 0 }, .hsub = 1, .vsub = 1 }, + { .format = DRM_FORMAT_XRGB8888, .depth = 24, .num_planes = 1, .cpp = { 4, 0, 0 }, .hsub = 1, .vsub = 1 }, +-- +2.35.3 + diff --git a/patches.suse/drm-i915-Don-t-use-BAR-mappings-for-ring-buffers-wit.patch b/patches.suse/drm-i915-Don-t-use-BAR-mappings-for-ring-buffers-wit.patch new file mode 100644 index 0000000..a8ebca5 --- /dev/null +++ b/patches.suse/drm-i915-Don-t-use-BAR-mappings-for-ring-buffers-wit.patch @@ -0,0 +1,63 @@ +From 85636167e3206c3fbd52254fc432991cc4e90194 Mon Sep 17 00:00:00 2001 +From: John Harrison +Date: Wed, 15 Feb 2023 17:11:01 -0800 +Subject: [PATCH] drm/i915: Don't use BAR mappings for ring buffers with LLC +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 85636167e3206c3fbd52254fc432991cc4e90194 +Patch-mainline: v6.3-rc1 +Alt-commit: 65c08339db1ada87afd6cfe7db8e60bb4851d919 +References: git-fixes + +Direction from hardware is that ring buffers should never be mapped +via the BAR on systems with LLC. There are too many caching pitfalls +due to the way BAR accesses are routed. So it is safest to just not +use it. + +Signed-off-by: John Harrison +Fixes: 9d80841ea4c9 ("drm/i915: Allow ringbuffers to be bound anywhere") +Cc: Chris Wilson +Cc: Joonas Lahtinen +Cc: Jani Nikula +Cc: Rodrigo Vivi +Cc: Tvrtko Ursulin +Cc: intel-gfx@lists.freedesktop.org +Cc: # v4.9+ +Tested-by: Jouni Högander +Reviewed-by: Daniele Ceraolo Spurio +Link: https://patchwork.freedesktop.org/patch/msgid/20230216011101.1909009-3-John.C.Harrison@Intel.com +(cherry picked from commit 65c08339db1ada87afd6cfe7db8e60bb4851d919) + +Signed-off-by: Jani Nikula +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/i915/gt/intel_ring.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_ring.c b/drivers/gpu/drm/i915/gt/intel_ring.c +index fb1d2595392e..fb99143be98e 100644 +--- a/drivers/gpu/drm/i915/gt/intel_ring.c ++++ b/drivers/gpu/drm/i915/gt/intel_ring.c +@@ -53,7 +53,7 @@ int intel_ring_pin(struct intel_ring *ring, struct i915_gem_ww_ctx *ww) + if (unlikely(ret)) + goto err_unpin; + +- if (i915_vma_is_map_and_fenceable(vma)) { ++ if (i915_vma_is_map_and_fenceable(vma) && !HAS_LLC(vma->vm->i915)) { + addr = (void __force *)i915_vma_pin_iomap(vma); + } else { + int type = i915_coherent_map_type(vma->vm->i915, vma->obj, false); +@@ -98,7 +98,7 @@ void intel_ring_unpin(struct intel_ring *ring) + return; + + i915_vma_unset_ggtt_write(vma); +- if (i915_vma_is_map_and_fenceable(vma)) ++ if (i915_vma_is_map_and_fenceable(vma) && !HAS_LLC(vma->vm->i915)) + i915_vma_unpin_iomap(vma); + else + i915_gem_object_unpin_map(vma->obj); +-- +2.35.3 + diff --git a/patches.suse/drm-i915-gen11-Moving-WAs-to-icl_gt_workarounds_init.patch b/patches.suse/drm-i915-gen11-Moving-WAs-to-icl_gt_workarounds_init.patch new file mode 100644 index 0000000..83e3904 --- /dev/null +++ b/patches.suse/drm-i915-gen11-Moving-WAs-to-icl_gt_workarounds_init.patch @@ -0,0 +1,58 @@ +From 67b858dd89932086ae0ee2d0ce4dd070a2c88bb3 Mon Sep 17 00:00:00 2001 +From: Raviteja Goud Talla +Date: Fri, 3 Dec 2021 20:26:03 +0530 +Subject: [PATCH] drm/i915/gen11: Moving WAs to icl_gt_workarounds_init() +Git-commit: 67b858dd89932086ae0ee2d0ce4dd070a2c88bb3 +Patch-mainline: v5.17-rc1 +References: git-fixes + +Bspec page says "Reset: BUS", Accordingly moving w/a's: +Wa_1407352427,Wa_1406680159 to proper function icl_gt_workarounds_init() +Which will resolve guc enabling error + +V2: - Previous patch rev2 was created by email client which caused the Build failure, This v2 is to resolve the previous broken series + +Reviewed-by: John Harrison +Signed-off-by: Raviteja Goud Talla +Signed-off-by: John Harrison +Link: https://patchwork.freedesktop.org/patch/msgid/20211203145603.4006937-1-ravitejax.goud.talla@intel.com +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/i915/gt/intel_workarounds.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c ++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c +@@ -1049,6 +1049,15 @@ icl_gt_workarounds_init(struct drm_i915_ + GAMT_CHKN_BIT_REG, + GAMT_CHKN_DISABLE_L3_COH_PIPE); + ++ /* Wa_1407352427:icl,ehl */ ++ wa_write_or(wal, UNSLICE_UNIT_LEVEL_CLKGATE2, ++ PSDUNIT_CLKGATE_DIS); ++ ++ /* Wa_1406680159:icl,ehl */ ++ wa_write_or(wal, ++ SUBSLICE_UNIT_LEVEL_CLKGATE, ++ GWUNIT_CLKGATE_DIS); ++ + /* Wa_1607087056:icl,ehl,jsl */ + if (IS_ICELAKE(i915) || + IS_JSL_EHL_GT_STEP(i915, STEP_A0, STEP_B0)) +@@ -1745,15 +1754,6 @@ rcs_engine_wa_init(struct intel_engine_c + wa_write_or(wal, UNSLICE_UNIT_LEVEL_CLKGATE, + VSUNIT_CLKGATE_DIS | HSUNIT_CLKGATE_DIS); + +- /* Wa_1407352427:icl,ehl */ +- wa_write_or(wal, UNSLICE_UNIT_LEVEL_CLKGATE2, +- PSDUNIT_CLKGATE_DIS); +- +- /* Wa_1406680159:icl,ehl */ +- wa_write_or(wal, +- SUBSLICE_UNIT_LEVEL_CLKGATE, +- GWUNIT_CLKGATE_DIS); +- + /* + * Wa_1408767742:icl[a2..forever],ehl[all] + * Wa_1605460711:icl[a0..c0] diff --git a/patches.suse/drm-i915-gen11-Wa_1408615072-Wa_1407596294-should-be.patch b/patches.suse/drm-i915-gen11-Wa_1408615072-Wa_1407596294-should-be.patch new file mode 100644 index 0000000..5367972 --- /dev/null +++ b/patches.suse/drm-i915-gen11-Wa_1408615072-Wa_1407596294-should-be.patch @@ -0,0 +1,65 @@ +From d5a1224aa68c8b124a4c5c390186e571815ed390 Mon Sep 17 00:00:00 2001 +From: Matt Roper +Date: Wed, 1 Feb 2023 14:28:29 -0800 +Subject: [PATCH] drm/i915/gen11: Wa_1408615072/Wa_1407596294 should be on GT list +Git-commit: d5a1224aa68c8b124a4c5c390186e571815ed390 +Patch-mainline: v6.2 +Alt-commit: 5f21dc07b52eb54a908e66f5d6e05a87bcb5b049 +References: git-fixes + +The UNSLICE_UNIT_LEVEL_CLKGATE register programmed by this workaround +has 'BUS' style reset, indicating that it does not lose its value on +engine resets. Furthermore, this register is part of the GT forcewake +domain rather than the RENDER domain, so it should not be impacted by +RCS engine resets. As such, we should implement this on the GT +workaround list rather than an engine list. + +Bspec: 19219 +Fixes: 3551ff928744 ("drm/i915/gen11: Moving WAs to rcs_engine_wa_init()") +Signed-off-by: Matt Roper +Reviewed-by: Gustavo Sousa +Link: https://patchwork.freedesktop.org/patch/msgid/20230201222831.608281-2-matthew.d.roper@intel.com +(cherry picked from commit 5f21dc07b52eb54a908e66f5d6e05a87bcb5b049) + +Signed-off-by: Rodrigo Vivi +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/i915/gt/intel_workarounds.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c +index 949c19339015..a0740308555d 100644 +--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c ++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c +@@ -1355,6 +1355,13 @@ icl_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) + GAMT_CHKN_BIT_REG, + GAMT_CHKN_DISABLE_L3_COH_PIPE); + ++ /* ++ * Wa_1408615072:icl,ehl (vsunit) ++ * Wa_1407596294:icl,ehl (hsunit) ++ */ ++ wa_write_or(wal, UNSLICE_UNIT_LEVEL_CLKGATE, ++ VSUNIT_CLKGATE_DIS | HSUNIT_CLKGATE_DIS); ++ + /* Wa_1407352427:icl,ehl */ + wa_write_or(wal, UNSLICE_UNIT_LEVEL_CLKGATE2, + PSDUNIT_CLKGATE_DIS); +@@ -2539,13 +2546,6 @@ rcs_engine_wa_init(struct intel_engine_cs *engine, struct i915_wa_list *wal) + wa_masked_en(wal, GEN9_CSFE_CHICKEN1_RCS, + GEN11_ENABLE_32_PLANE_MODE); + +- /* +- * Wa_1408615072:icl,ehl (vsunit) +- * Wa_1407596294:icl,ehl (hsunit) +- */ +- wa_write_or(wal, UNSLICE_UNIT_LEVEL_CLKGATE, +- VSUNIT_CLKGATE_DIS | HSUNIT_CLKGATE_DIS); +- + /* + * Wa_1408767742:icl[a2..forever],ehl[all] + * Wa_1605460711:icl[a0..c0] +-- +2.35.3 + diff --git a/patches.suse/drm-mediatek-Clean-dangling-pointer-on-bind-error-pa.patch b/patches.suse/drm-mediatek-Clean-dangling-pointer-on-bind-error-pa.patch new file mode 100644 index 0000000..31cd005 --- /dev/null +++ b/patches.suse/drm-mediatek-Clean-dangling-pointer-on-bind-error-pa.patch @@ -0,0 +1,44 @@ +From 36aa8c61af55675ed967900fbe5deb32d776f051 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?N=C3=ADcolas=20F=2E=20R=2E=20A=2E=20Prado?= +Date: Tue, 22 Nov 2022 09:39:49 -0500 +Subject: [PATCH] drm/mediatek: Clean dangling pointer on bind error path +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 36aa8c61af55675ed967900fbe5deb32d776f051 +Patch-mainline: v6.3-rc1 +References: git-fixes + +mtk_drm_bind() can fail, in which case drm_dev_put() is called, +destroying the drm_device object. However a pointer to it was still +being held in the private object, and that pointer would be passed along +to DRM in mtk_drm_sys_prepare() if a suspend were triggered at that +point, resulting in a panic. Clean the pointer when destroying the +object in the error path to prevent this from happening. + +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Nícolas F. R. A. Prado +Reviewed-by: AngeloGioacchino Del Regno +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20221122143949.3493104-1-nfraprado@collabora.com/ +Signed-off-by: Chun-Kuang Hu +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +index 4d552c260c91..4eb696c54311 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +@@ -520,6 +520,7 @@ static int mtk_drm_bind(struct device *dev) + err_deinit: + mtk_drm_kms_deinit(drm); + err_free: ++ private->drm = NULL; + drm_dev_put(drm); + return ret; + } +-- +2.35.3 + diff --git a/patches.suse/drm-mediatek-Drop-unbalanced-obj-unref.patch b/patches.suse/drm-mediatek-Drop-unbalanced-obj-unref.patch new file mode 100644 index 0000000..05b0129 --- /dev/null +++ b/patches.suse/drm-mediatek-Drop-unbalanced-obj-unref.patch @@ -0,0 +1,37 @@ +From 4deef811828e87e26a978d5d6433b261d4713849 Mon Sep 17 00:00:00 2001 +From: Rob Clark +Date: Thu, 19 Jan 2023 15:12:55 -0800 +Subject: [PATCH] drm/mediatek: Drop unbalanced obj unref +Git-commit: 4deef811828e87e26a978d5d6433b261d4713849 +Patch-mainline: v6.3-rc1 +References: git-fixes + +In the error path, mtk_drm_gem_object_mmap() is dropping an obj +reference that it doesn't own. + +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Rob Clark +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20230119231255.2883365-1-robdclark@gmail.com/ +Signed-off-by: Chun-Kuang Hu +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/mediatek/mtk_drm_gem.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c +index 3057790d9264..ec0518aa9315 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c +@@ -169,8 +169,6 @@ static int mtk_drm_gem_object_mmap(struct drm_gem_object *obj, + + ret = dma_mmap_attrs(priv->dma_dev, vma, mtk_gem->cookie, + mtk_gem->dma_addr, obj->size, mtk_gem->dma_attrs); +- if (ret) +- drm_gem_vm_close(vma); + + return ret; + } +-- +2.35.3 + diff --git a/patches.suse/drm-mediatek-Use-NULL-instead-of-0-for-NULL-pointer.patch b/patches.suse/drm-mediatek-Use-NULL-instead-of-0-for-NULL-pointer.patch new file mode 100644 index 0000000..18c9ecc --- /dev/null +++ b/patches.suse/drm-mediatek-Use-NULL-instead-of-0-for-NULL-pointer.patch @@ -0,0 +1,37 @@ +From 4744cde06f57dd6fbaac468663b1fe2f653eaa16 Mon Sep 17 00:00:00 2001 +From: Miles Chen +Date: Wed, 11 Jan 2023 10:44:41 +0800 +Subject: [PATCH] drm/mediatek: Use NULL instead of 0 for NULL pointer +Git-commit: 4744cde06f57dd6fbaac468663b1fe2f653eaa16 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Use NULL for NULL pointer to fix the following sparse warning: +drivers/gpu/drm/mediatek/mtk_drm_gem.c:265:27: sparse: warning: Using plain integer as NULL pointer + +Fixes: 3df64d7b0a4f ("drm/mediatek: Implement gem prime vmap/vunmap function") +Signed-off-by: Miles Chen +Reviewed-by: AngeloGioacchino Del Regno +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20230111024443.24559-1-miles.chen@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/mediatek/mtk_drm_gem.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c +index 47e96b0289f9..06aadd5e7f5b 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c +@@ -262,6 +262,6 @@ void mtk_drm_gem_prime_vunmap(struct drm_gem_object *obj, + return; + + vunmap(vaddr); +- mtk_gem->kvaddr = 0; ++ mtk_gem->kvaddr = NULL; + kfree(mtk_gem->pages); + } +-- +2.35.3 + diff --git a/patches.suse/drm-mediatek-dsi-Reduce-the-time-of-dsi-from-LP11-to.patch b/patches.suse/drm-mediatek-dsi-Reduce-the-time-of-dsi-from-LP11-to.patch new file mode 100644 index 0000000..3d56611 --- /dev/null +++ b/patches.suse/drm-mediatek-dsi-Reduce-the-time-of-dsi-from-LP11-to.patch @@ -0,0 +1,51 @@ +From 91aeaed2c1147e3b1157dc084d23f190856a6c23 Mon Sep 17 00:00:00 2001 +From: Xinlei Lee +Date: Tue, 10 Jan 2023 13:54:51 +0800 +Subject: [PATCH] drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending cmd +Git-commit: 91aeaed2c1147e3b1157dc084d23f190856a6c23 +Patch-mainline: v6.3-rc1 +References: git-fixes + +According to Figure 16 Turnaround Procedure on page 36 in [1], you +can see the status of LP-00 -> LP10 -> LP11. This state can correspond +to the state of DSI from LP00 -> LP11 in mtk_dsi_lane_ready function +in mtk_dsi.c. + +LP-00 -> LP10 -> LP11 takes about 2*TLPX time (refer to [1] page 51 +to see that TLPX is 50ns) + +The delay at the end of the mtk_dsi_lane_ready function should be +greater than the 2*TLPX specified by the DSI spec, and less than +the time specified by the DSI_RX (generally 6ms to 40ms), to avoid +problems caused by the RX specification + +[1]:mipi_D-PHY_specification_v1-1 + +Fixes: 39e8d062b03c ("drm/mediatek: Keep dsi as LP00 before dcs cmds transfer") +Signed-off-by: Xinlei Lee +Acked-by: Sam Ravnborg +Reviewed-by: AngeloGioacchino Del Regno +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/1673330093-6771-2-git-send-email-xinlei.lee@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/mediatek/mtk_dsi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c +index 3b7d13028fb6..9e1363c9fcdb 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dsi.c ++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c +@@ -721,7 +721,7 @@ static void mtk_dsi_lane_ready(struct mtk_dsi *dsi) + mtk_dsi_clk_ulp_mode_leave(dsi); + mtk_dsi_lane0_ulp_mode_leave(dsi); + mtk_dsi_clk_hs_mode(dsi, 0); +- msleep(20); ++ usleep_range(1000, 3000); + /* The reaction time after pulling up the mipi signal for dsi_rx */ + } + } +-- +2.35.3 + diff --git a/patches.suse/drm-mediatek-mtk_drm_crtc-Add-checks-for-devm_kcallo.patch b/patches.suse/drm-mediatek-mtk_drm_crtc-Add-checks-for-devm_kcallo.patch new file mode 100644 index 0000000..a00864c --- /dev/null +++ b/patches.suse/drm-mediatek-mtk_drm_crtc-Add-checks-for-devm_kcallo.patch @@ -0,0 +1,38 @@ +From 5bf1e3bd7da625ccf9a22c8cb7d65271e6e47f4c Mon Sep 17 00:00:00 2001 +From: ruanjinjie +Date: Mon, 5 Dec 2022 17:51:15 +0800 +Subject: [PATCH] drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc +Git-commit: 5bf1e3bd7da625ccf9a22c8cb7d65271e6e47f4c +Patch-mainline: v6.3-rc1 +References: git-fixes + +As the devm_kcalloc may return NULL, the return value needs to be checked +to avoid NULL poineter dereference. + +Fixes: 31c5558dae05 ("drm/mediatek: Refactor plane init") +Signed-off-by: ruanjinjie +Reviewed-by: AngeloGioacchino Del Regno +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20221205095115.2905090-1-ruanjinjie@huawei.com/ +Signed-off-by: Chun-Kuang Hu +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +index 112615817dcb..5071f1263216 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +@@ -945,6 +945,8 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev, + + mtk_crtc->planes = devm_kcalloc(dev, num_comp_planes, + sizeof(struct drm_plane), GFP_KERNEL); ++ if (!mtk_crtc->planes) ++ return -ENOMEM; + + for (i = 0; i < mtk_crtc->ddp_comp_nr; i++) { + ret = mtk_drm_crtc_init_comp_planes(drm_dev, mtk_crtc, i, +-- +2.35.3 + diff --git a/patches.suse/drm-mipi-dsi-Fix-byte-order-of-16-bit-DCS-set-get-br.patch b/patches.suse/drm-mipi-dsi-Fix-byte-order-of-16-bit-DCS-set-get-br.patch new file mode 100644 index 0000000..7abb607 --- /dev/null +++ b/patches.suse/drm-mipi-dsi-Fix-byte-order-of-16-bit-DCS-set-get-br.patch @@ -0,0 +1,110 @@ +From c9d27c6be518b4ef2966d9564654ef99292ea1b3 Mon Sep 17 00:00:00 2001 +From: Daniel Mentz +Date: Mon, 16 Jan 2023 17:49:07 -0500 +Subject: [PATCH] drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness +Git-commit: c9d27c6be518b4ef2966d9564654ef99292ea1b3 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The MIPI DCS specification demands that brightness values are sent in +big endian byte order. It also states that one parameter (i.e. one byte) +shall be sent/received for 8 bit wide values, and two parameters shall +be used for values that are between 9 and 16 bits wide. + +Add new functions to properly handle 16-bit brightness in big endian, +since the two 8- and 16-bit cases are distinct from each other. + +[richard: use separate functions instead of switch/case] +[richard: split into 16-bit component] + +Fixes: 1a9d759331b8 ("drm/dsi: Implement DCS set/get display brightness") +Signed-off-by: Daniel Mentz +Link: https://android.googlesource.com/kernel/msm/+/754affd62d0ee268c686c53169b1dbb7deac8550 +[richard: fix 16-bit brightness_get] +Signed-off-by: Richard Acayan +Tested-by: Caleb Connolly +Reviewed-by: Neil Armstrong +Reviewed-by: Sam Ravnborg +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230116224909.23884-2-mailingradian@gmail.com +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/drm_mipi_dsi.c | 52 +++++++++++++++++++++++++++++++++++++++++ + include/drm/drm_mipi_dsi.h | 4 +++ + 2 files changed, 56 insertions(+) + +--- a/drivers/gpu/drm/drm_mipi_dsi.c ++++ b/drivers/gpu/drm/drm_mipi_dsi.c +@@ -1143,6 +1143,58 @@ int mipi_dsi_dcs_get_display_brightness( + } + EXPORT_SYMBOL(mipi_dsi_dcs_get_display_brightness); + ++/** ++ * mipi_dsi_dcs_set_display_brightness_large() - sets the 16-bit brightness value ++ * of the display ++ * @dsi: DSI peripheral device ++ * @brightness: brightness value ++ * ++ * Return: 0 on success or a negative error code on failure. ++ */ ++int mipi_dsi_dcs_set_display_brightness_large(struct mipi_dsi_device *dsi, ++ u16 brightness) ++{ ++ u8 payload[2] = { brightness >> 8, brightness & 0xff }; ++ ssize_t err; ++ ++ err = mipi_dsi_dcs_write(dsi, MIPI_DCS_SET_DISPLAY_BRIGHTNESS, ++ payload, sizeof(payload)); ++ if (err < 0) ++ return err; ++ ++ return 0; ++} ++EXPORT_SYMBOL(mipi_dsi_dcs_set_display_brightness_large); ++ ++/** ++ * mipi_dsi_dcs_get_display_brightness_large() - gets the current 16-bit ++ * brightness value of the display ++ * @dsi: DSI peripheral device ++ * @brightness: brightness value ++ * ++ * Return: 0 on success or a negative error code on failure. ++ */ ++int mipi_dsi_dcs_get_display_brightness_large(struct mipi_dsi_device *dsi, ++ u16 *brightness) ++{ ++ u8 brightness_be[2]; ++ ssize_t err; ++ ++ err = mipi_dsi_dcs_read(dsi, MIPI_DCS_GET_DISPLAY_BRIGHTNESS, ++ brightness_be, sizeof(brightness_be)); ++ if (err <= 0) { ++ if (err == 0) ++ err = -ENODATA; ++ ++ return err; ++ } ++ ++ *brightness = (brightness_be[0] << 8) | brightness_be[1]; ++ ++ return 0; ++} ++EXPORT_SYMBOL(mipi_dsi_dcs_get_display_brightness_large); ++ + static int mipi_dsi_drv_probe(struct device *dev) + { + struct mipi_dsi_driver *drv = to_mipi_dsi_driver(dev->driver); +--- a/include/drm/drm_mipi_dsi.h ++++ b/include/drm/drm_mipi_dsi.h +@@ -283,6 +283,10 @@ int mipi_dsi_dcs_set_display_brightness( + u16 brightness); + int mipi_dsi_dcs_get_display_brightness(struct mipi_dsi_device *dsi, + u16 *brightness); ++int mipi_dsi_dcs_set_display_brightness_large(struct mipi_dsi_device *dsi, ++ u16 brightness); ++int mipi_dsi_dcs_get_display_brightness_large(struct mipi_dsi_device *dsi, ++ u16 *brightness); + + /** + * struct mipi_dsi_driver - DSI driver diff --git a/patches.suse/drm-msm-adreno-Fix-null-ptr-access-in-adreno_gpu_cle.patch b/patches.suse/drm-msm-adreno-Fix-null-ptr-access-in-adreno_gpu_cle.patch new file mode 100644 index 0000000..3573b2e --- /dev/null +++ b/patches.suse/drm-msm-adreno-Fix-null-ptr-access-in-adreno_gpu_cle.patch @@ -0,0 +1,86 @@ +From dbeedbcb268d055d8895aceca427f897e12c2b50 Mon Sep 17 00:00:00 2001 +From: Akhil P Oommen +Date: Wed, 21 Dec 2022 20:39:56 +0530 +Subject: [PATCH] drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup() +Git-commit: dbeedbcb268d055d8895aceca427f897e12c2b50 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Fix the below kernel panic due to null pointer access: +[ 18.504431] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000048 +[ 18.513464] Mem abort info: +[ 18.516346] ESR = 0x0000000096000005 +[ 18.520204] EC = 0x25: DABT (current EL), IL = 32 bits +[ 18.525706] SET = 0, FnV = 0 +[ 18.528878] EA = 0, S1PTW = 0 +[ 18.532117] FSC = 0x05: level 1 translation fault +[ 18.537138] Data abort info: +[ 18.540110] ISV = 0, ISS = 0x00000005 +[ 18.544060] CM = 0, WnR = 0 +[ 18.547109] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000112826000 +[ 18.553738] [0000000000000048] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 +[ 18.562690] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP +**Snip** +[ 18.696758] Call trace: +[ 18.699278] adreno_gpu_cleanup+0x30/0x88 +[ 18.703396] a6xx_destroy+0xc0/0x130 +[ 18.707066] a6xx_gpu_init+0x308/0x424 +[ 18.710921] adreno_bind+0x178/0x288 +[ 18.714590] component_bind_all+0xe0/0x214 +[ 18.718797] msm_drm_bind+0x1d4/0x614 +[ 18.722566] try_to_bring_up_aggregate_device+0x16c/0x1b8 +[ 18.728105] __component_add+0xa0/0x158 +[ 18.732048] component_add+0x20/0x2c +[ 18.735719] adreno_probe+0x40/0xc0 +[ 18.739300] platform_probe+0xb4/0xd4 +[ 18.743068] really_probe+0xfc/0x284 +[ 18.746738] __driver_probe_device+0xc0/0xec +[ 18.751129] driver_probe_device+0x48/0x110 +[ 18.755421] __device_attach_driver+0xa8/0xd0 +[ 18.759900] bus_for_each_drv+0x90/0xdc +[ 18.763843] __device_attach+0xfc/0x174 +[ 18.767786] device_initial_probe+0x20/0x2c +[ 18.772090] bus_probe_device+0x40/0xa0 +[ 18.776032] deferred_probe_work_func+0x94/0xd0 +[ 18.780686] process_one_work+0x190/0x3d0 +[ 18.784805] worker_thread+0x280/0x3d4 +[ 18.788659] kthread+0x104/0x1c0 +[ 18.791981] ret_from_fork+0x10/0x20 +[ 18.795654] Code: f9400408 aa0003f3 aa1f03f4 91142015 (f9402516) +[ 18.801913] ---[ end trace 0000000000000000 ]--- +[ 18.809039] Kernel panic - not syncing: Oops: Fatal exception + +Fixes: 17e822f7591f ("drm/msm: fix unbalanced pm_runtime_enable in adreno_gpu_{init, cleanup}") +Signed-off-by: Akhil P Oommen +Patchwork: https://patchwork.freedesktop.org/patch/515605/ +Link: https://lore.kernel.org/r/20221221203925.v2.1.Ib978de92c4bd000b515486aad72e96c2481f84d0@changeid +Signed-off-by: Rob Clark +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/msm/adreno/adreno_gpu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +index 57586c794b84..3bc02dbed9a7 100644 +--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +@@ -1079,13 +1079,13 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev, + void adreno_gpu_cleanup(struct adreno_gpu *adreno_gpu) + { + struct msm_gpu *gpu = &adreno_gpu->base; +- struct msm_drm_private *priv = gpu->dev->dev_private; ++ struct msm_drm_private *priv = gpu->dev ? gpu->dev->dev_private : NULL; + unsigned int i; + + for (i = 0; i < ARRAY_SIZE(adreno_gpu->info->fw); i++) + release_firmware(adreno_gpu->fw[i]); + +- if (pm_runtime_enabled(&priv->gpu_pdev->dev)) ++ if (priv && pm_runtime_enabled(&priv->gpu_pdev->dev)) + pm_runtime_disable(&priv->gpu_pdev->dev); + + msm_gpu_cleanup(&adreno_gpu->base); +-- +2.35.3 + diff --git a/patches.suse/drm-msm-clean-event_thread-worker-in-case-of-an-erro.patch b/patches.suse/drm-msm-clean-event_thread-worker-in-case-of-an-erro.patch new file mode 100644 index 0000000..85fdf47 --- /dev/null +++ b/patches.suse/drm-msm-clean-event_thread-worker-in-case-of-an-erro.patch @@ -0,0 +1,39 @@ +From c79bb6b92defdcb834ceeeed9c1cf591beb1b71a Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Sat, 18 Jun 2022 02:33:25 +0300 +Subject: [PATCH] drm/msm: clean event_thread->worker in case of an error +Git-commit: c79bb6b92defdcb834ceeeed9c1cf591beb1b71a +Patch-mainline: v6.3-rc1 +References: git-fixes + +If worker creation fails, nullify the event_thread->worker, so that +msm_drm_uninit() doesn't try accessing invalid memory location. While we +are at it, remove duplicate assignment to the ret variable. + +Fixes: 1041dee2178f ("drm/msm: use kthread_create_worker instead of kthread_run") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/490106/ +Link: https://lore.kernel.org/r/20220617233328.1143665-2-dmitry.baryshkov@linaro.org +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/msm/msm_drv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c +index 5737364fbb54..0acba7481f45 100644 +--- a/drivers/gpu/drm/msm/msm_drv.c ++++ b/drivers/gpu/drm/msm/msm_drv.c +@@ -492,7 +492,7 @@ static int msm_drm_init(struct device *dev, const struct drm_driver *drv) + if (IS_ERR(priv->event_thread[i].worker)) { + ret = PTR_ERR(priv->event_thread[i].worker); + DRM_DEV_ERROR(dev, "failed to create crtc_event kthread\n"); +- ret = PTR_ERR(priv->event_thread[i].worker); ++ priv->event_thread[i].worker = NULL; + goto err_msm_uninit; + } + +-- +2.35.3 + diff --git a/patches.suse/drm-msm-dpu-Add-check-for-cstate.patch b/patches.suse/drm-msm-dpu-Add-check-for-cstate.patch new file mode 100644 index 0000000..a30157f --- /dev/null +++ b/patches.suse/drm-msm-dpu-Add-check-for-cstate.patch @@ -0,0 +1,45 @@ +From c96988b7d99327bb08bd9efd29a203b22cd88ace Mon Sep 17 00:00:00 2001 +From: Jiasheng Jiang +Date: Tue, 6 Dec 2022 16:05:17 +0800 +Subject: [PATCH] drm/msm/dpu: Add check for cstate +Git-commit: c96988b7d99327bb08bd9efd29a203b22cd88ace +Patch-mainline: v6.3-rc1 +References: git-fixes + +As kzalloc may fail and return NULL pointer, +it should be better to check cstate +in order to avoid the NULL pointer dereference +in __drm_atomic_helper_crtc_reset. + +Fixes: 1cff7440a86e ("drm/msm: Convert to using __drm_atomic_helper_crtc_reset() for reset.") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Abhinav Kumar +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/514163/ +Link: https://lore.kernel.org/r/20221206080517.43786-1-jiasheng@iscas.ac.cn +Signed-off-by: Dmitry Baryshkov +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +index 41819039dd5e..175d2557e43c 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +@@ -968,7 +968,10 @@ static void dpu_crtc_reset(struct drm_crtc *crtc) + if (crtc->state) + dpu_crtc_destroy_state(crtc, crtc->state); + +- __drm_atomic_helper_crtc_reset(crtc, &cstate->base); ++ if (cstate) ++ __drm_atomic_helper_crtc_reset(crtc, &cstate->base); ++ else ++ __drm_atomic_helper_crtc_reset(crtc, NULL); + } + + /** +-- +2.35.3 + diff --git a/patches.suse/drm-msm-dpu-Add-check-for-pstates.patch b/patches.suse/drm-msm-dpu-Add-check-for-pstates.patch new file mode 100644 index 0000000..026d068 --- /dev/null +++ b/patches.suse/drm-msm-dpu-Add-check-for-pstates.patch @@ -0,0 +1,40 @@ +From 93340e10b9c5fc86730d149636e0aa8b47bb5a34 Mon Sep 17 00:00:00 2001 +From: Jiasheng Jiang +Date: Tue, 6 Dec 2022 16:02:36 +0800 +Subject: [PATCH] drm/msm/dpu: Add check for pstates +Git-commit: 93340e10b9c5fc86730d149636e0aa8b47bb5a34 +Patch-mainline: v6.3-rc1 +References: git-fixes + +As kzalloc may fail and return NULL pointer, +it should be better to check pstates +in order to avoid the NULL pointer dereference. + +Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/514160/ +Link: https://lore.kernel.org/r/20221206080236.43687-1-jiasheng@iscas.ac.cn +Signed-off-by: Dmitry Baryshkov +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +index 175d2557e43c..f29a339a3705 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +@@ -1153,6 +1153,8 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc, + bool needs_dirtyfb = dpu_crtc_needs_dirtyfb(crtc_state); + + pstates = kzalloc(sizeof(*pstates) * DPU_STAGE_MAX * 4, GFP_KERNEL); ++ if (!pstates) ++ return -ENOMEM; + + if (!crtc_state->enable || !crtc_state->active) { + DRM_DEBUG_ATOMIC("crtc%d -> enable %d, active %d, skip atomic_check\n", +-- +2.35.3 + diff --git a/patches.suse/drm-msm-dpu-Disallow-unallocated-resources-to-be-ret.patch b/patches.suse/drm-msm-dpu-Disallow-unallocated-resources-to-be-ret.patch new file mode 100644 index 0000000..e3ad0fa --- /dev/null +++ b/patches.suse/drm-msm-dpu-Disallow-unallocated-resources-to-be-ret.patch @@ -0,0 +1,57 @@ +From abc40122d9a69f56c04efb5a7485795f5ac799d1 Mon Sep 17 00:00:00 2001 +From: Marijn Suijten +Date: Tue, 10 Jan 2023 00:15:55 +0100 +Subject: [PATCH] drm/msm/dpu: Disallow unallocated resources to be returned +Git-commit: abc40122d9a69f56c04efb5a7485795f5ac799d1 +Patch-mainline: v6.3-rc1 +References: git-fixes + +In the event that the topology requests resources that have not been +created by the system (because they are typically not represented in +dpu_mdss_cfg ^1), the resource(s) in global_state (in this case DSC +blocks, until their allocation/assignment is being sanity-checked in +"drm/msm/dpu: Reject topologies for which no DSC blocks are available") +remain NULL but will still be returned out of +dpu_rm_get_assigned_resources, where the caller expects to get an array +containing num_blks valid pointers (but instead gets these NULLs). + +To prevent this from happening, where null-pointer dereferences +typically result in a hard-to-debug platform lockup, num_blks shouldn't +increase past NULL blocks and will print an error and break instead. +After all, max_blks represents the static size of the maximum number of +blocks whereas the actual amount varies per platform. + +^1: which can happen after a git rebase ended up moving additions to +_dpu_cfg to a different struct which has the same patch context. + +Fixes: bb00a452d6f7 ("drm/msm/dpu: Refactor resource manager") +Signed-off-by: Marijn Suijten +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/517636/ +Link: https://lore.kernel.org/r/20230109231556.344977-1-marijn.suijten@somainline.org +Signed-off-by: Dmitry Baryshkov +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c +index b6090a837779..396429e63756 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c +@@ -665,6 +665,11 @@ int dpu_rm_get_assigned_resources(struct dpu_rm *rm, + blks_size, enc_id); + break; + } ++ if (!hw_blks[i]) { ++ DPU_ERROR("Allocated resource %d unavailable to assign to enc %d\n", ++ type, enc_id); ++ break; ++ } + blks[num_blks++] = hw_blks[i]; + } + +-- +2.35.3 + diff --git a/patches.suse/drm-msm-dpu-drop-stale-comment-from-struct-dpu_mdp_c.patch b/patches.suse/drm-msm-dpu-drop-stale-comment-from-struct-dpu_mdp_c.patch new file mode 100644 index 0000000..618fb66 --- /dev/null +++ b/patches.suse/drm-msm-dpu-drop-stale-comment-from-struct-dpu_mdp_c.patch @@ -0,0 +1,37 @@ +From daa9a2ec3e079ff6bc9b1463dac3cf2c80648c95 Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Sat, 21 Jan 2023 15:54:57 +0200 +Subject: [PATCH] drm/msm/dpu: drop stale comment from struct dpu_mdp_cfg doc +Git-commit: daa9a2ec3e079ff6bc9b1463dac3cf2c80648c95 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The field ubwc_static was removed from struct dpu_mdp_cfg some time ago. +Drop the corresponding kerneldoc now. + +Fixes: 544d8b96150d ("drm/msm/dpu: update UBWC config for sm8150 and sm8250") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/519554/ +Link: https://lore.kernel.org/r/20230121135457.2788199-1-dmitry.baryshkov@linaro.org +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h +index 978e3bd145f0..ddab9caebb18 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h +@@ -537,7 +537,6 @@ struct dpu_clk_ctrl_reg { + * @base: register base offset to mdss + * @features bit mask identifying sub-blocks/features + * @highest_bank_bit: UBWC parameter +- * @ubwc_static: ubwc static configuration + * @ubwc_swizzle: ubwc default swizzle setting + * @clk_ctrls clock control register definition + */ +-- +2.35.3 + diff --git a/patches.suse/drm-msm-dpu-set-pdpu-is_rt_pipe-early-in-dpu_plane_s.patch b/patches.suse/drm-msm-dpu-set-pdpu-is_rt_pipe-early-in-dpu_plane_s.patch new file mode 100644 index 0000000..94f7347 --- /dev/null +++ b/patches.suse/drm-msm-dpu-set-pdpu-is_rt_pipe-early-in-dpu_plane_s.patch @@ -0,0 +1,64 @@ +From 1d233b1cb149ec78c20fac58331b27bb460f9558 Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Thu, 29 Dec 2022 21:18:30 +0200 +Subject: [PATCH] drm/msm/dpu: set pdpu->is_rt_pipe early in dpu_plane_sspp_atomic_update() +Git-commit: 1d233b1cb149ec78c20fac58331b27bb460f9558 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The function dpu_plane_sspp_atomic_update() updates pdpu->is_rt_pipe +flag, but after the commit 854f6f1c653b ("drm/msm/dpu: update the qos +remap only if the client type changes") it sets the flag late, after all +the qos functions have updated QoS programming. Move the flag update +back to the place where it happened before the mentioned commit to let +the pipe be programmed according to its current RT/non-RT state. + +Fixes: 854f6f1c653b ("drm/msm/dpu: update the qos remap only if the client type changes") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/516239/ +Link: https://lore.kernel.org/r/20221229191856.3508092-2-dmitry.baryshkov@linaro.org +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +@@ -1089,7 +1089,7 @@ static void dpu_plane_sspp_atomic_update + struct dpu_plane_state *pstate = to_dpu_plane_state(state); + struct drm_crtc *crtc = state->crtc; + struct drm_framebuffer *fb = state->fb; +- bool is_rt_pipe, update_qos_remap; ++ bool is_rt_pipe; + const struct dpu_format *fmt = + to_dpu_format(msm_framebuffer_format(fb)); + +@@ -1100,6 +1100,9 @@ static void dpu_plane_sspp_atomic_update + pstate->pending = true; + + is_rt_pipe = (dpu_crtc_get_client_type(crtc) != NRT_CLIENT); ++ pstate->needs_qos_remap |= (is_rt_pipe != pdpu->is_rt_pipe); ++ pdpu->is_rt_pipe = is_rt_pipe; ++ + _dpu_plane_set_qos_ctrl(plane, false, DPU_PLANE_QOS_PANIC_CTRL); + + DPU_DEBUG_PLANE(pdpu, "FB[%u] " DRM_RECT_FP_FMT "->crtc%u " DRM_RECT_FMT +@@ -1205,14 +1208,8 @@ static void dpu_plane_sspp_atomic_update + _dpu_plane_set_ot_limit(plane, crtc); + } + +- update_qos_remap = (is_rt_pipe != pdpu->is_rt_pipe) || +- pstate->needs_qos_remap; +- +- if (update_qos_remap) { +- if (is_rt_pipe != pdpu->is_rt_pipe) +- pdpu->is_rt_pipe = is_rt_pipe; +- else if (pstate->needs_qos_remap) +- pstate->needs_qos_remap = false; ++ if (pstate->needs_qos_remap) { ++ pstate->needs_qos_remap = false; + _dpu_plane_set_qos_remap(plane); + } + diff --git a/patches.suse/drm-msm-gem-Add-check-for-kmalloc.patch b/patches.suse/drm-msm-gem-Add-check-for-kmalloc.patch new file mode 100644 index 0000000..a83b38d --- /dev/null +++ b/patches.suse/drm-msm-gem-Add-check-for-kmalloc.patch @@ -0,0 +1,41 @@ +From d839f0811a31322c087a859c2b181e2383daa7be Mon Sep 17 00:00:00 2001 +From: Jiasheng Jiang +Date: Mon, 12 Dec 2022 17:11:17 +0800 +Subject: [PATCH] drm/msm/gem: Add check for kmalloc +Git-commit: d839f0811a31322c087a859c2b181e2383daa7be +Patch-mainline: v6.3-rc1 +References: git-fixes + +Add the check for the return value of kmalloc in order to avoid +NULL pointer dereference in copy_from_user. + +Fixes: 20224d715a88 ("drm/msm/submit: Move copy_from_user ahead of locking bos") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/514678/ +Link: https://lore.kernel.org/r/20221212091117.43511-1-jiasheng@iscas.ac.cn +Signed-off-by: Dmitry Baryshkov +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/msm/msm_gem_submit.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c +index 45a3e5cadc7d..7c2cc1262c05 100644 +--- a/drivers/gpu/drm/msm/msm_gem_submit.c ++++ b/drivers/gpu/drm/msm/msm_gem_submit.c +@@ -209,6 +209,10 @@ static int submit_lookup_cmds(struct msm_gem_submit *submit, + goto out; + } + submit->cmd[i].relocs = kmalloc(sz, GFP_KERNEL); ++ if (!submit->cmd[i].relocs) { ++ ret = -ENOMEM; ++ goto out; ++ } + ret = copy_from_user(submit->cmd[i].relocs, userptr, sz); + if (ret) { + ret = -EFAULT; +-- +2.35.3 + diff --git a/patches.suse/drm-msm-hdmi-Add-missing-check-for-alloc_ordered_wor.patch b/patches.suse/drm-msm-hdmi-Add-missing-check-for-alloc_ordered_wor.patch new file mode 100644 index 0000000..f365406 --- /dev/null +++ b/patches.suse/drm-msm-hdmi-Add-missing-check-for-alloc_ordered_wor.patch @@ -0,0 +1,37 @@ +From afe4cb96153a0d8003e4e4ebd91b5c543e10df84 Mon Sep 17 00:00:00 2001 +From: Jiasheng Jiang +Date: Fri, 6 Jan 2023 10:30:11 +0800 +Subject: [PATCH] drm/msm/hdmi: Add missing check for alloc_ordered_workqueue +Git-commit: afe4cb96153a0d8003e4e4ebd91b5c543e10df84 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Add check for the return value of alloc_ordered_workqueue as it may return +NULL pointer and cause NULL pointer dereference in `hdmi_hdcp.c` and +`hdmi_hpd.c`. + +Fixes: c6a57a50ad56 ("drm/msm/hdmi: add hdmi hdcp support (V3)") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/517211/ +Link: https://lore.kernel.org/r/20230106023011.3985-1-jiasheng@iscas.ac.cn +Signed-off-by: Dmitry Baryshkov +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/msm/hdmi/hdmi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/gpu/drm/msm/hdmi/hdmi.c ++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c +@@ -248,6 +248,10 @@ static struct hdmi *msm_hdmi_init(struct + pm_runtime_enable(&pdev->dev); + + hdmi->workq = alloc_ordered_workqueue("msm_hdmi", 0); ++ if (!hdmi->workq) { ++ ret = -ENOMEM; ++ goto fail; ++ } + + hdmi->i2c = msm_hdmi_i2c_init(hdmi); + if (IS_ERR(hdmi->i2c)) { diff --git a/patches.suse/drm-msm-mdp5-Add-check-for-kzalloc.patch b/patches.suse/drm-msm-mdp5-Add-check-for-kzalloc.patch new file mode 100644 index 0000000..29a5454 --- /dev/null +++ b/patches.suse/drm-msm-mdp5-Add-check-for-kzalloc.patch @@ -0,0 +1,43 @@ +From 13fcfcb2a9a4787fe4e49841d728f6f2e9fa6911 Mon Sep 17 00:00:00 2001 +From: Jiasheng Jiang +Date: Tue, 6 Dec 2022 15:48:19 +0800 +Subject: [PATCH] drm/msm/mdp5: Add check for kzalloc +Git-commit: 13fcfcb2a9a4787fe4e49841d728f6f2e9fa6911 +Patch-mainline: v6.3-rc1 +References: git-fixes + +As kzalloc may fail and return NULL pointer, +it should be better to check the return value +in order to avoid the NULL pointer dereference. + +Fixes: 1cff7440a86e ("drm/msm: Convert to using __drm_atomic_helper_crtc_reset() for reset.") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/514154/ +Link: https://lore.kernel.org/r/20221206074819.18134-1-jiasheng@iscas.ac.cn +Signed-off-by: Dmitry Baryshkov +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c +index e86421c69bd1..86036dd4e1e8 100644 +--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c ++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c +@@ -1139,7 +1139,10 @@ static void mdp5_crtc_reset(struct drm_crtc *crtc) + if (crtc->state) + mdp5_crtc_destroy_state(crtc, crtc->state); + +- __drm_atomic_helper_crtc_reset(crtc, &mdp5_cstate->base); ++ if (mdp5_cstate) ++ __drm_atomic_helper_crtc_reset(crtc, &mdp5_cstate->base); ++ else ++ __drm_atomic_helper_crtc_reset(crtc, NULL); + } + + static const struct drm_crtc_funcs mdp5_crtc_no_lm_cursor_funcs = { +-- +2.35.3 + diff --git a/patches.suse/drm-msm-use-strscpy-instead-of-strncpy.patch b/patches.suse/drm-msm-use-strscpy-instead-of-strncpy.patch new file mode 100644 index 0000000..cd4a460 --- /dev/null +++ b/patches.suse/drm-msm-use-strscpy-instead-of-strncpy.patch @@ -0,0 +1,41 @@ +From d7fd8634f48d76aa799ed57beb7d87dab91bde80 Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Wed, 18 Jan 2023 04:01:52 +0200 +Subject: [PATCH] drm/msm: use strscpy instead of strncpy +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: d7fd8634f48d76aa799ed57beb7d87dab91bde80 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Using strncpy can result in non-NULL-terminated destination string. Use +strscpy instead. This fixes following warning: + +Drivers/gpu/drm/msm/msm_fence.c: In function ‘msm_fence_context_alloc’: +drivers/gpu/drm/msm/msm_fence.c:25:9: warning: ‘strncpy’ specified bound 32 equals destination size [-Wstringop-truncation] + 25 | strncpy(fctx->name, name, sizeof(fctx->name)); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Fixes: f97decac5f4c ("drm/msm: Support multiple ringbuffers") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/518787/ +Link: https://lore.kernel.org/r/20230118020152.1689213-1-dmitry.baryshkov@linaro.org +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/msm/msm_fence.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/msm/msm_fence.c ++++ b/drivers/gpu/drm/msm/msm_fence.c +@@ -20,7 +20,7 @@ msm_fence_context_alloc(struct drm_devic + return ERR_PTR(-ENOMEM); + + fctx->dev = dev; +- strncpy(fctx->name, name, sizeof(fctx->name)); ++ strscpy(fctx->name, name, sizeof(fctx->name)); + fctx->context = dma_fence_context_alloc(1); + init_waitqueue_head(&fctx->event); + spin_lock_init(&fctx->spinlock); diff --git a/patches.suse/drm-mxsfb-DRM_MXSFB-should-depend-on-ARCH_MXS-ARCH_M.patch b/patches.suse/drm-mxsfb-DRM_MXSFB-should-depend-on-ARCH_MXS-ARCH_M.patch new file mode 100644 index 0000000..fbb7425 --- /dev/null +++ b/patches.suse/drm-mxsfb-DRM_MXSFB-should-depend-on-ARCH_MXS-ARCH_M.patch @@ -0,0 +1,34 @@ +From 7783cc67862f9166c901bfa0f80b717aa8d354dd Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Mon, 21 Nov 2022 16:59:55 +0100 +Subject: [PATCH] drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC +Git-commit: 7783cc67862f9166c901bfa0f80b717aa8d354dd +Patch-mainline: v6.3-rc1 +References: git-fixes + +Freescale/NXP i.MX LCDIF and eLCDIF LCD controllers are only present on +Freescale/NXP i.MX SoCs. Hence add a dependency on ARCH_MXS || +ARCH_MXC, to prevent asking the user about this driver when configuring +a kernel without Freescale/NXP i.MX support. + +Fixes: 45d59d704080cc0c ("drm: Add new driver for MXSFB controller") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Marek Vasut +Signed-off-by: Marek Vasut +Link: https://patchwork.freedesktop.org/patch/msgid/98e74779ca2bc575d91afff03369e86b080c01ac.1669046358.git.geert+renesas@glider.be +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/mxsfb/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/mxsfb/Kconfig ++++ b/drivers/gpu/drm/mxsfb/Kconfig +@@ -8,6 +8,7 @@ config DRM_MXSFB + tristate "i.MX (e)LCDIF LCD controller" + depends on DRM && OF + depends on COMMON_CLK ++ depends on ARCH_MXS || ARCH_MXC || COMPILE_TEST + select DRM_MXS + select DRM_KMS_HELPER + select DRM_KMS_CMA_HELPER diff --git a/patches.suse/drm-nouveau-devinit-tu102-wait-for-GFW_BOOT_PROGRESS.patch b/patches.suse/drm-nouveau-devinit-tu102-wait-for-GFW_BOOT_PROGRESS.patch new file mode 100644 index 0000000..f9fcbb3 --- /dev/null +++ b/patches.suse/drm-nouveau-devinit-tu102-wait-for-GFW_BOOT_PROGRESS.patch @@ -0,0 +1,69 @@ +From d22915d22ded21fd5b24b60d174775789f173997 Mon Sep 17 00:00:00 2001 +From: Ben Skeggs +Date: Tue, 31 Jan 2023 08:37:13 +1000 +Subject: [PATCH] drm/nouveau/devinit/tu102-: wait for GFW_BOOT_PROGRESS == COMPLETED +Git-commit: d22915d22ded21fd5b24b60d174775789f173997 +Patch-mainline: v6.2-rc7 +References: git-fixes + +Starting from Turing, the driver is no longer responsible for initiating +DEVINIT when required as the GPU started loading a FW image from ROM and +executing DEVINIT itself after power-on. + +However - we apparently still need to wait for it to complete. + +This should correct some issues with runpm on some systems, where we get +control of the HW before it's been fully reinitialised after resume from +suspend. + +Signed-off-by: Ben Skeggs +Reviewed-by: Lyude Paul +Signed-off-by: Lyude Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20230130223715.1831509-1-bskeggs@redhat.com +Acked-by: Takashi Iwai + +--- + .../drm/nouveau/nvkm/subdev/devinit/tu102.c | 23 +++++++++++++++++++ + 1 file changed, 23 insertions(+) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/tu102.c b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/tu102.c +index 634f64f88fc8..81a1ad2c88a7 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/tu102.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/tu102.c +@@ -65,10 +65,33 @@ tu102_devinit_pll_set(struct nvkm_devinit *init, u32 type, u32 freq) + return ret; + } + ++static int ++tu102_devinit_wait(struct nvkm_device *device) ++{ ++ unsigned timeout = 50 + 2000; ++ ++ do { ++ if (nvkm_rd32(device, 0x118128) & 0x00000001) { ++ if ((nvkm_rd32(device, 0x118234) & 0x000000ff) == 0xff) ++ return 0; ++ } ++ ++ usleep_range(1000, 2000); ++ } while (timeout--); ++ ++ return -ETIMEDOUT; ++} ++ + int + tu102_devinit_post(struct nvkm_devinit *base, bool post) + { + struct nv50_devinit *init = nv50_devinit(base); ++ int ret; ++ ++ ret = tu102_devinit_wait(init->base.subdev.device); ++ if (ret) ++ return ret; ++ + gm200_devinit_preos(init, post); + return 0; + } +-- +2.35.3 + diff --git a/patches.suse/drm-omapdrm-Remove-unused-struct-csc_coef_rgb2yuv.patch b/patches.suse/drm-omapdrm-Remove-unused-struct-csc_coef_rgb2yuv.patch new file mode 100644 index 0000000..5d96594 --- /dev/null +++ b/patches.suse/drm-omapdrm-Remove-unused-struct-csc_coef_rgb2yuv.patch @@ -0,0 +1,41 @@ +From 88652d8a2c7c52e209b3385d63dfc82e2d80c848 Mon Sep 17 00:00:00 2001 +From: Yuan Can +Date: Fri, 14 Oct 2022 02:48:10 +0000 +Subject: [PATCH] drm/omapdrm: Remove unused struct csc_coef_rgb2yuv +Git-commit: 88652d8a2c7c52e209b3385d63dfc82e2d80c848 +Patch-mainline: v6.3-rc1 +References: git-fixes + +After commit 64ff18911878, struct csc_coef_rgb2yuv is not used any more +and can be removed as well. + +Fixes: 64ff18911878 ("drm/omap: Enable COLOR_ENCODING and COLOR_RANGE properties for planes") +Signed-off-by: Yuan Can +Reviewed-by: Laurent Pinchart +Signed-off-by: Tomi Valkeinen +Link: https://patchwork.freedesktop.org/patch/msgid/20221014024810.21675-1-yuancan@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/omapdrm/dss/dispc.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/gpu/drm/omapdrm/dss/dispc.c b/drivers/gpu/drm/omapdrm/dss/dispc.c +index 0ee344ebcd1c..aacad5045e95 100644 +--- a/drivers/gpu/drm/omapdrm/dss/dispc.c ++++ b/drivers/gpu/drm/omapdrm/dss/dispc.c +@@ -855,11 +855,6 @@ struct csc_coef_yuv2rgb { + bool full_range; + }; + +-struct csc_coef_rgb2yuv { +- int yr, yg, yb, cbr, cbg, cbb, crr, crg, crb; +- bool full_range; +-}; +- + static void dispc_ovl_write_color_conv_coef(struct dispc_device *dispc, + enum omap_plane_id plane, + const struct csc_coef_yuv2rgb *ct) +-- +2.35.3 + diff --git a/patches.suse/drm-tidss-Fix-pixel-format-definition.patch b/patches.suse/drm-tidss-Fix-pixel-format-definition.patch new file mode 100644 index 0000000..a98527d --- /dev/null +++ b/patches.suse/drm-tidss-Fix-pixel-format-definition.patch @@ -0,0 +1,45 @@ +From 2df0433b18f2735a49d2c3a968b40fa2881137c0 Mon Sep 17 00:00:00 2001 +From: Randolph Sapp +Date: Thu, 1 Dec 2022 18:18:03 -0600 +Subject: [PATCH] drm: tidss: Fix pixel format definition +Git-commit: 2df0433b18f2735a49d2c3a968b40fa2881137c0 +Patch-mainline: v6.3-rc1 +References: git-fixes + +There was a long-standing bug from a typo that created 2 ARGB1555 and +ABGR1555 pixel format entries. Weston 10 has a sanity check that alerted +me to this issue. + +According to the Supported Pixel Data formats table we have the later +entries should have been for Alpha-X instead. + +Signed-off-by: Randolph Sapp +Fixes: 32a1795f57eecc ("drm/tidss: New driver for TI Keystone platform Display SubSystem") +Reviewed-by: Aradhya Bhatia +Acked-by: Andrew Davis +Signed-off-by: Tomi Valkeinen +Link: https://patchwork.freedesktop.org/patch/msgid/20221202001803.1765805-1-rs@ti.com +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/tidss/tidss_dispc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c +index 7a08feb9c2f0..165365b515e1 100644 +--- a/drivers/gpu/drm/tidss/tidss_dispc.c ++++ b/drivers/gpu/drm/tidss/tidss_dispc.c +@@ -1858,8 +1858,8 @@ static const struct { + { DRM_FORMAT_XBGR4444, 0x21, }, + { DRM_FORMAT_RGBX4444, 0x22, }, + +- { DRM_FORMAT_ARGB1555, 0x25, }, +- { DRM_FORMAT_ABGR1555, 0x26, }, ++ { DRM_FORMAT_XRGB1555, 0x25, }, ++ { DRM_FORMAT_XBGR1555, 0x26, }, + + { DRM_FORMAT_XRGB8888, 0x27, }, + { DRM_FORMAT_XBGR8888, 0x28, }, +-- +2.35.3 + diff --git a/patches.suse/drm-vc4-hdmi-Correct-interlaced-timings-again.patch b/patches.suse/drm-vc4-hdmi-Correct-interlaced-timings-again.patch new file mode 100644 index 0000000..2273d17 --- /dev/null +++ b/patches.suse/drm-vc4-hdmi-Correct-interlaced-timings-again.patch @@ -0,0 +1,39 @@ +From 771d6539f27bd55f43d8a95d53a7eeaaffa2681c Mon Sep 17 00:00:00 2001 +From: Dave Stevenson +Date: Wed, 7 Dec 2022 12:53:25 +0100 +Subject: [PATCH] drm/vc4: hdmi: Correct interlaced timings again +Git-commit: 771d6539f27bd55f43d8a95d53a7eeaaffa2681c +Patch-mainline: v6.3-rc1 +References: git-fixes + +The back porch timings were correct, only the sync offset was wrong. +Correct timing is now reported for 1080i and 576i, but the h offset is +incorrect for 480i for non-obvious reasons. + +Fixes: fb10dc451c0f ("drm/vc4: hdmi: Correct HDMI timing registers for interlaced modes") +Signed-off-by: Dave Stevenson +Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-14-1f8e0770798b@cerno.tech +Signed-off-by: Maxime Ripard +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/vc4/vc4_hdmi.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/vc4/vc4_hdmi.c ++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c +@@ -789,11 +789,12 @@ static void vc5_hdmi_set_timings(struct + VC4_SET_FIELD(mode->crtc_vdisplay, VC5_HDMI_VERTA_VAL)); + u32 vertb = (VC4_SET_FIELD(mode->htotal >> (2 - pixel_rep), + VC5_HDMI_VERTB_VSPO) | +- VC4_SET_FIELD(mode->crtc_vtotal - mode->crtc_vsync_end, ++ VC4_SET_FIELD(mode->crtc_vtotal - mode->crtc_vsync_end + ++ interlaced, + VC4_HDMI_VERTB_VBP)); + u32 vertb_even = (VC4_SET_FIELD(0, VC5_HDMI_VERTB_VSPO) | + VC4_SET_FIELD(mode->crtc_vtotal - +- mode->crtc_vsync_end - interlaced, ++ mode->crtc_vsync_end, + VC4_HDMI_VERTB_VBP)); + unsigned char gcp; + bool gcp_en; diff --git a/patches.suse/drm-vc4-hvs-Fix-colour-order-for-xRGB1555-on-HVS5.patch b/patches.suse/drm-vc4-hvs-Fix-colour-order-for-xRGB1555-on-HVS5.patch new file mode 100644 index 0000000..689ada5 --- /dev/null +++ b/patches.suse/drm-vc4-hvs-Fix-colour-order-for-xRGB1555-on-HVS5.patch @@ -0,0 +1,43 @@ +From 902973dc1a049c0d7bf0c222b8f2b3876f01b4a2 Mon Sep 17 00:00:00 2001 +From: Dave Stevenson +Date: Wed, 7 Dec 2022 12:53:17 +0100 +Subject: [PATCH] drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5 +Git-commit: 902973dc1a049c0d7bf0c222b8f2b3876f01b4a2 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Same as the xRGB8888 formats, HVS5 has managed to swap the colour +channels for the xRGB1555 formats as well. Add the relevant +config for pixel_order_hvs5. + +Fixes: c54619b0bfb3 ("drm/vc4: Add support for the BCM2711 HVS5") +Signed-off-by: Dave Stevenson +Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-6-1f8e0770798b@cerno.tech +Signed-off-by: Maxime Ripard +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/vc4/vc4_plane.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c +index c212f8c10388..e60d6f1a7de1 100644 +--- a/drivers/gpu/drm/vc4/vc4_plane.c ++++ b/drivers/gpu/drm/vc4/vc4_plane.c +@@ -75,11 +75,13 @@ static const struct hvs_format { + .drm = DRM_FORMAT_ARGB1555, + .hvs = HVS_PIXEL_FORMAT_RGBA5551, + .pixel_order = HVS_PIXEL_ORDER_ABGR, ++ .pixel_order_hvs5 = HVS_PIXEL_ORDER_ARGB, + }, + { + .drm = DRM_FORMAT_XRGB1555, + .hvs = HVS_PIXEL_FORMAT_RGBA5551, + .pixel_order = HVS_PIXEL_ORDER_ABGR, ++ .pixel_order_hvs5 = HVS_PIXEL_ORDER_ARGB, + }, + { + .drm = DRM_FORMAT_RGB888, +-- +2.35.3 + diff --git a/patches.suse/drm-vc4-hvs-Set-AXI-panic-modes.patch b/patches.suse/drm-vc4-hvs-Set-AXI-panic-modes.patch new file mode 100644 index 0000000..0455543 --- /dev/null +++ b/patches.suse/drm-vc4-hvs-Set-AXI-panic-modes.patch @@ -0,0 +1,63 @@ +From df993fced230daa8452892406f3180c93ebf7e7b Mon Sep 17 00:00:00 2001 +From: Dave Stevenson +Date: Wed, 7 Dec 2022 12:53:13 +0100 +Subject: [PATCH] drm/vc4: hvs: Set AXI panic modes +Git-commit: df993fced230daa8452892406f3180c93ebf7e7b +Patch-mainline: v6.3-rc1 +References: git-fixes + +The HVS can change AXI request mode based on how full the COB +FIFOs are. +Until now the vc4 driver has been relying on the firmware to +have set these to sensible values. + +With HVS channel 2 now being used for live video, change the +panic mode for all channels to be explicitly set by the driver, +and the same for all channels. + +Fixes: c54619b0bfb3 ("drm/vc4: Add support for the BCM2711 HVS5") +Signed-off-by: Dave Stevenson +Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-2-1f8e0770798b@cerno.tech +Signed-off-by: Maxime Ripard +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/vc4/vc4_hvs.c | 11 +++++++++++ + drivers/gpu/drm/vc4/vc4_regs.h | 6 ++++++ + 2 files changed, 17 insertions(+) + +--- a/drivers/gpu/drm/vc4/vc4_hvs.c ++++ b/drivers/gpu/drm/vc4/vc4_hvs.c +@@ -702,6 +702,17 @@ static int vc4_hvs_bind(struct device *d + SCALER_DISPCTRL_SCLEIRQ); + dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_DSP3_MUX); + ++ /* Set AXI panic mode. ++ * VC4 panics when < 2 lines in FIFO. ++ * VC5 panics when less than 1 line in the FIFO. ++ */ ++ dispctrl &= ~(SCALER_DISPCTRL_PANIC0_MASK | ++ SCALER_DISPCTRL_PANIC1_MASK | ++ SCALER_DISPCTRL_PANIC2_MASK); ++ dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC0); ++ dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC1); ++ dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC2); ++ + HVS_WRITE(SCALER_DISPCTRL, dispctrl); + + ret = devm_request_irq(dev, platform_get_irq(pdev, 0), +--- a/drivers/gpu/drm/vc4/vc4_regs.h ++++ b/drivers/gpu/drm/vc4/vc4_regs.h +@@ -220,6 +220,12 @@ + #define SCALER_DISPCTRL 0x00000000 + /* Global register for clock gating the HVS */ + # define SCALER_DISPCTRL_ENABLE BIT(31) ++# define SCALER_DISPCTRL_PANIC0_MASK VC4_MASK(25, 24) ++# define SCALER_DISPCTRL_PANIC0_SHIFT 24 ++# define SCALER_DISPCTRL_PANIC1_MASK VC4_MASK(27, 26) ++# define SCALER_DISPCTRL_PANIC1_SHIFT 26 ++# define SCALER_DISPCTRL_PANIC2_MASK VC4_MASK(29, 28) ++# define SCALER_DISPCTRL_PANIC2_SHIFT 28 + # define SCALER_DISPCTRL_DSP3_MUX_MASK VC4_MASK(19, 18) + # define SCALER_DISPCTRL_DSP3_MUX_SHIFT 18 + diff --git a/patches.suse/drm-vc4-vec-Use-pm_runtime_resume_and_get-in-vc4_vec.patch b/patches.suse/drm-vc4-vec-Use-pm_runtime_resume_and_get-in-vc4_vec.patch new file mode 100644 index 0000000..7b3baa2 --- /dev/null +++ b/patches.suse/drm-vc4-vec-Use-pm_runtime_resume_and_get-in-vc4_vec.patch @@ -0,0 +1,36 @@ +From 0ae41323a83233610e64e926eefb4d132ecb9028 Mon Sep 17 00:00:00 2001 +From: Shang XiaoJing +Date: Thu, 24 Nov 2022 09:51:13 +0800 +Subject: [PATCH] drm/vc4: vec: Use pm_runtime_resume_and_get() in vc4_vec_encoder_enable() +Git-commit: 0ae41323a83233610e64e926eefb4d132ecb9028 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Commit f0601ef8631c ("drm/vc4: vec: Protect device resources after +removal") add fail path for vc4_vec_encoder_enable(), and will put +usage_counter only when pm_runtime_get_sync() succeeds. However, +pm_runtime_get_sync() will increment usage_counter even it failed. Fix +it by replacing it with pm_runtime_resume_and_get() to keep usage +counter balanced. + +Fixes: e4b81f8c74c8 ("drm/vc4: Add support for the VEC (Video Encoder) IP") +Signed-off-by: Shang XiaoJing +Link: https://lore.kernel.org/r/20221124015113.18540-1-shangxiaojing@huawei.com +Signed-off-by: Maxime Ripard +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/vc4/vc4_vec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vc4/vc4_vec.c ++++ b/drivers/gpu/drm/vc4/vc4_vec.c +@@ -402,7 +402,7 @@ static void vc4_vec_encoder_enable(struc + struct vc4_vec *vec = vc4_vec_encoder->vec; + int ret; + +- ret = pm_runtime_get_sync(&vec->pdev->dev); ++ ret = pm_runtime_resume_and_get(&vec->pdev->dev); + if (ret < 0) { + DRM_ERROR("Failed to retain power domain: %d\n", ret); + return; diff --git a/patches.suse/drm-virtio-Fix-NULL-vs-IS_ERR-checking-in-virtio_gpu.patch b/patches.suse/drm-virtio-Fix-NULL-vs-IS_ERR-checking-in-virtio_gpu.patch new file mode 100644 index 0000000..9c9f999 --- /dev/null +++ b/patches.suse/drm-virtio-Fix-NULL-vs-IS_ERR-checking-in-virtio_gpu.patch @@ -0,0 +1,36 @@ +From c24968734abfed81c8f93dc5f44a7b7a9aecadfa Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Thu, 2 Jun 2022 14:42:22 +0400 +Subject: drm/virtio: Fix NULL vs IS_ERR checking in + virtio_gpu_object_shmem_init +Git-commit: c24968734abfed81c8f93dc5f44a7b7a9aecadfa +Patch-mainline: v6.0-rc1 +References: bsc#1208776 CVE-2023-22998 + +Since drm_prime_pages_to_sg() function return error pointers. +The drm_gem_shmem_get_sg_table() function returns error pointers too. +Using IS_ERR() to check the return value to fix this. + +Fixes: 2f2aa13724d5 ("drm/virtio: move virtio_gpu_mem_entry initialization to new function") +Signed-off-by: Miaoqian Lin +Link: http://patchwork.freedesktop.org/patch/msgid/20220602104223.54527-1-linmq006@gmail.com +Signed-off-by: Gerd Hoffmann +Acked-by: Patrik Jakobsson +--- + drivers/gpu/drm/virtio/virtgpu_object.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/virtio/virtgpu_object.c ++++ b/drivers/gpu/drm/virtio/virtgpu_object.c +@@ -168,9 +168,9 @@ + * since virtio_gpu doesn't support dma-buf import from other devices. + */ + shmem->pages = drm_gem_shmem_get_sg_table(&bo->base.base); +- if (!shmem->pages) { ++ if (IS_ERR(shmem->pages)) { + drm_gem_shmem_unpin(&bo->base.base); +- return -EINVAL; ++ return PTR_ERR(shmem->pages); + } + + if (use_dma_api) { diff --git a/patches.suse/drm-vkms-Fix-memory-leak-in-vkms_init.patch b/patches.suse/drm-vkms-Fix-memory-leak-in-vkms_init.patch new file mode 100644 index 0000000..ae4e7f1 --- /dev/null +++ b/patches.suse/drm-vkms-Fix-memory-leak-in-vkms_init.patch @@ -0,0 +1,75 @@ +From 0d0b368b9d104b437e1f4850ae94bdb9a3601e89 Mon Sep 17 00:00:00 2001 +From: Yuan Can +Date: Tue, 1 Nov 2022 06:51:55 +0000 +Subject: [PATCH] drm/vkms: Fix memory leak in vkms_init() +Git-commit: 0d0b368b9d104b437e1f4850ae94bdb9a3601e89 +Patch-mainline: v6.3-rc1 +References: git-fixes + +A memory leak was reported after the vkms module install failed. + +unreferenced object 0xffff88810bc28520 (size 16): + comm "modprobe", pid 9662, jiffies 4298009455 (age 42.590s) + hex dump (first 16 bytes): + 01 01 00 64 81 88 ff ff 00 00 dc 0a 81 88 ff ff ...d............ + backtrace: + [<00000000e7561ff8>] kmalloc_trace+0x27/0x60 + [<000000000b1954a0>] 0xffffffffc45200a9 + [<00000000abbf1da0>] do_one_initcall+0xd0/0x4f0 + [<000000001505ee87>] do_init_module+0x1a4/0x680 + [<00000000958079ad>] load_module+0x6249/0x7110 + [<00000000117e4696>] __do_sys_finit_module+0x140/0x200 + [<00000000f74b12d2>] do_syscall_64+0x35/0x80 + [<000000008fc6fcde>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +The reason is that the vkms_init() returns without checking the return +value of vkms_create(), and if the vkms_create() failed, the config +allocated at the beginning of vkms_init() is leaked. + + vkms_init() + config = kmalloc(...) # config allocated + ... + return vkms_create() # vkms_create failed and config is leaked + +Fix this problem by checking return value of vkms_create() and free the +config if error happened. + +Fixes: 2df7af93fdad ("drm/vkms: Add vkms_config type") +Signed-off-by: Yuan Can +Reviewed-by: Melissa Wen +Signed-off-by: Melissa Wen +Link: https://patchwork.freedesktop.org/patch/msgid/20221101065156.41584-2-yuancan@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/vkms/vkms_drv.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c +index 293dbca50c31..8a74f37d5912 100644 +--- a/drivers/gpu/drm/vkms/vkms_drv.c ++++ b/drivers/gpu/drm/vkms/vkms_drv.c +@@ -218,6 +218,7 @@ static int vkms_create(struct vkms_config *config) + + static int __init vkms_init(void) + { ++ int ret; + struct vkms_config *config; + + config = kmalloc(sizeof(*config), GFP_KERNEL); +@@ -230,7 +231,11 @@ static int __init vkms_init(void) + config->writeback = enable_writeback; + config->overlay = enable_overlay; + +- return vkms_create(config); ++ ret = vkms_create(config); ++ if (ret) ++ kfree(config); ++ ++ return ret; + } + + static void vkms_destroy(struct vkms_config *config) +-- +2.35.3 + diff --git a/patches.suse/drm-vkms-Fix-null-ptr-deref-in-vkms_release.patch b/patches.suse/drm-vkms-Fix-null-ptr-deref-in-vkms_release.patch new file mode 100644 index 0000000..ae3d3df --- /dev/null +++ b/patches.suse/drm-vkms-Fix-null-ptr-deref-in-vkms_release.patch @@ -0,0 +1,74 @@ +From 2fe2a8f40c21161ffe7653cc234e7934db5b7cc5 Mon Sep 17 00:00:00 2001 +From: Yuan Can +Date: Tue, 1 Nov 2022 06:51:56 +0000 +Subject: [PATCH] drm/vkms: Fix null-ptr-deref in vkms_release() +Git-commit: 2fe2a8f40c21161ffe7653cc234e7934db5b7cc5 +Patch-mainline: v6.3-rc1 +References: git-fixes + +A null-ptr-deref is triggered when it tries to destroy the workqueue in +vkms->output.composer_workq in vkms_release(). + + KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] + CPU: 5 PID: 17193 Comm: modprobe Not tainted 6.0.0-11331-gd465bff130bf #24 + RIP: 0010:destroy_workqueue+0x2f/0x710 + ... + Call Trace: + + ? vkms_config_debugfs_init+0x50/0x50 [vkms] + __devm_drm_dev_alloc+0x15a/0x1c0 [drm] + vkms_init+0x245/0x1000 [vkms] + do_one_initcall+0xd0/0x4f0 + do_init_module+0x1a4/0x680 + load_module+0x6249/0x7110 + __do_sys_finit_module+0x140/0x200 + do_syscall_64+0x35/0x80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +The reason is that an OOM happened which triggers the destroy of the +workqueue, however, the workqueue is alloced in the later process, +thus a null-ptr-deref happened. A simple call graph is shown as below: + + vkms_init() + vkms_create() + devm_drm_dev_alloc() + __devm_drm_dev_alloc() + devm_drm_dev_init() + devm_add_action_or_reset() + devm_add_action() # an error happened + devm_drm_dev_init_release() + drm_dev_put() + kref_put() + drm_dev_release() + vkms_release() + destroy_workqueue() # null-ptr-deref happened + vkms_modeset_init() + vkms_output_init() + vkms_crtc_init() # where the workqueue get allocated + +Fix this by checking if composer_workq is NULL before passing it to +the destroy_workqueue() in vkms_release(). + +Fixes: 6c234fe37c57 ("drm/vkms: Implement CRC debugfs API") +Signed-off-by: Yuan Can +Reviewed-by: Melissa Wen +Signed-off-by: Melissa Wen +Link: https://patchwork.freedesktop.org/patch/msgid/20221101065156.41584-3-yuancan@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/vkms/vkms_drv.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vkms/vkms_drv.c ++++ b/drivers/gpu/drm/vkms/vkms_drv.c +@@ -54,7 +54,8 @@ static void vkms_release(struct drm_devi + { + struct vkms_device *vkms = container_of(dev, struct vkms_device, drm); + +- destroy_workqueue(vkms->output.composer_workq); ++ if (vkms->output.composer_workq) ++ destroy_workqueue(vkms->output.composer_workq); + } + + static void vkms_atomic_commit_tail(struct drm_atomic_state *old_state) diff --git a/patches.suse/dt-bindings-arm-fsl-Fix-bindings-for-APF28Dev-board.patch b/patches.suse/dt-bindings-arm-fsl-Fix-bindings-for-APF28Dev-board.patch new file mode 100644 index 0000000..fd1d437 --- /dev/null +++ b/patches.suse/dt-bindings-arm-fsl-Fix-bindings-for-APF28Dev-board.patch @@ -0,0 +1,51 @@ +From c5a57dd6069df2014a2aca783afb1ecb27a69491 Mon Sep 17 00:00:00 2001 +From: Stefan Wahren +Date: Sat, 21 Jan 2023 15:00:52 +0100 +Subject: [PATCH] dt-bindings: arm: fsl: Fix bindings for APF28Dev board +Git-commit: c5a57dd6069df2014a2aca783afb1ecb27a69491 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Adjust the compatibles for the APF28Dev board in order to fix the +dtbs_check warning: + + DTC_CHK arch/arm/boot/dts/imx28-apf28dev.dtb +/home/stefanw/torvalds/arch/arm/boot/dts/imx28-apf28dev.dtb: /: compatible: oneOf' conditional failed, one must be fixed: ['armadeus,imx28-apf28dev', 'armadeus,imx28-apf28', 'fsl,imx28'] is too long ['armadeus,imx28-apf28dev', 'armadeus,imx28-apf28', 'fsl,imx28'] is too short ... + +Fixes: 3d735471d066 ("dt-bindings: arm: Document Armadeus SoM and Dev boards devicetree binding") +Signed-off-by: Stefan Wahren +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Shawn Guo +Acked-by: Takashi Iwai + +--- + Documentation/devicetree/bindings/arm/fsl.yaml | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/Documentation/devicetree/bindings/arm/fsl.yaml b/Documentation/devicetree/bindings/arm/fsl.yaml +index 67449bc30bc9..0b8da9a6d7d7 100644 +--- a/Documentation/devicetree/bindings/arm/fsl.yaml ++++ b/Documentation/devicetree/bindings/arm/fsl.yaml +@@ -88,12 +88,18 @@ properties: + items: + - enum: + - armadeus,imx28-apf28 # APF28 SoM +- - armadeus,imx28-apf28dev # APF28 SoM on APF28Dev board + - fsl,imx28-evk + - i2se,duckbill + - i2se,duckbill-2 + - technologic,imx28-ts4600 + - const: fsl,imx28 ++ ++ - description: i.MX28 Armadeus Systems APF28Dev Board ++ items: ++ - const: armadeus,imx28-apf28dev ++ - const: armadeus,imx28-apf28 ++ - const: fsl,imx28 ++ + - description: i.MX28 Duckbill 2 based Boards + items: + - enum: +-- +2.35.3 + diff --git a/patches.suse/dt-bindings-hwlock-sun6i-Add-missing-hwlock-cells.patch b/patches.suse/dt-bindings-hwlock-sun6i-Add-missing-hwlock-cells.patch new file mode 100644 index 0000000..a14be9e --- /dev/null +++ b/patches.suse/dt-bindings-hwlock-sun6i-Add-missing-hwlock-cells.patch @@ -0,0 +1,46 @@ +From 25d10262ed8aae71cd2f0b3c0a90d06a6b79fba2 Mon Sep 17 00:00:00 2001 +From: Bastian Germann +Date: Tue, 14 Feb 2023 00:19:28 +0100 +Subject: [PATCH] dt-bindings: hwlock: sun6i: Add missing #hwlock-cells +Git-commit: 25d10262ed8aae71cd2f0b3c0a90d06a6b79fba2 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The allwinner,sun6i-a31-hwspinlock.yaml binding needs #hwlock-cells +which is required by the hwlock type. + +Fixes: f9e784dcb63f ("dt-bindings: hwlock: add sun6i_hwspinlock") +Signed-off-by: Bastian Germann +Acked-by: Krzysztof Kozlowski +Reviewed-by: Andre Przywara +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230213231931.6546-2-bage@debian.org +Acked-by: Takashi Iwai + +--- + .../bindings/hwlock/allwinner,sun6i-a31-hwspinlock.yaml | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/Documentation/devicetree/bindings/hwlock/allwinner,sun6i-a31-hwspinlock.yaml b/Documentation/devicetree/bindings/hwlock/allwinner,sun6i-a31-hwspinlock.yaml +index 10e5a53e447b..01b1bbb3061f 100644 +--- a/Documentation/devicetree/bindings/hwlock/allwinner,sun6i-a31-hwspinlock.yaml ++++ b/Documentation/devicetree/bindings/hwlock/allwinner,sun6i-a31-hwspinlock.yaml +@@ -26,11 +26,15 @@ properties: + resets: + maxItems: 1 + ++ '#hwlock-cells': ++ const: 1 ++ + required: + - compatible + - reg + - clocks + - resets ++ - "#hwlock-cells" + + additionalProperties: false + +-- +2.35.3 + diff --git a/patches.suse/dt-bindings-input-iqs626a-Redefine-trackpad-property.patch b/patches.suse/dt-bindings-input-iqs626a-Redefine-trackpad-property.patch new file mode 100644 index 0000000..bf5ac71 --- /dev/null +++ b/patches.suse/dt-bindings-input-iqs626a-Redefine-trackpad-property.patch @@ -0,0 +1,165 @@ +From 9e69e845ae95227949c400af1037dca023f73038 Mon Sep 17 00:00:00 2001 +From: Jeff LaBundy +Date: Fri, 27 Jan 2023 16:30:09 -0600 +Subject: [PATCH] dt-bindings: input: iqs626a: Redefine trackpad property types +Git-commit: 9e69e845ae95227949c400af1037dca023f73038 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Following a recent refactor of the driver to properly drop unused +device nodes, the driver expects trackpad channel touch thresholds +and ATI base values to be specified under single trackpad channel +child nodes. + +This enhancement moves both properties to scalar values as opposed +to arrays, making their types consistent across bindings. + +Fixes: a8f1f0dc865c ("dt-bindings: input: Add bindings for Azoteq IQS626A") +Signed-off-by: Jeff LaBundy +Reviewed-by: Rob Herring +Link: https://lore.kernel.org/r/Y9RQcddToBr1rrnJ@nixie71 +Signed-off-by: Dmitry Torokhov +Acked-by: Takashi Iwai + +--- + .../devicetree/bindings/input/iqs626a.yaml | 94 +++++++++++++------ + 1 file changed, 67 insertions(+), 27 deletions(-) + +diff --git a/Documentation/devicetree/bindings/input/iqs626a.yaml b/Documentation/devicetree/bindings/input/iqs626a.yaml +index 7a27502095f3..e424d67b0542 100644 +--- a/Documentation/devicetree/bindings/input/iqs626a.yaml ++++ b/Documentation/devicetree/bindings/input/iqs626a.yaml +@@ -564,16 +564,6 @@ patternProperties: + 2: Partial + 3: Full + +- azoteq,ati-base: +- $ref: /schemas/types.yaml#/definitions/uint32-array +- minItems: 6 +- maxItems: 9 +- items: +- minimum: 45 +- maximum: 300 +- default: [45, 45, 45, 45, 45, 45, 45, 45, 45] +- description: Specifies each individual trackpad channel's ATI base. +- + azoteq,ati-target: + $ref: /schemas/types.yaml#/definitions/uint32 + multipleOf: 32 +@@ -620,17 +610,6 @@ patternProperties: + description: + Tightens the ATI band from 1/8 to 1/16 of the desired target. + +- azoteq,thresh: +- $ref: /schemas/types.yaml#/definitions/uint32-array +- minItems: 6 +- maxItems: 9 +- items: +- minimum: 0 +- maximum: 255 +- default: [0, 0, 0, 0, 0, 0, 0, 0, 0] +- description: +- Specifies each individual trackpad channel's touch threshold. +- + azoteq,hyst: + $ref: /schemas/types.yaml#/definitions/uint32 + minimum: 0 +@@ -720,6 +699,28 @@ patternProperties: + Specifies the number of points across which an axial gesture must + travel in order to be interpreted as a flick or swipe. + ++ patternProperties: ++ "^channel-[0-8]$": ++ type: object ++ description: Represents a single trackpad channel. ++ ++ properties: ++ azoteq,thresh: ++ $ref: /schemas/types.yaml#/definitions/uint32 ++ minimum: 0 ++ maximum: 255 ++ default: 0 ++ description: Specifies the threshold for the channel. ++ ++ azoteq,ati-base: ++ $ref: /schemas/types.yaml#/definitions/uint32 ++ minimum: 45 ++ maximum: 300 ++ default: 45 ++ description: Specifies the channel's ATI base. ++ ++ additionalProperties: false ++ + dependencies: + azoteq,gesture-swipe: ["linux,keycodes"] + azoteq,timeout-tap-ms: ["linux,keycodes"] +@@ -780,14 +781,8 @@ examples: + azoteq,filt-str-lp-cnt = <1>; + + azoteq,hyst = <4>; +- azoteq,thresh = <35>, <40>, <40>, +- <38>, <33>, <38>, +- <35>, <35>, <35>; + + azoteq,ati-mode = <3>; +- azoteq,ati-base = <195>, <195>, <195>, +- <195>, <195>, <195>, +- <195>, <195>, <195>; + azoteq,ati-target = <512>; + + azoteq,proj-bias = <1>; +@@ -804,6 +799,51 @@ examples: + azoteq,timeout-swipe-ms = <800>; + azoteq,timeout-tap-ms = <400>; + azoteq,thresh-swipe = <40>; ++ ++ channel-0 { ++ azoteq,thresh = <35>; ++ azoteq,ati-base = <195>; ++ }; ++ ++ channel-1 { ++ azoteq,thresh = <40>; ++ azoteq,ati-base = <195>; ++ }; ++ ++ channel-2 { ++ azoteq,thresh = <40>; ++ azoteq,ati-base = <195>; ++ }; ++ ++ channel-3 { ++ azoteq,thresh = <38>; ++ azoteq,ati-base = <195>; ++ }; ++ ++ channel-4 { ++ azoteq,thresh = <33>; ++ azoteq,ati-base = <195>; ++ }; ++ ++ channel-5 { ++ azoteq,thresh = <38>; ++ azoteq,ati-base = <195>; ++ }; ++ ++ channel-6 { ++ azoteq,thresh = <35>; ++ azoteq,ati-base = <195>; ++ }; ++ ++ channel-7 { ++ azoteq,thresh = <35>; ++ azoteq,ati-base = <195>; ++ }; ++ ++ channel-8 { ++ azoteq,thresh = <35>; ++ azoteq,ati-base = <195>; ++ }; + }; + + /* +-- +2.35.3 + diff --git a/patches.suse/dt-bindings-msm-dsi-controller-main-Add-vdd-descript.patch b/patches.suse/dt-bindings-msm-dsi-controller-main-Add-vdd-descript.patch new file mode 100644 index 0000000..d5fd794 --- /dev/null +++ b/patches.suse/dt-bindings-msm-dsi-controller-main-Add-vdd-descript.patch @@ -0,0 +1,73 @@ +From adf6a3ebba93245611cd766a6662b8000c7db325 Mon Sep 17 00:00:00 2001 +From: Bryan O'Donoghue +Date: Mon, 16 Jan 2023 22:52:17 +0000 +Subject: [PATCH] dt-bindings: msm: dsi-controller-main: Add vdd* descriptions back in +Git-commit: adf6a3ebba93245611cd766a6662b8000c7db325 +Patch-mainline: v6.3-rc1 +References: git-fixes + +When converting from .txt to .yaml we didn't include descriptions for the +existing regulator supplies. + +- vdd +- vdda +- vddio + +Add those descriptions into the yaml now as they were prior to the +conversion. In the .txt description we marked these regulators as required, +however, that requirement appears to have been in error. + +Taking the example of sc7180-trogdor-wormdingler.dtsi. The avdd and avee +come from GPIO controlled external regulators, not the SoC and in this case +there's no need for vddio to power an I/O bus. Similarly the regulators for +the LCD are controlled by the panel driver not by the dsi-ctrl driver. + +It would be possible to connect a different type of panel to the DSI bus +here in which case we may or may not want to make use of vdd, vdda or +vddio. + +This is also the case for older chipsets like apq8064, msm8916 etc the vdd* +regulators in the dsi-ctrl block are helpers not dependencies. + +Add the description of vdd, vdda and vddio back in for the existing +upstream dts where vdd, vdda or vddio are already declared but, don't +declare those regulators required - they are not SoC requirements. + +Fixes: 4dbe55c97741 ("dt-bindings: msm: dsi: add yaml schemas for DSI bindings") +Acked-by: Rob Herring +Signed-off-by: Bryan O'Donoghue +Patchwork: https://patchwork.freedesktop.org/patch/518643/ +Link: https://lore.kernel.org/r/20230116225217.1056258-4-bryan.odonoghue@linaro.org +Signed-off-by: Dmitry Baryshkov +Acked-by: Takashi Iwai + +--- + .../bindings/display/msm/dsi-controller-main.yaml | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/Documentation/devicetree/bindings/display/msm/dsi-controller-main.yaml b/Documentation/devicetree/bindings/display/msm/dsi-controller-main.yaml +index 6e2fd6e9fa7f..5b052cb3f328 100644 +--- a/Documentation/devicetree/bindings/display/msm/dsi-controller-main.yaml ++++ b/Documentation/devicetree/bindings/display/msm/dsi-controller-main.yaml +@@ -127,6 +127,18 @@ properties: + - port@0 + - port@1 + ++ vdd-supply: ++ description: ++ VDD regulator ++ ++ vddio-supply: ++ description: ++ VDD-IO regulator ++ ++ vdda-supply: ++ description: ++ VDDA regulator ++ + required: + - compatible + - reg +-- +2.35.3 + diff --git a/patches.suse/dt-bindings-net-snps-dwmac-Fix-snps-reset-delays-us-.patch b/patches.suse/dt-bindings-net-snps-dwmac-Fix-snps-reset-delays-us-.patch new file mode 100644 index 0000000..73eef6c --- /dev/null +++ b/patches.suse/dt-bindings-net-snps-dwmac-Fix-snps-reset-delays-us-.patch @@ -0,0 +1,39 @@ +From affb6a3fd8f44e4848f17989417415d158c1b8c4 Mon Sep 17 00:00:00 2001 +From: Andrew Halaney +Date: Tue, 14 Feb 2023 11:15:04 -0600 +Subject: [PATCH] dt-bindings: net: snps,dwmac: Fix snps,reset-delays-us dependency +Git-commit: affb6a3fd8f44e4848f17989417415d158c1b8c4 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The schema had snps,reset-delay-us as dependent on snps,reset-gpio. The +actual property is called snps,reset-delays-us, so fix this to catch any +devicetree defining snsps,reset-delays-us without snps,reset-gpio. + +Fixes: 7db3545aef5f ("dt-bindings: net: stmmac: Convert the binding to a schemas") +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Andrew Halaney +Link: https://lore.kernel.org/r/20230214171505.224602-1-ahalaney@redhat.com +Signed-off-by: Jakub Kicinski +Acked-by: Takashi Iwai + +--- + Documentation/devicetree/bindings/net/snps,dwmac.yaml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/devicetree/bindings/net/snps,dwmac.yaml b/Documentation/devicetree/bindings/net/snps,dwmac.yaml +index e88a86623fce..16b7d2904696 100644 +--- a/Documentation/devicetree/bindings/net/snps,dwmac.yaml ++++ b/Documentation/devicetree/bindings/net/snps,dwmac.yaml +@@ -552,7 +552,7 @@ required: + + dependencies: + snps,reset-active-low: ["snps,reset-gpio"] +- snps,reset-delay-us: ["snps,reset-gpio"] ++ snps,reset-delays-us: ["snps,reset-gpio"] + + allOf: + - $ref: "ethernet-controller.yaml#" +-- +2.35.3 + diff --git a/patches.suse/dt-bindings-power-supply-pm8941-coincell-Don-t-requi.patch b/patches.suse/dt-bindings-power-supply-pm8941-coincell-Don-t-requi.patch new file mode 100644 index 0000000..fb246c9 --- /dev/null +++ b/patches.suse/dt-bindings-power-supply-pm8941-coincell-Don-t-requi.patch @@ -0,0 +1,59 @@ +From b2b911afd86631e601537c7dd7bb0acc0b1f9b51 Mon Sep 17 00:00:00 2001 +From: Konrad Dybcio +Date: Tue, 14 Feb 2023 10:08:48 +0100 +Subject: [PATCH] dt-bindings: power: supply: pm8941-coincell: Don't require charging properties +Git-commit: b2b911afd86631e601537c7dd7bb0acc0b1f9b51 +Patch-mainline: v6.3-rc1 +References: git-fixes + +It's fine for these properties to be absent, as the driver doesn't fail +without them and functions with settings inherited from the reset/previous +stage bootloader state. + +Fixes: 6c463222a21d ("dt-bindings: power: supply: pm8941-coincell: Convert to DT schema format") +Signed-off-by: Konrad Dybcio +Acked-by: Krzysztof Kozlowski +Signed-off-by: Sebastian Reichel +Acked-by: Takashi Iwai + +--- + .../bindings/power/supply/qcom,pm8941-coincell.yaml | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/Documentation/devicetree/bindings/power/supply/qcom,pm8941-coincell.yaml b/Documentation/devicetree/bindings/power/supply/qcom,pm8941-coincell.yaml +index b7b58aed3f3c..1d2405bea109 100644 +--- a/Documentation/devicetree/bindings/power/supply/qcom,pm8941-coincell.yaml ++++ b/Documentation/devicetree/bindings/power/supply/qcom,pm8941-coincell.yaml +@@ -28,12 +28,18 @@ properties: + maxItems: 1 + + qcom,rset-ohms: +- description: resistance (in ohms) for current-limiting resistor ++ description: | ++ Resistance (in ohms) for current-limiting resistor. If unspecified, ++ inherit the previous configuration (e.g. from bootloader or hardware ++ default value). + enum: [ 800, 1200, 1700, 2100 ] + + qcom,vset-millivolts: + $ref: /schemas/types.yaml#/definitions/uint32 +- description: voltage (in millivolts) to apply for charging ++ description: | ++ Voltage (in millivolts) to apply for charging. If unspecified, inherit ++ the previous configuration (e.g. from bootloader or hardware default ++ value). + enum: [ 2500, 3000, 3100, 3200 ] + + qcom,charger-disable: +@@ -43,8 +49,6 @@ properties: + required: + - compatible + - reg +- - qcom,rset-ohms +- - qcom,vset-millivolts + + additionalProperties: false + +-- +2.35.3 + diff --git a/patches.suse/dt-bindings-usb-amlogic-meson-g12a-usb-ctrl-make-G12.patch b/patches.suse/dt-bindings-usb-amlogic-meson-g12a-usb-ctrl-make-G12.patch new file mode 100644 index 0000000..7db9559 --- /dev/null +++ b/patches.suse/dt-bindings-usb-amlogic-meson-g12a-usb-ctrl-make-G12.patch @@ -0,0 +1,38 @@ +From f87b564686ee47c480ccacc3922b38a8c54a6945 Mon Sep 17 00:00:00 2001 +From: Neil Armstrong +Date: Tue, 7 Feb 2023 16:02:04 +0100 +Subject: [PATCH] dt-bindings: usb: amlogic,meson-g12a-usb-ctrl: make G12A usb3-phy0 optional +Git-commit: f87b564686ee47c480ccacc3922b38a8c54a6945 +Patch-mainline: v6.3-rc1 +References: git-fixes + +On the G12A USB complex, the USB3 PHY is shared with the PCIe controller, +thus on designs without PCIe enabled the USB3 PHY entry can be ommited from +the PHY list. + +Fixes: cdff2c946f06 ("dt-bindings: usb: amlogic,meson-g12a-usb-ctrl: add the Amlogic AXG Families USB Glue Bindings") +Signed-off-by: Neil Armstrong +Acked-by: Rob Herring +Link: https://lore.kernel.org/r/20230207-b4-amlogic-g12a-usb-ctrl-bindings-fix-v1-1-c310293da7a2@linaro.org +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + .../devicetree/bindings/usb/amlogic,meson-g12a-usb-ctrl.yaml | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/Documentation/devicetree/bindings/usb/amlogic,meson-g12a-usb-ctrl.yaml b/Documentation/devicetree/bindings/usb/amlogic,meson-g12a-usb-ctrl.yaml +index daf2a859418d..f38a2be07eda 100644 +--- a/Documentation/devicetree/bindings/usb/amlogic,meson-g12a-usb-ctrl.yaml ++++ b/Documentation/devicetree/bindings/usb/amlogic,meson-g12a-usb-ctrl.yaml +@@ -108,6 +108,7 @@ allOf: + then: + properties: + phy-names: ++ minItems: 2 + items: + - const: usb2-phy0 # USB2 PHY0 if USBHOST_A port is used + - const: usb2-phy1 # USB2 PHY1 if USBOTG_B port is used +-- +2.35.3 + diff --git a/patches.suse/eeprom-idt_89hpesx-Fix-error-handling-in-idt_init.patch b/patches.suse/eeprom-idt_89hpesx-Fix-error-handling-in-idt_init.patch new file mode 100644 index 0000000..3031a04 --- /dev/null +++ b/patches.suse/eeprom-idt_89hpesx-Fix-error-handling-in-idt_init.patch @@ -0,0 +1,68 @@ +From d717a3ab282f51ec45142f911f7ef8a55c057de5 Mon Sep 17 00:00:00 2001 +From: Yuan Can +Date: Thu, 10 Nov 2022 02:00:30 +0000 +Subject: [PATCH] eeprom: idt_89hpesx: Fix error handling in idt_init() +Git-commit: d717a3ab282f51ec45142f911f7ef8a55c057de5 +Patch-mainline: v6.3-rc1 +References: git-fixes + +A problem about idt_89hpesx create debugfs failed is triggered with the +following log given: + + [ 4973.269647] debugfs: Directory 'idt_csr' with parent '/' already present! + +The reason is that idt_init() returns i2c_add_driver() directly without +checking its return value, if i2c_add_driver() failed, it returns without +destroy the newly created debugfs, resulting the debugfs of idt_csr can +never be created later. + + idt_init() + debugfs_create_dir() # create debugfs directory + i2c_add_driver() + driver_register() + bus_add_driver() + priv = kzalloc(...) # OOM happened + # return without destroy debugfs directory + +Fix by removing debugfs when i2c_add_driver() returns error. + +Fixes: cfad6425382e ("eeprom: Add IDT 89HPESx EEPROM/CSR driver") +Signed-off-by: Yuan Can +Acked-by: Serge Semin +Link: https://lore.kernel.org/r/20221110020030.47711-1-yuancan@huawei.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/misc/eeprom/idt_89hpesx.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/misc/eeprom/idt_89hpesx.c b/drivers/misc/eeprom/idt_89hpesx.c +index 4e07ee9cb500..7075d0b37881 100644 +--- a/drivers/misc/eeprom/idt_89hpesx.c ++++ b/drivers/misc/eeprom/idt_89hpesx.c +@@ -1566,12 +1566,20 @@ static struct i2c_driver idt_driver = { + */ + static int __init idt_init(void) + { ++ int ret; ++ + /* Create Debugfs directory first */ + if (debugfs_initialized()) + csr_dbgdir = debugfs_create_dir("idt_csr", NULL); + + /* Add new i2c-device driver */ +- return i2c_add_driver(&idt_driver); ++ ret = i2c_add_driver(&idt_driver); ++ if (ret) { ++ debugfs_remove_recursive(csr_dbgdir); ++ return ret; ++ } ++ ++ return 0; + } + module_init(idt_init); + +-- +2.35.3 + diff --git a/patches.suse/firmware-coreboot-Remove-GOOGLE_COREBOOT_TABLE_ACPI-.patch b/patches.suse/firmware-coreboot-Remove-GOOGLE_COREBOOT_TABLE_ACPI-.patch new file mode 100644 index 0000000..052206b --- /dev/null +++ b/patches.suse/firmware-coreboot-Remove-GOOGLE_COREBOOT_TABLE_ACPI-.patch @@ -0,0 +1,51 @@ +From e42af72223fdd0a4eca49e1bb904856710fdd46c Mon Sep 17 00:00:00 2001 +From: Douglas Anderson +Date: Tue, 7 Feb 2023 08:12:00 -0800 +Subject: [PATCH] firmware: coreboot: Remove GOOGLE_COREBOOT_TABLE_ACPI/OF Kconfig entries +Git-commit: e42af72223fdd0a4eca49e1bb904856710fdd46c +Patch-mainline: v6.3-rc1 +References: git-fixes + +Ever since commit a28aad66da8b ("firmware: coreboot: Collapse platform +drivers into bus core") the Kconfig entries GOOGLE_COREBOOT_TABLE_OF +and GOOGLE_COREBOOT_TABLE_ACPI have been dead. They have no "help" +text and thus aren't user choosable. They also aren't "select"ed by +anything. They also control the compilation of no code. + +Let's remove them. + +Fixes: a28aad66da8b ("firmware: coreboot: Collapse platform drivers into bus core") +Signed-off-by: Douglas Anderson +Reviewed-by: Guenter Roeck +Reviewed-by: Jack Rosenthal +Acked-by: Stephen Boyd +Link: https://lore.kernel.org/r/20230207081130.1.I657776750156793721efa247ce6293445137bc8a@changeid +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/firmware/google/Kconfig | 8 -------- + 1 file changed, 8 deletions(-) + +diff --git a/drivers/firmware/google/Kconfig b/drivers/firmware/google/Kconfig +index 9f190eab43ed..1bc7cbf2f65d 100644 +--- a/drivers/firmware/google/Kconfig ++++ b/drivers/firmware/google/Kconfig +@@ -44,14 +44,6 @@ config GOOGLE_COREBOOT_TABLE + device tree node /firmware/coreboot. + If unsure say N. + +-config GOOGLE_COREBOOT_TABLE_ACPI +- tristate +- select GOOGLE_COREBOOT_TABLE +- +-config GOOGLE_COREBOOT_TABLE_OF +- tristate +- select GOOGLE_COREBOOT_TABLE +- + config GOOGLE_MEMCONSOLE + tristate + depends on GOOGLE_MEMCONSOLE_X86_LEGACY || GOOGLE_MEMCONSOLE_COREBOOT +-- +2.35.3 + diff --git a/patches.suse/firmware-dmi-sysfs-Fix-null-ptr-deref-in-dmi_sysfs_r.patch b/patches.suse/firmware-dmi-sysfs-Fix-null-ptr-deref-in-dmi_sysfs_r.patch new file mode 100644 index 0000000..5de6802 --- /dev/null +++ b/patches.suse/firmware-dmi-sysfs-Fix-null-ptr-deref-in-dmi_sysfs_r.patch @@ -0,0 +1,76 @@ +From 18e126e97c961f7a93823795c879d7c085fe5098 Mon Sep 17 00:00:00 2001 +From: Chen Zhongjin +Date: Fri, 11 Nov 2022 09:53:26 +0800 +Subject: [PATCH] firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle +Git-commit: 18e126e97c961f7a93823795c879d7c085fe5098 +Patch-mainline: v6.3-rc1 +References: git-fixes + +KASAN reported a null-ptr-deref error: + +Kasan: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] +Cpu: 0 PID: 1373 Comm: modprobe +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) +Rip: 0010:dmi_sysfs_entry_release +... +Call Trace: + + kobject_put + dmi_sysfs_register_handle (drivers/firmware/dmi-sysfs.c:540) dmi_sysfs + dmi_decode_table (drivers/firmware/dmi_scan.c:133) + dmi_walk (drivers/firmware/dmi_scan.c:1115) + dmi_sysfs_init (drivers/firmware/dmi-sysfs.c:149) dmi_sysfs + do_one_initcall (init/main.c:1296) + ... +Kernel panic - not syncing: Fatal exception +Kernel Offset: 0x4000000 from 0xffffffff81000000 + +Acked-by: Takashi Iwai + +---[ end Kernel panic - not syncing: Fatal exception ]--- + +It is because previous patch added kobject_put() to release the memory +which will call dmi_sysfs_entry_release() and list_del(). + +However, list_add_tail(entry->list) is called after the error block, +so the list_head is uninitialized and cannot be deleted. + +Move error handling to after list_add_tail to fix this. + +Fixes: 660ba678f999 ("firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle") +Signed-off-by: Chen Zhongjin +Link: https://lore.kernel.org/r/20221111015326.251650-2-chenzhongjin@huawei.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/firmware/dmi-sysfs.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/firmware/dmi-sysfs.c b/drivers/firmware/dmi-sysfs.c +index 9b6ce172175c..ed5aff0a4204 100644 +--- a/drivers/firmware/dmi-sysfs.c ++++ b/drivers/firmware/dmi-sysfs.c +@@ -603,16 +603,16 @@ static void __init dmi_sysfs_register_handle(const struct dmi_header *dh, + *ret = kobject_init_and_add(&entry->kobj, &dmi_sysfs_entry_ktype, NULL, + "%d-%d", dh->type, entry->instance); + +- if (*ret) { +- kobject_put(&entry->kobj); +- return; +- } +- + /* Thread on the global list for cleanup */ + spin_lock(&entry_list_lock); + list_add_tail(&entry->list, &entry_list); + spin_unlock(&entry_list_lock); + ++ if (*ret) { ++ kobject_put(&entry->kobj); ++ return; ++ } ++ + /* Handle specializations by type */ + switch (dh->type) { + case DMI_ENTRY_SYSTEM_EVENT_LOG: +-- +2.35.3 + diff --git a/patches.suse/firmware-stratix10-svc-add-missing-gen_pool_destroy-.patch b/patches.suse/firmware-stratix10-svc-add-missing-gen_pool_destroy-.patch new file mode 100644 index 0000000..e1a92ad --- /dev/null +++ b/patches.suse/firmware-stratix10-svc-add-missing-gen_pool_destroy-.patch @@ -0,0 +1,64 @@ +From 9175ee1a99d57ec07d66ff572e1d5a724477ab37 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Tue, 29 Nov 2022 10:36:01 -0600 +Subject: [PATCH] firmware: stratix10-svc: add missing gen_pool_destroy() in stratix10_svc_drv_probe() +Git-commit: 9175ee1a99d57ec07d66ff572e1d5a724477ab37 +Patch-mainline: v6.3-rc1 +References: git-fixes + +In error path in stratix10_svc_drv_probe(), gen_pool_destroy() should be called +to destroy the memory pool that created by svc_create_memory_pool(). + +Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver") +Signed-off-by: Yang Yingliang +Signed-off-by: Dinh Nguyen +Link: https://lore.kernel.org/r/20221129163602.462369-1-dinguyen@kernel.org +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/firmware/stratix10-svc.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +--- a/drivers/firmware/stratix10-svc.c ++++ b/drivers/firmware/stratix10-svc.c +@@ -994,13 +994,17 @@ static int stratix10_svc_drv_probe(struc + + /* allocate service controller and supporting channel */ + controller = devm_kzalloc(dev, sizeof(*controller), GFP_KERNEL); +- if (!controller) +- return -ENOMEM; ++ if (!controller) { ++ ret = -ENOMEM; ++ goto err_destroy_pool; ++ } + + chans = devm_kmalloc_array(dev, SVC_NUM_CHANNEL, + sizeof(*chans), GFP_KERNEL | __GFP_ZERO); +- if (!chans) +- return -ENOMEM; ++ if (!chans) { ++ ret = -ENOMEM; ++ goto err_destroy_pool; ++ } + + controller->dev = dev; + controller->num_chans = SVC_NUM_CHANNEL; +@@ -1015,7 +1019,7 @@ static int stratix10_svc_drv_probe(struc + ret = kfifo_alloc(&controller->svc_fifo, fifo_size, GFP_KERNEL); + if (ret) { + dev_err(dev, "failed to allocate FIFO\n"); +- return ret; ++ goto err_destroy_pool; + } + spin_lock_init(&controller->svc_fifo_lock); + +@@ -1060,6 +1064,8 @@ err_put_device: + platform_device_put(svc->stratix10_svc_rsu); + err_free_kfifo: + kfifo_free(&controller->svc_fifo); ++err_destroy_pool: ++ gen_pool_destroy(genpool); + return ret; + } + diff --git a/patches.suse/gpio-tegra186-remove-unneeded-loop-in-tegra186_gpio_.patch b/patches.suse/gpio-tegra186-remove-unneeded-loop-in-tegra186_gpio_.patch new file mode 100644 index 0000000..ac47a62 --- /dev/null +++ b/patches.suse/gpio-tegra186-remove-unneeded-loop-in-tegra186_gpio_.patch @@ -0,0 +1,83 @@ +From 2e539b735d8683097846b486c0fb093da5f27fbb Mon Sep 17 00:00:00 2001 +From: Tom Rix +Date: Wed, 25 Jan 2023 13:26:31 -0800 +Subject: [PATCH] gpio: tegra186: remove unneeded loop in tegra186_gpio_init_route_mapping() +Git-commit: 2e539b735d8683097846b486c0fb093da5f27fbb +Patch-mainline: v6.3-rc1 +References: git-fixes + +Reviewing the j loop over num_irqs_per_bank, in the code previous +to the fixes: commit, every j was used. now only when j == 0. +If only j == 0 is used, there is no need for the loop. + +Fixes: 210386804745 ("gpio: tegra186: Support multiple interrupts per bank") +Signed-off-by: Tom Rix +Acked-by: Thierry Reding +Signed-off-by: Bartosz Golaszewski +Acked-by: Takashi Iwai + +--- + drivers/gpio/gpio-tegra186.c | 40 ++++++++++++++++-------------------- + 1 file changed, 18 insertions(+), 22 deletions(-) + +diff --git a/drivers/gpio/gpio-tegra186.c b/drivers/gpio/gpio-tegra186.c +index 9941f35af823..14c872b6ad05 100644 +--- a/drivers/gpio/gpio-tegra186.c ++++ b/drivers/gpio/gpio-tegra186.c +@@ -677,7 +677,7 @@ static const struct of_device_id tegra186_pmc_of_match[] = { + static void tegra186_gpio_init_route_mapping(struct tegra_gpio *gpio) + { + struct device *dev = gpio->gpio.parent; +- unsigned int i, j; ++ unsigned int i; + u32 value; + + for (i = 0; i < gpio->soc->num_ports; i++) { +@@ -699,27 +699,23 @@ static void tegra186_gpio_init_route_mapping(struct tegra_gpio *gpio) + * On Tegra194 and later, each pin can be routed to one or more + * interrupts. + */ +- for (j = 0; j < gpio->num_irqs_per_bank; j++) { +- dev_dbg(dev, "programming default interrupt routing for port %s\n", +- port->name); +- +- offset = TEGRA186_GPIO_INT_ROUTE_MAPPING(p, j); +- +- /* +- * By default we only want to route GPIO pins to IRQ 0. This works +- * only under the assumption that we're running as the host kernel +- * and hence all GPIO pins are owned by Linux. +- * +- * For cases where Linux is the guest OS, the hypervisor will have +- * to configure the interrupt routing and pass only the valid +- * interrupts via device tree. +- */ +- if (j == 0) { +- value = readl(base + offset); +- value = BIT(port->pins) - 1; +- writel(value, base + offset); +- } +- } ++ dev_dbg(dev, "programming default interrupt routing for port %s\n", ++ port->name); ++ ++ offset = TEGRA186_GPIO_INT_ROUTE_MAPPING(p, 0); ++ ++ /* ++ * By default we only want to route GPIO pins to IRQ 0. This works ++ * only under the assumption that we're running as the host kernel ++ * and hence all GPIO pins are owned by Linux. ++ * ++ * For cases where Linux is the guest OS, the hypervisor will have ++ * to configure the interrupt routing and pass only the valid ++ * interrupts via device tree. ++ */ ++ value = readl(base + offset); ++ value = BIT(port->pins) - 1; ++ writel(value, base + offset); + } + } + } +-- +2.35.3 + diff --git a/patches.suse/gpio-vf610-connect-GPIO-label-to-dev-name.patch b/patches.suse/gpio-vf610-connect-GPIO-label-to-dev-name.patch new file mode 100644 index 0000000..6b9fe72 --- /dev/null +++ b/patches.suse/gpio-vf610-connect-GPIO-label-to-dev-name.patch @@ -0,0 +1,33 @@ +From 6f8ecb7f85f441eb7d78ba2a4df45ee8a821934e Mon Sep 17 00:00:00 2001 +From: Haibo Chen +Date: Tue, 20 Dec 2022 17:02:47 +0800 +Subject: [PATCH] gpio: vf610: connect GPIO label to dev name +Git-commit: 6f8ecb7f85f441eb7d78ba2a4df45ee8a821934e +Patch-mainline: v6.3-rc1 +References: git-fixes + +Current GPIO label is fixed, so can't distinguish different GPIO +controllers through labels. Use dev name instead. + +Fixes: 7f2691a19627 ("gpio: vf610: add gpiolib/IRQ chip driver for Vybrid") +Signed-off-by: Clark Wang +Signed-off-by: Haibo Chen +Reviewed-by: Linus Walleij +Signed-off-by: Bartosz Golaszewski +Acked-by: Takashi Iwai + +--- + drivers/gpio/gpio-vf610.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpio/gpio-vf610.c ++++ b/drivers/gpio/gpio-vf610.c +@@ -304,7 +304,7 @@ static int vf610_gpio_probe(struct platf + gc = &port->gc; + gc->of_node = np; + gc->parent = dev; +- gc->label = "vf610-gpio"; ++ gc->label = dev_name(dev); + gc->ngpio = VF610_GPIO_PER_PORT; + gc->base = of_alias_get_id(np, "gpio") * VF610_GPIO_PER_PORT; + diff --git a/patches.suse/gpu-host1x-Don-t-skip-assigning-syncpoints-to-channe.patch b/patches.suse/gpu-host1x-Don-t-skip-assigning-syncpoints-to-channe.patch new file mode 100644 index 0000000..7b533bb --- /dev/null +++ b/patches.suse/gpu-host1x-Don-t-skip-assigning-syncpoints-to-channe.patch @@ -0,0 +1,40 @@ +From eb258cc1fd458e584082be987dbc6ec42668c05e Mon Sep 17 00:00:00 2001 +From: Mikko Perttunen +Date: Thu, 19 Jan 2023 15:39:00 +0200 +Subject: [PATCH] gpu: host1x: Don't skip assigning syncpoints to channels +Git-commit: eb258cc1fd458e584082be987dbc6ec42668c05e +Patch-mainline: v6.3-rc1 +References: git-fixes + +The code to write the syncpoint channel assignment register +incorrectly skips the write if hypervisor registers are not available. + +The register, however, is within the guest aperture so remove the +check and assign syncpoints properly even on virtualized systems. + +Fixes: c3f52220f276 ("gpu: host1x: Enable Tegra186 syncpoint protection") +Signed-off-by: Mikko Perttunen +Signed-off-by: Thierry Reding +Acked-by: Takashi Iwai + +--- + drivers/gpu/host1x/hw/syncpt_hw.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/gpu/host1x/hw/syncpt_hw.c b/drivers/gpu/host1x/hw/syncpt_hw.c +index dd39d67ccec3..8cf35b2eff3d 100644 +--- a/drivers/gpu/host1x/hw/syncpt_hw.c ++++ b/drivers/gpu/host1x/hw/syncpt_hw.c +@@ -106,9 +106,6 @@ static void syncpt_assign_to_channel(struct host1x_syncpt *sp, + #if HOST1X_HW >= 6 + struct host1x *host = sp->host; + +- if (!host->hv_regs) +- return; +- + host1x_sync_writel(host, + HOST1X_SYNC_SYNCPT_CH_APP_CH(ch ? ch->id : 0xff), + HOST1X_SYNC_SYNCPT_CH_APP(sp->id)); +-- +2.35.3 + diff --git a/patches.suse/gpu-ipu-v3-common-Add-of_node_put-for-reference-retu.patch b/patches.suse/gpu-ipu-v3-common-Add-of_node_put-for-reference-retu.patch new file mode 100644 index 0000000..d4b78ac --- /dev/null +++ b/patches.suse/gpu-ipu-v3-common-Add-of_node_put-for-reference-retu.patch @@ -0,0 +1,38 @@ +From 9afdf98cfdfa2ba8ec068cf08c5fcdc1ed8daf3f Mon Sep 17 00:00:00 2001 +From: Liang He +Date: Wed, 20 Jul 2022 23:22:27 +0800 +Subject: [PATCH] gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id() +Git-commit: 9afdf98cfdfa2ba8ec068cf08c5fcdc1ed8daf3f +Patch-mainline: v6.3-rc1 +References: git-fixes + +In ipu_add_client_devices(), we need to call of_node_put() for +reference returned by of_graph_get_port_by_id() in fail path. + +Fixes: 17e052175039 ("gpu: ipu-v3: Do not bail out on missing optional port nodes") +Signed-off-by: Liang He +Reviewed-by: Philipp Zabel +Link: https://lore.kernel.org/r/20220720152227.1288413-1-windhl@126.com +Signed-off-by: Philipp Zabel +Link: https://patchwork.freedesktop.org/patch/msgid/20220720152227.1288413-1-windhl@126.com +Acked-by: Takashi Iwai + +--- + drivers/gpu/ipu-v3/ipu-common.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c +index 118318513e2d..c35eac1116f5 100644 +--- a/drivers/gpu/ipu-v3/ipu-common.c ++++ b/drivers/gpu/ipu-v3/ipu-common.c +@@ -1165,6 +1165,7 @@ static int ipu_add_client_devices(struct ipu_soc *ipu, unsigned long ipu_base) + pdev = platform_device_alloc(reg->name, id++); + if (!pdev) { + ret = -ENOMEM; ++ of_node_put(of_node); + goto err_register; + } + +-- +2.35.3 + diff --git a/patches.suse/hid-bigben_probe-validate-report-count.patch b/patches.suse/hid-bigben_probe-validate-report-count.patch new file mode 100644 index 0000000..dd9ca43 --- /dev/null +++ b/patches.suse/hid-bigben_probe-validate-report-count.patch @@ -0,0 +1,57 @@ +From b94335f899542a0da5fafc38af8edcaf90195843 Mon Sep 17 00:00:00 2001 +From: Pietro Borrello +Date: Sun, 12 Feb 2023 00:01:44 +0000 +Subject: [PATCH] hid: bigben_probe(): validate report count +Git-commit: b94335f899542a0da5fafc38af8edcaf90195843 +Patch-mainline: v6.3-rc1 +References: git-fixes + +bigben_probe() does not validate that the output report has the +needed report values in the first field. +A malicious device registering a report with one field and a single +value causes an head OOB write in bigben_worker() when +accessing report_field->value[1] to report_field->value[7]. +Use hid_validate_values() which takes care of all the needed checks. + +Fixes: 256a90ed9e46 ("HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad") +Signed-off-by: Pietro Borrello +Link: https://lore.kernel.org/r/20230211-bigben-oob-v1-1-d2849688594c@diag.uniroma1.it +Signed-off-by: Benjamin Tissoires +Acked-by: Takashi Iwai + +--- + drivers/hid/hid-bigbenff.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c +index 9d6560db762b..a02cb517b4c4 100644 +--- a/drivers/hid/hid-bigbenff.c ++++ b/drivers/hid/hid-bigbenff.c +@@ -371,7 +371,6 @@ static int bigben_probe(struct hid_device *hid, + { + struct bigben_device *bigben; + struct hid_input *hidinput; +- struct list_head *report_list; + struct led_classdev *led; + char *name; + size_t name_sz; +@@ -396,14 +395,12 @@ static int bigben_probe(struct hid_device *hid, + return error; + } + +- report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list; +- if (list_empty(report_list)) { ++ bigben->report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 8); ++ if (!bigben->report) { + hid_err(hid, "no output report found\n"); + error = -ENODEV; + goto error_hw_stop; + } +- bigben->report = list_entry(report_list->next, +- struct hid_report, list); + + if (list_empty(&hid->inputs)) { + hid_err(hid, "no inputs found\n"); +-- +2.35.3 + diff --git a/patches.suse/hwmon-ftsteutates-Fix-scaling-of-measurements.patch b/patches.suse/hwmon-ftsteutates-Fix-scaling-of-measurements.patch new file mode 100644 index 0000000..af3f62a --- /dev/null +++ b/patches.suse/hwmon-ftsteutates-Fix-scaling-of-measurements.patch @@ -0,0 +1,124 @@ +From ca8fd8c16a8b77dfcf7f6ce52d2c863220693a78 Mon Sep 17 00:00:00 2001 +From: Armin Wolf +Date: Sat, 24 Dec 2022 05:18:53 +0100 +Subject: [PATCH] hwmon: (ftsteutates) Fix scaling of measurements +Git-commit: ca8fd8c16a8b77dfcf7f6ce52d2c863220693a78 +Patch-mainline: v6.3-rc1 +References: git-fixes + +A user complained that the ftsteutates driver was displaying +bogus values since its introduction. This happens because the +sensor measurements need to be scaled in order to produce +meaningful results: +- the fan speed needs to be multiplied by 60 since its in RPS +- the temperature is in degrees celsius and needs an offset of 64 +- the voltage is in 1/256 of 3.3V + +The offical datasheet says the voltage needs to be divided by 256, +but this is likely an off-by-one-error, since even the BIOS +devides by 255 (otherwise 3.3V could not be measured). + +The voltage channels additionally need a board-specific multiplier, +however this can be done by the driver since its board-specific. + +The reason the missing scaling of measurements is the way Fujitsu +used this driver when it was still out-of-tree. Back then, all +scaling was done in userspace by libsensors, even the generic one. + +Tested on a Fujitsu DS3401-B1. + +Fixes: 08426eda58e0 ("hwmon: Add driver for FTS BMC chip "Teutates"") +Signed-off-by: Armin Wolf +Link: https://lore.kernel.org/r/20221224041855.83981-2-W_Armin@gmx.de +Signed-off-by: Guenter Roeck +Acked-by: Takashi Iwai + +--- + Documentation/hwmon/ftsteutates.rst | 4 ++++ + drivers/hwmon/ftsteutates.c | 19 +++++++++++++------ + 2 files changed, 17 insertions(+), 6 deletions(-) + +diff --git a/Documentation/hwmon/ftsteutates.rst b/Documentation/hwmon/ftsteutates.rst +index 58a2483d8d0d..198fa8e2819d 100644 +--- a/Documentation/hwmon/ftsteutates.rst ++++ b/Documentation/hwmon/ftsteutates.rst +@@ -22,6 +22,10 @@ enhancements. It can monitor up to 4 voltages, 16 temperatures and + 8 fans. It also contains an integrated watchdog which is currently + implemented in this driver. + ++The 4 voltages require a board-specific multiplier, since the BMC can ++only measure voltages up to 3.3V and thus relies on voltage dividers. ++Consult your motherboard manual for details. ++ + To clear a temperature or fan alarm, execute the following command with the + correct path to the alarm file:: + +diff --git a/drivers/hwmon/ftsteutates.c b/drivers/hwmon/ftsteutates.c +index f5b8e724a8ca..ffa0bb364877 100644 +--- a/drivers/hwmon/ftsteutates.c ++++ b/drivers/hwmon/ftsteutates.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -347,13 +348,15 @@ static ssize_t in_value_show(struct device *dev, + { + struct fts_data *data = dev_get_drvdata(dev); + int index = to_sensor_dev_attr(devattr)->index; +- int err; ++ int value, err; + + err = fts_update_device(data); + if (err < 0) + return err; + +- return sprintf(buf, "%u\n", data->volt[index]); ++ value = DIV_ROUND_CLOSEST(data->volt[index] * 3300, 255); ++ ++ return sprintf(buf, "%d\n", value); + } + + static ssize_t temp_value_show(struct device *dev, +@@ -361,13 +364,15 @@ static ssize_t temp_value_show(struct device *dev, + { + struct fts_data *data = dev_get_drvdata(dev); + int index = to_sensor_dev_attr(devattr)->index; +- int err; ++ int value, err; + + err = fts_update_device(data); + if (err < 0) + return err; + +- return sprintf(buf, "%u\n", data->temp_input[index]); ++ value = (data->temp_input[index] - 64) * 1000; ++ ++ return sprintf(buf, "%d\n", value); + } + + static ssize_t temp_fault_show(struct device *dev, +@@ -436,13 +441,15 @@ static ssize_t fan_value_show(struct device *dev, + { + struct fts_data *data = dev_get_drvdata(dev); + int index = to_sensor_dev_attr(devattr)->index; +- int err; ++ int value, err; + + err = fts_update_device(data); + if (err < 0) + return err; + +- return sprintf(buf, "%u\n", data->fan_input[index]); ++ value = data->fan_input[index] * 60; ++ ++ return sprintf(buf, "%d\n", value); + } + + static ssize_t fan_source_show(struct device *dev, +-- +2.35.3 + diff --git a/patches.suse/hwmon-ltc2945-Handle-error-case-in-ltc2945_value_sto.patch b/patches.suse/hwmon-ltc2945-Handle-error-case-in-ltc2945_value_sto.patch new file mode 100644 index 0000000..ef2f3bf --- /dev/null +++ b/patches.suse/hwmon-ltc2945-Handle-error-case-in-ltc2945_value_sto.patch @@ -0,0 +1,38 @@ +From 178b01eccfb0b8149682f61388400bd3d903dddc Mon Sep 17 00:00:00 2001 +From: Jonathan Cormier +Date: Thu, 26 Jan 2023 17:32:25 -0500 +Subject: [PATCH] hwmon: (ltc2945) Handle error case in ltc2945_value_store +Git-commit: 178b01eccfb0b8149682f61388400bd3d903dddc +Patch-mainline: v6.3-rc1 +References: git-fixes + +ltc2945_val_to_reg errors were not being handled +which would have resulted in register being set to +0 (clamped) instead of being left alone. + +Fixes: 6700ce035f83 ("hwmon: Driver for Linear Technologies LTC2945") + +Signed-off-by: Jonathan Cormier +Signed-off-by: Guenter Roeck +Acked-by: Takashi Iwai + +--- + drivers/hwmon/ltc2945.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/hwmon/ltc2945.c b/drivers/hwmon/ltc2945.c +index 9af3e3821152..ac15298a6558 100644 +--- a/drivers/hwmon/ltc2945.c ++++ b/drivers/hwmon/ltc2945.c +@@ -254,6 +254,8 @@ static ssize_t ltc2945_value_store(struct device *dev, + + /* convert to register value, then clamp and write result */ + regval = ltc2945_val_to_reg(dev, reg, val); ++ if (regval < 0) ++ return regval; + if (is_power_reg(reg)) { + regval = clamp_val(regval, 0, 0xffffff); + regbuf[0] = regval >> 16; +-- +2.35.3 + diff --git a/patches.suse/hwmon-mlxreg-fan-Return-zero-speed-for-broken-fan.patch b/patches.suse/hwmon-mlxreg-fan-Return-zero-speed-for-broken-fan.patch new file mode 100644 index 0000000..1f2ac29 --- /dev/null +++ b/patches.suse/hwmon-mlxreg-fan-Return-zero-speed-for-broken-fan.patch @@ -0,0 +1,46 @@ +From a1ffd3c46267ee5c807acd780e15df9bb692223f Mon Sep 17 00:00:00 2001 +From: Vadim Pasternak +Date: Sun, 12 Feb 2023 16:57:30 +0200 +Subject: [PATCH] hwmon: (mlxreg-fan) Return zero speed for broken fan +Git-commit: a1ffd3c46267ee5c807acd780e15df9bb692223f +Patch-mainline: v6.3-rc1 +References: git-fixes + +Currently for broken fan driver returns value calculated based on error +code (0xFF) in related fan speed register. +Thus, for such fan user gets fan{n}_fault to 1 and fan{n}_input with +misleading value. + +Add check for fan fault prior return speed value and return zero if +fault is detected. + +Fixes: 65afb4c8e7e4 ("hwmon: (mlxreg-fan) Add support for Mellanox FAN driver") +Signed-off-by: Vadim Pasternak +Link: https://lore.kernel.org/r/20230212145730.24247-1-vadimp@nvidia.com +Signed-off-by: Guenter Roeck +Acked-by: Takashi Iwai + +--- + drivers/hwmon/mlxreg-fan.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c +index b48bd7c961d6..96017cc8da7e 100644 +--- a/drivers/hwmon/mlxreg-fan.c ++++ b/drivers/hwmon/mlxreg-fan.c +@@ -155,6 +155,12 @@ mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr, + if (err) + return err; + ++ if (MLXREG_FAN_GET_FAULT(regval, tacho->mask)) { ++ /* FAN is broken - return zero for FAN speed. */ ++ *val = 0; ++ return 0; ++ } ++ + *val = MLXREG_FAN_GET_RPM(regval, fan->divider, + fan->samples); + break; +-- +2.35.3 + diff --git a/patches.suse/i2c-designware-fix-i2c_dw_clk_rate-return-size-to-be.patch b/patches.suse/i2c-designware-fix-i2c_dw_clk_rate-return-size-to-be.patch new file mode 100644 index 0000000..a25f3bc --- /dev/null +++ b/patches.suse/i2c-designware-fix-i2c_dw_clk_rate-return-size-to-be.patch @@ -0,0 +1,52 @@ +From f2e1fa99550dd7a882229e2c2cd9ecab4ce773d0 Mon Sep 17 00:00:00 2001 +From: Hanna Hawa +Date: Mon, 19 Dec 2022 17:23:45 +0000 +Subject: [PATCH] i2c: designware: fix i2c_dw_clk_rate() return size to be u32 +Git-commit: f2e1fa99550dd7a882229e2c2cd9ecab4ce773d0 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Make i2c_dw_clk_rate() to return u32 instead of unsigned long, as the +function return the value of get_clk_rate_khz() which returns u32. + +Fixes: b33af11de236 ("i2c: designware: Do not require clock when SSCN and FFCN are provided") +Signed-off-by: Hanna Hawa +Reviewed-by: Andy Shevchenko +Acked-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Acked-by: Takashi Iwai + +--- + drivers/i2c/busses/i2c-designware-common.c | 2 +- + drivers/i2c/busses/i2c-designware-core.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-designware-common.c b/drivers/i2c/busses/i2c-designware-common.c +index a3240ece55b2..f8406b9f7651 100644 +--- a/drivers/i2c/busses/i2c-designware-common.c ++++ b/drivers/i2c/busses/i2c-designware-common.c +@@ -462,7 +462,7 @@ void __i2c_dw_disable(struct dw_i2c_dev *dev) + dev_warn(dev->dev, "timeout in disabling adapter\n"); + } + +-unsigned long i2c_dw_clk_rate(struct dw_i2c_dev *dev) ++u32 i2c_dw_clk_rate(struct dw_i2c_dev *dev) + { + /* + * Clock is not necessary if we got LCNT/HCNT values directly from +diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h +index 95ebc5eaa5d1..6bc2edec14f2 100644 +--- a/drivers/i2c/busses/i2c-designware-core.h ++++ b/drivers/i2c/busses/i2c-designware-core.h +@@ -320,7 +320,7 @@ int i2c_dw_init_regmap(struct dw_i2c_dev *dev); + u32 i2c_dw_scl_hcnt(u32 ic_clk, u32 tSYMBOL, u32 tf, int cond, int offset); + u32 i2c_dw_scl_lcnt(u32 ic_clk, u32 tLOW, u32 tf, int offset); + int i2c_dw_set_sda_hold(struct dw_i2c_dev *dev); +-unsigned long i2c_dw_clk_rate(struct dw_i2c_dev *dev); ++u32 i2c_dw_clk_rate(struct dw_i2c_dev *dev); + int i2c_dw_prepare_clk(struct dw_i2c_dev *dev, bool prepare); + int i2c_dw_acquire_lock(struct dw_i2c_dev *dev); + void i2c_dw_release_lock(struct dw_i2c_dev *dev); +-- +2.35.3 + diff --git a/patches.suse/ice-Do-not-skip-not-enabled-queues-in-ice_vc_dis_qs_.patch b/patches.suse/ice-Do-not-skip-not-enabled-queues-in-ice_vc_dis_qs_.patch index d016107..c7f1185 100644 --- a/patches.suse/ice-Do-not-skip-not-enabled-queues-in-ice_vc_dis_qs_.patch +++ b/patches.suse/ice-Do-not-skip-not-enabled-queues-in-ice_vc_dis_qs_.patch @@ -56,25 +56,20 @@ Signed-off-by: Tony Nguyen Signed-off-by: Paolo Abeni Signed-off-by: Denis Kirjanov --- - drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 4 ++-- + drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c -index 5515c44d9a2b..87806680653a 100644 --- a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c +++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c -@@ -3445,9 +3445,9 @@ static int ice_vc_dis_qs_msg(struct ice_vf *vf, u8 *msg) +@@ -3383,9 +3383,9 @@ static int ice_vc_dis_qs_msg(struct ice_ goto error_param; } - /* Skip queue if not enabled */ - if (!test_bit(vf_q_id, vf->rxq_ena)) + if (!test_bit(vf_q_id, vf->txq_ena)) - continue; + dev_dbg(ice_pf_to_dev(vsi->back), "Queue %u on VSI %u is not enabled, but stopping it anyway\n", + vf_q_id, vsi->vsi_num); - if (ice_vsi_ctrl_one_rx_ring(vsi, false, vf_q_id, - true)) { --- -2.16.4 - + ice_fill_txq_meta(vsi, ring, &txq_meta); + diff --git a/patches.suse/ice-clear-stale-Tx-queue-settings-before-configuring.patch b/patches.suse/ice-clear-stale-Tx-queue-settings-before-configuring.patch index fde0166..4e47d5e 100644 --- a/patches.suse/ice-clear-stale-Tx-queue-settings-before-configuring.patch +++ b/patches.suse/ice-clear-stale-Tx-queue-settings-before-configuring.patch @@ -49,7 +49,7 @@ Acked-by: Thomas Bogendoerfer --- a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c +++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c -@@ -3351,12 +3351,51 @@ error_param: +@@ -3333,12 +3333,51 @@ error_param: } /** @@ -103,7 +103,7 @@ Acked-by: Thomas Bogendoerfer */ static int ice_vc_dis_qs_msg(struct ice_vf *vf, u8 *msg) { -@@ -3393,30 +3432,15 @@ static int ice_vc_dis_qs_msg(struct ice_ +@@ -3375,30 +3414,15 @@ static int ice_vc_dis_qs_msg(struct ice_ q_map = vqs->tx_queues; for_each_set_bit(vf_q_id, &q_map, ICE_MAX_RSS_QS_PER_VF) { @@ -115,9 +115,9 @@ Acked-by: Thomas Bogendoerfer goto error_param; } -- /* Skip queue if not enabled */ - if (!test_bit(vf_q_id, vf->txq_ena)) -- continue; +- dev_dbg(ice_pf_to_dev(vsi->back), "Queue %u on VSI %u is not enabled, but stopping it anyway\n", +- vf_q_id, vsi->vsi_num); - - ice_fill_txq_meta(vsi, ring, &txq_meta); - @@ -135,7 +135,7 @@ Acked-by: Thomas Bogendoerfer } } -@@ -3665,6 +3689,14 @@ static int ice_vc_cfg_qs_msg(struct ice_ +@@ -3647,6 +3671,14 @@ static int ice_vc_cfg_qs_msg(struct ice_ if (qpi->txq.ring_len > 0) { vsi->tx_rings[i]->dma = qpi->txq.dma_ring_addr; vsi->tx_rings[i]->count = qpi->txq.ring_len; diff --git a/patches.suse/iio-light-tsl2563-Do-not-hardcode-interrupt-trigger-.patch b/patches.suse/iio-light-tsl2563-Do-not-hardcode-interrupt-trigger-.patch new file mode 100644 index 0000000..3624043 --- /dev/null +++ b/patches.suse/iio-light-tsl2563-Do-not-hardcode-interrupt-trigger-.patch @@ -0,0 +1,57 @@ +From 027641b52fe37b64af61025298ce160c8b9b7a73 Mon Sep 17 00:00:00 2001 +From: Ferry Toth +Date: Wed, 7 Dec 2022 21:03:38 +0200 +Subject: [PATCH] iio: light: tsl2563: Do not hardcode interrupt trigger type +Git-commit: 027641b52fe37b64af61025298ce160c8b9b7a73 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Instead of hardcoding IRQ trigger type to IRQF_TRIGGER_RAISING, +let's respect the settings specified in the firmware description. +To be compatible with the older firmware descriptions, if trigger +type is not set up there, we'll set it to default (raising edge). + +Fixes: 388be4883952 ("staging:iio: tsl2563 abi fixes and interrupt handling") +Fixes: bdab1001738f ("staging:iio:light:tsl2563 remove old style event registration.") +Signed-off-by: Ferry Toth +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20221207190348.9347-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Jonathan Cameron +Acked-by: Takashi Iwai + +--- + drivers/iio/light/tsl2563.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/iio/light/tsl2563.c b/drivers/iio/light/tsl2563.c +index d0e42b73203a..71302ae864d9 100644 +--- a/drivers/iio/light/tsl2563.c ++++ b/drivers/iio/light/tsl2563.c +@@ -704,6 +704,7 @@ static int tsl2563_probe(struct i2c_client *client) + struct iio_dev *indio_dev; + struct tsl2563_chip *chip; + struct tsl2563_platform_data *pdata = client->dev.platform_data; ++ unsigned long irq_flags; + int err = 0; + u8 id = 0; + +@@ -759,10 +760,15 @@ static int tsl2563_probe(struct i2c_client *client) + indio_dev->info = &tsl2563_info_no_irq; + + if (client->irq) { ++ irq_flags = irq_get_trigger_type(client->irq); ++ if (irq_flags == IRQF_TRIGGER_NONE) ++ irq_flags = IRQF_TRIGGER_RISING; ++ irq_flags |= IRQF_ONESHOT; ++ + err = devm_request_threaded_irq(&client->dev, client->irq, + NULL, + &tsl2563_event_handler, +- IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ irq_flags, + "tsl2563_event", + indio_dev); + if (err) { +-- +2.35.3 + diff --git a/patches.suse/ipmi-ssif-Add-a-timer-between-request-retries.patch b/patches.suse/ipmi-ssif-Add-a-timer-between-request-retries.patch index 4443c3c..02c62b0 100644 --- a/patches.suse/ipmi-ssif-Add-a-timer-between-request-retries.patch +++ b/patches.suse/ipmi-ssif-Add-a-timer-between-request-retries.patch @@ -1,15 +1,15 @@ From: Corey Minyard Date: Wed, 25 Jan 2023 10:34:47 -0600 Subject: [PATCH] ipmi:ssif: Add a timer between request retries -Patch-mainline: Queued -Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git -Git-commit: 1fc7ac8a9e3a4b6bf16895c67dcb9bf455d31a49 +Patch-mainline: v6.3-rc1 +Git-commit: 00bb7e763ec9f384cb382455cb6ba5588b5375cf References: bsc#1206459 The IPMI spec has a time (T6) specified between request retries. Add the handling for that. Reported by: Tony Camuso +Cc: stable@vger.kernel.org Signed-off-by: Corey Minyard Acked-by: Chester Lin --- diff --git a/patches.suse/ipmi-ssif-Remove-rtc_us_timer.patch b/patches.suse/ipmi-ssif-Remove-rtc_us_timer.patch index 8ae082d..77acaa6 100644 --- a/patches.suse/ipmi-ssif-Remove-rtc_us_timer.patch +++ b/patches.suse/ipmi-ssif-Remove-rtc_us_timer.patch @@ -1,13 +1,13 @@ From: Corey Minyard Date: Wed, 25 Jan 2023 10:41:48 -0600 Subject: [PATCH] ipmi:ssif: Remove rtc_us_timer -Patch-mainline: Queued -Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git -Git-commit: 48b4e13a3b8064ad61225ef6cb768c115c3a13c9 +Patch-mainline: v6.3-rc1 +Git-commit: 9e8b89926fb87e5625bdde6fd5de2c31fb1d83bf References: bsc#1206459 It was cruft left over from older handling of run to completion. +Cc: stable@vger.kernel.org Signed-off-by: Corey Minyard Acked-by: Chester Lin --- diff --git a/patches.suse/ipmi-ssif-resend_msg-cannot-fail.patch b/patches.suse/ipmi-ssif-resend_msg-cannot-fail.patch index b3eaabb..606af52 100644 --- a/patches.suse/ipmi-ssif-resend_msg-cannot-fail.patch +++ b/patches.suse/ipmi-ssif-resend_msg-cannot-fail.patch @@ -1,15 +1,15 @@ From: Corey Minyard Date: Wed, 25 Jan 2023 10:11:06 -0600 Subject: [PATCH] ipmi:ssif: resend_msg() cannot fail -Patch-mainline: Queued -Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git -Git-commit: 56d64b4c876fbdf70ce4881f9fbde224e749c5bc +Patch-mainline: v6.3-rc1 +Git-commit: 95767ed78a181d5404202627499f9cde56053b96 References: bsc#1206459 The resend_msg() function cannot fail, but there was error handling around using it. Rework the handling of the error, and fix the out of retries debug reporting that was wrong around this, too. +Cc: stable@vger.kernel.org Signed-off-by: Corey Minyard Acked-by: Chester Lin --- diff --git a/patches.suse/ipmi_ssif-Rename-idle-state-and-check.patch b/patches.suse/ipmi_ssif-Rename-idle-state-and-check.patch index 1784184..4553c41 100644 --- a/patches.suse/ipmi_ssif-Rename-idle-state-and-check.patch +++ b/patches.suse/ipmi_ssif-Rename-idle-state-and-check.patch @@ -1,14 +1,14 @@ From: Corey Minyard Date: Wed, 25 Jan 2023 10:13:13 -0600 Subject: [PATCH] ipmi_ssif: Rename idle state and check -Patch-mainline: Queued -Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git -Git-commit: b2aa938a4b7d2f2c21ef95c4ed779d4448bedd36 +Patch-mainline: v6.3-rc1 +Git-commit: 8230831c43a328c2be6d28c65d3f77e14c59986b References: bsc#1206459 Rename the SSIF_IDLE() to IS_SSIF_IDLE(), since that is more clear, and rename SSIF_NORMAL to SSIF_IDLE, since that's more accurate. +Cc: stable@vger.kernel.org Signed-off-by: Corey Minyard Acked-by: Chester Lin --- diff --git a/patches.suse/leds-led-class-Add-missing-put_device-to-led_put.patch b/patches.suse/leds-led-class-Add-missing-put_device-to-led_put.patch new file mode 100644 index 0000000..bf14ca7 --- /dev/null +++ b/patches.suse/leds-led-class-Add-missing-put_device-to-led_put.patch @@ -0,0 +1,58 @@ +From 445110941eb94709216363f9d807d2508e64abd7 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Fri, 20 Jan 2023 12:45:14 +0100 +Subject: [PATCH] leds: led-class: Add missing put_device() to led_put() +Git-commit: 445110941eb94709216363f9d807d2508e64abd7 +Patch-mainline: v6.3-rc1 +References: git-fixes + +led_put() is used to "undo" a successful of_led_get() call, +of_led_get() uses class_find_device_by_of_node() which returns +a reference to the device which must be free-ed with put_device() +when the caller is done with it. + +Add a put_device() call to led_put() to free the reference returned +by class_find_device_by_of_node(). + +And also add a put_device() in the error-exit case of try_module_get() +failing. + +Fixes: 699a8c7c4bd3 ("leds: Add of_led_get() and led_put()") +Reviewed-by: Andy Shevchenko +Reviewed-by: Linus Walleij +Signed-off-by: Hans de Goede +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20230120114524.408368-2-hdegoede@redhat.com +Acked-by: Takashi Iwai + +--- + drivers/leds/led-class.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c +index 6a8ea94834fa..7391d2cf1370 100644 +--- a/drivers/leds/led-class.c ++++ b/drivers/leds/led-class.c +@@ -241,8 +241,10 @@ struct led_classdev *of_led_get(struct device_node *np, int index) + + led_cdev = dev_get_drvdata(led_dev); + +- if (!try_module_get(led_cdev->dev->parent->driver->owner)) ++ if (!try_module_get(led_cdev->dev->parent->driver->owner)) { ++ put_device(led_cdev->dev); + return ERR_PTR(-ENODEV); ++ } + + return led_cdev; + } +@@ -255,6 +257,7 @@ EXPORT_SYMBOL_GPL(of_led_get); + void led_put(struct led_classdev *led_cdev) + { + module_put(led_cdev->dev->parent->driver->owner); ++ put_device(led_cdev->dev); + } + EXPORT_SYMBOL_GPL(led_put); + +-- +2.35.3 + diff --git a/patches.suse/leds-led-core-Fix-refcount-leak-in-of_led_get.patch b/patches.suse/leds-led-core-Fix-refcount-leak-in-of_led_get.patch new file mode 100644 index 0000000..abb399e --- /dev/null +++ b/patches.suse/leds-led-core-Fix-refcount-leak-in-of_led_get.patch @@ -0,0 +1,32 @@ +From da1afe8e6099980fe1e2fd7436dca284af9d3f29 Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Tue, 20 Dec 2022 16:18:07 +0400 +Subject: [PATCH] leds: led-core: Fix refcount leak in of_led_get() +Git-commit: da1afe8e6099980fe1e2fd7436dca284af9d3f29 +Patch-mainline: v6.3-rc1 +References: git-fixes + +class_find_device_by_of_node() calls class_find_device(), it will take +the reference, use the put_device() to drop the reference when not need +anymore. + +Fixes: 699a8c7c4bd3 ("leds: Add of_led_get() and led_put()") +Signed-off-by: Miaoqian Lin +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20221220121807.1543790-1-linmq006@gmail.com +Acked-by: Takashi Iwai + +--- + drivers/leds/led-class.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/leds/led-class.c ++++ b/drivers/leds/led-class.c +@@ -235,6 +235,7 @@ struct led_classdev *of_led_get(struct d + + led_dev = class_find_device_by_of_node(leds_class, led_node); + of_node_put(led_node); ++ put_device(led_dev); + + if (!led_dev) + return ERR_PTR(-EPROBE_DEFER); diff --git a/patches.suse/lib-mpi-Fix-buffer-overrun-when-SG-is-too-long.patch b/patches.suse/lib-mpi-Fix-buffer-overrun-when-SG-is-too-long.patch new file mode 100644 index 0000000..8e5dbe7 --- /dev/null +++ b/patches.suse/lib-mpi-Fix-buffer-overrun-when-SG-is-too-long.patch @@ -0,0 +1,40 @@ +From 7361d1bc307b926cbca214ab67b641123c2d6357 Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Tue, 27 Dec 2022 15:27:39 +0100 +Subject: [PATCH] lib/mpi: Fix buffer overrun when SG is too long +Git-commit: 7361d1bc307b926cbca214ab67b641123c2d6357 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The helper mpi_read_raw_from_sgl sets the number of entries in +the SG list according to nbytes. However, if the last entry +in the SG list contains more data than nbytes, then it may overrun +the buffer because it only allocates enough memory for nbytes. + +Fixes: 2d4d1eea540b ("lib/mpi: Add mpi sgl helpers") +Reported-by: Roberto Sassu +Signed-off-by: Herbert Xu +Reviewed-by: Eric Biggers +Acked-by: Takashi Iwai + +--- + lib/mpi/mpicoder.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c +index 39c4c6731094..3cb6bd148fa9 100644 +--- a/lib/mpi/mpicoder.c ++++ b/lib/mpi/mpicoder.c +@@ -504,7 +504,8 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes) + + while (sg_miter_next(&miter)) { + buff = miter.addr; +- len = miter.length; ++ len = min_t(unsigned, miter.length, nbytes); ++ nbytes -= len; + + for (x = 0; x < len; x++) { + a <<= 8; +-- +2.35.3 + diff --git a/patches.suse/lib-zlib-remove-redundation-assignement-of-avail_in-.patch b/patches.suse/lib-zlib-remove-redundation-assignement-of-avail_in-.patch new file mode 100644 index 0000000..a1cc57a --- /dev/null +++ b/patches.suse/lib-zlib-remove-redundation-assignement-of-avail_in-.patch @@ -0,0 +1,42 @@ +From e89bd9e7d8eb63a183040eaf0c9640fdb34ec47a Mon Sep 17 00:00:00 2001 +From: Tom Rix +Date: Sat, 28 Jan 2023 08:50:48 -0800 +Subject: [PATCH] lib/zlib: remove redundation assignement of avail_in dfltcc_gdht() +Git-commit: e89bd9e7d8eb63a183040eaf0c9640fdb34ec47a +Patch-mainline: v6.3-rc1 +References: git-fixes + +cppcheck reports +lib/zlib_dfltcc/dfltcc_deflate.c:65:21: warning: Redundant assignment of 'avail_in' to itself. [selfAssignment] + size_t avail_in = avail_in = strm->avail_in; + +Only setting avail_in once is needed. + +Link: https://lkml.kernel.org/r/20230128165048.1245792-1-trix@redhat.com +Fixes: aa5b395b69b6 ("lib/zlib: add s390 hardware support for kernel zlib_deflate") +Signed-off-by: Tom Rix +Acked-by: Ilya Leoshkevich +Acked-by: Mikhail Zaslonko +Signed-off-by: Andrew Morton +Acked-by: Takashi Iwai + +--- + lib/zlib_dfltcc/dfltcc_deflate.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/zlib_dfltcc/dfltcc_deflate.c b/lib/zlib_dfltcc/dfltcc_deflate.c +index 80924f067c24..b732b6d9e35d 100644 +--- a/lib/zlib_dfltcc/dfltcc_deflate.c ++++ b/lib/zlib_dfltcc/dfltcc_deflate.c +@@ -62,7 +62,7 @@ static void dfltcc_gdht( + { + deflate_state *state = (deflate_state *)strm->state; + struct dfltcc_param_v0 *param = &GET_DFLTCC_STATE(state)->param; +- size_t avail_in = avail_in = strm->avail_in; ++ size_t avail_in = strm->avail_in; + + dfltcc(DFLTCC_GDHT, + param, NULL, NULL, +-- +2.35.3 + diff --git a/patches.suse/locking-Add-missing-__sched-attributes.patch b/patches.suse/locking-Add-missing-__sched-attributes.patch new file mode 100644 index 0000000..b3ec012 --- /dev/null +++ b/patches.suse/locking-Add-missing-__sched-attributes.patch @@ -0,0 +1,67 @@ +From c441e934b604a3b5f350a9104124cf6a3ba07a34 Mon Sep 17 00:00:00 2001 +From: Minchan Kim +Date: Sat, 15 Jan 2022 15:16:57 -0800 +Subject: [PATCH] locking: Add missing __sched attributes +Git-commit: c441e934b604a3b5f350a9104124cf6a3ba07a34 +Patch-mainline: v5.18-rc1 +References: bsc#1207270 + +This patch adds __sched attributes to a few missing places +to show blocked function rather than locking function +in get_wchan. + +Signed-off-by: Minchan Kim +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20220115231657.84828-1-minchan@kernel.org +Signed-off-by: Jiri Wiesner +--- + kernel/locking/percpu-rwsem.c | 5 +++-- + kernel/locking/rwsem.c | 2 +- + 2 files changed, 4 insertions(+), 3 deletions(-) + +diff --git a/kernel/locking/percpu-rwsem.c b/kernel/locking/percpu-rwsem.c +index 70a32a576f3f..c9fdae94e098 100644 +--- a/kernel/locking/percpu-rwsem.c ++++ b/kernel/locking/percpu-rwsem.c +@@ -7,6 +7,7 @@ + #include + #include + #include ++#include + #include + + int __percpu_init_rwsem(struct percpu_rw_semaphore *sem, +@@ -162,7 +163,7 @@ static void percpu_rwsem_wait(struct percpu_rw_semaphore *sem, bool reader) + __set_current_state(TASK_RUNNING); + } + +-bool __percpu_down_read(struct percpu_rw_semaphore *sem, bool try) ++bool __sched __percpu_down_read(struct percpu_rw_semaphore *sem, bool try) + { + if (__percpu_down_read_trylock(sem)) + return true; +@@ -211,7 +212,7 @@ static bool readers_active_check(struct percpu_rw_semaphore *sem) + return true; + } + +-void percpu_down_write(struct percpu_rw_semaphore *sem) ++void __sched percpu_down_write(struct percpu_rw_semaphore *sem) + { + might_sleep(); + rwsem_acquire(&sem->dep_map, 0, 0, _RET_IP_); +diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c +index 69aba4abe104..acde5d6f1254 100644 +--- a/kernel/locking/rwsem.c ++++ b/kernel/locking/rwsem.c +@@ -1048,7 +1048,7 @@ rwsem_down_read_slowpath(struct rw_semaphore *sem, long count, unsigned int stat + /* + * Wait until we successfully acquire the write lock + */ +-static struct rw_semaphore * ++static struct rw_semaphore __sched * + rwsem_down_write_slowpath(struct rw_semaphore *sem, int state) + { + long count; +-- +2.35.3 + diff --git a/patches.suse/locking-rwsem-Allow-slowpath-writer-to-ignore-handof.patch b/patches.suse/locking-rwsem-Allow-slowpath-writer-to-ignore-handof.patch new file mode 100644 index 0000000..2f0a23d --- /dev/null +++ b/patches.suse/locking-rwsem-Allow-slowpath-writer-to-ignore-handof.patch @@ -0,0 +1,115 @@ +From 6eebd5fb20838f5971ba17df9f55cc4f84a31053 Mon Sep 17 00:00:00 2001 +From: Waiman Long +Date: Wed, 22 Jun 2022 16:04:19 -0400 +Subject: [PATCH] locking/rwsem: Allow slowpath writer to ignore handoff bit if + not set by first waiter +Git-commit: 6eebd5fb20838f5971ba17df9f55cc4f84a31053 +Patch-mainline: v5.19 +References: bsc#1207270 + +With commit d257cc8cb8d5 ("locking/rwsem: Make handoff bit handling more +consistent"), the writer that sets the handoff bit can be interrupted +out without clearing the bit if the wait queue isn't empty. This disables +reader and writer optimistic lock spinning and stealing. + +Now if a non-first writer in the queue is somehow woken up or a new +waiter enters the slowpath, it can't acquire the lock. This is not the +case before commit d257cc8cb8d5 as the writer that set the handoff bit +will clear it when exiting out via the out_nolock path. This is less +efficient as the busy rwsem stays in an unlock state for a longer time. + +In some cases, this new behavior may cause lockups as shown in [1] and +[2]. + +This patch allows a non-first writer to ignore the handoff bit if it +is not originally set or initiated by the first waiter. This patch is +shown to be effective in fixing the lockup problem reported in [1]. + +[1] https://lore.kernel.org/lkml/20220617134325.GC30825@techsingularity.net/ +[2] https://lore.kernel.org/lkml/3f02975c-1a9d-be20-32cf-f1d8e3dfafcc@oracle.com/ + +Fixes: d257cc8cb8d5 ("locking/rwsem: Make handoff bit handling more consistent") +Signed-off-by: Waiman Long +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: John Donnelly +Tested-by: Mel Gorman +Link: https://lore.kernel.org/r/20220622200419.778799-1-longman@redhat.com +Signed-off-by: Jiri Wiesner +--- + kernel/locking/rwsem.c | 30 ++++++++++++++++++++---------- + 1 file changed, 20 insertions(+), 10 deletions(-) + +diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c +index 9d1db4a54d34..65f0262f635e 100644 +--- a/kernel/locking/rwsem.c ++++ b/kernel/locking/rwsem.c +@@ -335,8 +335,6 @@ struct rwsem_waiter { + struct task_struct *task; + enum rwsem_waiter_type type; + unsigned long timeout; +- +- /* Writer only, not initialized in reader */ + bool handoff_set; + }; + #define rwsem_first_waiter(sem) \ +@@ -459,10 +457,12 @@ static void rwsem_mark_wake(struct rw_semaphore *sem, + * to give up the lock), request a HANDOFF to + * force the issue. + */ +- if (!(oldcount & RWSEM_FLAG_HANDOFF) && +- time_after(jiffies, waiter->timeout)) { +- adjustment -= RWSEM_FLAG_HANDOFF; +- lockevent_inc(rwsem_rlock_handoff); ++ if (time_after(jiffies, waiter->timeout)) { ++ if (!(oldcount & RWSEM_FLAG_HANDOFF)) { ++ adjustment -= RWSEM_FLAG_HANDOFF; ++ lockevent_inc(rwsem_rlock_handoff); ++ } ++ waiter->handoff_set = true; + } + + atomic_long_add(-adjustment, &sem->count); +@@ -599,7 +599,7 @@ rwsem_del_wake_waiter(struct rw_semaphore *sem, struct rwsem_waiter *waiter, + static inline bool rwsem_try_write_lock(struct rw_semaphore *sem, + struct rwsem_waiter *waiter) + { +- bool first = rwsem_first_waiter(sem) == waiter; ++ struct rwsem_waiter *first = rwsem_first_waiter(sem); + long count, new; + + lockdep_assert_held(&sem->wait_lock); +@@ -609,11 +609,20 @@ static inline bool rwsem_try_write_lock(struct rw_semaphore *sem, + bool has_handoff = !!(count & RWSEM_FLAG_HANDOFF); + + if (has_handoff) { +- if (!first) ++ /* ++ * Honor handoff bit and yield only when the first ++ * waiter is the one that set it. Otherwisee, we ++ * still try to acquire the rwsem. ++ */ ++ if (first->handoff_set && (waiter != first)) + return false; + +- /* First waiter inherits a previously set handoff bit */ +- waiter->handoff_set = true; ++ /* ++ * First waiter can inherit a previously set handoff ++ * bit and spin on rwsem if lock acquisition fails. ++ */ ++ if (waiter == first) ++ waiter->handoff_set = true; + } + + new = count; +@@ -1027,6 +1036,7 @@ rwsem_down_read_slowpath(struct rw_semaphore *sem, long count, unsigned int stat + waiter.task = current; + waiter.type = RWSEM_WAITING_FOR_READ; + waiter.timeout = jiffies + RWSEM_WAIT_TIMEOUT; ++ waiter.handoff_set = false; + + raw_spin_lock_irq(&sem->wait_lock); + if (list_empty(&sem->wait_list)) { +-- +2.35.3 + diff --git a/patches.suse/locking-rwsem-Always-try-to-wake-waiters-in-out_nolo.patch b/patches.suse/locking-rwsem-Always-try-to-wake-waiters-in-out_nolo.patch new file mode 100644 index 0000000..cc88f3c --- /dev/null +++ b/patches.suse/locking-rwsem-Always-try-to-wake-waiters-in-out_nolo.patch @@ -0,0 +1,123 @@ +From 1ee326196c66583006b0c95356a4b7dc51bf3531 Mon Sep 17 00:00:00 2001 +From: Waiman Long +Date: Tue, 22 Mar 2022 11:20:59 -0400 +Subject: [PATCH] locking/rwsem: Always try to wake waiters in out_nolock path +Git-commit: 1ee326196c66583006b0c95356a4b7dc51bf3531 +Patch-mainline: v5.19-rc1 +References: bsc#1207270 + +For writers, the out_nolock path will always attempt to wake up waiters. +This may not be really necessary if the waiter to be removed is not the +first one. + +For readers, no attempt to wake up waiter is being made. However, if +the HANDOFF bit is set and the reader to be removed is the first waiter, +the waiter behind it will inherit the HANDOFF bit and for a write lock +waiter waking it up will allow it to spin on the lock to acquire it +faster. So it can be beneficial to do a wakeup in this case. + +Add a new rwsem_del_wake_waiter() helper function to do that consistently +for both reader and writer out_nolock paths. + +Signed-off-by: Waiman Long +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20220322152059.2182333-4-longman@redhat.com +Signed-off-by: Jiri Wiesner +--- + kernel/locking/rwsem.c | 44 ++++++++++++++++++++++++++++++++---------- + 1 file changed, 34 insertions(+), 10 deletions(-) + +diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c +index 03cb97a8e4cd..16b532bb5b92 100644 +--- a/kernel/locking/rwsem.c ++++ b/kernel/locking/rwsem.c +@@ -375,16 +375,19 @@ rwsem_add_waiter(struct rw_semaphore *sem, struct rwsem_waiter *waiter) + * + * Both rwsem_mark_wake() and rwsem_try_write_lock() contain a full 'copy' of + * this function. Modify with care. ++ * ++ * Return: true if wait_list isn't empty and false otherwise + */ +-static inline void ++static inline bool + rwsem_del_waiter(struct rw_semaphore *sem, struct rwsem_waiter *waiter) + { + lockdep_assert_held(&sem->wait_lock); + list_del(&waiter->list); + if (likely(!list_empty(&sem->wait_list))) +- return; ++ return true; + + atomic_long_andnot(RWSEM_FLAG_HANDOFF | RWSEM_FLAG_WAITERS, &sem->count); ++ return false; + } + + /* +@@ -558,6 +561,33 @@ static void rwsem_mark_wake(struct rw_semaphore *sem, + } + } + ++/* ++ * Remove a waiter and try to wake up other waiters in the wait queue ++ * This function is called from the out_nolock path of both the reader and ++ * writer slowpaths with wait_lock held. It releases the wait_lock and ++ * optionally wake up waiters before it returns. ++ */ ++static inline void ++rwsem_del_wake_waiter(struct rw_semaphore *sem, struct rwsem_waiter *waiter, ++ struct wake_q_head *wake_q) ++ __releases(&sem->wait_lock) ++{ ++ bool first = rwsem_first_waiter(sem) == waiter; ++ ++ wake_q_init(wake_q); ++ ++ /* ++ * If the wait_list isn't empty and the waiter to be deleted is ++ * the first waiter, we wake up the remaining waiters as they may ++ * be eligible to acquire or spin on the lock. ++ */ ++ if (rwsem_del_waiter(sem, waiter) && first) ++ rwsem_mark_wake(sem, RWSEM_WAKE_ANY, wake_q); ++ raw_spin_unlock_irq(&sem->wait_lock); ++ if (!wake_q_empty(wake_q)) ++ wake_up_q(wake_q); ++} ++ + /* + * This function must be called with the sem->wait_lock held to prevent + * race conditions between checking the rwsem wait list and setting the +@@ -1050,8 +1080,7 @@ rwsem_down_read_slowpath(struct rw_semaphore *sem, long count, unsigned int stat + return sem; + + out_nolock: +- rwsem_del_waiter(sem, &waiter); +- raw_spin_unlock_irq(&sem->wait_lock); ++ rwsem_del_wake_waiter(sem, &waiter, &wake_q); + __set_current_state(TASK_RUNNING); + lockevent_inc(rwsem_rlock_fail); + return ERR_PTR(-EINTR); +@@ -1095,7 +1124,6 @@ rwsem_down_write_slowpath(struct rw_semaphore *sem, int state) + */ + raw_spin_unlock_irq(&sem->wait_lock); + wake_up_q(&wake_q); +- wake_q_init(&wake_q); /* Used again, reinit */ + raw_spin_lock_irq(&sem->wait_lock); + } + } else { +@@ -1148,11 +1176,7 @@ rwsem_down_write_slowpath(struct rw_semaphore *sem, int state) + out_nolock: + __set_current_state(TASK_RUNNING); + raw_spin_lock_irq(&sem->wait_lock); +- rwsem_del_waiter(sem, &waiter); +- if (!list_empty(&sem->wait_list)) +- rwsem_mark_wake(sem, RWSEM_WAKE_ANY, &wake_q); +- raw_spin_unlock_irq(&sem->wait_lock); +- wake_up_q(&wake_q); ++ rwsem_del_wake_waiter(sem, &waiter, &wake_q); + lockevent_inc(rwsem_wlock_fail); + return ERR_PTR(-EINTR); + } +-- +2.35.3 + diff --git a/patches.suse/locking-rwsem-Conditionally-wake-waiters-in-reader-w.patch b/patches.suse/locking-rwsem-Conditionally-wake-waiters-in-reader-w.patch new file mode 100644 index 0000000..167529f --- /dev/null +++ b/patches.suse/locking-rwsem-Conditionally-wake-waiters-in-reader-w.patch @@ -0,0 +1,154 @@ +From 54c1ee4d614d52844cf24c46d8415bf1392021d0 Mon Sep 17 00:00:00 2001 +From: Waiman Long +Date: Tue, 22 Mar 2022 11:20:58 -0400 +Subject: [PATCH] locking/rwsem: Conditionally wake waiters in reader/writer + slowpaths +Git-commit: 54c1ee4d614d52844cf24c46d8415bf1392021d0 +Patch-mainline: v5.19-rc1 +References: bsc#1207270 + +In an analysis of a recent vmcore, a reader-owned rwsem was found with +385 readers but no writer in the wait queue. That is kind of unusual +but it may be caused by some race conditions that we have not fully +understood yet. In such a case, all the readers in the wait queue should +join the other reader-owners and acquire the read lock. + +In rwsem_down_write_slowpath(), an incoming writer will try to +wake up the front readers under such circumstance. That is not +the case for rwsem_down_read_slowpath(), add a new helper function +rwsem_cond_wake_waiter() to do wakeup and use it in both reader and +writer slowpaths to have a consistent and correct behavior. + +Signed-off-by: Waiman Long +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20220322152059.2182333-3-longman@redhat.com +Signed-off-by: Jiri Wiesner +--- + kernel/locking/rwsem.c | 68 ++++++++++++++++++++---------------------- + 1 file changed, 32 insertions(+), 36 deletions(-) + +diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c +index b077b1b2d4b3..03cb97a8e4cd 100644 +--- a/kernel/locking/rwsem.c ++++ b/kernel/locking/rwsem.c +@@ -901,7 +901,7 @@ static bool rwsem_optimistic_spin(struct rw_semaphore *sem) + */ + static inline void clear_nonspinnable(struct rw_semaphore *sem) + { +- if (rwsem_test_oflags(sem, RWSEM_NONSPINNABLE)) ++ if (unlikely(rwsem_test_oflags(sem, RWSEM_NONSPINNABLE))) + atomic_long_andnot(RWSEM_NONSPINNABLE, &sem->owner); + } + +@@ -925,6 +925,31 @@ rwsem_spin_on_owner(struct rw_semaphore *sem) + } + #endif + ++/* ++ * Prepare to wake up waiter(s) in the wait queue by putting them into the ++ * given wake_q if the rwsem lock owner isn't a writer. If rwsem is likely ++ * reader-owned, wake up read lock waiters in queue front or wake up any ++ * front waiter otherwise. ++ ++ * This is being called from both reader and writer slow paths. ++ */ ++static inline void rwsem_cond_wake_waiter(struct rw_semaphore *sem, long count, ++ struct wake_q_head *wake_q) ++{ ++ enum rwsem_wake_type wake_type; ++ ++ if (count & RWSEM_WRITER_MASK) ++ return; ++ ++ if (count & RWSEM_READER_MASK) { ++ wake_type = RWSEM_WAKE_READERS; ++ } else { ++ wake_type = RWSEM_WAKE_ANY; ++ clear_nonspinnable(sem); ++ } ++ rwsem_mark_wake(sem, wake_type, wake_q); ++} ++ + /* + * Wait for the read lock to be granted + */ +@@ -935,7 +960,6 @@ rwsem_down_read_slowpath(struct rw_semaphore *sem, long count, unsigned int stat + long rcnt = (count >> RWSEM_READER_SHIFT); + struct rwsem_waiter waiter; + DEFINE_WAKE_Q(wake_q); +- bool wake = false; + + /* + * To prevent a constant stream of readers from starving a sleeping +@@ -996,22 +1020,11 @@ rwsem_down_read_slowpath(struct rw_semaphore *sem, long count, unsigned int stat + /* we're now waiting on the lock, but no longer actively locking */ + count = atomic_long_add_return(adjustment, &sem->count); + +- /* +- * If there are no active locks, wake the front queued process(es). +- * +- * If there are no writers and we are first in the queue, +- * wake our own waiter to join the existing active readers ! +- */ +- if (!(count & RWSEM_LOCK_MASK)) { +- clear_nonspinnable(sem); +- wake = true; +- } +- if (wake || (!(count & RWSEM_WRITER_MASK) && +- (adjustment & RWSEM_FLAG_WAITERS))) +- rwsem_mark_wake(sem, RWSEM_WAKE_ANY, &wake_q); +- ++ rwsem_cond_wake_waiter(sem, count, &wake_q); + raw_spin_unlock_irq(&sem->wait_lock); +- wake_up_q(&wake_q); ++ ++ if (!wake_q_empty(&wake_q)) ++ wake_up_q(&wake_q); + + /* wait to be given the lock */ + for (;;) { +@@ -1050,7 +1063,6 @@ rwsem_down_read_slowpath(struct rw_semaphore *sem, long count, unsigned int stat + static struct rw_semaphore __sched * + rwsem_down_write_slowpath(struct rw_semaphore *sem, int state) + { +- long count; + struct rwsem_waiter waiter; + DEFINE_WAKE_Q(wake_q); + +@@ -1074,23 +1086,8 @@ rwsem_down_write_slowpath(struct rw_semaphore *sem, int state) + + /* we're now waiting on the lock */ + if (rwsem_first_waiter(sem) != &waiter) { +- count = atomic_long_read(&sem->count); +- +- /* +- * If there were already threads queued before us and: +- * 1) there are no active locks, wake the front +- * queued process(es) as the handoff bit might be set. +- * 2) there are no active writers and some readers, the lock +- * must be read owned; so we try to wake any read lock +- * waiters that were queued ahead of us. +- */ +- if (count & RWSEM_WRITER_MASK) +- goto wait; +- +- rwsem_mark_wake(sem, (count & RWSEM_READER_MASK) +- ? RWSEM_WAKE_READERS +- : RWSEM_WAKE_ANY, &wake_q); +- ++ rwsem_cond_wake_waiter(sem, atomic_long_read(&sem->count), ++ &wake_q); + if (!wake_q_empty(&wake_q)) { + /* + * We want to minimize wait_lock hold time especially +@@ -1105,7 +1102,6 @@ rwsem_down_write_slowpath(struct rw_semaphore *sem, int state) + atomic_long_or(RWSEM_FLAG_WAITERS, &sem->count); + } + +-wait: + /* wait until we successfully acquire the lock */ + set_current_state(state); + for (;;) { +-- +2.35.3 + diff --git a/patches.suse/locking-rwsem-Disable-preemption-in-all-down_read-an.patch b/patches.suse/locking-rwsem-Disable-preemption-in-all-down_read-an.patch new file mode 100644 index 0000000..be77d93 --- /dev/null +++ b/patches.suse/locking-rwsem-Disable-preemption-in-all-down_read-an.patch @@ -0,0 +1,134 @@ +From 3f5245538a1964ae186ab7e1636020a41aa63143 Mon Sep 17 00:00:00 2001 +From: Waiman Long +Date: Wed, 25 Jan 2023 19:36:26 -0500 +Subject: [PATCH] locking/rwsem: Disable preemption in all down_read*() and + up_read() code paths +Git-commit: 3f5245538a1964ae186ab7e1636020a41aa63143 +Patch-mainline: v6.3-rc1 +References: bsc#1207270 + +Commit: + + 91d2a812dfb9 ("locking/rwsem: Make handoff writer optimistically spin on owner") + +... assumes that when the owner field is changed to NULL, the lock will +become free soon. But commit: + + 48dfb5d2560d ("locking/rwsem: Disable preemption while trying for rwsem lock") + +... disabled preemption when acquiring rwsem for write. + +However, preemption has not yet been disabled when acquiring a read lock +on a rwsem. So a reader can add a RWSEM_READER_BIAS to count without +setting owner to signal a reader, got preempted out by a RT task which +then spins in the writer slowpath as owner remains NULL leading to live lock. + +One easy way to fix this problem is to disable preemption at all the +down_read*() and up_read() code paths as implemented in this patch. + +Fixes: 91d2a812dfb9 ("locking/rwsem: Make handoff writer optimistically spin on owner") +Reported-by: Mukesh Ojha +Suggested-by: Peter Zijlstra +Signed-off-by: Waiman Long +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20230126003628.365092-3-longman@redhat.com +Signed-off-by: Jiri Wiesner +--- + kernel/locking/rwsem.c | 30 ++++++++++++++++++++++++------ + 1 file changed, 24 insertions(+), 6 deletions(-) + +diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c +index be2df9ea7c30..84d5b649b95f 100644 +--- a/kernel/locking/rwsem.c ++++ b/kernel/locking/rwsem.c +@@ -1091,7 +1091,7 @@ rwsem_down_read_slowpath(struct rw_semaphore *sem, long count, unsigned int stat + /* Ordered by sem->wait_lock against rwsem_mark_wake(). */ + break; + } +- schedule(); ++ schedule_preempt_disabled(); + lockevent_inc(rwsem_sleep_reader); + } + +@@ -1253,14 +1253,20 @@ static struct rw_semaphore *rwsem_downgrade_wake(struct rw_semaphore *sem) + */ + static inline int __down_read_common(struct rw_semaphore *sem, int state) + { ++ int ret = 0; + long count; + ++ preempt_disable(); + if (!rwsem_read_trylock(sem, &count)) { +- if (IS_ERR(rwsem_down_read_slowpath(sem, count, state))) +- return -EINTR; ++ if (IS_ERR(rwsem_down_read_slowpath(sem, count, state))) { ++ ret = -EINTR; ++ goto out; ++ } + DEBUG_RWSEMS_WARN_ON(!is_rwsem_reader_owned(sem), sem); + } +- return 0; ++out: ++ preempt_enable(); ++ return ret; + } + + static inline void __down_read(struct rw_semaphore *sem) +@@ -1280,19 +1286,23 @@ static inline int __down_read_killable(struct rw_semaphore *sem) + + static inline int __down_read_trylock(struct rw_semaphore *sem) + { ++ int ret = 0; + long tmp; + + DEBUG_RWSEMS_WARN_ON(sem->magic != sem, sem); + ++ preempt_disable(); + tmp = atomic_long_read(&sem->count); + while (!(tmp & RWSEM_READ_FAILED_MASK)) { + if (atomic_long_try_cmpxchg_acquire(&sem->count, &tmp, + tmp + RWSEM_READER_BIAS)) { + rwsem_set_reader_owned(sem); +- return 1; ++ ret = 1; ++ break; + } + } +- return 0; ++ preempt_enable(); ++ return ret; + } + + /* +@@ -1334,6 +1344,7 @@ static inline void __up_read(struct rw_semaphore *sem) + DEBUG_RWSEMS_WARN_ON(sem->magic != sem, sem); + DEBUG_RWSEMS_WARN_ON(!is_rwsem_reader_owned(sem), sem); + ++ preempt_disable(); + rwsem_clear_reader_owned(sem); + tmp = atomic_long_add_return_release(-RWSEM_READER_BIAS, &sem->count); + DEBUG_RWSEMS_WARN_ON(tmp < 0, sem); +@@ -1342,6 +1353,7 @@ static inline void __up_read(struct rw_semaphore *sem) + clear_nonspinnable(sem); + rwsem_wake(sem); + } ++ preempt_enable(); + } + + /* +@@ -1661,6 +1673,12 @@ void down_read_non_owner(struct rw_semaphore *sem) + { + might_sleep(); + __down_read(sem); ++ /* ++ * The owner value for a reader-owned lock is mostly for debugging ++ * purpose only and is not critical to the correct functioning of ++ * rwsem. So it is perfectly fine to set it in a preempt-enabled ++ * context here. ++ */ + __rwsem_set_reader_owned(sem, NULL); + } + EXPORT_SYMBOL(down_read_non_owner); +-- +2.35.3 + diff --git a/patches.suse/locking-rwsem-Disable-preemption-in-all-down_write-a.patch b/patches.suse/locking-rwsem-Disable-preemption-in-all-down_write-a.patch new file mode 100644 index 0000000..bc031cb --- /dev/null +++ b/patches.suse/locking-rwsem-Disable-preemption-in-all-down_write-a.patch @@ -0,0 +1,162 @@ +From 1d61659ced6bd8881cf2fb5cbcb28f9541fc7430 Mon Sep 17 00:00:00 2001 +From: Waiman Long +Date: Wed, 25 Jan 2023 19:36:27 -0500 +Subject: [PATCH] locking/rwsem: Disable preemption in all down_write*() and + up_write() code paths +Git-commit: 1d61659ced6bd8881cf2fb5cbcb28f9541fc7430 +Patch-mainline: v6.3-rc1 +References: bsc#1207270 + +The previous patch has disabled preemption in all the down_read() and +up_read() code paths. For symmetry, this patch extends commit: + + 48dfb5d2560d ("locking/rwsem: Disable preemption while trying for rwsem lock") + +... to have preemption disabled in all the down_write() and up_write() +code paths, including downgrade_write(). + +Suggested-by: Peter Zijlstra +Signed-off-by: Waiman Long +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20230126003628.365092-4-longman@redhat.com +Signed-off-by: Jiri Wiesner +--- + kernel/locking/rwsem.c | 38 +++++++++++++++++++------------------- + 1 file changed, 19 insertions(+), 19 deletions(-) + +diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c +index 84d5b649b95f..acb5a50309a1 100644 +--- a/kernel/locking/rwsem.c ++++ b/kernel/locking/rwsem.c +@@ -256,16 +256,13 @@ static inline bool rwsem_read_trylock(struct rw_semaphore *sem, long *cntp) + static inline bool rwsem_write_trylock(struct rw_semaphore *sem) + { + long tmp = RWSEM_UNLOCKED_VALUE; +- bool ret = false; + +- preempt_disable(); + if (atomic_long_try_cmpxchg_acquire(&sem->count, &tmp, RWSEM_WRITER_LOCKED)) { + rwsem_set_owner(sem); +- ret = true; ++ return true; + } + +- preempt_enable(); +- return ret; ++ return false; + } + + /* +@@ -716,7 +713,6 @@ static inline bool rwsem_can_spin_on_owner(struct rw_semaphore *sem) + return false; + } + +- preempt_disable(); + /* + * Disable preemption is equal to the RCU read-side crital section, + * thus the task_strcut structure won't go away. +@@ -728,7 +724,6 @@ static inline bool rwsem_can_spin_on_owner(struct rw_semaphore *sem) + if ((flags & RWSEM_NONSPINNABLE) || + (owner && !(flags & RWSEM_READER_OWNED) && !owner_on_cpu(owner))) + ret = false; +- preempt_enable(); + + lockevent_cond_inc(rwsem_opt_fail, !ret); + return ret; +@@ -828,8 +823,6 @@ static bool rwsem_optimistic_spin(struct rw_semaphore *sem) + int loop = 0; + u64 rspin_threshold = 0; + +- preempt_disable(); +- + /* sem->wait_lock should not be held when doing optimistic spinning */ + if (!osq_lock(&sem->osq)) + goto done; +@@ -937,7 +930,6 @@ static bool rwsem_optimistic_spin(struct rw_semaphore *sem) + } + osq_unlock(&sem->osq); + done: +- preempt_enable(); + lockevent_cond_inc(rwsem_opt_fail, !taken); + return taken; + } +@@ -1178,15 +1170,12 @@ rwsem_down_write_slowpath(struct rw_semaphore *sem, int state) + if (waiter.handoff_set) { + enum owner_state owner_state; + +- preempt_disable(); + owner_state = rwsem_spin_on_owner(sem); +- preempt_enable(); +- + if (owner_state == OWNER_NULL) + goto trylock_again; + } + +- schedule(); ++ schedule_preempt_disabled(); + lockevent_inc(rwsem_sleep_writer); + set_current_state(state); + trylock_again: +@@ -1310,12 +1299,15 @@ static inline int __down_read_trylock(struct rw_semaphore *sem) + */ + static inline int __down_write_common(struct rw_semaphore *sem, int state) + { ++ int ret = 0; ++ ++ preempt_disable(); + if (unlikely(!rwsem_write_trylock(sem))) { + if (IS_ERR(rwsem_down_write_slowpath(sem, state))) +- return -EINTR; ++ ret = -EINTR; + } +- +- return 0; ++ preempt_enable(); ++ return ret; + } + + static inline void __down_write(struct rw_semaphore *sem) +@@ -1330,8 +1322,14 @@ static inline int __down_write_killable(struct rw_semaphore *sem) + + static inline int __down_write_trylock(struct rw_semaphore *sem) + { ++ int ret; ++ ++ preempt_disable(); + DEBUG_RWSEMS_WARN_ON(sem->magic != sem, sem); +- return rwsem_write_trylock(sem); ++ ret = rwsem_write_trylock(sem); ++ preempt_enable(); ++ ++ return ret; + } + + /* +@@ -1374,9 +1372,9 @@ static inline void __up_write(struct rw_semaphore *sem) + preempt_disable(); + rwsem_clear_owner(sem); + tmp = atomic_long_fetch_add_release(-RWSEM_WRITER_LOCKED, &sem->count); +- preempt_enable(); + if (unlikely(tmp & RWSEM_FLAG_WAITERS)) + rwsem_wake(sem); ++ preempt_enable(); + } + + /* +@@ -1394,11 +1392,13 @@ static inline void __downgrade_write(struct rw_semaphore *sem) + * write side. As such, rely on RELEASE semantics. + */ + DEBUG_RWSEMS_WARN_ON(rwsem_owner(sem) != current, sem); ++ preempt_disable(); + tmp = atomic_long_fetch_add_release( + -RWSEM_WRITER_LOCKED+RWSEM_READER_BIAS, &sem->count); + rwsem_set_reader_owned(sem); + if (tmp & RWSEM_FLAG_WAITERS) + rwsem_downgrade_wake(sem); ++ preempt_enable(); + } + + #else /* !CONFIG_PREEMPT_RT */ +-- +2.35.3 + diff --git a/patches.suse/locking-rwsem-Disable-preemption-while-trying-for-rw.patch b/patches.suse/locking-rwsem-Disable-preemption-while-trying-for-rw.patch new file mode 100644 index 0000000..d776173 --- /dev/null +++ b/patches.suse/locking-rwsem-Disable-preemption-while-trying-for-rw.patch @@ -0,0 +1,95 @@ +From 48dfb5d2560d36fb16c7d430c229d1604ea7d185 Mon Sep 17 00:00:00 2001 +From: Gokul krishna Krishnakumar +Date: Thu, 8 Sep 2022 23:54:27 +0530 +Subject: [PATCH] locking/rwsem: Disable preemption while trying for rwsem lock +Git-commit: 48dfb5d2560d36fb16c7d430c229d1604ea7d185 +Patch-mainline: v6.1-rc1 +References: bsc#1207270 + +Make the region inside the rwsem_write_trylock non preemptible. + +We observe RT task is hogging CPU when trying to acquire rwsem lock +which was acquired by a kworker task but before the rwsem owner was set. + +Here is the scenario: +1. CFS task (affined to a particular CPU) takes rwsem lock. + +2. CFS task gets preempted by a RT task before setting owner. + +3. RT task (FIFO) is trying to acquire the lock, but spinning until +RT throttling happens for the lock as the lock was taken by CFS task. + +This patch attempts to fix the above issue by disabling preemption +until owner is set for the lock. While at it also fix the issues +at the places where rwsem_{set,clear}_owner() are called. + +This also adds lockdep annotation of preemption disable in +rwsem_{set,clear}_owner() on Peter Z. suggestion. + +Signed-off-by: Gokul krishna Krishnakumar +Signed-off-by: Mukesh Ojha +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Waiman Long +Link: https://lore.kernel.org/r/1662661467-24203-1-git-send-email-quic_mojha@quicinc.com +Signed-off-by: Jiri Wiesner +--- + kernel/locking/rwsem.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c +index 65f0262f635e..44873594de03 100644 +--- a/kernel/locking/rwsem.c ++++ b/kernel/locking/rwsem.c +@@ -133,14 +133,19 @@ + * the owner value concurrently without lock. Read from owner, however, + * may not need READ_ONCE() as long as the pointer value is only used + * for comparison and isn't being dereferenced. ++ * ++ * Both rwsem_{set,clear}_owner() functions should be in the same ++ * preempt disable section as the atomic op that changes sem->count. + */ + static inline void rwsem_set_owner(struct rw_semaphore *sem) + { ++ lockdep_assert_preemption_disabled(); + atomic_long_set(&sem->owner, (long)current); + } + + static inline void rwsem_clear_owner(struct rw_semaphore *sem) + { ++ lockdep_assert_preemption_disabled(); + atomic_long_set(&sem->owner, 0); + } + +@@ -251,13 +256,16 @@ static inline bool rwsem_read_trylock(struct rw_semaphore *sem, long *cntp) + static inline bool rwsem_write_trylock(struct rw_semaphore *sem) + { + long tmp = RWSEM_UNLOCKED_VALUE; ++ bool ret = false; + ++ preempt_disable(); + if (atomic_long_try_cmpxchg_acquire(&sem->count, &tmp, RWSEM_WRITER_LOCKED)) { + rwsem_set_owner(sem); +- return true; ++ ret = true; + } + +- return false; ++ preempt_enable(); ++ return ret; + } + + /* +@@ -1352,8 +1360,10 @@ static inline void __up_write(struct rw_semaphore *sem) + DEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && + !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE), sem); + ++ preempt_disable(); + rwsem_clear_owner(sem); + tmp = atomic_long_fetch_add_release(-RWSEM_WRITER_LOCKED, &sem->count); ++ preempt_enable(); + if (unlikely(tmp & RWSEM_FLAG_WAITERS)) + rwsem_wake(sem); + } +-- +2.35.3 + diff --git a/patches.suse/locking-rwsem-Make-handoff-bit-handling-more-consist.patch b/patches.suse/locking-rwsem-Make-handoff-bit-handling-more-consist.patch new file mode 100644 index 0000000..30b2653 --- /dev/null +++ b/patches.suse/locking-rwsem-Make-handoff-bit-handling-more-consist.patch @@ -0,0 +1,380 @@ +From d257cc8cb8d5355ffc43a96bab94db7b5a324803 Mon Sep 17 00:00:00 2001 +From: Waiman Long +Date: Mon, 15 Nov 2021 20:29:12 -0500 +Subject: [PATCH] locking/rwsem: Make handoff bit handling more consistent +Git-commit: d257cc8cb8d5355ffc43a96bab94db7b5a324803 +Patch-mainline: v5.16-rc3 +References: bsc#1207270 + +There are some inconsistency in the way that the handoff bit is being +handled in readers and writers that lead to a race condition. + +Firstly, when a queue head writer set the handoff bit, it will clear +it when the writer is being killed or interrupted on its way out +without acquiring the lock. That is not the case for a queue head +reader. The handoff bit will simply be inherited by the next waiter. + +Secondly, in the out_nolock path of rwsem_down_read_slowpath(), both +the waiter and handoff bits are cleared if the wait queue becomes +empty. For rwsem_down_write_slowpath(), however, the handoff bit is +not checked and cleared if the wait queue is empty. This can +potentially make the handoff bit set with empty wait queue. + +Worse, the situation in rwsem_down_write_slowpath() relies on wstate, +a variable set outside of the critical section containing the ->count +manipulation, this leads to race condition where RWSEM_FLAG_HANDOFF +can be double subtracted, corrupting ->count. + +To make the handoff bit handling more consistent and robust, extract +out handoff bit clearing code into the new rwsem_del_waiter() helper +function. Also, completely eradicate wstate; always evaluate +everything inside the same critical section. + +The common function will only use atomic_long_andnot() to clear bits +when the wait queue is empty to avoid possible race condition. If the +first waiter with handoff bit set is killed or interrupted to exit the +slowpath without acquiring the lock, the next waiter will inherit the +handoff bit. + +While at it, simplify the trylock for loop in +rwsem_down_write_slowpath() to make it easier to read. + +Fixes: 4f23dbc1e657 ("locking/rwsem: Implement lock handoff to prevent lock starvation") +Reported-by: Zhenhua Ma +Suggested-by: Peter Zijlstra +Signed-off-by: Waiman Long +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20211116012912.723980-1-longman@redhat.com +Signed-off-by: Jiri Wiesner +--- + kernel/locking/rwsem.c | 171 ++++++++++++++++++++--------------------- + 1 file changed, 85 insertions(+), 86 deletions(-) + +diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c +index c51387a43265..e039cf1605af 100644 +--- a/kernel/locking/rwsem.c ++++ b/kernel/locking/rwsem.c +@@ -105,9 +105,9 @@ + * atomic_long_cmpxchg() will be used to obtain writer lock. + * + * There are three places where the lock handoff bit may be set or cleared. +- * 1) rwsem_mark_wake() for readers. +- * 2) rwsem_try_write_lock() for writers. +- * 3) Error path of rwsem_down_write_slowpath(). ++ * 1) rwsem_mark_wake() for readers -- set, clear ++ * 2) rwsem_try_write_lock() for writers -- set, clear ++ * 3) rwsem_del_waiter() -- clear + * + * For all the above cases, wait_lock will be held. A writer must also + * be the first one in the wait_list to be eligible for setting the handoff +@@ -334,6 +334,9 @@ struct rwsem_waiter { + struct task_struct *task; + enum rwsem_waiter_type type; + unsigned long timeout; ++ ++ /* Writer only, not initialized in reader */ ++ bool handoff_set; + }; + #define rwsem_first_waiter(sem) \ + list_first_entry(&sem->wait_list, struct rwsem_waiter, list) +@@ -344,12 +347,6 @@ enum rwsem_wake_type { + RWSEM_WAKE_READ_OWNED /* Waker thread holds the read lock */ + }; + +-enum writer_wait_state { +- WRITER_NOT_FIRST, /* Writer is not first in wait list */ +- WRITER_FIRST, /* Writer is first in wait list */ +- WRITER_HANDOFF /* Writer is first & handoff needed */ +-}; +- + /* + * The typical HZ value is either 250 or 1000. So set the minimum waiting + * time to at least 4ms or 1 jiffy (if it is higher than 4ms) in the wait +@@ -365,6 +362,31 @@ enum writer_wait_state { + */ + #define MAX_READERS_WAKEUP 0x100 + ++static inline void ++rwsem_add_waiter(struct rw_semaphore *sem, struct rwsem_waiter *waiter) ++{ ++ lockdep_assert_held(&sem->wait_lock); ++ list_add_tail(&waiter->list, &sem->wait_list); ++ /* caller will set RWSEM_FLAG_WAITERS */ ++} ++ ++/* ++ * Remove a waiter from the wait_list and clear flags. ++ * ++ * Both rwsem_mark_wake() and rwsem_try_write_lock() contain a full 'copy' of ++ * this function. Modify with care. ++ */ ++static inline void ++rwsem_del_waiter(struct rw_semaphore *sem, struct rwsem_waiter *waiter) ++{ ++ lockdep_assert_held(&sem->wait_lock); ++ list_del(&waiter->list); ++ if (likely(!list_empty(&sem->wait_list))) ++ return; ++ ++ atomic_long_andnot(RWSEM_FLAG_HANDOFF | RWSEM_FLAG_WAITERS, &sem->count); ++} ++ + /* + * handle the lock release when processes blocked on it that can now run + * - if we come here from up_xxxx(), then the RWSEM_FLAG_WAITERS bit must +@@ -376,6 +398,8 @@ enum writer_wait_state { + * preferably when the wait_lock is released + * - woken process blocks are discarded from the list after having task zeroed + * - writers are only marked woken if downgrading is false ++ * ++ * Implies rwsem_del_waiter() for all woken readers. + */ + static void rwsem_mark_wake(struct rw_semaphore *sem, + enum rwsem_wake_type wake_type, +@@ -490,18 +514,25 @@ static void rwsem_mark_wake(struct rw_semaphore *sem, + + adjustment = woken * RWSEM_READER_BIAS - adjustment; + lockevent_cond_inc(rwsem_wake_reader, woken); ++ ++ oldcount = atomic_long_read(&sem->count); + if (list_empty(&sem->wait_list)) { +- /* hit end of list above */ ++ /* ++ * Combined with list_move_tail() above, this implies ++ * rwsem_del_waiter(). ++ */ + adjustment -= RWSEM_FLAG_WAITERS; ++ if (oldcount & RWSEM_FLAG_HANDOFF) ++ adjustment -= RWSEM_FLAG_HANDOFF; ++ } else if (woken) { ++ /* ++ * When we've woken a reader, we no longer need to force ++ * writers to give up the lock and we can clear HANDOFF. ++ */ ++ if (oldcount & RWSEM_FLAG_HANDOFF) ++ adjustment -= RWSEM_FLAG_HANDOFF; + } + +- /* +- * When we've woken a reader, we no longer need to force writers +- * to give up the lock and we can clear HANDOFF. +- */ +- if (woken && (atomic_long_read(&sem->count) & RWSEM_FLAG_HANDOFF)) +- adjustment -= RWSEM_FLAG_HANDOFF; +- + if (adjustment) + atomic_long_add(adjustment, &sem->count); + +@@ -532,12 +563,12 @@ static void rwsem_mark_wake(struct rw_semaphore *sem, + * race conditions between checking the rwsem wait list and setting the + * sem->count accordingly. + * +- * If wstate is WRITER_HANDOFF, it will make sure that either the handoff +- * bit is set or the lock is acquired with handoff bit cleared. ++ * Implies rwsem_del_waiter() on success. + */ + static inline bool rwsem_try_write_lock(struct rw_semaphore *sem, +- enum writer_wait_state wstate) ++ struct rwsem_waiter *waiter) + { ++ bool first = rwsem_first_waiter(sem) == waiter; + long count, new; + + lockdep_assert_held(&sem->wait_lock); +@@ -546,13 +577,19 @@ static inline bool rwsem_try_write_lock(struct rw_semaphore *sem, + do { + bool has_handoff = !!(count & RWSEM_FLAG_HANDOFF); + +- if (has_handoff && wstate == WRITER_NOT_FIRST) +- return false; ++ if (has_handoff) { ++ if (!first) ++ return false; ++ ++ /* First waiter inherits a previously set handoff bit */ ++ waiter->handoff_set = true; ++ } + + new = count; + + if (count & RWSEM_LOCK_MASK) { +- if (has_handoff || (wstate != WRITER_HANDOFF)) ++ if (has_handoff || (!rt_task(waiter->task) && ++ !time_after(jiffies, waiter->timeout))) + return false; + + new |= RWSEM_FLAG_HANDOFF; +@@ -569,9 +606,17 @@ static inline bool rwsem_try_write_lock(struct rw_semaphore *sem, + * We have either acquired the lock with handoff bit cleared or + * set the handoff bit. + */ +- if (new & RWSEM_FLAG_HANDOFF) ++ if (new & RWSEM_FLAG_HANDOFF) { ++ waiter->handoff_set = true; ++ lockevent_inc(rwsem_wlock_handoff); + return false; ++ } + ++ /* ++ * Have rwsem_try_write_lock() fully imply rwsem_del_waiter() on ++ * success. ++ */ ++ list_del(&waiter->list); + rwsem_set_owner(sem); + return true; + } +@@ -956,7 +1001,7 @@ rwsem_down_read_slowpath(struct rw_semaphore *sem, long count, unsigned int stat + } + adjustment += RWSEM_FLAG_WAITERS; + } +- list_add_tail(&waiter.list, &sem->wait_list); ++ rwsem_add_waiter(sem, &waiter); + + /* we're now waiting on the lock, but no longer actively locking */ + count = atomic_long_add_return(adjustment, &sem->count); +@@ -1002,11 +1047,7 @@ rwsem_down_read_slowpath(struct rw_semaphore *sem, long count, unsigned int stat + return sem; + + out_nolock: +- list_del(&waiter.list); +- if (list_empty(&sem->wait_list)) { +- atomic_long_andnot(RWSEM_FLAG_WAITERS|RWSEM_FLAG_HANDOFF, +- &sem->count); +- } ++ rwsem_del_waiter(sem, &waiter); + raw_spin_unlock_irq(&sem->wait_lock); + __set_current_state(TASK_RUNNING); + lockevent_inc(rwsem_rlock_fail); +@@ -1020,9 +1061,7 @@ static struct rw_semaphore * + rwsem_down_write_slowpath(struct rw_semaphore *sem, int state) + { + long count; +- enum writer_wait_state wstate; + struct rwsem_waiter waiter; +- struct rw_semaphore *ret = sem; + DEFINE_WAKE_Q(wake_q); + + /* do optimistic spinning and steal lock if possible */ +@@ -1038,16 +1077,13 @@ rwsem_down_write_slowpath(struct rw_semaphore *sem, int state) + waiter.task = current; + waiter.type = RWSEM_WAITING_FOR_WRITE; + waiter.timeout = jiffies + RWSEM_WAIT_TIMEOUT; ++ waiter.handoff_set = false; + + raw_spin_lock_irq(&sem->wait_lock); +- +- /* account for this before adding a new element to the list */ +- wstate = list_empty(&sem->wait_list) ? WRITER_FIRST : WRITER_NOT_FIRST; +- +- list_add_tail(&waiter.list, &sem->wait_list); ++ rwsem_add_waiter(sem, &waiter); + + /* we're now waiting on the lock */ +- if (wstate == WRITER_NOT_FIRST) { ++ if (rwsem_first_waiter(sem) != &waiter) { + count = atomic_long_read(&sem->count); + + /* +@@ -1083,13 +1119,16 @@ rwsem_down_write_slowpath(struct rw_semaphore *sem, int state) + /* wait until we successfully acquire the lock */ + set_current_state(state); + for (;;) { +- if (rwsem_try_write_lock(sem, wstate)) { ++ if (rwsem_try_write_lock(sem, &waiter)) { + /* rwsem_try_write_lock() implies ACQUIRE on success */ + break; + } + + raw_spin_unlock_irq(&sem->wait_lock); + ++ if (signal_pending_state(state, current)) ++ goto out_nolock; ++ + /* + * After setting the handoff bit and failing to acquire + * the lock, attempt to spin on owner to accelerate lock +@@ -1098,7 +1137,7 @@ rwsem_down_write_slowpath(struct rw_semaphore *sem, int state) + * In this case, we attempt to acquire the lock again + * without sleeping. + */ +- if (wstate == WRITER_HANDOFF) { ++ if (waiter.handoff_set) { + enum owner_state owner_state; + + preempt_disable(); +@@ -1109,66 +1148,26 @@ rwsem_down_write_slowpath(struct rw_semaphore *sem, int state) + goto trylock_again; + } + +- /* Block until there are no active lockers. */ +- for (;;) { +- if (signal_pending_state(state, current)) +- goto out_nolock; +- +- schedule(); +- lockevent_inc(rwsem_sleep_writer); +- set_current_state(state); +- /* +- * If HANDOFF bit is set, unconditionally do +- * a trylock. +- */ +- if (wstate == WRITER_HANDOFF) +- break; +- +- if ((wstate == WRITER_NOT_FIRST) && +- (rwsem_first_waiter(sem) == &waiter)) +- wstate = WRITER_FIRST; +- +- count = atomic_long_read(&sem->count); +- if (!(count & RWSEM_LOCK_MASK)) +- break; +- +- /* +- * The setting of the handoff bit is deferred +- * until rwsem_try_write_lock() is called. +- */ +- if ((wstate == WRITER_FIRST) && (rt_task(current) || +- time_after(jiffies, waiter.timeout))) { +- wstate = WRITER_HANDOFF; +- lockevent_inc(rwsem_wlock_handoff); +- break; +- } +- } ++ schedule(); ++ lockevent_inc(rwsem_sleep_writer); ++ set_current_state(state); + trylock_again: + raw_spin_lock_irq(&sem->wait_lock); + } + __set_current_state(TASK_RUNNING); +- list_del(&waiter.list); + raw_spin_unlock_irq(&sem->wait_lock); + lockevent_inc(rwsem_wlock); +- +- return ret; ++ return sem; + + out_nolock: + __set_current_state(TASK_RUNNING); + raw_spin_lock_irq(&sem->wait_lock); +- list_del(&waiter.list); +- +- if (unlikely(wstate == WRITER_HANDOFF)) +- atomic_long_add(-RWSEM_FLAG_HANDOFF, &sem->count); +- +- if (list_empty(&sem->wait_list)) +- atomic_long_andnot(RWSEM_FLAG_WAITERS, &sem->count); +- else ++ rwsem_del_waiter(sem, &waiter); ++ if (!list_empty(&sem->wait_list)) + rwsem_mark_wake(sem, RWSEM_WAKE_ANY, &wake_q); + raw_spin_unlock_irq(&sem->wait_lock); + wake_up_q(&wake_q); + lockevent_inc(rwsem_wlock_fail); +- + return ERR_PTR(-EINTR); + } + +-- +2.35.3 + diff --git a/patches.suse/locking-rwsem-No-need-to-check-for-handoff-bit-if-wa.patch b/patches.suse/locking-rwsem-No-need-to-check-for-handoff-bit-if-wa.patch new file mode 100644 index 0000000..6967699 --- /dev/null +++ b/patches.suse/locking-rwsem-No-need-to-check-for-handoff-bit-if-wa.patch @@ -0,0 +1,46 @@ +From f9e21aa9e6fb11355e54c8949a390d49ca21cde1 Mon Sep 17 00:00:00 2001 +From: Waiman Long +Date: Tue, 22 Mar 2022 11:20:57 -0400 +Subject: [PATCH] locking/rwsem: No need to check for handoff bit if wait queue + empty +Git-commit: f9e21aa9e6fb11355e54c8949a390d49ca21cde1 +Patch-mainline: v5.19-rc1 +References: bsc#1207270 + +Since commit d257cc8cb8d5 ("locking/rwsem: Make handoff bit handling +more consistent"), the handoff bit is always cleared if the wait queue +becomes empty. There is no need to check for RWSEM_FLAG_HANDOFF when +the wait list is known to be empty. + +Signed-off-by: Waiman Long +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20220322152059.2182333-2-longman@redhat.com +Signed-off-by: Jiri Wiesner +--- + kernel/locking/rwsem.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c +index acde5d6f1254..b077b1b2d4b3 100644 +--- a/kernel/locking/rwsem.c ++++ b/kernel/locking/rwsem.c +@@ -977,12 +977,11 @@ rwsem_down_read_slowpath(struct rw_semaphore *sem, long count, unsigned int stat + if (list_empty(&sem->wait_list)) { + /* + * In case the wait queue is empty and the lock isn't owned +- * by a writer or has the handoff bit set, this reader can +- * exit the slowpath and return immediately as its +- * RWSEM_READER_BIAS has already been set in the count. ++ * by a writer, this reader can exit the slowpath and return ++ * immediately as its RWSEM_READER_BIAS has already been set ++ * in the count. + */ +- if (!(atomic_long_read(&sem->count) & +- (RWSEM_WRITER_MASK | RWSEM_FLAG_HANDOFF))) { ++ if (!(atomic_long_read(&sem->count) & RWSEM_WRITER_MASK)) { + /* Provide lock ACQUIRE */ + smp_acquire__after_ctrl_dep(); + raw_spin_unlock_irq(&sem->wait_lock); +-- +2.35.3 + diff --git a/patches.suse/locking-rwsem-Prevent-non-first-waiter-from-spinning.patch b/patches.suse/locking-rwsem-Prevent-non-first-waiter-from-spinning.patch new file mode 100644 index 0000000..c5a0557 --- /dev/null +++ b/patches.suse/locking-rwsem-Prevent-non-first-waiter-from-spinning.patch @@ -0,0 +1,104 @@ +From b613c7f31476c44316bfac1af7cac714b7d6bef9 Mon Sep 17 00:00:00 2001 +From: Waiman Long +Date: Wed, 25 Jan 2023 19:36:25 -0500 +Subject: [PATCH] locking/rwsem: Prevent non-first waiter from spinning in + down_write() slowpath +Git-commit: b613c7f31476c44316bfac1af7cac714b7d6bef9 +Patch-mainline: v6.3-rc1 +References: bsc#1207270 + +A non-first waiter can potentially spin in the for loop of +rwsem_down_write_slowpath() without sleeping but fail to acquire the +lock even if the rwsem is free if the following sequence happens: + + Non-first RT waiter First waiter Lock holder + ------------------- ------------ ----------- + Acquire wait_lock + rwsem_try_write_lock(): + Set handoff bit if RT or + wait too long + Set waiter->handoff_set + Release wait_lock + Acquire wait_lock + Inherit waiter->handoff_set + Release wait_lock + Clear owner + Release lock + if (waiter.handoff_set) { + rwsem_spin_on_owner((); + if (OWNER_NULL) + goto trylock_again; + } + trylock_again: + Acquire wait_lock + rwsem_try_write_lock(): + if (first->handoff_set && (waiter != first)) + return false; + Release wait_lock + +A non-first waiter cannot really acquire the rwsem even if it mistakenly +believes that it can spin on OWNER_NULL value. If that waiter happens +to be an RT task running on the same CPU as the first waiter, it can +block the first waiter from acquiring the rwsem leading to live lock. +Fix this problem by making sure that a non-first waiter cannot spin in +the slowpath loop without sleeping. + +Fixes: d257cc8cb8d5 ("locking/rwsem: Make handoff bit handling more consistent") +Signed-off-by: Waiman Long +Signed-off-by: Ingo Molnar +Tested-by: Mukesh Ojha +Reviewed-by: Mukesh Ojha +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230126003628.365092-2-longman@redhat.com +Signed-off-by: Jiri Wiesner +--- + kernel/locking/rwsem.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c +index 44873594de03..be2df9ea7c30 100644 +--- a/kernel/locking/rwsem.c ++++ b/kernel/locking/rwsem.c +@@ -624,18 +624,16 @@ static inline bool rwsem_try_write_lock(struct rw_semaphore *sem, + */ + if (first->handoff_set && (waiter != first)) + return false; +- +- /* +- * First waiter can inherit a previously set handoff +- * bit and spin on rwsem if lock acquisition fails. +- */ +- if (waiter == first) +- waiter->handoff_set = true; + } + + new = count; + + if (count & RWSEM_LOCK_MASK) { ++ /* ++ * A waiter (first or not) can set the handoff bit ++ * if it is an RT task or wait in the wait queue ++ * for too long. ++ */ + if (has_handoff || (!rt_task(waiter->task) && + !time_after(jiffies, waiter->timeout))) + return false; +@@ -651,11 +649,12 @@ static inline bool rwsem_try_write_lock(struct rw_semaphore *sem, + } while (!atomic_long_try_cmpxchg_acquire(&sem->count, &count, new)); + + /* +- * We have either acquired the lock with handoff bit cleared or +- * set the handoff bit. ++ * We have either acquired the lock with handoff bit cleared or set ++ * the handoff bit. Only the first waiter can have its handoff_set ++ * set here to enable optimistic spinning in slowpath loop. + */ + if (new & RWSEM_FLAG_HANDOFF) { +- waiter->handoff_set = true; ++ first->handoff_set = true; + lockevent_inc(rwsem_wlock_handoff); + return false; + } +-- +2.35.3 + diff --git a/patches.suse/malidp-Fix-NULL-vs-IS_ERR-checking.patch b/patches.suse/malidp-Fix-NULL-vs-IS_ERR-checking.patch new file mode 100644 index 0000000..ba517a2 --- /dev/null +++ b/patches.suse/malidp-Fix-NULL-vs-IS_ERR-checking.patch @@ -0,0 +1,35 @@ +From 15342f930ebebcfe36f2415049736a77d7d2e045 Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Mon, 13 Dec 2021 07:21:15 +0000 +Subject: malidp: Fix NULL vs IS_ERR() checking +Git-commit: 15342f930ebebcfe36f2415049736a77d7d2e045 +Patch-mainline: v5.19-rc1 +References: bsc#1208843 CVE-2023-23004 + +The get_sg_table() function does not return NULL. +It returns error pointers. + +Signed-off-by: Miaoqian Lin +Signed-off-by: Liviu Dudau +Link: https://lore.kernel.org/dri-devel/20211213072115.18098-1-linmq006@gmail.com/ +Acked-by: Patrik Jakobsson +--- + drivers/gpu/drm/arm/malidp_planes.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c +index 81d9f5004025..338cec4a3fff 100644 +--- a/drivers/gpu/drm/arm/malidp_planes.c ++++ b/drivers/gpu/drm/arm/malidp_planes.c +@@ -344,7 +344,7 @@ static bool malidp_check_pages_threshold(struct malidp_plane_state *ms, + else + sgt = obj->funcs->get_sg_table(obj); + +- if (!sgt) ++ if (IS_ERR(sgt)) + return false; + + sgl = sgt->sgl; +-- +2.39.2 + diff --git a/patches.suse/media-coda-Add-check-for-dcoda_iram_alloc.patch b/patches.suse/media-coda-Add-check-for-dcoda_iram_alloc.patch new file mode 100644 index 0000000..759c8ee --- /dev/null +++ b/patches.suse/media-coda-Add-check-for-dcoda_iram_alloc.patch @@ -0,0 +1,46 @@ +From 6b8082238fb8bb20f67e46388123e67a5bbc558d Mon Sep 17 00:00:00 2001 +From: Jiasheng Jiang +Date: Thu, 17 Nov 2022 14:56:52 +0800 +Subject: [PATCH] media: coda: Add check for dcoda_iram_alloc +Git-commit: 6b8082238fb8bb20f67e46388123e67a5bbc558d +References: git-fixes +Patch-mainline: v6.2-rc1 + +As the coda_iram_alloc may return NULL pointer, +it should be better to check the return value +in order to avoid NULL poineter dereference, +same as the others. + +Fixes: b313bcc9a467 ("[media] coda: simplify IRAM setup") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Hans Verkuil +Signed-off-by: Oliver Neukum +--- + drivers/media/platform/chips-media/coda-bit.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/chips-media/coda-bit.c b/drivers/media/platform/chips-media/coda-bit.c +index 2736a902e3df..6d816fd69a17 100644 +--- a/drivers/media/platform/coda/coda-bit.c ++++ b/drivers/media/platform/coda/coda-bit.c +@@ -854,7 +854,7 @@ static void coda_setup_iram(struct coda_ctx *ctx) + /* Only H.264BP and H.263P3 are considered */ + iram_info->buf_dbk_y_use = coda_iram_alloc(iram_info, w64); + iram_info->buf_dbk_c_use = coda_iram_alloc(iram_info, w64); +- if (!iram_info->buf_dbk_c_use) ++ if (!iram_info->buf_dbk_y_use || !iram_info->buf_dbk_c_use) + goto out; + iram_info->axi_sram_use |= dbk_bits; + +@@ -878,7 +878,7 @@ static void coda_setup_iram(struct coda_ctx *ctx) + + iram_info->buf_dbk_y_use = coda_iram_alloc(iram_info, w128); + iram_info->buf_dbk_c_use = coda_iram_alloc(iram_info, w128); +- if (!iram_info->buf_dbk_c_use) ++ if (!iram_info->buf_dbk_y_use || !iram_info->buf_dbk_c_use) + goto out; + iram_info->axi_sram_use |= dbk_bits; + +-- +2.39.2 + diff --git a/patches.suse/media-coda-Add-check-for-kmalloc.patch b/patches.suse/media-coda-Add-check-for-kmalloc.patch new file mode 100644 index 0000000..91d16c7 --- /dev/null +++ b/patches.suse/media-coda-Add-check-for-kmalloc.patch @@ -0,0 +1,47 @@ +From 6e5e5defdb8b0186312c2f855ace175aee6daf9b Mon Sep 17 00:00:00 2001 +From: Jiasheng Jiang +Date: Thu, 17 Nov 2022 15:02:36 +0800 +Subject: [PATCH] media: coda: Add check for kmalloc +Git-commit: 6e5e5defdb8b0186312c2f855ace175aee6daf9b +References: git-fixes +Patch-mainline: v6.2-rc1 + +As the kmalloc may return NULL pointer, +it should be better to check the return value +in order to avoid NULL poineter dereference, +same as the others. + +Fixes: cb1d3a336371 ("[media] coda: add CODA7541 JPEG support") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Hans Verkuil +Signed-off-by: Oliver Neukum +--- + drivers/media/platform/chips-media/coda-bit.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/chips-media/coda-bit.c b/drivers/media/platform/chips-media/coda-bit.c +index 6d816fd69a17..ed47d5bd8d61 100644 +--- a/drivers/media/platform/coda/coda-bit.c ++++ b/drivers/media/platform/coda/coda-bit.c +@@ -1084,10 +1084,16 @@ static int coda_start_encoding(struct coda_ctx *ctx) + } + + if (dst_fourcc == V4L2_PIX_FMT_JPEG) { +- if (!ctx->params.jpeg_qmat_tab[0]) ++ if (!ctx->params.jpeg_qmat_tab[0]) { + ctx->params.jpeg_qmat_tab[0] = kmalloc(64, GFP_KERNEL); +- if (!ctx->params.jpeg_qmat_tab[1]) ++ if (!ctx->params.jpeg_qmat_tab[0]) ++ return -ENOMEM; ++ } ++ if (!ctx->params.jpeg_qmat_tab[1]) { + ctx->params.jpeg_qmat_tab[1] = kmalloc(64, GFP_KERNEL); ++ if (!ctx->params.jpeg_qmat_tab[1]) ++ return -ENOMEM; ++ } + coda_set_jpeg_compression_quality(ctx, ctx->params.jpeg_quality); + } + +-- +2.39.2 + diff --git a/patches.suse/media-dvb-core-Fix-UAF-due-to-refcount-races-at-rele.patch b/patches.suse/media-dvb-core-Fix-UAF-due-to-refcount-races-at-rele.patch index ce930ca..93cbe35 100644 --- a/patches.suse/media-dvb-core-Fix-UAF-due-to-refcount-races-at-rele.patch +++ b/patches.suse/media-dvb-core-Fix-UAF-due-to-refcount-races-at-rele.patch @@ -1,8 +1,8 @@ From: Takashi Iwai Date: Wed, 7 Sep 2022 13:13:07 +0200 Subject: [PATCH] media: dvb-core: Fix UAF due to refcount races at releasing -Message-Id: <20220908132754.30532-1-tiwai@suse.de> -Patch-mainline: Submitted, linux-media ML +Git-commit: fd3d91ab1c6ab0628fe642dd570b56302c30a792 +Patch-mainline: v6.2-rc1 References: CVE-2022-41218 bsc#1202960 The dvb-core tries to sync the releases of opened files at diff --git a/patches.suse/media-i2c-ov7670-0-instead-of-EINVAL-was-returned.patch b/patches.suse/media-i2c-ov7670-0-instead-of-EINVAL-was-returned.patch new file mode 100644 index 0000000..7d9f642 --- /dev/null +++ b/patches.suse/media-i2c-ov7670-0-instead-of-EINVAL-was-returned.patch @@ -0,0 +1,41 @@ +From 6a4c664539e6de9b32b65ddcf767ec1bcc1d7f8a Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Thu, 26 Jan 2023 14:03:51 +0100 +Subject: [PATCH] media: i2c: ov7670: 0 instead of -EINVAL was returned +Git-commit: 6a4c664539e6de9b32b65ddcf767ec1bcc1d7f8a +Patch-mainline: v6.3-rc1 +References: git-fixes + +If the media bus is unsupported, then return -EINVAL. Instead it +returned 'ret' which happened to be 0. + +This fixes a smatch warning: + +ov7670.c:1843 ov7670_parse_dt() warn: missing error code? 'ret' + +Signed-off-by: Hans Verkuil +Fixes: 01b8444828fc ("media: v4l2: i2c: ov7670: Implement OF mbus configuration") +Acked-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/i2c/ov7670.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/ov7670.c b/drivers/media/i2c/ov7670.c +index 27db0a07de1f..b1bb0833571e 100644 +--- a/drivers/media/i2c/ov7670.c ++++ b/drivers/media/i2c/ov7670.c +@@ -1840,7 +1840,7 @@ static int ov7670_parse_dt(struct device *dev, + + if (bus_cfg.bus_type != V4L2_MBUS_PARALLEL) { + dev_err(dev, "Unsupported media bus type\n"); +- return ret; ++ return -EINVAL; + } + info->mbus_config = bus_cfg.bus.parallel.flags; + +-- +2.35.3 + diff --git a/patches.suse/media-i2c-ov772x-Fix-memleak-in-ov772x_probe.patch b/patches.suse/media-i2c-ov772x-Fix-memleak-in-ov772x_probe.patch new file mode 100644 index 0000000..02c9998 --- /dev/null +++ b/patches.suse/media-i2c-ov772x-Fix-memleak-in-ov772x_probe.patch @@ -0,0 +1,74 @@ +From 7485edb2b6ca5960205c0a49bedfd09bba30e521 Mon Sep 17 00:00:00 2001 +From: Yuan Can +Date: Thu, 8 Dec 2022 09:06:25 +0100 +Subject: [PATCH] media: i2c: ov772x: Fix memleak in ov772x_probe() +Git-commit: 7485edb2b6ca5960205c0a49bedfd09bba30e521 +Patch-mainline: v6.3-rc1 +References: git-fixes + +A memory leak was reported when testing ov772x with bpf mock device: + +Assertionerror: unreferenced object 0xffff888109afa7a8 (size 8): comm "python3", pid 279, jiffies 4294805921 (age 20.681s) hex dump (first 8 bytes): 80 22 88 15 81 88 ff ff ."...... backtrace: [<000000009990b438>] __kmalloc_node+0x44/0x1b0 [<000000009e32f7d7>] kvmalloc_node+0x34/0x180 [<00000000faf48134>] v4l2_ctrl_handler_init_class+0x11d/0x180 [videodev] [<00000000da376937>] ov772x_probe+0x1c3/0x68c [ov772x] [<000000003f0d225e>] i2c_device_probe+0x28d/0x680 [<00000000e0b6db89>] really_probe+0x17c/0x3f0 [<000000001b19fcee>] __driver_probe_device+0xe3/0x170 [<0000000048370519>] driver_probe_device+0x49/0x120 [<000000005ead07a0>] __device_attach_driver+0xf7/0x150 [<0000000043f452b8>] bus_for_each_drv+0x114/0x180 [<00000000358e5596>] __device_attach+0x1e5/0x2d0 [<0000000043f83c5d>] bus_probe_device+0x126/0x140 [<00000000ee0f3046>] device_add+0x810/0x1130 [<00000000e0278184>] i2c_new_client_device+0x359/0x4f0 [<0000000070baf34f>] of_i2c_register_device+0xf1/0x110 [<00000000a9f2159d>] of_i2c_notify+0x100/0x160 +unreferenced object 0xffff888119825c00 (size 256): + comm "python3", pid 279, jiffies 4294805921 (age 20.681s) + hex dump (first 32 bytes): + 00 b4 a5 17 81 88 ff ff 00 5e 82 19 81 88 ff ff .........^...... + 10 5c 82 19 81 88 ff ff 10 5c 82 19 81 88 ff ff .\.......\...... + backtrace: + [<000000009990b438>] __kmalloc_node+0x44/0x1b0 + [<000000009e32f7d7>] kvmalloc_node+0x34/0x180 + [<0000000073d88e0b>] v4l2_ctrl_new.cold+0x19b/0x86f [videodev] + [<00000000b1f576fb>] v4l2_ctrl_new_std+0x16f/0x210 [videodev] + [<00000000caf7ac99>] ov772x_probe+0x1fa/0x68c [ov772x] + [<000000003f0d225e>] i2c_device_probe+0x28d/0x680 + [<00000000e0b6db89>] really_probe+0x17c/0x3f0 + [<000000001b19fcee>] __driver_probe_device+0xe3/0x170 + [<0000000048370519>] driver_probe_device+0x49/0x120 + [<000000005ead07a0>] __device_attach_driver+0xf7/0x150 + [<0000000043f452b8>] bus_for_each_drv+0x114/0x180 + [<00000000358e5596>] __device_attach+0x1e5/0x2d0 + [<0000000043f83c5d>] bus_probe_device+0x126/0x140 + [<00000000ee0f3046>] device_add+0x810/0x1130 + [<00000000e0278184>] i2c_new_client_device+0x359/0x4f0 + [<0000000070baf34f>] of_i2c_register_device+0xf1/0x110 + +The reason is that if priv->hdl.error is set, ov772x_probe() jumps to the +error_mutex_destroy without doing v4l2_ctrl_handler_free(), and all +resources allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() +are leaked. + +Fixes: 1112babde214 ("media: i2c: Copy ov772x soc_camera sensor driver") +Signed-off-by: Yuan Can +Reviewed-by: Laurent Pinchart +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/i2c/ov772x.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/media/i2c/ov772x.c b/drivers/media/i2c/ov772x.c +index 4189e3fc3d53..a238e63425f8 100644 +--- a/drivers/media/i2c/ov772x.c ++++ b/drivers/media/i2c/ov772x.c +@@ -1462,7 +1462,7 @@ static int ov772x_probe(struct i2c_client *client) + priv->subdev.ctrl_handler = &priv->hdl; + if (priv->hdl.error) { + ret = priv->hdl.error; +- goto error_mutex_destroy; ++ goto error_ctrl_free; + } + + priv->clk = clk_get(&client->dev, NULL); +@@ -1515,7 +1515,6 @@ static int ov772x_probe(struct i2c_client *client) + clk_put(priv->clk); + error_ctrl_free: + v4l2_ctrl_handler_free(&priv->hdl); +-error_mutex_destroy: + mutex_destroy(&priv->lock); + + return ret; +-- +2.35.3 + diff --git a/patches.suse/media-imx-imx7-media-csi-fix-missing-clk_disable_unp.patch b/patches.suse/media-imx-imx7-media-csi-fix-missing-clk_disable_unp.patch new file mode 100644 index 0000000..68718b2 --- /dev/null +++ b/patches.suse/media-imx-imx7-media-csi-fix-missing-clk_disable_unp.patch @@ -0,0 +1,41 @@ +From cea606d9e996a77eed57fc60709e0728341450e3 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Wed, 4 Jan 2023 10:39:21 +0100 +Subject: [PATCH] media: imx: imx7-media-csi: fix missing + clk_disable_unprepare() in imx7_csi_init() +Git-commit: cea606d9e996a77eed57fc60709e0728341450e3 +References: git-fixes +Patch-mainline: v6.3-rc1 + +Add missing clk_disable_unprepare(), if imx7_csi_dma_setup() fails +in imx7_csi_init(). + +Fixes: ff43ca911978 ("media: imx: imx7-media-csi: Move CSI configuration before source start") +Signed-off-by: Yang Yingliang +Reviewed-by: Rui Miguel Silva +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/platform/nxp/imx7-media-csi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/nxp/imx7-media-csi.c b/drivers/media/platform/nxp/imx7-media-csi.c +index 886374d3a6ff..1ef92c8c0098 100644 +--- a/drivers/staging/media/imx/imx7-media-csi.c ++++ b/drivers/staging/media/imx/imx7-media-csi.c +@@ -638,8 +638,10 @@ static int imx7_csi_init(struct imx7_csi *csi) + imx7_csi_configure(csi); + + ret = imx7_csi_dma_setup(csi); +- if (ret < 0) ++ if (ret < 0) { ++ clk_disable_unprepare(csi->mclk); + return ret; ++ } + + return 0; + } +-- +2.39.2 + diff --git a/patches.suse/media-ipu3-cio2-Fix-PM-runtime-usage_count-in-driver.patch b/patches.suse/media-ipu3-cio2-Fix-PM-runtime-usage_count-in-driver.patch new file mode 100644 index 0000000..b8ede05 --- /dev/null +++ b/patches.suse/media-ipu3-cio2-Fix-PM-runtime-usage_count-in-driver.patch @@ -0,0 +1,39 @@ +From 909d3096ac99fa2289f9b8945a3eab2269947a0a Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Wed, 21 Dec 2022 09:30:11 +0100 +Subject: [PATCH] media: ipu3-cio2: Fix PM runtime usage_count in driver unbind +Git-commit: 909d3096ac99fa2289f9b8945a3eab2269947a0a +Patch-mainline: v6.3-rc1 +References: git-fixes + +Get the PM runtime usage_count and forbid PM runtime at driver unbind. The +opposite is being done in probe() already. + +Fixes: commit c2a6a07afe4a ("media: intel-ipu3: cio2: add new MIPI-CSI2 driver") +Cc: stable@vger.kernel.org # for >= 4.16 +Signed-off-by: Sakari Ailus +Reviewed-by: Bingbu Cao +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/pci/intel/ipu3/ipu3-cio2-main.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c b/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c +index 390bd5ea3472..3b76a9d0383a 100644 +--- a/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c ++++ b/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c +@@ -1843,6 +1843,9 @@ static void cio2_pci_remove(struct pci_dev *pci_dev) + v4l2_device_unregister(&cio2->v4l2_dev); + media_device_cleanup(&cio2->media_dev); + mutex_destroy(&cio2->lock); ++ ++ pm_runtime_forbid(&pci_dev->dev); ++ pm_runtime_get_noresume(&pci_dev->dev); + } + + static int __maybe_unused cio2_runtime_suspend(struct device *dev) +-- +2.35.3 + diff --git a/patches.suse/media-max9286-Fix-memleak-in-max9286_v4l2_register.patch b/patches.suse/media-max9286-Fix-memleak-in-max9286_v4l2_register.patch new file mode 100644 index 0000000..08c835d --- /dev/null +++ b/patches.suse/media-max9286-Fix-memleak-in-max9286_v4l2_register.patch @@ -0,0 +1,66 @@ +From 8636c5fc7658c7c6299fb8b352d24ea4b9ba99e2 Mon Sep 17 00:00:00 2001 +From: Shang XiaoJing +Date: Tue, 6 Dec 2022 14:05:55 +0100 +Subject: [PATCH] media: max9286: Fix memleak in max9286_v4l2_register() +Git-commit: 8636c5fc7658c7c6299fb8b352d24ea4b9ba99e2 +Patch-mainline: v6.3-rc1 +References: git-fixes + +There is a kmemleak when testing the media/i2c/max9286.c with bpf mock +Device: + +Kmemleak: 5 new suspected memory leaks (see /sys/kernel/debug/kmemleak) + +unreferenced object 0xffff88810defc400 (size 256): + comm "python3", pid 278, jiffies 4294737563 (age 31.978s) + hex dump (first 32 bytes): + 28 06 a7 0a 81 88 ff ff 00 fe 22 12 81 88 ff ff (........."..... + 10 c4 ef 0d 81 88 ff ff 10 c4 ef 0d 81 88 ff ff ................ + backtrace: + [<00000000191de6a7>] __kmalloc_node+0x44/0x1b0 + [<000000002f4912b7>] kvmalloc_node+0x34/0x180 + [<0000000057dc4cae>] v4l2_ctrl_new+0x325/0x10f0 [videodev] + [<0000000026030272>] v4l2_ctrl_new_std+0x16f/0x210 [videodev] + [<00000000f0d9ea2f>] max9286_probe+0x76e/0xbff [max9286] + [<00000000ea8f6455>] i2c_device_probe+0x28d/0x680 + [<0000000087529af3>] really_probe+0x17c/0x3f0 + [<00000000b08be526>] __driver_probe_device+0xe3/0x170 + [<000000004382edea>] driver_probe_device+0x49/0x120 + [<000000007bde528a>] __device_attach_driver+0xf7/0x150 + [<000000009f9c6ab4>] bus_for_each_drv+0x114/0x180 + [<00000000c8aaf588>] __device_attach+0x1e5/0x2d0 + [<0000000041cc06b9>] bus_probe_device+0x126/0x140 + [<000000002309860d>] device_add+0x810/0x1130 + [<000000002827bf98>] i2c_new_client_device+0x359/0x4f0 + [<00000000593bdc85>] of_i2c_register_device+0xf1/0x110 + +max9286_v4l2_register() calls v4l2_ctrl_new_std(), but won't free the +created v412_ctrl when fwnode_graph_get_endpoint_by_id() failed, which +causes the memleak. Call v4l2_ctrl_handler_free() to free the v412_ctrl. + +Fixes: 66d8c9d2422d ("media: i2c: Add MAX9286 driver") +Signed-off-by: Shang XiaoJing +Reviewed-by: Laurent Pinchart +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/i2c/max9286.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/i2c/max9286.c b/drivers/media/i2c/max9286.c +index dd6477548f29..701038d6d19b 100644 +--- a/drivers/media/i2c/max9286.c ++++ b/drivers/media/i2c/max9286.c +@@ -1113,6 +1113,7 @@ static int max9286_v4l2_register(struct max9286_priv *priv) + err_put_node: + fwnode_handle_put(ep); + err_async: ++ v4l2_ctrl_handler_free(&priv->ctrls); + max9286_v4l2_notifier_unregister(priv); + + return ret; +-- +2.35.3 + diff --git a/patches.suse/media-ov2740-Fix-memleak-in-ov2740_init_controls.patch b/patches.suse/media-ov2740-Fix-memleak-in-ov2740_init_controls.patch new file mode 100644 index 0000000..e2b3e10 --- /dev/null +++ b/patches.suse/media-ov2740-Fix-memleak-in-ov2740_init_controls.patch @@ -0,0 +1,67 @@ +From 2d899592ed7829d0d5140853bac4d58742a6b8af Mon Sep 17 00:00:00 2001 +From: Shang XiaoJing +Date: Thu, 8 Dec 2022 08:59:37 +0100 +Subject: [PATCH] media: ov2740: Fix memleak in ov2740_init_controls() +Git-commit: 2d899592ed7829d0d5140853bac4d58742a6b8af +Patch-mainline: v6.3-rc1 +References: git-fixes + +There is a kmemleak when testing the media/i2c/ov2740.c with bpf mock +Device: + +unreferenced object 0xffff8881090e19e0 (size 16): + comm "51-i2c-ov2740", pid 278, jiffies 4294781584 (age 23.613s) + hex dump (first 16 bytes): + 00 f3 7c 0b 81 88 ff ff 80 75 6a 09 81 88 ff ff ..|......uj..... + backtrace: + [<000000004e9fad8f>] __kmalloc_node+0x44/0x1b0 + [<0000000039c802f4>] kvmalloc_node+0x34/0x180 + [<000000009b8b5c63>] v4l2_ctrl_handler_init_class+0x11d/0x180 +[videodev] + [<0000000038644056>] ov2740_probe+0x37d/0x84f [ov2740] + [<0000000092489f59>] i2c_device_probe+0x28d/0x680 + [<000000001038babe>] really_probe+0x17c/0x3f0 + [<0000000098c7af1c>] __driver_probe_device+0xe3/0x170 + [<00000000e1b3dc24>] device_driver_attach+0x34/0x80 + [<000000005a04a34d>] bind_store+0x10b/0x1a0 + [<00000000ce25d4f2>] drv_attr_store+0x49/0x70 + [<000000007d9f4e9a>] sysfs_kf_write+0x8c/0xb0 + [<00000000be6cff0f>] kernfs_fop_write_iter+0x216/0x2e0 + [<0000000031ddb40a>] vfs_write+0x658/0x810 + [<0000000041beecdd>] ksys_write+0xd6/0x1b0 + [<0000000023755840>] do_syscall_64+0x38/0x90 + [<00000000b2cc2da2>] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +ov2740_init_controls() won't clean all the allocated resources in fail +path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to +prevent memleak. + +Fixes: 866edc895171 ("media: i2c: Add ov2740 image sensor driver") +Signed-off-by: Shang XiaoJing +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/i2c/ov2740.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/ov2740.c b/drivers/media/i2c/ov2740.c +index f3731f932a94..89d126240c34 100644 +--- a/drivers/media/i2c/ov2740.c ++++ b/drivers/media/i2c/ov2740.c +@@ -629,8 +629,10 @@ static int ov2740_init_controls(struct ov2740 *ov2740) + V4L2_CID_TEST_PATTERN, + ARRAY_SIZE(ov2740_test_pattern_menu) - 1, + 0, 0, ov2740_test_pattern_menu); +- if (ctrl_hdlr->error) ++ if (ctrl_hdlr->error) { ++ v4l2_ctrl_handler_free(ctrl_hdlr); + return ctrl_hdlr->error; ++ } + + ov2740->sd.ctrl_handler = ctrl_hdlr; + +-- +2.35.3 + diff --git a/patches.suse/media-ov5675-Fix-memleak-in-ov5675_init_controls.patch b/patches.suse/media-ov5675-Fix-memleak-in-ov5675_init_controls.patch new file mode 100644 index 0000000..5f04132 --- /dev/null +++ b/patches.suse/media-ov5675-Fix-memleak-in-ov5675_init_controls.patch @@ -0,0 +1,60 @@ +From dd74ed6c213003533e3abf4c204374ef01d86978 Mon Sep 17 00:00:00 2001 +From: Shang XiaoJing +Date: Thu, 8 Dec 2022 08:59:38 +0100 +Subject: [PATCH] media: ov5675: Fix memleak in ov5675_init_controls() +Git-commit: dd74ed6c213003533e3abf4c204374ef01d86978 +Patch-mainline: v6.3-rc1 +References: git-fixes + +There is a kmemleak when testing the media/i2c/ov5675.c with bpf mock +Device: + +Assertionerror: unreferenced object 0xffff888107362160 (size 16): comm "python3", pid 277, jiffies 4294832798 (age 20.722s) hex dump (first 16 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000abe7d67c>] __kmalloc_node+0x44/0x1b0 [<000000008a725aac>] kvmalloc_node+0x34/0x180 [<000000009a53cd11>] v4l2_ctrl_handler_init_class+0x11d/0x180 +[videodev] + [<0000000055b46db0>] ov5675_probe+0x38b/0x897 [ov5675] + [<00000000153d886c>] i2c_device_probe+0x28d/0x680 + [<000000004afb7e8f>] really_probe+0x17c/0x3f0 + [<00000000ff2f18e4>] __driver_probe_device+0xe3/0x170 + [<000000000a001029>] driver_probe_device+0x49/0x120 + [<00000000e39743c7>] __device_attach_driver+0xf7/0x150 + [<00000000d32fd070>] bus_for_each_drv+0x114/0x180 + [<000000009083ac41>] __device_attach+0x1e5/0x2d0 + [<0000000015b4a830>] bus_probe_device+0x126/0x140 + [<000000007813deaf>] device_add+0x810/0x1130 + [<000000007becb867>] i2c_new_client_device+0x386/0x540 + [<000000007f9cf4b4>] of_i2c_register_device+0xf1/0x110 + [<00000000ebfdd032>] of_i2c_notify+0xfc/0x1f0 + +ov5675_init_controls() won't clean all the allocated resources in fail +path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to +prevent memleak. + +Fixes: bf27502b1f3b ("media: ov5675: Add support for OV5675 sensor") +Signed-off-by: Shang XiaoJing +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/i2c/ov5675.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/ov5675.c b/drivers/media/i2c/ov5675.c +index 94dc8cb7a7c0..a6e6b367d128 100644 +--- a/drivers/media/i2c/ov5675.c ++++ b/drivers/media/i2c/ov5675.c +@@ -820,8 +820,10 @@ static int ov5675_init_controls(struct ov5675 *ov5675) + v4l2_ctrl_new_std(ctrl_hdlr, &ov5675_ctrl_ops, + V4L2_CID_VFLIP, 0, 1, 1, 0); + +- if (ctrl_hdlr->error) ++ if (ctrl_hdlr->error) { ++ v4l2_ctrl_handler_free(ctrl_hdlr); + return ctrl_hdlr->error; ++ } + + ov5675->sd.ctrl_handler = ctrl_hdlr; + +-- +2.35.3 + diff --git a/patches.suse/media-platform-ti-Add-missing-check-for-devm_regulat.patch b/patches.suse/media-platform-ti-Add-missing-check-for-devm_regulat.patch new file mode 100644 index 0000000..629bfa3 --- /dev/null +++ b/patches.suse/media-platform-ti-Add-missing-check-for-devm_regulat.patch @@ -0,0 +1,44 @@ +From da8e05f84a11c3cc3b0ba0a3c62d20e358002d99 Mon Sep 17 00:00:00 2001 +From: Jiasheng Jiang +Date: Wed, 4 Jan 2023 09:55:37 +0100 +Subject: [PATCH] media: platform: ti: Add missing check for devm_regulator_get +Git-commit: da8e05f84a11c3cc3b0ba0a3c62d20e358002d99 +References: git-fixes +Patch-mainline: v6.3-rc1 + +Add check for the return value of devm_regulator_get since it may return +error pointer. + +Fixes: 448de7e7850b ("[media] omap3isp: OMAP3 ISP core") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/platform/ti/omap3isp/isp.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/media/platform/ti/omap3isp/isp.c b/drivers/media/platform/ti/omap3isp/isp.c +index 1d40bb59ff81..e7327e38482d 100644 +--- a/drivers/media/platform/omap3isp/isp.c ++++ b/drivers/media/platform/omap3isp/isp.c +@@ -2307,7 +2307,16 @@ static int isp_probe(struct platform_device *pdev) + + /* Regulators */ + isp->isp_csiphy1.vdd = devm_regulator_get(&pdev->dev, "vdd-csiphy1"); ++ if (IS_ERR(isp->isp_csiphy1.vdd)) { ++ ret = PTR_ERR(isp->isp_csiphy1.vdd); ++ goto error; ++ } ++ + isp->isp_csiphy2.vdd = devm_regulator_get(&pdev->dev, "vdd-csiphy2"); ++ if (IS_ERR(isp->isp_csiphy2.vdd)) { ++ ret = PTR_ERR(isp->isp_csiphy2.vdd); ++ goto error; ++ } + + /* Clocks + * +-- +2.39.2 + diff --git a/patches.suse/media-rc-Fix-use-after-free-bugs-caused-by-ene_tx_ir.patch b/patches.suse/media-rc-Fix-use-after-free-bugs-caused-by-ene_tx_ir.patch new file mode 100644 index 0000000..47b3951 --- /dev/null +++ b/patches.suse/media-rc-Fix-use-after-free-bugs-caused-by-ene_tx_ir.patch @@ -0,0 +1,83 @@ +From 29b0589a865b6f66d141d79b2dd1373e4e50fe17 Mon Sep 17 00:00:00 2001 +From: Duoming Zhou +Date: Tue, 24 Jan 2023 08:55:33 +0100 +Subject: [PATCH] media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() +Git-commit: 29b0589a865b6f66d141d79b2dd1373e4e50fe17 +Patch-mainline: v6.3-rc1 +References: CVE-2023-1118 bsc#1208837 + +When the ene device is detaching, function ene_remove() will +be called. But there is no function to cancel tx_sim_timer +in ene_remove(), the timer handler ene_tx_irqsim() could race +with ene_remove(). As a result, the UAF bugs could happen, +the process is shown below. + + (cleanup routine) | (timer routine) + | mod_timer(&dev->tx_sim_timer, ..) +ene_remove() | (wait a time) + | ene_tx_irqsim() + | dev->hw_lock //USE + | ene_tx_sample(dev) //USE + +Fix by adding del_timer_sync(&dev->tx_sim_timer) in ene_remove(), +The tx_sim_timer could stop before ene device is deallocated. + +What's more, The rc_unregister_device() and del_timer_sync() +should be called first in ene_remove() and the deallocated +functions such as free_irq(), release_region() and so on +should be called behind them. Because the rc_unregister_device() +is well synchronized. Otherwise, race conditions may happen. The +situations that may lead to race conditions are shown below. + +Firstly, the rx receiver is disabled with ene_rx_disable() +before rc_unregister_device() in ene_remove(), which means it +can be enabled again if a process opens /dev/lirc0 between +ene_rx_disable() and rc_unregister_device(). + +Secondly, the irqaction descriptor is freed by free_irq() +before the rc device is unregistered, which means irqaction +descriptor may be accessed again after it is deallocated. + +Thirdly, the timer can call ene_tx_sample() that can write +to the io ports, which means the io ports could be accessed +again after they are deallocated by release_region(). + +Therefore, the rc_unregister_device() and del_timer_sync() +should be called first in ene_remove(). + +Suggested by: Sean Young + +Fixes: 9ea53b74df9c ("V4L/DVB: STAGING: remove lirc_ene0100 driver") +Signed-off-by: Duoming Zhou +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/rc/ene_ir.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/rc/ene_ir.c b/drivers/media/rc/ene_ir.c +index e09270916fbc..11ee21a7db8f 100644 +--- a/drivers/media/rc/ene_ir.c ++++ b/drivers/media/rc/ene_ir.c +@@ -1106,6 +1106,8 @@ static void ene_remove(struct pnp_dev *pnp_dev) + struct ene_device *dev = pnp_get_drvdata(pnp_dev); + unsigned long flags; + ++ rc_unregister_device(dev->rdev); ++ del_timer_sync(&dev->tx_sim_timer); + spin_lock_irqsave(&dev->hw_lock, flags); + ene_rx_disable(dev); + ene_rx_restore_hw_buffer(dev); +@@ -1113,7 +1115,6 @@ static void ene_remove(struct pnp_dev *pnp_dev) + + free_irq(dev->irq, dev); + release_region(dev->hw_io, ENE_IO_SIZE); +- rc_unregister_device(dev->rdev); + kfree(dev); + } + +-- +2.35.3 + diff --git a/patches.suse/media-saa7134-Use-video_unregister_device-for-radio_.patch b/patches.suse/media-saa7134-Use-video_unregister_device-for-radio_.patch new file mode 100644 index 0000000..19f9a81 --- /dev/null +++ b/patches.suse/media-saa7134-Use-video_unregister_device-for-radio_.patch @@ -0,0 +1,39 @@ +From bc7635c6435c77a0c168e2cc6535740adfaff4e4 Mon Sep 17 00:00:00 2001 +From: Tasos Sahanidis +Date: Thu, 26 Jan 2023 12:00:59 +0100 +Subject: [PATCH] media: saa7134: Use video_unregister_device for radio_dev +Git-commit: bc7635c6435c77a0c168e2cc6535740adfaff4e4 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The radio device doesn't use vb2, thus calling vb2_video_unregister_device() +which results in the following warning being printed on module unload. + +Warning: CPU: 1 PID: 215963 at drivers/media/common/videobuf2/videobuf2-v4l2.c:1236 vb2_video_unregister_device+0xc6/0xe0 [videobuf2_v4l2] + +Fixes: 11788d9b7e91 ("media: media/pci: use vb2_video_unregister_device()") +Signed-off-by: Tasos Sahanidis +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/pci/saa7134/saa7134-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/pci/saa7134/saa7134-core.c b/drivers/media/pci/saa7134/saa7134-core.c +index 96328b0af164..cf2871306987 100644 +--- a/drivers/media/pci/saa7134/saa7134-core.c ++++ b/drivers/media/pci/saa7134/saa7134-core.c +@@ -978,7 +978,7 @@ static void saa7134_unregister_video(struct saa7134_dev *dev) + } + if (dev->radio_dev) { + if (video_is_registered(dev->radio_dev)) +- vb2_video_unregister_device(dev->radio_dev); ++ video_unregister_device(dev->radio_dev); + else + video_device_release(dev->radio_dev); + dev->radio_dev = NULL; +-- +2.35.3 + diff --git a/patches.suse/media-ti-cal-fix-possible-memory-leak-in-cal_ctx_cre.patch b/patches.suse/media-ti-cal-fix-possible-memory-leak-in-cal_ctx_cre.patch new file mode 100644 index 0000000..89e87bd --- /dev/null +++ b/patches.suse/media-ti-cal-fix-possible-memory-leak-in-cal_ctx_cre.patch @@ -0,0 +1,40 @@ +From 7acd650a0484d92985a0d6d867d980c6dd019885 Mon Sep 17 00:00:00 2001 +From: Gaosheng Cui +Date: Tue, 29 Nov 2022 12:01:59 +0100 +Subject: [PATCH] media: ti: cal: fix possible memory leak in cal_ctx_create() +Git-commit: 7acd650a0484d92985a0d6d867d980c6dd019885 +References: git-fixes +Patch-mainline: v6.3-rc1 + +The memory of ctx is allocated in cal_ctx_create(), but it will +not be freed when cal_ctx_v4l2_init() fails, so add kfree() when +cal_ctx_v4l2_init() fails to fix it. + +Fixes: d68a94e98a89 ("media: ti-vpe: cal: Split video device initialization and registration") +Signed-off-by: Gaosheng Cui +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Oliver Neukum +--- + drivers/media/platform/ti/cal/cal.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/ti/cal/cal.c b/drivers/media/platform/ti/cal/cal.c +index 56b61c0583cf..1236215ec70e 100644 +--- a/drivers/media/platform/ti-vpe/cal.c ++++ b/drivers/media/platform/ti-vpe/cal.c +@@ -1050,8 +1050,10 @@ static struct cal_ctx *cal_ctx_create(struct cal_dev *cal, int inst) + ctx->cport = inst; + + ret = cal_ctx_v4l2_init(ctx); +- if (ret) ++ if (ret) { ++ kfree(ctx); + return NULL; ++ } + + return ctx; + } +-- +2.39.2 + diff --git a/patches.suse/media-usb-siano-Fix-use-after-free-bugs-caused-by-do.patch b/patches.suse/media-usb-siano-Fix-use-after-free-bugs-caused-by-do.patch new file mode 100644 index 0000000..a01208a --- /dev/null +++ b/patches.suse/media-usb-siano-Fix-use-after-free-bugs-caused-by-do.patch @@ -0,0 +1,233 @@ +From ebad8e731c1c06adf04621d6fd327b860c0861b5 Mon Sep 17 00:00:00 2001 +From: Duoming Zhou +Date: Mon, 23 Jan 2023 03:04:38 +0100 +Subject: [PATCH] media: usb: siano: Fix use after free bugs caused by do_submit_urb +Git-commit: ebad8e731c1c06adf04621d6fd327b860c0861b5 +Patch-mainline: v6.3-rc1 +References: git-fixes + +There are UAF bugs caused by do_submit_urb(). One of the KASan reports +is shown below: + +[ 36.403605] BUG: KASAN: use-after-free in worker_thread+0x4a2/0x890 +[ 36.406105] Read of size 8 at addr ffff8880059600e8 by task kworker/0:2/49 +[ 36.408316] +[ 36.408867] CPU: 0 PID: 49 Comm: kworker/0:2 Not tainted 6.2.0-rc3-15798-g5a41237ad1d4-dir8 +[ 36.411696] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g15584 +[ 36.416157] Workqueue: 0x0 (events) +[ 36.417654] Call Trace: +[ 36.418546] +[ 36.419320] dump_stack_lvl+0x96/0xd0 +[ 36.420522] print_address_description+0x75/0x350 +[ 36.421992] print_report+0x11b/0x250 +[ 36.423174] ? _raw_spin_lock_irqsave+0x87/0xd0 +[ 36.424806] ? __virt_addr_valid+0xcf/0x170 +[ 36.426069] ? worker_thread+0x4a2/0x890 +[ 36.427355] kasan_report+0x131/0x160 +[ 36.428556] ? worker_thread+0x4a2/0x890 +[ 36.430053] worker_thread+0x4a2/0x890 +[ 36.431297] ? worker_clr_flags+0x90/0x90 +[ 36.432479] kthread+0x166/0x190 +[ 36.433493] ? kthread_blkcg+0x50/0x50 +[ 36.434669] ret_from_fork+0x22/0x30 +[ 36.435923] +[ 36.436684] +[ 36.437215] Allocated by task 24: +[ 36.438289] kasan_set_track+0x50/0x80 +[ 36.439436] __kasan_kmalloc+0x89/0xa0 +[ 36.440566] smsusb_probe+0x374/0xc90 +[ 36.441920] usb_probe_interface+0x2d1/0x4c0 +[ 36.443253] really_probe+0x1d5/0x580 +[ 36.444539] __driver_probe_device+0xe3/0x130 +[ 36.446085] driver_probe_device+0x49/0x220 +[ 36.447423] __device_attach_driver+0x19e/0x1b0 +[ 36.448931] bus_for_each_drv+0xcb/0x110 +[ 36.450217] __device_attach+0x132/0x1f0 +[ 36.451470] bus_probe_device+0x59/0xf0 +[ 36.452563] device_add+0x4ec/0x7b0 +[ 36.453830] usb_set_configuration+0xc63/0xe10 +[ 36.455230] usb_generic_driver_probe+0x3b/0x80 +[ 36.456166] printk: console [ttyGS0] disabled +[ 36.456569] usb_probe_device+0x90/0x110 +[ 36.459523] really_probe+0x1d5/0x580 +[ 36.461027] __driver_probe_device+0xe3/0x130 +[ 36.462465] driver_probe_device+0x49/0x220 +[ 36.463847] __device_attach_driver+0x19e/0x1b0 +[ 36.465229] bus_for_each_drv+0xcb/0x110 +[ 36.466466] __device_attach+0x132/0x1f0 +[ 36.467799] bus_probe_device+0x59/0xf0 +[ 36.469010] device_add+0x4ec/0x7b0 +[ 36.470125] usb_new_device+0x863/0xa00 +[ 36.471374] hub_event+0x18c7/0x2220 +[ 36.472746] process_one_work+0x34c/0x5b0 +[ 36.474041] worker_thread+0x4b7/0x890 +[ 36.475216] kthread+0x166/0x190 +[ 36.476267] ret_from_fork+0x22/0x30 +[ 36.477447] +[ 36.478160] Freed by task 24: +[ 36.479239] kasan_set_track+0x50/0x80 +[ 36.480512] kasan_save_free_info+0x2b/0x40 +[ 36.481808] ____kasan_slab_free+0x122/0x1a0 +[ 36.483173] __kmem_cache_free+0xc4/0x200 +[ 36.484563] smsusb_term_device+0xcd/0xf0 +[ 36.485896] smsusb_probe+0xc85/0xc90 +[ 36.486976] usb_probe_interface+0x2d1/0x4c0 +[ 36.488303] really_probe+0x1d5/0x580 +[ 36.489498] __driver_probe_device+0xe3/0x130 +[ 36.491140] driver_probe_device+0x49/0x220 +[ 36.492475] __device_attach_driver+0x19e/0x1b0 +[ 36.493988] bus_for_each_drv+0xcb/0x110 +[ 36.495171] __device_attach+0x132/0x1f0 +[ 36.496617] bus_probe_device+0x59/0xf0 +[ 36.497875] device_add+0x4ec/0x7b0 +[ 36.498972] usb_set_configuration+0xc63/0xe10 +[ 36.500264] usb_generic_driver_probe+0x3b/0x80 +[ 36.501740] usb_probe_device+0x90/0x110 +[ 36.503084] really_probe+0x1d5/0x580 +[ 36.504241] __driver_probe_device+0xe3/0x130 +[ 36.505548] driver_probe_device+0x49/0x220 +[ 36.506766] __device_attach_driver+0x19e/0x1b0 +[ 36.508368] bus_for_each_drv+0xcb/0x110 +[ 36.509646] __device_attach+0x132/0x1f0 +[ 36.510911] bus_probe_device+0x59/0xf0 +[ 36.512103] device_add+0x4ec/0x7b0 +[ 36.513215] usb_new_device+0x863/0xa00 +[ 36.514736] hub_event+0x18c7/0x2220 +[ 36.516130] process_one_work+0x34c/0x5b0 +[ 36.517396] worker_thread+0x4b7/0x890 +[ 36.518591] kthread+0x166/0x190 +[ 36.519599] ret_from_fork+0x22/0x30 +[ 36.520851] +[ 36.521405] Last potentially related work creation: +[ 36.523143] kasan_save_stack+0x3f/0x60 +[ 36.524275] kasan_record_aux_stack_noalloc+0x9d/0xb0 +[ 36.525831] insert_work+0x25/0x130 +[ 36.527039] __queue_work+0x4d4/0x620 +[ 36.528236] queue_work_on+0x72/0xb0 +[ 36.529344] __usb_hcd_giveback_urb+0x13f/0x1b0 +[ 36.530819] dummy_timer+0x350/0x1a40 +[ 36.532149] call_timer_fn+0x2c/0x190 +[ 36.533567] expire_timers+0x69/0x1f0 +[ 36.534736] __run_timers+0x289/0x2d0 +[ 36.535841] run_timer_softirq+0x2d/0x60 +[ 36.537110] __do_softirq+0x116/0x380 +[ 36.538377] +[ 36.538950] Second to last potentially related work creation: +[ 36.540855] kasan_save_stack+0x3f/0x60 +[ 36.542084] kasan_record_aux_stack_noalloc+0x9d/0xb0 +[ 36.543592] insert_work+0x25/0x130 +[ 36.544891] __queue_work+0x4d4/0x620 +[ 36.546168] queue_work_on+0x72/0xb0 +[ 36.547328] __usb_hcd_giveback_urb+0x13f/0x1b0 +[ 36.548805] dummy_timer+0x350/0x1a40 +[ 36.550116] call_timer_fn+0x2c/0x190 +[ 36.551570] expire_timers+0x69/0x1f0 +[ 36.552762] __run_timers+0x289/0x2d0 +[ 36.553916] run_timer_softirq+0x2d/0x60 +[ 36.555118] __do_softirq+0x116/0x380 +[ 36.556239] +[ 36.556807] The buggy address belongs to the object at ffff888005960000 +[ 36.556807] which belongs to the cache kmalloc-4k of size 4096 +[ 36.560652] The buggy address is located 232 bytes inside of +[ 36.560652] 4096-byte region [ffff888005960000, ffff888005961000) +[ 36.564791] +[ 36.565355] The buggy address belongs to the physical page: +[ 36.567212] page:000000004f0a0731 refcount:1 mapcount:0 mapping:0000000000000000 index:0x00 +[ 36.570534] head:000000004f0a0731 order:3 compound_mapcount:0 subpages_mapcount:0 compound0 +[ 36.573717] flags: 0x100000000010200(slab|head|node=0|zone=1) +[ 36.575481] raw: 0100000000010200 ffff888001042140 dead000000000122 0000000000000000 +[ 36.577842] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 +[ 36.580175] page dumped because: kasan: bad access detected +[ 36.581994] +[ 36.582548] Memory state around the buggy address: +[ 36.583983] ffff88800595ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +[ 36.586240] ffff888005960000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 36.588884] >ffff888005960080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 36.591071] ^ +[ 36.593295] ffff888005960100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 36.595705] ffff888005960180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 36.598026] ================================================================== +[ 36.600224] Disabling lock debugging due to kernel taint +[ 36.602681] general protection fault, probably for non-canonical address 0x43600a000000060I +[ 36.607129] CPU: 0 PID: 49 Comm: kworker/0:2 Tainted: G B 6.2.0-rc3-15798-8 +[ 36.611115] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g15584 +[ 36.615026] Workqueue: events do_submit_urb +[ 36.616290] RIP: 0010:_raw_spin_lock_irqsave+0x8a/0xd0 +[ 36.618107] Code: 24 00 00 00 00 48 89 df be 04 00 00 00 e8 9e b5 c6 fe 48 89 ef be 04 00 5 +[ 36.623522] RSP: 0018:ffff888004b6fcf0 EFLAGS: 00010046 +[ 36.625072] RAX: 0000000000000000 RBX: 043600a000000060 RCX: ffffffff9fc0e0d7 +[ 36.627206] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff888004b6fcf0 +[ 36.629813] RBP: ffff888004b6fcf0 R08: dffffc0000000000 R09: ffffed100096df9f +[ 36.631974] R10: dfffe9100096dfa0 R11: 1ffff1100096df9e R12: ffff888005960020 +[ 36.634285] R13: ffff8880059600f0 R14: 0000000000000246 R15: 0000000000000001 +[ 36.636438] FS: 0000000000000000(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 +[ 36.639092] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 36.640951] CR2: 00007f07476819a3 CR3: 0000000004a34000 CR4: 00000000000006f0 +[ 36.643411] Call Trace: +[ 36.644215] +[ 36.644902] smscore_getbuffer+0x3e/0x1e0 +[ 36.646147] do_submit_urb+0x4f/0x190 +[ 36.647449] process_one_work+0x34c/0x5b0 +[ 36.648777] worker_thread+0x4b7/0x890 +[ 36.649984] ? worker_clr_flags+0x90/0x90 +[ 36.651166] kthread+0x166/0x190 +[ 36.652151] ? kthread_blkcg+0x50/0x50 +[ 36.653547] ret_from_fork+0x22/0x30 +[ 36.655051] +[ 36.655733] Modules linked in: +[ 36.656787] ---[ end trace 0000000000000000 ]--- +[ 36.658328] RIP: 0010:_raw_spin_lock_irqsave+0x8a/0xd0 +[ 36.660045] Code: 24 00 00 00 00 48 89 df be 04 00 00 00 e8 9e b5 c6 fe 48 89 ef be 04 00 5 +[ 36.665730] RSP: 0018:ffff888004b6fcf0 EFLAGS: 00010046 +[ 36.667448] RAX: 0000000000000000 RBX: 043600a000000060 RCX: ffffffff9fc0e0d7 +[ 36.669675] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff888004b6fcf0 +[ 36.672645] RBP: ffff888004b6fcf0 R08: dffffc0000000000 R09: ffffed100096df9f +[ 36.674921] R10: dfffe9100096dfa0 R11: 1ffff1100096df9e R12: ffff888005960020 +[ 36.677034] R13: ffff8880059600f0 R14: 0000000000000246 R15: 0000000000000001 +[ 36.679184] FS: 0000000000000000(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 +[ 36.681655] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 36.683383] CR2: 00007f07476819a3 CR3: 0000000004a34000 CR4: 00000000000006f0 +[ 36.685733] Kernel panic - not syncing: Fatal exception +[ 36.688585] Kernel Offset: 0x1d400000 from 0xffffffff81000000 (relocation range: 0xfffffff) +[ 36.692199] ---[ end Kernel panic - not syncing: Fatal exception ]--- + +When the siano device is plugged in, it may call the following functions +to initialize the device. + +smsusb_probe()-->smsusb_init_device()-->smscore_start_device(). + +When smscore_start_device() gets failed, the function smsusb_term_device() +will be called and smsusb_device_t will be deallocated. Although we use +usb_kill_urb() in smsusb_stop_streaming() to cancel transfer requests +and wait for them to finish, the worker threads that are scheduled by +smsusb_onresponse() may be still running. As a result, the UAF bugs +could happen. + +We add cancel_work_sync() in smsusb_stop_streaming() in order that the +worker threads could finish before the smsusb_device_t is deallocated. + +Fixes: dd47fbd40e6e ("[media] smsusb: don't sleep while atomic") +Signed-off-by: Duoming Zhou +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/usb/siano/smsusb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c +index fe9c7b3a950e..6f443c542c6d 100644 +--- a/drivers/media/usb/siano/smsusb.c ++++ b/drivers/media/usb/siano/smsusb.c +@@ -179,6 +179,7 @@ static void smsusb_stop_streaming(struct smsusb_device_t *dev) + + for (i = 0; i < MAX_URBS; i++) { + usb_kill_urb(&dev->surbs[i].urb); ++ cancel_work_sync(&dev->surbs[i].wq); + + if (dev->surbs[i].cb) { + smscore_putbuffer(dev->coredev, dev->surbs[i].cb); +-- +2.35.3 + diff --git a/patches.suse/media-uvcvideo-Fix-race-condition-with-usb_kill_urb.patch b/patches.suse/media-uvcvideo-Fix-race-condition-with-usb_kill_urb.patch new file mode 100644 index 0000000..90cdd5e --- /dev/null +++ b/patches.suse/media-uvcvideo-Fix-race-condition-with-usb_kill_urb.patch @@ -0,0 +1,139 @@ +From 619d9b710cf06f7a00a17120ca92333684ac45a8 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Thu, 5 Jan 2023 15:31:29 +0100 +Subject: [PATCH] media: uvcvideo: Fix race condition with usb_kill_urb +Git-commit: 619d9b710cf06f7a00a17120ca92333684ac45a8 +References: git-fixes +Patch-mainline: v6.3-rc1 + +usb_kill_urb warranties that all the handlers are finished when it +returns, but does not protect against threads that might be handling +asynchronously the urb. + +For UVC, the function uvc_ctrl_status_event_async() takes care of +control changes asynchronously. + +If the code is executed in the following order: + +CPU 0 CPU 1 +===== ===== +uvc_status_complete() + uvc_status_stop() +uvc_ctrl_status_event_work() + uvc_status_start() -> FAIL + +Then uvc_status_start will keep failing and this error will be shown: + +<4>[ 5.540139] URB 0000000000000000 submitted while active +drivers/usb/core/urb.c:378 usb_submit_urb+0x4c3/0x528 + +Let's improve the current situation, by not re-submiting the urb if +we are stopping the status event. Also process the queued work +(if any) during stop. + +CPU 0 CPU 1 +===== ===== +uvc_status_complete() + uvc_status_stop() + uvc_status_start() +uvc_ctrl_status_event_work() -> FAIL + +Hopefully, with the usb layer protection this should be enough to cover +all the cases. + +Cc: stable@vger.kernel.org +Fixes: e5225c820c05 ("media: uvcvideo: Send a control event when a Control Change interrupt arrives") +Reviewed-by: Yunke Cao +Signed-off-by: Ricardo Ribalda +Reviewed-by: Laurent Pinchart +Signed-off-by: Laurent Pinchart +Signed-off-by: Oliver Neukum +--- + drivers/media/usb/uvc/uvc_ctrl.c | 5 +++++ + drivers/media/usb/uvc/uvc_status.c | 37 +++++++++++++++++++++++++++++++++++++ + drivers/media/usb/uvc/uvcvideo.h | 1 + + 3 files changed, 43 insertions(+) + +--- a/drivers/media/usb/uvc/uvc_ctrl.c ++++ b/drivers/media/usb/uvc/uvc_ctrl.c +@@ -6,6 +6,7 @@ + * Laurent Pinchart (laurent.pinchart@ideasonboard.com) + */ + ++#include + #include + #include + #include +@@ -1345,6 +1346,10 @@ static void uvc_ctrl_status_event_work(s + + uvc_ctrl_status_event(w->chain, w->ctrl, w->data); + ++ /* The barrier is needed to synchronize with uvc_status_stop(). */ ++ if (smp_load_acquire(&dev->flush_status)) ++ return; ++ + /* Resubmit the URB. */ + w->urb->interval = dev->int_ep->desc.bInterval; + ret = usb_submit_urb(w->urb, GFP_KERNEL); +--- a/drivers/media/usb/uvc/uvc_status.c ++++ b/drivers/media/usb/uvc/uvc_status.c +@@ -6,6 +6,7 @@ + * Laurent Pinchart (laurent.pinchart@ideasonboard.com) + */ + ++#include + #include + #include + #include +@@ -309,5 +310,41 @@ int uvc_status_start(struct uvc_device * + + void uvc_status_stop(struct uvc_device *dev) + { ++ struct uvc_ctrl_work *w = &dev->async_ctrl; ++ ++ /* ++ * Prevent the asynchronous control handler from requeing the URB. The ++ * barrier is needed so the flush_status change is visible to other ++ * CPUs running the asynchronous handler before usb_kill_urb() is ++ * called below. ++ */ ++ smp_store_release(&dev->flush_status, true); ++ ++ /* ++ * Cancel any pending asynchronous work. If any status event was queued, ++ * process it synchronously. ++ */ ++ if (cancel_work_sync(&w->work)) ++ uvc_ctrl_status_event(w->chain, w->ctrl, w->data); ++ ++ /* Kill the urb. */ + usb_kill_urb(dev->int_urb); ++ ++ /* ++ * The URB completion handler may have queued asynchronous work. This ++ * won't resubmit the URB as flush_status is set, but it needs to be ++ * cancelled before returning or it could then race with a future ++ * uvc_status_start() call. ++ */ ++ if (cancel_work_sync(&w->work)) ++ uvc_ctrl_status_event(w->chain, w->ctrl, w->data); ++ ++ /* ++ * From this point, there are no events on the queue and the status URB ++ * is dead. No events will be queued until uvc_status_start() is called. ++ * The barrier is needed to make sure that flush_status is visible to ++ * uvc_ctrl_status_event_work() when uvc_status_start() will be called ++ * again. ++ */ ++ smp_store_release(&dev->flush_status, false); + } +--- a/drivers/media/usb/uvc/uvcvideo.h ++++ b/drivers/media/usb/uvc/uvcvideo.h +@@ -698,6 +698,7 @@ struct uvc_device { + struct usb_host_endpoint *int_ep; + struct urb *int_urb; + u8 *status; ++ bool flush_status; + struct input_dev *input; + char input_phys[64]; + diff --git a/patches.suse/media-v4l2-jpeg-correct-the-skip-count-in-jpeg_parse.patch b/patches.suse/media-v4l2-jpeg-correct-the-skip-count-in-jpeg_parse.patch new file mode 100644 index 0000000..fa95242 --- /dev/null +++ b/patches.suse/media-v4l2-jpeg-correct-the-skip-count-in-jpeg_parse.patch @@ -0,0 +1,44 @@ +From 41959c4f973b837a12061b84d3a436fc64c73a30 Mon Sep 17 00:00:00 2001 +From: Ming Qian +Date: Fri, 16 Dec 2022 09:30:33 +0100 +Subject: [PATCH] media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data +Git-commit: 41959c4f973b837a12061b84d3a436fc64c73a30 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The curr pointer has advanced 14 bytes in jpeg_parse_app14_data. +1. jpeg_get_word_be(stream), it goes forward 2 bytes. +2. jpeg_skip(stream, 11), it goes forward 11 bytes. +3. jpeg_get_byte(stream), it goes forward 1 bytes. + +so the remain bytes of this segment should be (lp - 2 - 11 - 1), +but not (lp - 2 - 11). + +if driver skip 1 extra bytes, the following parsing may go wrong. + +Fixes: b8035f7988a8 ("media: Add parsing for APP14 data segment in jpeg helpers") +Signed-off-by: Ming Qian +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/v4l2-core/v4l2-jpeg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/v4l2-core/v4l2-jpeg.c b/drivers/media/v4l2-core/v4l2-jpeg.c +index c2513b775f6a..75c2af763d55 100644 +--- a/drivers/media/v4l2-core/v4l2-jpeg.c ++++ b/drivers/media/v4l2-core/v4l2-jpeg.c +@@ -474,7 +474,7 @@ static int jpeg_parse_app14_data(struct jpeg_stream *stream, + *tf = ret; + + /* skip the rest of the segment, this ensures at least it is complete */ +- skip = lp - 2 - 11; ++ skip = lp - 2 - 11 - 1; + return jpeg_skip(stream, skip); + } + +-- +2.35.3 + diff --git a/patches.suse/media-v4l2-jpeg-ignore-the-unknown-APP14-marker.patch b/patches.suse/media-v4l2-jpeg-ignore-the-unknown-APP14-marker.patch new file mode 100644 index 0000000..a351fb9 --- /dev/null +++ b/patches.suse/media-v4l2-jpeg-ignore-the-unknown-APP14-marker.patch @@ -0,0 +1,40 @@ +From 251c0ea6efd3c3ea0f8a55fdd96c749a98639bd3 Mon Sep 17 00:00:00 2001 +From: Ming Qian +Date: Fri, 16 Dec 2022 10:08:44 +0100 +Subject: [PATCH] media: v4l2-jpeg: ignore the unknown APP14 marker +Git-commit: 251c0ea6efd3c3ea0f8a55fdd96c749a98639bd3 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The legal identifier of APP14 is "Adobe\0", +but sometimes it may be +"This is an unknown APP marker . Compliant decoders must ignore it." +In this case, just ignore it. +It won't affect the decode result. + +Fixes: b8035f7988a8 ("media: Add parsing for APP14 data segment in jpeg helpers") +Signed-off-by: Ming Qian +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/v4l2-core/v4l2-jpeg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/v4l2-core/v4l2-jpeg.c b/drivers/media/v4l2-core/v4l2-jpeg.c +index 75c2af763d55..94435a7b6816 100644 +--- a/drivers/media/v4l2-core/v4l2-jpeg.c ++++ b/drivers/media/v4l2-core/v4l2-jpeg.c +@@ -460,7 +460,7 @@ static int jpeg_parse_app14_data(struct jpeg_stream *stream, + /* Check for "Adobe\0" in Ap1..6 */ + if (stream->curr + 6 > stream->end || + strncmp(stream->curr, "Adobe\0", 6)) +- return -EINVAL; ++ return jpeg_skip(stream, lp - 2); + + /* get to Ap12 */ + ret = jpeg_skip(stream, 11); +-- +2.35.3 + diff --git a/patches.suse/mfd-cs5535-Don-t-build-on-UML.patch b/patches.suse/mfd-cs5535-Don-t-build-on-UML.patch new file mode 100644 index 0000000..c99b7d4 --- /dev/null +++ b/patches.suse/mfd-cs5535-Don-t-build-on-UML.patch @@ -0,0 +1,62 @@ +From 5ec32a3e4053c1a726b45381d56aa9e39eaf3911 Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Wed, 30 Nov 2022 17:25:41 -0800 +Subject: [PATCH] mfd: cs5535: Don't build on UML +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 5ec32a3e4053c1a726b45381d56aa9e39eaf3911 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The cs5535-mfd driver uses CPU-specific data that is not available +for ARCH=um builds, so don't allow it to be built for UML. + +Prevents these build errors: + +In file included from ../arch/x86/include/asm/olpc.h:7, + from ../drivers/mfd/cs5535-mfd.c:17: +../arch/x86/include/asm/geode.h: In function ‘is_geode_gx’: +../arch/x86/include/asm/geode.h:16:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_vendor’ + 16 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_NSC) && +../arch/x86/include/asm/geode.h:16:46: error: ‘X86_VENDOR_NSC’ undeclared (first use in this function); did you mean ‘X86_VENDOR_ANY’? + 16 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_NSC) && +../arch/x86/include/asm/geode.h:17:31: error: ‘struct cpuinfo_um’ has no member named ‘x86’ + 17 | (boot_cpu_data.x86 == 5) && +../arch/x86/include/asm/geode.h:18:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_model’ + 18 | (boot_cpu_data.x86_model == 5)); +../arch/x86/include/asm/geode.h: In function ‘is_geode_lx’: +../arch/x86/include/asm/geode.h:23:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_vendor’ + 23 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) && +../arch/x86/include/asm/geode.h:23:46: error: ‘X86_VENDOR_AMD’ undeclared (first use in this function); did you mean ‘X86_VENDOR_ANY’? + 23 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) && +../arch/x86/include/asm/geode.h:24:31: error: ‘struct cpuinfo_um’ has no member named ‘x86’ + 24 | (boot_cpu_data.x86 == 5) && +../arch/x86/include/asm/geode.h:25:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_model’ + 25 | (boot_cpu_data.x86_model == 10)); + +Fixes: 68f5d3f3b654 ("um: add PCI over virtio emulation driver") +Signed-off-by: Randy Dunlap +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20221201012541.11809-1-rdunlap@infradead.org +Acked-by: Takashi Iwai + +--- + drivers/mfd/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig +index 2632ca2162de..d90b4258fc44 100644 +--- a/drivers/mfd/Kconfig ++++ b/drivers/mfd/Kconfig +@@ -15,6 +15,7 @@ config MFD_CS5535 + tristate "AMD CS5535 and CS5536 southbridge core functions" + select MFD_CORE + depends on PCI && (X86_32 || (X86 && COMPILE_TEST)) ++ depends on !UML + help + This is the core driver for CS5535/CS5536 MFD functions. This is + necessary for using the board's GPIO and MFGPT functionality. +-- +2.35.3 + diff --git a/patches.suse/mfd-pcf50633-adc-Fix-potential-memleak-in-pcf50633_a.patch b/patches.suse/mfd-pcf50633-adc-Fix-potential-memleak-in-pcf50633_a.patch new file mode 100644 index 0000000..fb4a0d0 --- /dev/null +++ b/patches.suse/mfd-pcf50633-adc-Fix-potential-memleak-in-pcf50633_a.patch @@ -0,0 +1,50 @@ +From 8b450dcff23aa254844492831a8e2b508a9d522d Mon Sep 17 00:00:00 2001 +From: Qiheng Lin +Date: Thu, 8 Dec 2022 14:15:55 +0800 +Subject: [PATCH] mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() +Git-commit: 8b450dcff23aa254844492831a8e2b508a9d522d +Patch-mainline: v6.3-rc1 +References: git-fixes + +`req` is allocated in pcf50633_adc_async_read(), but +adc_enqueue_request() could fail to insert the `req` into queue. +We need to check the return value and free it in the case of failure. + +Fixes: 08c3e06a5eb2 ("mfd: PCF50633 adc driver") +Signed-off-by: Qiheng Lin +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20221208061555.8776-1-linqiheng@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/mfd/pcf50633-adc.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/mfd/pcf50633-adc.c b/drivers/mfd/pcf50633-adc.c +index 5cd653e61512..191b1bc6141c 100644 +--- a/drivers/mfd/pcf50633-adc.c ++++ b/drivers/mfd/pcf50633-adc.c +@@ -136,6 +136,7 @@ int pcf50633_adc_async_read(struct pcf50633 *pcf, int mux, int avg, + void *callback_param) + { + struct pcf50633_adc_request *req; ++ int ret; + + /* req is freed when the result is ready, in interrupt handler */ + req = kmalloc(sizeof(*req), GFP_KERNEL); +@@ -147,7 +148,11 @@ int pcf50633_adc_async_read(struct pcf50633 *pcf, int mux, int avg, + req->callback = callback; + req->callback_param = callback_param; + +- return adc_enqueue_request(pcf, req); ++ ret = adc_enqueue_request(pcf, req); ++ if (ret) ++ kfree(req); ++ ++ return ret; + } + EXPORT_SYMBOL_GPL(pcf50633_adc_async_read); + +-- +2.35.3 + diff --git a/patches.suse/misc-enclosure-Fix-doc-for-enclosure_find.patch b/patches.suse/misc-enclosure-Fix-doc-for-enclosure_find.patch new file mode 100644 index 0000000..d714b10 --- /dev/null +++ b/patches.suse/misc-enclosure-Fix-doc-for-enclosure_find.patch @@ -0,0 +1,36 @@ +From f5b29c7a4df1dafd79ee7c0b1084b75afbe0ff60 Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Thu, 15 Dec 2022 13:08:04 +0400 +Subject: [PATCH] misc: enclosure: Fix doc for enclosure_find() +Git-commit: f5b29c7a4df1dafd79ee7c0b1084b75afbe0ff60 +Patch-mainline: v6.3-rc1 +References: git-fixes + +We should use put_device() to release the reference. + +Fixes: ee959b00c335 ("SCSI: convert struct class_device to struct device") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20221215090804.473022-1-linmq006@gmail.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/misc/enclosure.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/misc/enclosure.c b/drivers/misc/enclosure.c +index 1b010d9267c9..4ba966529458 100644 +--- a/drivers/misc/enclosure.c ++++ b/drivers/misc/enclosure.c +@@ -32,7 +32,7 @@ static struct class enclosure_class; + * found. @start can be used as a starting point to obtain multiple + * enclosures per parent (should begin with NULL and then be set to + * each returned enclosure device). Obtains a reference to the +- * enclosure class device which must be released with device_put(). ++ * enclosure class device which must be released with put_device(). + * If @start is not NULL, a reference must be taken on it which is + * released before returning (this allows a loop through all + * enclosures to exit with only the reference on the enclosure of +-- +2.35.3 + diff --git a/patches.suse/misc-mei-hdcp-Use-correct-macros-to-initialize-uuid_.patch b/patches.suse/misc-mei-hdcp-Use-correct-macros-to-initialize-uuid_.patch new file mode 100644 index 0000000..f15d6b8 --- /dev/null +++ b/patches.suse/misc-mei-hdcp-Use-correct-macros-to-initialize-uuid_.patch @@ -0,0 +1,41 @@ +From 512ba04d8211dd1a54dd36adc3ecc527a28069c5 Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Wed, 28 Dec 2022 18:05:00 +0200 +Subject: [PATCH] misc/mei/hdcp: Use correct macros to initialize uuid_le +Git-commit: 512ba04d8211dd1a54dd36adc3ecc527a28069c5 +Patch-mainline: v6.3-rc1 +References: git-fixes + +GUID_INIT() is for internal guid_t type and shouldn't be used +for the uuid_le. I.o.w. relying on the implementation details +is layering violation. Use correct macros to initialize uuid_le. + +Fixes: 64e9bbdd9588 ("misc/mei/hdcp: Client driver for HDCP application") +Signed-off-by: Andy Shevchenko +Acked-by: Tomas Winkler +Link: https://lore.kernel.org/r/20221228160500.21220-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/misc/mei/hdcp/mei_hdcp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/misc/mei/hdcp/mei_hdcp.c b/drivers/misc/mei/hdcp/mei_hdcp.c +index e889a8bd7ac8..e0dcd5c114db 100644 +--- a/drivers/misc/mei/hdcp/mei_hdcp.c ++++ b/drivers/misc/mei/hdcp/mei_hdcp.c +@@ -859,8 +859,8 @@ static void mei_hdcp_remove(struct mei_cl_device *cldev) + dev_warn(&cldev->dev, "mei_cldev_disable() failed\n"); + } + +-#define MEI_UUID_HDCP GUID_INIT(0xB638AB7E, 0x94E2, 0x4EA2, 0xA5, \ +- 0x52, 0xD1, 0xC5, 0x4B, 0x62, 0x7F, 0x04) ++#define MEI_UUID_HDCP UUID_LE(0xB638AB7E, 0x94E2, 0x4EA2, 0xA5, \ ++ 0x52, 0xD1, 0xC5, 0x4B, 0x62, 0x7F, 0x04) + + static const struct mei_cl_device_id mei_hdcp_tbl[] = { + { .uuid = MEI_UUID_HDCP, .version = MEI_CL_VERSION_ANY }, +-- +2.35.3 + diff --git a/patches.suse/mm-memory-return-vm_fault_t-result-from-migrate_to_ram-callback.patch b/patches.suse/mm-memory-return-vm_fault_t-result-from-migrate_to_ram-callback.patch new file mode 100644 index 0000000..f0d6e41 --- /dev/null +++ b/patches.suse/mm-memory-return-vm_fault_t-result-from-migrate_to_ram-callback.patch @@ -0,0 +1,42 @@ +From: Alistair Popple +Date: Mon, 14 Nov 2022 22:55:37 +1100 +Subject: mm/memory: return vm_fault_t result from migrate_to_ram() callback +Git-commit: 4a955bed882e734807024afd8f53213d4c61ff97 +Patch-mainline: v6.1-rc7 +References: CVE-2022-3523, bsc#1204363 + +The migrate_to_ram() callback should always succeed, but in rare cases can +fail usually returning VM_FAULT_SIGBUS. Commit 16ce101db85d +("mm/memory.c: fix race when faulting a device private page") incorrectly +stopped passing the return code up the stack. Fix this by setting the ret +variable, restoring the previous behaviour on migrate_to_ram() failure. + +Link: https://lkml.kernel.org/r/20221114115537.727371-1-apopple@nvidia.com +Fixes: 16ce101db85d ("mm/memory.c: fix race when faulting a device private page") +Signed-off-by: Alistair Popple +Acked-by: David Hildenbrand +Reviewed-by: Felix Kuehling +Cc: Ralph Campbell +Cc: John Hubbard +Cc: Alex Sierra +Cc: Ben Skeggs +Cc: Lyude Paul +Cc: Jason Gunthorpe +Cc: Michael Ellerman +Signed-off-by: Andrew Morton +Signed-off-by: Vlastimil Babka +--- + mm/memory.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -3504,7 +3504,7 @@ vm_fault_t do_swap_page(struct vm_fault + */ + get_page(vmf->page); + pte_unmap_unlock(vmf->pte, vmf->ptl); +- vmf->page->pgmap->ops->migrate_to_ram(vmf); ++ ret = vmf->page->pgmap->ops->migrate_to_ram(vmf); + put_page(vmf->page); + } else if (is_hwpoison_entry(entry)) { + ret = VM_FAULT_HWPOISON; diff --git a/patches.suse/mm-memory.c-fix-race-when-faulting-a-device-private-page.patch b/patches.suse/mm-memory.c-fix-race-when-faulting-a-device-private-page.patch new file mode 100644 index 0000000..5a7b7a1 --- /dev/null +++ b/patches.suse/mm-memory.c-fix-race-when-faulting-a-device-private-page.patch @@ -0,0 +1,458 @@ +From: Alistair Popple +Date: Wed, 28 Sep 2022 22:01:15 +1000 +Subject: mm/memory.c: fix race when faulting a device private page +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Git-commit: 16ce101db85db694a91380aa4c89b25530871d33 +Patch-mainline: v6.1-rc1 +References: CVE-2022-3523, bsc#1204363 + +[ SLE15-SP4 backport notes: + - amdkfd functions missing 'trigger' parameter do to missing SMI events + - adjust to not having split out mm/migrate_device.c + - adjust to missing page folios patches ] + +Patch series "Fix several device private page reference counting issues", +v2 + +This series aims to fix a number of page reference counting issues in +drivers dealing with device private ZONE_DEVICE pages. These result in +use-after-free type bugs, either from accessing a struct page which no +longer exists because it has been removed or accessing fields within the +struct page which are no longer valid because the page has been freed. + +During normal usage it is unlikely these will cause any problems. However +without these fixes it is possible to crash the kernel from userspace. +These crashes can be triggered either by unloading the kernel module or +unbinding the device from the driver prior to a userspace task exiting. +In modules such as Nouveau it is also possible to trigger some of these +issues by explicitly closing the device file-descriptor prior to the task +exiting and then accessing device private memory. + +This involves some minor changes to both PowerPC and AMD GPU code. +Unfortunately I lack hardware to test either of those so any help there +would be appreciated. The changes mimic what is done in for both Nouveau +and hmm-tests though so I doubt they will cause problems. + + +This patch (of 8): + +When the CPU tries to access a device private page the migrate_to_ram() +callback associated with the pgmap for the page is called. However no +reference is taken on the faulting page. Therefore a concurrent migration +of the device private page can free the page and possibly the underlying +pgmap. This results in a race which can crash the kernel due to the +migrate_to_ram() function pointer becoming invalid. It also means drivers +can't reliably read the zone_device_data field because the page may have +been freed with memunmap_pages(). + +Close the race by getting a reference on the page while holding the ptl to +ensure it has not been freed. Unfortunately the elevated reference count +will cause the migration required to handle the fault to fail. To avoid +this failure pass the faulting page into the migrate_vma functions so that +if an elevated reference count is found it can be checked to see if it's +expected or not. + +[mpe@ellerman.id.au: fix build] + Link: https://lkml.kernel.org/r/87fsgbf3gh.fsf@mpe.ellerman.id.au +Link: https://lkml.kernel.org/r/cover.60659b549d8509ddecafad4f498ee7f03bb23c69.1664366292.git-series.apopple@nvidia.com +Link: https://lkml.kernel.org/r/d3e813178a59e565e8d78d9b9a4e2562f6494f90.1664366292.git-series.apopple@nvidia.com +Signed-off-by: Alistair Popple +Acked-by: Felix Kuehling +Cc: Jason Gunthorpe +Cc: John Hubbard +Cc: Ralph Campbell +Cc: Michael Ellerman +Cc: Lyude Paul +Cc: Alex Deucher +Cc: Alex Sierra +Cc: Ben Skeggs +Cc: Christian König +Cc: Dan Williams +Cc: David Hildenbrand +Cc: "Huang, Ying" +Cc: Matthew Wilcox +Cc: Yang Shi +Cc: Zi Yan +Signed-off-by: Andrew Morton +Signed-off-by: Vlastimil Babka +--- + arch/powerpc/kvm/book3s_hv_uvmem.c | 19 +++++++++++-------- + drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 18 +++++++++++------- + drivers/gpu/drm/amd/amdkfd/kfd_migrate.h | 3 ++- + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 9 +++++---- + include/linux/migrate.h | 9 +++++++++ + lib/test_hmm.c | 5 +++-- + mm/memory.c | 16 +++++++++++++++- + mm/migrate.c | 30 ++++++++++++++++++++++-------- + 8 files changed, 78 insertions(+), 31 deletions(-) + +--- a/arch/powerpc/kvm/book3s_hv_uvmem.c ++++ b/arch/powerpc/kvm/book3s_hv_uvmem.c +@@ -507,10 +507,10 @@ unsigned long kvmppc_h_svm_init_start(st + static int __kvmppc_svm_page_out(struct vm_area_struct *vma, + unsigned long start, + unsigned long end, unsigned long page_shift, +- struct kvm *kvm, unsigned long gpa) ++ struct kvm *kvm, unsigned long gpa, struct page *fault_page) + { + unsigned long src_pfn, dst_pfn = 0; +- struct migrate_vma mig; ++ struct migrate_vma mig = { 0 }; + struct page *dpage, *spage; + struct kvmppc_uvmem_page_pvt *pvt; + unsigned long pfn; +@@ -524,6 +524,7 @@ static int __kvmppc_svm_page_out(struct + mig.dst = &dst_pfn; + mig.pgmap_owner = &kvmppc_uvmem_pgmap; + mig.flags = MIGRATE_VMA_SELECT_DEVICE_PRIVATE; ++ mig.fault_page = fault_page; + + /* The requested page is already paged-out, nothing to do */ + if (!kvmppc_gfn_is_uvmem_pfn(gpa >> page_shift, kvm, NULL)) +@@ -579,12 +580,14 @@ out_finalize: + static inline int kvmppc_svm_page_out(struct vm_area_struct *vma, + unsigned long start, unsigned long end, + unsigned long page_shift, +- struct kvm *kvm, unsigned long gpa) ++ struct kvm *kvm, unsigned long gpa, ++ struct page *fault_page) + { + int ret; + + mutex_lock(&kvm->arch.uvmem_lock); +- ret = __kvmppc_svm_page_out(vma, start, end, page_shift, kvm, gpa); ++ ret = __kvmppc_svm_page_out(vma, start, end, page_shift, kvm, gpa, ++ fault_page); + mutex_unlock(&kvm->arch.uvmem_lock); + + return ret; +@@ -633,7 +636,7 @@ void kvmppc_uvmem_drop_pages(const struc + pvt->remove_gfn = true; + + if (__kvmppc_svm_page_out(vma, addr, addr + PAGE_SIZE, +- PAGE_SHIFT, kvm, pvt->gpa)) ++ PAGE_SHIFT, kvm, pvt->gpa, NULL)) + pr_err("Can't page out gpa:0x%lx addr:0x%lx\n", + pvt->gpa, addr); + } else { +@@ -736,7 +739,7 @@ static int kvmppc_svm_page_in(struct vm_ + bool pagein) + { + unsigned long src_pfn, dst_pfn = 0; +- struct migrate_vma mig; ++ struct migrate_vma mig = { 0 }; + struct page *spage; + unsigned long pfn; + struct page *dpage; +@@ -994,7 +997,7 @@ static vm_fault_t kvmppc_uvmem_migrate_t + + if (kvmppc_svm_page_out(vmf->vma, vmf->address, + vmf->address + PAGE_SIZE, PAGE_SHIFT, +- pvt->kvm, pvt->gpa)) ++ pvt->kvm, pvt->gpa, vmf->page)) + return VM_FAULT_SIGBUS; + else + return 0; +@@ -1065,7 +1068,7 @@ kvmppc_h_svm_page_out(struct kvm *kvm, u + if (!vma || vma->vm_start > start || vma->vm_end < end) + goto out; + +- if (!kvmppc_svm_page_out(vma, start, end, page_shift, kvm, gpa)) ++ if (!kvmppc_svm_page_out(vma, start, end, page_shift, kvm, gpa, NULL)) + ret = H_SUCCESS; + out: + mmap_read_unlock(kvm->mm); +--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +@@ -380,7 +380,7 @@ svm_migrate_vma_to_vram(struct amdgpu_de + uint64_t npages = (end - start) >> PAGE_SHIFT; + struct kfd_process_device *pdd; + struct dma_fence *mfence = NULL; +- struct migrate_vma migrate; ++ struct migrate_vma migrate = { 0 }; + dma_addr_t *scratch; + size_t size; + void *buf; +@@ -601,12 +601,13 @@ out_oom: + + static int + svm_migrate_vma_to_ram(struct amdgpu_device *adev, struct svm_range *prange, +- struct vm_area_struct *vma, uint64_t start, uint64_t end) ++ struct vm_area_struct *vma, uint64_t start, uint64_t end, ++ struct page *fault_page) + { + uint64_t npages = (end - start) >> PAGE_SHIFT; + struct kfd_process_device *pdd; + struct dma_fence *mfence = NULL; +- struct migrate_vma migrate; ++ struct migrate_vma migrate = { 0 }; + dma_addr_t *scratch; + size_t size; + void *buf; +@@ -627,6 +628,7 @@ svm_migrate_vma_to_ram(struct amdgpu_dev + + migrate.src = buf; + migrate.dst = migrate.src + npages; ++ migrate.fault_page = fault_page; + scratch = (dma_addr_t *)(migrate.dst + npages); + + r = migrate_vma_setup(&migrate); +@@ -673,7 +675,8 @@ out: + * Return: + * 0 - OK, otherwise error code + */ +-int svm_migrate_vram_to_ram(struct svm_range *prange, struct mm_struct *mm) ++int svm_migrate_vram_to_ram(struct svm_range *prange, struct mm_struct *mm, ++ struct page *fault_page) + { + struct amdgpu_device *adev; + struct vm_area_struct *vma; +@@ -710,7 +713,8 @@ int svm_migrate_vram_to_ram(struct svm_r + break; + + next = min(vma->vm_end, end); +- r = svm_migrate_vma_to_ram(adev, prange, vma, addr, next); ++ r = svm_migrate_vma_to_ram(adev, prange, vma, addr, next, ++ fault_page); + if (r) { + pr_debug("failed %d to migrate\n", r); + break; +@@ -749,7 +753,7 @@ svm_migrate_vram_to_vram(struct svm_rang + + pr_debug("from gpu 0x%x to gpu 0x%x\n", prange->actual_loc, best_loc); + +- r = svm_migrate_vram_to_ram(prange, mm); ++ r = svm_migrate_vram_to_ram(prange, mm, NULL); + if (r) + return r; + +@@ -845,7 +849,7 @@ static vm_fault_t svm_migrate_to_ram(str + goto out_unlock_prange; + } + +- r = svm_migrate_vram_to_ram(prange, vmf->vma->vm_mm); ++ r = svm_migrate_vram_to_ram(prange, vmf->vma->vm_mm, vmf->page); + if (r) + pr_debug("failed %d migrate svms 0x%p range 0x%p [0x%lx 0x%lx]\n", + r, prange->svms, prange, prange->start, prange->last); +--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.h ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.h +@@ -42,7 +42,8 @@ enum MIGRATION_COPY_DIR { + + int svm_migrate_to_vram(struct svm_range *prange, uint32_t best_loc, + struct mm_struct *mm); +-int svm_migrate_vram_to_ram(struct svm_range *prange, struct mm_struct *mm); ++int svm_migrate_vram_to_ram(struct svm_range *prange, struct mm_struct *mm, ++ struct page *fault_page); + unsigned long + svm_migrate_addr_to_pfn(struct amdgpu_device *adev, unsigned long addr); + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +@@ -2551,12 +2551,13 @@ retry_write_locked: + * VRAM failed + */ + if (prange->actual_loc) +- r = svm_migrate_vram_to_ram(prange, mm); ++ r = svm_migrate_vram_to_ram(prange, mm, ++ NULL); + else + r = 0; + } + } else { +- r = svm_migrate_vram_to_ram(prange, mm); ++ r = svm_migrate_vram_to_ram(prange, mm, NULL); + } + if (r) { + pr_debug("failed %d to migrate svms %p [0x%lx 0x%lx]\n", +@@ -2858,7 +2859,7 @@ svm_range_trigger_migration(struct mm_st + return 0; + + if (!best_loc) { +- r = svm_migrate_vram_to_ram(prange, mm); ++ r = svm_migrate_vram_to_ram(prange, mm, NULL); + *migrated = !r; + return r; + } +@@ -2916,7 +2917,7 @@ static void svm_range_evict_svm_bo_worke + prange->start, prange->last); + + mutex_lock(&prange->migrate_mutex); +- svm_migrate_vram_to_ram(prange, svm_bo->eviction_fence->mm); ++ svm_migrate_vram_to_ram(prange, svm_bo->eviction_fence->mm, NULL); + + mutex_lock(&prange->lock); + prange->svm_bo = NULL; +--- a/include/linux/migrate.h ++++ b/include/linux/migrate.h +@@ -37,6 +37,9 @@ extern const char *migrate_reason_names[ + #ifdef CONFIG_MIGRATION + + extern void putback_movable_pages(struct list_head *l); ++int migrate_page_extra(struct address_space *mapping, struct page *newpage, ++ struct page *page, enum migrate_mode mode, ++ int extra_count); + extern int migrate_page(struct address_space *mapping, + struct page *newpage, struct page *page, + enum migrate_mode mode); +@@ -161,6 +164,12 @@ struct migrate_vma { + */ + void *pgmap_owner; + unsigned long flags; ++ ++ /* ++ * Set to vmf->page if this is being called to migrate a page as part of ++ * a migrate_to_ram() callback. ++ */ ++ struct page *fault_page; + }; + + int migrate_vma_setup(struct migrate_vma *args); +--- a/lib/test_hmm.c ++++ b/lib/test_hmm.c +@@ -785,7 +785,7 @@ static int dmirror_migrate(struct dmirro + unsigned long src_pfns[64]; + unsigned long dst_pfns[64]; + struct dmirror_bounce bounce; +- struct migrate_vma args; ++ struct migrate_vma args = { 0 }; + unsigned long next; + int ret; + +@@ -1146,7 +1146,7 @@ static vm_fault_t dmirror_devmem_fault_a + + static vm_fault_t dmirror_devmem_fault(struct vm_fault *vmf) + { +- struct migrate_vma args; ++ struct migrate_vma args = { 0 }; + unsigned long src_pfns; + unsigned long dst_pfns; + struct page *rpage; +@@ -1169,6 +1169,7 @@ static vm_fault_t dmirror_devmem_fault(s + args.dst = &dst_pfns; + args.pgmap_owner = dmirror->mdevice; + args.flags = MIGRATE_VMA_SELECT_DEVICE_PRIVATE; ++ args.fault_page = vmf->page; + + if (migrate_vma_setup(&args)) + return VM_FAULT_SIGBUS; +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -3491,7 +3491,21 @@ vm_fault_t do_swap_page(struct vm_fault + ret = remove_device_exclusive_entry(vmf); + } else if (is_device_private_entry(entry)) { + vmf->page = pfn_swap_entry_to_page(entry); +- ret = vmf->page->pgmap->ops->migrate_to_ram(vmf); ++ vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd, ++ vmf->address, &vmf->ptl); ++ if (unlikely(!pte_same(*vmf->pte, vmf->orig_pte))) { ++ spin_unlock(vmf->ptl); ++ goto out; ++ } ++ ++ /* ++ * Get a page reference while we know the page can't be ++ * freed. ++ */ ++ get_page(vmf->page); ++ pte_unmap_unlock(vmf->pte, vmf->ptl); ++ vmf->page->pgmap->ops->migrate_to_ram(vmf); ++ put_page(vmf->page); + } else if (is_hwpoison_entry(entry)) { + ret = VM_FAULT_HWPOISON; + } else { +--- a/mm/migrate.c ++++ b/mm/migrate.c +@@ -633,15 +633,15 @@ EXPORT_SYMBOL(migrate_page_copy); + * + * Pages are locked upon entry and exit. + */ +-int migrate_page(struct address_space *mapping, ++int migrate_page_extra(struct address_space *mapping, + struct page *newpage, struct page *page, +- enum migrate_mode mode) ++ enum migrate_mode mode, int extra_count) + { + int rc; + + BUG_ON(PageWriteback(page)); /* Writeback must be complete */ + +- rc = migrate_page_move_mapping(mapping, newpage, page, 0); ++ rc = migrate_page_move_mapping(mapping, newpage, page, extra_count); + + if (rc != MIGRATEPAGE_SUCCESS) + return rc; +@@ -652,6 +652,13 @@ int migrate_page(struct address_space *m + migrate_page_states(newpage, page); + return MIGRATEPAGE_SUCCESS; + } ++ ++int migrate_page(struct address_space *mapping, ++ struct page *newpage, struct page *page, ++ enum migrate_mode mode) ++{ ++ return migrate_page_extra(mapping, newpage, page, mode, 0); ++} + EXPORT_SYMBOL(migrate_page); + + #ifdef CONFIG_BLOCK +@@ -2389,14 +2396,14 @@ static void migrate_vma_collect(struct m + * migrate_page_move_mapping(), except that here we allow migration of a + * ZONE_DEVICE page. + */ +-static bool migrate_vma_check_page(struct page *page) ++static bool migrate_vma_check_page(struct page *page, struct page *fault_page) + { + /* + * One extra ref because caller holds an extra reference, either from + * isolate_lru_page() for a regular page, or migrate_vma_collect() for + * a device page. + */ +- int extra = 1; ++ int extra = 1 + (page == fault_page); + + /* + * FIXME support THP (transparent huge page), it is bit more complex to +@@ -2504,7 +2511,7 @@ static void migrate_vma_prepare(struct m + put_page(page); + } + +- if (!migrate_vma_check_page(page)) { ++ if (!migrate_vma_check_page(page, migrate->fault_page)) { + if (remap) { + migrate->src[i] &= ~MIGRATE_PFN_MIGRATE; + migrate->cpages--; +@@ -2571,7 +2578,7 @@ static void migrate_vma_unmap(struct mig + goto restore; + } + +- if (migrate_vma_check_page(page)) ++ if (migrate_vma_check_page(page, migrate->fault_page)) + continue; + + restore: +@@ -2681,6 +2688,8 @@ int migrate_vma_setup(struct migrate_vma + return -EINVAL; + if (!args->src || !args->dst) + return -EINVAL; ++ if (args->fault_page && !is_device_private_page(args->fault_page)) ++ return -EINVAL; + + memset(args->src, 0, sizeof(*args->src) * nr_pages); + args->cpages = 0; +@@ -2913,7 +2922,12 @@ void migrate_vma_pages(struct migrate_vm + } + } + +- r = migrate_page(mapping, newpage, page, MIGRATE_SYNC_NO_COPY); ++ if (migrate->fault_page == page) ++ r = migrate_page_extra(mapping, newpage, page, ++ MIGRATE_SYNC_NO_COPY, 1); ++ else ++ r = migrate_page(mapping, newpage, page, ++ MIGRATE_SYNC_NO_COPY); + if (r != MIGRATEPAGE_SUCCESS) + migrate->src[i] &= ~MIGRATE_PFN_MIGRATE; + } diff --git a/patches.suse/mmc-jz4740-Work-around-bug-on-JZ4760-B.patch b/patches.suse/mmc-jz4740-Work-around-bug-on-JZ4760-B.patch new file mode 100644 index 0000000..1245f25 --- /dev/null +++ b/patches.suse/mmc-jz4740-Work-around-bug-on-JZ4760-B.patch @@ -0,0 +1,49 @@ +From 3f18c5046e633cc4bbad396b74c05d46d353033d Mon Sep 17 00:00:00 2001 +From: Paul Cercueil +Date: Tue, 31 Jan 2023 21:02:28 +0000 +Subject: [PATCH] mmc: jz4740: Work around bug on JZ4760(B) +Git-commit: 3f18c5046e633cc4bbad396b74c05d46d353033d +Patch-mainline: v6.2 +References: git-fixes + +On JZ4760 and JZ4760B, SD cards fail to run if the maximum clock +rate is set to 50 MHz, even though the controller officially does +support it. + +Until the actual bug is found and fixed, limit the maximum clock rate to +24 MHz. + +Signed-off-by: Paul Cercueil +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230131210229.68129-1-paul@crapouillou.net +Signed-off-by: Ulf Hansson +Acked-by: Takashi Iwai + +--- + drivers/mmc/host/jz4740_mmc.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/mmc/host/jz4740_mmc.c b/drivers/mmc/host/jz4740_mmc.c +index dc2db9c185ea..eda1e2ddcaca 100644 +--- a/drivers/mmc/host/jz4740_mmc.c ++++ b/drivers/mmc/host/jz4740_mmc.c +@@ -1053,6 +1053,16 @@ static int jz4740_mmc_probe(struct platform_device* pdev) + mmc->ops = &jz4740_mmc_ops; + if (!mmc->f_max) + mmc->f_max = JZ_MMC_CLK_RATE; ++ ++ /* ++ * There seems to be a problem with this driver on the JZ4760 and ++ * JZ4760B SoCs. There, when using the maximum rate supported (50 MHz), ++ * the communication fails with many SD cards. ++ * Until this bug is sorted out, limit the maximum rate to 24 MHz. ++ */ ++ if (host->version == JZ_MMC_JZ4760 && mmc->f_max > JZ_MMC_CLK_RATE) ++ mmc->f_max = JZ_MMC_CLK_RATE; ++ + mmc->f_min = mmc->f_max / 128; + mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34; + +-- +2.35.3 + diff --git a/patches.suse/mmc-mmc_spi-fix-error-handling-in-mmc_spi_probe.patch b/patches.suse/mmc-mmc_spi-fix-error-handling-in-mmc_spi_probe.patch new file mode 100644 index 0000000..a3f1c6c --- /dev/null +++ b/patches.suse/mmc-mmc_spi-fix-error-handling-in-mmc_spi_probe.patch @@ -0,0 +1,70 @@ +From cf4c9d2ac1e42c7d18b921bec39486896645b714 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Tue, 31 Jan 2023 09:38:35 +0800 +Subject: [PATCH] mmc: mmc_spi: fix error handling in mmc_spi_probe() +Git-commit: cf4c9d2ac1e42c7d18b921bec39486896645b714 +Patch-mainline: v6.2 +References: git-fixes + +If mmc_add_host() fails, it doesn't need to call mmc_remove_host(), +or it will cause null-ptr-deref, because of deleting a not added +device in mmc_remove_host(). + +To fix this, goto label 'fail_glue_init', if mmc_add_host() fails, +and change the label 'fail_add_host' to 'fail_gpiod_request'. + +Fixes: 15a0580ced08 ("mmc_spi host driver") +Signed-off-by: Yang Yingliang +Cc:stable@vger.kernel.org + +Link: https://lore.kernel.org/r/20230131013835.3564011-1-yangyingliang@huawei.com +Signed-off-by: Ulf Hansson +Acked-by: Takashi Iwai + +--- + drivers/mmc/host/mmc_spi.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/mmc/host/mmc_spi.c b/drivers/mmc/host/mmc_spi.c +index 106dd204b1a7..cc333ad67cac 100644 +--- a/drivers/mmc/host/mmc_spi.c ++++ b/drivers/mmc/host/mmc_spi.c +@@ -1437,7 +1437,7 @@ static int mmc_spi_probe(struct spi_device *spi) + + status = mmc_add_host(mmc); + if (status != 0) +- goto fail_add_host; ++ goto fail_glue_init; + + /* + * Index 0 is card detect +@@ -1445,7 +1445,7 @@ static int mmc_spi_probe(struct spi_device *spi) + */ + status = mmc_gpiod_request_cd(mmc, NULL, 0, false, 1000); + if (status == -EPROBE_DEFER) +- goto fail_add_host; ++ goto fail_gpiod_request; + if (!status) { + /* + * The platform has a CD GPIO signal that may support +@@ -1460,7 +1460,7 @@ static int mmc_spi_probe(struct spi_device *spi) + /* Index 1 is write protect/read only */ + status = mmc_gpiod_request_ro(mmc, NULL, 1, 0); + if (status == -EPROBE_DEFER) +- goto fail_add_host; ++ goto fail_gpiod_request; + if (!status) + has_ro = true; + +@@ -1474,7 +1474,7 @@ static int mmc_spi_probe(struct spi_device *spi) + ? ", cd polling" : ""); + return 0; + +-fail_add_host: ++fail_gpiod_request: + mmc_remove_host(mmc); + fail_glue_init: + mmc_spi_dma_free(host); +-- +2.35.3 + diff --git a/patches.suse/mmc-sdio-fix-possible-resource-leaks-in-some-error-p.patch b/patches.suse/mmc-sdio-fix-possible-resource-leaks-in-some-error-p.patch new file mode 100644 index 0000000..93825ff --- /dev/null +++ b/patches.suse/mmc-sdio-fix-possible-resource-leaks-in-some-error-p.patch @@ -0,0 +1,134 @@ +From 605d9fb9556f8f5fb4566f4df1480f280f308ded Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Mon, 30 Jan 2023 20:58:08 +0800 +Subject: [PATCH] mmc: sdio: fix possible resource leaks in some error paths +Git-commit: 605d9fb9556f8f5fb4566f4df1480f280f308ded +Patch-mainline: v6.2 +References: git-fixes + +If sdio_add_func() or sdio_init_func() fails, sdio_remove_func() can +not release the resources, because the sdio function is not presented +in these two cases, it won't call of_node_put() or put_device(). + +To fix these leaks, make sdio_func_present() only control whether +device_del() needs to be called or not, then always call of_node_put() +and put_device(). + +In error case in sdio_init_func(), the reference of 'card->dev' is +not get, to avoid redundant put in sdio_free_func_cis(), move the +get_device() to sdio_alloc_func() and put_device() to sdio_release_func(), +it can keep the get/put function be balanced. + +Without this patch, while doing fault inject test, it can get the +following leak reports, after this fix, the leak is gone. + +unreferenced object 0xffff888112514000 (size 2048): + comm "kworker/3:2", pid 65, jiffies 4294741614 (age 124.774s) + hex dump (first 32 bytes): + 00 e0 6f 12 81 88 ff ff 60 58 8d 06 81 88 ff ff ..o.....`X...... + 10 40 51 12 81 88 ff ff 10 40 51 12 81 88 ff ff .@Q......@Q..... + backtrace: + [<000000009e5931da>] kmalloc_trace+0x21/0x110 + [<000000002f839ccb>] mmc_alloc_card+0x38/0xb0 [mmc_core] + [<0000000004adcbf6>] mmc_sdio_init_card+0xde/0x170 [mmc_core] + [<000000007538fea0>] mmc_attach_sdio+0xcb/0x1b0 [mmc_core] + [<00000000d4fdeba7>] mmc_rescan+0x54a/0x640 [mmc_core] + +unreferenced object 0xffff888112511000 (size 2048): + comm "kworker/3:2", pid 65, jiffies 4294741623 (age 124.766s) + hex dump (first 32 bytes): + 00 40 51 12 81 88 ff ff e0 58 8d 06 81 88 ff ff .@Q......X...... + 10 10 51 12 81 88 ff ff 10 10 51 12 81 88 ff ff ..Q.......Q..... + backtrace: + [<000000009e5931da>] kmalloc_trace+0x21/0x110 + [<00000000fcbe706c>] sdio_alloc_func+0x35/0x100 [mmc_core] + [<00000000c68f4b50>] mmc_attach_sdio.cold.18+0xb1/0x395 [mmc_core] + [<00000000d4fdeba7>] mmc_rescan+0x54a/0x640 [mmc_core] + +Fixes: 3d10a1ba0d37 ("sdio: fix reference counting in sdio_remove_func()") +Signed-off-by: Yang Yingliang +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230130125808.3471254-1-yangyingliang@huawei.com +Signed-off-by: Ulf Hansson +Acked-by: Takashi Iwai + +--- + drivers/mmc/core/sdio_bus.c | 17 ++++++++++++++--- + drivers/mmc/core/sdio_cis.c | 12 ------------ + 2 files changed, 14 insertions(+), 15 deletions(-) + +diff --git a/drivers/mmc/core/sdio_bus.c b/drivers/mmc/core/sdio_bus.c +index babf21a0adeb..f191a2a76f3b 100644 +--- a/drivers/mmc/core/sdio_bus.c ++++ b/drivers/mmc/core/sdio_bus.c +@@ -294,6 +294,12 @@ static void sdio_release_func(struct device *dev) + if (!(func->card->quirks & MMC_QUIRK_NONSTD_SDIO)) + sdio_free_func_cis(func); + ++ /* ++ * We have now removed the link to the tuples in the ++ * card structure, so remove the reference. ++ */ ++ put_device(&func->card->dev); ++ + kfree(func->info); + kfree(func->tmpbuf); + kfree(func); +@@ -324,6 +330,12 @@ struct sdio_func *sdio_alloc_func(struct mmc_card *card) + + device_initialize(&func->dev); + ++ /* ++ * We may link to tuples in the card structure, ++ * we need make sure we have a reference to it. ++ */ ++ get_device(&func->card->dev); ++ + func->dev.parent = &card->dev; + func->dev.bus = &sdio_bus_type; + func->dev.release = sdio_release_func; +@@ -377,10 +389,9 @@ int sdio_add_func(struct sdio_func *func) + */ + void sdio_remove_func(struct sdio_func *func) + { +- if (!sdio_func_present(func)) +- return; ++ if (sdio_func_present(func)) ++ device_del(&func->dev); + +- device_del(&func->dev); + of_node_put(func->dev.of_node); + put_device(&func->dev); + } +diff --git a/drivers/mmc/core/sdio_cis.c b/drivers/mmc/core/sdio_cis.c +index a705ba6eff5b..afaa6cab1adc 100644 +--- a/drivers/mmc/core/sdio_cis.c ++++ b/drivers/mmc/core/sdio_cis.c +@@ -403,12 +403,6 @@ int sdio_read_func_cis(struct sdio_func *func) + if (ret) + return ret; + +- /* +- * Since we've linked to tuples in the card structure, +- * we must make sure we have a reference to it. +- */ +- get_device(&func->card->dev); +- + /* + * Vendor/device id is optional for function CIS, so + * copy it from the card structure as needed. +@@ -434,11 +428,5 @@ void sdio_free_func_cis(struct sdio_func *func) + } + + func->tuples = NULL; +- +- /* +- * We have now removed the link to the tuples in the +- * card structure, so remove the reference. +- */ +- put_device(&func->card->dev); + } + +-- +2.35.3 + diff --git a/patches.suse/msft-hv-2767-hv_netvsc-Check-status-in-SEND_RNDIS_PKT-completion-.patch b/patches.suse/msft-hv-2767-hv_netvsc-Check-status-in-SEND_RNDIS_PKT-completion-.patch new file mode 100644 index 0000000..f20e54d --- /dev/null +++ b/patches.suse/msft-hv-2767-hv_netvsc-Check-status-in-SEND_RNDIS_PKT-completion-.patch @@ -0,0 +1,58 @@ +From: Michael Kelley +Date: Sun, 12 Feb 2023 21:08:01 -0800 +Patch-mainline: v6.3-rc1 +Subject: hv_netvsc: Check status in SEND_RNDIS_PKT completion message +Git-commit: dca5161f9bd052e9e73be90716ffd57e8762c697 +References: git-fixes + +Completion responses to SEND_RNDIS_PKT messages are currently processed +regardless of the status in the response, so that resources associated +with the request are freed. While this is appropriate, code bugs that +cause sending a malformed message, or errors on the Hyper-V host, go +undetected. Fix this by checking the status and outputting a rate-limited +message if there is an error. + +Signed-off-by: Michael Kelley +Reviewed-by: Haiyang Zhang +Link: https://lore.kernel.org/r/1676264881-48928-1-git-send-email-mikelley@microsoft.com +Signed-off-by: Paolo Abeni +Acked-by: Olaf Hering +--- + drivers/net/hyperv/netvsc.c | 18 +++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c +--- a/drivers/net/hyperv/netvsc.c ++++ b/drivers/net/hyperv/netvsc.c +@@ -851,6 +851,7 @@ static void netvsc_send_completion(struct net_device *ndev, + u32 msglen = hv_pkt_datalen(desc); + struct nvsp_message *pkt_rqst; + u64 cmd_rqst; ++ u32 status; + + /* First check if this is a VMBUS completion without data payload */ + if (!msglen) { +@@ -922,6 +923,23 @@ static void netvsc_send_completion(struct net_device *ndev, + break; + + case NVSP_MSG1_TYPE_SEND_RNDIS_PKT_COMPLETE: ++ if (msglen < sizeof(struct nvsp_message_header) + ++ sizeof(struct nvsp_1_message_send_rndis_packet_complete)) { ++ if (net_ratelimit()) ++ netdev_err(ndev, "nvsp_rndis_pkt_complete length too small: %u\n", ++ msglen); ++ return; ++ } ++ ++ /* If status indicates an error, output a message so we know ++ * there's a problem. But process the completion anyway so the ++ * resources are released. ++ */ ++ status = nvsp_packet->msg.v1_msg.send_rndis_pkt_complete.status; ++ if (status != NVSP_STAT_SUCCESS && net_ratelimit()) ++ netdev_err(ndev, "nvsp_rndis_pkt_complete error status: %x\n", ++ status); ++ + netvsc_send_tx_complete(ndev, net_device, incoming_channel, + desc, budget); + break; diff --git a/patches.suse/mtd-dataflash-remove-duplicate-SPI-ID-table.patch b/patches.suse/mtd-dataflash-remove-duplicate-SPI-ID-table.patch new file mode 100644 index 0000000..f281b72 --- /dev/null +++ b/patches.suse/mtd-dataflash-remove-duplicate-SPI-ID-table.patch @@ -0,0 +1,63 @@ +From a30144c02c84614ed160ab70e38fcf7b024a1bb0 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Thu, 15 Dec 2022 17:47:30 +0100 +Subject: [PATCH] mtd: dataflash: remove duplicate SPI ID table +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: a30144c02c84614ed160ab70e38fcf7b024a1bb0 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Building with -Werror=override-init reveals that two patches added +the same device ID table to this driver: + +drivers/mtd/devices/mtd_dataflash.c:946:27: error: initialized field overwritten [-Werror=override-init] + 946 | .id_table = dataflash_spi_ids, + | ^~~~~~~~~~~~~~~~~ +drivers/mtd/devices/mtd_dataflash.c:946:27: note: (near initialization for 'dataflash_driver.id_table') + +Remove one of the copies. + +Fixes: 27a030e87292 ("mtd: dataflash: Add device-tree SPI IDs") +Fixes: ac4f83482afb ("mtd: dataflash: Add SPI ID table") +Signed-off-by: Arnd Bergmann +Acked-by: Uwe Kleine-König +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20221215164736.1315815-1-arnd@kernel.org +Acked-by: Takashi Iwai + +--- + drivers/mtd/devices/mtd_dataflash.c | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/drivers/mtd/devices/mtd_dataflash.c b/drivers/mtd/devices/mtd_dataflash.c +index 25bad4318305..3bbaa590c768 100644 +--- a/drivers/mtd/devices/mtd_dataflash.c ++++ b/drivers/mtd/devices/mtd_dataflash.c +@@ -96,13 +96,6 @@ struct dataflash { + struct mtd_info mtd; + }; + +-static const struct spi_device_id dataflash_dev_ids[] = { +- { "at45" }, +- { "dataflash" }, +- { }, +-}; +-MODULE_DEVICE_TABLE(spi, dataflash_dev_ids); +- + #ifdef CONFIG_OF + static const struct of_device_id dataflash_dt_ids[] = { + { .compatible = "atmel,at45", }, +@@ -939,8 +932,6 @@ static struct spi_driver dataflash_driver = { + .name = "mtd_dataflash", + .of_match_table = of_match_ptr(dataflash_dt_ids), + }, +- .id_table = dataflash_dev_ids, +- + .probe = dataflash_probe, + .remove = dataflash_remove, + .id_table = dataflash_spi_ids, +-- +2.35.3 + diff --git a/patches.suse/mtd-rawnand-fsl_elbc-Propagate-HW-ECC-settings-to-HW.patch b/patches.suse/mtd-rawnand-fsl_elbc-Propagate-HW-ECC-settings-to-HW.patch new file mode 100644 index 0000000..8cc2fd4 --- /dev/null +++ b/patches.suse/mtd-rawnand-fsl_elbc-Propagate-HW-ECC-settings-to-HW.patch @@ -0,0 +1,69 @@ +From b56265257d38af5abf43bd5461ca166b401c35a5 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Pali=20Roh=C3=A1r?= +Date: Sat, 28 Jan 2023 14:41:11 +0100 +Subject: [PATCH] mtd: rawnand: fsl_elbc: Propagate HW ECC settings to HW +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: b56265257d38af5abf43bd5461ca166b401c35a5 +Patch-mainline: v6.3-rc1 +References: git-fixes + +It is possible that current chip->ecc.engine_type value does not match to +configured HW value (if HW ECC checking and generating is enabled or not). + +This can happen with old U-Boot bootloader version which either does not +initialize NAND (and let it in some default unusable state) or initialize +NAND with different parameters than what is specified in kernel DTS file. + +So if kernel chose to use some chip->ecc.engine_type settings (e.g. from +DTS file) then do not depend on bootloader HW configuration and configures +HW ECC settings according to chip->ecc.engine_type value. + +BR_DECC must be set to BR_DECC_CHK_GEN when HW is doing ECC (both +generating and checking), or to BR_DECC_OFF when HW is not doing ECC. + +This change fixes usage of SW ECC support in case bootloader explicitly +enabled HW ECC support and kernel DTS file has specified to use SW ECC. +(Of course this works only in case when NAND is not a boot device and both +bootloader and kernel are loaded from different location, e.g. FLASH NOR.) + +Fixes: f6424c22aa36 ("mtd: rawnand: fsl_elbc: Make SW ECC work") +Signed-off-by: Pali Rohár +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20230128134111.32559-1-pali@kernel.org +Acked-by: Takashi Iwai + +--- + drivers/mtd/nand/raw/fsl_elbc_nand.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/mtd/nand/raw/fsl_elbc_nand.c b/drivers/mtd/nand/raw/fsl_elbc_nand.c +index a18d121396aa..e25119e58b69 100644 +--- a/drivers/mtd/nand/raw/fsl_elbc_nand.c ++++ b/drivers/mtd/nand/raw/fsl_elbc_nand.c +@@ -725,6 +725,7 @@ static int fsl_elbc_attach_chip(struct nand_chip *chip) + struct fsl_lbc_ctrl *ctrl = priv->ctrl; + struct fsl_lbc_regs __iomem *lbc = ctrl->regs; + unsigned int al; ++ u32 br; + + /* + * if ECC was not chosen in DT, decide whether to use HW or SW ECC from +@@ -764,6 +765,13 @@ static int fsl_elbc_attach_chip(struct nand_chip *chip) + return -EINVAL; + } + ++ /* enable/disable HW ECC checking and generating based on if HW ECC was chosen */ ++ br = in_be32(&lbc->bank[priv->bank].br) & ~BR_DECC; ++ if (chip->ecc.engine_type == NAND_ECC_ENGINE_TYPE_ON_HOST) ++ out_be32(&lbc->bank[priv->bank].br, br | BR_DECC_CHK_GEN); ++ else ++ out_be32(&lbc->bank[priv->bank].br, br | BR_DECC_OFF); ++ + /* calculate FMR Address Length field */ + al = 0; + if (chip->pagemask & 0xffff0000) +-- +2.35.3 + diff --git a/patches.suse/mtd-rawnand-sunxi-Clean-up-chips-after-failed-init.patch b/patches.suse/mtd-rawnand-sunxi-Clean-up-chips-after-failed-init.patch new file mode 100644 index 0000000..9269b78 --- /dev/null +++ b/patches.suse/mtd-rawnand-sunxi-Clean-up-chips-after-failed-init.patch @@ -0,0 +1,88 @@ +From 6d7fea226b238b95d69faba49b8faf73d6e8c469 Mon Sep 17 00:00:00 2001 +From: Samuel Holland +Date: Thu, 29 Dec 2022 12:15:20 -0600 +Subject: [PATCH] mtd: rawnand: sunxi: Clean up chips after failed init +Git-commit: 6d7fea226b238b95d69faba49b8faf73d6e8c469 +Patch-mainline: v6.3-rc1 +References: git-fixes + +If a chip fails to initialize, we need to clean up any chips that were +already initialized/registered. + +Fixes: 1fef62c1423b ("mtd: nand: add sunxi NAND flash controller support") +Signed-off-by: Samuel Holland +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20221229181526.53766-2-samuel@sholland.org +Acked-by: Takashi Iwai + +--- + drivers/mtd/nand/raw/sunxi_nand.c | 39 ++++++++++++++++--------------- + 1 file changed, 20 insertions(+), 19 deletions(-) + +diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c +index ea953e31933e..2ee86f7b0905 100644 +--- a/drivers/mtd/nand/raw/sunxi_nand.c ++++ b/drivers/mtd/nand/raw/sunxi_nand.c +@@ -1950,6 +1950,25 @@ static const struct nand_controller_ops sunxi_nand_controller_ops = { + .exec_op = sunxi_nfc_exec_op, + }; + ++static void sunxi_nand_chips_cleanup(struct sunxi_nfc *nfc) ++{ ++ struct sunxi_nand_chip *sunxi_nand; ++ struct nand_chip *chip; ++ int ret; ++ ++ while (!list_empty(&nfc->chips)) { ++ sunxi_nand = list_first_entry(&nfc->chips, ++ struct sunxi_nand_chip, ++ node); ++ chip = &sunxi_nand->nand; ++ ret = mtd_device_unregister(nand_to_mtd(chip)); ++ WARN_ON(ret); ++ nand_cleanup(chip); ++ sunxi_nand_ecc_cleanup(sunxi_nand); ++ list_del(&sunxi_nand->node); ++ } ++} ++ + static int sunxi_nand_chip_init(struct device *dev, struct sunxi_nfc *nfc, + struct device_node *np) + { +@@ -2053,6 +2072,7 @@ static int sunxi_nand_chips_init(struct device *dev, struct sunxi_nfc *nfc) + ret = sunxi_nand_chip_init(dev, nfc, nand_np); + if (ret) { + of_node_put(nand_np); ++ sunxi_nand_chips_cleanup(nfc); + return ret; + } + } +@@ -2060,25 +2080,6 @@ static int sunxi_nand_chips_init(struct device *dev, struct sunxi_nfc *nfc) + return 0; + } + +-static void sunxi_nand_chips_cleanup(struct sunxi_nfc *nfc) +-{ +- struct sunxi_nand_chip *sunxi_nand; +- struct nand_chip *chip; +- int ret; +- +- while (!list_empty(&nfc->chips)) { +- sunxi_nand = list_first_entry(&nfc->chips, +- struct sunxi_nand_chip, +- node); +- chip = &sunxi_nand->nand; +- ret = mtd_device_unregister(nand_to_mtd(chip)); +- WARN_ON(ret); +- nand_cleanup(chip); +- sunxi_nand_ecc_cleanup(sunxi_nand); +- list_del(&sunxi_nand->node); +- } +-} +- + static int sunxi_nfc_dma_init(struct sunxi_nfc *nfc, struct resource *r) + { + int ret; +-- +2.35.3 + diff --git a/patches.suse/mtd-rawnand-sunxi-Fix-the-size-of-the-last-OOB-regio.patch b/patches.suse/mtd-rawnand-sunxi-Fix-the-size-of-the-last-OOB-regio.patch new file mode 100644 index 0000000..9dcdcee --- /dev/null +++ b/patches.suse/mtd-rawnand-sunxi-Fix-the-size-of-the-last-OOB-regio.patch @@ -0,0 +1,37 @@ +From 34569d869532b54d6e360d224a0254dcdd6a1785 Mon Sep 17 00:00:00 2001 +From: Samuel Holland +Date: Thu, 29 Dec 2022 12:15:24 -0600 +Subject: [PATCH] mtd: rawnand: sunxi: Fix the size of the last OOB region +Git-commit: 34569d869532b54d6e360d224a0254dcdd6a1785 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The previous code assigned to the wrong structure member. + +Fixes: c66811e6d350 ("mtd: nand: sunxi: switch to mtd_ooblayout_ops") +Signed-off-by: Samuel Holland +Acked-by: Dhruva Gole +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20221229181526.53766-6-samuel@sholland.org +Acked-by: Takashi Iwai + +--- + drivers/mtd/nand/raw/sunxi_nand.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c +index 1bddeb1be66f..e673ac46f2e8 100644 +--- a/drivers/mtd/nand/raw/sunxi_nand.c ++++ b/drivers/mtd/nand/raw/sunxi_nand.c +@@ -1609,7 +1609,7 @@ static int sunxi_nand_ooblayout_free(struct mtd_info *mtd, int section, + if (section < ecc->steps) + oobregion->length = 4; + else +- oobregion->offset = mtd->oobsize - oobregion->offset; ++ oobregion->length = mtd->oobsize - oobregion->offset; + + return 0; + } +-- +2.35.3 + diff --git a/patches.suse/mtd-spi-nor-Fix-shift-out-of-bounds-in-spi_nor_set_e.patch b/patches.suse/mtd-spi-nor-Fix-shift-out-of-bounds-in-spi_nor_set_e.patch new file mode 100644 index 0000000..25c3790 --- /dev/null +++ b/patches.suse/mtd-spi-nor-Fix-shift-out-of-bounds-in-spi_nor_set_e.patch @@ -0,0 +1,85 @@ +From f0f0cfdc3a024e21161714f2e05f0df3b84d42ad Mon Sep 17 00:00:00 2001 +From: Louis Rannou +Date: Fri, 3 Feb 2023 09:07:54 +0200 +Subject: [PATCH] mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type +Git-commit: f0f0cfdc3a024e21161714f2e05f0df3b84d42ad +Patch-mainline: v6.3-rc1 +References: git-fixes + +spi_nor_set_erase_type() was used either to set or to mask out an erase +type. When we used it to mask out an erase type a shift-out-of-bounds +was hit: +Ubsan: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24 +shift exponent 4294967295 is too large for 32-bit type 'int' + +The setting of the size_{shift, mask} and of the opcode are unnecessary +when the erase size is zero, as throughout the code just the erase size +is considered to determine whether an erase type is supported or not. +Setting the opcode to 0xFF was wrong too as nobody guarantees that 0xFF +is an unused opcode. Thus when masking out an erase type, just set the +erase size to zero. This will fix the shift-out-of-bounds. + +Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI NOR flash memories") +Cc: stable@vger.kernel.org +Reported-by: Alexander Stein +Signed-off-by: Louis Rannou +Tested-by: Alexander Stein +Link: https://lore.kernel.org/r/20230203070754.50677-1-tudor.ambarus@linaro.org +[ta: refine changes, new commit message, fix compilation error] +Signed-off-by: Tudor Ambarus +Acked-by: Takashi Iwai + +--- + drivers/mtd/spi-nor/core.c | 9 +++++++++ + drivers/mtd/spi-nor/core.h | 1 + + drivers/mtd/spi-nor/sfdp.c | 4 ++-- + 3 files changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/mtd/spi-nor/core.c ++++ b/drivers/mtd/spi-nor/core.c +@@ -2248,6 +2248,15 @@ void spi_nor_set_erase_type(struct spi_n + } + + /** ++ * spi_nor_mask_erase_type() - mask out a SPI NOR erase type ++ * @erase: pointer to a structure that describes a SPI NOR erase type ++ */ ++void spi_nor_mask_erase_type(struct spi_nor_erase_type *erase) ++{ ++ erase->size = 0; ++} ++ ++/** + * spi_nor_init_uniform_erase_map() - Initialize uniform erase map + * @map: the erase map of the SPI NOR + * @erase_mask: bitmask encoding erase types that can erase the entire +--- a/drivers/mtd/spi-nor/core.h ++++ b/drivers/mtd/spi-nor/core.h +@@ -538,6 +538,7 @@ void spi_nor_set_pp_settings(struct spi_ + + void spi_nor_set_erase_type(struct spi_nor_erase_type *erase, u32 size, + u8 opcode); ++void spi_nor_mask_erase_type(struct spi_nor_erase_type *erase); + struct spi_nor_erase_region * + spi_nor_region_next(struct spi_nor_erase_region *region); + void spi_nor_init_uniform_erase_map(struct spi_nor_erase_map *map, +--- a/drivers/mtd/spi-nor/sfdp.c ++++ b/drivers/mtd/spi-nor/sfdp.c +@@ -874,7 +874,7 @@ static int spi_nor_init_non_uniform_eras + */ + for (i = 0; i < SNOR_ERASE_TYPE_MAX; i++) + if (!(regions_erase_type & BIT(erase[i].idx))) +- spi_nor_set_erase_type(&erase[i], 0, 0xFF); ++ spi_nor_mask_erase_type(&erase[i]); + + return 0; + } +@@ -1088,7 +1088,7 @@ static int spi_nor_parse_4bait(struct sp + erase_type[i].opcode = (dwords[1] >> + erase_type[i].idx * 8) & 0xFF; + else +- spi_nor_set_erase_type(&erase_type[i], 0u, 0xFF); ++ spi_nor_mask_erase_type(&erase_type[i]); + } + + /* diff --git a/patches.suse/mtd-spi-nor-core-fix-implicit-declaration-warning.patch b/patches.suse/mtd-spi-nor-core-fix-implicit-declaration-warning.patch new file mode 100644 index 0000000..cee6a67 --- /dev/null +++ b/patches.suse/mtd-spi-nor-core-fix-implicit-declaration-warning.patch @@ -0,0 +1,44 @@ +From 25e3f30601a368642678744fc8a9b1dce183c7bc Mon Sep 17 00:00:00 2001 +From: Zeng Heng +Date: Fri, 23 Sep 2022 11:14:57 +0800 +Subject: [PATCH] mtd: spi-nor: core: fix implicit declaration warning +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 25e3f30601a368642678744fc8a9b1dce183c7bc +Patch-mainline: v6.3-rc1 +References: git-fixes + +spi-nor/core.c needs to include linux/delay.h, +or it would raise below compile warning: + +Drivers/mtd/spi-nor/core.c: In function ‘spi_nor_soft_reset’: +drivers/mtd/spi-nor/core.c:2779:2: error: implicit declaration of function ‘usleep_range’ [-Werror=implicit-function-declaration] + 2779 | usleep_range(SPI_NOR_SRST_SLEEP_MIN, SPI_NOR_SRST_SLEEP_MAX); + | ^~~~~~~~~~~~ + +Fixes: d73ee7534cc5 ("mtd: spi-nor: core: perform a Soft Reset on shutdown") +Signed-off-by: Zeng Heng +Signed-off-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20220923031457.56103-1-zengheng4@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/mtd/spi-nor/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c +index d8703d7dfd0a..b500655f7937 100644 +--- a/drivers/mtd/spi-nor/core.c ++++ b/drivers/mtd/spi-nor/core.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + + #include + #include +-- +2.35.3 + diff --git a/patches.suse/mtd-spi-nor-sfdp-Fix-index-value-for-SCCR-dwords.patch b/patches.suse/mtd-spi-nor-sfdp-Fix-index-value-for-SCCR-dwords.patch new file mode 100644 index 0000000..1a8e818 --- /dev/null +++ b/patches.suse/mtd-spi-nor-sfdp-Fix-index-value-for-SCCR-dwords.patch @@ -0,0 +1,38 @@ +From ad9679f3811899fd1c21dc7bdd715e8e1cfb46b9 Mon Sep 17 00:00:00 2001 +From: Takahiro Kuwano +Date: Mon, 26 Dec 2022 13:01:58 +0900 +Subject: [PATCH] mtd: spi-nor: sfdp: Fix index value for SCCR dwords +Git-commit: ad9679f3811899fd1c21dc7bdd715e8e1cfb46b9 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Array index for SCCR 22th DOWRD should be 21. + +Fixes: 981a8d60e01f ("mtd: spi-nor: Parse SFDP SCCR Map") +Signed-off-by: Takahiro Kuwano +Signed-off-by: Tudor Ambarus +Reviewed-by: Michael Walle +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/d8a2a77c2c95cf776e7dcae6392d29fdcf5d6307.1672026365.git.Takahiro.Kuwano@infineon.com +Acked-by: Takashi Iwai + +--- + drivers/mtd/spi-nor/sfdp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/spi-nor/sfdp.c b/drivers/mtd/spi-nor/sfdp.c +index 8434f654eca1..5df2fcba5483 100644 +--- a/drivers/mtd/spi-nor/sfdp.c ++++ b/drivers/mtd/spi-nor/sfdp.c +@@ -1228,7 +1228,7 @@ static int spi_nor_parse_sccr(struct spi_nor *nor, + + le32_to_cpu_array(dwords, sccr_header->length); + +- if (FIELD_GET(SCCR_DWORD22_OCTAL_DTR_EN_VOLATILE, dwords[22])) ++ if (FIELD_GET(SCCR_DWORD22_OCTAL_DTR_EN_VOLATILE, dwords[21])) + nor->flags |= SNOR_F_IO_MODE_EN_VOLATILE; + + out: +-- +2.35.3 + diff --git a/patches.suse/mtd-spi-nor-spansion-Consider-reserved-bits-in-CFR5-.patch b/patches.suse/mtd-spi-nor-spansion-Consider-reserved-bits-in-CFR5-.patch new file mode 100644 index 0000000..e62def6 --- /dev/null +++ b/patches.suse/mtd-spi-nor-spansion-Consider-reserved-bits-in-CFR5-.patch @@ -0,0 +1,46 @@ +From 3f592a869f87723314f0cb1ac232bd3bf8245be8 Mon Sep 17 00:00:00 2001 +From: Tudor Ambarus +Date: Tue, 10 Jan 2023 18:47:02 +0200 +Subject: [PATCH] mtd: spi-nor: spansion: Consider reserved bits in CFR5 register +Git-commit: 3f592a869f87723314f0cb1ac232bd3bf8245be8 +Patch-mainline: v6.3-rc1 +References: git-fixes + +CFR5[6] is reserved bit and must be always 1. Set it to comply with flash +requirements. While fixing SPINOR_REG_CYPRESS_CFR5V_OCT_DTR_{EN, DS} +definition, stop using magic numbers and describe the missing bit fields +in CFR5 register. This is useful for both readability and future possible +addition of Octal STR mode support. + +Fixes: c3266af101f2 ("mtd: spi-nor: spansion: add support for Cypress Semper flash") +Cc: stable@vger.kernel.org +Reported-by: Takahiro Kuwano +Signed-off-by: Tudor Ambarus +Reviewed-by: Dhruva Gole +Reviewed-by: Pratyush Yadav +Tested-by: Dhruva Gole +Link: https://lore.kernel.org/linux-mtd/20230110164703.83413-1-tudor.ambarus@linaro.org +Acked-by: Takashi Iwai + +--- + drivers/mtd/spi-nor/spansion.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/mtd/spi-nor/spansion.c ++++ b/drivers/mtd/spi-nor/spansion.c +@@ -15,8 +15,13 @@ + #define SPINOR_REG_CYPRESS_CFR3V 0x00800004 + #define SPINOR_REG_CYPRESS_CFR3V_PGSZ BIT(4) /* Page size. */ + #define SPINOR_REG_CYPRESS_CFR5V 0x00800006 +-#define SPINOR_REG_CYPRESS_CFR5V_OCT_DTR_EN 0x3 +-#define SPINOR_REG_CYPRESS_CFR5V_OCT_DTR_DS 0 ++#define SPINOR_REG_CYPRESS_CFR5_BIT6 BIT(6) ++#define SPINOR_REG_CYPRESS_CFR5_DDR BIT(1) ++#define SPINOR_REG_CYPRESS_CFR5_OPI BIT(0) ++#define SPINOR_REG_CYPRESS_CFR5V_OCT_DTR_EN \ ++ (SPINOR_REG_CYPRESS_CFR5_BIT6 | SPINOR_REG_CYPRESS_CFR5_DDR | \ ++ SPINOR_REG_CYPRESS_CFR5_OPI) ++#define SPINOR_REG_CYPRESS_CFR5V_OCT_DTR_DS SPINOR_REG_CYPRESS_CFR5_BIT6 + #define SPINOR_OP_CYPRESS_RD_FAST 0xee + + /** diff --git a/patches.suse/net-rose-Fix-to-not-accept-on-connected-socket.patch b/patches.suse/net-rose-Fix-to-not-accept-on-connected-socket.patch new file mode 100644 index 0000000..3ba24eb --- /dev/null +++ b/patches.suse/net-rose-Fix-to-not-accept-on-connected-socket.patch @@ -0,0 +1,63 @@ +From 14caefcf9837a2be765a566005ad82cd0d2a429f Mon Sep 17 00:00:00 2001 +From: Hyunwoo Kim +Date: Wed, 25 Jan 2023 02:59:44 -0800 +Subject: [PATCH] net/rose: Fix to not accept on connected socket +Git-commit: 14caefcf9837a2be765a566005ad82cd0d2a429f +Patch-mainline: v6.2-rc7 +References: git-fixes + +If you call listen() and accept() on an already connect()ed +rose socket, accept() can successfully connect. +This is because when the peer socket sends data to sendmsg, +the skb with its own sk stored in the connected socket's +sk->sk_receive_queue is connected, and rose_accept() dequeues +the skb waiting in the sk->sk_receive_queue. + +This creates a child socket with the sk of the parent +rose socket, which can cause confusion. + +Fix rose_listen() to return -EINVAL if the socket has +already been successfully connected, and add lock_sock +to prevent this issue. + +Signed-off-by: Hyunwoo Kim +Reviewed-by: Kuniyuki Iwashima +Link: https://lore.kernel.org/r/20230125105944.GA133314@ubuntu +Signed-off-by: Jakub Kicinski +Acked-by: Takashi Iwai + +--- + net/rose/af_rose.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c +index 36fefc3957d7..ca2b17f32670 100644 +--- a/net/rose/af_rose.c ++++ b/net/rose/af_rose.c +@@ -488,6 +488,12 @@ static int rose_listen(struct socket *sock, int backlog) + { + struct sock *sk = sock->sk; + ++ lock_sock(sk); ++ if (sock->state != SS_UNCONNECTED) { ++ release_sock(sk); ++ return -EINVAL; ++ } ++ + if (sk->sk_state != TCP_LISTEN) { + struct rose_sock *rose = rose_sk(sk); + +@@ -497,8 +503,10 @@ static int rose_listen(struct socket *sock, int backlog) + memset(rose->dest_digis, 0, AX25_ADDR_LEN * ROSE_MAX_DIGIS); + sk->sk_max_ack_backlog = backlog; + sk->sk_state = TCP_LISTEN; ++ release_sock(sk); + return 0; + } ++ release_sock(sk); + + return -EOPNOTSUPP; + } +-- +2.35.3 + diff --git a/patches.suse/net-sunrpc-fix-reference-count-leaks-in-rpc_sysfs_xp.patch b/patches.suse/net-sunrpc-fix-reference-count-leaks-in-rpc_sysfs_xp.patch new file mode 100644 index 0000000..db38b38 --- /dev/null +++ b/patches.suse/net-sunrpc-fix-reference-count-leaks-in-rpc_sysfs_xp.patch @@ -0,0 +1,44 @@ +From: Xiyu Yang +Date: Thu, 9 Sep 2021 12:32:38 +0800 +Subject: [PATCH] net/sunrpc: fix reference count leaks in + rpc_sysfs_xprt_state_change +Git-commit: 776d794f28c95051bc70405a7b1fa40115658a18 +Patch-mainline: v5.17 +References: git-fixes + +The refcount leak issues take place in an error handling path. When the +3rd argument buf doesn't match with "offline", "online" or "remove", the +function simply returns -EINVAL and forgets to decrease the reference +count of a rpc_xprt object and a rpc_xprt_switch object increased by +rpc_sysfs_xprt_kobj_get_xprt() and +rpc_sysfs_xprt_kobj_get_xprt_switch(), causing reference count leaks of +both unused objects. + +Fix this issue by jumping to the error handling path labelled with +out_put when buf matches none of "offline", "online" or "remove". + +Signed-off-by: Xiyu Yang +Signed-off-by: Xin Xiong +Signed-off-by: Xin Tan +Signed-off-by: Anna Schumaker +Acked-by: NeilBrown + +--- + net/sunrpc/sysfs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/net/sunrpc/sysfs.c ++++ b/net/sunrpc/sysfs.c +@@ -274,8 +274,10 @@ static ssize_t rpc_sysfs_xprt_state_chan + online = 1; + else if (!strncmp(buf, "remove", 6)) + remove = 1; +- else +- return -EINVAL; ++ else { ++ count = -EINVAL; ++ goto out_put; ++ } + + if (wait_on_bit_lock(&xprt->state, XPRT_LOCKED, TASK_KILLABLE)) { + count = -EINTR; diff --git a/patches.suse/net-ulp-prevent-ULP-without-clone-op-from-entering-t.patch b/patches.suse/net-ulp-prevent-ULP-without-clone-op-from-entering-t.patch new file mode 100644 index 0000000..35b5ec6 --- /dev/null +++ b/patches.suse/net-ulp-prevent-ULP-without-clone-op-from-entering-t.patch @@ -0,0 +1,77 @@ +From: Paolo Abeni +Date: Tue, 3 Jan 2023 12:19:17 +0100 +Subject: net/ulp: prevent ULP without clone op from entering the LISTEN status +Patch-mainline: v6.2-rc3 +Git-commit: 2c02d41d71f90a5168391b6a5f2954112ba2307c +References: CVE-2023-0461 bsc#1208787 + +When an ULP-enabled socket enters the LISTEN status, the listener ULP data +pointer is copied inside the child/accepted sockets by sk_clone_lock(). + +The relevant ULP can take care of de-duplicating the context pointer via +the clone() operation, but only MPTCP and SMC implement such op. + +Other ULPs may end-up with a double-free at socket disposal time. + +We can't simply clear the ULP data at clone time, as TLS replaces the +socket ops with custom ones assuming a valid TLS ULP context is +available. + +Instead completely prevent clone-less ULP sockets from entering the +LISTEN status. + +Fixes: 734942cc4ea6 ("tcp: ULP infrastructure") +Reported-by: slipper +Signed-off-by: Paolo Abeni +Link: https://lore.kernel.org/r/4b80c3d1dbe3d0ab072f80450c202d9bc88b4b03.1672740602.git.pabeni@redhat.com +Signed-off-by: Jakub Kicinski +Acked-by: Michal Kubecek + +--- + net/ipv4/inet_connection_sock.c | 17 ++++++++++++++++- + net/ipv4/tcp_ulp.c | 4 ++++ + 2 files changed, 20 insertions(+), 1 deletion(-) + +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -1034,11 +1034,26 @@ void inet_csk_prepare_forced_close(struct sock *sk) + } + EXPORT_SYMBOL(inet_csk_prepare_forced_close); + ++static int inet_ulp_can_listen(const struct sock *sk) ++{ ++ const struct inet_connection_sock *icsk = inet_csk(sk); ++ ++ if (icsk->icsk_ulp_ops && !icsk->icsk_ulp_ops->clone) ++ return -EINVAL; ++ ++ return 0; ++} ++ + int inet_csk_listen_start(struct sock *sk, int backlog) + { + struct inet_connection_sock *icsk = inet_csk(sk); + struct inet_sock *inet = inet_sk(sk); +- int err = -EADDRINUSE; ++ int err; ++ ++ err = inet_ulp_can_listen(sk); ++ if (unlikely(err)) ++ return err; ++ err = -EADDRINUSE; + + reqsk_queue_alloc(&icsk->icsk_accept_queue); + +--- a/net/ipv4/tcp_ulp.c ++++ b/net/ipv4/tcp_ulp.c +@@ -136,6 +136,10 @@ static int __tcp_set_ulp(struct sock *sk, const struct tcp_ulp_ops *ulp_ops) + if (icsk->icsk_ulp_ops) + goto out_err; + ++ err = -EINVAL; ++ if (!ulp_ops->clone && sk->sk_state == TCP_LISTEN) ++ goto out_err; ++ + err = ulp_ops->init(sk); + if (err) + goto out_err; diff --git a/patches.suse/net-ulp-use-consistent-error-code-when-blocking-ULP.patch b/patches.suse/net-ulp-use-consistent-error-code-when-blocking-ULP.patch new file mode 100644 index 0000000..1092b0b --- /dev/null +++ b/patches.suse/net-ulp-use-consistent-error-code-when-blocking-ULP.patch @@ -0,0 +1,50 @@ +From: Paolo Abeni +Date: Wed, 18 Jan 2023 13:24:12 +0100 +Subject: net/ulp: use consistent error code when blocking ULP +Patch-mainline: v6.2-rc5 +Git-commit: 8ccc99362b60c6f27bb46f36fdaaccf4ef0303de +References: CVE-2023-0461 bsc#1208787 + +The referenced commit changed the error code returned by the kernel +when preventing a non-established socket from attaching the ktls +ULP. Before to such a commit, the user-space got ENOTCONN instead +of EINVAL. + +The existing self-tests depend on such error code, and the change +caused a failure: + + RUN global.non_established ... + tls.c:1673:non_established:Expected errno (22) == ENOTCONN (107) + non_established: Test failed at step #3 + FAIL global.non_established + +In the unlikely event existing applications do the same, address +the issue by restoring the prior error code in the above scenario. + +Note that the only other ULP performing similar checks at init +time - smc_ulp_ops - also fails with ENOTCONN when trying to attach +the ULP to a non-established socket. + +Reported-by: Sabrina Dubroca +Fixes: 2c02d41d71f9 ("net/ulp: prevent ULP without clone op from entering the LISTEN status") +Signed-off-by: Paolo Abeni +Reviewed-by: Sabrina Dubroca +Link: https://lore.kernel.org/r/7bb199e7a93317fb6f8bf8b9b2dc71c18f337cde.1674042685.git.pabeni@redhat.com +Signed-off-by: Jakub Kicinski +Acked-by: Michal Kubecek + +--- + net/ipv4/tcp_ulp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/tcp_ulp.c ++++ b/net/ipv4/tcp_ulp.c +@@ -136,7 +136,7 @@ static int __tcp_set_ulp(struct sock *sk, const struct tcp_ulp_ops *ulp_ops) + if (icsk->icsk_ulp_ops) + goto out_err; + +- err = -EINVAL; ++ err = -ENOTCONN; + if (!ulp_ops->clone && sk->sk_state == TCP_LISTEN) + goto out_err; + diff --git a/patches.suse/nfc-fix-memory-leak-of-se_io-context-in-nfc_genl_se_.patch b/patches.suse/nfc-fix-memory-leak-of-se_io-context-in-nfc_genl_se_.patch new file mode 100644 index 0000000..80267bf --- /dev/null +++ b/patches.suse/nfc-fix-memory-leak-of-se_io-context-in-nfc_genl_se_.patch @@ -0,0 +1,85 @@ +From 25ff6f8a5a3b8dc48e8abda6f013e8cc4b14ffea Mon Sep 17 00:00:00 2001 +From: Fedor Pchelkin +Date: Sat, 25 Feb 2023 13:56:14 +0300 +Subject: [PATCH] nfc: fix memory leak of se_io context in nfc_genl_se_io +Git-commit: 25ff6f8a5a3b8dc48e8abda6f013e8cc4b14ffea +Patch-mainline: v6.3-rc1 +References: git-fixes + +The callback context for sending/receiving APDUs to/from the selected +secure element is allocated inside nfc_genl_se_io and supposed to be +eventually freed in se_io_cb callback function. However, there are several +error paths where the bwi_timer is not charged to call se_io_cb later, and +the cb_context is leaked. + +The patch proposes to free the cb_context explicitly on those error paths. + +At the moment we can't simply check 'dev->ops->se_io()' return value as it +may be negative in both cases: when the timer was charged and was not. + +Fixes: 5ce3f32b5264 ("NFC: netlink: SE API implementation") +Reported-by: syzbot+df64c0a2e8d68e78a4fa@syzkaller.appspotmail.com +Signed-off-by: Fedor Pchelkin +Signed-off-by: Alexey Khoroshilov +Signed-off-by: David S. Miller +Acked-by: Takashi Iwai + +--- + drivers/nfc/st-nci/se.c | 6 ++++++ + drivers/nfc/st21nfca/se.c | 6 ++++++ + net/nfc/netlink.c | 4 ++++ + 3 files changed, 16 insertions(+) + +diff --git a/drivers/nfc/st-nci/se.c b/drivers/nfc/st-nci/se.c +index ec87dd21e054..b2f1ced8e6dd 100644 +--- a/drivers/nfc/st-nci/se.c ++++ b/drivers/nfc/st-nci/se.c +@@ -672,6 +672,12 @@ int st_nci_se_io(struct nci_dev *ndev, u32 se_idx, + ST_NCI_EVT_TRANSMIT_DATA, apdu, + apdu_length); + default: ++ /* Need to free cb_context here as at the moment we can't ++ * clearly indicate to the caller if the callback function ++ * would be called (and free it) or not. In both cases a ++ * negative value may be returned to the caller. ++ */ ++ kfree(cb_context); + return -ENODEV; + } + } +diff --git a/drivers/nfc/st21nfca/se.c b/drivers/nfc/st21nfca/se.c +index df8d27cf2956..dae288bebcb5 100644 +--- a/drivers/nfc/st21nfca/se.c ++++ b/drivers/nfc/st21nfca/se.c +@@ -236,6 +236,12 @@ int st21nfca_hci_se_io(struct nfc_hci_dev *hdev, u32 se_idx, + ST21NFCA_EVT_TRANSMIT_DATA, + apdu, apdu_length); + default: ++ /* Need to free cb_context here as at the moment we can't ++ * clearly indicate to the caller if the callback function ++ * would be called (and free it) or not. In both cases a ++ * negative value may be returned to the caller. ++ */ ++ kfree(cb_context); + return -ENODEV; + } + } +diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c +index 1fc339084d89..348bf561bc9f 100644 +--- a/net/nfc/netlink.c ++++ b/net/nfc/netlink.c +@@ -1442,7 +1442,11 @@ static int nfc_se_io(struct nfc_dev *dev, u32 se_idx, + rc = dev->ops->se_io(dev, se_idx, apdu, + apdu_length, cb, cb_context); + ++ device_unlock(&dev->dev); ++ return rc; ++ + error: ++ kfree(cb_context); + device_unlock(&dev->dev); + return rc; + } +-- +2.35.3 + diff --git a/patches.suse/nfs-nfs4clinet-check-the-return-value-of-kstrdup.patch b/patches.suse/nfs-nfs4clinet-check-the-return-value-of-kstrdup.patch new file mode 100644 index 0000000..6ec1545 --- /dev/null +++ b/patches.suse/nfs-nfs4clinet-check-the-return-value-of-kstrdup.patch @@ -0,0 +1,34 @@ +From: Xiaoke Wang +Date: Fri, 17 Dec 2021 01:01:33 +0800 +Subject: [PATCH] nfs: nfs4clinet: check the return value of kstrdup() +Git-commit: fbd2057e5329d3502a27491190237b6be52a1cb6 +Patch-mainline: v5.17 +References: git-fixes + +kstrdup() returns NULL when some internal memory errors happen, it is +better to check the return value of it so to catch the memory error in +time. + +Signed-off-by: Xiaoke Wang +Signed-off-by: Anna Schumaker +Acked-by: NeilBrown + +--- + fs/nfs/nfs4client.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -1331,8 +1331,11 @@ int nfs4_update_server(struct nfs_server + } + nfs_put_client(clp); + +- if (server->nfs_client->cl_hostname == NULL) ++ if (server->nfs_client->cl_hostname == NULL) { + server->nfs_client->cl_hostname = kstrdup(hostname, GFP_KERNEL); ++ if (server->nfs_client->cl_hostname == NULL) ++ return -ENOMEM; ++ } + nfs_server_insert_lists(server); + + return nfs_probe_destination(server); diff --git a/patches.suse/nouveau-fix-migrate_to_ram-for-faulting-page.patch b/patches.suse/nouveau-fix-migrate_to_ram-for-faulting-page.patch new file mode 100644 index 0000000..f348fcb --- /dev/null +++ b/patches.suse/nouveau-fix-migrate_to_ram-for-faulting-page.patch @@ -0,0 +1,38 @@ +From: Alistair Popple +Date: Wed, 19 Oct 2022 23:29:34 +1100 +Subject: nouveau: fix migrate_to_ram() for faulting page +Git-commit: 97061d441110528dc02972818f2f1dad485107f9 +Alt-commit: 1beca7f1471e14802f7f6730ac9ac0a3de7c8f8b +Patch-mainline: v6.1-rc2 +References: CVE-2022-3523, bsc#1204363 + +Commit 16ce101db85d ("mm/memory.c: fix race when faulting a device private +page") changed the migrate_to_ram() callback to take a reference on the +device page to ensure it can't be freed while handling the fault. +Unfortunately the corresponding update to Nouveau to accommodate this +change was inadvertently dropped from that patch causing GPU to CPU +migration to fail so add it here. + +Link: https://lkml.kernel.org/r/20221019122934.866205-1-apopple@nvidia.com +Fixes: 16ce101db85d ("mm/memory.c: fix race when faulting a device private page") +Signed-off-by: Alistair Popple +Cc: John Hubbard +Cc: Ralph Campbell +Cc: Lyude Paul +Cc: Ben Skeggs +Signed-off-by: Andrew Morton +Signed-off-by: Vlastimil Babka +--- + drivers/gpu/drm/nouveau/nouveau_dmem.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/nouveau/nouveau_dmem.c ++++ b/drivers/gpu/drm/nouveau/nouveau_dmem.c +@@ -192,6 +192,7 @@ static vm_fault_t nouveau_dmem_migrate_t + .src = &src, + .dst = &dst, + .pgmap_owner = drm->dev, ++ .fault_page = vmf->page, + .flags = MIGRATE_VMA_SELECT_DEVICE_PRIVATE, + }; + diff --git a/patches.suse/nvme-auth-check-chap-ctrl_key-once-constructed.patch b/patches.suse/nvme-auth-check-chap-ctrl_key-once-constructed.patch new file mode 100644 index 0000000..f2b33a9 --- /dev/null +++ b/patches.suse/nvme-auth-check-chap-ctrl_key-once-constructed.patch @@ -0,0 +1,40 @@ +From: Sagi Grimberg +Date: Sun, 13 Nov 2022 13:24:18 +0200 +Subject: nvme-auth: check chap ctrl_key once constructed +Patch-mainline: v6.2-rc1 +Git-commit: 546dea18c99928bb81392de63092da0e25d07b10 +References: bsc#1202633 + +ctrl ctrl_key member may be overwritten from a sysfs context driven +by the user. Once a queue local copy was created, use that instead +to minimize checks on a shared resource. + +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Hannes Reinecke +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/auth.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -333,7 +333,7 @@ static int nvme_auth_process_dhchap_succ + struct nvmf_auth_dhchap_success1_data *data = chap->buf; + size_t size = sizeof(*data); + +- if (ctrl->ctrl_key) ++ if (chap->ctrl_key) + size += chap->hash_len; + + if (size > CHAP_BUF_SIZE) { +@@ -811,7 +811,7 @@ static void nvme_queue_auth_work(struct + goto fail2; + } + +- if (ctrl->ctrl_key) { ++ if (chap->ctrl_key) { + /* DH-HMAC-CHAP Step 5: send success2 */ + dev_dbg(ctrl->device, "%s: qid %d send success2\n", + __func__, chap->qid); diff --git a/patches.suse/nvme-auth-clear-sensitive-info-right-after-authentic.patch b/patches.suse/nvme-auth-clear-sensitive-info-right-after-authentic.patch new file mode 100644 index 0000000..5ee6804 --- /dev/null +++ b/patches.suse/nvme-auth-clear-sensitive-info-right-after-authentic.patch @@ -0,0 +1,30 @@ +From: Sagi Grimberg +Date: Sun, 13 Nov 2022 13:24:15 +0200 +Subject: nvme-auth: clear sensitive info right after authentication completes +Patch-mainline: v6.2-rc1 +Git-commit: 8d1c1904e94757b78c28fbbef9285e4101d86ee9 +References: bsc#1202633 + +We don't want to keep authentication sensitive info in memory for unlimited +amount of time. + +Reviewed-by: Hannes Reinecke +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/auth.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -912,6 +912,8 @@ int nvme_auth_wait(struct nvme_ctrl *ctr + mutex_unlock(&ctrl->dhchap_auth_mutex); + flush_work(&chap->auth_work); + ret = chap->error; ++ /* clear sensitive info */ ++ nvme_auth_reset_dhchap(chap); + return ret; + } + mutex_unlock(&ctrl->dhchap_auth_mutex); diff --git a/patches.suse/nvme-auth-convert-dhchap_auth_list-to-an-array.patch b/patches.suse/nvme-auth-convert-dhchap_auth_list-to-an-array.patch new file mode 100644 index 0000000..c6d5496 --- /dev/null +++ b/patches.suse/nvme-auth-convert-dhchap_auth_list-to-an-array.patch @@ -0,0 +1,286 @@ +From: Sagi Grimberg +Date: Sun, 13 Nov 2022 13:24:20 +0200 +Subject: nvme-auth: convert dhchap_auth_list to an array +Patch-mainline: v6.2-rc1 +Git-commit: aa36d711e945e65fa87410927800f01878a8faed +References: bsc#1202633 + +We know exactly how many dhchap contexts we will need, there is no need +to hold a list that we need to protect with a mutex. Convert to +a dynamically allocated array. And dhchap_context access state is +maintained by the chap itself. + +Make dhchap_auth_mutex protect only the ctrl host_key and ctrl_key +in a fine-grained lock such that there is no long lasting acquisition +of the lock and no need to take/release this lock when flushing +authentication works. + +Signed-off-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/auth.c | 118 +++++++++++++++++++++------------------ + drivers/nvme/host/core.c | 4 ++ + drivers/nvme/host/nvme.h | 2 +- + 3 files changed, 69 insertions(+), 55 deletions(-) + +diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c +index 781a6003109d..24726683d4bc 100644 +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -50,6 +50,12 @@ struct nvme_dhchap_queue_context { + #define nvme_auth_queue_from_qid(ctrl, qid) \ + (qid == 0) ? (ctrl)->fabrics_q : (ctrl)->connect_q + ++static inline int ctrl_max_dhchaps(struct nvme_ctrl *ctrl) ++{ ++ return ctrl->opts->nr_io_queues + ctrl->opts->nr_write_queues + ++ ctrl->opts->nr_poll_queues + 1; ++} ++ + static int nvme_auth_submit(struct nvme_ctrl *ctrl, int qid, + void *data, size_t data_len, bool auth_send) + { +@@ -510,6 +516,7 @@ static int nvme_auth_dhchap_setup_ctrl_response(struct nvme_ctrl *ctrl, + ret = PTR_ERR(ctrl_response); + return ret; + } ++ + ret = crypto_shash_setkey(chap->shash_tfm, + ctrl_response, ctrl->ctrl_key->len); + if (ret) { +@@ -668,7 +675,6 @@ static void nvme_auth_free_dhchap(struct nvme_dhchap_queue_context *chap) + crypto_free_shash(chap->shash_tfm); + if (chap->dh_tfm) + crypto_free_kpp(chap->dh_tfm); +- kfree(chap); + } + + static void nvme_queue_auth_work(struct work_struct *work) +@@ -748,11 +754,14 @@ static void nvme_queue_auth_work(struct work_struct *work) + + dev_dbg(ctrl->device, "%s: qid %d host response\n", + __func__, chap->qid); ++ mutex_lock(&ctrl->dhchap_auth_mutex); + ret = nvme_auth_dhchap_setup_host_response(ctrl, chap); + if (ret) { ++ mutex_unlock(&ctrl->dhchap_auth_mutex); + chap->error = ret; + goto fail2; + } ++ mutex_unlock(&ctrl->dhchap_auth_mutex); + + /* DH-HMAC-CHAP Step 3: send reply */ + dev_dbg(ctrl->device, "%s: qid %d send reply\n", +@@ -793,16 +802,19 @@ static void nvme_queue_auth_work(struct work_struct *work) + return; + } + ++ mutex_lock(&ctrl->dhchap_auth_mutex); + if (ctrl->ctrl_key) { + dev_dbg(ctrl->device, + "%s: qid %d controller response\n", + __func__, chap->qid); + ret = nvme_auth_dhchap_setup_ctrl_response(ctrl, chap); + if (ret) { ++ mutex_unlock(&ctrl->dhchap_auth_mutex); + chap->error = ret; + goto fail2; + } + } ++ mutex_unlock(&ctrl->dhchap_auth_mutex); + + ret = nvme_auth_process_dhchap_success1(ctrl, chap); + if (ret) { +@@ -852,29 +864,8 @@ int nvme_auth_negotiate(struct nvme_ctrl *ctrl, int qid) + return -ENOKEY; + } + +- mutex_lock(&ctrl->dhchap_auth_mutex); +- /* Check if the context is already queued */ +- list_for_each_entry(chap, &ctrl->dhchap_auth_list, entry) { +- WARN_ON(!chap->buf); +- if (chap->qid == qid) { +- dev_dbg(ctrl->device, "qid %d: re-using context\n", qid); +- mutex_unlock(&ctrl->dhchap_auth_mutex); +- flush_work(&chap->auth_work); +- nvme_auth_reset_dhchap(chap); +- queue_work(nvme_wq, &chap->auth_work); +- return 0; +- } +- } +- chap = kzalloc(sizeof(*chap), GFP_KERNEL); +- if (!chap) { +- mutex_unlock(&ctrl->dhchap_auth_mutex); +- return -ENOMEM; +- } +- chap->qid = qid; +- chap->ctrl = ctrl; +- INIT_WORK(&chap->auth_work, nvme_queue_auth_work); +- list_add(&chap->entry, &ctrl->dhchap_auth_list); +- mutex_unlock(&ctrl->dhchap_auth_mutex); ++ chap = &ctrl->dhchap_ctxs[qid]; ++ cancel_work_sync(&chap->auth_work); + queue_work(nvme_wq, &chap->auth_work); + return 0; + } +@@ -885,19 +876,12 @@ int nvme_auth_wait(struct nvme_ctrl *ctrl, int qid) + struct nvme_dhchap_queue_context *chap; + int ret; + +- mutex_lock(&ctrl->dhchap_auth_mutex); +- list_for_each_entry(chap, &ctrl->dhchap_auth_list, entry) { +- if (chap->qid != qid) +- continue; +- mutex_unlock(&ctrl->dhchap_auth_mutex); +- flush_work(&chap->auth_work); +- ret = chap->error; +- /* clear sensitive info */ +- nvme_auth_reset_dhchap(chap); +- return ret; +- } +- mutex_unlock(&ctrl->dhchap_auth_mutex); +- return -ENXIO; ++ chap = &ctrl->dhchap_ctxs[qid]; ++ flush_work(&chap->auth_work); ++ ret = chap->error; ++ /* clear sensitive info */ ++ nvme_auth_reset_dhchap(chap); ++ return ret; + } + EXPORT_SYMBOL_GPL(nvme_auth_wait); + +@@ -946,11 +930,11 @@ static void nvme_ctrl_auth_work(struct work_struct *work) + + int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl) + { +- int ret; ++ struct nvme_dhchap_queue_context *chap; ++ int i, ret; + +- INIT_LIST_HEAD(&ctrl->dhchap_auth_list); +- INIT_WORK(&ctrl->dhchap_auth_work, nvme_ctrl_auth_work); + mutex_init(&ctrl->dhchap_auth_mutex); ++ INIT_WORK(&ctrl->dhchap_auth_work, nvme_ctrl_auth_work); + if (!ctrl->opts) + return 0; + ret = nvme_auth_generate_key(ctrl->opts->dhchap_secret, +@@ -959,37 +943,63 @@ int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl) + return ret; + ret = nvme_auth_generate_key(ctrl->opts->dhchap_ctrl_secret, + &ctrl->ctrl_key); +- if (ret) { +- nvme_auth_free_key(ctrl->host_key); +- ctrl->host_key = NULL; ++ if (ret) ++ goto err_free_dhchap_secret; ++ ++ if (!ctrl->opts->dhchap_secret && !ctrl->opts->dhchap_ctrl_secret) ++ return ret; ++ ++ ctrl->dhchap_ctxs = kvcalloc(ctrl_max_dhchaps(ctrl), ++ sizeof(*chap), GFP_KERNEL); ++ if (!ctrl->dhchap_ctxs) { ++ ret = -ENOMEM; ++ goto err_free_dhchap_ctrl_secret; + } ++ ++ for (i = 0; i < ctrl_max_dhchaps(ctrl); i++) { ++ chap = &ctrl->dhchap_ctxs[i]; ++ chap->qid = i; ++ chap->ctrl = ctrl; ++ INIT_WORK(&chap->auth_work, nvme_queue_auth_work); ++ } ++ ++ return 0; ++err_free_dhchap_ctrl_secret: ++ nvme_auth_free_key(ctrl->ctrl_key); ++ ctrl->ctrl_key = NULL; ++err_free_dhchap_secret: ++ nvme_auth_free_key(ctrl->host_key); ++ ctrl->host_key = NULL; + return ret; + } + EXPORT_SYMBOL_GPL(nvme_auth_init_ctrl); + + void nvme_auth_stop(struct nvme_ctrl *ctrl) + { +- struct nvme_dhchap_queue_context *chap = NULL, *tmp; ++ struct nvme_dhchap_queue_context *chap; ++ int i; + + cancel_work_sync(&ctrl->dhchap_auth_work); +- mutex_lock(&ctrl->dhchap_auth_mutex); +- list_for_each_entry_safe(chap, tmp, &ctrl->dhchap_auth_list, entry) ++ for (i = 0; i < ctrl_max_dhchaps(ctrl); i++) { ++ chap = &ctrl->dhchap_ctxs[i]; + cancel_work_sync(&chap->auth_work); +- mutex_unlock(&ctrl->dhchap_auth_mutex); ++ } + } + EXPORT_SYMBOL_GPL(nvme_auth_stop); + + void nvme_auth_free(struct nvme_ctrl *ctrl) + { +- struct nvme_dhchap_queue_context *chap = NULL, *tmp; ++ struct nvme_dhchap_queue_context *chap; ++ int i; + +- mutex_lock(&ctrl->dhchap_auth_mutex); +- list_for_each_entry_safe(chap, tmp, &ctrl->dhchap_auth_list, entry) { +- list_del_init(&chap->entry); +- flush_work(&chap->auth_work); +- nvme_auth_free_dhchap(chap); ++ if (ctrl->dhchap_ctxs) { ++ for (i = 0; i < ctrl_max_dhchaps(ctrl); i++) { ++ chap = &ctrl->dhchap_ctxs[i]; ++ flush_work(&chap->auth_work); ++ nvme_auth_free_dhchap(chap); ++ } ++ kfree(ctrl->dhchap_ctxs); + } +- mutex_unlock(&ctrl->dhchap_auth_mutex); + if (ctrl->host_key) { + nvme_auth_free_key(ctrl->host_key); + ctrl->host_key = NULL; +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 2944d9b565a2..bc0eede419cb 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -3785,7 +3785,9 @@ static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev, + kfree(opts->dhchap_secret); + opts->dhchap_secret = dhchap_secret; + host_key = ctrl->host_key; ++ mutex_lock(&ctrl->dhchap_auth_mutex); + ctrl->host_key = key; ++ mutex_unlock(&ctrl->dhchap_auth_mutex); + nvme_auth_free_key(host_key); + } + /* Start re-authentication */ +@@ -3837,7 +3839,9 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev, + kfree(opts->dhchap_ctrl_secret); + opts->dhchap_ctrl_secret = dhchap_secret; + ctrl_key = ctrl->ctrl_key; ++ mutex_lock(&ctrl->dhchap_auth_mutex); + ctrl->ctrl_key = key; ++ mutex_unlock(&ctrl->dhchap_auth_mutex); + nvme_auth_free_key(ctrl_key); + } + /* Start re-authentication */ +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index e431ec348d52..ef23c6c6e2a3 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -337,8 +337,8 @@ struct nvme_ctrl { + + #ifdef CONFIG_NVME_AUTH + struct work_struct dhchap_auth_work; +- struct list_head dhchap_auth_list; + struct mutex dhchap_auth_mutex; ++ struct nvme_dhchap_queue_context *dhchap_ctxs; + struct nvme_dhchap_key *host_key; + struct nvme_dhchap_key *ctrl_key; + u16 transaction; +-- +2.35.3 + diff --git a/patches.suse/nvme-auth-don-t-ignore-key-generation-failures-when-.patch b/patches.suse/nvme-auth-don-t-ignore-key-generation-failures-when-.patch new file mode 100644 index 0000000..5422393 --- /dev/null +++ b/patches.suse/nvme-auth-don-t-ignore-key-generation-failures-when-.patch @@ -0,0 +1,93 @@ +From: Sagi Grimberg +Date: Sun, 13 Nov 2022 13:24:10 +0200 +Subject: nvme-auth: don't ignore key generation failures when initializing + ctrl keys +Patch-mainline: v6.2-rc1 +Git-commit: 193a8c7e5f1a8481841636cec9c185543ec5c759 +References: bsc#1202633 + +nvme_auth_generate_key can fail, don't ignore it upon initialization. + +Reviewed-by: Hannes Reinecke +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/auth.c | 19 +++++++++++++++---- + drivers/nvme/host/core.c | 6 +++++- + drivers/nvme/host/nvme.h | 7 +++++-- + 3 files changed, 25 insertions(+), 7 deletions(-) + +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -972,15 +972,26 @@ static void nvme_ctrl_auth_work(struct w + */ + } + +-void nvme_auth_init_ctrl(struct nvme_ctrl *ctrl) ++int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl) + { ++ int ret; ++ + INIT_LIST_HEAD(&ctrl->dhchap_auth_list); + INIT_WORK(&ctrl->dhchap_auth_work, nvme_ctrl_auth_work); + mutex_init(&ctrl->dhchap_auth_mutex); + if (!ctrl->opts) +- return; +- nvme_auth_generate_key(ctrl->opts->dhchap_secret, &ctrl->host_key); +- nvme_auth_generate_key(ctrl->opts->dhchap_ctrl_secret, &ctrl->ctrl_key); ++ return 0; ++ ret = nvme_auth_generate_key(ctrl->opts->dhchap_secret, ++ &ctrl->host_key); ++ if (ret) ++ return ret; ++ ret = nvme_auth_generate_key(ctrl->opts->dhchap_ctrl_secret, ++ &ctrl->ctrl_key); ++ if (ret) { ++ nvme_auth_free_key(ctrl->host_key); ++ ctrl->host_key = NULL; ++ } ++ return ret; + } + EXPORT_SYMBOL_GPL(nvme_auth_init_ctrl); + +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -4679,9 +4679,13 @@ int nvme_init_ctrl(struct nvme_ctrl *ctr + + nvme_fault_inject_init(&ctrl->fault_inject, dev_name(ctrl->device)); + nvme_mpath_init_ctrl(ctrl); +- nvme_auth_init_ctrl(ctrl); ++ ret = nvme_auth_init_ctrl(ctrl); ++ if (ret) ++ goto out_free_cdev; + + return 0; ++out_free_cdev: ++ cdev_device_del(&ctrl->cdev, ctrl->device); + out_free_name: + nvme_put_ctrl(ctrl); + kfree_const(ctrl->device->kobj.name); +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -928,14 +928,17 @@ static inline bool nvme_ctrl_sgl_support + } + + #ifdef CONFIG_NVME_AUTH +-void nvme_auth_init_ctrl(struct nvme_ctrl *ctrl); ++int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl); + void nvme_auth_stop(struct nvme_ctrl *ctrl); + int nvme_auth_negotiate(struct nvme_ctrl *ctrl, int qid); + int nvme_auth_wait(struct nvme_ctrl *ctrl, int qid); + void nvme_auth_reset(struct nvme_ctrl *ctrl); + void nvme_auth_free(struct nvme_ctrl *ctrl); + #else +-static inline void nvme_auth_init_ctrl(struct nvme_ctrl *ctrl) {}; ++static inline int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl) ++{ ++ return 0; ++} + static inline void nvme_auth_stop(struct nvme_ctrl *ctrl) {}; + static inline int nvme_auth_negotiate(struct nvme_ctrl *ctrl, int qid) + { diff --git a/patches.suse/nvme-auth-don-t-keep-long-lived-4k-dhchap-buffer.patch b/patches.suse/nvme-auth-don-t-keep-long-lived-4k-dhchap-buffer.patch new file mode 100644 index 0000000..78bd0d2 --- /dev/null +++ b/patches.suse/nvme-auth-don-t-keep-long-lived-4k-dhchap-buffer.patch @@ -0,0 +1,157 @@ +From: Sagi Grimberg +Date: Sun, 13 Nov 2022 13:24:13 +0200 +Subject: nvme-auth: don't keep long lived 4k dhchap buffer +Patch-mainline: v6.2-rc1 +Git-commit: b7d604cae8f6edde53ac8aa9038ee154be562eb5 +References: bsc#1202633 + +dhchap structure is per-queue, it is wasteful to keep it for the entire +lifetime of the queue. Allocate it dynamically and get rid of it after +authentication. We don't need kzalloc because all accessors are clearing +it before writing to it. + +Also, remove redundant chap buf_size which is always 4096, use a define +instead. + +Reviewed-by: Hannes Reinecke +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/auth.c | 47 ++++++++++++++++++++++++----------------------- + 1 file changed, 24 insertions(+), 23 deletions(-) + +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -13,6 +13,8 @@ + #include "fabrics.h" + #include + ++#define CHAP_BUF_SIZE 4096 ++ + struct nvme_dhchap_queue_context { + struct list_head entry; + struct work_struct auth_work; +@@ -20,7 +22,6 @@ struct nvme_dhchap_queue_context { + struct crypto_shash *shash_tfm; + struct crypto_kpp *dh_tfm; + void *buf; +- size_t buf_size; + int qid; + int error; + u32 s1; +@@ -112,7 +113,7 @@ static int nvme_auth_set_dhchap_negotiat + struct nvmf_auth_dhchap_negotiate_data *data = chap->buf; + size_t size = sizeof(*data) + sizeof(union nvmf_auth_protocol); + +- if (chap->buf_size < size) { ++ if (size > CHAP_BUF_SIZE) { + chap->status = NVME_AUTH_DHCHAP_FAILURE_INCORRECT_PAYLOAD; + return -EINVAL; + } +@@ -147,7 +148,7 @@ static int nvme_auth_process_dhchap_chal + const char *gid_name = nvme_auth_dhgroup_name(data->dhgid); + const char *hmac_name, *kpp_name; + +- if (chap->buf_size < size) { ++ if (size > CHAP_BUF_SIZE) { + chap->status = NVME_AUTH_DHCHAP_FAILURE_INCORRECT_PAYLOAD; + return NVME_SC_INVALID_FIELD; + } +@@ -302,7 +303,7 @@ static int nvme_auth_set_dhchap_reply_da + if (chap->host_key_len) + size += chap->host_key_len; + +- if (chap->buf_size < size) { ++ if (size > CHAP_BUF_SIZE) { + chap->status = NVME_AUTH_DHCHAP_FAILURE_INCORRECT_PAYLOAD; + return -EINVAL; + } +@@ -347,7 +348,7 @@ static int nvme_auth_process_dhchap_succ + if (ctrl->ctrl_key) + size += chap->hash_len; + +- if (chap->buf_size < size) { ++ if (size > CHAP_BUF_SIZE) { + chap->status = NVME_AUTH_DHCHAP_FAILURE_INCORRECT_PAYLOAD; + return NVME_SC_INVALID_FIELD; + } +@@ -674,6 +675,8 @@ static void nvme_auth_reset_dhchap(struc + chap->transaction = 0; + memset(chap->c1, 0, sizeof(chap->c1)); + memset(chap->c2, 0, sizeof(chap->c2)); ++ kfree(chap->buf); ++ chap->buf = NULL; + } + + static void nvme_auth_free_dhchap(struct nvme_dhchap_queue_context *chap) +@@ -683,7 +686,6 @@ static void nvme_auth_free_dhchap(struct + crypto_free_shash(chap->shash_tfm); + if (chap->dh_tfm) + crypto_free_kpp(chap->dh_tfm); +- kfree(chap->buf); + kfree(chap); + } + +@@ -695,6 +697,16 @@ static void nvme_queue_auth_work(struct + size_t tl; + int ret = 0; + ++ /* ++ * Allocate a large enough buffer for the entire negotiation: ++ * 4k is enough to ffdhe8192. ++ */ ++ chap->buf = kmalloc(CHAP_BUF_SIZE, GFP_KERNEL); ++ if (!chap->buf) { ++ chap->error = -ENOMEM; ++ return; ++ } ++ + chap->transaction = ctrl->transaction++; + + /* DH-HMAC-CHAP Step 1: send negotiate */ +@@ -716,8 +728,9 @@ static void nvme_queue_auth_work(struct + dev_dbg(ctrl->device, "%s: qid %d receive challenge\n", + __func__, chap->qid); + +- memset(chap->buf, 0, chap->buf_size); +- ret = nvme_auth_submit(ctrl, chap->qid, chap->buf, chap->buf_size, false); ++ memset(chap->buf, 0, CHAP_BUF_SIZE); ++ ret = nvme_auth_submit(ctrl, chap->qid, chap->buf, CHAP_BUF_SIZE, ++ false); + if (ret) { + dev_warn(ctrl->device, + "qid %d failed to receive challenge, %s %d\n", +@@ -779,8 +792,9 @@ static void nvme_queue_auth_work(struct + dev_dbg(ctrl->device, "%s: qid %d receive success1\n", + __func__, chap->qid); + +- memset(chap->buf, 0, chap->buf_size); +- ret = nvme_auth_submit(ctrl, chap->qid, chap->buf, chap->buf_size, false); ++ memset(chap->buf, 0, CHAP_BUF_SIZE); ++ ret = nvme_auth_submit(ctrl, chap->qid, chap->buf, CHAP_BUF_SIZE, ++ false); + if (ret) { + dev_warn(ctrl->device, + "qid %d failed to receive success1, %s %d\n", +@@ -876,19 +890,6 @@ int nvme_auth_negotiate(struct nvme_ctrl + } + chap->qid = qid; + chap->ctrl = ctrl; +- +- /* +- * Allocate a large enough buffer for the entire negotiation: +- * 4k should be enough to ffdhe8192. +- */ +- chap->buf_size = 4096; +- chap->buf = kzalloc(chap->buf_size, GFP_KERNEL); +- if (!chap->buf) { +- mutex_unlock(&ctrl->dhchap_auth_mutex); +- kfree(chap); +- return -ENOMEM; +- } +- + INIT_WORK(&chap->auth_work, nvme_queue_auth_work); + list_add(&chap->entry, &ctrl->dhchap_auth_list); + mutex_unlock(&ctrl->dhchap_auth_mutex); diff --git a/patches.suse/nvme-auth-don-t-override-ctrl-keys-before-validation.patch b/patches.suse/nvme-auth-don-t-override-ctrl-keys-before-validation.patch new file mode 100644 index 0000000..5766607 --- /dev/null +++ b/patches.suse/nvme-auth-don-t-override-ctrl-keys-before-validation.patch @@ -0,0 +1,59 @@ +From: Sagi Grimberg +Date: Sun, 13 Nov 2022 13:24:11 +0200 +Subject: nvme-auth: don't override ctrl keys before validation +Patch-mainline: v6.2-rc1 +Git-commit: 01604350e14560d4d69323eb1ba12a257a643ea8 +References: bsc#1202633 + +Replace ctrl ctrl_key/host_key only after nvme_auth_generate_key is successful. +Also, this fixes a bug where the keys are leaked. + +Reviewed-by: Hannes Reinecke +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/core.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -3576,13 +3576,17 @@ static ssize_t nvme_ctrl_dhchap_secret_s + memcpy(dhchap_secret, buf, count); + nvme_auth_stop(ctrl); + if (strcmp(dhchap_secret, opts->dhchap_secret)) { ++ struct nvme_dhchap_key *key, *host_key; + int ret; + +- ret = nvme_auth_generate_key(dhchap_secret, &ctrl->host_key); ++ ret = nvme_auth_generate_key(dhchap_secret, &key); + if (ret) + return ret; + kfree(opts->dhchap_secret); + opts->dhchap_secret = dhchap_secret; ++ host_key = ctrl->host_key; ++ ctrl->host_key = key; ++ nvme_auth_free_key(host_key); + /* Key has changed; re-authentication with new key */ + nvme_auth_reset(ctrl); + } +@@ -3626,13 +3630,17 @@ static ssize_t nvme_ctrl_dhchap_ctrl_sec + memcpy(dhchap_secret, buf, count); + nvme_auth_stop(ctrl); + if (strcmp(dhchap_secret, opts->dhchap_ctrl_secret)) { ++ struct nvme_dhchap_key *key, *ctrl_key; + int ret; + +- ret = nvme_auth_generate_key(dhchap_secret, &ctrl->ctrl_key); ++ ret = nvme_auth_generate_key(dhchap_secret, &key); + if (ret) + return ret; + kfree(opts->dhchap_ctrl_secret); + opts->dhchap_ctrl_secret = dhchap_secret; ++ ctrl_key = ctrl->ctrl_key; ++ ctrl->ctrl_key = key; ++ nvme_auth_free_key(ctrl_key); + /* Key has changed; re-authentication with new key */ + nvme_auth_reset(ctrl); + } diff --git a/patches.suse/nvme-auth-don-t-re-authenticate-if-the-controller-is.patch b/patches.suse/nvme-auth-don-t-re-authenticate-if-the-controller-is.patch new file mode 100644 index 0000000..e0ebf96 --- /dev/null +++ b/patches.suse/nvme-auth-don-t-re-authenticate-if-the-controller-is.patch @@ -0,0 +1,34 @@ +From: Sagi Grimberg +Date: Sun, 13 Nov 2022 13:24:08 +0200 +Subject: nvme-auth: don't re-authenticate if the controller is not LIVE +Patch-mainline: v6.2-rc1 +Git-commit: c7390f132a896ff1a3fa26ea2b0be4f9ceb9041e +References: bsc#1202633 + +The connect sequence will re-authenticate. + +Reviewed-by: Hannes Reinecke +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/auth.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -939,6 +939,13 @@ static void nvme_ctrl_auth_work(struct w + container_of(work, struct nvme_ctrl, dhchap_auth_work); + int ret, q; + ++ /* ++ * If the ctrl is no connected, bail as reconnect will handle ++ * authentication. ++ */ ++ if (ctrl->state != NVME_CTRL_LIVE) ++ return; ++ + /* Authenticate admin queue first */ + ret = nvme_auth_negotiate(ctrl, 0); + if (ret) { diff --git a/patches.suse/nvme-auth-don-t-use-NVMe-status-codes.patch b/patches.suse/nvme-auth-don-t-use-NVMe-status-codes.patch new file mode 100644 index 0000000..d1eff09 --- /dev/null +++ b/patches.suse/nvme-auth-don-t-use-NVMe-status-codes.patch @@ -0,0 +1,158 @@ +From: Hannes Reinecke +Date: Tue, 13 Dec 2022 20:00:26 +0100 +Subject: nvme-auth: don't use NVMe status codes +Patch-mainline: v6.3-rc1 +Git-commit: b0ef1b11d3909d8f246dd3af9c94e38880d349b0 +References: bsc#1202633 + +NVMe status codes are part of the wire protocol, and shouldn't be +fabricated in the stack. So with this patch the authentication code +is switched over to use error codes; as a side effect authentication +failures due to internal error won't be retried anymore. +But that shouldn't have happened anyway. + +Signed-off-by: Hannes Reinecke +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/auth.c | 30 +++++++++++++++--------------- + 1 file changed, 15 insertions(+), 15 deletions(-) + +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -160,7 +160,7 @@ static int nvme_auth_process_dhchap_chal + + if (size > CHAP_BUF_SIZE) { + chap->status = NVME_AUTH_DHCHAP_FAILURE_INCORRECT_PAYLOAD; +- return NVME_SC_INVALID_FIELD; ++ return -EINVAL; + } + + hmac_name = nvme_auth_hmac_name(data->hashid); +@@ -169,7 +169,7 @@ static int nvme_auth_process_dhchap_chal + "qid %d: invalid HASH ID %d\n", + chap->qid, data->hashid); + chap->status = NVME_AUTH_DHCHAP_FAILURE_HASH_UNUSABLE; +- return NVME_SC_INVALID_FIELD; ++ return -EPROTO; + } + + if (chap->hash_id == data->hashid && chap->shash_tfm && +@@ -195,7 +195,7 @@ static int nvme_auth_process_dhchap_chal + chap->qid, hmac_name, PTR_ERR(chap->shash_tfm)); + chap->shash_tfm = NULL; + chap->status = NVME_AUTH_DHCHAP_FAILURE_FAILED; +- return NVME_SC_AUTH_REQUIRED; ++ return -ENOMEM; + } + + if (crypto_shash_digestsize(chap->shash_tfm) != data->hl) { +@@ -205,7 +205,7 @@ static int nvme_auth_process_dhchap_chal + crypto_free_shash(chap->shash_tfm); + chap->shash_tfm = NULL; + chap->status = NVME_AUTH_DHCHAP_FAILURE_HASH_UNUSABLE; +- return NVME_SC_AUTH_REQUIRED; ++ return -EPROTO; + } + + chap->hash_id = data->hashid; +@@ -221,7 +221,7 @@ static int nvme_auth_process_dhchap_chal + chap->qid, data->dhgid); + chap->status = NVME_AUTH_DHCHAP_FAILURE_DHGROUP_UNUSABLE; + /* Leave previous dh_tfm intact */ +- return NVME_SC_AUTH_REQUIRED; ++ return -EPROTO; + } + + if (chap->dhgroup_id == data->dhgid && +@@ -244,7 +244,7 @@ static int nvme_auth_process_dhchap_chal + "qid %d: empty DH value\n", + chap->qid); + chap->status = NVME_AUTH_DHCHAP_FAILURE_DHGROUP_UNUSABLE; +- return NVME_SC_INVALID_FIELD; ++ return -EPROTO; + } + + chap->dh_tfm = crypto_alloc_kpp(kpp_name, 0, 0); +@@ -256,7 +256,7 @@ static int nvme_auth_process_dhchap_chal + chap->qid, ret, gid_name); + chap->status = NVME_AUTH_DHCHAP_FAILURE_DHGROUP_UNUSABLE; + chap->dh_tfm = NULL; +- return NVME_SC_AUTH_REQUIRED; ++ return -ret; + } + dev_dbg(ctrl->device, "qid %d: selected DH group %s\n", + chap->qid, gid_name); +@@ -265,7 +265,7 @@ static int nvme_auth_process_dhchap_chal + "qid %d: invalid DH value for NULL DH\n", + chap->qid); + chap->status = NVME_AUTH_DHCHAP_FAILURE_INCORRECT_PAYLOAD; +- return NVME_SC_INVALID_FIELD; ++ return -EPROTO; + } + chap->dhgroup_id = data->dhgid; + +@@ -276,7 +276,7 @@ static int nvme_auth_process_dhchap_chal + chap->ctrl_key = kmalloc(dhvlen, GFP_KERNEL); + if (!chap->ctrl_key) { + chap->status = NVME_AUTH_DHCHAP_FAILURE_FAILED; +- return NVME_SC_AUTH_REQUIRED; ++ return -ENOMEM; + } + chap->ctrl_key_len = dhvlen; + memcpy(chap->ctrl_key, data->cval + chap->hash_len, +@@ -346,7 +346,7 @@ static int nvme_auth_process_dhchap_succ + + if (size > CHAP_BUF_SIZE) { + chap->status = NVME_AUTH_DHCHAP_FAILURE_INCORRECT_PAYLOAD; +- return NVME_SC_INVALID_FIELD; ++ return -EINVAL; + } + + if (data->hl != chap->hash_len) { +@@ -354,7 +354,7 @@ static int nvme_auth_process_dhchap_succ + "qid %d: invalid hash length %u\n", + chap->qid, data->hl); + chap->status = NVME_AUTH_DHCHAP_FAILURE_HASH_UNUSABLE; +- return NVME_SC_INVALID_FIELD; ++ return -EPROTO; + } + + /* Just print out information for the admin queue */ +@@ -378,7 +378,7 @@ static int nvme_auth_process_dhchap_succ + "qid %d: controller authentication failed\n", + chap->qid); + chap->status = NVME_AUTH_DHCHAP_FAILURE_FAILED; +- return NVME_SC_AUTH_REQUIRED; ++ return -ECONNREFUSED; + } + + /* Just print out information for the admin queue */ +@@ -732,7 +732,7 @@ static void nvme_queue_auth_work(struct + NVME_AUTH_DHCHAP_MESSAGE_CHALLENGE); + if (ret) { + chap->status = ret; +- chap->error = NVME_SC_AUTH_REQUIRED; ++ chap->error = -ECONNREFUSED; + return; + } + +@@ -800,7 +800,7 @@ static void nvme_queue_auth_work(struct + NVME_AUTH_DHCHAP_MESSAGE_SUCCESS1); + if (ret) { + chap->status = ret; +- chap->error = NVME_SC_AUTH_REQUIRED; ++ chap->error = -ECONNREFUSED; + return; + } + +@@ -821,7 +821,7 @@ static void nvme_queue_auth_work(struct + ret = nvme_auth_process_dhchap_success1(ctrl, chap); + if (ret) { + /* Controller authentication failed */ +- chap->error = NVME_SC_AUTH_REQUIRED; ++ chap->error = -ECONNREFUSED; + goto fail2; + } + diff --git a/patches.suse/nvme-auth-fix-an-error-code-in-nvme_auth_process_dhc.patch b/patches.suse/nvme-auth-fix-an-error-code-in-nvme_auth_process_dhc.patch new file mode 100644 index 0000000..44a5b67 --- /dev/null +++ b/patches.suse/nvme-auth-fix-an-error-code-in-nvme_auth_process_dhc.patch @@ -0,0 +1,31 @@ +From: Dan Carpenter +Date: Thu, 16 Feb 2023 15:14:49 +0300 +Subject: nvme-auth: fix an error code in nvme_auth_process_dhchap_challenge() +Patch-mainline: v6.3-rc1 +Git-commit: 51d24f701f453c18cb5f4596d8bbe8034e5d3fb4 +References: bsc#1202633 + +This function was transitioned from returning NVMe status codes to +returning traditional kernel error codes. However, this particular +return now accidentally returns positive error codes like ENOMEM instead +of negative -ENOMEM. + +Fixes: b0ef1b11d390 ("nvme-auth: don't use NVMe status codes") +Signed-off-by: Dan Carpenter +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/auth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -256,7 +256,7 @@ static int nvme_auth_process_dhchap_chal + chap->qid, ret, gid_name); + chap->status = NVME_AUTH_DHCHAP_FAILURE_DHGROUP_UNUSABLE; + chap->dh_tfm = NULL; +- return -ret; ++ return ret; + } + dev_dbg(ctrl->device, "qid %d: selected DH group %s\n", + chap->qid, gid_name); diff --git a/patches.suse/nvme-auth-fix-smatch-warning-complaints.patch b/patches.suse/nvme-auth-fix-smatch-warning-complaints.patch new file mode 100644 index 0000000..50e3d5a --- /dev/null +++ b/patches.suse/nvme-auth-fix-smatch-warning-complaints.patch @@ -0,0 +1,33 @@ +From: Sagi Grimberg +Date: Sun, 25 Dec 2022 13:28:51 +0200 +Subject: nvme-auth: fix smatch warning complaints +Patch-mainline: v6.2-rc2 +Git-commit: 76807fcd73b818eb9f245ef1035aed34ecdd9813 +References: bsc#1202633 + +When initializing auth context, there may be no secrets passed +by the user. Make return code explicit when returning successfully. + +smatch warnings: +drivers/nvme/host/auth.c:950 nvme_auth_init_ctrl() warn: missing error code? 'ret' + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/auth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -953,7 +953,7 @@ int nvme_auth_init_ctrl(struct nvme_ctrl + goto err_free_dhchap_secret; + + if (!ctrl->opts->dhchap_secret && !ctrl->opts->dhchap_ctrl_secret) +- return ret; ++ return 0; + + ctrl->dhchap_ctxs = kvcalloc(ctrl_max_dhchaps(ctrl), + sizeof(*chap), GFP_KERNEL); diff --git a/patches.suse/nvme-auth-guarantee-dhchap-buffers-under-memory-pres.patch b/patches.suse/nvme-auth-guarantee-dhchap-buffers-under-memory-pres.patch new file mode 100644 index 0000000..24f48a4 --- /dev/null +++ b/patches.suse/nvme-auth-guarantee-dhchap-buffers-under-memory-pres.patch @@ -0,0 +1,126 @@ +From: Sagi Grimberg +Date: Tue, 15 Nov 2022 17:08:06 +0100 +Subject: nvme-auth: guarantee dhchap buffers under memory pressure +Patch-mainline: v6.2-rc1 +Git-commit: e481fc0a377798976d5c3044c7f10c86a8372b92 +References: bsc#1202633 + +We want to guarantee that we have chap buffers when a controller +reconnects under memory pressure. Add a mempool specifically +for that. + +Signed-off-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/auth.c | 30 ++++++++++++++++++++++++++++-- + drivers/nvme/host/core.c | 6 ++++++ + drivers/nvme/host/nvme.h | 9 +++++++++ + 3 files changed, 43 insertions(+), 2 deletions(-) + +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -14,6 +14,8 @@ + #include + + #define CHAP_BUF_SIZE 4096 ++static struct kmem_cache *nvme_chap_buf_cache; ++static mempool_t *nvme_chap_buf_pool; + + struct nvme_dhchap_queue_context { + struct list_head entry; +@@ -675,7 +677,7 @@ static void nvme_auth_reset_dhchap(struc + chap->transaction = 0; + memset(chap->c1, 0, sizeof(chap->c1)); + memset(chap->c2, 0, sizeof(chap->c2)); +- kfree(chap->buf); ++ mempool_free(chap->buf, nvme_chap_buf_pool); + chap->buf = NULL; + } + +@@ -701,7 +703,7 @@ static void nvme_queue_auth_work(struct + * Allocate a large enough buffer for the entire negotiation: + * 4k is enough to ffdhe8192. + */ +- chap->buf = kmalloc(CHAP_BUF_SIZE, GFP_KERNEL); ++ chap->buf = mempool_alloc(nvme_chap_buf_pool, GFP_KERNEL); + if (!chap->buf) { + chap->error = -ENOMEM; + return; +@@ -1029,3 +1031,27 @@ void nvme_auth_free(struct nvme_ctrl *ct + } + } + EXPORT_SYMBOL_GPL(nvme_auth_free); ++ ++int __init nvme_init_auth(void) ++{ ++ nvme_chap_buf_cache = kmem_cache_create("nvme-chap-buf-cache", ++ CHAP_BUF_SIZE, 0, SLAB_HWCACHE_ALIGN, NULL); ++ if (!nvme_chap_buf_cache) ++ return -ENOMEM; ++ ++ nvme_chap_buf_pool = mempool_create(16, mempool_alloc_slab, ++ mempool_free_slab, nvme_chap_buf_cache); ++ if (!nvme_chap_buf_pool) ++ goto err_destroy_chap_buf_cache; ++ ++ return 0; ++err_destroy_chap_buf_cache: ++ kmem_cache_destroy(nvme_chap_buf_cache); ++ return -ENOMEM; ++} ++ ++void __exit nvme_exit_auth(void) ++{ ++ mempool_destroy(nvme_chap_buf_pool); ++ kmem_cache_destroy(nvme_chap_buf_cache); ++} +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -4946,8 +4946,13 @@ static int __init nvme_core_init(void) + goto unregister_generic_ns; + } + ++ result = nvme_init_auth(); ++ if (result) ++ goto destroy_ns_chr; + return 0; + ++destroy_ns_chr: ++ class_destroy(nvme_ns_chr_class); + unregister_generic_ns: + unregister_chrdev_region(nvme_ns_chr_devt, NVME_MINORS); + destroy_subsys_class: +@@ -4968,6 +4973,7 @@ static int __init nvme_core_init(void) + + static void __exit nvme_core_exit(void) + { ++ nvme_exit_auth(); + class_destroy(nvme_ns_chr_class); + class_destroy(nvme_subsys_class); + class_destroy(nvme_class); +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -928,6 +928,8 @@ static inline bool nvme_ctrl_sgl_support + } + + #ifdef CONFIG_NVME_AUTH ++int __init nvme_init_auth(void); ++void __exit nvme_exit_auth(void); + int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl); + void nvme_auth_stop(struct nvme_ctrl *ctrl); + int nvme_auth_negotiate(struct nvme_ctrl *ctrl, int qid); +@@ -939,6 +941,13 @@ static inline int nvme_auth_init_ctrl(st + { + return 0; + } ++static inline int __init nvme_init_auth(void) ++{ ++ return 0; ++} ++static inline void __exit nvme_exit_auth(void) ++{ ++} + static inline void nvme_auth_stop(struct nvme_ctrl *ctrl) {}; + static inline int nvme_auth_negotiate(struct nvme_ctrl *ctrl, int qid) + { diff --git a/patches.suse/nvme-auth-have-dhchap_auth_work-wait-for-queues-auth.patch b/patches.suse/nvme-auth-have-dhchap_auth_work-wait-for-queues-auth.patch new file mode 100644 index 0000000..190cedd --- /dev/null +++ b/patches.suse/nvme-auth-have-dhchap_auth_work-wait-for-queues-auth.patch @@ -0,0 +1,51 @@ +From: Sagi Grimberg +Date: Sun, 13 Nov 2022 13:24:22 +0200 +Subject: nvme-auth: have dhchap_auth_work wait for queues auth to complete +Patch-mainline: v6.2-rc1 +Git-commit: d061a1bd1fff5332ee48601947abb414007a9610 +References: bsc#1202633 + +It triggered the queue authentication work elements in parallel, but +the ctrl authentication work itself completes when all of them +completes. Hence wait for queues auth completions. + +This also makes nvme_auth_stop simply a sync cancel of ctrl +dhchap_auth_work. + +Signed-off-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/auth.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -926,6 +926,12 @@ static void nvme_ctrl_auth_work(struct w + * Failure is a soft-state; credentials remain valid until + * the controller terminates the connection. + */ ++ for (q = 1; q < ctrl->queue_count; q++) { ++ ret = nvme_auth_wait(ctrl, q); ++ if (ret) ++ dev_warn(ctrl->device, ++ "qid %d: authentication failed\n", q); ++ } + } + + int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl) +@@ -976,14 +982,7 @@ EXPORT_SYMBOL_GPL(nvme_auth_init_ctrl); + + void nvme_auth_stop(struct nvme_ctrl *ctrl) + { +- struct nvme_dhchap_queue_context *chap; +- int i; +- + cancel_work_sync(&ctrl->dhchap_auth_work); +- for (i = 0; i < ctrl_max_dhchaps(ctrl); i++) { +- chap = &ctrl->dhchap_ctxs[i]; +- cancel_work_sync(&chap->auth_work); +- } + } + EXPORT_SYMBOL_GPL(nvme_auth_stop); + diff --git a/patches.suse/nvme-auth-mark-nvme_auth_wq-static.patch b/patches.suse/nvme-auth-mark-nvme_auth_wq-static.patch new file mode 100644 index 0000000..d30b2e2 --- /dev/null +++ b/patches.suse/nvme-auth-mark-nvme_auth_wq-static.patch @@ -0,0 +1,33 @@ +From: Tom Rix +Date: Mon, 6 Feb 2023 06:57:00 -0800 +Subject: nvme-auth: mark nvme_auth_wq static +Patch-mainline: v6.2-rc8 +Git-commit: 70daa5c8f001e351af174c40ac21eb0a25600483 +References: bsc#1202633 + +Fix a smatch report for the newly added nvme_auth_wq. + +Signed-off-by: Tom Rix +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/auth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c +index b57630d1d3b8..bdb97496ba2d 100644 +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -45,7 +45,7 @@ struct nvme_dhchap_queue_context { + int sess_key_len; + }; + +-struct workqueue_struct *nvme_auth_wq; ++static struct workqueue_struct *nvme_auth_wq; + + #define nvme_auth_flags_from_qid(qid) \ + (qid == 0) ? 0 : BLK_MQ_REQ_NOWAIT | BLK_MQ_REQ_RESERVED +-- +2.35.3 + diff --git a/patches.suse/nvme-auth-no-need-to-reset-chap-contexts-on-re-authe.patch b/patches.suse/nvme-auth-no-need-to-reset-chap-contexts-on-re-authe.patch new file mode 100644 index 0000000..24b1585 --- /dev/null +++ b/patches.suse/nvme-auth-no-need-to-reset-chap-contexts-on-re-authe.patch @@ -0,0 +1,73 @@ +From: Sagi Grimberg +Date: Sun, 13 Nov 2022 13:24:17 +0200 +Subject: nvme-auth: no need to reset chap contexts on re-authentication +Patch-mainline: v6.2-rc1 +Git-commit: e8a420efb637f52c586596283d6fd96f2a7ecb5c +References: bsc#1202633 + +Now that the chap context is reset upon completion, this is no longer +needed. Also remove nvme_auth_reset as no callers are left. + +Reviewed-by: Hannes Reinecke +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/auth.c | 13 ------------- + drivers/nvme/host/core.c | 4 ---- + drivers/nvme/host/nvme.h | 1 - + 3 files changed, 18 deletions(-) + +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -901,19 +901,6 @@ int nvme_auth_wait(struct nvme_ctrl *ctr + } + EXPORT_SYMBOL_GPL(nvme_auth_wait); + +-void nvme_auth_reset(struct nvme_ctrl *ctrl) +-{ +- struct nvme_dhchap_queue_context *chap; +- +- mutex_lock(&ctrl->dhchap_auth_mutex); +- list_for_each_entry(chap, &ctrl->dhchap_auth_list, entry) { +- mutex_unlock(&ctrl->dhchap_auth_mutex); +- flush_work(&chap->auth_work); +- nvme_auth_reset_dhchap(chap); +- } +- mutex_unlock(&ctrl->dhchap_auth_mutex); +-} +- + static void nvme_ctrl_auth_work(struct work_struct *work) + { + struct nvme_ctrl *ctrl = +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -3587,8 +3587,6 @@ static ssize_t nvme_ctrl_dhchap_secret_s + host_key = ctrl->host_key; + ctrl->host_key = key; + nvme_auth_free_key(host_key); +- /* Key has changed; re-authentication with new key */ +- nvme_auth_reset(ctrl); + } + /* Start re-authentication */ + dev_info(ctrl->device, "re-authenticating controller\n"); +@@ -3641,8 +3639,6 @@ static ssize_t nvme_ctrl_dhchap_ctrl_sec + ctrl_key = ctrl->ctrl_key; + ctrl->ctrl_key = key; + nvme_auth_free_key(ctrl_key); +- /* Key has changed; re-authentication with new key */ +- nvme_auth_reset(ctrl); + } + /* Start re-authentication */ + dev_info(ctrl->device, "re-authenticating controller\n"); +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -934,7 +934,6 @@ int nvme_auth_init_ctrl(struct nvme_ctrl + void nvme_auth_stop(struct nvme_ctrl *ctrl); + int nvme_auth_negotiate(struct nvme_ctrl *ctrl, int qid); + int nvme_auth_wait(struct nvme_ctrl *ctrl, int qid); +-void nvme_auth_reset(struct nvme_ctrl *ctrl); + void nvme_auth_free(struct nvme_ctrl *ctrl); + #else + static inline int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl) diff --git a/patches.suse/nvme-auth-remove-redundant-auth_work-flush.patch b/patches.suse/nvme-auth-remove-redundant-auth_work-flush.patch new file mode 100644 index 0000000..1b6b0d5 --- /dev/null +++ b/patches.suse/nvme-auth-remove-redundant-auth_work-flush.patch @@ -0,0 +1,41 @@ +From: Sagi Grimberg +Date: Sun, 13 Nov 2022 13:24:21 +0200 +Subject: nvme-auth: remove redundant auth_work flush +Patch-mainline: v6.2-rc1 +Git-commit: a2a00d2a66e480c8b225012db538dca6e389a92d +References: bsc#1202633 + +only ctrl deletion calls nvme_auth_free, which was stopped prior in the +teardown stage, so there is no possibility that it should ever run when +nvme_auth_free is called. As a result, we can remove a local chap pointer +variable. + +Reviewed-by: Hannes Reinecke +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/auth.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -989,15 +989,11 @@ EXPORT_SYMBOL_GPL(nvme_auth_stop); + + void nvme_auth_free(struct nvme_ctrl *ctrl) + { +- struct nvme_dhchap_queue_context *chap; + int i; + + if (ctrl->dhchap_ctxs) { +- for (i = 0; i < ctrl_max_dhchaps(ctrl); i++) { +- chap = &ctrl->dhchap_ctxs[i]; +- flush_work(&chap->auth_work); +- nvme_auth_free_dhchap(chap); +- } ++ for (i = 0; i < ctrl_max_dhchaps(ctrl); i++) ++ nvme_auth_free_dhchap(&ctrl->dhchap_ctxs[i]); + kfree(ctrl->dhchap_ctxs); + } + if (ctrl->host_key) { diff --git a/patches.suse/nvme-auth-remove-redundant-buffer-deallocations.patch b/patches.suse/nvme-auth-remove-redundant-buffer-deallocations.patch new file mode 100644 index 0000000..c04323e --- /dev/null +++ b/patches.suse/nvme-auth-remove-redundant-buffer-deallocations.patch @@ -0,0 +1,33 @@ +From: Sagi Grimberg +Date: Sun, 13 Nov 2022 13:24:09 +0200 +Subject: nvme-auth: remove redundant buffer deallocations +Patch-mainline: v6.2-rc1 +Git-commit: f6b182fbd5c608bd6cbaaaee35b1325443f48043 +References: bsc#1202633 + +host_response, host_key, ctrl_key and sess_key are +freed in nvme_auth_reset_dhchap which is called from +nvme_auth_free_dhchap. + +Reviewed-by: Hannes Reinecke +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/auth.c | 4 ---- + 1 file changed, 4 deletions(-) + +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -683,10 +683,6 @@ static void nvme_auth_free_dhchap(struct + crypto_free_shash(chap->shash_tfm); + if (chap->dh_tfm) + crypto_free_kpp(chap->dh_tfm); +- kfree_sensitive(chap->ctrl_key); +- kfree_sensitive(chap->host_key); +- kfree_sensitive(chap->sess_key); +- kfree_sensitive(chap->host_response); + kfree(chap->buf); + kfree(chap); + } diff --git a/patches.suse/nvme-auth-remove-redundant-deallocations.patch b/patches.suse/nvme-auth-remove-redundant-deallocations.patch new file mode 100644 index 0000000..8e92f95 --- /dev/null +++ b/patches.suse/nvme-auth-remove-redundant-deallocations.patch @@ -0,0 +1,69 @@ +From: Sagi Grimberg +Date: Sun, 13 Nov 2022 13:24:16 +0200 +Subject: nvme-auth: remove redundant deallocations +Patch-mainline: v6.2-rc1 +Git-commit: 96df31839354c2bb9d2f0d51eb6c6f6b762fd150 +References: bsc#1202633 + +These are now redundant as the dhchap context is +removed after authentication completes. + +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Hannes Reinecke +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/auth.c | 20 -------------------- + 1 file changed, 20 deletions(-) + +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -200,12 +200,6 @@ static int nvme_auth_process_dhchap_chal + return NVME_SC_AUTH_REQUIRED; + } + +- /* Reset host response if the hash had been changed */ +- if (chap->hash_id != data->hashid) { +- kfree(chap->host_response); +- chap->host_response = NULL; +- } +- + chap->hash_id = data->hashid; + chap->hash_len = data->hl; + dev_dbg(ctrl->device, "qid %d: selected hash %s\n", +@@ -222,14 +216,6 @@ static int nvme_auth_process_dhchap_chal + return NVME_SC_AUTH_REQUIRED; + } + +- /* Clear host and controller key to avoid accidental reuse */ +- kfree_sensitive(chap->host_key); +- chap->host_key = NULL; +- chap->host_key_len = 0; +- kfree_sensitive(chap->ctrl_key); +- chap->ctrl_key = NULL; +- chap->ctrl_key_len = 0; +- + if (chap->dhgroup_id == data->dhgid && + (data->dhgid == NVME_AUTH_DHGROUP_NULL || chap->dh_tfm)) { + dev_dbg(ctrl->device, +@@ -624,9 +610,6 @@ static int nvme_auth_dhchap_exponential( + if (ret) { + dev_dbg(ctrl->device, + "failed to generate public key, error %d\n", ret); +- kfree(chap->host_key); +- chap->host_key = NULL; +- chap->host_key_len = 0; + chap->status = NVME_AUTH_DHCHAP_FAILURE_INCORRECT_PAYLOAD; + return ret; + } +@@ -646,9 +629,6 @@ static int nvme_auth_dhchap_exponential( + if (ret) { + dev_dbg(ctrl->device, + "failed to generate shared secret, error %d\n", ret); +- kfree_sensitive(chap->sess_key); +- chap->sess_key = NULL; +- chap->sess_key_len = 0; + chap->status = NVME_AUTH_DHCHAP_FAILURE_INCORRECT_PAYLOAD; + return ret; + } diff --git a/patches.suse/nvme-auth-remove-redundant-if-statement.patch b/patches.suse/nvme-auth-remove-redundant-if-statement.patch new file mode 100644 index 0000000..234f1d7 --- /dev/null +++ b/patches.suse/nvme-auth-remove-redundant-if-statement.patch @@ -0,0 +1,29 @@ +From: Sagi Grimberg +Date: Sun, 13 Nov 2022 13:24:12 +0200 +Subject: nvme-auth: remove redundant if statement +Patch-mainline: v6.2-rc1 +Git-commit: bfc4068e1e55e30a86f0e82e15163a60f99a894d +References: bsc#1202633 + +No one passes NVME_QID_ANY to nvme_auth_negotiate. + +Reviewed-by: Hannes Reinecke +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/auth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -874,7 +874,7 @@ int nvme_auth_negotiate(struct nvme_ctrl + mutex_unlock(&ctrl->dhchap_auth_mutex); + return -ENOMEM; + } +- chap->qid = (qid == NVME_QID_ANY) ? 0 : qid; ++ chap->qid = qid; + chap->ctrl = ctrl; + + /* diff --git a/patches.suse/nvme-auth-remove-symbol-export-from-nvme_auth_reset.patch b/patches.suse/nvme-auth-remove-symbol-export-from-nvme_auth_reset.patch new file mode 100644 index 0000000..8be17ec --- /dev/null +++ b/patches.suse/nvme-auth-remove-symbol-export-from-nvme_auth_reset.patch @@ -0,0 +1,28 @@ +From: Sagi Grimberg +Date: Sun, 13 Nov 2022 13:24:07 +0200 +Subject: nvme-auth: remove symbol export from nvme_auth_reset +Patch-mainline: v6.2-rc1 +Git-commit: 100b555bc204fc754108351676297805f5affa49 +References: bsc#1202633 + +Only the nvme module calls it. + +Reviewed-by: Hannes Reinecke +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/auth.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -932,7 +932,6 @@ void nvme_auth_reset(struct nvme_ctrl *c + } + mutex_unlock(&ctrl->dhchap_auth_mutex); + } +-EXPORT_SYMBOL_GPL(nvme_auth_reset); + + static void nvme_ctrl_auth_work(struct work_struct *work) + { diff --git a/patches.suse/nvme-auth-rename-__nvme_auth_-reset-free-to-nvme_aut.patch b/patches.suse/nvme-auth-rename-__nvme_auth_-reset-free-to-nvme_aut.patch new file mode 100644 index 0000000..c9476df --- /dev/null +++ b/patches.suse/nvme-auth-rename-__nvme_auth_-reset-free-to-nvme_aut.patch @@ -0,0 +1,71 @@ +From: Sagi Grimberg +Date: Sun, 13 Nov 2022 13:24:05 +0200 +Subject: nvme-auth: rename __nvme_auth_[reset|free] to + nvme_auth[reset|free]_dhchap +Patch-mainline: v6.2-rc1 +Git-commit: 0a7ce375f83f4ade7c2a835444093b6870fb8257 +References: bsc#1202633 + +nvme_auth_[reset|free] operate on the controller while +__nvme_auth_[reset|free] operate on a chap struct (which maps to a queue +context). Rename it for clarity. + +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Hannes Reinecke +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/auth.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -654,7 +654,7 @@ static int nvme_auth_dhchap_exponential( + return 0; + } + +-static void __nvme_auth_reset(struct nvme_dhchap_queue_context *chap) ++static void nvme_auth_reset_dhchap(struct nvme_dhchap_queue_context *chap) + { + kfree_sensitive(chap->host_response); + chap->host_response = NULL; +@@ -676,9 +676,9 @@ static void __nvme_auth_reset(struct nvm + memset(chap->c2, 0, sizeof(chap->c2)); + } + +-static void __nvme_auth_free(struct nvme_dhchap_queue_context *chap) ++static void nvme_auth_free_dhchap(struct nvme_dhchap_queue_context *chap) + { +- __nvme_auth_reset(chap); ++ nvme_auth_reset_dhchap(chap); + if (chap->shash_tfm) + crypto_free_shash(chap->shash_tfm); + if (chap->dh_tfm) +@@ -868,7 +868,7 @@ int nvme_auth_negotiate(struct nvme_ctrl + dev_dbg(ctrl->device, "qid %d: re-using context\n", qid); + mutex_unlock(&ctrl->dhchap_auth_mutex); + flush_work(&chap->auth_work); +- __nvme_auth_reset(chap); ++ nvme_auth_reset_dhchap(chap); + queue_work(nvme_wq, &chap->auth_work); + return 0; + } +@@ -928,7 +928,7 @@ void nvme_auth_reset(struct nvme_ctrl *c + list_for_each_entry(chap, &ctrl->dhchap_auth_list, entry) { + mutex_unlock(&ctrl->dhchap_auth_mutex); + flush_work(&chap->auth_work); +- __nvme_auth_reset(chap); ++ nvme_auth_reset_dhchap(chap); + } + mutex_unlock(&ctrl->dhchap_auth_mutex); + } +@@ -1002,7 +1002,7 @@ void nvme_auth_free(struct nvme_ctrl *ct + list_for_each_entry_safe(chap, tmp, &ctrl->dhchap_auth_list, entry) { + list_del_init(&chap->entry); + flush_work(&chap->auth_work); +- __nvme_auth_free(chap); ++ nvme_auth_free_dhchap(chap); + } + mutex_unlock(&ctrl->dhchap_auth_mutex); + if (ctrl->host_key) { diff --git a/patches.suse/nvme-auth-rename-authentication-work-elements.patch b/patches.suse/nvme-auth-rename-authentication-work-elements.patch new file mode 100644 index 0000000..f80de64 --- /dev/null +++ b/patches.suse/nvme-auth-rename-authentication-work-elements.patch @@ -0,0 +1,57 @@ +From: Sagi Grimberg +Date: Sun, 13 Nov 2022 13:24:06 +0200 +Subject: nvme-auth: rename authentication work elements +Patch-mainline: v6.2-rc1 +Git-commit: 0c999e69c40a87285f910c400b550fad866e99d0 +References: bsc#1202633 + +Use nvme_ctrl_auth_work and nvme_queue_auth_work for better +readability. + +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Hannes Reinecke +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/auth.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -691,7 +691,7 @@ static void nvme_auth_free_dhchap(struct + kfree(chap); + } + +-static void __nvme_auth_work(struct work_struct *work) ++static void nvme_queue_auth_work(struct work_struct *work) + { + struct nvme_dhchap_queue_context *chap = + container_of(work, struct nvme_dhchap_queue_context, auth_work); +@@ -893,7 +893,7 @@ int nvme_auth_negotiate(struct nvme_ctrl + return -ENOMEM; + } + +- INIT_WORK(&chap->auth_work, __nvme_auth_work); ++ INIT_WORK(&chap->auth_work, nvme_queue_auth_work); + list_add(&chap->entry, &ctrl->dhchap_auth_list); + mutex_unlock(&ctrl->dhchap_auth_mutex); + queue_work(nvme_wq, &chap->auth_work); +@@ -934,7 +934,7 @@ void nvme_auth_reset(struct nvme_ctrl *c + } + EXPORT_SYMBOL_GPL(nvme_auth_reset); + +-static void nvme_dhchap_auth_work(struct work_struct *work) ++static void nvme_ctrl_auth_work(struct work_struct *work) + { + struct nvme_ctrl *ctrl = + container_of(work, struct nvme_ctrl, dhchap_auth_work); +@@ -973,7 +973,7 @@ static void nvme_dhchap_auth_work(struct + void nvme_auth_init_ctrl(struct nvme_ctrl *ctrl) + { + INIT_LIST_HEAD(&ctrl->dhchap_auth_list); +- INIT_WORK(&ctrl->dhchap_auth_work, nvme_dhchap_auth_work); ++ INIT_WORK(&ctrl->dhchap_auth_work, nvme_ctrl_auth_work); + mutex_init(&ctrl->dhchap_auth_mutex); + if (!ctrl->opts) + return; diff --git a/patches.suse/nvme-auth-use-workqueue-dedicated-to-authentication.patch b/patches.suse/nvme-auth-use-workqueue-dedicated-to-authentication.patch new file mode 100644 index 0000000..6879f8f --- /dev/null +++ b/patches.suse/nvme-auth-use-workqueue-dedicated-to-authentication.patch @@ -0,0 +1,88 @@ +From: Shin'ichiro Kawasaki +Date: Tue, 31 Jan 2023 18:26:44 +0900 +Subject: nvme-auth: use workqueue dedicated to authentication +Patch-mainline: v6.2-rc7 +Git-commit: bd97a59da6a866e3dee5d2a2d582ec71dbbc84cd +References: bsc#1202633 + +NVMe In-Band authentication uses two kinds of works: chap->auth_work and +ctrl->dhchap_auth_work. The latter work flushes or cancels the former +work. However, the both works are queued to the same workqueue nvme-wq. +It results in the lockdep WARNING as follows: + + WARNING: possible recursive locking detected + 6.2.0-rc4+ #1 Not tainted + -------------------------------------------- + kworker/u16:7/69 is trying to acquire lock: + ffff902d52e65548 ((wq_completion)nvme-wq){+.+.}-{0:0}, at: start_flush_work+0x2c5/0x380 + + but task is already holding lock: + ffff902d52e65548 ((wq_completion)nvme-wq){+.+.}-{0:0}, at: process_one_work+0x210/0x410 + +To avoid the WARNING, introduce a new workqueue nvme-auth-wq dedicated +to chap->auth_work. + +Reported-by: Daniel Wagner +Link: https://lore.kernel.org/linux-nvme/20230130110802.paafkiipmitwtnwr@carbon.lan/ +Fixes: f50fff73d620 ("nvme: implement In-Band authentication") +Signed-off-by: Shin'ichiro Kawasaki +Tested-by: Daniel Wagner +Reviewed-by: Hannes Reinecke +Signed-off-by: Christoph Hellwig +Acked-by: Daniel Wagner +--- + drivers/nvme/host/auth.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -45,6 +45,8 @@ struct nvme_dhchap_queue_context { + int sess_key_len; + }; + ++struct workqueue_struct *nvme_auth_wq; ++ + #define nvme_auth_flags_from_qid(qid) \ + (qid == 0) ? 0 : BLK_MQ_REQ_NOWAIT | BLK_MQ_REQ_RESERVED + #define nvme_auth_queue_from_qid(ctrl, qid) \ +@@ -866,7 +868,7 @@ int nvme_auth_negotiate(struct nvme_ctrl + + chap = &ctrl->dhchap_ctxs[qid]; + cancel_work_sync(&chap->auth_work); +- queue_work(nvme_wq, &chap->auth_work); ++ queue_work(nvme_auth_wq, &chap->auth_work); + return 0; + } + EXPORT_SYMBOL_GPL(nvme_auth_negotiate); +@@ -1008,10 +1010,15 @@ EXPORT_SYMBOL_GPL(nvme_auth_free); + + int __init nvme_init_auth(void) + { ++ nvme_auth_wq = alloc_workqueue("nvme-auth-wq", ++ WQ_UNBOUND | WQ_MEM_RECLAIM | WQ_SYSFS, 0); ++ if (!nvme_auth_wq) ++ return -ENOMEM; ++ + nvme_chap_buf_cache = kmem_cache_create("nvme-chap-buf-cache", + CHAP_BUF_SIZE, 0, SLAB_HWCACHE_ALIGN, NULL); + if (!nvme_chap_buf_cache) +- return -ENOMEM; ++ goto err_destroy_workqueue; + + nvme_chap_buf_pool = mempool_create(16, mempool_alloc_slab, + mempool_free_slab, nvme_chap_buf_cache); +@@ -1021,6 +1028,8 @@ int __init nvme_init_auth(void) + return 0; + err_destroy_chap_buf_cache: + kmem_cache_destroy(nvme_chap_buf_cache); ++err_destroy_workqueue: ++ destroy_workqueue(nvme_auth_wq); + return -ENOMEM; + } + +@@ -1028,4 +1037,5 @@ void __exit nvme_exit_auth(void) + { + mempool_destroy(nvme_chap_buf_pool); + kmem_cache_destroy(nvme_chap_buf_cache); ++ destroy_workqueue(nvme_auth_wq); + } diff --git a/patches.suse/nvme-fabrics-show-well-known-discovery-name.patch b/patches.suse/nvme-fabrics-show-well-known-discovery-name.patch new file mode 100644 index 0000000..6dd69b8 --- /dev/null +++ b/patches.suse/nvme-fabrics-show-well-known-discovery-name.patch @@ -0,0 +1,51 @@ +From: Daniel Wagner +Date: Tue, 21 Feb 2023 17:51:06 +0100 +Subject: nvme-fabrics: show well known discovery name +Patch-mainline: v6.3-rc1 +Git-commit: 26a57cb35548ae67c14871cccbf50da3edb01ea4 +References: bsc#1200054 + +The kernel always logs the unique subsystem name for a discovery +controller, even in the case user space asked for the well known. + +This has lead to confusion as the logs of nvme-cli and the kernel +logs didn't match. + +First, nvme-cli connects to the well known discovery controller to +figure out if it supports TP8013. If so then nvme-cli disconnects and +connects to the unique discovery controller. Currently, the kernel show +that user space connected twice to the unique one. + +To avoid further confusion, show the well known discovery controller if +user space asked for it: + + $ nvme connect-all -v -t tcp -a 192.168.0.1 + nvme0: nqn.2014-08.org.nvmexpress.discovery connected + nvme0: nqn.2014-08.org.nvmexpress.discovery disconnected + nvme0: nqn.discovery connected + + kernel log: + nvme nvme0: new ctrl: NQN "nqn.2014-08.org.nvmexpress.discovery", addr 192.168.0.1:8009 + nvme nvme0: Removing ctrl: NQN "nqn.2014-08.org.nvmexpress.discovery" + nvme nvme0: new ctrl: NQN "nqn.discovery", addr 192.168.0.1:8009 + +Fixes: e5ea42faa773 ("nvme: display correct subsystem NQN") +Signed-off-by: Daniel Wagner +Reviewed-by: Hannes Reinecke +Signed-off-by: Christoph Hellwig +--- + drivers/nvme/host/fabrics.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/nvme/host/fabrics.h ++++ b/drivers/nvme/host/fabrics.h +@@ -189,7 +189,8 @@ nvmf_ctlr_matches_baseopts(struct nvme_c + + static inline char *nvmf_ctrl_subsysnqn(struct nvme_ctrl *ctrl) + { +- if (!ctrl->subsys) ++ if (!ctrl->subsys || ++ !strcmp(ctrl->opts->subsysnqn, NVME_DISC_SUBSYS_NAME)) + return ctrl->opts->subsysnqn; + return ctrl->subsys->subnqn; + } diff --git a/patches.suse/ocfs2-fix-data-corruption-after-failed-write.patch b/patches.suse/ocfs2-fix-data-corruption-after-failed-write.patch new file mode 100644 index 0000000..5b5b15e --- /dev/null +++ b/patches.suse/ocfs2-fix-data-corruption-after-failed-write.patch @@ -0,0 +1,53 @@ +From: Jan Kara +Subject: [PATCH] ocfs2: Fix data corruption after failed write +Patch-mainline: Submitted, Mar 2 +References: bsc#1208542 + +When buffered write fails to copy data into underlying page cache page, +ocfs2_write_end_nolock() just zeroes out and dirties the page. This can +leave dirty page beyond EOF and if page writeback tries to write this +page before write succeeds and expands i_size, page gets into +inconsistent state where page dirty bit is clear but buffer dirty bits +stay set resulting in page data never getting written and so data copied +to the page is lost. Fix the problem by invalidating page beyond EOF +after failed write. + +Fixes: 6dbf7bb55598 ("fs: Don't invalidate page buffers in block_write_full_page()") +CC: stable@vger.kernel.org +Signed-off-by: Jan Kara +--- + +--- + fs/ocfs2/aops.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +--- a/fs/ocfs2/aops.c ++++ b/fs/ocfs2/aops.c +@@ -2001,11 +2001,25 @@ int ocfs2_write_end_nolock(struct addres + } + + if (unlikely(copied < len) && wc->w_target_page) { ++ loff_t new_isize; ++ + if (!PageUptodate(wc->w_target_page)) + copied = 0; + +- ocfs2_zero_new_buffers(wc->w_target_page, start+copied, +- start+len); ++ new_isize = max_t(loff_t, i_size_read(inode), pos + copied); ++ if (new_isize > page_offset(wc->w_target_page)) ++ ocfs2_zero_new_buffers(wc->w_target_page, start+copied, ++ start+len); ++ else { ++ /* ++ * When page is fully beyond new isize (data copy ++ * failed), do not bother zeroing the page. Invalidate ++ * it instead so that writeback does not get confused ++ * put page & buffer dirty bits into inconsistent ++ * state. ++ */ ++ block_invalidatepage(wc->w_target_page, 0, PAGE_SIZE); ++ } + } + if (wc->w_target_page) + flush_dcache_page(wc->w_target_page); diff --git a/patches.suse/phy-rockchip-typec-fix-tcphy_get_mode-error-case.patch b/patches.suse/phy-rockchip-typec-fix-tcphy_get_mode-error-case.patch new file mode 100644 index 0000000..fbfd53b --- /dev/null +++ b/patches.suse/phy-rockchip-typec-fix-tcphy_get_mode-error-case.patch @@ -0,0 +1,55 @@ +From 4ca651df07183e29cdad7272255e23aec0169a1b Mon Sep 17 00:00:00 2001 +From: Neill Kapron +Date: Thu, 26 Jan 2023 00:10:12 +0000 +Subject: [PATCH] phy: rockchip-typec: fix tcphy_get_mode error case +Git-commit: 4ca651df07183e29cdad7272255e23aec0169a1b +Patch-mainline: v6.3-rc1 +References: git-fixes + +The existing logic in tcphy_get_mode() can cause the phy to be +incorrectly configured to USB UFP or DisplayPort mode when +extcon_get_state returns an error code. + +extcon_get_state() can return 0, 1, or a negative error code. + +It is possible to get into the failing state with an extcon driver +which does not support the extcon connector id specified as the +second argument to extcon_get_state(). + +tcphy_get_mode() +->extcon_get_state() +-->find_cable_index_by_id() + +Acked-by: Takashi Iwai + +--->return -EINVAL; + +Fixes: e96be45cb84e ("phy: Add USB Type-C PHY driver for rk3399") +Signed-off-by: Neill Kapron +Reviewed-by: Lee Jones +Link: https://lore.kernel.org/r/20230126001013.3707873-1-nkapron@google.com +Signed-off-by: Vinod Koul +--- + drivers/phy/rockchip/phy-rockchip-typec.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/rockchip/phy-rockchip-typec.c b/drivers/phy/rockchip/phy-rockchip-typec.c +index d76440ae10ff..6aea512e5d4e 100644 +--- a/drivers/phy/rockchip/phy-rockchip-typec.c ++++ b/drivers/phy/rockchip/phy-rockchip-typec.c +@@ -821,10 +821,10 @@ static int tcphy_get_mode(struct rockchip_typec_phy *tcphy) + mode = MODE_DFP_USB; + id = EXTCON_USB_HOST; + +- if (ufp) { ++ if (ufp > 0) { + mode = MODE_UFP_USB; + id = EXTCON_USB; +- } else if (dp) { ++ } else if (dp > 0) { + mode = MODE_DFP_DP; + id = EXTCON_DISP_DP; + +-- +2.35.3 + diff --git a/patches.suse/phy-tegra-xusb-Fix-return-value-of-tegra_xusb_find_p.patch b/patches.suse/phy-tegra-xusb-Fix-return-value-of-tegra_xusb_find_p.patch new file mode 100644 index 0000000..27d0f48 --- /dev/null +++ b/patches.suse/phy-tegra-xusb-Fix-return-value-of-tegra_xusb_find_p.patch @@ -0,0 +1,38 @@ +From 045a31b95509c8f25f5f04ec5e0dec5cd09f2c5f Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Mon, 13 Dec 2021 02:05:07 +0000 +Subject: [PATCH] phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function +Git-commit: 045a31b95509c8f25f5f04ec5e0dec5cd09f2c5f +Patch-mainline: v5.17-rc1 +References: CVE-2023-23000 bsc#1208816 + +callers of tegra_xusb_find_port_node() function only do NULL checking for +the return value. return NULL instead of ERR_PTR(-ENOMEM) to keep +consistent. + +Signed-off-by: Miaoqian Lin +Acked-by: Thierry Reding +Link: https://lore.kernel.org/r/20211213020507.1458-1-linmq006@gmail.com +Signed-off-by: Vinod Koul +Acked-by: Takashi Iwai + +--- + drivers/phy/tegra/xusb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c +index 963de5913e50..aa5237eacd29 100644 +--- a/drivers/phy/tegra/xusb.c ++++ b/drivers/phy/tegra/xusb.c +@@ -455,7 +455,7 @@ tegra_xusb_find_port_node(struct tegra_xusb_padctl *padctl, const char *type, + name = kasprintf(GFP_KERNEL, "%s-%u", type, index); + if (!name) { + of_node_put(ports); +- return ERR_PTR(-ENOMEM); ++ return NULL; + } + np = of_get_child_by_name(ports, name); + kfree(name); +-- +2.35.3 + diff --git a/patches.suse/pinctrl-mediatek-Initialize-variable-buf-to-zero.patch b/patches.suse/pinctrl-mediatek-Initialize-variable-buf-to-zero.patch new file mode 100644 index 0000000..463bb25 --- /dev/null +++ b/patches.suse/pinctrl-mediatek-Initialize-variable-buf-to-zero.patch @@ -0,0 +1,39 @@ +From 2e34f82ba214134ecf590fbe0cdbd87401645a8a Mon Sep 17 00:00:00 2001 +From: Guodong Liu +Date: Wed, 18 Jan 2023 14:20:36 +0800 +Subject: [PATCH] pinctrl: mediatek: Initialize variable *buf to zero +Git-commit: 2e34f82ba214134ecf590fbe0cdbd87401645a8a +Patch-mainline: v6.3-rc1 +References: git-fixes + +Coverity spotted that *buf is not initialized to zero in +mtk_pctrl_dbg_show. Using uninitialized variable *buf as argument to %s +when calling seq_printf. Fix this coverity by initializing *buf as zero. + +Fixes: 184d8e13f9b1 ("pinctrl: mediatek: Add support for pin configuration dump via debugfs.") +Signed-off-by: Guodong Liu +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20230118062036.26258-3-Guodong.Liu@mediatek.com +Signed-off-by: Linus Walleij +Acked-by: Takashi Iwai + +--- + drivers/pinctrl/mediatek/pinctrl-paris.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c +index bc0bf5aedc54..33d6c3fb7908 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-paris.c ++++ b/drivers/pinctrl/mediatek/pinctrl-paris.c +@@ -717,7 +717,7 @@ static void mtk_pctrl_dbg_show(struct pinctrl_dev *pctldev, struct seq_file *s, + unsigned int gpio) + { + struct mtk_pinctrl *hw = pinctrl_dev_get_drvdata(pctldev); +- char buf[PIN_DBG_BUF_SZ]; ++ char buf[PIN_DBG_BUF_SZ] = { 0 }; + + (void)mtk_pctrl_show_one_pin(hw, gpio, buf, PIN_DBG_BUF_SZ); + +-- +2.35.3 + diff --git a/patches.suse/pinctrl-qcom-pinctrl-msm8976-Correct-function-names-.patch b/patches.suse/pinctrl-qcom-pinctrl-msm8976-Correct-function-names-.patch new file mode 100644 index 0000000..f3f3efb --- /dev/null +++ b/patches.suse/pinctrl-qcom-pinctrl-msm8976-Correct-function-names-.patch @@ -0,0 +1,50 @@ +From a7cc0e2685082a0d79baec02df184dfa83cbfac3 Mon Sep 17 00:00:00 2001 +From: Adam Skladowski +Date: Sat, 31 Dec 2022 17:42:50 +0100 +Subject: [PATCH] pinctrl: qcom: pinctrl-msm8976: Correct function names for wcss pins +Git-commit: a7cc0e2685082a0d79baec02df184dfa83cbfac3 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Adjust names of function for wcss pins, also fix third gpio in bt group. + +Fixes: bcd11493f0ab ("pinctrl: qcom: Add a pinctrl driver for MSM8976 and 8956") +Signed-off-by: Adam Skladowski +Reviewed-by: Marijn Suijten +Link: https://lore.kernel.org/r/20221231164250.74550-1-a39.skl@gmail.com +Signed-off-by: Linus Walleij +Acked-by: Takashi Iwai + +--- + drivers/pinctrl/qcom/pinctrl-msm8976.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/pinctrl/qcom/pinctrl-msm8976.c b/drivers/pinctrl/qcom/pinctrl-msm8976.c +index ec43edf9b660..e11d84584719 100644 +--- a/drivers/pinctrl/qcom/pinctrl-msm8976.c ++++ b/drivers/pinctrl/qcom/pinctrl-msm8976.c +@@ -733,7 +733,7 @@ static const char * const codec_int2_groups[] = { + "gpio74", + }; + static const char * const wcss_bt_groups[] = { +- "gpio39", "gpio47", "gpio88", ++ "gpio39", "gpio47", "gpio48", + }; + static const char * const sdc3_groups[] = { + "gpio39", "gpio40", "gpio41", +@@ -958,9 +958,9 @@ static const struct msm_pingroup msm8976_groups[] = { + PINGROUP(37, NA, NA, NA, qdss_tracedata_b, NA, NA, NA, NA, NA), + PINGROUP(38, NA, NA, NA, NA, NA, NA, NA, qdss_tracedata_b, NA), + PINGROUP(39, wcss_bt, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), +- PINGROUP(40, wcss_wlan, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), +- PINGROUP(41, wcss_wlan, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), +- PINGROUP(42, wcss_wlan, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), ++ PINGROUP(40, wcss_wlan2, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), ++ PINGROUP(41, wcss_wlan1, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), ++ PINGROUP(42, wcss_wlan0, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), + PINGROUP(43, wcss_wlan, sdc3, NA, NA, qdss_tracedata_a, NA, NA, NA, NA), + PINGROUP(44, wcss_wlan, sdc3, NA, NA, NA, NA, NA, NA, NA), + PINGROUP(45, wcss_fm, NA, qdss_tracectl_a, NA, NA, NA, NA, NA, NA), +-- +2.35.3 + diff --git a/patches.suse/pinctrl-rockchip-Fix-refcount-leak-in-rockchip_pinct.patch b/patches.suse/pinctrl-rockchip-Fix-refcount-leak-in-rockchip_pinct.patch new file mode 100644 index 0000000..9451ec5 --- /dev/null +++ b/patches.suse/pinctrl-rockchip-Fix-refcount-leak-in-rockchip_pinct.patch @@ -0,0 +1,37 @@ +From c818ae563bf99457f02e8170aabd6b174f629f65 Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Mon, 2 Jan 2023 15:28:45 +0400 +Subject: [PATCH] pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups +Git-commit: c818ae563bf99457f02e8170aabd6b174f629f65 +Patch-mainline: v6.3-rc1 +References: git-fixes + +of_find_node_by_phandle() returns a node pointer with refcount incremented, +We should use of_node_put() on it when not needed anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: d3e5116119bd ("pinctrl: add pinctrl driver for Rockchip SoCs") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20230102112845.3982407-1-linmq006@gmail.com +Signed-off-by: Linus Walleij +Acked-by: Takashi Iwai + +--- + drivers/pinctrl/pinctrl-rockchip.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c +index da974ff2d75d..0bc3dc2220fd 100644 +--- a/drivers/pinctrl/pinctrl-rockchip.c ++++ b/drivers/pinctrl/pinctrl-rockchip.c +@@ -3036,6 +3036,7 @@ static int rockchip_pinctrl_parse_groups(struct device_node *np, + np_config = of_find_node_by_phandle(be32_to_cpup(phandle)); + ret = pinconf_generic_parse_dt_config(np_config, NULL, + &grp->data[j].configs, &grp->data[j].nconfigs); ++ of_node_put(np_config); + if (ret) + return ret; + } +-- +2.35.3 + diff --git a/patches.suse/pinctrl-stm32-Fix-refcount-leak-in-stm32_pctrl_get_i.patch b/patches.suse/pinctrl-stm32-Fix-refcount-leak-in-stm32_pctrl_get_i.patch new file mode 100644 index 0000000..bf21143 --- /dev/null +++ b/patches.suse/pinctrl-stm32-Fix-refcount-leak-in-stm32_pctrl_get_i.patch @@ -0,0 +1,37 @@ +From dcef18c8ac40aa85bb339f64c1dd31dd458b06fb Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Mon, 2 Jan 2023 12:24:56 +0400 +Subject: [PATCH] pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain +Git-commit: dcef18c8ac40aa85bb339f64c1dd31dd458b06fb +Patch-mainline: v6.3-rc1 +References: git-fixes + +of_irq_find_parent() returns a node pointer with refcount incremented, +We should use of_node_put() on it when not needed anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: d86f4d71e42a ("pinctrl: stm32: check irq controller availability at probe") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20230102082503.3944927-1-linmq006@gmail.com +Signed-off-by: Linus Walleij +Acked-by: Takashi Iwai + +--- + drivers/pinctrl/stm32/pinctrl-stm32.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c +index 1cddca506ad7..cb33a23ab0c1 100644 +--- a/drivers/pinctrl/stm32/pinctrl-stm32.c ++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c +@@ -1382,6 +1382,7 @@ static struct irq_domain *stm32_pctrl_get_irq_domain(struct platform_device *pde + return ERR_PTR(-ENXIO); + + domain = irq_find_host(parent); ++ of_node_put(parent); + if (!domain) + /* domain not registered yet */ + return ERR_PTR(-EPROBE_DEFER); +-- +2.35.3 + diff --git a/patches.suse/platform-x86-MLX_PLATFORM-select-REGMAP-instead-of-d.patch b/patches.suse/platform-x86-MLX_PLATFORM-select-REGMAP-instead-of-d.patch new file mode 100644 index 0000000..c3f8c4e --- /dev/null +++ b/patches.suse/platform-x86-MLX_PLATFORM-select-REGMAP-instead-of-d.patch @@ -0,0 +1,50 @@ +From 7e7e1541c91615e9950d0b96bcd1806d297e970e Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Sat, 25 Feb 2023 21:39:51 -0800 +Subject: [PATCH] platform: x86: MLX_PLATFORM: select REGMAP instead of depending on it +Git-commit: 7e7e1541c91615e9950d0b96bcd1806d297e970e +Patch-mainline: v6.3-rc2 +References: git-fixes + +REGMAP is a hidden (not user visible) symbol. Users cannot set it +directly thru "make *config", so drivers should select it instead of +depending on it if they need it. + +Consistently using "select" or "depends on" can also help reduce +Kconfig circular dependency issues. + +Therefore, change the use of "depends on REGMAP" to "select REGMAP". + +Fixes: ef0f62264b2a ("platform/x86: mlx-platform: Add physical bus number auto detection") +Signed-off-by: Randy Dunlap +Cc: Vadim Pasternak +Cc: Darren Hart +Cc: Hans de Goede +Cc: Mark Gross +Cc: platform-driver-x86@vger.kernel.org +Link: https://lore.kernel.org/r/20230226053953.4681-7-rdunlap@infradead.org +Signed-off-by: Hans de Goede +Reviewed-by: Hans de Goede +Acked-by: Takashi Iwai + +--- + drivers/platform/x86/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig +index ec7c2b4e1721..4a01b315e0a9 100644 +--- a/drivers/platform/x86/Kconfig ++++ b/drivers/platform/x86/Kconfig +@@ -955,7 +955,8 @@ config SERIAL_MULTI_INSTANTIATE + + config MLX_PLATFORM + tristate "Mellanox Technologies platform support" +- depends on I2C && REGMAP ++ depends on I2C ++ select REGMAP + help + This option enables system support for the Mellanox Technologies + platform. The Mellanox systems provide data center networking +-- +2.35.3 + diff --git a/patches.suse/platform-x86-amd-pmc-Correct-usage-of-SMU-version.patch b/patches.suse/platform-x86-amd-pmc-Correct-usage-of-SMU-version.patch new file mode 100644 index 0000000..8b4a4e5 --- /dev/null +++ b/patches.suse/platform-x86-amd-pmc-Correct-usage-of-SMU-version.patch @@ -0,0 +1,60 @@ +From b8fb0d9b47660ddb8a8256412784aad7cee9f21a Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Thu, 20 Jan 2022 11:44:39 -0600 +Subject: [PATCH] platform/x86: amd-pmc: Correct usage of SMU version +Git-commit: b8fb0d9b47660ddb8a8256412784aad7cee9f21a +Patch-mainline: v5.17-rc3 +References: git-fixes + +Yellow carp has been outputting versions like `1093.24.0`, but this +is supposed to be 69.24.0. That is the MSB is being interpreted +incorrectly. + +The MSB is not part of the major version, but has generally been +treated that way thus far. It's actually the program, and used to +distinguish between two programs from a similar family but different +codebase. + +Link: https://patchwork.freedesktop.org/patch/469993/ +Signed-off-by: Mario Limonciello +Link: https://lore.kernel.org/r/20220120174439.12770-1-mario.limonciello@amd.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Acked-by: Takashi Iwai + +--- + drivers/platform/x86/amd-pmc.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/platform/x86/amd-pmc.c ++++ b/drivers/platform/x86/amd-pmc.c +@@ -115,9 +115,10 @@ struct amd_pmc_dev { + u32 cpu_id; + u32 active_ips; + /* SMU version information */ +- u16 major; +- u16 minor; +- u16 rev; ++ u8 smu_program; ++ u8 major; ++ u8 minor; ++ u8 rev; + struct device *dev; + struct mutex lock; /* generic mutex lock */ + #if IS_ENABLED(CONFIG_DEBUG_FS) +@@ -164,11 +165,13 @@ static int amd_pmc_get_smu_version(struc + if (rc) + return rc; + +- dev->major = (val >> 16) & GENMASK(15, 0); ++ dev->smu_program = (val >> 24) & GENMASK(7, 0); ++ dev->major = (val >> 16) & GENMASK(7, 0); + dev->minor = (val >> 8) & GENMASK(7, 0); + dev->rev = (val >> 0) & GENMASK(7, 0); + +- dev_dbg(dev->dev, "SMU version is %u.%u.%u\n", dev->major, dev->minor, dev->rev); ++ dev_dbg(dev->dev, "SMU program %u version is %u.%u.%u\n", ++ dev->smu_program, dev->major, dev->minor, dev->rev); + + return 0; + } diff --git a/patches.suse/platform-x86-amd-pmc-Export-Idlemask-values-based-on.patch b/patches.suse/platform-x86-amd-pmc-Export-Idlemask-values-based-on.patch new file mode 100644 index 0000000..8b9411f --- /dev/null +++ b/patches.suse/platform-x86-amd-pmc-Export-Idlemask-values-based-on.patch @@ -0,0 +1,160 @@ +From f6045de1f53268131ea75a99b210b869dcc150b2 Mon Sep 17 00:00:00 2001 +From: Sanket Goswami +Date: Thu, 16 Sep 2021 18:10:02 +0530 +Subject: [PATCH] platform/x86: amd-pmc: Export Idlemask values based on the APU +Git-commit: f6045de1f53268131ea75a99b210b869dcc150b2 +Patch-mainline: v5.16-rc1 +References: git-fixes + +IdleMask is the metric used by the PM firmware to know the status of each +of the Hardware IP blocks monitored by the PM firmware. + +Knowing this value is key to get the information of s2idle suspend/resume +status. This value is mapped to PMC scratch registers, retrieve them +accordingly based on the CPU family and the underlying firmware support. + +Co-developed-by: Shyam Sundar S K +Signed-off-by: Shyam Sundar S K +Signed-off-by: Sanket Goswami +Reviewed-by: Mario Limonciello +Link: https://lore.kernel.org/r/20210916124002.2529-1-Sanket.Goswami@amd.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Acked-by: Takashi Iwai + +--- + drivers/platform/x86/amd-pmc.c | 76 ++++++++++++++++++++++++++++++++++ + 1 file changed, 76 insertions(+) + +diff --git a/drivers/platform/x86/amd-pmc.c b/drivers/platform/x86/amd-pmc.c +index 8c2016e02470..1303366c31af 100644 +--- a/drivers/platform/x86/amd-pmc.c ++++ b/drivers/platform/x86/amd-pmc.c +@@ -29,6 +29,10 @@ + #define AMD_PMC_REGISTER_RESPONSE 0x980 + #define AMD_PMC_REGISTER_ARGUMENT 0x9BC + ++/* PMC Scratch Registers */ ++#define AMD_PMC_SCRATCH_REG_CZN 0x94 ++#define AMD_PMC_SCRATCH_REG_YC 0xD14 ++ + /* Base address of SMU for mapping physical address to virtual address */ + #define AMD_PMC_SMU_INDEX_ADDRESS 0xB8 + #define AMD_PMC_SMU_INDEX_DATA 0xBC +@@ -110,6 +114,10 @@ struct amd_pmc_dev { + u32 base_addr; + u32 cpu_id; + u32 active_ips; ++/* SMU version information */ ++ u16 major; ++ u16 minor; ++ u16 rev; + struct device *dev; + struct mutex lock; /* generic mutex lock */ + #if IS_ENABLED(CONFIG_DEBUG_FS) +@@ -202,6 +210,66 @@ static int s0ix_stats_show(struct seq_file *s, void *unused) + } + DEFINE_SHOW_ATTRIBUTE(s0ix_stats); + ++static int amd_pmc_get_smu_version(struct amd_pmc_dev *dev) ++{ ++ int rc; ++ u32 val; ++ ++ rc = amd_pmc_send_cmd(dev, 0, &val, SMU_MSG_GETSMUVERSION, 1); ++ if (rc) ++ return rc; ++ ++ dev->major = (val >> 16) & GENMASK(15, 0); ++ dev->minor = (val >> 8) & GENMASK(7, 0); ++ dev->rev = (val >> 0) & GENMASK(7, 0); ++ ++ dev_dbg(dev->dev, "SMU version is %u.%u.%u\n", dev->major, dev->minor, dev->rev); ++ ++ return 0; ++} ++ ++static int amd_pmc_idlemask_read(struct amd_pmc_dev *pdev, struct device *dev, ++ struct seq_file *s) ++{ ++ u32 val; ++ ++ switch (pdev->cpu_id) { ++ case AMD_CPU_ID_CZN: ++ val = amd_pmc_reg_read(pdev, AMD_PMC_SCRATCH_REG_CZN); ++ break; ++ case AMD_CPU_ID_YC: ++ val = amd_pmc_reg_read(pdev, AMD_PMC_SCRATCH_REG_YC); ++ break; ++ default: ++ return -EINVAL; ++ } ++ ++ if (dev) ++ dev_dbg(pdev->dev, "SMU idlemask s0i3: 0x%x\n", val); ++ ++ if (s) ++ seq_printf(s, "SMU idlemask : 0x%x\n", val); ++ ++ return 0; ++} ++ ++static int amd_pmc_idlemask_show(struct seq_file *s, void *unused) ++{ ++ struct amd_pmc_dev *dev = s->private; ++ int rc; ++ ++ if (dev->major > 56 || (dev->major >= 55 && dev->minor >= 37)) { ++ rc = amd_pmc_idlemask_read(dev, NULL, s); ++ if (rc) ++ return rc; ++ } else { ++ seq_puts(s, "Unsupported SMU version for Idlemask\n"); ++ } ++ ++ return 0; ++} ++DEFINE_SHOW_ATTRIBUTE(amd_pmc_idlemask); ++ + static void amd_pmc_dbgfs_unregister(struct amd_pmc_dev *dev) + { + debugfs_remove_recursive(dev->dbgfs_dir); +@@ -214,6 +282,8 @@ static void amd_pmc_dbgfs_register(struct amd_pmc_dev *dev) + &smu_fw_info_fops); + debugfs_create_file("s0ix_stats", 0644, dev->dbgfs_dir, dev, + &s0ix_stats_fops); ++ debugfs_create_file("amd_pmc_idlemask", 0644, dev->dbgfs_dir, dev, ++ &amd_pmc_idlemask_fops); + } + #else + static inline void amd_pmc_dbgfs_register(struct amd_pmc_dev *dev) +@@ -350,6 +420,8 @@ static int __maybe_unused amd_pmc_suspend(struct device *dev) + amd_pmc_send_cmd(pdev, 0, NULL, SMU_MSG_LOG_RESET, 0); + amd_pmc_send_cmd(pdev, 0, NULL, SMU_MSG_LOG_START, 0); + ++ /* Dump the IdleMask before we send hint to SMU */ ++ amd_pmc_idlemask_read(pdev, dev, NULL); + msg = amd_pmc_get_os_hint(pdev); + rc = amd_pmc_send_cmd(pdev, 1, NULL, msg, 0); + if (rc) +@@ -372,6 +444,9 @@ static int __maybe_unused amd_pmc_resume(struct device *dev) + if (rc) + dev_err(pdev->dev, "resume failed\n"); + ++ /* Dump the IdleMask to see the blockers */ ++ amd_pmc_idlemask_read(pdev, dev, NULL); ++ + return 0; + } + +@@ -458,6 +533,7 @@ static int amd_pmc_probe(struct platform_device *pdev) + if (err) + dev_err(dev->dev, "SMU debugging info not supported on this platform\n"); + ++ amd_pmc_get_smu_version(dev); + platform_set_drvdata(pdev, dev); + amd_pmc_dbgfs_register(dev); + return 0; +-- +2.35.3 + diff --git a/patches.suse/platform-x86-amd-pmc-Fix-compilation-when-CONFIG_DEB.patch b/patches.suse/platform-x86-amd-pmc-Fix-compilation-when-CONFIG_DEB.patch new file mode 100644 index 0000000..e8c85d2 --- /dev/null +++ b/patches.suse/platform-x86-amd-pmc-Fix-compilation-when-CONFIG_DEB.patch @@ -0,0 +1,134 @@ +From 40635cd32f0d83573a558dc30e9ba3469e769249 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Tue, 28 Sep 2021 16:16:06 +0200 +Subject: [PATCH] platform/x86: amd-pmc: Fix compilation when CONFIG_DEBUGFS is disabled +Git-commit: 40635cd32f0d83573a558dc30e9ba3469e769249 +Patch-mainline: v5.16-rc1 +References: git-fixes + +The amd_pmc_get_smu_version() and amd_pmc_idlemask_read() functions are +used in the probe / suspend/resume code, so they are also used when +CONFIG_DEBUGFS is disabled, move them outside of the #ifdef CONFIG_DEBUGFS +block. + +Note this purely moves the code to above the #ifdef CONFIG_DEBUGFS, +the code is completely unchanged. + +Fixes: f6045de1f532 ("platform/x86: amd-pmc: Export Idlemask values based on the APU") +Cc: Shyam Sundar S K +Cc: Sanket Goswami +Reported-by: Nathan Chancellor +Signed-off-by: Hans de Goede +Acked-by: Takashi Iwai + +--- + drivers/platform/x86/amd-pmc.c | 86 +++++++++++++++++----------------- + 1 file changed, 43 insertions(+), 43 deletions(-) + +diff --git a/drivers/platform/x86/amd-pmc.c b/drivers/platform/x86/amd-pmc.c +index 1303366c31af..f185c43bbaa4 100644 +--- a/drivers/platform/x86/amd-pmc.c ++++ b/drivers/platform/x86/amd-pmc.c +@@ -155,6 +155,49 @@ struct smu_metrics { + u64 timecondition_notmet_totaltime[SOC_SUBSYSTEM_IP_MAX]; + } __packed; + ++static int amd_pmc_get_smu_version(struct amd_pmc_dev *dev) ++{ ++ int rc; ++ u32 val; ++ ++ rc = amd_pmc_send_cmd(dev, 0, &val, SMU_MSG_GETSMUVERSION, 1); ++ if (rc) ++ return rc; ++ ++ dev->major = (val >> 16) & GENMASK(15, 0); ++ dev->minor = (val >> 8) & GENMASK(7, 0); ++ dev->rev = (val >> 0) & GENMASK(7, 0); ++ ++ dev_dbg(dev->dev, "SMU version is %u.%u.%u\n", dev->major, dev->minor, dev->rev); ++ ++ return 0; ++} ++ ++static int amd_pmc_idlemask_read(struct amd_pmc_dev *pdev, struct device *dev, ++ struct seq_file *s) ++{ ++ u32 val; ++ ++ switch (pdev->cpu_id) { ++ case AMD_CPU_ID_CZN: ++ val = amd_pmc_reg_read(pdev, AMD_PMC_SCRATCH_REG_CZN); ++ break; ++ case AMD_CPU_ID_YC: ++ val = amd_pmc_reg_read(pdev, AMD_PMC_SCRATCH_REG_YC); ++ break; ++ default: ++ return -EINVAL; ++ } ++ ++ if (dev) ++ dev_dbg(pdev->dev, "SMU idlemask s0i3: 0x%x\n", val); ++ ++ if (s) ++ seq_printf(s, "SMU idlemask : 0x%x\n", val); ++ ++ return 0; ++} ++ + #ifdef CONFIG_DEBUG_FS + static int smu_fw_info_show(struct seq_file *s, void *unused) + { +@@ -210,49 +253,6 @@ static int s0ix_stats_show(struct seq_file *s, void *unused) + } + DEFINE_SHOW_ATTRIBUTE(s0ix_stats); + +-static int amd_pmc_get_smu_version(struct amd_pmc_dev *dev) +-{ +- int rc; +- u32 val; +- +- rc = amd_pmc_send_cmd(dev, 0, &val, SMU_MSG_GETSMUVERSION, 1); +- if (rc) +- return rc; +- +- dev->major = (val >> 16) & GENMASK(15, 0); +- dev->minor = (val >> 8) & GENMASK(7, 0); +- dev->rev = (val >> 0) & GENMASK(7, 0); +- +- dev_dbg(dev->dev, "SMU version is %u.%u.%u\n", dev->major, dev->minor, dev->rev); +- +- return 0; +-} +- +-static int amd_pmc_idlemask_read(struct amd_pmc_dev *pdev, struct device *dev, +- struct seq_file *s) +-{ +- u32 val; +- +- switch (pdev->cpu_id) { +- case AMD_CPU_ID_CZN: +- val = amd_pmc_reg_read(pdev, AMD_PMC_SCRATCH_REG_CZN); +- break; +- case AMD_CPU_ID_YC: +- val = amd_pmc_reg_read(pdev, AMD_PMC_SCRATCH_REG_YC); +- break; +- default: +- return -EINVAL; +- } +- +- if (dev) +- dev_dbg(pdev->dev, "SMU idlemask s0i3: 0x%x\n", val); +- +- if (s) +- seq_printf(s, "SMU idlemask : 0x%x\n", val); +- +- return 0; +-} +- + static int amd_pmc_idlemask_show(struct seq_file *s, void *unused) + { + struct amd_pmc_dev *dev = s->private; +-- +2.35.3 + diff --git a/patches.suse/platform-x86-touchscreen_dmi-Add-Chuwi-Vi8-CWI501-DM.patch b/patches.suse/platform-x86-touchscreen_dmi-Add-Chuwi-Vi8-CWI501-DM.patch new file mode 100644 index 0000000..350c89e --- /dev/null +++ b/patches.suse/platform-x86-touchscreen_dmi-Add-Chuwi-Vi8-CWI501-DM.patch @@ -0,0 +1,43 @@ +From eecf2acd4a580e9364e5087daf0effca60a240b7 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 2 Feb 2023 11:34:13 +0100 +Subject: [PATCH] platform/x86: touchscreen_dmi: Add Chuwi Vi8 (CWI501) DMI match +Git-commit: eecf2acd4a580e9364e5087daf0effca60a240b7 +Patch-mainline: v6.2-rc7 +References: git-fixes + +Add a DMI match for the CWI501 version of the Chuwi Vi8 tablet, +pointing to the same chuwi_vi8_data as the existing CWI506 version +DMI match. + +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20230202103413.331459-1-hdegoede@redhat.com +Acked-by: Takashi Iwai + +--- + drivers/platform/x86/touchscreen_dmi.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c +index f00995390fdf..13802a3c3591 100644 +--- a/drivers/platform/x86/touchscreen_dmi.c ++++ b/drivers/platform/x86/touchscreen_dmi.c +@@ -1097,6 +1097,15 @@ const struct dmi_system_id touchscreen_dmi_table[] = { + DMI_MATCH(DMI_BIOS_DATE, "05/07/2016"), + }, + }, ++ { ++ /* Chuwi Vi8 (CWI501) */ ++ .driver_data = (void *)&chuwi_vi8_data, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Insyde"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "i86"), ++ DMI_MATCH(DMI_BIOS_VERSION, "CHUWI.W86JLBNR01"), ++ }, ++ }, + { + /* Chuwi Vi8 (CWI506) */ + .driver_data = (void *)&chuwi_vi8_data, +-- +2.35.3 + diff --git a/patches.suse/printf-fix-errname.c-list.patch b/patches.suse/printf-fix-errname.c-list.patch new file mode 100644 index 0000000..9c66800 --- /dev/null +++ b/patches.suse/printf-fix-errname.c-list.patch @@ -0,0 +1,110 @@ +From 0c2baf6509af1d11310ae4c1c839481a6e9a4bc4 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 6 Feb 2023 20:40:57 +0100 +Subject: [PATCH] printf: fix errname.c list +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 0c2baf6509af1d11310ae4c1c839481a6e9a4bc4 +Patch-mainline: v6.3-rc1 +References: git-fixes + +On most architectures, gcc -Wextra warns about the list of error +numbers containing both EDEADLK and EDEADLOCK: + +lib/errname.c:15:67: warning: initialized field overwritten [-Woverride-init] + 15 | #define E(err) [err + BUILD_BUG_ON_ZERO(err <= 0 || err > 300)] = "-" #err + | ^~~ +lib/errname.c:172:2: note: in expansion of macro 'E' + 172 | E(EDEADLK), /* EDEADLOCK */ + | ^ + +On parisc, a similar error happens with -ECANCELLED, which is an +alias for ECANCELED. + +Make the EDEADLK printing conditional on the number being distinct +from EDEADLOCK, and remove the -ECANCELLED bit completely as it +can never be hit. + +To ensure these are correct, add static_assert lines that verify +all the remaining aliases are in fact identical to the canonical +name. + +Fixes: 57f5677e535b ("printf: add support for printing symbolic error names") +Cc: Petr Mladek +Suggested-by: Rasmus Villemoes +Acked-by: Uwe Kleine-König +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/all/20210514213456.745039-1-arnd@kernel.org/ +Link: https://lore.kernel.org/all/20210927123409.1109737-1-arnd@kernel.org/ +Signed-off-by: Arnd Bergmann +Reviewed-by: Sergey Senozhatsky +Acked-by: Rasmus Villemoes +Reviewed-by: Petr Mladek +Signed-off-by: Petr Mladek +Link: https://lore.kernel.org/r/20230206194126.380350-1-arnd@kernel.org +Acked-by: Takashi Iwai + +--- + lib/errname.c | 22 ++++++++++++++-------- + 1 file changed, 14 insertions(+), 8 deletions(-) + +diff --git a/lib/errname.c b/lib/errname.c +index 05cbf731545f..67739b174a8c 100644 +--- a/lib/errname.c ++++ b/lib/errname.c +@@ -21,6 +21,7 @@ static const char *names_0[] = { + E(EADDRNOTAVAIL), + E(EADV), + E(EAFNOSUPPORT), ++ E(EAGAIN), /* EWOULDBLOCK */ + E(EALREADY), + E(EBADE), + E(EBADF), +@@ -31,15 +32,17 @@ static const char *names_0[] = { + E(EBADSLT), + E(EBFONT), + E(EBUSY), +-#ifdef ECANCELLED +- E(ECANCELLED), +-#endif ++ E(ECANCELED), /* ECANCELLED */ + E(ECHILD), + E(ECHRNG), + E(ECOMM), + E(ECONNABORTED), ++ E(ECONNREFUSED), /* EREFUSED */ + E(ECONNRESET), ++ E(EDEADLK), /* EDEADLOCK */ ++#if EDEADLK != EDEADLOCK /* mips, sparc, powerpc */ + E(EDEADLOCK), ++#endif + E(EDESTADDRREQ), + E(EDOM), + E(EDOTDOT), +@@ -166,14 +169,17 @@ static const char *names_0[] = { + E(EUSERS), + E(EXDEV), + E(EXFULL), +- +- E(ECANCELED), /* ECANCELLED */ +- E(EAGAIN), /* EWOULDBLOCK */ +- E(ECONNREFUSED), /* EREFUSED */ +- E(EDEADLK), /* EDEADLOCK */ + }; + #undef E + ++#ifdef EREFUSED /* parisc */ ++static_assert(EREFUSED == ECONNREFUSED); ++#endif ++#ifdef ECANCELLED /* parisc */ ++static_assert(ECANCELLED == ECANCELED); ++#endif ++static_assert(EAGAIN == EWOULDBLOCK); /* everywhere */ ++ + #define E(err) [err - 512 + BUILD_BUG_ON_ZERO(err < 512 || err > 550)] = "-" #err + static const char *names_512[] = { + E(ERESTARTSYS), +-- +2.35.3 + diff --git a/patches.suse/qede-avoid-uninitialized-entries-in-coal_entry-array.patch b/patches.suse/qede-avoid-uninitialized-entries-in-coal_entry-array.patch new file mode 100644 index 0000000..7a93666 --- /dev/null +++ b/patches.suse/qede-avoid-uninitialized-entries-in-coal_entry-array.patch @@ -0,0 +1,75 @@ +From: Michal Schmidt +Date: Fri, 24 Feb 2023 01:41:45 +0100 +Subject: qede: avoid uninitialized entries in coal_entry array +Patch-mainline: v6.3-rc1 +Git-commit: aaa3c08ee0653beaa649d4adfb27ad562641cfd8 +References: bsc#1205846 + +Even after commit 908d4bb7c54c ("qede: fix interrupt coalescing +configuration"), some entries of the coal_entry array may theoretically +be used uninitialized: + + 1. qede_alloc_fp_array() allocates QEDE_MAX_RSS_CNT entries for + coal_entry. The initial allocation uses kcalloc, so everything is + initialized. + 2. The user sets a small number of queues (ethtool -L). + coal_entry is reallocated for the actual small number of queues. + 3. The user sets a bigger number of queues. + coal_entry is reallocated bigger. The added entries are not + necessarily initialized. + +In practice, the reallocations will actually keep using the originally +allocated region of memory, but we should not rely on it. + +The reallocation is unnecessary. coal_entry can always have +QEDE_MAX_RSS_CNT entries. + +Fixes: 908d4bb7c54c ("qede: fix interrupt coalescing configuration") +Signed-off-by: Michal Schmidt +Nacked-by: Manish Chopra +Acked-by: Manish Chopra +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/qlogic/qede/qede_main.c | 21 +++++++-------------- + 1 file changed, 7 insertions(+), 14 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qede/qede_main.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c +@@ -899,7 +899,6 @@ static int qede_alloc_fp_array(struct qe + { + u8 fp_combined, fp_rx = edev->fp_num_rx; + struct qede_fastpath *fp; +- void *mem; + int i; + + edev->fp_array = kcalloc(QEDE_QUEUE_CNT(edev), +@@ -910,21 +909,15 @@ static int qede_alloc_fp_array(struct qe + } + + if (!edev->coal_entry) { +- mem = kcalloc(QEDE_MAX_RSS_CNT(edev), +- sizeof(*edev->coal_entry), GFP_KERNEL); +- } else { +- mem = krealloc(edev->coal_entry, +- QEDE_QUEUE_CNT(edev) * sizeof(*edev->coal_entry), +- GFP_KERNEL); ++ edev->coal_entry = kcalloc(QEDE_MAX_RSS_CNT(edev), ++ sizeof(*edev->coal_entry), ++ GFP_KERNEL); ++ if (!edev->coal_entry) { ++ DP_ERR(edev, "coalesce entry allocation failed\n"); ++ goto err; ++ } + } + +- if (!mem) { +- DP_ERR(edev, "coalesce entry allocation failed\n"); +- kfree(edev->coal_entry); +- goto err; +- } +- edev->coal_entry = mem; +- + fp_combined = QEDE_QUEUE_CNT(edev) - fp_rx - edev->fp_num_tx; + + /* Allocate the FP elements for Rx queues followed by combined and then diff --git a/patches.suse/qede-fix-interrupt-coalescing-configuration.patch b/patches.suse/qede-fix-interrupt-coalescing-configuration.patch new file mode 100644 index 0000000..67d8db2 --- /dev/null +++ b/patches.suse/qede-fix-interrupt-coalescing-configuration.patch @@ -0,0 +1,50 @@ +From: Manish Chopra +Date: Thu, 16 Feb 2023 03:54:47 -0800 +Subject: qede: fix interrupt coalescing configuration +Patch-mainline: v6.3-rc1 +Git-commit: 908d4bb7c54caa58253a363d63e797a468eaf321 +References: bsc#1205846 + +On default driver load device gets configured with unexpected +higher interrupt coalescing values instead of default expected +values as memory allocated from krealloc() is not supposed to +be zeroed out and may contain garbage values. + +Fix this by allocating the memory of required size first with +kcalloc() and then use krealloc() to resize and preserve the +contents across down/up of the interface. + +Signed-off-by: Manish Chopra +Fixes: b0ec5489c480 ("qede: preserve per queue stats across up/down of interface") +Cc: stable@vger.kernel.org +Cc: Bhaskar Upadhaya +Cc: David S. Miller +Link: https://bugzilla.redhat.com/show_bug.cgi?id=2160054 +Signed-off-by: Alok Prasad +Signed-off-by: Ariel Elior +Signed-off-by: David S. Miller +Acked-by: Thomas Bogendoerfer +--- + drivers/net/ethernet/qlogic/qede/qede_main.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qede/qede_main.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c +@@ -909,8 +909,15 @@ static int qede_alloc_fp_array(struct qe + goto err; + } + +- mem = krealloc(edev->coal_entry, QEDE_QUEUE_CNT(edev) * +- sizeof(*edev->coal_entry), GFP_KERNEL); ++ if (!edev->coal_entry) { ++ mem = kcalloc(QEDE_MAX_RSS_CNT(edev), ++ sizeof(*edev->coal_entry), GFP_KERNEL); ++ } else { ++ mem = krealloc(edev->coal_entry, ++ QEDE_QUEUE_CNT(edev) * sizeof(*edev->coal_entry), ++ GFP_KERNEL); ++ } ++ + if (!mem) { + DP_ERR(edev, "coalesce entry allocation failed\n"); + kfree(edev->coal_entry); diff --git a/patches.suse/remoteproc-mtk_scp-Move-clk-ops-outside-send_lock.patch b/patches.suse/remoteproc-mtk_scp-Move-clk-ops-outside-send_lock.patch new file mode 100644 index 0000000..94f54e7 --- /dev/null +++ b/patches.suse/remoteproc-mtk_scp-Move-clk-ops-outside-send_lock.patch @@ -0,0 +1,81 @@ +From e46ceea3148163166ef9b7bcac578e72dd30c064 Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Wed, 4 Jan 2023 16:31:10 +0800 +Subject: [PATCH] remoteproc/mtk_scp: Move clk ops outside send_lock +Git-commit: e46ceea3148163166ef9b7bcac578e72dd30c064 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Clocks are properly reference counted and do not need to be inside the +lock range. + +Right now this triggers a false-positive lockdep warning on MT8192 based +Chromebooks, through a combination of mtk-scp that has a cros-ec-rpmsg +sub-device, the (actual) cros-ec I2C adapter registration, I2C client +(not on cros-ec) probe doing i2c transfers and enabling clocks. + +This is a false positive because the cros-ec-rpmsg under mtk-scp does +not have an I2C adapter, and also each I2C adapter and cros-ec instance +have their own mutex. + +Move the clk operations outside of the send_lock range. + +Fixes: 63c13d61eafe ("remoteproc/mediatek: add SCP support for mt8183") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230104083110.736377-1-wenst@chromium.org +[Fixed "Fixes:" tag line] + +Signed-off-by: Mathieu Poirier +Acked-by: Takashi Iwai + +--- + drivers/remoteproc/mtk_scp_ipi.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/remoteproc/mtk_scp_ipi.c b/drivers/remoteproc/mtk_scp_ipi.c +index 00f041ebcde6..4c0d121c2f54 100644 +--- a/drivers/remoteproc/mtk_scp_ipi.c ++++ b/drivers/remoteproc/mtk_scp_ipi.c +@@ -164,21 +164,21 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len, + WARN_ON(len > sizeof(send_obj->share_buf)) || WARN_ON(!buf)) + return -EINVAL; + +- mutex_lock(&scp->send_lock); +- + ret = clk_prepare_enable(scp->clk); + if (ret) { + dev_err(scp->dev, "failed to enable clock\n"); +- goto unlock_mutex; ++ return ret; + } + ++ mutex_lock(&scp->send_lock); ++ + /* Wait until SCP receives the last command */ + timeout = jiffies + msecs_to_jiffies(2000); + do { + if (time_after(jiffies, timeout)) { + dev_err(scp->dev, "%s: IPI timeout!\n", __func__); + ret = -ETIMEDOUT; +- goto clock_disable; ++ goto unlock_mutex; + } + } while (readl(scp->reg_base + scp->data->host_to_scp_reg)); + +@@ -205,10 +205,9 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len, + ret = 0; + } + +-clock_disable: +- clk_disable_unprepare(scp->clk); + unlock_mutex: + mutex_unlock(&scp->send_lock); ++ clk_disable_unprepare(scp->clk); + + return ret; + } +-- +2.35.3 + diff --git a/patches.suse/remoteproc-qcom_q6v5_mss-Use-a-carveout-to-authentic.patch b/patches.suse/remoteproc-qcom_q6v5_mss-Use-a-carveout-to-authentic.patch new file mode 100644 index 0000000..6747767 --- /dev/null +++ b/patches.suse/remoteproc-qcom_q6v5_mss-Use-a-carveout-to-authentic.patch @@ -0,0 +1,138 @@ +From 57f72170a2b2a362c35bb9407fc844eac5afdec1 Mon Sep 17 00:00:00 2001 +From: Sibi Sankar +Date: Tue, 17 Jan 2023 14:28:35 +0530 +Subject: [PATCH] remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers +Git-commit: 57f72170a2b2a362c35bb9407fc844eac5afdec1 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Any access to the dynamically allocated metadata region by the application +processor after assigning it to the remote Q6 will result in a XPU +violation. Fix this by replacing the dynamically allocated memory region +with a no-map carveout and unmap the modem metadata memory region before +passing control to the remote Q6. + +Reported-and-tested-by: Amit Pundir +Fixes: 6c5a9dc2481b ("remoteproc: qcom: Make secure world call for mem ownership switch") +Signed-off-by: Sibi Sankar +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230117085840.32356-7-quic_sibis@quicinc.com +Acked-by: Takashi Iwai + +--- + drivers/remoteproc/qcom_q6v5_mss.c | 59 +++++++++++++++++++++++++++--- + 1 file changed, 53 insertions(+), 6 deletions(-) + +diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c +index e2f765f87ec9..292e22f58df3 100644 +--- a/drivers/remoteproc/qcom_q6v5_mss.c ++++ b/drivers/remoteproc/qcom_q6v5_mss.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -215,6 +216,9 @@ struct q6v5 { + size_t mba_size; + size_t dp_size; + ++ phys_addr_t mdata_phys; ++ size_t mdata_size; ++ + phys_addr_t mpss_phys; + phys_addr_t mpss_reloc; + size_t mpss_size; +@@ -973,15 +977,35 @@ static int q6v5_mpss_init_image(struct q6v5 *qproc, const struct firmware *fw, + if (IS_ERR(metadata)) + return PTR_ERR(metadata); + +- ptr = dma_alloc_attrs(qproc->dev, size, &phys, GFP_KERNEL, dma_attrs); +- if (!ptr) { +- kfree(metadata); +- dev_err(qproc->dev, "failed to allocate mdt buffer\n"); +- return -ENOMEM; ++ if (qproc->mdata_phys) { ++ if (size > qproc->mdata_size) { ++ ret = -EINVAL; ++ dev_err(qproc->dev, "metadata size outside memory range\n"); ++ goto free_metadata; ++ } ++ ++ phys = qproc->mdata_phys; ++ ptr = memremap(qproc->mdata_phys, size, MEMREMAP_WC); ++ if (!ptr) { ++ ret = -EBUSY; ++ dev_err(qproc->dev, "unable to map memory region: %pa+%zx\n", ++ &qproc->mdata_phys, size); ++ goto free_metadata; ++ } ++ } else { ++ ptr = dma_alloc_attrs(qproc->dev, size, &phys, GFP_KERNEL, dma_attrs); ++ if (!ptr) { ++ ret = -ENOMEM; ++ dev_err(qproc->dev, "failed to allocate mdt buffer\n"); ++ goto free_metadata; ++ } + } + + memcpy(ptr, metadata, size); + ++ if (qproc->mdata_phys) ++ memunmap(ptr); ++ + /* Hypervisor mapping to access metadata by modem */ + mdata_perm = BIT(QCOM_SCM_VMID_HLOS); + ret = q6v5_xfer_mem_ownership(qproc, &mdata_perm, false, true, +@@ -1010,7 +1034,9 @@ static int q6v5_mpss_init_image(struct q6v5 *qproc, const struct firmware *fw, + "mdt buffer not reclaimed system may become unstable\n"); + + free_dma_attrs: +- dma_free_attrs(qproc->dev, size, ptr, phys, dma_attrs); ++ if (!qproc->mdata_phys) ++ dma_free_attrs(qproc->dev, size, ptr, phys, dma_attrs); ++free_metadata: + kfree(metadata); + + return ret < 0 ? ret : 0; +@@ -1847,6 +1873,7 @@ static int q6v5_init_reset(struct q6v5 *qproc) + static int q6v5_alloc_memory_region(struct q6v5 *qproc) + { + struct device_node *child; ++ struct reserved_mem *rmem; + struct device_node *node; + struct resource r; + int ret; +@@ -1893,6 +1920,26 @@ static int q6v5_alloc_memory_region(struct q6v5 *qproc) + qproc->mpss_phys = qproc->mpss_reloc = r.start; + qproc->mpss_size = resource_size(&r); + ++ if (!child) { ++ node = of_parse_phandle(qproc->dev->of_node, "memory-region", 2); ++ } else { ++ child = of_get_child_by_name(qproc->dev->of_node, "metadata"); ++ node = of_parse_phandle(child, "memory-region", 0); ++ of_node_put(child); ++ } ++ ++ if (!node) ++ return 0; ++ ++ rmem = of_reserved_mem_lookup(node); ++ if (!rmem) { ++ dev_err(qproc->dev, "unable to resolve metadata region\n"); ++ return -EINVAL; ++ } ++ ++ qproc->mdata_phys = rmem->base; ++ qproc->mdata_size = rmem->size; ++ + return 0; + } + +-- +2.35.3 + diff --git a/patches.suse/revert-scsi-qla2xxx-Changes-to-support-FCP2-Target.patch b/patches.suse/revert-scsi-qla2xxx-Changes-to-support-FCP2-Target.patch deleted file mode 100644 index 85577d7..0000000 --- a/patches.suse/revert-scsi-qla2xxx-Changes-to-support-FCP2-Target.patch +++ /dev/null @@ -1,50 +0,0 @@ -From: David Bond -Date: Tue, 31 May 2022 08:53:10 -0600 -Subject: revert scsi: qla2xxx: Changes to support FCP2 Target -Patch-mainline: Never, revert of mainline commit causing customer issue for test package -References: bsc#1198438 - -Revert Adding changes to support FCP2 Target. ---- - ---- - drivers/scsi/qla2xxx/qla_init.c | 8 -------- - drivers/scsi/qla2xxx/qla_os.c | 10 ---------- - 2 files changed, 18 deletions(-) - ---- a/drivers/scsi/qla2xxx/qla_init.c -+++ b/drivers/scsi/qla2xxx/qla_init.c -@@ -1832,14 +1832,6 @@ void qla2x00_handle_rscn(scsi_qla_host_t - case RSCN_PORT_ADDR: - fcport = qla2x00_find_fcport_by_nportid(vha, &ea->id, 1); - if (fcport) { -- if (fcport->flags & FCF_FCP2_DEVICE && -- atomic_read(&fcport->state) == FCS_ONLINE) { -- ql_dbg(ql_dbg_disc, vha, 0x2115, -- "Delaying session delete for FCP2 portid=%06x %8phC ", -- fcport->d_id.b24, fcport->port_name); -- return; -- } -- - if (vha->hw->flags.edif_enabled && DBELL_ACTIVE(vha)) { - /* - * On ipsec start by remote port, Target port ---- a/drivers/scsi/qla2xxx/qla_os.c -+++ b/drivers/scsi/qla2xxx/qla_os.c -@@ -4046,16 +4046,6 @@ qla2x00_mark_all_devices_lost(scsi_qla_h - "Mark all dev lost\n"); - - list_for_each_entry(fcport, &vha->vp_fcports, list) { -- if (fcport->loop_id != FC_NO_LOOP_ID && -- (fcport->flags & FCF_FCP2_DEVICE) && -- fcport->port_type == FCT_TARGET && -- !qla2x00_reset_active(vha)) { -- ql_dbg(ql_dbg_disc, vha, 0x211a, -- "Delaying session delete for FCP2 flags 0x%x port_type = 0x%x port_id=%06x %phC", -- fcport->flags, fcport->port_type, -- fcport->d_id.b24, fcport->port_name); -- continue; -- } - fcport->scan_state = 0; - qlt_schedule_sess_for_deletion(fcport); - } diff --git a/patches.suse/rtc-allow-rtc_read_alarm-without-read_alarm-callback.patch b/patches.suse/rtc-allow-rtc_read_alarm-without-read_alarm-callback.patch new file mode 100644 index 0000000..446db28 --- /dev/null +++ b/patches.suse/rtc-allow-rtc_read_alarm-without-read_alarm-callback.patch @@ -0,0 +1,40 @@ +From a783c962619271a8b905efad1d89adfec11ae0c8 Mon Sep 17 00:00:00 2001 +From: Alexandre Belloni +Date: Tue, 14 Feb 2023 23:27:53 +0100 +Subject: [PATCH] rtc: allow rtc_read_alarm without read_alarm callback +Git-commit: a783c962619271a8b905efad1d89adfec11ae0c8 +Patch-mainline: v6.3-rc1 +References: git-fixes + +.read_alarm is not necessary to read the current alarm because it is +recorded in the aie_timer and so rtc_read_alarm() will never call +rtc_read_alarm_internal() which is the only function calling the callback. + +Reported-by: Zhipeng Wang +Reported-by: Marcel Ziswiler +Fixes: 7ae41220ef58 ("rtc: introduce features bitfield") +Tested-by: Philippe Schenker +Link: https://lore.kernel.org/r/20230214222754.582582-1-alexandre.belloni@bootlin.com +Signed-off-by: Alexandre Belloni +Acked-by: Takashi Iwai + +--- + drivers/rtc/interface.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c +index 7c30cb3c764d..499d89150afc 100644 +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -392,7 +392,7 @@ int rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) + return err; + if (!rtc->ops) { + err = -ENODEV; +- } else if (!test_bit(RTC_FEATURE_ALARM, rtc->features) || !rtc->ops->read_alarm) { ++ } else if (!test_bit(RTC_FEATURE_ALARM, rtc->features)) { + err = -EINVAL; + } else { + memset(alarm, 0, sizeof(struct rtc_wkalrm)); +-- +2.35.3 + diff --git a/patches.suse/rtc-pm8xxx-fix-set-alarm-race.patch b/patches.suse/rtc-pm8xxx-fix-set-alarm-race.patch new file mode 100644 index 0000000..d162276 --- /dev/null +++ b/patches.suse/rtc-pm8xxx-fix-set-alarm-race.patch @@ -0,0 +1,79 @@ +From c88db0eff9722fc2b6c4d172a50471d20e08ecc6 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 2 Feb 2023 16:54:27 +0100 +Subject: [PATCH] rtc: pm8xxx: fix set-alarm race +Git-commit: c88db0eff9722fc2b6c4d172a50471d20e08ecc6 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Make sure to disable the alarm before updating the four alarm time +registers to avoid spurious alarms during the update. + +Note that the disable needs to be done outside of the ctrl_reg_lock +section to prevent a racing alarm interrupt from disabling the newly set +alarm when the lock is released. + +Fixes: 9a9a54ad7aa2 ("drivers/rtc: add support for Qualcomm PMIC8xxx RTC") +Cc: stable@vger.kernel.org # 3.1 +Signed-off-by: Johan Hovold +Reviewed-by: David Collins +Link: https://lore.kernel.org/r/20230202155448.6715-2-johan+linaro@kernel.org +Signed-off-by: Alexandre Belloni +Acked-by: Takashi Iwai + +--- + drivers/rtc/rtc-pm8xxx.c | 24 ++++++++++-------------- + 1 file changed, 10 insertions(+), 14 deletions(-) + +diff --git a/drivers/rtc/rtc-pm8xxx.c b/drivers/rtc/rtc-pm8xxx.c +index 716e5d9ad74d..d114f0da537d 100644 +--- a/drivers/rtc/rtc-pm8xxx.c ++++ b/drivers/rtc/rtc-pm8xxx.c +@@ -221,7 +221,6 @@ static int pm8xxx_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alarm) + { + int rc, i; + u8 value[NUM_8_BIT_RTC_REGS]; +- unsigned int ctrl_reg; + unsigned long secs, irq_flags; + struct pm8xxx_rtc *rtc_dd = dev_get_drvdata(dev); + const struct pm8xxx_rtc_regs *regs = rtc_dd->regs; +@@ -233,6 +232,11 @@ static int pm8xxx_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alarm) + secs >>= 8; + } + ++ rc = regmap_update_bits(rtc_dd->regmap, regs->alarm_ctrl, ++ regs->alarm_en, 0); ++ if (rc) ++ return rc; ++ + spin_lock_irqsave(&rtc_dd->ctrl_reg_lock, irq_flags); + + rc = regmap_bulk_write(rtc_dd->regmap, regs->alarm_rw, value, +@@ -242,19 +246,11 @@ static int pm8xxx_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alarm) + goto rtc_rw_fail; + } + +- rc = regmap_read(rtc_dd->regmap, regs->alarm_ctrl, &ctrl_reg); +- if (rc) +- goto rtc_rw_fail; +- +- if (alarm->enabled) +- ctrl_reg |= regs->alarm_en; +- else +- ctrl_reg &= ~regs->alarm_en; +- +- rc = regmap_write(rtc_dd->regmap, regs->alarm_ctrl, ctrl_reg); +- if (rc) { +- dev_err(dev, "Write to RTC alarm control register failed\n"); +- goto rtc_rw_fail; ++ if (alarm->enabled) { ++ rc = regmap_update_bits(rtc_dd->regmap, regs->alarm_ctrl, ++ regs->alarm_en, regs->alarm_en); ++ if (rc) ++ goto rtc_rw_fail; + } + + dev_dbg(dev, "Alarm Set for h:m:s=%ptRt, y-m-d=%ptRdr\n", +-- +2.35.3 + diff --git a/patches.suse/rtc-sun6i-Always-export-the-internal-oscillator.patch b/patches.suse/rtc-sun6i-Always-export-the-internal-oscillator.patch new file mode 100644 index 0000000..810ce40 --- /dev/null +++ b/patches.suse/rtc-sun6i-Always-export-the-internal-oscillator.patch @@ -0,0 +1,83 @@ +From 344f4030f6c50a9db2d03021884c4bf36191b53a Mon Sep 17 00:00:00 2001 +From: Samuel Holland +Date: Thu, 29 Dec 2022 15:53:19 -0600 +Subject: [PATCH] rtc: sun6i: Always export the internal oscillator +Git-commit: 344f4030f6c50a9db2d03021884c4bf36191b53a +Patch-mainline: v6.3-rc1 +References: git-fixes + +On all variants of the hardware, the internal oscillator is one possible +parent for the AR100 clock. It needs to be exported so we can model that +relationship correctly in the devicetree. + +Fixes: c56afc1844d6 ("rtc: sun6i: Expose internal oscillator through device tree") +Signed-off-by: Samuel Holland +Acked-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20221229215319.14145-1-samuel@sholland.org +Signed-off-by: Alexandre Belloni +Acked-by: Takashi Iwai + +--- + drivers/rtc/rtc-sun6i.c | 16 ++++------------ + 1 file changed, 4 insertions(+), 12 deletions(-) + +diff --git a/drivers/rtc/rtc-sun6i.c b/drivers/rtc/rtc-sun6i.c +index ed5516089e9a..7038f47d77ff 100644 +--- a/drivers/rtc/rtc-sun6i.c ++++ b/drivers/rtc/rtc-sun6i.c +@@ -136,7 +136,6 @@ struct sun6i_rtc_clk_data { + unsigned int fixed_prescaler : 16; + unsigned int has_prescaler : 1; + unsigned int has_out_clk : 1; +- unsigned int export_iosc : 1; + unsigned int has_losc_en : 1; + unsigned int has_auto_swt : 1; + }; +@@ -271,10 +270,8 @@ static void __init sun6i_rtc_clk_init(struct device_node *node, + /* Yes, I know, this is ugly. */ + sun6i_rtc = rtc; + +- /* Only read IOSC name from device tree if it is exported */ +- if (rtc->data->export_iosc) +- of_property_read_string_index(node, "clock-output-names", 2, +- &iosc_name); ++ of_property_read_string_index(node, "clock-output-names", 2, ++ &iosc_name); + + rtc->int_osc = clk_hw_register_fixed_rate_with_accuracy(NULL, + iosc_name, +@@ -315,13 +312,10 @@ static void __init sun6i_rtc_clk_init(struct device_node *node, + goto err_register; + } + +- clk_data->num = 2; ++ clk_data->num = 3; + clk_data->hws[0] = &rtc->hw; + clk_data->hws[1] = __clk_get_hw(rtc->ext_losc); +- if (rtc->data->export_iosc) { +- clk_data->hws[2] = rtc->int_osc; +- clk_data->num = 3; +- } ++ clk_data->hws[2] = rtc->int_osc; + of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + return; + +@@ -361,7 +355,6 @@ static const struct sun6i_rtc_clk_data sun8i_h3_rtc_data = { + .fixed_prescaler = 32, + .has_prescaler = 1, + .has_out_clk = 1, +- .export_iosc = 1, + }; + + static void __init sun8i_h3_rtc_clk_init(struct device_node *node) +@@ -379,7 +372,6 @@ static const struct sun6i_rtc_clk_data sun50i_h6_rtc_data = { + .fixed_prescaler = 32, + .has_prescaler = 1, + .has_out_clk = 1, +- .export_iosc = 1, + .has_losc_en = 1, + .has_auto_swt = 1, + }; +-- +2.35.3 + diff --git a/patches.suse/scsi-qla2xxx-Add-option-to-disable-FC2-Target-suppor.patch b/patches.suse/scsi-qla2xxx-Add-option-to-disable-FC2-Target-suppor.patch new file mode 100644 index 0000000..3e9ec24 --- /dev/null +++ b/patches.suse/scsi-qla2xxx-Add-option-to-disable-FC2-Target-suppor.patch @@ -0,0 +1,72 @@ +From: Daniel Wagner +Date: Wed, 8 Feb 2023 16:20:14 +0100 +Subject: scsi: qla2xxx: Add option to disable FC2 Target support +Patch-mainline: Queued in subsystem maintainer repository +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git +Git-commit: 877b03795fcf29ff2e2351f7e574ecc9b9c51732 +References: bsc#1198438 bsc#1206103 + +Commit 44c57f205876 ("scsi: qla2xxx: Changes to support FCP2 Target") added +support for FC2 Targets. Unfortunately, there are older setups which break +with this new feature enabled. + +Allow to disable it via module option. + +Link: https://lore.kernel.org/r/20230208152014.109214-1-dwagner@suse.de +Signed-off-by: Daniel Wagner +Reviewed-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +--- + drivers/scsi/qla2xxx/qla_gbl.h | 1 + + drivers/scsi/qla2xxx/qla_init.c | 3 ++- + drivers/scsi/qla2xxx/qla_os.c | 10 +++++++++- + 3 files changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_gbl.h ++++ b/drivers/scsi/qla2xxx/qla_gbl.h +@@ -192,6 +192,7 @@ extern int ql2xsecenable; + extern int ql2xenforce_iocb_limit; + extern int ql2xabts_wait_nvme; + extern u32 ql2xnvme_queues; ++extern int ql2xfc2target; + + extern int qla2x00_loop_reset(scsi_qla_host_t *); + extern void qla2x00_abort_all_cmds(scsi_qla_host_t *, int); +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -1840,7 +1840,8 @@ void qla2x00_handle_rscn(scsi_qla_host_t + case RSCN_PORT_ADDR: + fcport = qla2x00_find_fcport_by_nportid(vha, &ea->id, 1); + if (fcport) { +- if (fcport->flags & FCF_FCP2_DEVICE && ++ if (ql2xfc2target && ++ fcport->flags & FCF_FCP2_DEVICE && + atomic_read(&fcport->state) == FCS_ONLINE) { + ql_dbg(ql_dbg_disc, vha, 0x2115, + "Delaying session delete for FCP2 portid=%06x %8phC ", +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -360,6 +360,13 @@ MODULE_PARM_DESC(ql2xnvme_queues, + "1 - Minimum number of queues supported\n" + "8 - Default value"); + ++int ql2xfc2target = 1; ++module_param(ql2xfc2target, int, 0444); ++MODULE_PARM_DESC(qla2xfc2target, ++ "Enables FC2 Target support. " ++ "0 - FC2 Target support is disabled. " ++ "1 - FC2 Target support is enabled (default)."); ++ + static struct scsi_transport_template *qla2xxx_transport_template = NULL; + struct scsi_transport_template *qla2xxx_transport_vport_template = NULL; + +@@ -4085,7 +4092,8 @@ qla2x00_mark_all_devices_lost(scsi_qla_h + "Mark all dev lost\n"); + + list_for_each_entry(fcport, &vha->vp_fcports, list) { +- if (fcport->loop_id != FC_NO_LOOP_ID && ++ if (ql2xfc2target && ++ fcport->loop_id != FC_NO_LOOP_ID && + (fcport->flags & FCF_FCP2_DEVICE) && + fcport->port_type == FCT_TARGET && + !qla2x00_reset_active(vha)) { diff --git a/patches.suse/sefltests-netdevsim-wait-for-devlink-instance-after-.patch b/patches.suse/sefltests-netdevsim-wait-for-devlink-instance-after-.patch new file mode 100644 index 0000000..416d2c1 --- /dev/null +++ b/patches.suse/sefltests-netdevsim-wait-for-devlink-instance-after-.patch @@ -0,0 +1,75 @@ +From f922c7b1c1c45740d329bf248936fdb78c0cff6e Mon Sep 17 00:00:00 2001 +From: Jiri Pirko +Date: Mon, 20 Feb 2023 14:23:36 +0100 +Subject: [PATCH] sefltests: netdevsim: wait for devlink instance after netns removal +Git-commit: f922c7b1c1c45740d329bf248936fdb78c0cff6e +Patch-mainline: v6.3-rc1 +References: git-fixes + +When devlink instance is put into network namespace and that network +namespace gets deleted, devlink instance is moved back into init_ns. +This is done as a part of cleanup_net() routine. Since cleanup_net() +is called asynchronously from workqueue, there is no guarantee that +the devlink instance move is done after "ip netns del" returns. + +So fix this race by making sure that the devlink instance is present +before any other operation. + +Reported-by: Amir Tzin +Fixes: b74c37fd35a2 ("selftests: netdevsim: add tests for devlink reload with resources") +Signed-off-by: Jiri Pirko +Reviewed-by: Pavan Chebbi +Link: https://lore.kernel.org/r/20230220132336.198597-1-jiri@resnulli.us +Signed-off-by: Paolo Abeni +Acked-by: Takashi Iwai + +--- + .../selftests/drivers/net/netdevsim/devlink.sh | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/tools/testing/selftests/drivers/net/netdevsim/devlink.sh b/tools/testing/selftests/drivers/net/netdevsim/devlink.sh +index a08c02abde12..7f7d20f22207 100755 +--- a/tools/testing/selftests/drivers/net/netdevsim/devlink.sh ++++ b/tools/testing/selftests/drivers/net/netdevsim/devlink.sh +@@ -17,6 +17,18 @@ SYSFS_NET_DIR=/sys/bus/netdevsim/devices/$DEV_NAME/net/ + DEBUGFS_DIR=/sys/kernel/debug/netdevsim/$DEV_NAME/ + DL_HANDLE=netdevsim/$DEV_NAME + ++wait_for_devlink() ++{ ++ "$@" | grep -q $DL_HANDLE ++} ++ ++devlink_wait() ++{ ++ local timeout=$1 ++ ++ busywait "$timeout" wait_for_devlink devlink dev ++} ++ + fw_flash_test() + { + RET=0 +@@ -256,6 +268,9 @@ netns_reload_test() + ip netns del testns2 + ip netns del testns1 + ++ # Wait until netns async cleanup is done. ++ devlink_wait 2000 ++ + log_test "netns reload test" + } + +@@ -348,6 +363,9 @@ resource_test() + ip netns del testns2 + ip netns del testns1 + ++ # Wait until netns async cleanup is done. ++ devlink_wait 2000 ++ + log_test "resource test" + } + +-- +2.35.3 + diff --git a/patches.suse/selftest-lkdtm-Skip-stack-entropy-test-if-lkdtm-is-n.patch b/patches.suse/selftest-lkdtm-Skip-stack-entropy-test-if-lkdtm-is-n.patch new file mode 100644 index 0000000..50a917e --- /dev/null +++ b/patches.suse/selftest-lkdtm-Skip-stack-entropy-test-if-lkdtm-is-n.patch @@ -0,0 +1,56 @@ +From 90091c367e74d5b58d9ebe979cc363f7468f58d3 Mon Sep 17 00:00:00 2001 +From: Misono Tomohiro +Date: Thu, 5 Aug 2021 19:12:36 +0900 +Subject: [PATCH] selftest/lkdtm: Skip stack-entropy test if lkdtm is not available +Git-commit: 90091c367e74d5b58d9ebe979cc363f7468f58d3 +Patch-mainline: v5.17-rc1 +References: git-fixes + +Exit with return code 4 if lkdtm is not available like other tests +in order to properly skip the test. + +Signed-off-by: Misono Tomohiro +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20210805101236.1140381-1-misono.tomohiro@jp.fujitsu.com +Acked-by: Takashi Iwai + +--- + tools/testing/selftests/lkdtm/stack-entropy.sh | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/lkdtm/stack-entropy.sh b/tools/testing/selftests/lkdtm/stack-entropy.sh +index 1b4d95d575f8..14fedeef762e 100755 +--- a/tools/testing/selftests/lkdtm/stack-entropy.sh ++++ b/tools/testing/selftests/lkdtm/stack-entropy.sh +@@ -4,13 +4,27 @@ + # Measure kernel stack entropy by sampling via LKDTM's REPORT_STACK test. + set -e + samples="${1:-1000}" ++TRIGGER=/sys/kernel/debug/provoke-crash/DIRECT ++KSELFTEST_SKIP_TEST=4 ++ ++# Verify we have LKDTM available in the kernel. ++if [ ! -r $TRIGGER ] ; then ++ /sbin/modprobe -q lkdtm || true ++ if [ ! -r $TRIGGER ] ; then ++ echo "Cannot find $TRIGGER (missing CONFIG_LKDTM?)" ++ else ++ echo "Cannot write $TRIGGER (need to run as root?)" ++ fi ++ # Skip this test ++ exit $KSELFTEST_SKIP_TEST ++fi + + # Capture dmesg continuously since it may fill up depending on sample size. + log=$(mktemp -t stack-entropy-XXXXXX) + dmesg --follow >"$log" & pid=$! + report=-1 + for i in $(seq 1 $samples); do +- echo "REPORT_STACK" >/sys/kernel/debug/provoke-crash/DIRECT ++ echo "REPORT_STACK" > $TRIGGER + if [ -t 1 ]; then + percent=$(( 100 * $i / $samples )) + if [ "$percent" -ne "$report" ]; then +-- +2.35.3 + diff --git a/patches.suse/selftests-ftrace-Add-check-for-ping-command-for-trig.patch b/patches.suse/selftests-ftrace-Add-check-for-ping-command-for-trig.patch new file mode 100644 index 0000000..7ce13a4 --- /dev/null +++ b/patches.suse/selftests-ftrace-Add-check-for-ping-command-for-trig.patch @@ -0,0 +1,177 @@ +From 4aa4d4def2993ea1a0481e080de11b26bc1ac6c7 Mon Sep 17 00:00:00 2001 +From: "Naveen N. Rao" +Date: Fri, 28 Oct 2022 12:46:09 +0530 +Subject: [PATCH] selftests/ftrace: Add check for ping command for trigger + tests + +References: bsc#1204993 ltc#200103 +Patch-mainline: v6.2-rc1 +Git-commit: 4aa4d4def2993ea1a0481e080de11b26bc1ac6c7 + +All these tests depend on the ping command and will fail if it is not +found. Allow tests to specify dependencies on programs through the +'requires' field. Add dependency on 'ping' for some of the trigger +tests. + +Link: https://lore.kernel.org/all/20221017104312.16af5467@gandalf.local.home/ +Reported-by: Akanksha J N +Acked-by: Masami Hiramatsu (Google) +Suggested-by: Steven Rostedt (Google) +Reviewed-by: Steven Rostedt (Google) +Signed-off-by: Naveen N. Rao +Signed-off-by: Shuah Khan +Acked-by: Michal Suchanek +--- + tools/testing/selftests/ftrace/test.d/functions | 8 +++++++- + .../trigger/inter-event/trigger-field-variable-support.tc | 2 +- + .../inter-event/trigger-inter-event-combined-hist.tc | 2 +- + .../trigger/inter-event/trigger-onchange-action-hist.tc | 2 +- + .../trigger/inter-event/trigger-onmatch-action-hist.tc | 2 +- + .../inter-event/trigger-onmatch-onmax-action-hist.tc | 2 +- + .../trigger/inter-event/trigger-onmax-action-hist.tc | 2 +- + .../trigger/inter-event/trigger-snapshot-action-hist.tc | 2 +- + .../inter-event/trigger-synthetic-event-dynstring.tc | 2 +- + .../trigger/inter-event/trigger-trace-action-hist.tc | 2 +- + 10 files changed, 16 insertions(+), 10 deletions(-) + +diff --git a/tools/testing/selftests/ftrace/test.d/functions b/tools/testing/selftests/ftrace/test.d/functions +index 5f6cbec847fc..779f3e62ec90 100644 +--- a/tools/testing/selftests/ftrace/test.d/functions ++++ b/tools/testing/selftests/ftrace/test.d/functions +@@ -142,9 +142,15 @@ finish_ftrace() { + + check_requires() { # Check required files and tracers + for i in "$@" ; do ++ p=${i%:program} + r=${i%:README} + t=${i%:tracer} +- if [ $t != $i ]; then ++ if [ $p != $i ]; then ++ if ! which $p ; then ++ echo "Required program $p is not found." ++ exit_unresolved ++ fi ++ elif [ $t != $i ]; then + if ! grep -wq $t available_tracers ; then + echo "Required tracer $t is not configured." + exit_unsupported +diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-field-variable-support.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-field-variable-support.tc +index 41119e0440e9..04c5dd7d0acc 100644 +--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-field-variable-support.tc ++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-field-variable-support.tc +@@ -1,7 +1,7 @@ + #!/bin/sh + # SPDX-License-Identifier: GPL-2.0 + # description: event trigger - test field variable support +-# requires: set_event synthetic_events events/sched/sched_process_fork/hist ++# requires: set_event synthetic_events events/sched/sched_process_fork/hist ping:program + + fail() { #msg + echo $1 +diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-inter-event-combined-hist.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-inter-event-combined-hist.tc +index 9098f1e7433f..f7447d800899 100644 +--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-inter-event-combined-hist.tc ++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-inter-event-combined-hist.tc +@@ -1,7 +1,7 @@ + #!/bin/sh + # SPDX-License-Identifier: GPL-2.0 + # description: event trigger - test inter-event combined histogram trigger +-# requires: set_event synthetic_events events/sched/sched_process_fork/hist ++# requires: set_event synthetic_events events/sched/sched_process_fork/hist ping:program + + fail() { #msg + echo $1 +diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onchange-action-hist.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onchange-action-hist.tc +index adaabb873ed4..91339c130832 100644 +--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onchange-action-hist.tc ++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onchange-action-hist.tc +@@ -1,7 +1,7 @@ + #!/bin/sh + # SPDX-License-Identifier: GPL-2.0 + # description: event trigger - test inter-event histogram trigger onchange action +-# requires: set_event "onchange(var)":README ++# requires: set_event "onchange(var)":README ping:program + + fail() { #msg + echo $1 +diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onmatch-action-hist.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onmatch-action-hist.tc +index 20e39471052e..d645abcf11c4 100644 +--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onmatch-action-hist.tc ++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onmatch-action-hist.tc +@@ -1,7 +1,7 @@ + #!/bin/sh + # SPDX-License-Identifier: GPL-2.0 + # description: event trigger - test inter-event histogram trigger onmatch action +-# requires: set_event synthetic_events events/sched/sched_process_fork/hist ++# requires: set_event synthetic_events events/sched/sched_process_fork/hist ping:program + + fail() { #msg + echo $1 +diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onmatch-onmax-action-hist.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onmatch-onmax-action-hist.tc +index f4b03ab7c287..c369247efb35 100644 +--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onmatch-onmax-action-hist.tc ++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onmatch-onmax-action-hist.tc +@@ -1,7 +1,7 @@ + #!/bin/sh + # SPDX-License-Identifier: GPL-2.0 + # description: event trigger - test inter-event histogram trigger onmatch-onmax action +-# requires: set_event synthetic_events events/sched/sched_process_fork/hist ++# requires: set_event synthetic_events events/sched/sched_process_fork/hist ping:program + + fail() { #msg + echo $1 +diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onmax-action-hist.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onmax-action-hist.tc +index 71c9b5911c70..e28dc5f11b2b 100644 +--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onmax-action-hist.tc ++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onmax-action-hist.tc +@@ -1,7 +1,7 @@ + #!/bin/sh + # SPDX-License-Identifier: GPL-2.0 + # description: event trigger - test inter-event histogram trigger onmax action +-# requires: set_event synthetic_events events/sched/sched_process_fork/hist ++# requires: set_event synthetic_events events/sched/sched_process_fork/hist ping:program + + fail() { #msg + echo $1 +diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-snapshot-action-hist.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-snapshot-action-hist.tc +index 67fa328b830f..147967e86584 100644 +--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-snapshot-action-hist.tc ++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-snapshot-action-hist.tc +@@ -1,7 +1,7 @@ + #!/bin/sh + # SPDX-License-Identifier: GPL-2.0 + # description: event trigger - test inter-event histogram trigger snapshot action +-# requires: set_event snapshot events/sched/sched_process_fork/hist "onchange(var)":README "snapshot()":README ++# requires: set_event snapshot events/sched/sched_process_fork/hist "onchange(var)":README "snapshot()":README ping:program + + fail() { #msg + echo $1 +diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-dynstring.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-dynstring.tc +index 3d65c856eca3..213d890ed188 100644 +--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-dynstring.tc ++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-dynstring.tc +@@ -1,7 +1,7 @@ + #!/bin/sh + # SPDX-License-Identifier: GPL-2.0 + # description: event trigger - test inter-event histogram trigger trace action with dynamic string param +-# requires: set_event synthetic_events events/sched/sched_process_exec/hist "char name[]' >> synthetic_events":README ++# requires: set_event synthetic_events events/sched/sched_process_exec/hist "char name[]' >> synthetic_events":README ping:program + + fail() { #msg + echo $1 +diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-trace-action-hist.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-trace-action-hist.tc +index c126d2350a6d..d7312047ce28 100644 +--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-trace-action-hist.tc ++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-trace-action-hist.tc +@@ -1,7 +1,7 @@ + #!/bin/sh + # SPDX-License-Identifier: GPL-2.0 + # description: event trigger - test inter-event histogram trigger trace action +-# requires: set_event synthetic_events events/sched/sched_process_fork/hist "trace(":README ++# requires: set_event synthetic_events events/sched/sched_process_fork/hist "trace(":README ping:program + + fail() { #msg + echo $1 +-- +2.39.2 + diff --git a/patches.suse/selftests-ftrace-Convert-tracer-tests-to-use-require.patch b/patches.suse/selftests-ftrace-Convert-tracer-tests-to-use-require.patch new file mode 100644 index 0000000..15fdab0 --- /dev/null +++ b/patches.suse/selftests-ftrace-Convert-tracer-tests-to-use-require.patch @@ -0,0 +1,62 @@ +From 94fea664ae4eea69e90abb4bd01997b9c54cd013 Mon Sep 17 00:00:00 2001 +From: "Naveen N. Rao" +Date: Fri, 28 Oct 2022 12:46:10 +0530 +Subject: [PATCH] selftests/ftrace: Convert tracer tests to use 'requires' to + specify program dependency + +References: bsc#1204993 ltc#200103 +Patch-mainline: v6.2-rc1 +Git-commit: 94fea664ae4eea69e90abb4bd01997b9c54cd013 + +Now that we have a good way to specify dependency of tests on programs, +convert some of the tracer tests to use this method for specifying +dependency on 'chrt'. + +Reviewed-by: Steven Rostedt (Google) +Signed-off-by: Naveen N. Rao +Signed-off-by: Shuah Khan +Acked-by: Michal Suchanek +--- + tools/testing/selftests/ftrace/test.d/tracer/wakeup.tc | 7 +------ + tools/testing/selftests/ftrace/test.d/tracer/wakeup_rt.tc | 7 +------ + 2 files changed, 2 insertions(+), 12 deletions(-) + +diff --git a/tools/testing/selftests/ftrace/test.d/tracer/wakeup.tc b/tools/testing/selftests/ftrace/test.d/tracer/wakeup.tc +index 11be10e1bf96..e8f0fac9a110 100644 +--- a/tools/testing/selftests/ftrace/test.d/tracer/wakeup.tc ++++ b/tools/testing/selftests/ftrace/test.d/tracer/wakeup.tc +@@ -1,12 +1,7 @@ + #!/bin/sh + # SPDX-License-Identifier: GPL-2.0 + # description: Test wakeup tracer +-# requires: wakeup:tracer +- +-if ! which chrt ; then +- echo "chrt is not found. This test requires nice command." +- exit_unresolved +-fi ++# requires: wakeup:tracer chrt:program + + echo wakeup > current_tracer + echo 1 > tracing_on +diff --git a/tools/testing/selftests/ftrace/test.d/tracer/wakeup_rt.tc b/tools/testing/selftests/ftrace/test.d/tracer/wakeup_rt.tc +index 3a77198b3c69..79807656785b 100644 +--- a/tools/testing/selftests/ftrace/test.d/tracer/wakeup_rt.tc ++++ b/tools/testing/selftests/ftrace/test.d/tracer/wakeup_rt.tc +@@ -1,12 +1,7 @@ + #!/bin/sh + # SPDX-License-Identifier: GPL-2.0 + # description: Test wakeup RT tracer +-# requires: wakeup_rt:tracer +- +-if ! which chrt ; then +- echo "chrt is not found. This test requires chrt command." +- exit_unresolved +-fi ++# requires: wakeup_rt:tracer chrt:program + + echo wakeup_rt > current_tracer + echo 1 > tracing_on +-- +2.39.2 + diff --git a/patches.suse/selftests-powerpc-Account-for-offline-cpus-in-perf-hwbreak-test.patch b/patches.suse/selftests-powerpc-Account-for-offline-cpus-in-perf-hwbreak-test.patch new file mode 100644 index 0000000..5a2c414 --- /dev/null +++ b/patches.suse/selftests-powerpc-Account-for-offline-cpus-in-perf-hwbreak-test.patch @@ -0,0 +1,98 @@ +From: "Naveen N. Rao" +Date: Tue, 22 Nov 2022 12:10:54 +0530 +Subject: selftests/powerpc: Account for offline cpus in perf-hwbreak test +Git-commit: 260095926d3956071c6699a28824c3f0fa7cd97a +Patch-mainline: v6.2-rc1 +References: bsc#1206232 + +For systemwide tests, use online cpu mask to only open events on online +cpus. This enables this test to work on systems in lower SMT modes. + +Signed-off-by: Naveen N. Rao +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/15fd447dcefd19945a7d31f0a475349f548a3603.1669096083.git.naveen.n.rao@linux.vnet.ibm.com + +Signed-off-by: Tony Jones +--- + .../selftests/powerpc/ptrace/perf-hwbreak.c | 45 +++++++++++++++++++--- + 1 file changed, 39 insertions(+), 6 deletions(-) + +diff --git a/tools/testing/selftests/powerpc/ptrace/perf-hwbreak.c b/tools/testing/selftests/powerpc/ptrace/perf-hwbreak.c +index 866e5be48ee3..f75739bbad28 100644 +--- a/tools/testing/selftests/powerpc/ptrace/perf-hwbreak.c ++++ b/tools/testing/selftests/powerpc/ptrace/perf-hwbreak.c +@@ -17,8 +17,11 @@ + * Copyright (C) 2018 Michael Neuling, IBM Corporation. + */ + ++#define _GNU_SOURCE ++ + #include + #include ++#include + #include + #include + #include +@@ -141,8 +144,10 @@ static void disable_fds(int *fd, int n) + + static int perf_systemwide_event_open(int *fd, __u32 type, __u64 addr, __u64 len) + { ++ int i, ncpus, cpu, ret = 0; + struct rlimit rlim; +- int i = 0; ++ cpu_set_t *mask; ++ size_t size; + + if (getrlimit(RLIMIT_NOFILE, &rlim)) { + perror("getrlimit"); +@@ -154,16 +159,44 @@ static int perf_systemwide_event_open(int *fd, __u32 type, __u64 addr, __u64 len + return -1; + } + +- /* Assume online processors are 0 to nprocs for simplisity */ +- for (i = 0; i < nprocs; i++) { +- fd[i] = perf_cpu_event_open(i, type, addr, len); ++ ncpus = get_nprocs_conf(); ++ size = CPU_ALLOC_SIZE(ncpus); ++ mask = CPU_ALLOC(ncpus); ++ if (!mask) { ++ perror("malloc"); ++ return -1; ++ } ++ ++ CPU_ZERO_S(size, mask); ++ ++ if (sched_getaffinity(0, size, mask)) { ++ perror("sched_getaffinity"); ++ ret = -1; ++ goto done; ++ } ++ ++ for (i = 0, cpu = 0; i < nprocs && cpu < ncpus; cpu++) { ++ if (!CPU_ISSET_S(cpu, size, mask)) ++ continue; ++ fd[i] = perf_cpu_event_open(cpu, type, addr, len); + if (fd[i] < 0) { + perror("perf_systemwide_event_open"); + close_fds(fd, i); +- return fd[i]; ++ ret = fd[i]; ++ goto done; + } ++ i++; + } +- return 0; ++ ++ if (i < nprocs) { ++ printf("Error: Number of online cpus reduced since start of test: %d < %d\n", i, nprocs); ++ close_fds(fd, i); ++ ret = -1; ++ } ++ ++done: ++ CPU_FREE(mask); ++ return ret; + } + + static inline bool breakpoint_test(int len) + diff --git a/patches.suse/selftests-powerpc-Bump-up-rlimit-for-perf-hwbreak-test.patch b/patches.suse/selftests-powerpc-Bump-up-rlimit-for-perf-hwbreak-test.patch new file mode 100644 index 0000000..41f3a8e --- /dev/null +++ b/patches.suse/selftests-powerpc-Bump-up-rlimit-for-perf-hwbreak-test.patch @@ -0,0 +1,55 @@ +From: "Naveen N. Rao" +Date: Tue, 22 Nov 2022 12:10:53 +0530 +Subject: selftests/powerpc: Bump up rlimit for perf-hwbreak test +Git-commit: 616ad3f4aac287c48b66c92cb777395b4465ed4f +Patch-mainline: v6.2-rc1 +References: bsc#1206232 + +The systemwide perf hardware breakpoint test tries to open a perf event +on each cpu. On large systems, we run out of file descriptors and fail +the test. Instead, have the test set the file descriptor limit to an +arbitraty high value. + +Reported-by: Rohan Deshpande +Signed-off-by: Naveen N. Rao +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/187fed5843cecc1e5066677b6296ee88337d7bef.1669096083.git.naveen.n.rao@linux.vnet.ibm.com + +Signed-off-by: Tony Jones +--- + tools/testing/selftests/powerpc/ptrace/perf-hwbreak.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/tools/testing/selftests/powerpc/ptrace/perf-hwbreak.c b/tools/testing/selftests/powerpc/ptrace/perf-hwbreak.c +index ea5e14ecbf30..866e5be48ee3 100644 +--- a/tools/testing/selftests/powerpc/ptrace/perf-hwbreak.c ++++ b/tools/testing/selftests/powerpc/ptrace/perf-hwbreak.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -140,8 +141,19 @@ static void disable_fds(int *fd, int n) + + static int perf_systemwide_event_open(int *fd, __u32 type, __u64 addr, __u64 len) + { ++ struct rlimit rlim; + int i = 0; + ++ if (getrlimit(RLIMIT_NOFILE, &rlim)) { ++ perror("getrlimit"); ++ return -1; ++ } ++ rlim.rlim_cur = 65536; ++ if (setrlimit(RLIMIT_NOFILE, &rlim)) { ++ perror("setrlimit"); ++ return -1; ++ } ++ + /* Assume online processors are 0 to nprocs for simplisity */ + for (i = 0; i < nprocs; i++) { + fd[i] = perf_cpu_event_open(i, type, addr, len); + diff --git a/patches.suse/selftests-powerpc-Move-perror-closer-to-its-use.patch b/patches.suse/selftests-powerpc-Move-perror-closer-to-its-use.patch new file mode 100644 index 0000000..04e8d91 --- /dev/null +++ b/patches.suse/selftests-powerpc-Move-perror-closer-to-its-use.patch @@ -0,0 +1,101 @@ +From: "Naveen N. Rao" +Date: Tue, 22 Nov 2022 12:10:52 +0530 +Subject: selftests/powerpc: Move perror closer to its use +Git-commit: 71ae6305ad41cfd1ac5aa91d356e71c7a537df2e +Patch-mainline: v6.2-rc1 +References: bsc#1206232 + +Right now, if perf_event_open() fails for the systemwide tests, error +report is printed too late, sometimes after subsequent system calls. +Move use of perror() to the main function, just after the syscall. + +Signed-off-by: Naveen N. Rao +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/372ac78c27899f1f612fbd6ac796604a4a9310aa.1669096083.git.naveen.n.rao@linux.vnet.ibm.com + +Signed-off-by: Tony Jones +--- + .../testing/selftests/powerpc/ptrace/perf-hwbreak.c | 21 +++++---------------- + 1 file changed, 5 insertions(+), 16 deletions(-) + +diff --git a/tools/testing/selftests/powerpc/ptrace/perf-hwbreak.c b/tools/testing/selftests/powerpc/ptrace/perf-hwbreak.c +index ecde2c199f3b..ea5e14ecbf30 100644 +--- a/tools/testing/selftests/powerpc/ptrace/perf-hwbreak.c ++++ b/tools/testing/selftests/powerpc/ptrace/perf-hwbreak.c +@@ -146,6 +146,7 @@ static int perf_systemwide_event_open(int *fd, __u32 type, __u64 addr, __u64 len + for (i = 0; i < nprocs; i++) { + fd[i] = perf_cpu_event_open(i, type, addr, len); + if (fd[i] < 0) { ++ perror("perf_systemwide_event_open"); + close_fds(fd, i); + return fd[i]; + } +@@ -543,15 +544,12 @@ static int test_syswide_multi_diff_addr(void) + int ret; + + ret = perf_systemwide_event_open(fd1, HW_BREAKPOINT_RW, (__u64)&a, (__u64)sizeof(a)); +- if (ret) { +- perror("perf_systemwide_event_open"); ++ if (ret) + exit(EXIT_FAILURE); +- } + + ret = perf_systemwide_event_open(fd2, HW_BREAKPOINT_RW, (__u64)&b, (__u64)sizeof(b)); + if (ret) { + close_fds(fd1, nprocs); +- perror("perf_systemwide_event_open"); + exit(EXIT_FAILURE); + } + +@@ -590,15 +588,12 @@ static int test_syswide_multi_same_addr(void) + int ret; + + ret = perf_systemwide_event_open(fd1, HW_BREAKPOINT_RW, (__u64)&a, (__u64)sizeof(a)); +- if (ret) { +- perror("perf_systemwide_event_open"); ++ if (ret) + exit(EXIT_FAILURE); +- } + + ret = perf_systemwide_event_open(fd2, HW_BREAKPOINT_RW, (__u64)&a, (__u64)sizeof(a)); + if (ret) { + close_fds(fd1, nprocs); +- perror("perf_systemwide_event_open"); + exit(EXIT_FAILURE); + } + +@@ -637,15 +632,12 @@ static int test_syswide_multi_diff_addr_ro_wo(void) + int ret; + + ret = perf_systemwide_event_open(fd1, HW_BREAKPOINT_W, (__u64)&a, (__u64)sizeof(a)); +- if (ret) { +- perror("perf_systemwide_event_open"); ++ if (ret) + exit(EXIT_FAILURE); +- } + + ret = perf_systemwide_event_open(fd2, HW_BREAKPOINT_R, (__u64)&b, (__u64)sizeof(b)); + if (ret) { + close_fds(fd1, nprocs); +- perror("perf_systemwide_event_open"); + exit(EXIT_FAILURE); + } + +@@ -684,15 +676,12 @@ static int test_syswide_multi_same_addr_ro_wo(void) + int ret; + + ret = perf_systemwide_event_open(fd1, HW_BREAKPOINT_W, (__u64)&a, (__u64)sizeof(a)); +- if (ret) { +- perror("perf_systemwide_event_open"); ++ if (ret) + exit(EXIT_FAILURE); +- } + + ret = perf_systemwide_event_open(fd2, HW_BREAKPOINT_R, (__u64)&a, (__u64)sizeof(a)); + if (ret) { + close_fds(fd1, nprocs); +- perror("perf_systemwide_event_open"); + exit(EXIT_FAILURE); + } + + diff --git a/patches.suse/serial-fsl_lpuart-fix-RS485-RTS-polariy-inverse-issu.patch b/patches.suse/serial-fsl_lpuart-fix-RS485-RTS-polariy-inverse-issu.patch new file mode 100644 index 0000000..f1956c4 --- /dev/null +++ b/patches.suse/serial-fsl_lpuart-fix-RS485-RTS-polariy-inverse-issu.patch @@ -0,0 +1,40 @@ +From 3957b9501a5a8fa709ae4a47483714491471f6db Mon Sep 17 00:00:00 2001 +From: Shenwei Wang +Date: Tue, 7 Feb 2023 10:24:20 -0600 +Subject: [PATCH] serial: fsl_lpuart: fix RS485 RTS polariy inverse issue +Git-commit: 3957b9501a5a8fa709ae4a47483714491471f6db +Patch-mainline: v6.3-rc1 +References: git-fixes + +The previous 'commit 846651eca073 ("serial: fsl_lpuart: RS485 RTS +polariy is inverse")' only fixed the inverse issue on lpuart 8bit +platforms. + +This is a follow-up patch to fix the RS485 polarity inverse +issue on lpuart 32bit platforms. + +Fixes: 03895cf41d18 ("tty: serial: fsl_lpuart: Add support for RS-485") +Reported-by: Sherry Sun +Signed-off-by: Shenwei Wang +Link: https://lore.kernel.org/r/20230207162420.3647904-1-shenwei.wang@nxp.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/serial/fsl_lpuart.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1406,9 +1406,9 @@ static int lpuart32_config_rs485(struct + * Note: UART is assumed to be active high. + */ + if (rs485->flags & SER_RS485_RTS_ON_SEND) +- modem &= ~UARTMODEM_TXRTSPOL; +- else if (rs485->flags & SER_RS485_RTS_AFTER_SEND) + modem |= UARTMODEM_TXRTSPOL; ++ else if (rs485->flags & SER_RS485_RTS_AFTER_SEND) ++ modem &= ~UARTMODEM_TXRTSPOL; + } + + /* Store the new configuration */ diff --git a/patches.suse/serial-tegra-Add-missing-clk_disable_unprepare-in-te.patch b/patches.suse/serial-tegra-Add-missing-clk_disable_unprepare-in-te.patch new file mode 100644 index 0000000..08a6015 --- /dev/null +++ b/patches.suse/serial-tegra-Add-missing-clk_disable_unprepare-in-te.patch @@ -0,0 +1,62 @@ +From 38f28cfe9d08e3a47ef008798b275fef8118fc20 Mon Sep 17 00:00:00 2001 +From: Yi Yang +Date: Sat, 26 Nov 2022 10:08:52 +0800 +Subject: [PATCH] serial: tegra: Add missing clk_disable_unprepare() in tegra_uart_hw_init() +Git-commit: 38f28cfe9d08e3a47ef008798b275fef8118fc20 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Add the missing clk_disable_unprepare() before return from +tegra_uart_hw_init() in the error handling path. +When request_irq() fails in tegra_uart_startup(), 'tup->uart_clk' +has been enabled, fix it by adding clk_disable_unprepare(). + +Fixes: cc9ca4d95846 ("serial: tegra: Only print FIFO error message when an error occurs") +Fixes: d781ec21bae6 ("serial: tegra: report clk rate errors") +Signed-off-by: Yi Yang +Link: https://lore.kernel.org/r/20221126020852.113378-1-yiyang13@huawei.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/serial/serial-tegra.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c +index e5b9773db5e3..1cf08b33456c 100644 +--- a/drivers/tty/serial/serial-tegra.c ++++ b/drivers/tty/serial/serial-tegra.c +@@ -1046,6 +1046,7 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup) + if (tup->cdata->fifo_mode_enable_status) { + ret = tegra_uart_wait_fifo_mode_enabled(tup); + if (ret < 0) { ++ clk_disable_unprepare(tup->uart_clk); + dev_err(tup->uport.dev, + "Failed to enable FIFO mode: %d\n", ret); + return ret; +@@ -1067,6 +1068,7 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup) + */ + ret = tegra_set_baudrate(tup, TEGRA_UART_DEFAULT_BAUD); + if (ret < 0) { ++ clk_disable_unprepare(tup->uart_clk); + dev_err(tup->uport.dev, "Failed to set baud rate\n"); + return ret; + } +@@ -1226,10 +1228,13 @@ static int tegra_uart_startup(struct uart_port *u) + dev_name(u->dev), tup); + if (ret < 0) { + dev_err(u->dev, "Failed to register ISR for IRQ %d\n", u->irq); +- goto fail_hw_init; ++ goto fail_request_irq; + } + return 0; + ++fail_request_irq: ++ /* tup->uart_clk is already enabled in tegra_uart_hw_init */ ++ clk_disable_unprepare(tup->uart_clk); + fail_hw_init: + if (!tup->use_rx_pio) + tegra_uart_dma_channel_free(tup, true); +-- +2.35.3 + diff --git a/patches.suse/smb3-Replace-smb2pdu-1-element-arrays-with-flex-arrays.patch b/patches.suse/smb3-Replace-smb2pdu-1-element-arrays-with-flex-arrays.patch new file mode 100644 index 0000000..f10feab --- /dev/null +++ b/patches.suse/smb3-Replace-smb2pdu-1-element-arrays-with-flex-arrays.patch @@ -0,0 +1,397 @@ +From: Kees Cook +Date: Fri, 17 Feb 2023 16:24:40 -0800 +Subject: [PATCH] smb3: Replace smb2pdu 1-element arrays with flex-arrays +Git-commit: eb3e28c1e89b4984308777231887e41aa8a0151f +References: bsc#1193629 +Patch-mainline: v6.3-rc1 + +The kernel is globally removing the ambiguous 0-length and 1-element +arrays in favor of flexible arrays, so that we can gain both compile-time +and run-time array bounds checking[1]. + +Replace the trailing 1-element array with a flexible array in the +following structures: + + struct smb2_err_rsp + struct smb2_tree_connect_req + struct smb2_negotiate_rsp + struct smb2_sess_setup_req + struct smb2_sess_setup_rsp + struct smb2_read_req + struct smb2_read_rsp + struct smb2_write_req + struct smb2_write_rsp + struct smb2_query_directory_req + struct smb2_query_directory_rsp + struct smb2_set_info_req + struct smb2_change_notify_rsp + struct smb2_create_rsp + struct smb2_query_info_req + struct smb2_query_info_rsp + +Replace the trailing 1-element array with a flexible array, but leave +the existing structure padding: + + struct smb2_file_all_info + struct smb2_lock_req + +Adjust all related size calculations to match the changes to sizeof(). + +No machine code output or .data section differences are produced after +these changes. + +[1] For lots of details, see both: + https://docs.kernel.org/process/deprecated.html#zero-length-and-one-element-arrays + https://people.kernel.org/kees/bounded-flexible-arrays-in-c + +Cc: Steve French +Cc: Paulo Alcantara +Cc: Ronnie Sahlberg +Cc: Shyam Prasad N +Cc: Tom Talpey +Cc: Namjae Jeon +Cc: Sergey Senozhatsky +Cc: linux-cifs@vger.kernel.org +Cc: samba-technical@lists.samba.org +Reviewed-by: Namjae Jeon +Signed-off-by: Kees Cook +Signed-off-by: Steve French +Acked-by: Paulo Alcantara +--- + fs/cifs/smb2file.c | 2 +- + fs/cifs/smb2misc.c | 2 +- + fs/cifs/smb2ops.c | 14 +++++++------- + fs/cifs/smb2pdu.c | 16 +++++++--------- + fs/cifs/smb2pdu.h | 2 +- + fs/smbfs_common/smb2pdu.h | 42 ++++++++++++++++++++++++------------------ + 6 files changed, 41 insertions(+), 37 deletions(-) + +--- a/fs/cifs/smb2file.c ++++ b/fs/cifs/smb2file.c +@@ -34,7 +34,7 @@ static struct smb2_symlink_err_rsp *syml + len = (u32)err->ErrorContextCount * (offsetof(struct smb2_error_context_rsp, + ErrorContextData) + + sizeof(struct smb2_symlink_err_rsp)); +- if (le32_to_cpu(err->ByteCount) < len || iov->iov_len < len + sizeof(*err)) ++ if (le32_to_cpu(err->ByteCount) < len || iov->iov_len < len + sizeof(*err) + 1) + return ERR_PTR(-EINVAL); + + p = (struct smb2_error_context_rsp *)err->ErrorData; +--- a/fs/cifs/smb2misc.c ++++ b/fs/cifs/smb2misc.c +@@ -113,7 +113,7 @@ static __u32 get_neg_ctxt_len(struct smb + } else if (nc_offset + 1 == non_ctxlen) { + cifs_dbg(FYI, "no SPNEGO security blob in negprot rsp\n"); + size_of_pad_before_neg_ctxts = 0; +- } else if (non_ctxlen == SMB311_NEGPROT_BASE_SIZE) ++ } else if (non_ctxlen == SMB311_NEGPROT_BASE_SIZE + 1) + /* has padding, but no SPNEGO blob */ + size_of_pad_before_neg_ctxts = nc_offset - non_ctxlen + 1; + else +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -5644,7 +5644,7 @@ struct smb_version_values smb20_values = + .header_size = sizeof(struct smb2_hdr), + .header_preamble_size = 0, + .max_header_size = MAX_SMB2_HDR_SIZE, +- .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, ++ .read_rsp_size = sizeof(struct smb2_read_rsp), + .lock_cmd = SMB2_LOCK, + .cap_unix = 0, + .cap_nt_find = SMB2_NT_FIND, +@@ -5666,7 +5666,7 @@ struct smb_version_values smb21_values = + .header_size = sizeof(struct smb2_hdr), + .header_preamble_size = 0, + .max_header_size = MAX_SMB2_HDR_SIZE, +- .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, ++ .read_rsp_size = sizeof(struct smb2_read_rsp), + .lock_cmd = SMB2_LOCK, + .cap_unix = 0, + .cap_nt_find = SMB2_NT_FIND, +@@ -5687,7 +5687,7 @@ struct smb_version_values smb3any_values + .header_size = sizeof(struct smb2_hdr), + .header_preamble_size = 0, + .max_header_size = MAX_SMB2_HDR_SIZE, +- .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, ++ .read_rsp_size = sizeof(struct smb2_read_rsp), + .lock_cmd = SMB2_LOCK, + .cap_unix = 0, + .cap_nt_find = SMB2_NT_FIND, +@@ -5708,7 +5708,7 @@ struct smb_version_values smbdefault_val + .header_size = sizeof(struct smb2_hdr), + .header_preamble_size = 0, + .max_header_size = MAX_SMB2_HDR_SIZE, +- .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, ++ .read_rsp_size = sizeof(struct smb2_read_rsp), + .lock_cmd = SMB2_LOCK, + .cap_unix = 0, + .cap_nt_find = SMB2_NT_FIND, +@@ -5729,7 +5729,7 @@ struct smb_version_values smb30_values = + .header_size = sizeof(struct smb2_hdr), + .header_preamble_size = 0, + .max_header_size = MAX_SMB2_HDR_SIZE, +- .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, ++ .read_rsp_size = sizeof(struct smb2_read_rsp), + .lock_cmd = SMB2_LOCK, + .cap_unix = 0, + .cap_nt_find = SMB2_NT_FIND, +@@ -5750,7 +5750,7 @@ struct smb_version_values smb302_values + .header_size = sizeof(struct smb2_hdr), + .header_preamble_size = 0, + .max_header_size = MAX_SMB2_HDR_SIZE, +- .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, ++ .read_rsp_size = sizeof(struct smb2_read_rsp), + .lock_cmd = SMB2_LOCK, + .cap_unix = 0, + .cap_nt_find = SMB2_NT_FIND, +@@ -5771,7 +5771,7 @@ struct smb_version_values smb311_values + .header_size = sizeof(struct smb2_hdr), + .header_preamble_size = 0, + .max_header_size = MAX_SMB2_HDR_SIZE, +- .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, ++ .read_rsp_size = sizeof(struct smb2_read_rsp), + .lock_cmd = SMB2_LOCK, + .cap_unix = 0, + .cap_nt_find = SMB2_NT_FIND, +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -1373,7 +1373,7 @@ SMB2_sess_sendreceive(struct SMB2_sess_d + + /* Testing shows that buffer offset must be at location of Buffer[0] */ + req->SecurityBufferOffset = +- cpu_to_le16(sizeof(struct smb2_sess_setup_req) - 1 /* pad */); ++ cpu_to_le16(sizeof(struct smb2_sess_setup_req)); + req->SecurityBufferLength = cpu_to_le16(sess_data->iov[1].iov_len); + + memset(&rqst, 0, sizeof(struct smb_rqst)); +@@ -1892,8 +1892,7 @@ SMB2_tcon(const unsigned int xid, struct + iov[0].iov_len = total_len - 1; + + /* Testing shows that buffer offset must be at location of Buffer[0] */ +- req->PathOffset = cpu_to_le16(sizeof(struct smb2_tree_connect_req) +- - 1 /* pad */); ++ req->PathOffset = cpu_to_le16(sizeof(struct smb2_tree_connect_req)); + req->PathLength = cpu_to_le16(unc_path_len); + iov[1].iov_base = unc_path; + iov[1].iov_len = unc_path_len; +@@ -3773,7 +3772,7 @@ SMB2_change_notify(const unsigned int xi + ses->Suid, (u8)watch_tree, completion_filter); + /* validate that notify information is plausible */ + if ((rsp_iov.iov_base == NULL) || +- (rsp_iov.iov_len < sizeof(struct smb2_change_notify_rsp))) ++ (rsp_iov.iov_len < sizeof(struct smb2_change_notify_rsp) + 1)) + goto cnotify_exit; + + smb_rsp = (struct smb2_change_notify_rsp *)rsp_iov.iov_base; +@@ -4966,7 +4965,7 @@ int SMB2_query_directory_init(const unsi + memcpy(bufptr, &asteriks, len); + + req->FileNameOffset = +- cpu_to_le16(sizeof(struct smb2_query_directory_req) - 1); ++ cpu_to_le16(sizeof(struct smb2_query_directory_req)); + req->FileNameLength = cpu_to_le16(len); + /* + * BB could be 30 bytes or so longer if we used SMB2 specific +@@ -5162,8 +5161,7 @@ SMB2_set_info_init(struct cifs_tcon *tco + req->VolatileFileId = volatile_fid; + req->AdditionalInformation = cpu_to_le32(additional_info); + +- req->BufferOffset = +- cpu_to_le16(sizeof(struct smb2_set_info_req) - 1); ++ req->BufferOffset = cpu_to_le16(sizeof(struct smb2_set_info_req)); + req->BufferLength = cpu_to_le32(*size); + + memcpy(req->Buffer, *data, *size); +@@ -5397,9 +5395,9 @@ build_qfs_info_req(struct kvec *iov, str + req->VolatileFileId = volatile_fid; + /* 1 for pad */ + req->InputBufferOffset = +- cpu_to_le16(sizeof(struct smb2_query_info_req) - 1); ++ cpu_to_le16(sizeof(struct smb2_query_info_req)); + req->OutputBufferLength = cpu_to_le32( +- outbuf_len + sizeof(struct smb2_query_info_rsp) - 1); ++ outbuf_len + sizeof(struct smb2_query_info_rsp)); + + iov->iov_base = (char *)req; + iov->iov_len = total_len; +--- a/fs/cifs/smb2pdu.h ++++ b/fs/cifs/smb2pdu.h +@@ -57,7 +57,7 @@ struct smb2_rdma_crypto_transform { + #define COMPOUND_FID 0xFFFFFFFFFFFFFFFFULL + + #define SMB2_SYMLINK_STRUCT_SIZE \ +- (sizeof(struct smb2_err_rsp) - 1 + sizeof(struct smb2_symlink_err_rsp)) ++ (sizeof(struct smb2_err_rsp) + sizeof(struct smb2_symlink_err_rsp)) + + #define SYMLINK_ERROR_TAG 0x4c4d5953 + +--- a/fs/smbfs_common/smb2pdu.h ++++ b/fs/smbfs_common/smb2pdu.h +@@ -167,7 +167,7 @@ struct smb2_err_rsp { + __u8 ErrorContextCount; + __u8 Reserved; + __le32 ByteCount; /* even if zero, at least one byte follows */ +- __u8 ErrorData[1]; /* variable length */ ++ __u8 ErrorData[]; /* variable length */ + } __packed; + + #define SMB3_AES_CCM_NONCE 11 +@@ -308,7 +308,7 @@ struct smb2_tree_connect_req { + __le16 Flags; /* Flags in SMB3.1.1 */ + __le16 PathOffset; + __le16 PathLength; +- __u8 Buffer[1]; /* variable length */ ++ __u8 Buffer[]; /* variable length */ + } __packed; + + /* Possible ShareType values */ +@@ -595,7 +595,7 @@ struct smb2_negotiate_rsp { + __le16 SecurityBufferOffset; + __le16 SecurityBufferLength; + __le32 NegotiateContextOffset; /* Pre:SMB3.1.1 was reserved/ignored */ +- __u8 Buffer[1]; /* variable length GSS security buffer */ ++ __u8 Buffer[]; /* variable length GSS security buffer */ + } __packed; + + +@@ -616,7 +616,7 @@ struct smb2_sess_setup_req { + __le16 SecurityBufferOffset; + __le16 SecurityBufferLength; + __le64 PreviousSessionId; +- __u8 Buffer[1]; /* variable length GSS security buffer */ ++ __u8 Buffer[]; /* variable length GSS security buffer */ + } __packed; + + /* Currently defined SessionFlags */ +@@ -633,7 +633,7 @@ struct smb2_sess_setup_rsp { + __le16 SessionFlags; + __le16 SecurityBufferOffset; + __le16 SecurityBufferLength; +- __u8 Buffer[1]; /* variable length GSS security buffer */ ++ __u8 Buffer[]; /* variable length GSS security buffer */ + } __packed; + + +@@ -715,7 +715,7 @@ struct smb2_read_req { + __le32 RemainingBytes; + __le16 ReadChannelInfoOffset; + __le16 ReadChannelInfoLength; +- __u8 Buffer[1]; ++ __u8 Buffer[]; + } __packed; + + /* Read flags */ +@@ -730,7 +730,7 @@ struct smb2_read_rsp { + __le32 DataLength; + __le32 DataRemaining; + __le32 Flags; +- __u8 Buffer[1]; ++ __u8 Buffer[]; + } __packed; + + +@@ -754,7 +754,7 @@ struct smb2_write_req { + __le16 WriteChannelInfoOffset; + __le16 WriteChannelInfoLength; + __le32 Flags; +- __u8 Buffer[1]; ++ __u8 Buffer[]; + } __packed; + + struct smb2_write_rsp { +@@ -765,7 +765,7 @@ struct smb2_write_rsp { + __le32 DataLength; + __le32 DataRemaining; + __u32 Reserved2; +- __u8 Buffer[1]; ++ __u8 Buffer[]; + } __packed; + + +@@ -812,7 +812,10 @@ struct smb2_lock_req { + __u64 PersistentFileId; + __u64 VolatileFileId; + /* Followed by at least one */ +- struct smb2_lock_element locks[1]; ++ union { ++ struct smb2_lock_element lock; ++ DECLARE_FLEX_ARRAY(struct smb2_lock_element, locks); ++ }; + } __packed; + + struct smb2_lock_rsp { +@@ -866,7 +869,7 @@ struct smb2_query_directory_req { + __le16 FileNameOffset; + __le16 FileNameLength; + __le32 OutputBufferLength; +- __u8 Buffer[1]; ++ __u8 Buffer[]; + } __packed; + + struct smb2_query_directory_rsp { +@@ -874,7 +877,7 @@ struct smb2_query_directory_rsp { + __le16 StructureSize; /* Must be 9 */ + __le16 OutputBufferOffset; + __le32 OutputBufferLength; +- __u8 Buffer[1]; ++ __u8 Buffer[]; + } __packed; + + /* +@@ -897,7 +900,7 @@ struct smb2_set_info_req { + __le32 AdditionalInformation; + __u64 PersistentFileId; + __u64 VolatileFileId; +- __u8 Buffer[1]; ++ __u8 Buffer[]; + } __packed; + + struct smb2_set_info_rsp { +@@ -952,7 +955,7 @@ struct smb2_change_notify_rsp { + __le16 StructureSize; /* Must be 9 */ + __le16 OutputBufferOffset; + __le32 OutputBufferLength; +- __u8 Buffer[1]; /* array of file notify structs */ ++ __u8 Buffer[]; /* array of file notify structs */ + } __packed; + + +@@ -1154,7 +1157,7 @@ struct smb2_create_rsp { + __u64 VolatileFileId; + __le32 CreateContextsOffset; + __le32 CreateContextsLength; +- __u8 Buffer[1]; ++ __u8 Buffer[]; + } __packed; + + struct create_posix { +@@ -1497,7 +1500,7 @@ struct smb2_query_info_req { + __le32 Flags; + __u64 PersistentFileId; + __u64 VolatileFileId; +- __u8 Buffer[1]; ++ __u8 Buffer[]; + } __packed; + + struct smb2_query_info_rsp { +@@ -1505,7 +1508,7 @@ struct smb2_query_info_rsp { + __le16 StructureSize; /* Must be 9 */ + __le16 OutputBufferOffset; + __le32 OutputBufferLength; +- __u8 Buffer[1]; ++ __u8 Buffer[]; + } __packed; + + /* +@@ -1566,7 +1569,10 @@ struct smb2_file_all_info { /* data bloc + __le32 Mode; + __le32 AlignmentRequirement; + __le32 FileNameLength; +- char FileName[1]; ++ union { ++ char __pad; /* Legacy structure padding */ ++ DECLARE_FLEX_ARRAY(char, FileName); ++ }; + } __packed; /* level 18 Query */ + + struct smb2_file_eof_info { /* encoding of request for level 10 */ diff --git a/patches.suse/soundwire-cadence-Don-t-overflow-the-command-FIFOs.patch b/patches.suse/soundwire-cadence-Don-t-overflow-the-command-FIFOs.patch new file mode 100644 index 0000000..0790dbc --- /dev/null +++ b/patches.suse/soundwire-cadence-Don-t-overflow-the-command-FIFOs.patch @@ -0,0 +1,48 @@ +From 7cbfee2e2e40d2be54196362a845a3ea0a3f877d Mon Sep 17 00:00:00 2001 +From: Richard Fitzgerald +Date: Fri, 2 Dec 2022 16:18:10 +0000 +Subject: [PATCH] soundwire: cadence: Don't overflow the command FIFOs +Git-commit: 7cbfee2e2e40d2be54196362a845a3ea0a3f877d +Patch-mainline: v6.3-rc1 +References: git-fixes + +The command FIFOs in the Cadence IP can be configured during design +up to 32 entries, and the code in cadence_master.c was assuming the +full 32-entry FIFO. But all current Intel implementations use an 8-entry +FIFO. + +Up to now the longest message used was 6 entries so this wasn't +causing any problem. But future Cirrus Logic codecs have downloadable +firmware or tuning blobs. It is more efficient for the codec driver to +issue long transfers that can take advantage of any queuing in the +Soundwire controller and avoid the overhead of repeatedly writing the +page registers. + +Signed-off-by: Richard Fitzgerald +Reviewed-by: Pierre-Louis Bossart +Fixes: 2f52a5177caa ("soundwire: cdns: Add cadence library") +Link: https://lore.kernel.org/r/20221202161812.4186897-2-rf@opensource.cirrus.com +Signed-off-by: Vinod Koul +Acked-by: Takashi Iwai + +--- + drivers/soundwire/cadence_master.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c +index a1de363eba3f..27699f341f2c 100644 +--- a/drivers/soundwire/cadence_master.c ++++ b/drivers/soundwire/cadence_master.c +@@ -127,7 +127,8 @@ MODULE_PARM_DESC(cdns_mcp_int_mask, "Cadence MCP IntMask"); + + #define CDNS_MCP_CMD_BASE 0x80 + #define CDNS_MCP_RESP_BASE 0x80 +-#define CDNS_MCP_CMD_LEN 0x20 ++/* FIFO can hold 8 commands */ ++#define CDNS_MCP_CMD_LEN 8 + #define CDNS_MCP_CMD_WORD_LEN 0x4 + + #define CDNS_MCP_CMD_SSP_TAG BIT(31) +-- +2.35.3 + diff --git a/patches.suse/spi-bcm63xx-hsspi-Endianness-fix-for-ARM-based-SoC.patch b/patches.suse/spi-bcm63xx-hsspi-Endianness-fix-for-ARM-based-SoC.patch new file mode 100644 index 0000000..ca65bdc --- /dev/null +++ b/patches.suse/spi-bcm63xx-hsspi-Endianness-fix-for-ARM-based-SoC.patch @@ -0,0 +1,41 @@ +From 85a84a61699990db6a025b5073f337f49933a875 Mon Sep 17 00:00:00 2001 +From: William Zhang +Date: Mon, 6 Feb 2023 22:58:17 -0800 +Subject: [PATCH] spi: bcm63xx-hsspi: Endianness fix for ARM based SoC +Git-commit: 85a84a61699990db6a025b5073f337f49933a875 +Patch-mainline: v6.3-rc1 +References: git-fixes + +HSSPI controller uses big endian for the opcode in the message to the +controller ping pong buffer. Use cpu_to_be16 to properly handle the +endianness for both big and little endian host. + +Fixes: 142168eba9dc ("spi: bcm63xx-hsspi: add bcm63xx HSSPI driver") +Signed-off-by: Kursad Oney +Signed-off-by: William Zhang +Acked-by: Florian Fainelli + +Link: https://lore.kernel.org/r/20230207065826.285013-7-william.zhang@broadcom.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + drivers/spi/spi-bcm63xx-hsspi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c +index 01d5acad4a1b..a65a0ec67641 100644 +--- a/drivers/spi/spi-bcm63xx-hsspi.c ++++ b/drivers/spi/spi-bcm63xx-hsspi.c +@@ -194,7 +194,7 @@ static int bcm63xx_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t) + tx += curr_step; + } + +- __raw_writew(opcode | curr_step, bs->fifo); ++ __raw_writew((u16)cpu_to_be16(opcode | curr_step), bs->fifo); + + /* enable interrupt */ + __raw_writel(HSSPI_PINGx_CMD_DONE(0), +-- +2.35.3 + diff --git a/patches.suse/spi-synquacer-Fix-timeout-handling-in-synquacer_spi_.patch b/patches.suse/spi-synquacer-Fix-timeout-handling-in-synquacer_spi_.patch new file mode 100644 index 0000000..937436a --- /dev/null +++ b/patches.suse/spi-synquacer-Fix-timeout-handling-in-synquacer_spi_.patch @@ -0,0 +1,47 @@ +From e6a0b671880207566e1ece983bf989dde60bc1d7 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Wed, 15 Feb 2023 14:01:28 +0100 +Subject: [PATCH] spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one() +Git-commit: e6a0b671880207566e1ece983bf989dde60bc1d7 +Patch-mainline: v6.3-rc1 +References: git-fixes + +wait_for_completion_timeout() never returns a <0 value. It returns either +on timeout or a positive value (at least 1, or number of jiffies left +till timeout) + +So, fix the error handling path and return -ETIMEDOUT should a timeout +occur. + +Fixes: b0823ee35cf9 ("spi: Add spi driver for Socionext SynQuacer platform") +Signed-off-by: Christophe JAILLET +Acked-by: Jassi Brar +Link: https://lore.kernel.org/r/c2040bf3cfa201fd8890cfab14fa5a701ffeca14.1676466072.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + drivers/spi/spi-synquacer.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-synquacer.c b/drivers/spi/spi-synquacer.c +index 47cbe73137c2..dc188f9202c9 100644 +--- a/drivers/spi/spi-synquacer.c ++++ b/drivers/spi/spi-synquacer.c +@@ -472,10 +472,9 @@ static int synquacer_spi_transfer_one(struct spi_master *master, + read_fifo(sspi); + } + +- if (status < 0) { +- dev_err(sspi->dev, "failed to transfer. status: 0x%x\n", +- status); +- return status; ++ if (status == 0) { ++ dev_err(sspi->dev, "failed to transfer. Timeout.\n"); ++ return -ETIMEDOUT; + } + + return 0; +-- +2.35.3 + diff --git a/patches.suse/spi-tegra210-quad-Fix-validate-combined-sequence.patch b/patches.suse/spi-tegra210-quad-Fix-validate-combined-sequence.patch new file mode 100644 index 0000000..4ce67a2 --- /dev/null +++ b/patches.suse/spi-tegra210-quad-Fix-validate-combined-sequence.patch @@ -0,0 +1,38 @@ +From 047ee71ae4f412d8819e39e4b08c588fa299cfc2 Mon Sep 17 00:00:00 2001 +From: Krishna Yarlagadda +Date: Fri, 24 Feb 2023 22:10:34 +0530 +Subject: [PATCH] spi: tegra210-quad: Fix validate combined sequence +Git-commit: 047ee71ae4f412d8819e39e4b08c588fa299cfc2 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Check for non dma transfers that do not fit in FIFO has issue and skips +combined sequence for Tegra234 & Tegra241 which does not have GPCDMA. + +Fixes: 1b8342cc4a38 ("spi: tegra210-quad: combined sequence mode") + +Signed-off-by: Krishna Yarlagadda +Link: https://lore.kernel.org/r/20230224164034.56933-1-kyarlagadda@nvidia.com +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + drivers/spi/spi-tegra210-quad.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-tegra210-quad.c b/drivers/spi/spi-tegra210-quad.c +index 258e3b8c9c2c..9aaca2289c59 100644 +--- a/drivers/spi/spi-tegra210-quad.c ++++ b/drivers/spi/spi-tegra210-quad.c +@@ -1297,7 +1297,7 @@ static bool tegra_qspi_validate_cmb_seq(struct tegra_qspi *tqspi, + if (xfer->len > 4 || xfer->len < 3) + return false; + xfer = list_next_entry(xfer, transfer_list); +- if (!tqspi->soc_data->has_dma || xfer->len > (QSPI_FIFO_DEPTH << 2)) ++ if (!tqspi->soc_data->has_dma && xfer->len > (QSPI_FIFO_DEPTH << 2)) + return false; + + return true; +-- +2.35.3 + diff --git a/patches.suse/staging-mt7621-dts-change-palmbus-address-to-lower-c.patch b/patches.suse/staging-mt7621-dts-change-palmbus-address-to-lower-c.patch new file mode 100644 index 0000000..39b2d1f --- /dev/null +++ b/patches.suse/staging-mt7621-dts-change-palmbus-address-to-lower-c.patch @@ -0,0 +1,36 @@ +From efbc7bd90f60c71b8e786ee767952bc22fc3666d Mon Sep 17 00:00:00 2001 +From: Sergio Paracuellos +Date: Tue, 19 Oct 2021 12:29:14 +0200 +Subject: [PATCH] staging: mt7621-dts: change palmbus address to lower case +Git-commit: efbc7bd90f60c71b8e786ee767952bc22fc3666d +Patch-mainline: v5.16-rc1 +References: git-fixes + +Hexadecimal addresses in device tree must be defined using lower case. +Change missing one in 'gbpc1.dts' file. + +Signed-off-by: Sergio Paracuellos +Link: https://lore.kernel.org/r/20211019102915.15409-1-sergio.paracuellos@gmail.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/staging/mt7621-dts/gbpc1.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/mt7621-dts/gbpc1.dts b/drivers/staging/mt7621-dts/gbpc1.dts +index b65d71686814..36e1e507f241 100644 +--- a/drivers/staging/mt7621-dts/gbpc1.dts ++++ b/drivers/staging/mt7621-dts/gbpc1.dts +@@ -18,7 +18,7 @@ chosen { + bootargs = "console=ttyS0,57600"; + }; + +- palmbus: palmbus@1E000000 { ++ palmbus: palmbus@1e000000 { + i2c@900 { + status = "okay"; + }; +-- +2.35.3 + diff --git a/patches.suse/sunrpc-Fix-potential-race-conditions-in-rpc_sysfs_xp.patch b/patches.suse/sunrpc-Fix-potential-race-conditions-in-rpc_sysfs_xp.patch new file mode 100644 index 0000000..86afbd2 --- /dev/null +++ b/patches.suse/sunrpc-Fix-potential-race-conditions-in-rpc_sysfs_xp.patch @@ -0,0 +1,65 @@ +From: Anna Schumaker +Date: Mon, 15 Nov 2021 11:54:25 -0500 +Subject: [PATCH] sunrpc: Fix potential race conditions in + rpc_sysfs_xprt_state_change() +Git-commit: 1a48db3fef499f615b56093947ec4b0d3d8e3021 +Patch-mainline: v5.17 +References: git-fixes + +We need to use test_and_set_bit() when changing xprt state flags to +avoid potentially getting xps->xps_nactive out of sync. + +Signed-off-by: Anna Schumaker +Acked-by: NeilBrown + +--- + net/sunrpc/sysfs.c | 35 +++++++++++++++++++---------------- + 1 file changed, 19 insertions(+), 16 deletions(-) + +--- a/net/sunrpc/sysfs.c ++++ b/net/sunrpc/sysfs.c +@@ -288,25 +288,28 @@ static ssize_t rpc_sysfs_xprt_state_chan + goto release_tasks; + } + if (offline) { +- set_bit(XPRT_OFFLINE, &xprt->state); +- spin_lock(&xps->xps_lock); +- xps->xps_nactive--; +- spin_unlock(&xps->xps_lock); ++ if (!test_and_set_bit(XPRT_OFFLINE, &xprt->state)) { ++ spin_lock(&xps->xps_lock); ++ xps->xps_nactive--; ++ spin_unlock(&xps->xps_lock); ++ } + } else if (online) { +- clear_bit(XPRT_OFFLINE, &xprt->state); +- spin_lock(&xps->xps_lock); +- xps->xps_nactive++; +- spin_unlock(&xps->xps_lock); ++ if (test_and_clear_bit(XPRT_OFFLINE, &xprt->state)) { ++ spin_lock(&xps->xps_lock); ++ xps->xps_nactive++; ++ spin_unlock(&xps->xps_lock); ++ } + } else if (remove) { + if (test_bit(XPRT_OFFLINE, &xprt->state)) { +- set_bit(XPRT_REMOVE, &xprt->state); +- xprt_force_disconnect(xprt); +- if (test_bit(XPRT_CONNECTED, &xprt->state)) { +- if (!xprt->sending.qlen && +- !xprt->pending.qlen && +- !xprt->backlog.qlen && +- !atomic_long_read(&xprt->queuelen)) +- rpc_xprt_switch_remove_xprt(xps, xprt); ++ if (!test_and_set_bit(XPRT_REMOVE, &xprt->state)) { ++ xprt_force_disconnect(xprt); ++ if (test_bit(XPRT_CONNECTED, &xprt->state)) { ++ if (!xprt->sending.qlen && ++ !xprt->pending.qlen && ++ !xprt->backlog.qlen && ++ !atomic_long_read(&xprt->queuelen)) ++ rpc_xprt_switch_remove_xprt(xps, xprt); ++ } + } + } else { + count = -EINVAL; diff --git a/patches.suse/thermal-drivers-hisi-Drop-second-sensor-hi3660.patch b/patches.suse/thermal-drivers-hisi-Drop-second-sensor-hi3660.patch new file mode 100644 index 0000000..cbec43f --- /dev/null +++ b/patches.suse/thermal-drivers-hisi-Drop-second-sensor-hi3660.patch @@ -0,0 +1,46 @@ +From 15cc25829a97c3957e520e971868aacc84341317 Mon Sep 17 00:00:00 2001 +From: Yongqin Liu +Date: Fri, 10 Feb 2023 22:15:07 +0800 +Subject: [PATCH] thermal/drivers/hisi: Drop second sensor hi3660 +Git-commit: 15cc25829a97c3957e520e971868aacc84341317 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The commit 74c8e6bffbe1 ("driver core: Add __alloc_size hint to devm +allocators") exposes a panic "BRK handler: Fatal exception" on the +hi3660_thermal_probe funciton. +This is because the function allocates memory for only one +sensors array entry, but tries to fill up a second one. + +Fix this by removing the unneeded second access. + +Fixes: 7d3a2a2bbadb ("thermal/drivers/hisi: Fix number of sensors on hi3660") +Signed-off-by: Yongqin Liu +Link: https://lore.kernel.org/linux-mm/20221101223321.1326815-5-keescook@chromium.org/ +Link: https://lore.kernel.org/r/20230210141507.71014-1-yongqin.liu@linaro.org +Signed-off-by: Daniel Lezcano +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/thermal/hisi_thermal.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/thermal/hisi_thermal.c b/drivers/thermal/hisi_thermal.c +index 45226cab466e..be0365656005 100644 +--- a/drivers/thermal/hisi_thermal.c ++++ b/drivers/thermal/hisi_thermal.c +@@ -427,10 +427,6 @@ static int hi3660_thermal_probe(struct hisi_thermal_data *data) + data->sensor[0].irq_name = "tsensor_a73"; + data->sensor[0].data = data; + +- data->sensor[1].id = HI3660_LITTLE_SENSOR; +- data->sensor[1].irq_name = "tsensor_a53"; +- data->sensor[1].data = data; +- + return 0; + } + +-- +2.35.3 + diff --git a/patches.suse/thermal-drivers-tsens-Drop-msm8976-specific-defines.patch b/patches.suse/thermal-drivers-tsens-Drop-msm8976-specific-defines.patch new file mode 100644 index 0000000..ccd18d3 --- /dev/null +++ b/patches.suse/thermal-drivers-tsens-Drop-msm8976-specific-defines.patch @@ -0,0 +1,52 @@ +From 3bf0ea99e2e32b0335106b86d84404cc85bcd113 Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Sun, 1 Jan 2023 21:40:19 +0200 +Subject: [PATCH] thermal/drivers/tsens: Drop msm8976-specific defines +Git-commit: 3bf0ea99e2e32b0335106b86d84404cc85bcd113 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Drop msm8976-specific defines, which duplicate generic ones. + +Fixes: 0e580290170d ("thermal: qcom: tsens-v1: Add support for MSM8956 and MSM8976") +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20230101194034.831222-6-dmitry.baryshkov@linaro.org +Signed-off-by: Daniel Lezcano +Acked-by: Takashi Iwai + +--- + drivers/thermal/qcom/tsens-v1.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/drivers/thermal/qcom/tsens-v1.c b/drivers/thermal/qcom/tsens-v1.c +index 96ef12d47bff..a7f53966156b 100644 +--- a/drivers/thermal/qcom/tsens-v1.c ++++ b/drivers/thermal/qcom/tsens-v1.c +@@ -78,11 +78,6 @@ + + #define MSM8976_CAL_SEL_MASK 0x3 + +-#define MSM8976_CAL_DEGC_PT1 30 +-#define MSM8976_CAL_DEGC_PT2 120 +-#define MSM8976_SLOPE_FACTOR 1000 +-#define MSM8976_SLOPE_DEFAULT 3200 +- + /* eeprom layout data for qcs404/405 (v1) */ + #define BASE0_MASK 0x000007f8 + #define BASE1_MASK 0x0007f800 +@@ -160,8 +155,8 @@ static void compute_intercept_slope_8976(struct tsens_priv *priv, + priv->sensor[10].slope = 3286; + + for (i = 0; i < priv->num_sensors; i++) { +- priv->sensor[i].offset = (p1[i] * MSM8976_SLOPE_FACTOR) - +- (MSM8976_CAL_DEGC_PT1 * ++ priv->sensor[i].offset = (p1[i] * SLOPE_FACTOR) - ++ (CAL_DEGC_PT1 * + priv->sensor[i].slope); + } + } +-- +2.35.3 + diff --git a/patches.suse/thermal-drivers-tsens-Sort-out-msm8976-vs-msm8956-da.patch b/patches.suse/thermal-drivers-tsens-Sort-out-msm8976-vs-msm8956-da.patch new file mode 100644 index 0000000..7970024 --- /dev/null +++ b/patches.suse/thermal-drivers-tsens-Sort-out-msm8976-vs-msm8956-da.patch @@ -0,0 +1,147 @@ +From a7d3006be5ca7b04e4b84b5ceaae55a700e511bd Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Sun, 1 Jan 2023 21:40:20 +0200 +Subject: [PATCH] thermal/drivers/tsens: Sort out msm8976 vs msm8956 data +Git-commit: a7d3006be5ca7b04e4b84b5ceaae55a700e511bd +Patch-mainline: v6.3-rc1 +References: git-fixes + +Tsens driver mentions that msm8976 data should be used for both msm8976 +and msm8956 SoCs. This is not quite correct, as according to the +vendor kernels, msm8976 should use standard slope values (3200), while +msm8956 really uses the slope values found in the driver. + +Add separate compatibility string for msm8956, move slope value +overrides to the corresponding init function and use the standard +compute_intercept_slope() function for both platforms. + +Fixes: 0e580290170d ("thermal: qcom: tsens-v1: Add support for MSM8956 and MSM8976") +Cc: AngeloGioacchino Del Regno +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20230101194034.831222-7-dmitry.baryshkov@linaro.org +Signed-off-by: Daniel Lezcano +Acked-by: Takashi Iwai + +--- + drivers/thermal/qcom/tsens-v1.c | 56 +++++++++++++++++++++------------------- + drivers/thermal/qcom/tsens.c | 3 ++ + drivers/thermal/qcom/tsens.h | 2 - + 3 files changed, 34 insertions(+), 27 deletions(-) + +--- a/drivers/thermal/qcom/tsens-v1.c ++++ b/drivers/thermal/qcom/tsens-v1.c +@@ -137,30 +137,6 @@ + #define CAL_SEL_MASK 7 + #define CAL_SEL_SHIFT 0 + +-static void compute_intercept_slope_8976(struct tsens_priv *priv, +- u32 *p1, u32 *p2, u32 mode) +-{ +- int i; +- +- priv->sensor[0].slope = 3313; +- priv->sensor[1].slope = 3275; +- priv->sensor[2].slope = 3320; +- priv->sensor[3].slope = 3246; +- priv->sensor[4].slope = 3279; +- priv->sensor[5].slope = 3257; +- priv->sensor[6].slope = 3234; +- priv->sensor[7].slope = 3269; +- priv->sensor[8].slope = 3255; +- priv->sensor[9].slope = 3239; +- priv->sensor[10].slope = 3286; +- +- for (i = 0; i < priv->num_sensors; i++) { +- priv->sensor[i].offset = (p1[i] * SLOPE_FACTOR) - +- (CAL_DEGC_PT1 * +- priv->sensor[i].slope); +- } +-} +- + static int calibrate_v1(struct tsens_priv *priv) + { + u32 base0 = 0, base1 = 0; +@@ -286,7 +262,7 @@ static int calibrate_8976(struct tsens_p + break; + } + +- compute_intercept_slope_8976(priv, p1, p2, mode); ++ compute_intercept_slope(priv, p1, p2, mode); + kfree(qfprom_cdata); + + return 0; +@@ -357,6 +333,22 @@ static const struct reg_field tsens_v1_r + [TRDY] = REG_FIELD(TM_TRDY_OFF, 0, 0), + }; + ++static int __init init_8956(struct tsens_priv *priv) { ++ priv->sensor[0].slope = 3313; ++ priv->sensor[1].slope = 3275; ++ priv->sensor[2].slope = 3320; ++ priv->sensor[3].slope = 3246; ++ priv->sensor[4].slope = 3279; ++ priv->sensor[5].slope = 3257; ++ priv->sensor[6].slope = 3234; ++ priv->sensor[7].slope = 3269; ++ priv->sensor[8].slope = 3255; ++ priv->sensor[9].slope = 3239; ++ priv->sensor[10].slope = 3286; ++ ++ return init_common(priv); ++} ++ + static const struct tsens_ops ops_generic_v1 = { + .init = init_common, + .calibrate = calibrate_v1, +@@ -369,13 +361,25 @@ struct tsens_plat_data data_tsens_v1 = { + .fields = tsens_v1_regfields, + }; + ++static const struct tsens_ops ops_8956 = { ++ .init = init_8956, ++ .calibrate = calibrate_8976, ++ .get_temp = get_temp_tsens_valid, ++}; ++ ++struct tsens_plat_data data_8956 = { ++ .num_sensors = 11, ++ .ops = &ops_8956, ++ .feat = &tsens_v1_feat, ++ .fields = tsens_v1_regfields, ++}; ++ + static const struct tsens_ops ops_8976 = { + .init = init_common, + .calibrate = calibrate_8976, + .get_temp = get_temp_tsens_valid, + }; + +-/* Valid for both MSM8956 and MSM8976. */ + struct tsens_plat_data data_8976 = { + .num_sensors = 11, + .ops = &ops_8976, +--- a/drivers/thermal/qcom/tsens.c ++++ b/drivers/thermal/qcom/tsens.c +@@ -979,6 +979,9 @@ static const struct of_device_id tsens_t + .compatible = "qcom,msm8939-tsens", + .data = &data_8939, + }, { ++ .compatible = "qcom,msm8956-tsens", ++ .data = &data_8956, ++ }, { + .compatible = "qcom,msm8974-tsens", + .data = &data_8974, + }, { +--- a/drivers/thermal/qcom/tsens.h ++++ b/drivers/thermal/qcom/tsens.h +@@ -590,7 +590,7 @@ extern struct tsens_plat_data data_8960; + extern struct tsens_plat_data data_8916, data_8939, data_8974, data_9607; + + /* TSENS v1 targets */ +-extern struct tsens_plat_data data_tsens_v1, data_8976; ++extern struct tsens_plat_data data_tsens_v1, data_8976, data_8956; + + /* TSENS v2 targets */ + extern struct tsens_plat_data data_8996, data_tsens_v2; diff --git a/patches.suse/thermal-drivers-tsens-fix-slope-values-for-msm8939.patch b/patches.suse/thermal-drivers-tsens-fix-slope-values-for-msm8939.patch new file mode 100644 index 0000000..07c8483 --- /dev/null +++ b/patches.suse/thermal-drivers-tsens-fix-slope-values-for-msm8939.patch @@ -0,0 +1,65 @@ +From 5aec3b035e0cbf3f042c2a03d654e5ad6748feb7 Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Sun, 1 Jan 2023 21:40:21 +0200 +Subject: [PATCH] thermal/drivers/tsens: fix slope values for msm8939 +Git-commit: 5aec3b035e0cbf3f042c2a03d654e5ad6748feb7 +Patch-mainline: v6.3-rc1 +References: git-fixes + +According to the vendor kernels (msm-3.10, 3.14 and 3.18), msm8939 +uses non-standard slope values for calibrating the sensors. Fill them +accordingly. + +Fixes: 332bc8ebab2c ("thermal: qcom: tsens-v0_1: Add support for MSM8939") +Cc: Bryan O'Donoghue +Cc: Shawn Guo +Reviewed-by: Konrad Dybcio +Acked-by: Shawn Guo +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Bryan O'Donoghue +Link: https://lore.kernel.org/r/20230101194034.831222-8-dmitry.baryshkov@linaro.org +Signed-off-by: Daniel Lezcano +Acked-by: Takashi Iwai + +--- + drivers/thermal/qcom/tsens-v0_1.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/thermal/qcom/tsens-v0_1.c b/drivers/thermal/qcom/tsens-v0_1.c +index 0bc4e5cec184..6645c98ff56c 100644 +--- a/drivers/thermal/qcom/tsens-v0_1.c ++++ b/drivers/thermal/qcom/tsens-v0_1.c +@@ -534,6 +534,21 @@ static int calibrate_9607(struct tsens_priv *priv) + return 0; + } + ++static int __init init_8939(struct tsens_priv *priv) { ++ priv->sensor[0].slope = 2911; ++ priv->sensor[1].slope = 2789; ++ priv->sensor[2].slope = 2906; ++ priv->sensor[3].slope = 2763; ++ priv->sensor[4].slope = 2922; ++ priv->sensor[5].slope = 2867; ++ priv->sensor[6].slope = 2833; ++ priv->sensor[7].slope = 2838; ++ priv->sensor[8].slope = 2840; ++ priv->sensor[9].slope = 2852; ++ ++ return init_common(priv); ++} ++ + /* v0.1: 8916, 8939, 8974, 9607 */ + + static struct tsens_features tsens_v0_1_feat = { +@@ -599,7 +614,7 @@ struct tsens_plat_data data_8916 = { + }; + + static const struct tsens_ops ops_8939 = { +- .init = init_common, ++ .init = init_8939, + .calibrate = calibrate_8939, + .get_temp = get_temp_common, + }; +-- +2.35.3 + diff --git a/patches.suse/thermal-drivers-tsens-limit-num_sensors-to-9-for-msm.patch b/patches.suse/thermal-drivers-tsens-limit-num_sensors-to-9-for-msm.patch new file mode 100644 index 0000000..08d6a9f --- /dev/null +++ b/patches.suse/thermal-drivers-tsens-limit-num_sensors-to-9-for-msm.patch @@ -0,0 +1,96 @@ +From 903238a33c116edf5f64f7a3fd246e6169cccfa6 Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Sun, 1 Jan 2023 21:40:22 +0200 +Subject: [PATCH] thermal/drivers/tsens: limit num_sensors to 9 for msm8939 +Git-commit: 903238a33c116edf5f64f7a3fd246e6169cccfa6 +Patch-mainline: v6.3-rc1 +References: git-fixes + +On msm8939 last (hwid=10) sensor was added in the hw revision 3.0. +Calibration data for it was placed outside of the main calibration data +blob, so it is not accessible by the current blob-parsing code. + +Moreover data for the sensor's p2 is not contiguous in the fuses. This +makes it hard to use nvmem_cell API to parse calibration data in a +generic way. + +Since the sensor doesn't seem to be actually used by the existing +hardware, disable the sensor for now. + +Fixes: 332bc8ebab2c ("thermal: qcom: tsens-v0_1: Add support for MSM8939") +Cc: Bryan O'Donoghue +Cc: Shawn Guo +Acked-by: Shawn Guo +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Bryan O'Donoghue +Link: https://lore.kernel.org/r/20230101194034.831222-9-dmitry.baryshkov@linaro.org +Signed-off-by: Daniel Lezcano +Acked-by: Takashi Iwai + +--- + drivers/thermal/qcom/tsens-v0_1.c | 13 ++++--------- + 1 file changed, 4 insertions(+), 9 deletions(-) + +diff --git a/drivers/thermal/qcom/tsens-v0_1.c b/drivers/thermal/qcom/tsens-v0_1.c +index 6645c98ff56c..579028ea48f4 100644 +--- a/drivers/thermal/qcom/tsens-v0_1.c ++++ b/drivers/thermal/qcom/tsens-v0_1.c +@@ -285,7 +285,7 @@ static int calibrate_8939(struct tsens_priv *priv) + u32 p1[10], p2[10]; + int mode = 0; + u32 *qfprom_cdata; +- u32 cdata[6]; ++ u32 cdata[4]; + + qfprom_cdata = (u32 *)qfprom_read(priv->dev, "calib"); + if (IS_ERR(qfprom_cdata)) +@@ -296,8 +296,6 @@ static int calibrate_8939(struct tsens_priv *priv) + cdata[1] = qfprom_cdata[13]; + cdata[2] = qfprom_cdata[0]; + cdata[3] = qfprom_cdata[1]; +- cdata[4] = qfprom_cdata[22]; +- cdata[5] = qfprom_cdata[21]; + + mode = (cdata[0] & MSM8939_CAL_SEL_MASK) >> MSM8939_CAL_SEL_SHIFT; + dev_dbg(priv->dev, "calibration mode is %d\n", mode); +@@ -314,8 +312,6 @@ static int calibrate_8939(struct tsens_priv *priv) + p2[6] = (cdata[2] & MSM8939_S6_P2_MASK) >> MSM8939_S6_P2_SHIFT; + p2[7] = (cdata[3] & MSM8939_S7_P2_MASK) >> MSM8939_S7_P2_SHIFT; + p2[8] = (cdata[3] & MSM8939_S8_P2_MASK) >> MSM8939_S8_P2_SHIFT; +- p2[9] = (cdata[4] & MSM8939_S9_P2_MASK_0_4) >> MSM8939_S9_P2_SHIFT_0_4; +- p2[9] |= ((cdata[5] & MSM8939_S9_P2_MASK_5) >> MSM8939_S9_P2_SHIFT_5) << 5; + for (i = 0; i < priv->num_sensors; i++) + p2[i] = (base1 + p2[i]) << 2; + fallthrough; +@@ -331,7 +327,6 @@ static int calibrate_8939(struct tsens_priv *priv) + p1[6] = (cdata[2] & MSM8939_S6_P1_MASK) >> MSM8939_S6_P1_SHIFT; + p1[7] = (cdata[3] & MSM8939_S7_P1_MASK) >> MSM8939_S7_P1_SHIFT; + p1[8] = (cdata[3] & MSM8939_S8_P1_MASK) >> MSM8939_S8_P1_SHIFT; +- p1[9] = (cdata[4] & MSM8939_S9_P1_MASK) >> MSM8939_S9_P1_SHIFT; + for (i = 0; i < priv->num_sensors; i++) + p1[i] = ((base0) + p1[i]) << 2; + break; +@@ -544,7 +539,7 @@ static int __init init_8939(struct tsens_priv *priv) { + priv->sensor[6].slope = 2833; + priv->sensor[7].slope = 2838; + priv->sensor[8].slope = 2840; +- priv->sensor[9].slope = 2852; ++ /* priv->sensor[9].slope = 2852; */ + + return init_common(priv); + } +@@ -620,9 +615,9 @@ static const struct tsens_ops ops_8939 = { + }; + + struct tsens_plat_data data_8939 = { +- .num_sensors = 10, ++ .num_sensors = 9, + .ops = &ops_8939, +- .hw_ids = (unsigned int []){ 0, 1, 2, 3, 5, 6, 7, 8, 9, 10 }, ++ .hw_ids = (unsigned int []){ 0, 1, 2, 3, 5, 6, 7, 8, 9, /* 10 */ }, + + .feat = &tsens_v0_1_feat, + .fields = tsens_v0_1_regfields, +-- +2.35.3 + diff --git a/patches.suse/thermal-intel-BXT_PMIC-select-REGMAP-instead-of-depe.patch b/patches.suse/thermal-intel-BXT_PMIC-select-REGMAP-instead-of-depe.patch new file mode 100644 index 0000000..29ce73f --- /dev/null +++ b/patches.suse/thermal-intel-BXT_PMIC-select-REGMAP-instead-of-depe.patch @@ -0,0 +1,43 @@ +From 1467fb960349dfa5e300658f1a409dde2cfb0c51 Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Sat, 25 Feb 2023 21:39:52 -0800 +Subject: [PATCH] thermal: intel: BXT_PMIC: select REGMAP instead of depending on it +Git-commit: 1467fb960349dfa5e300658f1a409dde2cfb0c51 +Patch-mainline: v6.3-rc1 +References: git-fixes + +REGMAP is a hidden (not user visible) symbol. Users cannot set it +directly thru "make *config", so drivers should select it instead of +depending on it if they need it. + +Consistently using "select" or "depends on" can also help reduce +Kconfig circular dependency issues. + +Therefore, change the use of "depends on REGMAP" to "select REGMAP". + +Fixes: b474303ffd57 ("thermal: add Intel BXT WhiskeyCove PMIC thermal driver") +Signed-off-by: Randy Dunlap +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/thermal/intel/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/thermal/intel/Kconfig b/drivers/thermal/intel/Kconfig +index b5808f92702d..cb7e7697cf1e 100644 +--- a/drivers/thermal/intel/Kconfig ++++ b/drivers/thermal/intel/Kconfig +@@ -73,7 +73,8 @@ endmenu + + config INTEL_BXT_PMIC_THERMAL + tristate "Intel Broxton PMIC thermal driver" +- depends on X86 && INTEL_SOC_PMIC_BXTWC && REGMAP ++ depends on X86 && INTEL_SOC_PMIC_BXTWC ++ select REGMAP + help + Select this driver for Intel Broxton PMIC with ADC channels monitoring + system temperature measurements and alerts. +-- +2.35.3 + diff --git a/patches.suse/thermal-intel-powerclamp-Fix-cur_state-for-multi-pac.patch b/patches.suse/thermal-intel-powerclamp-Fix-cur_state-for-multi-pac.patch new file mode 100644 index 0000000..0cb5b52 --- /dev/null +++ b/patches.suse/thermal-intel-powerclamp-Fix-cur_state-for-multi-pac.patch @@ -0,0 +1,102 @@ +From 8e47363588377e1bdb65e2b020b409cfb44dd260 Mon Sep 17 00:00:00 2001 +From: Srinivas Pandruvada +Date: Wed, 1 Feb 2023 12:39:41 -0800 +Subject: [PATCH] thermal: intel: powerclamp: Fix cur_state for multi package system +Git-commit: 8e47363588377e1bdb65e2b020b409cfb44dd260 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The powerclamp cooling device cur_state shows actual idle observed by +package C-state idle counters. But the implementation is not sufficient +for multi package or multi die system. The cur_state value is incorrect. +On these systems, these counters must be read from each package/die and +somehow aggregate them. But there is no good method for aggregation. + +It was not a problem when explicit CPU model addition was required to +enable intel powerclamp. In this way certain CPU models could have +been avoided. But with the removal of CPU model check with the +availability of Package C-state counters, the driver is loaded on most +of the recent systems. + +For multi package/die systems, just show the actual target idle state, +the system is trying to achieve. In powerclamp this is the user set +state minus one. + +Also there is no use of starting a worker thread for polling package +C-state counters and applying any compensation for multiple package +or multiple die systems. + +Fixes: b721ca0d1927 ("thermal/powerclamp: remove cpu whitelist") +Signed-off-by: Srinivas Pandruvada +Cc: 4.14+ # 4.14+ +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/thermal/intel/intel_powerclamp.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +diff --git a/drivers/thermal/intel/intel_powerclamp.c b/drivers/thermal/intel/intel_powerclamp.c +index b80e25ec1261..2f4cbfdf26a0 100644 +--- a/drivers/thermal/intel/intel_powerclamp.c ++++ b/drivers/thermal/intel/intel_powerclamp.c +@@ -57,6 +57,7 @@ + + static unsigned int target_mwait; + static struct dentry *debug_dir; ++static bool poll_pkg_cstate_enable; + + /* user selected target */ + static unsigned int set_target_ratio; +@@ -261,6 +262,9 @@ static unsigned int get_compensation(int ratio) + { + unsigned int comp = 0; + ++ if (!poll_pkg_cstate_enable) ++ return 0; ++ + /* we only use compensation if all adjacent ones are good */ + if (ratio == 1 && + cal_data[ratio].confidence >= CONFIDENCE_OK && +@@ -519,7 +523,8 @@ static int start_power_clamp(void) + control_cpu = cpumask_first(cpu_online_mask); + + clamping = true; +- schedule_delayed_work(&poll_pkg_cstate_work, 0); ++ if (poll_pkg_cstate_enable) ++ schedule_delayed_work(&poll_pkg_cstate_work, 0); + + /* start one kthread worker per online cpu */ + for_each_online_cpu(cpu) { +@@ -585,11 +590,15 @@ static int powerclamp_get_max_state(struct thermal_cooling_device *cdev, + static int powerclamp_get_cur_state(struct thermal_cooling_device *cdev, + unsigned long *state) + { +- if (true == clamping) +- *state = pkg_cstate_ratio_cur; +- else ++ if (clamping) { ++ if (poll_pkg_cstate_enable) ++ *state = pkg_cstate_ratio_cur; ++ else ++ *state = set_target_ratio; ++ } else { + /* to save power, do not poll idle ratio while not clamping */ + *state = -1; /* indicates invalid state */ ++ } + + return 0; + } +@@ -712,6 +721,9 @@ static int __init powerclamp_init(void) + goto exit_unregister; + } + ++ if (topology_max_packages() == 1 && topology_max_die_per_package() == 1) ++ poll_pkg_cstate_enable = true; ++ + cooling_dev = thermal_cooling_device_register("intel_powerclamp", NULL, + &powerclamp_cooling_ops); + if (IS_ERR(cooling_dev)) { +-- +2.35.3 + diff --git a/patches.suse/thermal-intel-quark_dts-fix-error-pointer-dereferenc.patch b/patches.suse/thermal-intel-quark_dts-fix-error-pointer-dereferenc.patch new file mode 100644 index 0000000..f6fc1a8 --- /dev/null +++ b/patches.suse/thermal-intel-quark_dts-fix-error-pointer-dereferenc.patch @@ -0,0 +1,52 @@ +From f1b930e740811d416de4d2074da48b6633a672c8 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 27 Feb 2023 13:06:50 +0300 +Subject: [PATCH] thermal: intel: quark_dts: fix error pointer dereference +Git-commit: f1b930e740811d416de4d2074da48b6633a672c8 +Patch-mainline: v6.3-rc1 +References: git-fixes + +If alloc_soc_dts() fails, then we can just return. Trying to free +"soc_dts" will lead to an Oops. + +Fixes: 8c1876939663 ("thermal: intel Quark SoC X1000 DTS thermal driver") +Signed-off-by: Dan Carpenter +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/thermal/intel/intel_quark_dts_thermal.c | 12 ++---------- + 1 file changed, 2 insertions(+), 10 deletions(-) + +diff --git a/drivers/thermal/intel/intel_quark_dts_thermal.c b/drivers/thermal/intel/intel_quark_dts_thermal.c +index 97b843fa7568..ffdc95047838 100644 +--- a/drivers/thermal/intel/intel_quark_dts_thermal.c ++++ b/drivers/thermal/intel/intel_quark_dts_thermal.c +@@ -400,22 +400,14 @@ MODULE_DEVICE_TABLE(x86cpu, qrk_thermal_ids); + + static int __init intel_quark_thermal_init(void) + { +- int err = 0; +- + if (!x86_match_cpu(qrk_thermal_ids) || !iosf_mbi_available()) + return -ENODEV; + + soc_dts = alloc_soc_dts(); +- if (IS_ERR(soc_dts)) { +- err = PTR_ERR(soc_dts); +- goto err_free; +- } ++ if (IS_ERR(soc_dts)) ++ return PTR_ERR(soc_dts); + + return 0; +- +-err_free: +- free_soc_dts(soc_dts); +- return err; + } + + static void __exit intel_quark_thermal_exit(void) +-- +2.35.3 + diff --git a/patches.suse/tty-serial-fsl_lpuart-Fix-the-wrong-RXWATER-setting-.patch b/patches.suse/tty-serial-fsl_lpuart-Fix-the-wrong-RXWATER-setting-.patch new file mode 100644 index 0000000..045cf9f --- /dev/null +++ b/patches.suse/tty-serial-fsl_lpuart-Fix-the-wrong-RXWATER-setting-.patch @@ -0,0 +1,40 @@ +From 9ad9df8447547febe9dd09b040f4528a09e495f0 Mon Sep 17 00:00:00 2001 +From: Sherry Sun +Date: Mon, 30 Jan 2023 14:44:46 +0800 +Subject: [PATCH] tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx dma case +Git-commit: 9ad9df8447547febe9dd09b040f4528a09e495f0 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The RXWATER value must be greater than 0 according to the LPUART +reference manual. And when the number of datawords in the receive +FIFO is greater than RXWATER, an interrupt or a DMA request is +generated, so no need to set the different value for lpuart interrupt +case and dma case. Here delete the wrong RXWATER setting for dma case +directly. + +Fixes: 42b68768e51b ("serial: fsl_lpuart: DMA support for 32-bit variant") +Signed-off-by: Sherry Sun +Link: https://lore.kernel.org/r/20230130064449.9564-4-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/serial/fsl_lpuart.c | 6 ------ + 1 file changed, 6 deletions(-) + +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1700,12 +1700,6 @@ static void lpuart32_configure(struct lp + { + unsigned long temp; + +- if (sport->lpuart_dma_rx_use) { +- /* RXWATER must be 0 */ +- temp = lpuart32_read(&sport->port, UARTWATER); +- temp &= ~(UARTWATER_WATER_MASK << UARTWATER_RXWATER_OFF); +- lpuart32_write(&sport->port, temp, UARTWATER); +- } + temp = lpuart32_read(&sport->port, UARTCTRL); + if (!sport->lpuart_dma_rx_use) + temp |= UARTCTRL_RIE; diff --git a/patches.suse/tty-serial-fsl_lpuart-clear-LPUART-Status-Register-i.patch b/patches.suse/tty-serial-fsl_lpuart-clear-LPUART-Status-Register-i.patch new file mode 100644 index 0000000..aead563 --- /dev/null +++ b/patches.suse/tty-serial-fsl_lpuart-clear-LPUART-Status-Register-i.patch @@ -0,0 +1,39 @@ +From 4029dfc034febb54f6dd8ea83568accc943bc088 Mon Sep 17 00:00:00 2001 +From: Sherry Sun +Date: Fri, 25 Nov 2022 18:19:53 +0800 +Subject: [PATCH] tty: serial: fsl_lpuart: clear LPUART Status Register in lpuart32_shutdown() +Git-commit: 4029dfc034febb54f6dd8ea83568accc943bc088 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The LPUART Status Register needs to be cleared when closing the uart +port to get a clean environment when reopening the uart. + +Fixes: 380c966c093e ("tty: serial: fsl_lpuart: add 32-bit register interface support") +Signed-off-by: Sherry Sun +Link: https://lore.kernel.org/r/20221125101953.18753-4-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/serial/fsl_lpuart.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 88697ddcd8c4..8918e08bb19e 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1799,6 +1799,10 @@ static void lpuart32_shutdown(struct uart_port *port) + + spin_lock_irqsave(&port->lock, flags); + ++ /* clear status */ ++ temp = lpuart32_read(&sport->port, UARTSTAT); ++ lpuart32_write(&sport->port, temp, UARTSTAT); ++ + /* disable Rx/Tx DMA */ + temp = lpuart32_read(port, UARTBAUD); + temp &= ~(UARTBAUD_TDMAE | UARTBAUD_RDMAE); +-- +2.35.3 + diff --git a/patches.suse/tty-serial-fsl_lpuart-disable-Rx-Tx-DMA-in-lpuart32_.patch b/patches.suse/tty-serial-fsl_lpuart-disable-Rx-Tx-DMA-in-lpuart32_.patch new file mode 100644 index 0000000..71d5cdb --- /dev/null +++ b/patches.suse/tty-serial-fsl_lpuart-disable-Rx-Tx-DMA-in-lpuart32_.patch @@ -0,0 +1,37 @@ +From 1d4bd0e4ae4ba95892bef919a8d4d3f08f122d7e Mon Sep 17 00:00:00 2001 +From: Sherry Sun +Date: Fri, 25 Nov 2022 18:19:52 +0800 +Subject: [PATCH] tty: serial: fsl_lpuart: disable Rx/Tx DMA in lpuart32_shutdown() +Git-commit: 1d4bd0e4ae4ba95892bef919a8d4d3f08f122d7e +Patch-mainline: v6.3-rc1 +References: git-fixes + +UARTBAUD_RDMAE and UARTBAUD_TDMAE are enabled in lpuart32_startup(), but +lpuart32_shutdown() not disable them, only free the dma ring buffer and +release the dma channels, so here disable the Rx/Tx DMA first in +lpuart32_shutdown(). + +Fixes: 42b68768e51b ("serial: fsl_lpuart: DMA support for 32-bit variant") +Signed-off-by: Sherry Sun +Link: https://lore.kernel.org/r/20221125101953.18753-3-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/serial/fsl_lpuart.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1807,6 +1807,11 @@ static void lpuart32_shutdown(struct uar + + spin_lock_irqsave(&port->lock, flags); + ++ /* disable Rx/Tx DMA */ ++ temp = lpuart32_read(port, UARTBAUD); ++ temp &= ~(UARTBAUD_TDMAE | UARTBAUD_RDMAE); ++ lpuart32_write(port, temp, UARTBAUD); ++ + /* disable Rx/Tx and interrupts */ + temp = lpuart32_read(port, UARTCTRL); + temp &= ~(UARTCTRL_TE | UARTCTRL_RE | diff --git a/patches.suse/tty-serial-qcom-geni-serial-stop-operations-in-progr.patch b/patches.suse/tty-serial-qcom-geni-serial-stop-operations-in-progr.patch new file mode 100644 index 0000000..32250be --- /dev/null +++ b/patches.suse/tty-serial-qcom-geni-serial-stop-operations-in-progr.patch @@ -0,0 +1,39 @@ +From d8aca2f96813d51df574a811eda9a2cbed00f261 Mon Sep 17 00:00:00 2001 +From: Bartosz Golaszewski +Date: Thu, 29 Dec 2022 16:50:17 +0100 +Subject: [PATCH] tty: serial: qcom-geni-serial: stop operations in progress at shutdown +Git-commit: d8aca2f96813d51df574a811eda9a2cbed00f261 +Patch-mainline: v6.3-rc1 +References: git-fixes + +We don't stop transmissions in progress at shutdown. This is fine with +FIFO SE mode but with DMA (support for which we'll introduce later) it +causes trouble so fix it now. + +Fixes: e83766334f96 ("tty: serial: qcom_geni_serial: No need to stop tx/rx on UART shutdown") +Signed-off-by: Bartosz Golaszewski +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20221229155030.418800-2-brgl@bgdev.pl +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/serial/qcom_geni_serial.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c +index b487823f0e61..4f4c12f3c433 100644 +--- a/drivers/tty/serial/qcom_geni_serial.c ++++ b/drivers/tty/serial/qcom_geni_serial.c +@@ -880,6 +880,8 @@ static void get_tx_fifo_size(struct qcom_geni_serial_port *port) + static void qcom_geni_serial_shutdown(struct uart_port *uport) + { + disable_irq(uport->irq); ++ qcom_geni_serial_stop_tx(uport); ++ qcom_geni_serial_stop_rx(uport); + } + + static int qcom_geni_serial_port_setup(struct uart_port *uport) +-- +2.35.3 + diff --git a/patches.suse/usb-dwc3-pci-add-support-for-the-Intel-Meteor-Lake-M.patch b/patches.suse/usb-dwc3-pci-add-support-for-the-Intel-Meteor-Lake-M.patch new file mode 100644 index 0000000..2152fc0 --- /dev/null +++ b/patches.suse/usb-dwc3-pci-add-support-for-the-Intel-Meteor-Lake-M.patch @@ -0,0 +1,46 @@ +From 8e5248c3a8778f3e394e9a19195bc7a48f567ca2 Mon Sep 17 00:00:00 2001 +From: Heikki Krogerus +Date: Wed, 15 Feb 2023 15:27:11 +0200 +Subject: [PATCH] usb: dwc3: pci: add support for the Intel Meteor Lake-M +Git-commit: 8e5248c3a8778f3e394e9a19195bc7a48f567ca2 +Patch-mainline: v6.3-rc1 +References: git-fixes + +This patch adds the necessary PCI IDs for Intel Meteor Lake-M +devices. + +Signed-off-by: Heikki Krogerus +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230215132711.35668-1-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/dwc3/dwc3-pci.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index 89c9ab2b19f8..a23ddbb81979 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -47,6 +47,7 @@ + #define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1 + #define PCI_DEVICE_ID_INTEL_RPL 0xa70e + #define PCI_DEVICE_ID_INTEL_RPLS 0x7a61 ++#define PCI_DEVICE_ID_INTEL_MTLM 0x7eb1 + #define PCI_DEVICE_ID_INTEL_MTLP 0x7ec1 + #define PCI_DEVICE_ID_INTEL_MTL 0x7e7e + #define PCI_DEVICE_ID_INTEL_TGL 0x9a15 +@@ -467,6 +468,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = { + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_RPLS), + (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTLM), ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, ++ + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTLP), + (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + +-- +2.35.3 + diff --git a/patches.suse/usb-early-xhci-dbc-Fix-a-potential-out-of-bound-memo.patch b/patches.suse/usb-early-xhci-dbc-Fix-a-potential-out-of-bound-memo.patch new file mode 100644 index 0000000..bffdfcd --- /dev/null +++ b/patches.suse/usb-early-xhci-dbc-Fix-a-potential-out-of-bound-memo.patch @@ -0,0 +1,41 @@ +From a4a97ab3db5c081eb6e7dba91306adefb461e0bd Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sun, 29 Jan 2023 19:23:08 +0100 +Subject: [PATCH] usb: early: xhci-dbc: Fix a potential out-of-bound memory access +Git-commit: a4a97ab3db5c081eb6e7dba91306adefb461e0bd +Patch-mainline: v6.3-rc1 +References: git-fixes + +If xdbc_bulk_write() fails, the values in 'buf' can be anything. So the +string is not guaranteed to be NULL terminated when xdbc_trace() is called. + +Reserve an extra byte, which will be zeroed automatically because 'buf' is +a static variable, in order to avoid troubles, should it happen. + +Fixes: aeb9dd1de98c ("usb/early: Add driver for xhci debug capability") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/d6a7562c5e839a195cee85db6dc81817f9372cb1.1675016180.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/early/xhci-dbc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/early/xhci-dbc.c b/drivers/usb/early/xhci-dbc.c +index 797047154820..f3e23be227d4 100644 +--- a/drivers/usb/early/xhci-dbc.c ++++ b/drivers/usb/early/xhci-dbc.c +@@ -874,7 +874,8 @@ static int xdbc_bulk_write(const char *bytes, int size) + + static void early_xdbc_write(struct console *con, const char *str, u32 n) + { +- static char buf[XDBC_MAX_PACKET]; ++ /* static variables are zeroed, so buf is always NULL terminated */ ++ static char buf[XDBC_MAX_PACKET + 1]; + int chunk, ret; + int use_cr = 0; + +-- +2.35.3 + diff --git a/patches.suse/usb-gadget-fusb300_udc-free-irq-on-the-error-path-in.patch b/patches.suse/usb-gadget-fusb300_udc-free-irq-on-the-error-path-in.patch new file mode 100644 index 0000000..b66157c --- /dev/null +++ b/patches.suse/usb-gadget-fusb300_udc-free-irq-on-the-error-path-in.patch @@ -0,0 +1,72 @@ +From a8d3392e0e5cfeb03f0cea1f2bc3f5f183c1deb4 Mon Sep 17 00:00:00 2001 +From: Gaosheng Cui +Date: Wed, 23 Nov 2022 09:41:21 +0800 +Subject: [PATCH] usb: gadget: fusb300_udc: free irq on the error path in fusb300_probe() +Git-commit: a8d3392e0e5cfeb03f0cea1f2bc3f5f183c1deb4 +Patch-mainline: v6.3-rc1 +References: git-fixes + +When request_irq(ires1->start) failed in w5300_hw_probe(), irq +ires->start has not been freed, and on the clean_up3 error path, +we also need to free ires1->start irq, fix it. + +In addition, We should add free_irq in fusb300_remove(), and give +the lables a proper name so that they can be understood easily, +so add free_irq in fusb300_remove(), and update clean_up3 to +err_alloc_request. + +Fixes: 0fe6f1d1f612 ("usb: udc: add Faraday fusb300 driver") +Signed-off-by: Gaosheng Cui +Link: https://lore.kernel.org/r/20221123014121.1989721-1-cuigaosheng1@huawei.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/gadget/udc/fusb300_udc.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/gadget/udc/fusb300_udc.c b/drivers/usb/gadget/udc/fusb300_udc.c +index 9af8b415f303..5e9e8e56e2d0 100644 +--- a/drivers/usb/gadget/udc/fusb300_udc.c ++++ b/drivers/usb/gadget/udc/fusb300_udc.c +@@ -1347,6 +1347,7 @@ static int fusb300_remove(struct platform_device *pdev) + usb_del_gadget_udc(&fusb300->gadget); + iounmap(fusb300->reg); + free_irq(platform_get_irq(pdev, 0), fusb300); ++ free_irq(platform_get_irq(pdev, 1), fusb300); + + fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req); + for (i = 0; i < FUSB300_MAX_NUM_EP; i++) +@@ -1432,7 +1433,7 @@ static int fusb300_probe(struct platform_device *pdev) + IRQF_SHARED, udc_name, fusb300); + if (ret < 0) { + pr_err("request_irq1 error (%d)\n", ret); +- goto clean_up; ++ goto err_request_irq1; + } + + INIT_LIST_HEAD(&fusb300->gadget.ep_list); +@@ -1471,7 +1472,7 @@ static int fusb300_probe(struct platform_device *pdev) + GFP_KERNEL); + if (fusb300->ep0_req == NULL) { + ret = -ENOMEM; +- goto clean_up3; ++ goto err_alloc_request; + } + + init_controller(fusb300); +@@ -1486,7 +1487,10 @@ static int fusb300_probe(struct platform_device *pdev) + err_add_udc: + fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req); + +-clean_up3: ++err_alloc_request: ++ free_irq(ires1->start, fusb300); ++ ++err_request_irq1: + free_irq(ires->start, fusb300); + + clean_up: +-- +2.35.3 + diff --git a/patches.suse/usb-gadget-u_serial-Add-null-pointer-check-in-gseria.patch b/patches.suse/usb-gadget-u_serial-Add-null-pointer-check-in-gseria.patch new file mode 100644 index 0000000..c5f0555 --- /dev/null +++ b/patches.suse/usb-gadget-u_serial-Add-null-pointer-check-in-gseria.patch @@ -0,0 +1,90 @@ +From 5ec63fdbca604568890c577753c6f66c5b3ef0b5 Mon Sep 17 00:00:00 2001 +From: Prashanth K +Date: Mon, 13 Feb 2023 23:00:38 +0530 +Subject: [PATCH] usb: gadget: u_serial: Add null pointer check in + gserial_resume +Git-commit: 5ec63fdbca604568890c577753c6f66c5b3ef0b5 +References: git-fixes +Patch-mainline: v6.3-rc1 + +Consider a case where gserial_disconnect has already cleared +gser->ioport. And if a wakeup interrupt triggers afterwards, +gserial_resume gets called, which will lead to accessing of +gser->ioport and thus causing null pointer dereference.Add +a null pointer check to prevent this. + +Added a static spinlock to prevent gser->ioport from becoming +null after the newly added check. + +Fixes: aba3a8d01d62 ("usb: gadget: u_serial: add suspend resume callbacks") +Cc: stable +Signed-off-by: Prashanth K +Acked-by: Alan Stern +Link: https://lore.kernel.org/r/1676309438-14922-1-git-send-email-quic_prashk@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Oliver Neukum +--- + drivers/usb/gadget/function/u_serial.c | 23 +++++++++++++++++++---- + 1 file changed, 19 insertions(+), 4 deletions(-) + +diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c +index 840626e064e1..a0ca47fbff0f 100644 +--- a/drivers/usb/gadget/function/u_serial.c ++++ b/drivers/usb/gadget/function/u_serial.c +@@ -82,6 +82,9 @@ + #define WRITE_BUF_SIZE 8192 /* TX only */ + #define GS_CONSOLE_BUF_SIZE 8192 + ++/* Prevents race conditions while accessing gser->ioport */ ++static DEFINE_SPINLOCK(serial_port_lock); ++ + /* console info */ + struct gs_console { + struct console console; +@@ -1375,8 +1378,10 @@ void gserial_disconnect(struct gserial *gser) + if (!port) + return; + ++ spin_lock_irqsave(&serial_port_lock, flags); ++ + /* tell the TTY glue not to do I/O here any more */ +- spin_lock_irqsave(&port->port_lock, flags); ++ spin_lock(&port->port_lock); + + gs_console_disconnect(port); + +@@ -1391,7 +1396,8 @@ void gserial_disconnect(struct gserial *gser) + tty_hangup(port->port.tty); + } + port->suspended = false; +- spin_unlock_irqrestore(&port->port_lock, flags); ++ spin_unlock(&port->port_lock); ++ spin_unlock_irqrestore(&serial_port_lock, flags); + + /* disable endpoints, aborting down any active I/O */ + usb_ep_disable(gser->out); +@@ -1425,10 +1431,19 @@ EXPORT_SYMBOL_GPL(gserial_suspend); + + void gserial_resume(struct gserial *gser) + { +- struct gs_port *port = gser->ioport; ++ struct gs_port *port; + unsigned long flags; + +- spin_lock_irqsave(&port->port_lock, flags); ++ spin_lock_irqsave(&serial_port_lock, flags); ++ port = gser->ioport; ++ ++ if (!port) { ++ spin_unlock_irqrestore(&serial_port_lock, flags); ++ return; ++ } ++ ++ spin_lock(&port->port_lock); ++ spin_unlock(&serial_port_lock); + port->suspended = false; + if (!port->start_delayed) { + spin_unlock_irqrestore(&port->port_lock, flags); +-- +2.39.2 + diff --git a/patches.suse/usb-max-3421-Fix-setting-of-I-O-pins.patch b/patches.suse/usb-max-3421-Fix-setting-of-I-O-pins.patch new file mode 100644 index 0000000..4821cd7 --- /dev/null +++ b/patches.suse/usb-max-3421-Fix-setting-of-I-O-pins.patch @@ -0,0 +1,39 @@ +From a7efe3fc7cbe27c6eb2c2a3ab612194f8f800f4c Mon Sep 17 00:00:00 2001 +From: Mark Tomlinson +Date: Tue, 7 Feb 2023 16:33:37 +1300 +Subject: [PATCH] usb: max-3421: Fix setting of I/O pins +Git-commit: a7efe3fc7cbe27c6eb2c2a3ab612194f8f800f4c +Patch-mainline: v6.3-rc1 +References: git-fixes + +To update the I/O pins, the registers are read/modified/written. The +read operation incorrectly always read the first register. Although +wrong, there wasn't any impact as all the output pins are always +written, and the inputs are read only anyway. + +Fixes: 2d53139f3162 ("Add support for using a MAX3421E chip as a host driver.") +Signed-off-by: Mark Tomlinson +Link: https://lore.kernel.org/r/20230207033337.18112-1-mark.tomlinson@alliedtelesis.co.nz +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/host/max3421-hcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c +index 9a87056fc738..28d1524ee2fa 100644 +--- a/drivers/usb/host/max3421-hcd.c ++++ b/drivers/usb/host/max3421-hcd.c +@@ -1427,7 +1427,7 @@ max3421_spi_thread(void *dev_id) + * use spi_wr_buf(). + */ + for (i = 0; i < ARRAY_SIZE(max3421_hcd->iopins); ++i) { +- u8 val = spi_rd8(hcd, MAX3421_REG_IOPINS1); ++ u8 val = spi_rd8(hcd, MAX3421_REG_IOPINS1 + i); + + val = ((val & 0xf0) | + (max3421_hcd->iopins[i] & 0x0f)); +-- +2.35.3 + diff --git a/patches.suse/usb-musb-mediatek-don-t-unregister-something-that-wa.patch b/patches.suse/usb-musb-mediatek-don-t-unregister-something-that-wa.patch new file mode 100644 index 0000000..5f74574 --- /dev/null +++ b/patches.suse/usb-musb-mediatek-don-t-unregister-something-that-wa.patch @@ -0,0 +1,39 @@ +From ba883de971d1ad018f3083d9195b8abe54d87407 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 24 Jan 2023 18:20:46 +0300 +Subject: [PATCH] usb: musb: mediatek: don't unregister something that wasn't registered +Git-commit: ba883de971d1ad018f3083d9195b8abe54d87407 +Patch-mainline: v6.3-rc1 +References: git-fixes + +This function only calls mtk_otg_switch_init() when the ->port_mode +is MUSB_OTG so the clean up code should only call mtk_otg_switch_exit() +for that mode. + +Fixes: 0990366bab3c ("usb: musb: Add support for MediaTek musb controller") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/Y8/3TqpqiSr0RxFH@kili +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/musb/mediatek.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/musb/mediatek.c b/drivers/usb/musb/mediatek.c +index cad991380b0c..27b9bd258340 100644 +--- a/drivers/usb/musb/mediatek.c ++++ b/drivers/usb/musb/mediatek.c +@@ -294,7 +294,8 @@ static int mtk_musb_init(struct musb *musb) + err_phy_power_on: + phy_exit(glue->phy); + err_phy_init: +- mtk_otg_switch_exit(glue); ++ if (musb->port_mode == MUSB_OTG) ++ mtk_otg_switch_exit(glue); + return ret; + } + +-- +2.35.3 + diff --git a/patches.suse/vc_screen-don-t-clobber-return-value-in-vcs_read.patch b/patches.suse/vc_screen-don-t-clobber-return-value-in-vcs_read.patch new file mode 100644 index 0000000..edafa90 --- /dev/null +++ b/patches.suse/vc_screen-don-t-clobber-return-value-in-vcs_read.patch @@ -0,0 +1,61 @@ +From ae3419fbac845b4d3f3a9fae4cc80c68d82cdf6e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= +Date: Mon, 20 Feb 2023 06:46:12 +0000 +Subject: [PATCH] vc_screen: don't clobber return value in vcs_read +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: ae3419fbac845b4d3f3a9fae4cc80c68d82cdf6e +Patch-mainline: v6.3-rc1 +References: git-fixes + +Commit 226fae124b2d ("vc_screen: move load of struct vc_data pointer in +vcs_read() to avoid UAF") moved the call to vcs_vc() into the loop. + +While doing this it also moved the unconditional assignment of + + ret = -ENXIO; + +This unconditional assignment was valid outside the loop but within it +it clobbers the actual value of ret. + +To avoid this only assign "ret = -ENXIO" when actually needed. + +[ Also, the 'goto unlock_out" needs to be just a "break", so that it + does the right thing when it exits on later iterations when partial + success has happened - Linus ] + +Reported-by: Storm Dragon +Link: https://lore.kernel.org/lkml/Y%2FKS6vdql2pIsCiI@hotmail.com/ +Fixes: 226fae124b2d ("vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF") +Signed-off-by: Thomas Weißschuh +Link: https://lore.kernel.org/lkml/64981d94-d00c-4b31-9063-43ad0a384bde@t-8ch.de/ +Signed-off-by: Linus Torvalds +Acked-by: Takashi Iwai + +--- + drivers/tty/vt/vc_screen.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c +index c0a2273bb998..1dc07f9214d5 100644 +--- a/drivers/tty/vt/vc_screen.c ++++ b/drivers/tty/vt/vc_screen.c +@@ -403,10 +403,11 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos) + unsigned int this_round, skip = 0; + int size; + +- ret = -ENXIO; + vc = vcs_vc(inode, &viewed); +- if (!vc) +- goto unlock_out; ++ if (!vc) { ++ ret = -ENXIO; ++ break; ++ } + + /* Check whether we are above size each round, + * as copy_to_user at the end of this loop +-- +2.35.3 + diff --git a/patches.suse/vc_screen-modify-vcs_size-handling-in-vcs_read.patch b/patches.suse/vc_screen-modify-vcs_size-handling-in-vcs_read.patch new file mode 100644 index 0000000..9fb6179 --- /dev/null +++ b/patches.suse/vc_screen-modify-vcs_size-handling-in-vcs_read.patch @@ -0,0 +1,40 @@ +From 46d733d0efc79bc8430d63b57ab88011806d5180 Mon Sep 17 00:00:00 2001 +From: George Kennedy +Date: Mon, 27 Feb 2023 15:21:41 -0500 +Subject: [PATCH] vc_screen: modify vcs_size() handling in vcs_read() +Git-commit: 46d733d0efc79bc8430d63b57ab88011806d5180 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Restore the vcs_size() handling in vcs_read() to what +it had been in previous version. + +Fixes: 226fae124b2d ("vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF") +Suggested-by: Jiri Slaby +Signed-off-by: George Kennedy +Signed-off-by: Linus Torvalds +Acked-by: Takashi Iwai + +--- + drivers/tty/vt/vc_screen.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c +index f566eb1839dc..c0a2273bb998 100644 +--- a/drivers/tty/vt/vc_screen.c ++++ b/drivers/tty/vt/vc_screen.c +@@ -414,10 +414,8 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos) + */ + size = vcs_size(vc, attr, uni_mode); + if (size < 0) { +- if (read) +- break; + ret = size; +- goto unlock_out; ++ break; + } + if (pos >= size) + break; +-- +2.35.3 + diff --git a/patches.suse/vdpa_sim-not-reset-state-in-vdpasim_queue_ready.patch b/patches.suse/vdpa_sim-not-reset-state-in-vdpasim_queue_ready.patch new file mode 100644 index 0000000..ae0c904 --- /dev/null +++ b/patches.suse/vdpa_sim-not-reset-state-in-vdpasim_queue_ready.patch @@ -0,0 +1,54 @@ +From 0e84f918fac8ae61dcb790534fad5e3555ca2930 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= +Date: Wed, 18 Jan 2023 17:43:58 +0100 +Subject: [PATCH] vdpa_sim: not reset state in vdpasim_queue_ready +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 0e84f918fac8ae61dcb790534fad5e3555ca2930 +Patch-mainline: v6.3-rc1 +References: git-fixes + +vdpasim_queue_ready calls vringh_init_iotlb, which resets split indexes. +But it can be called after setting a ring base with +vdpasim_set_vq_state. + +Fix it by stashing them. They're still resetted in vdpasim_vq_reset. + +This was discovered and tested live migrating the vdpa_sim_net device. + +Fixes: 2c53d0f64c06 ("vdpasim: vDPA device simulator") +Signed-off-by: Eugenio Pérez +Message-id: <20230118164359.1523760-2-eperezma@redhat.com> +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Tested-by: Lei Yang +Acked-by: Takashi Iwai + +--- + drivers/vdpa/vdpa_sim/vdpa_sim.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/vdpa/vdpa_sim/vdpa_sim.c b/drivers/vdpa/vdpa_sim/vdpa_sim.c +index cb88891b44a8..8839232a3fcb 100644 +--- a/drivers/vdpa/vdpa_sim/vdpa_sim.c ++++ b/drivers/vdpa/vdpa_sim/vdpa_sim.c +@@ -66,6 +66,7 @@ static void vdpasim_vq_notify(struct vringh *vring) + static void vdpasim_queue_ready(struct vdpasim *vdpasim, unsigned int idx) + { + struct vdpasim_virtqueue *vq = &vdpasim->vqs[idx]; ++ uint16_t last_avail_idx = vq->vring.last_avail_idx; + + vringh_init_iotlb(&vq->vring, vdpasim->features, vq->num, false, + (struct vring_desc *)(uintptr_t)vq->desc_addr, +@@ -74,6 +75,7 @@ static void vdpasim_queue_ready(struct vdpasim *vdpasim, unsigned int idx) + (struct vring_used *) + (uintptr_t)vq->device_addr); + ++ vq->vring.last_avail_idx = last_avail_idx; + vq->vring.notify = vdpasim_vq_notify; + } + +-- +2.35.3 + diff --git a/patches.suse/watchdog-Fix-kmemleak-in-watchdog_cdev_register.patch b/patches.suse/watchdog-Fix-kmemleak-in-watchdog_cdev_register.patch new file mode 100644 index 0000000..8c4a807 --- /dev/null +++ b/patches.suse/watchdog-Fix-kmemleak-in-watchdog_cdev_register.patch @@ -0,0 +1,91 @@ +From 13721a2ac66b246f5802ba1b75ad8637e53eeecc Mon Sep 17 00:00:00 2001 +From: Chen Jun +Date: Wed, 16 Nov 2022 01:27:14 +0000 +Subject: [PATCH] watchdog: Fix kmemleak in watchdog_cdev_register +Git-commit: 13721a2ac66b246f5802ba1b75ad8637e53eeecc +Patch-mainline: v6.3-rc1 +References: git-fixes + +kmemleak reports memory leaks in watchdog_dev_register, as follows: +unreferenced object 0xffff888116233000 (size 2048): + comm ""modprobe"", pid 28147, jiffies 4353426116 (age 61.741s) + hex dump (first 32 bytes): + 80 fa b9 05 81 88 ff ff 08 30 23 16 81 88 ff ff .........0#..... + 08 30 23 16 81 88 ff ff 00 00 00 00 00 00 00 00 .0#............. + backtrace: + [<000000007f001ffd>] __kmem_cache_alloc_node+0x157/0x220 + [<000000006a389304>] kmalloc_trace+0x21/0x110 + [<000000008d640eea>] watchdog_dev_register+0x4e/0x780 [watchdog] + [<0000000053c9f248>] __watchdog_register_device+0x4f0/0x680 [watchdog] + [<00000000b2979824>] watchdog_register_device+0xd2/0x110 [watchdog] + [<000000001f730178>] 0xffffffffc10880ae + [<000000007a1a8bcc>] do_one_initcall+0xcb/0x4d0 + [<00000000b98be325>] do_init_module+0x1ca/0x5f0 + [<0000000046d08e7c>] load_module+0x6133/0x70f0 + ... + +unreferenced object 0xffff888105b9fa80 (size 16): + comm ""modprobe"", pid 28147, jiffies 4353426116 (age 61.741s) + hex dump (first 16 bytes): + 77 61 74 63 68 64 6f 67 31 00 b9 05 81 88 ff ff watchdog1....... + backtrace: + [<000000007f001ffd>] __kmem_cache_alloc_node+0x157/0x220 + [<00000000486ab89b>] __kmalloc_node_track_caller+0x44/0x1b0 + [<000000005a39aab0>] kvasprintf+0xb5/0x140 + [<0000000024806f85>] kvasprintf_const+0x55/0x180 + [<000000009276cb7f>] kobject_set_name_vargs+0x56/0x150 + [<00000000a92e820b>] dev_set_name+0xab/0xe0 + [<00000000cec812c6>] watchdog_dev_register+0x285/0x780 [watchdog] + [<0000000053c9f248>] __watchdog_register_device+0x4f0/0x680 [watchdog] + [<00000000b2979824>] watchdog_register_device+0xd2/0x110 [watchdog] + [<000000001f730178>] 0xffffffffc10880ae + [<000000007a1a8bcc>] do_one_initcall+0xcb/0x4d0 + [<00000000b98be325>] do_init_module+0x1ca/0x5f0 + [<0000000046d08e7c>] load_module+0x6133/0x70f0 + ... + +The reason is that put_device is not be called if cdev_device_add fails +and wdd->id != 0. + +watchdog_cdev_register + wd_data = kzalloc [1] + err = dev_set_name [2] + .. + err = cdev_device_add + if (err) { + if (wdd->id == 0) { // wdd->id != 0 + .. + } + return err; // [1],[2] would be leaked + +To fix it, call put_device in all wdd->id cases. + +Fixes: 72139dfa2464 ("watchdog: Fix the race between the release of watchdog_core_data and cdev") +Signed-off-by: Chen Jun +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20221116012714.102066-1-chenjun102@huawei.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Acked-by: Takashi Iwai + +--- + drivers/watchdog/watchdog_dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c +index f31608f3e324..455a9a572d7b 100644 +--- a/drivers/watchdog/watchdog_dev.c ++++ b/drivers/watchdog/watchdog_dev.c +@@ -1062,8 +1062,8 @@ static int watchdog_cdev_register(struct watchdog_device *wdd) + if (wdd->id == 0) { + misc_deregister(&watchdog_miscdev); + old_wd_data = NULL; +- put_device(&wd_data->dev); + } ++ put_device(&wd_data->dev); + return err; + } + +-- +2.35.3 + diff --git a/patches.suse/watchdog-at91sam9_wdt-use-devm_request_irq-to-avoid-.patch b/patches.suse/watchdog-at91sam9_wdt-use-devm_request_irq-to-avoid-.patch new file mode 100644 index 0000000..340ac92 --- /dev/null +++ b/patches.suse/watchdog-at91sam9_wdt-use-devm_request_irq-to-avoid-.patch @@ -0,0 +1,45 @@ +From 07bec0e09c1afbab4c5674fd2341f4f52d594f30 Mon Sep 17 00:00:00 2001 +From: ruanjinjie +Date: Wed, 16 Nov 2022 17:49:50 +0800 +Subject: [PATCH] watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path +Git-commit: 07bec0e09c1afbab4c5674fd2341f4f52d594f30 +Patch-mainline: v6.3-rc1 +References: git-fixes + +free_irq() is missing in case of error in at91_wdt_init(), use +devm_request_irq to fix that. + +Fixes: 5161b31dc39a ("watchdog: at91sam9_wdt: better watchdog support") +Signed-off-by: ruanjinjie +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20221116094950.3141943-1-ruanjinjie@huawei.com +[groeck: Adjust multi-line alignment] +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Acked-by: Takashi Iwai + +--- + drivers/watchdog/at91sam9_wdt.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/watchdog/at91sam9_wdt.c b/drivers/watchdog/at91sam9_wdt.c +index 292b5a1ca831..fed7be246442 100644 +--- a/drivers/watchdog/at91sam9_wdt.c ++++ b/drivers/watchdog/at91sam9_wdt.c +@@ -206,10 +206,9 @@ static int at91_wdt_init(struct platform_device *pdev, struct at91wdt *wdt) + "min heartbeat and max heartbeat might be too close for the system to handle it correctly\n"); + + if ((tmp & AT91_WDT_WDFIEN) && wdt->irq) { +- err = request_irq(wdt->irq, wdt_interrupt, +- IRQF_SHARED | IRQF_IRQPOLL | +- IRQF_NO_SUSPEND, +- pdev->name, wdt); ++ err = devm_request_irq(dev, wdt->irq, wdt_interrupt, ++ IRQF_SHARED | IRQF_IRQPOLL | IRQF_NO_SUSPEND, ++ pdev->name, wdt); + if (err) + return err; + } +-- +2.35.3 + diff --git a/patches.suse/watchdog-pcwd_usb-Fix-attempting-to-access-uninitial.patch b/patches.suse/watchdog-pcwd_usb-Fix-attempting-to-access-uninitial.patch new file mode 100644 index 0000000..f3c763d --- /dev/null +++ b/patches.suse/watchdog-pcwd_usb-Fix-attempting-to-access-uninitial.patch @@ -0,0 +1,64 @@ +From 7d06c07c67100fd0f8e6b3ab7145ce789f788117 Mon Sep 17 00:00:00 2001 +From: Li Hua +Date: Wed, 16 Nov 2022 10:07:06 +0800 +Subject: [PATCH] watchdog: pcwd_usb: Fix attempting to access uninitialized memory +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 7d06c07c67100fd0f8e6b3ab7145ce789f788117 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The stack variable msb and lsb may be used uninitialized in function +usb_pcwd_get_temperature and usb_pcwd_get_timeleft when usb card no response. + +The build waring is: +drivers/watchdog/pcwd_usb.c:336:22: error: ‘lsb’ is used uninitialized in this function [-Werror=uninitialized] + *temperature = (lsb * 9 / 5) + 32; + ~~~~^~~ +drivers/watchdog/pcwd_usb.c:328:21: note: ‘lsb’ was declared here + unsigned char msb, lsb; + ^~~ +Cc1: all warnings being treated as errors +scripts/Makefile.build:250: recipe for target 'drivers/watchdog/pcwd_usb.o' failed +Make[3]: *** [drivers/watchdog/pcwd_usb.o] Error 1 + +Fixes: b7e04f8c61a4 ("mv watchdog tree under drivers") +Signed-off-by: Li Hua +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20221116020706.70847-1-hucool.lihua@huawei.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Acked-by: Takashi Iwai + +--- + drivers/watchdog/pcwd_usb.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/watchdog/pcwd_usb.c b/drivers/watchdog/pcwd_usb.c +index 1bdaf17c1d38..8202f0a6b093 100644 +--- a/drivers/watchdog/pcwd_usb.c ++++ b/drivers/watchdog/pcwd_usb.c +@@ -325,7 +325,8 @@ static int usb_pcwd_set_heartbeat(struct usb_pcwd_private *usb_pcwd, int t) + static int usb_pcwd_get_temperature(struct usb_pcwd_private *usb_pcwd, + int *temperature) + { +- unsigned char msb, lsb; ++ unsigned char msb = 0x00; ++ unsigned char lsb = 0x00; + + usb_pcwd_send_command(usb_pcwd, CMD_READ_TEMP, &msb, &lsb); + +@@ -341,7 +342,8 @@ static int usb_pcwd_get_temperature(struct usb_pcwd_private *usb_pcwd, + static int usb_pcwd_get_timeleft(struct usb_pcwd_private *usb_pcwd, + int *time_left) + { +- unsigned char msb, lsb; ++ unsigned char msb = 0x00; ++ unsigned char lsb = 0x00; + + /* Read the time that's left before rebooting */ + /* Note: if the board is not yet armed then we will read 0xFFFF */ +-- +2.35.3 + diff --git a/patches.suse/watchdog-sbsa_wdog-Make-sure-the-timeout-programming.patch b/patches.suse/watchdog-sbsa_wdog-Make-sure-the-timeout-programming.patch new file mode 100644 index 0000000..5ba4eb6 --- /dev/null +++ b/patches.suse/watchdog-sbsa_wdog-Make-sure-the-timeout-programming.patch @@ -0,0 +1,40 @@ +From 000987a38b53c172f435142a4026dd71378ca464 Mon Sep 17 00:00:00 2001 +From: George Cherian +Date: Thu, 9 Feb 2023 02:11:17 +0000 +Subject: [PATCH] watchdog: sbsa_wdog: Make sure the timeout programming is within the limits +Git-commit: 000987a38b53c172f435142a4026dd71378ca464 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Make sure to honour the max_hw_heartbeat_ms while programming the timeout +value to WOR. Clamp the timeout passed to sbsa_gwdt_set_timeout() to +make sure the programmed value is within the permissible range. + +Fixes: abd3ac7902fb ("watchdog: sbsa: Support architecture version 1") + +Signed-off-by: George Cherian +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20230209021117.1512097-1-george.cherian@marvell.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Acked-by: Takashi Iwai + +--- + drivers/watchdog/sbsa_gwdt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/watchdog/sbsa_gwdt.c b/drivers/watchdog/sbsa_gwdt.c +index 9791c74aebd4..63862803421f 100644 +--- a/drivers/watchdog/sbsa_gwdt.c ++++ b/drivers/watchdog/sbsa_gwdt.c +@@ -150,6 +150,7 @@ static int sbsa_gwdt_set_timeout(struct watchdog_device *wdd, + struct sbsa_gwdt *gwdt = watchdog_get_drvdata(wdd); + + wdd->timeout = timeout; ++ timeout = clamp_t(unsigned int, timeout, 1, wdd->max_hw_heartbeat_ms / 1000); + + if (action) + sbsa_gwdt_reg_write(gwdt->clk * timeout, gwdt); +-- +2.35.3 + diff --git a/patches.suse/wifi-ath11k-Fix-memory-leak-in-ath11k_peer_rx_frag_s.patch b/patches.suse/wifi-ath11k-Fix-memory-leak-in-ath11k_peer_rx_frag_s.patch new file mode 100644 index 0000000..25d78f5 --- /dev/null +++ b/patches.suse/wifi-ath11k-Fix-memory-leak-in-ath11k_peer_rx_frag_s.patch @@ -0,0 +1,38 @@ +From ed3f83b3459a67a3ab9d806490ac304b567b1c2d Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Mon, 2 Jan 2023 12:11:42 +0400 +Subject: [PATCH] wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup +Git-commit: ed3f83b3459a67a3ab9d806490ac304b567b1c2d +Patch-mainline: v6.3-rc1 +References: git-fixes + +crypto_alloc_shash() allocates resources, which should be released by +crypto_free_shash(). When ath11k_peer_find() fails, there has memory +leak. Add missing crypto_free_shash() to fix this. + +Fixes: 243874c64c81 ("ath11k: handle RX fragments") +Signed-off-by: Miaoqian Lin +Reviewed-by: Leon Romanovsky +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230102081142.3937570-1-linmq006@gmail.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/ath/ath11k/dp_rx.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c +index be391322956f..b65a84a88264 100644 +--- a/drivers/net/wireless/ath/ath11k/dp_rx.c ++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c +@@ -3126,6 +3126,7 @@ int ath11k_peer_rx_frag_setup(struct ath11k *ar, const u8 *peer_mac, int vdev_id + if (!peer) { + ath11k_warn(ab, "failed to find the peer to set up fragment info\n"); + spin_unlock_bh(&ab->base_lock); ++ crypto_free_shash(tfm); + return -ENOENT; + } + +-- +2.35.3 + diff --git a/patches.suse/wifi-ath11k-allow-system-suspend-to-survive-ath11k.patch b/patches.suse/wifi-ath11k-allow-system-suspend-to-survive-ath11k.patch new file mode 100644 index 0000000..638226a --- /dev/null +++ b/patches.suse/wifi-ath11k-allow-system-suspend-to-survive-ath11k.patch @@ -0,0 +1,53 @@ +From 7c15430822e71e90203d87e6d0cfe83fa058b0dc Mon Sep 17 00:00:00 2001 +From: Len Brown +Date: Wed, 1 Feb 2023 12:32:01 -0600 +Subject: [PATCH] wifi: ath11k: allow system suspend to survive ath11k +Git-commit: 7c15430822e71e90203d87e6d0cfe83fa058b0dc +Patch-mainline: v6.3-rc1 +References: git-fixes + +When ath11k runs into internal errors upon suspend, +it returns an error code to pci_pm_suspend, which +aborts the entire system suspend. + +The driver should not abort system suspend, but should +keep its internal errors to itself, and allow the system +to suspend. Otherwise, a user can suspend a laptop +by closing the lid and sealing it into a case, assuming +that is will suspend, rather than heating up and draining +the battery when in transit. + +In practice, the ath11k device seems to have plenty of transient +errors, and subsequent suspend cycles after this failure +often succeed. + +https://bugzilla.kernel.org/show_bug.cgi?id=216968 + +Fixes: d1b0c33850d29 ("ath11k: implement suspend for QCA6390 PCI devices") + +Signed-off-by: Len Brown +Cc: stable@vger.kernel.org +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230201183201.14431-1-len.brown@intel.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/ath/ath11k/pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath11k/pci.c b/drivers/net/wireless/ath/ath11k/pci.c +index 776362d151cb..0aeef2948ff5 100644 +--- a/drivers/net/wireless/ath/ath11k/pci.c ++++ b/drivers/net/wireless/ath/ath11k/pci.c +@@ -981,7 +981,7 @@ static __maybe_unused int ath11k_pci_pm_suspend(struct device *dev) + if (ret) + ath11k_warn(ab, "failed to suspend core: %d\n", ret); + +- return ret; ++ return 0; + } + + static __maybe_unused int ath11k_pci_pm_resume(struct device *dev) +-- +2.35.3 + diff --git a/patches.suse/wifi-ath9k-Fix-potential-stack-out-of-bounds-write-i.patch b/patches.suse/wifi-ath9k-Fix-potential-stack-out-of-bounds-write-i.patch new file mode 100644 index 0000000..2d3c563 --- /dev/null +++ b/patches.suse/wifi-ath9k-Fix-potential-stack-out-of-bounds-write-i.patch @@ -0,0 +1,61 @@ +From 8a2f35b9830692f7a616f2f627f943bc748af13a Mon Sep 17 00:00:00 2001 +From: Minsuk Kang +Date: Wed, 4 Jan 2023 21:41:30 +0900 +Subject: [PATCH] wifi: ath9k: Fix potential stack-out-of-bounds write in + ath9k_wmi_rsp_callback() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Git-commit: 8a2f35b9830692f7a616f2f627f943bc748af13a +References: git-fixes +Patch-mainline: v6.3-rc1 + +Fix a stack-out-of-bounds write that occurs in a WMI response callback +function that is called after a timeout occurs in ath9k_wmi_cmd(). +The callback writes to wmi->cmd_rsp_buf, a stack-allocated buffer that +could no longer be valid when a timeout occurs. Set wmi->last_seq_id to +0 when a timeout occurred. + +Found by a modified version of syzkaller. + +BUG: KASAN: stack-out-of-bounds in ath9k_wmi_ctrl_rx +Write of size 4 +Call Trace: + memcpy + ath9k_wmi_ctrl_rx + ath9k_htc_rx_msg + ath9k_hif_usb_reg_in_cb + __usb_hcd_giveback_urb + usb_hcd_giveback_urb + dummy_timer + call_timer_fn + run_timer_softirq + __do_softirq + irq_exit_rcu + sysvec_apic_timer_interrupt + +Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") +Signed-off-by: Minsuk Kang +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230104124130.10996-1-linuxlovemin@yonsei.ac.kr +Signed-off-by: Oliver Neukum +--- + drivers/net/wireless/ath/ath9k/wmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c +index f315c54bd3ac..19345b8f7bfd 100644 +--- a/drivers/net/wireless/ath/ath9k/wmi.c ++++ b/drivers/net/wireless/ath/ath9k/wmi.c +@@ -341,6 +341,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id, + if (!time_left) { + ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n", + wmi_cmd_to_name(cmd_id)); ++ wmi->last_seq_id = 0; + mutex_unlock(&wmi->op_mutex); + return -ETIMEDOUT; + } +-- +2.39.2 + diff --git a/patches.suse/wifi-ath9k-htc_hst-free-skb-in-ath9k_htc_rx_msg-if-t.patch b/patches.suse/wifi-ath9k-htc_hst-free-skb-in-ath9k_htc_rx_msg-if-t.patch new file mode 100644 index 0000000..5dd1315 --- /dev/null +++ b/patches.suse/wifi-ath9k-htc_hst-free-skb-in-ath9k_htc_rx_msg-if-t.patch @@ -0,0 +1,57 @@ +From 9b25e3985477ac3f02eca5fc1e0cc6850a3f7e69 Mon Sep 17 00:00:00 2001 +From: Fedor Pchelkin +Date: Wed, 4 Jan 2023 15:35:46 +0300 +Subject: [PATCH] wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 9b25e3985477ac3f02eca5fc1e0cc6850a3f7e69 +Patch-mainline: v6.3-rc1 +References: git-fixes + +It is stated that ath9k_htc_rx_msg() either frees the provided skb or +passes its management to another callback function. However, the skb is +not freed in case there is no another callback function, and Syzkaller was +able to cause a memory leak. Also minor comment fix. + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") +Reported-by: syzbot+e008dccab31bd3647609@syzkaller.appspotmail.com +Reported-by: syzbot+6692c72009680f7c4eb2@syzkaller.appspotmail.com +Signed-off-by: Fedor Pchelkin +Signed-off-by: Alexey Khoroshilov +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230104123546.51427-1-pchelkin@ispras.ru +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/ath/ath9k/htc_hst.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c +index ca05b07a45e6..fe62ff668f75 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_hst.c ++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c +@@ -391,7 +391,7 @@ static void ath9k_htc_fw_panic_report(struct htc_target *htc_handle, + * HTC Messages are handled directly here and the obtained SKB + * is freed. + * +- * Service messages (Data, WMI) passed to the corresponding ++ * Service messages (Data, WMI) are passed to the corresponding + * endpoint RX handlers, which have to free the SKB. + */ + void ath9k_htc_rx_msg(struct htc_target *htc_handle, +@@ -478,6 +478,8 @@ void ath9k_htc_rx_msg(struct htc_target *htc_handle, + if (endpoint->ep_callbacks.rx) + endpoint->ep_callbacks.rx(endpoint->ep_callbacks.priv, + skb, epid); ++ else ++ goto invalid; + } + } + +-- +2.35.3 + diff --git a/patches.suse/wifi-brcmfmac-fix-potential-memory-leak-in-brcmf_net.patch b/patches.suse/wifi-brcmfmac-fix-potential-memory-leak-in-brcmf_net.patch new file mode 100644 index 0000000..e8794cf --- /dev/null +++ b/patches.suse/wifi-brcmfmac-fix-potential-memory-leak-in-brcmf_net.patch @@ -0,0 +1,38 @@ +From 212fde3fe76e962598ce1d47b97cc78afdfc71b3 Mon Sep 17 00:00:00 2001 +From: Zhang Changzhong +Date: Thu, 17 Nov 2022 19:33:01 +0800 +Subject: [PATCH] wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() +Git-commit: 212fde3fe76e962598ce1d47b97cc78afdfc71b3 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb +in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it. +Compile tested only. + +Fixes: 270a6c1f65fe ("brcmfmac: rework headroom check in .start_xmit()") +Signed-off-by: Zhang Changzhong +Reviewed-by: Arend van Spriel +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1668684782-47422-1-git-send-email-zhangchangzhong@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +index 83ea251cfcec..f599d5f896e8 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +@@ -336,6 +336,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, + bphy_err(drvr, "%s: failed to expand headroom\n", + brcmf_ifname(ifp)); + atomic_inc(&drvr->bus_if->stats.pktcow_failed); ++ dev_kfree_skb(skb); + goto done; + } + } +-- +2.35.3 + diff --git a/patches.suse/wifi-brcmfmac-unmap-dma-buffer-in-brcmf_msgbuf_alloc.patch b/patches.suse/wifi-brcmfmac-unmap-dma-buffer-in-brcmf_msgbuf_alloc.patch new file mode 100644 index 0000000..2ceddc8 --- /dev/null +++ b/patches.suse/wifi-brcmfmac-unmap-dma-buffer-in-brcmf_msgbuf_alloc.patch @@ -0,0 +1,46 @@ +From b9f420032f2ba1e634b22ca7b433e5c40ea663af Mon Sep 17 00:00:00 2001 +From: Zhengchao Shao +Date: Wed, 7 Dec 2022 09:31:14 +0800 +Subject: [PATCH] wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid() +Git-commit: b9f420032f2ba1e634b22ca7b433e5c40ea663af +Patch-mainline: v6.3-rc1 +References: git-fixes + +After the DMA buffer is mapped to a physical address, address is stored +in pktids in brcmf_msgbuf_alloc_pktid(). Then, pktids is parsed in +brcmf_msgbuf_get_pktid()/brcmf_msgbuf_release_array() to obtain physaddr +and later unmap the DMA buffer. But when count is always equal to +pktids->array_size, physaddr isn't stored in pktids and the DMA buffer +will not be unmapped anyway. + +Fixes: 9a1bb60250d2 ("brcmfmac: Adding msgbuf protocol.") +Signed-off-by: Zhengchao Shao +Reviewed-by: Sebastian Andrzej Siewior +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207013114.1748936-1-shaozhengchao@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c +index cec53f934940..45fbcbdc7d9e 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c +@@ -347,8 +347,11 @@ brcmf_msgbuf_alloc_pktid(struct device *dev, + count++; + } while (count < pktids->array_size); + +- if (count == pktids->array_size) ++ if (count == pktids->array_size) { ++ dma_unmap_single(dev, *physaddr, skb->len - data_offset, ++ pktids->direction); + return -ENOMEM; ++ } + + array[*idx].data_offset = data_offset; + array[*idx].physaddr = *physaddr; +-- +2.35.3 + diff --git a/patches.suse/wifi-cfg80211-Fix-extended-KCK-key-length-check-in-n.patch b/patches.suse/wifi-cfg80211-Fix-extended-KCK-key-length-check-in-n.patch new file mode 100644 index 0000000..1ae1418 --- /dev/null +++ b/patches.suse/wifi-cfg80211-Fix-extended-KCK-key-length-check-in-n.patch @@ -0,0 +1,41 @@ +From df4969ca135b9b3b2c38c07514aaa775112ac835 Mon Sep 17 00:00:00 2001 +From: Shivani Baranwal +Date: Tue, 6 Dec 2022 20:07:14 +0530 +Subject: [PATCH] wifi: cfg80211: Fix extended KCK key length check in nl80211_set_rekey_data() +Git-commit: df4969ca135b9b3b2c38c07514aaa775112ac835 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The extended KCK key length check wrongly using the KEK key attribute +for validation. Due to this GTK rekey offload is failing when the KCK +key length is 24 bytes even though the driver advertising +WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK flag. Use correct attribute to fix the +same. + +Fixes: 093a48d2aa4b ("cfg80211: support bigger kek/kck key length") +Signed-off-by: Shivani Baranwal +Signed-off-by: Veerendranath Jakkam +Link: https://lore.kernel.org/r/20221206143715.1802987-2-quic_vjakkam@quicinc.com +Signed-off-by: Johannes Berg +Acked-by: Takashi Iwai + +--- + net/wireless/nl80211.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 33a82ecab9d5..02b9a0280896 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -13809,7 +13809,7 @@ static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info) + return -ERANGE; + if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN && + !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK && +- nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KCK_EXT_LEN)) ++ nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN)) + return -ERANGE; + + rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]); +-- +2.35.3 + diff --git a/patches.suse/wifi-cfg80211-Fix-use-after-free-for-wext.patch b/patches.suse/wifi-cfg80211-Fix-use-after-free-for-wext.patch new file mode 100644 index 0000000..27f2796 --- /dev/null +++ b/patches.suse/wifi-cfg80211-Fix-use-after-free-for-wext.patch @@ -0,0 +1,96 @@ +From 015b8cc5e7c4d7bb671f1984d7b7338c310b185b Mon Sep 17 00:00:00 2001 +From: Alexander Wetzel +Date: Tue, 24 Jan 2023 15:18:56 +0100 +Subject: [PATCH] wifi: cfg80211: Fix use after free for wext +Git-commit: 015b8cc5e7c4d7bb671f1984d7b7338c310b185b +Patch-mainline: v6.3-rc1 +References: git-fixes + +Key information in wext.connect is not reset on (re)connect and can hold +data from a previous connection. + +Reset key data to avoid that drivers or mac80211 incorrectly detect a +WEP connection request and access the freed or already reused memory. + +Additionally optimize cfg80211_sme_connect() and avoid an useless +schedule of conn_work. + +Fixes: fffd0934b939 ("cfg80211: rework key operation") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230124141856.356646-1-alexander@wetzel-home.de +Signed-off-by: Alexander Wetzel +Signed-off-by: Johannes Berg +Acked-by: Takashi Iwai + +--- + net/wireless/sme.c | 31 ++++++++++++++++++++++++++----- + 1 file changed, 26 insertions(+), 5 deletions(-) + +--- a/net/wireless/sme.c ++++ b/net/wireless/sme.c +@@ -268,6 +268,15 @@ void cfg80211_conn_work(struct work_stru + wiphy_unlock(&rdev->wiphy); + } + ++static void cfg80211_step_auth_next(struct cfg80211_conn *conn, ++ struct cfg80211_bss *bss) ++{ ++ memcpy(conn->bssid, bss->bssid, ETH_ALEN); ++ conn->params.bssid = conn->bssid; ++ conn->params.channel = bss->channel; ++ conn->state = CFG80211_CONN_AUTHENTICATE_NEXT; ++} ++ + /* Returned bss is reference counted and must be cleaned up appropriately. */ + static struct cfg80211_bss *cfg80211_get_conn_bss(struct wireless_dev *wdev) + { +@@ -285,10 +294,7 @@ static struct cfg80211_bss *cfg80211_get + if (!bss) + return NULL; + +- memcpy(wdev->conn->bssid, bss->bssid, ETH_ALEN); +- wdev->conn->params.bssid = wdev->conn->bssid; +- wdev->conn->params.channel = bss->channel; +- wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT; ++ cfg80211_step_auth_next(wdev->conn, bss); + schedule_work(&rdev->conn_work); + + return bss; +@@ -567,7 +573,12 @@ static int cfg80211_sme_connect(struct w + wdev->conn->params.ssid_len = wdev->ssid_len; + + /* see if we have the bss already */ +- bss = cfg80211_get_conn_bss(wdev); ++ bss = cfg80211_get_bss(wdev->wiphy, wdev->conn->params.channel, ++ wdev->conn->params.bssid, ++ wdev->conn->params.ssid, ++ wdev->conn->params.ssid_len, ++ wdev->conn_bss_type, ++ IEEE80211_PRIVACY(wdev->conn->params.privacy)); + + if (prev_bssid) { + memcpy(wdev->conn->prev_bssid, prev_bssid, ETH_ALEN); +@@ -578,6 +589,7 @@ static int cfg80211_sme_connect(struct w + if (bss) { + enum nl80211_timeout_reason treason; + ++ cfg80211_step_auth_next(wdev->conn, bss); + err = cfg80211_conn_do_work(wdev, &treason); + cfg80211_put_bss(wdev->wiphy, bss); + } else { +@@ -1244,6 +1256,15 @@ int cfg80211_connect(struct cfg80211_reg + } else { + if (WARN_ON(connkeys)) + return -EINVAL; ++ ++ /* connect can point to wdev->wext.connect which ++ * can hold key data from a previous connection ++ */ ++ connect->key = NULL; ++ connect->key_len = 0; ++ connect->key_idx = 0; ++ connect->crypto.cipher_group = 0; ++ connect->crypto.n_ciphers_pairwise = 0; + } + + wdev->connect_keys = connkeys; diff --git a/patches.suse/wifi-ipw2200-fix-memory-leak-in-ipw_wdev_init.patch b/patches.suse/wifi-ipw2200-fix-memory-leak-in-ipw_wdev_init.patch new file mode 100644 index 0000000..1a723eb --- /dev/null +++ b/patches.suse/wifi-ipw2200-fix-memory-leak-in-ipw_wdev_init.patch @@ -0,0 +1,47 @@ +From 9fe21dc626117fb44a8eb393713a86a620128ce3 Mon Sep 17 00:00:00 2001 +From: Zhengchao Shao +Date: Fri, 9 Dec 2022 09:24:22 +0800 +Subject: [PATCH] wifi: ipw2200: fix memory leak in ipw_wdev_init() +Git-commit: 9fe21dc626117fb44a8eb393713a86a620128ce3 +Patch-mainline: v6.3-rc1 +References: git-fixes + +In the error path of ipw_wdev_init(), exception value is returned, and +the memory applied for in the function is not released. Also the memory +is not released in ipw_pci_probe(). As a result, memory leakage occurs. +So memory release needs to be added to the error path of ipw_wdev_init(). + +Fixes: a3caa99e6c68 ("libipw: initiate cfg80211 API conversion (v2)") +Signed-off-by: Zhengchao Shao +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221209012422.182669-1-shaozhengchao@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/intel/ipw2x00/ipw2200.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c +index cc66fd92278e..d382f2017325 100644 +--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c ++++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c +@@ -11383,9 +11383,14 @@ static int ipw_wdev_init(struct net_device *dev) + set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev); + + /* With that information in place, we can now register the wiphy... */ +- if (wiphy_register(wdev->wiphy)) +- rc = -EIO; ++ rc = wiphy_register(wdev->wiphy); ++ if (rc) ++ goto out; ++ ++ return 0; + out: ++ kfree(priv->ieee->a_band.channels); ++ kfree(priv->ieee->bg_band.channels); + return rc; + } + +-- +2.35.3 + diff --git a/patches.suse/wifi-ipw2x00-don-t-call-dev_kfree_skb-under-spin_loc.patch b/patches.suse/wifi-ipw2x00-don-t-call-dev_kfree_skb-under-spin_loc.patch new file mode 100644 index 0000000..f32b38d --- /dev/null +++ b/patches.suse/wifi-ipw2x00-don-t-call-dev_kfree_skb-under-spin_loc.patch @@ -0,0 +1,46 @@ +From 45fc6d7461f18df2f238caf0cbc5acc4163203d1 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Thu, 8 Dec 2022 22:38:26 +0800 +Subject: [PATCH] wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave() +Git-commit: 45fc6d7461f18df2f238caf0cbc5acc4163203d1 +Patch-mainline: v6.3-rc1 +References: git-fixes + +It is not allowed to call kfree_skb() or consume_skb() from hardware +interrupt context or with hardware interrupts being disabled. + +It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. +The difference between them is free reason, dev_kfree_skb_irq() means +the SKB is dropped in error and dev_consume_skb_irq() means the SKB +is consumed in normal. + +In this case, dev_kfree_skb() is called to free and drop the SKB when +it's reset, so replace it with dev_kfree_skb_irq(). Compile tested +only. + +Fixes: 43f66a6ce8da ("Add ipw2200 wireless driver.") +Signed-off-by: Yang Yingliang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221208143826.2385218-1-yangyingliang@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/intel/ipw2x00/ipw2200.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c +index ca802af8cddc..cc66fd92278e 100644 +--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c ++++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c +@@ -3427,7 +3427,7 @@ static void ipw_rx_queue_reset(struct ipw_priv *priv, + dma_unmap_single(&priv->pci_dev->dev, + rxq->pool[i].dma_addr, + IPW_RX_BUF_SIZE, DMA_FROM_DEVICE); +- dev_kfree_skb(rxq->pool[i].skb); ++ dev_kfree_skb_irq(rxq->pool[i].skb); + rxq->pool[i].skb = NULL; + } + list_add_tail(&rxq->pool[i].list, &rxq->rx_used); +-- +2.35.3 + diff --git a/patches.suse/wifi-iwl3945-Add-missing-check-for-create_singlethre.patch b/patches.suse/wifi-iwl3945-Add-missing-check-for-create_singlethre.patch new file mode 100644 index 0000000..72c6af0 --- /dev/null +++ b/patches.suse/wifi-iwl3945-Add-missing-check-for-create_singlethre.patch @@ -0,0 +1,85 @@ +From 1fdeb8b9f29dfd64805bb49475ac7566a3cb06cb Mon Sep 17 00:00:00 2001 +From: Jiasheng Jiang +Date: Wed, 8 Feb 2023 14:30:32 +0800 +Subject: [PATCH] wifi: iwl3945: Add missing check for create_singlethread_workqueue +Git-commit: 1fdeb8b9f29dfd64805bb49475ac7566a3cb06cb +Patch-mainline: v6.3-rc1 +References: git-fixes + +Add the check for the return value of the create_singlethread_workqueue +in order to avoid NULL pointer dereference. + +Fixes: b481de9ca074 ("[IWLWIFI]: add iwlwifi wireless drivers") +Signed-off-by: Jiasheng Jiang +Acked-by: Stanislaw Gruszka +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230208063032.42763-2-jiasheng@iscas.ac.cn +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/intel/iwlegacy/3945-mac.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c +index d7e99d50b287..9eaf5ec133f9 100644 +--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c ++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c +@@ -3372,10 +3372,12 @@ static DEVICE_ATTR(dump_errors, 0200, NULL, il3945_dump_error_log); + * + *****************************************************************************/ + +-static void ++static int + il3945_setup_deferred_work(struct il_priv *il) + { + il->workqueue = create_singlethread_workqueue(DRV_NAME); ++ if (!il->workqueue) ++ return -ENOMEM; + + init_waitqueue_head(&il->wait_command_queue); + +@@ -3392,6 +3394,8 @@ il3945_setup_deferred_work(struct il_priv *il) + timer_setup(&il->watchdog, il_bg_watchdog, 0); + + tasklet_setup(&il->irq_tasklet, il3945_irq_tasklet); ++ ++ return 0; + } + + static void +@@ -3712,7 +3716,10 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + } + + il_set_rxon_channel(il, &il->bands[NL80211_BAND_2GHZ].channels[5]); +- il3945_setup_deferred_work(il); ++ err = il3945_setup_deferred_work(il); ++ if (err) ++ goto out_remove_sysfs; ++ + il3945_setup_handlers(il); + il_power_initialize(il); + +@@ -3724,7 +3731,7 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + + err = il3945_setup_mac(il); + if (err) +- goto out_remove_sysfs; ++ goto out_destroy_workqueue; + + il_dbgfs_register(il, DRV_NAME); + +@@ -3733,9 +3740,10 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + + return 0; + +-out_remove_sysfs: ++out_destroy_workqueue: + destroy_workqueue(il->workqueue); + il->workqueue = NULL; ++out_remove_sysfs: + sysfs_remove_group(&pdev->dev.kobj, &il3945_attribute_group); + out_release_irq: + free_irq(il->pci_dev->irq, il); +-- +2.35.3 + diff --git a/patches.suse/wifi-iwl4965-Add-missing-check-for-create_singlethre.patch b/patches.suse/wifi-iwl4965-Add-missing-check-for-create_singlethre.patch new file mode 100644 index 0000000..3651b92 --- /dev/null +++ b/patches.suse/wifi-iwl4965-Add-missing-check-for-create_singlethre.patch @@ -0,0 +1,72 @@ +From 26e6775f75517ad6844fe5b79bc5f3fa8c22ee61 Mon Sep 17 00:00:00 2001 +From: Jiasheng Jiang +Date: Thu, 9 Feb 2023 09:07:48 +0800 +Subject: [PATCH] wifi: iwl4965: Add missing check for create_singlethread_workqueue() +Git-commit: 26e6775f75517ad6844fe5b79bc5f3fa8c22ee61 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Add the check for the return value of the create_singlethread_workqueue() +in order to avoid NULL pointer dereference. + +Fixes: b481de9ca074 ("[IWLWIFI]: add iwlwifi wireless drivers") +Signed-off-by: Jiasheng Jiang +Acked-by: Stanislaw Gruszka +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230209010748.45454-1-jiasheng@iscas.ac.cn +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/intel/iwlegacy/4965-mac.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c +index 721b4042b4bf..4d3c544ff2e6 100644 +--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c ++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c +@@ -6211,10 +6211,12 @@ il4965_bg_txpower_work(struct work_struct *work) + mutex_unlock(&il->mutex); + } + +-static void ++static int + il4965_setup_deferred_work(struct il_priv *il) + { + il->workqueue = create_singlethread_workqueue(DRV_NAME); ++ if (!il->workqueue) ++ return -ENOMEM; + + init_waitqueue_head(&il->wait_command_queue); + +@@ -6233,6 +6235,8 @@ il4965_setup_deferred_work(struct il_priv *il) + timer_setup(&il->watchdog, il_bg_watchdog, 0); + + tasklet_setup(&il->irq_tasklet, il4965_irq_tasklet); ++ ++ return 0; + } + + static void +@@ -6618,7 +6622,10 @@ il4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + goto out_disable_msi; + } + +- il4965_setup_deferred_work(il); ++ err = il4965_setup_deferred_work(il); ++ if (err) ++ goto out_free_irq; ++ + il4965_setup_handlers(il); + + /********************************************* +@@ -6656,6 +6663,7 @@ il4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + out_destroy_workqueue: + destroy_workqueue(il->workqueue); + il->workqueue = NULL; ++out_free_irq: + free_irq(il->pci_dev->irq, il); + out_disable_msi: + pci_disable_msi(il->pci_dev); +-- +2.35.3 + diff --git a/patches.suse/wifi-iwlegacy-common-don-t-call-dev_kfree_skb-under-.patch b/patches.suse/wifi-iwlegacy-common-don-t-call-dev_kfree_skb-under-.patch new file mode 100644 index 0000000..dc30201 --- /dev/null +++ b/patches.suse/wifi-iwlegacy-common-don-t-call-dev_kfree_skb-under-.patch @@ -0,0 +1,48 @@ +From 0c1528675d7a9787cb516b64d8f6c0f6f8efcb48 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Wed, 7 Dec 2022 22:40:13 +0800 +Subject: [PATCH] wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave() +Git-commit: 0c1528675d7a9787cb516b64d8f6c0f6f8efcb48 +Patch-mainline: v6.3-rc1 +References: git-fixes + +It is not allowed to call consume_skb() from hardware interrupt context +or with interrupts being disabled. So replace dev_kfree_skb() with +dev_consume_skb_irq() under spin_lock_irqsave(). Compile tested only. + +Fixes: 4bc85c1324aa ("Revert "iwlwifi: split the drivers for agn and legacy devices 3945/4965"") +Signed-off-by: Yang Yingliang +Acked-by: Stanislaw Gruszka +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207144013.70210-1-yangyingliang@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/intel/iwlegacy/common.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c +index 341c17fe2af4..96002121bb8b 100644 +--- a/drivers/net/wireless/intel/iwlegacy/common.c ++++ b/drivers/net/wireless/intel/iwlegacy/common.c +@@ -5174,7 +5174,7 @@ il_mac_reset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif) + memset(&il->current_ht_config, 0, sizeof(struct il_ht_config)); + + /* new association get rid of ibss beacon skb */ +- dev_kfree_skb(il->beacon_skb); ++ dev_consume_skb_irq(il->beacon_skb); + il->beacon_skb = NULL; + il->timestamp = 0; + +@@ -5293,7 +5293,7 @@ il_beacon_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif) + } + + spin_lock_irqsave(&il->lock, flags); +- dev_kfree_skb(il->beacon_skb); ++ dev_consume_skb_irq(il->beacon_skb); + il->beacon_skb = skb; + + timestamp = ((struct ieee80211_mgmt *)skb->data)->u.beacon.timestamp; +-- +2.35.3 + diff --git a/patches.suse/wifi-libertas-cmdresp-don-t-call-kfree_skb-under-spi.patch b/patches.suse/wifi-libertas-cmdresp-don-t-call-kfree_skb-under-spi.patch new file mode 100644 index 0000000..e3722bb --- /dev/null +++ b/patches.suse/wifi-libertas-cmdresp-don-t-call-kfree_skb-under-spi.patch @@ -0,0 +1,39 @@ +From 708a49a64237f19bd404852f297aaadbc9e7fee0 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Wed, 7 Dec 2022 23:00:08 +0800 +Subject: [PATCH] wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave() +Git-commit: 708a49a64237f19bd404852f297aaadbc9e7fee0 +Patch-mainline: v6.3-rc1 +References: git-fixes + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. So replace kfree_skb() +with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile +tested only. + +Fixes: f52b041aed77 ("libertas: Add spinlock to avoid race condition") +Signed-off-by: Yang Yingliang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207150008.111743-5-yangyingliang@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/marvell/libertas/cmdresp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/libertas/cmdresp.c b/drivers/net/wireless/marvell/libertas/cmdresp.c +index cb515c5584c1..74cb7551f427 100644 +--- a/drivers/net/wireless/marvell/libertas/cmdresp.c ++++ b/drivers/net/wireless/marvell/libertas/cmdresp.c +@@ -48,7 +48,7 @@ void lbs_mac_event_disconnected(struct lbs_private *priv, + + /* Free Tx and Rx packets */ + spin_lock_irqsave(&priv->driver_lock, flags); +- kfree_skb(priv->currenttxskb); ++ dev_kfree_skb_irq(priv->currenttxskb); + priv->currenttxskb = NULL; + priv->tx_pending_len = 0; + spin_unlock_irqrestore(&priv->driver_lock, flags); +-- +2.35.3 + diff --git a/patches.suse/wifi-libertas-fix-memory-leak-in-lbs_init_adapter.patch b/patches.suse/wifi-libertas-fix-memory-leak-in-lbs_init_adapter.patch new file mode 100644 index 0000000..99cf130 --- /dev/null +++ b/patches.suse/wifi-libertas-fix-memory-leak-in-lbs_init_adapter.patch @@ -0,0 +1,37 @@ +From 16a03958618fb91bb1bc7077cf3211055162cc2f Mon Sep 17 00:00:00 2001 +From: Zhengchao Shao +Date: Thu, 8 Dec 2022 20:14:48 +0800 +Subject: [PATCH] wifi: libertas: fix memory leak in lbs_init_adapter() +Git-commit: 16a03958618fb91bb1bc7077cf3211055162cc2f +Patch-mainline: v6.3-rc1 +References: git-fixes + +When kfifo_alloc() failed in lbs_init_adapter(), cmd buffer is not +released. Add free memory to processing error path. + +Fixes: 7919b89c8276 ("libertas: convert libertas driver to use an event/cmdresp queue") +Signed-off-by: Zhengchao Shao +Reviewed-by: Jiri Pirko +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221208121448.2845986-1-shaozhengchao@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/marvell/libertas/main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/marvell/libertas/main.c b/drivers/net/wireless/marvell/libertas/main.c +index 8f5220cee112..ae975304cfcf 100644 +--- a/drivers/net/wireless/marvell/libertas/main.c ++++ b/drivers/net/wireless/marvell/libertas/main.c +@@ -869,6 +869,7 @@ static int lbs_init_adapter(struct lbs_private *priv) + ret = kfifo_alloc(&priv->event_fifo, sizeof(u32) * 16, GFP_KERNEL); + if (ret) { + pr_err("Out of memory allocating event FIFO buffer\n"); ++ lbs_free_cmd_buffer(priv); + goto out; + } + +-- +2.35.3 + diff --git a/patches.suse/wifi-libertas-if_usb-don-t-call-kfree_skb-under-spin.patch b/patches.suse/wifi-libertas-if_usb-don-t-call-kfree_skb-under-spin.patch new file mode 100644 index 0000000..e844d5e --- /dev/null +++ b/patches.suse/wifi-libertas-if_usb-don-t-call-kfree_skb-under-spin.patch @@ -0,0 +1,39 @@ +From 3968e81ba644f10a7d45bae2539560db9edac501 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Wed, 7 Dec 2022 23:00:06 +0800 +Subject: [PATCH] wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave() +Git-commit: 3968e81ba644f10a7d45bae2539560db9edac501 +Patch-mainline: v6.3-rc1 +References: git-fixes + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. So replace kfree_skb() +with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile +tested only. + +Fixes: a3128feef6d5 ("libertas: use irqsave() in USB's complete callback") +Signed-off-by: Yang Yingliang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207150008.111743-3-yangyingliang@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/marvell/libertas/if_usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c +index 32fdc4150b60..2240b4db8c03 100644 +--- a/drivers/net/wireless/marvell/libertas/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas/if_usb.c +@@ -637,7 +637,7 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff, + priv->resp_len[i] = (recvlength - MESSAGE_HEADER_LEN); + memcpy(priv->resp_buf[i], recvbuff + MESSAGE_HEADER_LEN, + priv->resp_len[i]); +- kfree_skb(skb); ++ dev_kfree_skb_irq(skb); + lbs_notify_command_response(priv, i); + + spin_unlock_irqrestore(&priv->driver_lock, flags); +-- +2.35.3 + diff --git a/patches.suse/wifi-libertas-main-don-t-call-kfree_skb-under-spin_l.patch b/patches.suse/wifi-libertas-main-don-t-call-kfree_skb-under-spin_l.patch new file mode 100644 index 0000000..44ae447 --- /dev/null +++ b/patches.suse/wifi-libertas-main-don-t-call-kfree_skb-under-spin_l.patch @@ -0,0 +1,39 @@ +From f393df151540bf858effbd29ff572ab94e76a4c4 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Wed, 7 Dec 2022 23:00:07 +0800 +Subject: [PATCH] wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave() +Git-commit: f393df151540bf858effbd29ff572ab94e76a4c4 +Patch-mainline: v6.3-rc1 +References: git-fixes + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. So replace kfree_skb() +with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile +tested only. + +Fixes: d2e7b3425c47 ("libertas: disable functionality when interface is down") +Signed-off-by: Yang Yingliang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207150008.111743-4-yangyingliang@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/marvell/libertas/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/libertas/main.c b/drivers/net/wireless/marvell/libertas/main.c +index ae975304cfcf..78e8b5aecec0 100644 +--- a/drivers/net/wireless/marvell/libertas/main.c ++++ b/drivers/net/wireless/marvell/libertas/main.c +@@ -216,7 +216,7 @@ int lbs_stop_iface(struct lbs_private *priv) + + spin_lock_irqsave(&priv->driver_lock, flags); + priv->iface_running = false; +- kfree_skb(priv->currenttxskb); ++ dev_kfree_skb_irq(priv->currenttxskb); + priv->currenttxskb = NULL; + priv->tx_pending_len = 0; + spin_unlock_irqrestore(&priv->driver_lock, flags); +-- +2.35.3 + diff --git a/patches.suse/wifi-libertas_tf-don-t-call-kfree_skb-under-spin_loc.patch b/patches.suse/wifi-libertas_tf-don-t-call-kfree_skb-under-spin_loc.patch new file mode 100644 index 0000000..cf9dd0b --- /dev/null +++ b/patches.suse/wifi-libertas_tf-don-t-call-kfree_skb-under-spin_loc.patch @@ -0,0 +1,39 @@ +From 9388ce97b98216833c969191ee6df61a7201d797 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Wed, 7 Dec 2022 23:00:05 +0800 +Subject: [PATCH] wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave() +Git-commit: 9388ce97b98216833c969191ee6df61a7201d797 +Patch-mainline: v6.3-rc1 +References: git-fixes + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. So replace kfree_skb() +with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile +tested only. + +Fixes: fc75122fabb5 ("libertas_tf: use irqsave() in USB's complete callback") +Signed-off-by: Yang Yingliang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207150008.111743-2-yangyingliang@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/libertas_tf/if_usb.c b/drivers/net/wireless/marvell/libertas_tf/if_usb.c +index 75b5319d033f..1750f5e93de2 100644 +--- a/drivers/net/wireless/marvell/libertas_tf/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas_tf/if_usb.c +@@ -613,7 +613,7 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff, + spin_lock_irqsave(&priv->driver_lock, flags); + memcpy(priv->cmd_resp_buff, recvbuff + MESSAGE_HEADER_LEN, + recvlength - MESSAGE_HEADER_LEN); +- kfree_skb(skb); ++ dev_kfree_skb_irq(skb); + lbtf_cmd_response_rx(priv); + spin_unlock_irqrestore(&priv->driver_lock, flags); + } +-- +2.35.3 + diff --git a/patches.suse/wifi-mac80211-make-rate-u32-in-sta_set_rate_info_rx.patch b/patches.suse/wifi-mac80211-make-rate-u32-in-sta_set_rate_info_rx.patch new file mode 100644 index 0000000..ee99bde --- /dev/null +++ b/patches.suse/wifi-mac80211-make-rate-u32-in-sta_set_rate_info_rx.patch @@ -0,0 +1,38 @@ +From 59336e07b287d91dc4ec265e07724e8f7e3d0209 Mon Sep 17 00:00:00 2001 +From: Shayne Chen +Date: Thu, 9 Feb 2023 19:06:59 +0800 +Subject: [PATCH] wifi: mac80211: make rate u32 in sta_set_rate_info_rx() +Git-commit: 59336e07b287d91dc4ec265e07724e8f7e3d0209 +Patch-mainline: v6.3-rc1 +References: git-fixes + +The value of last_rate in ieee80211_sta_rx_stats is degraded from u32 to +u16 after being assigned to rate variable, which causes information loss +in STA_STATS_FIELD_TYPE and later bitfields. + +Signed-off-by: Shayne Chen +Link: https://lore.kernel.org/r/20230209110659.25447-1-shayne.chen@mediatek.com +Fixes: 41cbb0f5a295 ("mac80211: add support for HE") +Signed-off-by: Johannes Berg +Acked-by: Takashi Iwai + +--- + net/mac80211/sta_info.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index 27c737fe7fb8..bd532d3f925d 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -2418,7 +2418,7 @@ static void sta_stats_decode_rate(struct ieee80211_local *local, u32 rate, + + static int sta_set_rate_info_rx(struct sta_info *sta, struct rate_info *rinfo) + { +- u16 rate = READ_ONCE(sta_get_last_rx_stats(sta)->last_rate); ++ u32 rate = READ_ONCE(sta_get_last_rx_stats(sta)->last_rate); + + if (rate == STA_STATS_RATE_INVALID) + return -EINVAL; +-- +2.35.3 + diff --git a/patches.suse/wifi-mwifiex-Add-missing-compatible-string-for-SD878.patch b/patches.suse/wifi-mwifiex-Add-missing-compatible-string-for-SD878.patch new file mode 100644 index 0000000..ac84fef --- /dev/null +++ b/patches.suse/wifi-mwifiex-Add-missing-compatible-string-for-SD878.patch @@ -0,0 +1,39 @@ +From 36dd7a4c6226133b0b7aa92b8e604e688d958d0c Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Fri, 27 Jan 2023 15:01:00 +0100 +Subject: [PATCH] wifi: mwifiex: Add missing compatible string for SD8787 +Git-commit: 36dd7a4c6226133b0b7aa92b8e604e688d958d0c +Patch-mainline: v6.3-rc1 +References: git-fixes + +Commit e3fffc1f0b47 ("devicetree: document new marvell-8xxx and +pwrseq-sd8787 options") documented a compatible string for SD8787 in +the devicetree bindings, but neglected to add it to the mwifiex driver. + +Fixes: e3fffc1f0b47 ("devicetree: document new marvell-8xxx and pwrseq-sd8787 options") +Signed-off-by: Lukas Wunner +Cc: stable@vger.kernel.org # v4.11+ +Cc: Matt Ranostay +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/320de5005ff3b8fd76be2d2b859fd021689c3681.1674827105.git.lukas@wunner.de +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/marvell/mwifiex/sdio.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c +index b8dc3b5c9ad9..9f506efa5370 100644 +--- a/drivers/net/wireless/marvell/mwifiex/sdio.c ++++ b/drivers/net/wireless/marvell/mwifiex/sdio.c +@@ -480,6 +480,7 @@ static struct memory_type_mapping mem_type_mapping_tbl[] = { + }; + + static const struct of_device_id mwifiex_sdio_of_match_table[] = { ++ { .compatible = "marvell,sd8787" }, + { .compatible = "marvell,sd8897" }, + { .compatible = "marvell,sd8997" }, + { } +-- +2.35.3 + diff --git a/patches.suse/wifi-mwifiex-fix-loop-iterator-in-mwifiex_update_amp.patch b/patches.suse/wifi-mwifiex-fix-loop-iterator-in-mwifiex_update_amp.patch new file mode 100644 index 0000000..dcce8a6 --- /dev/null +++ b/patches.suse/wifi-mwifiex-fix-loop-iterator-in-mwifiex_update_amp.patch @@ -0,0 +1,48 @@ +From 3cfb7df24cee0f5fdc4cc5d3176cab9aadfcb430 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 6 Feb 2023 17:41:33 +0300 +Subject: [PATCH] wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize() +Git-commit: 3cfb7df24cee0f5fdc4cc5d3176cab9aadfcb430 +Patch-mainline: v6.3-rc1 +References: git-fixes + +This code re-uses "i" to be the iterator for both the inside and outside +loops. It means the outside loop will exit earlier than intended. + +Fixes: d219b7eb3792 ("mwifiex: handle BT coex event to adjust Rx BA window size") +Signed-off-by: Dan Carpenter +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/Y+ERnaDaZD7RtLvX@kili +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/marvell/mwifiex/11n.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/11n.c b/drivers/net/wireless/marvell/mwifiex/11n.c +index 4af57e6d4393..90e401100898 100644 +--- a/drivers/net/wireless/marvell/mwifiex/11n.c ++++ b/drivers/net/wireless/marvell/mwifiex/11n.c +@@ -878,7 +878,7 @@ mwifiex_send_delba_txbastream_tbl(struct mwifiex_private *priv, u8 tid) + */ + void mwifiex_update_ampdu_txwinsize(struct mwifiex_adapter *adapter) + { +- u8 i; ++ u8 i, j; + u32 tx_win_size; + struct mwifiex_private *priv; + +@@ -909,8 +909,8 @@ void mwifiex_update_ampdu_txwinsize(struct mwifiex_adapter *adapter) + if (tx_win_size != priv->add_ba_param.tx_win_size) { + if (!priv->media_connected) + continue; +- for (i = 0; i < MAX_NUM_TID; i++) +- mwifiex_send_delba_txbastream_tbl(priv, i); ++ for (j = 0; j < MAX_NUM_TID; j++) ++ mwifiex_send_delba_txbastream_tbl(priv, j); + } + } + } +-- +2.35.3 + diff --git a/patches.suse/wifi-orinoco-check-return-value-of-hermes_write_word.patch b/patches.suse/wifi-orinoco-check-return-value-of-hermes_write_word.patch new file mode 100644 index 0000000..03d11d1 --- /dev/null +++ b/patches.suse/wifi-orinoco-check-return-value-of-hermes_write_word.patch @@ -0,0 +1,43 @@ +From 1e346cbb096a5351a637ec1992beffbf330547f0 Mon Sep 17 00:00:00 2001 +From: Alexey Kodanev +Date: Tue, 27 Dec 2022 16:33:06 +0300 +Subject: [PATCH] wifi: orinoco: check return value of hermes_write_wordrec() +Git-commit: 1e346cbb096a5351a637ec1992beffbf330547f0 +Patch-mainline: v6.3-rc1 +References: git-fixes + +There is currently no return check for writing an authentication +type (HERMES_AUTH_SHARED_KEY or HERMES_AUTH_OPEN). It looks like +it was accidentally skipped. + +This patch adds a return check similar to the other checks in +__orinoco_hw_setup_enc() for hermes_write_wordrec(). + +Detected using the static analysis tool - Svace. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Alexey Kodanev +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221227133306.201356-1-aleksei.kodanev@bell-sw.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/intersil/orinoco/hw.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/intersil/orinoco/hw.c b/drivers/net/wireless/intersil/orinoco/hw.c +index 0aea35c9c11c..4fcca08e50de 100644 +--- a/drivers/net/wireless/intersil/orinoco/hw.c ++++ b/drivers/net/wireless/intersil/orinoco/hw.c +@@ -931,6 +931,8 @@ int __orinoco_hw_setup_enc(struct orinoco_private *priv) + err = hermes_write_wordrec(hw, USER_BAP, + HERMES_RID_CNFAUTHENTICATION_AGERE, + auth_flag); ++ if (err) ++ return err; + } + err = hermes_write_wordrec(hw, USER_BAP, + HERMES_RID_CNFWEPENABLED_AGERE, +-- +2.35.3 + diff --git a/patches.suse/wifi-rsi-Fix-memory-leak-in-rsi_coex_attach.patch b/patches.suse/wifi-rsi-Fix-memory-leak-in-rsi_coex_attach.patch new file mode 100644 index 0000000..83267e5 --- /dev/null +++ b/patches.suse/wifi-rsi-Fix-memory-leak-in-rsi_coex_attach.patch @@ -0,0 +1,37 @@ +From 956fb851a6e19da5ab491e19c1bc323bb2c2cf6f Mon Sep 17 00:00:00 2001 +From: Yuan Can +Date: Mon, 5 Dec 2022 06:14:41 +0000 +Subject: [PATCH] wifi: rsi: Fix memory leak in rsi_coex_attach() +Git-commit: 956fb851a6e19da5ab491e19c1bc323bb2c2cf6f +Patch-mainline: v6.3-rc1 +References: git-fixes + +The coex_cb needs to be freed when rsi_create_kthread() failed in +rsi_coex_attach(). + +Fixes: 2108df3c4b18 ("rsi: add coex support") +Signed-off-by: Yuan Can +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221205061441.114632-1-yuancan@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/rsi/rsi_91x_coex.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/rsi/rsi_91x_coex.c b/drivers/net/wireless/rsi/rsi_91x_coex.c +index 8a3d86897ea8..45ac9371f262 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_coex.c ++++ b/drivers/net/wireless/rsi/rsi_91x_coex.c +@@ -160,6 +160,7 @@ int rsi_coex_attach(struct rsi_common *common) + rsi_coex_scheduler_thread, + "Coex-Tx-Thread")) { + rsi_dbg(ERR_ZONE, "%s: Unable to init tx thrd\n", __func__); ++ kfree(coex_cb); + return -EINVAL; + } + return 0; +-- +2.35.3 + diff --git a/patches.suse/wifi-rtl8xxxu-Fix-memory-leaks-with-RTL8723BU-RTL819.patch b/patches.suse/wifi-rtl8xxxu-Fix-memory-leaks-with-RTL8723BU-RTL819.patch new file mode 100644 index 0000000..3f91e7f --- /dev/null +++ b/patches.suse/wifi-rtl8xxxu-Fix-memory-leaks-with-RTL8723BU-RTL819.patch @@ -0,0 +1,76 @@ +From b39f662ce1648db0b9de32e6a849b098480793cb Mon Sep 17 00:00:00 2001 +From: Bitterblue Smith +Date: Thu, 22 Dec 2022 13:48:04 +0200 +Subject: [PATCH] wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU +Git-commit: b39f662ce1648db0b9de32e6a849b098480793cb +Patch-mainline: v6.3-rc1 +References: git-fixes + +The wifi + bluetooth combo chip RTL8723BU can leak memory (especially?) +when it's connected to a bluetooth audio device. The busy bluetooth +traffic generates lots of C2H (card to host) messages, which are not +freed correctly. + +To fix this, move the dev_kfree_skb() call in rtl8xxxu_c2hcmd_callback() +inside the loop where skb_dequeue() is called. + +The RTL8192EU leaks memory because the C2H messages are added to the +queue and left there forever. (This was fine in the past because it +probably wasn't sending any C2H messages until commit e542e66b7c2e +("wifi: rtl8xxxu: gen2: Turn on the rate control"). Since that commit +it sends a C2H message when the TX rate changes.) + +To fix this, delete the check for rf_paths > 1 and the goto. Let the +function process the C2H messages from RTL8192EU like the ones from +the other chips. + +Theoretically the RTL8188FU could also leak like RTL8723BU, but it +most likely doesn't send C2H messages frequently enough. + +This change was tested with RTL8723BU by Erhard F. I tested it with +RTL8188FU and RTL8192EU. + +Reported-by: Erhard F. +Tested-by: Erhard F. +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215197 +Fixes: e542e66b7c2e ("rtl8xxxu: add bluetooth co-existence support for single antenna") +Signed-off-by: Bitterblue Smith +Reviewed-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/03b099c1-c671-d252-36f4-57b70d721f9d@gmail.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index fd97c040948a..03ffb99da7e2 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -5702,9 +5702,6 @@ static void rtl8xxxu_c2hcmd_callback(struct work_struct *work) + btcoex = &priv->bt_coex; + rarpt = &priv->ra_report; + +- if (priv->rf_paths > 1) +- goto out; +- + while (!skb_queue_empty(&priv->c2hcmd_queue)) { + skb = skb_dequeue(&priv->c2hcmd_queue); + +@@ -5737,10 +5734,9 @@ static void rtl8xxxu_c2hcmd_callback(struct work_struct *work) + default: + break; + } +- } + +-out: +- dev_kfree_skb(skb); ++ dev_kfree_skb(skb); ++ } + } + + static void rtl8723bu_handle_c2h(struct rtl8xxxu_priv *priv, +-- +2.35.3 + diff --git a/patches.suse/wifi-rtl8xxxu-don-t-call-dev_kfree_skb-under-spin_lo.patch b/patches.suse/wifi-rtl8xxxu-don-t-call-dev_kfree_skb-under-spin_lo.patch new file mode 100644 index 0000000..33a90c7 --- /dev/null +++ b/patches.suse/wifi-rtl8xxxu-don-t-call-dev_kfree_skb-under-spin_lo.patch @@ -0,0 +1,47 @@ +From 4c2005ac87685907b3719b4f40215b578efd27c4 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Thu, 8 Dec 2022 22:35:17 +0800 +Subject: [PATCH] wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave() +Git-commit: 4c2005ac87685907b3719b4f40215b578efd27c4 +Patch-mainline: v6.3-rc1 +References: git-fixes + +It is not allowed to call kfree_skb() or consume_skb() from hardware +interrupt context or with hardware interrupts being disabled. + +It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. +The difference between them is free reason, dev_kfree_skb_irq() means +the SKB is dropped in error and dev_consume_skb_irq() means the SKB +is consumed in normal. + +In this case, dev_kfree_skb() is called to free and drop the SKB when +it's shutdown, so replace it with dev_kfree_skb_irq(). Compile tested +only. + +Fixes: 26f1fad29ad9 ("New driver: rtl8xxxu (mac80211)") +Signed-off-by: Yang Yingliang +Reviewed-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221208143517.2383424-1-yangyingliang@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index 799b03ec1980..c8b82c581011 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -5276,7 +5276,7 @@ static void rtl8xxxu_queue_rx_urb(struct rtl8xxxu_priv *priv, + pending = priv->rx_urb_pending_count; + } else { + skb = (struct sk_buff *)rx_urb->urb.context; +- dev_kfree_skb(skb); ++ dev_kfree_skb_irq(skb); + usb_free_urb(&rx_urb->urb); + } + +-- +2.35.3 + diff --git a/patches.suse/wifi-rtlwifi-Fix-global-out-of-bounds-bug-in-_rtl881.patch b/patches.suse/wifi-rtlwifi-Fix-global-out-of-bounds-bug-in-_rtl881.patch new file mode 100644 index 0000000..9387548 --- /dev/null +++ b/patches.suse/wifi-rtlwifi-Fix-global-out-of-bounds-bug-in-_rtl881.patch @@ -0,0 +1,157 @@ +From 117dbeda22ec5ea0918254d03b540ef8b8a64d53 Mon Sep 17 00:00:00 2001 +From: Li Zetao +Date: Mon, 12 Dec 2022 10:58:12 +0800 +Subject: [PATCH] wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() +Git-commit: 117dbeda22ec5ea0918254d03b540ef8b8a64d53 +Patch-mainline: v6.3-rc1 +References: git-fixes + +There is a global-out-of-bounds reported by KASAN: + + BUG: KASAN: global-out-of-bounds in + _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] + Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411 + + CPU: 6 PID: 411 Comm: NetworkManager Tainted: G D + 6.1.0-rc8+ #144 e15588508517267d37 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), + Call Trace: + + ... + kasan_report+0xbb/0x1c0 + _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] + rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae] + rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae] + ... + + +The root cause of the problem is that the comparison order of +"prate_section" in _rtl8812ae_phy_set_txpower_limit() is wrong. The +_rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two +strings from tail to head, which causes the problem. In the +_rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet +this requirement by carefully designing the comparison order. +For example, "pregulation" and "pbandwidth" are compared in order of +length from small to large, first is 3 and last is 4. However, the +comparison order of "prate_section" dose not obey such order requirement, +therefore when "prate_section" is "HT", when comparing from tail to head, +it will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As +mentioned above, the _rtl8812ae_eq_n_byte() has the same function as +strcmp(), so just strcmp() is enough. + +Fix it by removing _rtl8812ae_eq_n_byte() and use strcmp() barely. +Although it can be fixed by adjusting the comparison order of +"prate_section", this may cause the value of "rate_section" to not be +from 0 to 5. In addition, commit "21e4b0726dc6" not only moved driver +from staging to regular tree, but also added setting txpower limit +function during the driver config phase, so the problem was introduced +by this commit. + +Fixes: 21e4b0726dc6 ("rtlwifi: rtl8821ae: Move driver from staging to regular tree") +Signed-off-by: Li Zetao +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221212025812.1541311-1-lizetao1@huawei.com +Acked-by: Takashi Iwai + +--- + .../wireless/realtek/rtlwifi/rtl8821ae/phy.c | 52 +++++++------------ + 1 file changed, 20 insertions(+), 32 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c +index a29321e2fa72..5323ead30db0 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c +@@ -1598,18 +1598,6 @@ static bool _rtl8812ae_get_integer_from_string(const char *str, u8 *pint) + return true; + } + +-static bool _rtl8812ae_eq_n_byte(const char *str1, const char *str2, u32 num) +-{ +- if (num == 0) +- return false; +- while (num > 0) { +- num--; +- if (str1[num] != str2[num]) +- return false; +- } +- return true; +-} +- + static s8 _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(struct ieee80211_hw *hw, + u8 band, u8 channel) + { +@@ -1659,42 +1647,42 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, + power_limit = power_limit > MAX_POWER_INDEX ? + MAX_POWER_INDEX : power_limit; + +- if (_rtl8812ae_eq_n_byte(pregulation, "FCC", 3)) ++ if (strcmp(pregulation, "FCC") == 0) + regulation = 0; +- else if (_rtl8812ae_eq_n_byte(pregulation, "MKK", 3)) ++ else if (strcmp(pregulation, "MKK") == 0) + regulation = 1; +- else if (_rtl8812ae_eq_n_byte(pregulation, "ETSI", 4)) ++ else if (strcmp(pregulation, "ETSI") == 0) + regulation = 2; +- else if (_rtl8812ae_eq_n_byte(pregulation, "WW13", 4)) ++ else if (strcmp(pregulation, "WW13") == 0) + regulation = 3; + +- if (_rtl8812ae_eq_n_byte(prate_section, "CCK", 3)) ++ if (strcmp(prate_section, "CCK") == 0) + rate_section = 0; +- else if (_rtl8812ae_eq_n_byte(prate_section, "OFDM", 4)) ++ else if (strcmp(prate_section, "OFDM") == 0) + rate_section = 1; +- else if (_rtl8812ae_eq_n_byte(prate_section, "HT", 2) && +- _rtl8812ae_eq_n_byte(prf_path, "1T", 2)) ++ else if (strcmp(prate_section, "HT") == 0 && ++ strcmp(prf_path, "1T") == 0) + rate_section = 2; +- else if (_rtl8812ae_eq_n_byte(prate_section, "HT", 2) && +- _rtl8812ae_eq_n_byte(prf_path, "2T", 2)) ++ else if (strcmp(prate_section, "HT") == 0 && ++ strcmp(prf_path, "2T") == 0) + rate_section = 3; +- else if (_rtl8812ae_eq_n_byte(prate_section, "VHT", 3) && +- _rtl8812ae_eq_n_byte(prf_path, "1T", 2)) ++ else if (strcmp(prate_section, "VHT") == 0 && ++ strcmp(prf_path, "1T") == 0) + rate_section = 4; +- else if (_rtl8812ae_eq_n_byte(prate_section, "VHT", 3) && +- _rtl8812ae_eq_n_byte(prf_path, "2T", 2)) ++ else if (strcmp(prate_section, "VHT") == 0 && ++ strcmp(prf_path, "2T") == 0) + rate_section = 5; + +- if (_rtl8812ae_eq_n_byte(pbandwidth, "20M", 3)) ++ if (strcmp(pbandwidth, "20M") == 0) + bandwidth = 0; +- else if (_rtl8812ae_eq_n_byte(pbandwidth, "40M", 3)) ++ else if (strcmp(pbandwidth, "40M") == 0) + bandwidth = 1; +- else if (_rtl8812ae_eq_n_byte(pbandwidth, "80M", 3)) ++ else if (strcmp(pbandwidth, "80M") == 0) + bandwidth = 2; +- else if (_rtl8812ae_eq_n_byte(pbandwidth, "160M", 4)) ++ else if (strcmp(pbandwidth, "160M") == 0) + bandwidth = 3; + +- if (_rtl8812ae_eq_n_byte(pband, "2.4G", 4)) { ++ if (strcmp(pband, "2.4G") == 0) { + ret = _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(hw, + BAND_ON_2_4G, + channel); +@@ -1718,7 +1706,7 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, + regulation, bandwidth, rate_section, channel_index, + rtlphy->txpwr_limit_2_4g[regulation][bandwidth] + [rate_section][channel_index][RF90_PATH_A]); +- } else if (_rtl8812ae_eq_n_byte(pband, "5G", 2)) { ++ } else if (strcmp(pband, "5G") == 0) { + ret = _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(hw, + BAND_ON_5G, + channel); +-- +2.35.3 + diff --git a/patches.suse/wifi-rtlwifi-rtl8188ee-don-t-call-kfree_skb-under-sp.patch b/patches.suse/wifi-rtlwifi-rtl8188ee-don-t-call-kfree_skb-under-sp.patch new file mode 100644 index 0000000..ef851b2 --- /dev/null +++ b/patches.suse/wifi-rtlwifi-rtl8188ee-don-t-call-kfree_skb-under-sp.patch @@ -0,0 +1,57 @@ +From 2611687fa7ffc84190f92292de0b80468de17220 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Wed, 7 Dec 2022 22:14:10 +0800 +Subject: [PATCH] wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under spin_lock_irqsave() +Git-commit: 2611687fa7ffc84190f92292de0b80468de17220 +Patch-mainline: v6.3-rc1 +References: git-fixes + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. All the SKBs have +been dequeued from the old queue, so it's safe to enqueue these +SKBs to a free queue, then free them after spin_unlock_irqrestore() +at once. Compile tested only. + +Fixes: 7fe3b3abb5da ("rtlwifi: rtl8188ee: rtl8821ae: Fix a queue locking problem") +Signed-off-by: Yang Yingliang +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207141411.46098-3-yangyingliang@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c +index 58c2ab3d44be..de61c9c0ddec 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c +@@ -68,8 +68,10 @@ static void _rtl88ee_return_beacon_queue_skb(struct ieee80211_hw *hw) + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); + struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE]; ++ struct sk_buff_head free_list; + unsigned long flags; + ++ skb_queue_head_init(&free_list); + spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags); + while (skb_queue_len(&ring->queue)) { + struct rtl_tx_desc *entry = &ring->desc[ring->idx]; +@@ -79,10 +81,12 @@ static void _rtl88ee_return_beacon_queue_skb(struct ieee80211_hw *hw) + rtlpriv->cfg->ops->get_desc(hw, (u8 *)entry, + true, HW_DESC_TXBUFF_ADDR), + skb->len, DMA_TO_DEVICE); +- kfree_skb(skb); ++ __skb_queue_tail(&free_list, skb); + ring->idx = (ring->idx + 1) % ring->entries; + } + spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags); ++ ++ __skb_queue_purge(&free_list); + } + + static void _rtl88ee_disable_bcn_sub_func(struct ieee80211_hw *hw) +-- +2.35.3 + diff --git a/patches.suse/wifi-rtlwifi-rtl8723be-don-t-call-kfree_skb-under-sp.patch b/patches.suse/wifi-rtlwifi-rtl8723be-don-t-call-kfree_skb-under-sp.patch new file mode 100644 index 0000000..18d2383 --- /dev/null +++ b/patches.suse/wifi-rtlwifi-rtl8723be-don-t-call-kfree_skb-under-sp.patch @@ -0,0 +1,57 @@ +From 313950c2114e7051c4e3020fd82495fa1fb526a8 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Wed, 7 Dec 2022 22:14:11 +0800 +Subject: [PATCH] wifi: rtlwifi: rtl8723be: don't call kfree_skb() under spin_lock_irqsave() +Git-commit: 313950c2114e7051c4e3020fd82495fa1fb526a8 +Patch-mainline: v6.3-rc1 +References: git-fixes + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. All the SKBs have +been dequeued from the old queue, so it's safe to enqueue these +SKBs to a free queue, then free them after spin_unlock_irqrestore() +at once. Compile tested only. + +Fixes: 5c99f04fec93 ("rtlwifi: rtl8723be: Update driver to match Realtek release of 06/28/14") +Signed-off-by: Yang Yingliang +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207141411.46098-4-yangyingliang@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c +index 189cc6437600..0ba3bbed6ed3 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c +@@ -30,8 +30,10 @@ static void _rtl8723be_return_beacon_queue_skb(struct ieee80211_hw *hw) + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); + struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE]; ++ struct sk_buff_head free_list; + unsigned long flags; + ++ skb_queue_head_init(&free_list); + spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags); + while (skb_queue_len(&ring->queue)) { + struct rtl_tx_desc *entry = &ring->desc[ring->idx]; +@@ -41,10 +43,12 @@ static void _rtl8723be_return_beacon_queue_skb(struct ieee80211_hw *hw) + rtlpriv->cfg->ops->get_desc(hw, (u8 *)entry, + true, HW_DESC_TXBUFF_ADDR), + skb->len, DMA_TO_DEVICE); +- kfree_skb(skb); ++ __skb_queue_tail(&free_list, skb); + ring->idx = (ring->idx + 1) % ring->entries; + } + spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags); ++ ++ __skb_queue_purge(&free_list); + } + + static void _rtl8723be_set_bcn_ctrl_reg(struct ieee80211_hw *hw, +-- +2.35.3 + diff --git a/patches.suse/wifi-rtlwifi-rtl8821ae-don-t-call-kfree_skb-under-sp.patch b/patches.suse/wifi-rtlwifi-rtl8821ae-don-t-call-kfree_skb-under-sp.patch new file mode 100644 index 0000000..508ce57 --- /dev/null +++ b/patches.suse/wifi-rtlwifi-rtl8821ae-don-t-call-kfree_skb-under-sp.patch @@ -0,0 +1,57 @@ +From 106031c1f4a850915190d7ec1026696282f9359b Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Wed, 7 Dec 2022 22:14:09 +0800 +Subject: [PATCH] wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under spin_lock_irqsave() +Git-commit: 106031c1f4a850915190d7ec1026696282f9359b +Patch-mainline: v6.3-rc1 +References: git-fixes + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. All the SKBs have +been dequeued from the old queue, so it's safe to enqueue these +SKBs to a free queue, then free them after spin_unlock_irqrestore() +at once. Compile tested only. + +Fixes: 5c99f04fec93 ("rtlwifi: rtl8723be: Update driver to match Realtek release of 06/28/14") +Signed-off-by: Yang Yingliang +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207141411.46098-2-yangyingliang@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c +index 7e0f62d59fe1..a7e3250957dc 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c +@@ -26,8 +26,10 @@ static void _rtl8821ae_return_beacon_queue_skb(struct ieee80211_hw *hw) + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); + struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE]; ++ struct sk_buff_head free_list; + unsigned long flags; + ++ skb_queue_head_init(&free_list); + spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags); + while (skb_queue_len(&ring->queue)) { + struct rtl_tx_desc *entry = &ring->desc[ring->idx]; +@@ -37,10 +39,12 @@ static void _rtl8821ae_return_beacon_queue_skb(struct ieee80211_hw *hw) + rtlpriv->cfg->ops->get_desc(hw, (u8 *)entry, + true, HW_DESC_TXBUFF_ADDR), + skb->len, DMA_TO_DEVICE); +- kfree_skb(skb); ++ __skb_queue_tail(&free_list, skb); + ring->idx = (ring->idx + 1) % ring->entries; + } + spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags); ++ ++ __skb_queue_purge(&free_list); + } + + static void _rtl8821ae_set_bcn_ctrl_reg(struct ieee80211_hw *hw, +-- +2.35.3 + diff --git a/patches.suse/wifi-rtw89-Add-missing-check-for-alloc_workqueue.patch b/patches.suse/wifi-rtw89-Add-missing-check-for-alloc_workqueue.patch new file mode 100644 index 0000000..546e225 --- /dev/null +++ b/patches.suse/wifi-rtw89-Add-missing-check-for-alloc_workqueue.patch @@ -0,0 +1,43 @@ +From ed9e6166eb0984b718facb7ca59296098cc3aa64 Mon Sep 17 00:00:00 2001 +From: Jiasheng Jiang +Date: Wed, 4 Jan 2023 22:29:01 +0800 +Subject: [PATCH] wifi: rtw89: Add missing check for alloc_workqueue +Git-commit: ed9e6166eb0984b718facb7ca59296098cc3aa64 +Patch-mainline: v6.3-rc1 +References: git-fixes + +Add check for the return value of alloc_workqueue since it may return +NULL pointer. +Moreover, add destroy_workqueue when rtw89_load_firmware fails. + +Fixes: e3ec7017f6a2 ("rtw89: add Realtek 802.11ax driver") +Signed-off-by: Jiasheng Jiang +Acked-by: Ping-Ke Shih +Reviewed-by: Leon Romanovsky +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230104142901.1611-1-jiasheng@iscas.ac.cn +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/realtek/rtw89/core.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/wireless/realtek/rtw89/core.c ++++ b/drivers/net/wireless/realtek/rtw89/core.c +@@ -2289,6 +2289,8 @@ int rtw89_core_init(struct rtw89_dev *rt + INIT_DELAYED_WORK(&rtwdev->coex_rfk_chk_work, rtw89_coex_rfk_chk_work); + INIT_DELAYED_WORK(&rtwdev->cfo_track_work, rtw89_phy_cfo_track_work); + rtwdev->txq_wq = alloc_workqueue("rtw89_tx_wq", WQ_UNBOUND | WQ_HIGHPRI, 0); ++ if (!rtwdev->txq_wq) ++ return -ENOMEM; + spin_lock_init(&rtwdev->ba_lock); + mutex_init(&rtwdev->mutex); + mutex_init(&rtwdev->rf_mutex); +@@ -2310,6 +2312,7 @@ int rtw89_core_init(struct rtw89_dev *rt + ret = rtw89_load_firmware(rtwdev); + if (ret) { + rtw89_warn(rtwdev, "no firmware loaded\n"); ++ destroy_workqueue(rtwdev->txq_wq); + return ret; + } + rtw89_ser_init(rtwdev); diff --git a/patches.suse/wifi-wilc1000-fix-potential-memory-leak-in-wilc_mac_.patch b/patches.suse/wifi-wilc1000-fix-potential-memory-leak-in-wilc_mac_.patch new file mode 100644 index 0000000..eb786bd --- /dev/null +++ b/patches.suse/wifi-wilc1000-fix-potential-memory-leak-in-wilc_mac_.patch @@ -0,0 +1,36 @@ +From deb962ec9e1c9a81babd3d37542ad4bd6ac3396e Mon Sep 17 00:00:00 2001 +From: Zhang Changzhong +Date: Thu, 17 Nov 2022 19:36:03 +0800 +Subject: [PATCH] wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() +Git-commit: deb962ec9e1c9a81babd3d37542ad4bd6ac3396e +Patch-mainline: v6.3-rc1 +References: git-fixes + +The wilc_mac_xmit() returns NETDEV_TX_OK without freeing skb, add +dev_kfree_skb() to fix it. Compile tested only. + +Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver") +Signed-off-by: Zhang Changzhong +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1668684964-48622-1-git-send-email-zhangchangzhong@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/microchip/wilc1000/netdev.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/microchip/wilc1000/netdev.c b/drivers/net/wireless/microchip/wilc1000/netdev.c +index 9b319a455b96..6f3ae0dff77c 100644 +--- a/drivers/net/wireless/microchip/wilc1000/netdev.c ++++ b/drivers/net/wireless/microchip/wilc1000/netdev.c +@@ -730,6 +730,7 @@ netdev_tx_t wilc_mac_xmit(struct sk_buff *skb, struct net_device *ndev) + + if (skb->dev != ndev) { + netdev_err(ndev, "Packet not destined to this device\n"); ++ dev_kfree_skb(skb); + return NETDEV_TX_OK; + } + +-- +2.35.3 + diff --git a/patches.suse/wifi-wl3501_cs-don-t-call-kfree_skb-under-spin_lock_.patch b/patches.suse/wifi-wl3501_cs-don-t-call-kfree_skb-under-spin_lock_.patch new file mode 100644 index 0000000..77c0f70 --- /dev/null +++ b/patches.suse/wifi-wl3501_cs-don-t-call-kfree_skb-under-spin_lock_.patch @@ -0,0 +1,39 @@ +From 44bacbdf9066c590423259dbd6d520baac99c1a8 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Wed, 7 Dec 2022 23:04:53 +0800 +Subject: [PATCH] wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave() +Git-commit: 44bacbdf9066c590423259dbd6d520baac99c1a8 +Patch-mainline: v6.3-rc1 +References: git-fixes + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. So replace kfree_skb() +with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile +tested only. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yang Yingliang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207150453.114742-1-yangyingliang@huawei.com +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/wl3501_cs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c +index 1b532e00a56f..7fb2f9513476 100644 +--- a/drivers/net/wireless/wl3501_cs.c ++++ b/drivers/net/wireless/wl3501_cs.c +@@ -1328,7 +1328,7 @@ static netdev_tx_t wl3501_hard_start_xmit(struct sk_buff *skb, + } else { + ++dev->stats.tx_packets; + dev->stats.tx_bytes += skb->len; +- kfree_skb(skb); ++ dev_kfree_skb_irq(skb); + + if (this->tx_buffer_cnt < 2) + netif_stop_queue(dev); +-- +2.35.3 + diff --git a/patches.suse/x86-mm-Randomize-per-cpu-entry-area.patch b/patches.suse/x86-mm-Randomize-per-cpu-entry-area.patch new file mode 100644 index 0000000..b2bb81e --- /dev/null +++ b/patches.suse/x86-mm-Randomize-per-cpu-entry-area.patch @@ -0,0 +1,172 @@ +From: Peter Zijlstra +Date: Thu, 27 Oct 2022 14:54:41 -0700 +Subject: x86/mm: Randomize per-cpu entry area +Git-commit: 97e3d26b5e5f371b3ee223d94dd123e6c442ba80 +Patch-mainline: v6.2-rc1 +References: bsc#1207845 CVE-2023-0597 + +Seth found that the CPU-entry-area; the piece of per-cpu data that is +mapped into the userspace page-tables for kPTI is not subject to any +randomization -- irrespective of kASLR settings. + +On x86_64 a whole P4D (512 GB) of virtual address space is reserved for +this structure, which is plenty large enough to randomize things a +little. + +As such, use a straight forward randomization scheme that avoids +duplicates to spread the existing CPUs over the available space. + + [ bp: Fix le build. ] + +Reported-by: Seth Jenkins +Reviewed-by: Kees Cook +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Dave Hansen +Signed-off-by: Borislav Petkov +[mkoutny: v5.14 backport: init_cea_offsets() is called way before + prandom_init_early() initcall, prandom_u32_max() is not properly + seeded yet. Use KASLR seed and local state to generate CPU entry + areas offsets, this is based on the approach in + kernel_randomize_memory() and should provide same randomness + guarantees -- beware we don't get cryptographically secure random + offsets. This reduces effective entropy in exfiltrating *all* CPU + entry areas by log2(nr_cpus) bits, entropy for *any* CPU is + unaffected. + This was chosen instead of backporting f62384995e4c ("random: split + initialization into early step and later step") and crng related + reworks.] +Acked-by: Michal Koutný +--- + arch/x86/include/asm/cpu_entry_area.h | 4 -- + arch/x86/include/asm/pgtable_areas.h | 8 ++++- + arch/x86/kernel/hw_breakpoint.c | 2 - + arch/x86/mm/cpu_entry_area.c | 50 +++++++++++++++++++++++++++++++--- + 4 files changed, 54 insertions(+), 10 deletions(-) + +--- a/arch/x86/include/asm/cpu_entry_area.h ++++ b/arch/x86/include/asm/cpu_entry_area.h +@@ -130,10 +130,6 @@ struct cpu_entry_area { + }; + + #define CPU_ENTRY_AREA_SIZE (sizeof(struct cpu_entry_area)) +-#define CPU_ENTRY_AREA_ARRAY_SIZE (CPU_ENTRY_AREA_SIZE * NR_CPUS) +- +-/* Total size includes the readonly IDT mapping page as well: */ +-#define CPU_ENTRY_AREA_TOTAL_SIZE (CPU_ENTRY_AREA_ARRAY_SIZE + PAGE_SIZE) + + DECLARE_PER_CPU(struct cpu_entry_area *, cpu_entry_area); + DECLARE_PER_CPU(struct cea_exception_stacks *, cea_exception_stacks); +--- a/arch/x86/include/asm/pgtable_areas.h ++++ b/arch/x86/include/asm/pgtable_areas.h +@@ -11,6 +11,12 @@ + + #define CPU_ENTRY_AREA_RO_IDT_VADDR ((void *)CPU_ENTRY_AREA_RO_IDT) + +-#define CPU_ENTRY_AREA_MAP_SIZE (CPU_ENTRY_AREA_PER_CPU + CPU_ENTRY_AREA_ARRAY_SIZE - CPU_ENTRY_AREA_BASE) ++#ifdef CONFIG_X86_32 ++#define CPU_ENTRY_AREA_MAP_SIZE (CPU_ENTRY_AREA_PER_CPU + \ ++ (CPU_ENTRY_AREA_SIZE * NR_CPUS) - \ ++ CPU_ENTRY_AREA_BASE) ++#else ++#define CPU_ENTRY_AREA_MAP_SIZE P4D_SIZE ++#endif + + #endif /* _ASM_X86_PGTABLE_AREAS_H */ +--- a/arch/x86/kernel/hw_breakpoint.c ++++ b/arch/x86/kernel/hw_breakpoint.c +@@ -266,7 +266,7 @@ static inline bool within_cpu_entry(unsi + + /* CPU entry erea is always used for CPU entry */ + if (within_area(addr, end, CPU_ENTRY_AREA_BASE, +- CPU_ENTRY_AREA_TOTAL_SIZE)) ++ CPU_ENTRY_AREA_MAP_SIZE)) + return true; + + /* +--- a/arch/x86/mm/cpu_entry_area.c ++++ b/arch/x86/mm/cpu_entry_area.c +@@ -5,6 +5,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -15,16 +16,56 @@ static DEFINE_PER_CPU_PAGE_ALIGNED(struc + #ifdef CONFIG_X86_64 + static DEFINE_PER_CPU_PAGE_ALIGNED(struct exception_stacks, exception_stacks); + DEFINE_PER_CPU(struct cea_exception_stacks*, cea_exception_stacks); +-#endif + +-#ifdef CONFIG_X86_32 ++static DEFINE_PER_CPU_READ_MOSTLY(unsigned long, _cea_offset); ++ ++static __always_inline unsigned int cea_offset(unsigned int cpu) ++{ ++ return per_cpu(_cea_offset, cpu); ++} ++ ++static __init void init_cea_offsets(void) ++{ ++ struct rnd_state rand_state; ++ unsigned int max_cea, rand; ++ unsigned int i, j; ++ ++ max_cea = (CPU_ENTRY_AREA_MAP_SIZE - PAGE_SIZE) / CPU_ENTRY_AREA_SIZE; ++ prandom_seed_state(&rand_state, kaslr_get_random_long("CPU entry")); ++ ++ /* O(sodding terrible) */ ++ for_each_possible_cpu(i) { ++ unsigned int cea; ++ ++again: ++ prandom_bytes_state(&rand_state, &rand, sizeof(rand)); ++ cea = rand % max_cea; ++ ++ for_each_possible_cpu(j) { ++ if (cea_offset(j) == cea) ++ goto again; ++ ++ if (i == j) ++ break; ++ } ++ ++ per_cpu(_cea_offset, i) = cea; ++ } ++} ++#else /* !X86_64 */ + DECLARE_PER_CPU_PAGE_ALIGNED(struct doublefault_stack, doublefault_stack); ++ ++static __always_inline unsigned int cea_offset(unsigned int cpu) ++{ ++ return cpu; ++} ++static inline void init_cea_offsets(void) { } + #endif + + /* Is called from entry code, so must be noinstr */ + noinstr struct cpu_entry_area *get_cpu_entry_area(int cpu) + { +- unsigned long va = CPU_ENTRY_AREA_PER_CPU + cpu * CPU_ENTRY_AREA_SIZE; ++ unsigned long va = CPU_ENTRY_AREA_PER_CPU + cea_offset(cpu) * CPU_ENTRY_AREA_SIZE; + BUILD_BUG_ON(sizeof(struct cpu_entry_area) % PAGE_SIZE != 0); + + return (struct cpu_entry_area *) va; +@@ -205,7 +246,6 @@ static __init void setup_cpu_entry_area_ + + /* The +1 is for the readonly IDT: */ + BUILD_BUG_ON((CPU_ENTRY_AREA_PAGES+1)*PAGE_SIZE != CPU_ENTRY_AREA_MAP_SIZE); +- BUILD_BUG_ON(CPU_ENTRY_AREA_TOTAL_SIZE != CPU_ENTRY_AREA_MAP_SIZE); + BUG_ON(CPU_ENTRY_AREA_BASE & ~PMD_MASK); + + start = CPU_ENTRY_AREA_BASE; +@@ -221,6 +261,8 @@ void __init setup_cpu_entry_areas(void) + { + unsigned int cpu; + ++ init_cea_offsets(); ++ + setup_cpu_entry_area_ptes(); + + for_each_possible_cpu(cpu) diff --git a/series.conf b/series.conf index bb2a615..202e388 100644 --- a/series.conf +++ b/series.conf @@ -6060,6 +6060,8 @@ patches.suse/platform-x86-wmi-make-GUID-block-packed.patch patches.suse/platform-x86-wmi-do-not-fail-if-disabling-fails.patch patches.suse/platform-x86-wmi-introduce-helper-to-convert-driver-.patch + patches.suse/platform-x86-amd-pmc-Export-Idlemask-values-based-on.patch + patches.suse/platform-x86-amd-pmc-Fix-compilation-when-CONFIG_DEB.patch patches.suse/ABI-sysfs-platform-dell-privacy-wmi-correct-ABI-entr.patch patches.suse/ABI-sysfs-platform-intel-pmc-add-blank-lines-to-make.patch patches.suse/platform-x86-thinkpad_acpi-Fix-bitwise-vs.-logical-w.patch @@ -6473,6 +6475,7 @@ patches.suse/staging-ks7010-select-CRYPTO_HASH-CRYPTO_MICHAEL_MIC.patch patches.suse/staging-wlan-ng-Avoid-bitwise-vs-logical-OR-warning-.patch patches.suse/staging-mt7621-dts-change-some-node-hex-addresses-to.patch + patches.suse/staging-mt7621-dts-change-palmbus-address-to-lower-c.patch patches.suse/staging-rtl8712-fix-use-after-free-in-rtl8712_dl_fw.patch patches.suse/staging-rtl8192u-fix-control-message-timeouts.patch patches.suse/staging-r8712u-fix-control-message-timeout.patch @@ -6957,6 +6960,7 @@ patches.suse/NFS-Default-change_attr_type-to-NFS4_CHANGE_TYPE_IS_.patch patches.suse/NFS-Don-t-set-NFS_INO_DATA_INVAL_DEFER-and-NFS_INO_I.patch patches.suse/NFS-Ignore-the-directory-size-when-marking-for-reval.patch + patches.suse/NFS-Further-optimisations-for-ls-l.patch patches.suse/NFS-Fix-dentry-verifier-races.patch patches.suse/pnfs-flexfiles-Fix-misplaced-barrier-in-nfs4_ff_layo.patch patches.suse/NFS-Fix-deadlocks-in-nfs_scan_commit_list.patch @@ -6969,7 +6973,11 @@ patches.suse/NFSv4-Fix-a-regression-in-nfs_set_open_stateid_locke.patch patches.suse/SUNRPC-Check-if-the-xprt-is-connected-before-handlin.patch patches.suse/SUNRPC-Prevent-immediate-close-reconnect.patch + patches.suse/NFS-Don-t-allocate-nfs_fattr-on-the-stack-in-__nfs42.patch + patches.suse/NFS-Always-initialise-fattr-label-in-nfs_fattr_alloc.patch + patches.suse/NFS-Create-a-new-nfs_alloc_fattr_with_label-function.patch patches.suse/nfsd-don-t-alloc-under-spinlock-in-rpc_parse_scope_i.patch + patches.suse/NFSD-Have-legacy-NFSD-WRITE-decoders-use-xdr_stream_.patch patches.suse/ext4-fix-lazy-initialization-next-schedule-time-comp.patch patches.suse/ext4-ensure-enough-credits-in-ext4_ext_shift_path_ex.patch patches.suse/ext4-refresh-the-ext4_ext_path-struct-after-dropping.patch @@ -7490,6 +7498,7 @@ patches.suse/iommu-amd-Clarify-AMD-IOMMUv2-initialization-messages patches.suse/iommu-rockchip-fix-page_desc_hi_masks-for-rk3568 patches.suse/iommu-vt-d-fix-unmap_pages-support + patches.suse/locking-rwsem-Make-handoff-bit-handling-more-consist.patch patches.suse/locking-rwsem-Optimize-down_read_trylock-under-highl.patch patches.suse/perf-Ignore-sigtrap-for-tracepoints-destined-for-other-tasks.patch patches.suse/sched-scs-Reset-task-stack-state-in-bringup_cpu.patch @@ -8333,6 +8342,7 @@ patches.suse/drm-vmwgfx-Release-ttm-memory-if-probe-fails.patch patches.suse/drm-vmwgfx-Fail-to-initialize-on-broken-configs.patch patches.suse/dma_fence_array-Fix-PENDING_ERROR-leak-in-dma_fence_.patch + patches.suse/drm-i915-gen11-Moving-WAs-to-icl_gt_workarounds_init.patch patches.suse/drm-i915-migrate-don-t-check-the-scratch-page.patch patches.suse/drm-i915-migrate-fix-offset-calculation.patch patches.suse/drm-i915-migrate-fix-length-calculation.patch @@ -9248,6 +9258,7 @@ patches.suse/char-mwave-Adjust-io-port-register-size.patch patches.suse/w1-Misuse-of-get_user-put_user-reported-by-sparse.patch patches.suse/uio-uio_dmem_genirq-Catch-the-Exception.patch + patches.suse/selftest-lkdtm-Skip-stack-entropy-test-if-lkdtm-is-n.patch patches.suse/bus-mhi-pci_generic-Graceful-shutdown-on-freeze.patch patches.suse/bus-mhi-core-Fix-reading-wake_capable-channel-config.patch patches.suse/coresight-Use-devm_bitmap_zalloc-when-applicable.patch @@ -9259,6 +9270,7 @@ patches.suse/iio-trigger-Fix-a-scheduling-whilst-atomic-issue-see.patch patches.suse/iio-adc-ti-adc081c-Partial-revert-of-removal-of-ACPI.patch patches.suse/interconnect-qcom-rpm-Prevent-integer-overflow-in-ra.patch + patches.suse/phy-tegra-xusb-Fix-return-value-of-tegra_xusb_find_p.patch patches.suse/phy-uniphier-usb3ss-fix-unintended-writing-zeros-to-.patch patches.suse/phy-mediatek-Fix-missing-check-in-mtk_mipi_tx_probe.patch patches.suse/phy-cadence-Sierra-Fix-to-get-correct-parent-for-mux.patch @@ -9299,6 +9311,7 @@ patches.suse/NFSD-Fix-zero-length-NFSv3-WRITEs.patch patches.suse/NFSD-Fix-verifier-returned-in-stable-WRITEs.patch patches.suse/nfsd-Replace-use-of-rwsem-with-errseq_t.patch + patches.suse/NFSD-De-duplicate-net_generic-nf-nf_net-nfsd_net_id.patch patches.suse/Revert-nfsd-skip-some-unnecessary-stats-in-the-v4-ca.patch patches.suse/nfsd-fix-crash-on-COPY_NOTIFY-with-special-stateid.patch patches.suse/SUNRPC-Fix-sockaddr-handling-in-the-svc_xprt_create_error-trace-point.patch @@ -9580,8 +9593,19 @@ patches.suse/NFS-don-t-store-struct-cred-in-struct-nfs_access_ent.patch patches.suse/NFS-Ensure-the-server-has-an-up-to-date-ctime-before.patch patches.suse/NFS-Ensure-the-server-has-an-up-to-date-ctime-rename.patch + patches.suse/NFSv4-only-print-the-label-when-its-queried.patch + patches.suse/nfs-nfs4clinet-check-the-return-value-of-kstrdup.patch + patches.suse/NFSv4.1-Fix-uninitialised-variable-in-devicenotify.patch patches.suse/0001-NFSv4-Handle-case-where-the-lookup-of-a-directory-fa.patch patches.suse/NFSv4-nfs_atomic_open-can-race-when-looking-up-a-non.patch + patches.suse/NFSv4-remove-zero-number-of-fs_locations-entries-err.patch + patches.suse/NFSv4-store-server-support-for-fs_location-attribute.patch + patches.suse/NFSv4.1-query-for-fs_location-attr-on-a-new-file-sys.patch + patches.suse/NFSv4-expose-nfs_parse_server_name-function.patch + patches.suse/NFSv4-handle-port-presence-in-fs_location-server-str.patch + patches.suse/SUNRPC-allow-for-unspecified-transport-time-in-rpc_c.patch + patches.suse/net-sunrpc-fix-reference-count-leaks-in-rpc_sysfs_xp.patch + patches.suse/sunrpc-Fix-potential-race-conditions-in-rpc_sysfs_xp.patch patches.suse/SUNRPC-Don-t-dereference-xprt-snd_task-if-it-s-a-cookie.patch patches.suse/rpmsg-char-Fix-race-between-the-release-of-rpmsg_ctr.patch patches.suse/rpmsg-char-Fix-race-between-the-release-of-rpmsg_ept.patch @@ -9737,6 +9761,7 @@ patches.suse/irqchip-realtek-rtl-Service-all-pending-interrupts.patch patches.suse/audit-improve-audit-queue-handling-when-audit-1-on-c.patch patches.suse/platform-x86-touchscreen_dmi-Add-info-for-the-RWC-NA.patch + patches.suse/platform-x86-amd-pmc-Correct-usage-of-SMU-version.patch patches.suse/spi-stm32-qspi-Update-spi-registering.patch patches.suse/spi-meson-spicc-add-IRQ-check-in-meson_spicc_probe.patch patches.suse/spi-uniphier-fix-reference-count-leak-in-uniphier_sp.patch @@ -9914,6 +9939,7 @@ patches.suse/NFSD-Fix-ia_size-underflow.patch patches.suse/NFSD-Fix-NFSv3-SETATTR-CREATE-s-handling-of-large-fi.patch patches.suse/NFSD-Clamp-WRITE-offsets.patch + patches.suse/NFSD-COMMIT-operations-must-not-return-NFS-ERR_INVAL.patch patches.suse/NFSD-Fix-offset-type-in-I-O-trace-points.patch patches.suse/tipc-improve-size-validations-for-received-domain-re.patch patches.suse/selftests-fixup-build-warnings-in-pidfd-clone3-tests.patch @@ -10740,6 +10766,7 @@ patches.suse/cifs-we-do-not-need-a-spinlock-around-the-tree-access-during-umount.patch patches.suse/cifs-use-a-different-reconnect-helper-for-non-cifsd-threads.patch patches.suse/nfsd-more-robust-allocation-failure-handling-in-nfsd.patch + patches.suse/NFSD-Fix-nfsd_breaker_owns_lease-return-values.patch patches.suse/NFSD-prevent-underflow-in-nfssvc_decode_writeargs.patch patches.suse/NFSD-prevent-integer-overflow-on-32-bit-systems.patch patches.suse/ext4-correct-cluster-len-and-clusters-changed-accoun.patch @@ -10766,6 +10793,7 @@ patches.suse/perf-x86-intel-pt-Fix-address-filter-config-for-32-bit-kernel.patch patches.suse/perf-x86-intel-uncore-Make-uncore_discovery-clean-for-64-bit-addresses.patch patches.suse/locking-lockdep-Avoid-potential-access-of-invalid-me.patch + patches.suse/locking-Add-missing-__sched-attributes.patch patches.suse/atomics-Fix-atomic64_-read_acquire-set_release-fallb.patch patches.suse/locking-lockdep-Iterate-lock_classes-directly-when-r.patch patches.suse/sched-debug-Remove-mpol_get-put-and-task_lock-unlock.patch @@ -11536,6 +11564,7 @@ patches.suse/platform-x86-Add-Intel-Software-Defined-Silicon-driv.patch patches.suse/tools-arch-x86-Add-Intel-SDSi-provisiong-tool.patch patches.suse/platform-x86-huawei-wmi-check-the-return-value-of-de.patch + patches.suse/ACPI-x86-Add-support-for-LPS0-callback-handler.patch patches.suse/HID-intel-ish-hid-Use-dma_alloc_coherent-for-firmwar.patch patches.suse/HID-i2c-hid-fix-GET-SET_REPORT-for-unnumbered-report.patch patches.suse/gpiolib-make-struct-comments-into-real-kernel-docs.patch @@ -11775,6 +11804,8 @@ patches.suse/fs-fd-tables-have-to-be-multiples-of-BITS_PER_LONG.patch patches.suse/jfs-fix-divide-error-in-dbNextAG.patch patches.suse/jfs-prevent-NULL-deref-in-diFree.patch + patches.suse/NFSv4.2-fix-reference-count-leaks-in-_nfs42_proc_cop.patch + patches.suse/NFSv4-Protect-the-state-recovery-thread-against-dire.patch patches.suse/NFS-NFSv2-v3-clients-should-never-be-setting-NFS_CAP.patch patches.suse/NFS-Use-of-mapping_set_error-results-in-spurious-err.patch patches.suse/NFS-Return-valid-errors-from-nfs2-3_decode_dirent.patch @@ -11785,6 +11816,7 @@ patches.suse/SUNRPC-improve-swap-handling-scheduling-and-PF_MEMAL.patch patches.suse/0001-SUNRPC-change-locking-for-xs_swap_enable-disable.patch patches.suse/SUNRPC-Don-t-call-connect-more-than-once-on-a-TCP-so.patch + patches.suse/SUNRPC-Fix-socket-waits-for-write-buffer-space.patch patches.suse/SUNRPC-avoid-race-between-mod_timer-and-del_timer_sy.patch patches.suse/SUNRPC-don-t-resend-a-task-on-an-offlined-transport.patch patches.suse/NFSv4.1-don-t-retry-BIND_CONN_TO_SESSION-on-session-.patch @@ -12100,6 +12132,7 @@ patches.suse/nfc-nci-add-flush_workqueue-to-prevent-uaf.patch patches.suse/net-dsa-felix-fix-tagging-protocol-changes-with-mult.patch patches.suse/net-bcmgenet-Revert-Use-stronger-register-read-write.patch + patches.suse/VFS-filename_create-fix-incorrect-intent.patch patches.suse/cifs-Check-the-IOCB_DIRECT-flag-not-O_DIRECT.patch patches.suse/cifs-release-cached-dentries-only-if-mount-is-complete.patch patches.suse/cifs-Split-the-smb3_add_credits-tracepoint.patch @@ -12720,6 +12753,9 @@ patches.suse/of-Support-more-than-one-crash-kernel-regions-for-ke.patch patches.suse/kselftest-arm64-bti-force-static-linking.patch patches.suse/arm64-compat-Do-not-treat-syscall-number-as-ESR_ELx-.patch + patches.suse/locking-rwsem-No-need-to-check-for-handoff-bit-if-wa.patch + patches.suse/locking-rwsem-Conditionally-wake-waiters-in-reader-w.patch + patches.suse/locking-rwsem-Always-try-to-wake-waiters-in-out_nolo.patch patches.suse/scripts-faddr2line-Fix-overlapping-text-section-fail.patch patches.suse/perf-amd-ibs-cascade-pmu-init-functions-return-value.patch patches.suse/perf-amd-ibs-use-is_visible-callback-for-dynamic-attributes.patch @@ -12959,6 +12995,7 @@ patches.suse/drm-panel-simple-Add-missing-bus-flags-for-Innolux-G.patch patches.suse/drm-amdgpu-sdma-Fix-incorrect-calculations-of-the-wp.patch patches.suse/drm-amdgpu-disable-runtime-pm-on-several-sienna-cich.patch + patches.suse/malidp-Fix-NULL-vs-IS_ERR-checking.patch patches.suse/drm-plane-Move-range-check-for-format_count-earlier.patch patches.suse/drm-bridge-tc358767-Fix-e-DP-bridge-endpoint-parsing.patch patches.suse/drm-panel-panel-simple-Fix-proper-bpc-for-AM-1280800.patch @@ -14228,6 +14265,7 @@ patches.suse/ARM-9216-1-Fix-MAX_DMA_ADDRESS-overflow.patch patches.suse/ARM-findbit-fix-overflowing-offset.patch patches.suse/edac-ghes-set-the-dimm-label-unconditionally.patch + patches.suse/locking-rwsem-Allow-slowpath-writer-to-ignore-handof.patch patches.suse/revert-x86-sev-expose-sev_es_ghcb_hv_call-for-use-by-hyperv.patch patches.suse/docs-kernel-parameters-Update-descriptions-for-mitig.patch patches.suse/arm64-errata-Add-Cortex-A510-to-the-repeat-tlbi-list.patch @@ -14486,6 +14524,7 @@ patches.suse/drm-bridge-lt9611uxc-Cancel-only-driver-s-work.patch patches.suse/virtio-gpu-fix-a-missing-check-to-avoid-NULL-derefer.patch patches.suse/udmabuf-Set-the-DMA-mask-for-the-udmabuf-device-v2.patch + patches.suse/drm-virtio-Fix-NULL-vs-IS_ERR-checking-in-virtio_gpu.patch patches.suse/drm-adv7511-override-i2c-address-of-cec-before-acces.patch patches.suse/0009-fbcon-Fix-accelerated-fbdev-scrolling-while-logo-is-.patch patches.suse/fbcon-Fix-boundary-checks-for-fbcon-vc-n1-n2-paramet.patch @@ -16160,6 +16199,7 @@ patches.suse/powerpc-pseries-vas-Pass-hw_cpu_id-to-node-associati.patch patches.suse/signal-break-out-of-wait-loops-on-kthread_stop.patch patches.suse/sched-core-Introduce-sched_asym_cpucap_active.patch + patches.suse/locking-rwsem-Disable-preemption-while-trying-for-rw.patch patches.suse/cgroup-cpuset-Enable-update_tasks_cpumask-on-top_cpuset.patch patches.suse/livepatch-fix-race-between-fork-and-KLP-transition.patch patches.suse/livepatch-Add-a-missing-newline-character-in-klp_mod.patch @@ -16297,6 +16337,7 @@ patches.suse/drm-amd-pm-smu7_hwmgr-fix-potential-off-by-one-overf.patch patches.suse/drm-amd-display-Fix-build-breakage-with-CONFIG_DEBUG.patch patches.suse/ext4-f2fs-fix-readahead-of-verity-data.patch + patches.suse/mm-memory.c-fix-race-when-faulting-a-device-private-page.patch patches.suse/arm64-errata-Add-Cortex-A55-to-the-repeat-tlbi-list.patch patches.suse/arm64-mte-Avoid-setting-PG_mte_tagged-if-no-tags-cle.patch patches.suse/arm64-Add-AMPERE1-to-the-Spectre-BHB-affected-list.patch @@ -16343,6 +16384,7 @@ patches.suse/gcov-support-GCC-12.1-and-newer-compilers.patch patches.suse/ocfs2-fix-BUG-when-iput-after-ocfs2_mknod-fails.patch patches.suse/ocfs2-clear-dinode-links-count-in-case-of-error.patch + patches.suse/nouveau-fix-migrate_to_ram-for-faulting-page.patch patches.suse/selinux-enable-use-of-both-GFP_KERNEL-and-GFP_ATOMIC.patch patches.suse/scsi-core-Restrict-legal-sdev_state-transitions-via-sysfs.patch patches.suse/scsi-lpfc-Fix-memory-leak-in-lpfc_create_port.patch @@ -16821,6 +16863,7 @@ patches.suse/ASoC-rt711-sdca-fix-the-latency-time-of-clock-stop-p.patch patches.suse/ASoC-max98373-Add-checks-for-devm_kcalloc.patch patches.suse/ASoC-soc-pcm-Add-NULL-check-in-BE-reparenting.patch + patches.suse/mm-memory-return-vm_fault_t-result-from-migrate_to_ram-callback.patch patches.suse/nilfs2-fix-nilfs_sufile_mark_dirty-not-set-segment-u.patch patches.suse/msft-hv-2700-x86-hyperv-Restore-VP-assist-page-after-cpu-offlinin.patch patches.suse/msft-hv-2680-scsi-storvsc-Fix-handling-of-srb_status-and-capacity.patch @@ -17052,6 +17095,8 @@ patches.suse/sched-uclamp-Make-asym_fits_capacity-use-util_fits_c.patch patches.suse/sched-Clear-ttwu_pending-after-enqueue_task.patch patches.suse/selftests-Use-optional-USERCFLAGS-and-USERLDFLAGS.patch + patches.suse/selftests-ftrace-Add-check-for-ping-command-for-trig.patch + patches.suse/selftests-ftrace-Convert-tracer-tests-to-use-require.patch patches.suse/selftests-ftrace-event_triggers-wait-longer-for-test.patch patches.suse/selftests-efivarfs-Add-checking-of-the-test-return-v.patch patches.suse/Documentation-devres-add-missing-PWM-helper.patch @@ -17109,6 +17154,23 @@ patches.suse/drbd-destroy-workqueue-when-drbd-device-was-freed.patch patches.suse/blk-mq-fix-possible-memleak-when-register-hctx-failed-4b7a.patch patches.suse/block-mq-deadline-Rename-deadline_is_seq_writes-3692.patch + patches.suse/nvme-auth-rename-__nvme_auth_-reset-free-to-nvme_aut.patch + patches.suse/nvme-auth-rename-authentication-work-elements.patch + patches.suse/nvme-auth-remove-symbol-export-from-nvme_auth_reset.patch + patches.suse/nvme-auth-don-t-re-authenticate-if-the-controller-is.patch + patches.suse/nvme-auth-remove-redundant-buffer-deallocations.patch + patches.suse/nvme-auth-don-t-ignore-key-generation-failures-when-.patch + patches.suse/nvme-auth-don-t-override-ctrl-keys-before-validation.patch + patches.suse/nvme-auth-remove-redundant-if-statement.patch + patches.suse/nvme-auth-don-t-keep-long-lived-4k-dhchap-buffer.patch + patches.suse/nvme-auth-guarantee-dhchap-buffers-under-memory-pres.patch + patches.suse/nvme-auth-clear-sensitive-info-right-after-authentic.patch + patches.suse/nvme-auth-remove-redundant-deallocations.patch + patches.suse/nvme-auth-no-need-to-reset-chap-contexts-on-re-authe.patch + patches.suse/nvme-auth-check-chap-ctrl_key-once-constructed.patch + patches.suse/nvme-auth-convert-dhchap_auth_list-to-an-array.patch + patches.suse/nvme-auth-remove-redundant-auth_work-flush.patch + patches.suse/nvme-auth-have-dhchap_auth_work-wait-for-queues-auth.patch patches.suse/block-Do-not-reread-partition-table-on-exclusively-o.patch patches.suse/floppy-Fix-memory-leak-in-do_floppy_init.patch patches.suse/0043-blktrace-Fix-output-non-blktrace-event-when-blk_classic-option-enabled.patch @@ -17141,6 +17203,7 @@ patches.suse/media-i2c-ad5820-Fix-error-path.patch patches.suse/staging-media-tegra-video-fix-chan-mipi-value-on-err.patch patches.suse/staging-media-tegra-video-fix-device_node-use-after-.patch + patches.suse/media-dvb-core-Fix-UAF-due-to-refcount-races-at-rele.patch patches.suse/media-vivid-fix-compose-size-exceed-boundary.patch patches.suse/media-v4l2-ctrls-Fix-off-by-one-error-in-integer-men.patch patches.suse/media-adv748x-afe-Select-input-port-when-initializin.patch @@ -17154,6 +17217,8 @@ patches.suse/media-dvb-core-Fix-ignored-return-value-in-dvb_regis.patch patches.suse/media-dvb-usb-az6027-fix-null-ptr-deref-in-az6027_i2.patch patches.suse/media-saa7164-fix-missing-pci_disable_device.patch + patches.suse/media-coda-Add-check-for-dcoda_iram_alloc.patch + patches.suse/media-coda-Add-check-for-kmalloc.patch patches.suse/media-si470x-Fix-use-after-free-in-si470x_int_in_cal.patch patches.suse/drm-edid-Fix-minimum-bpc-supported-with-DSC1.2-for-H.patch patches.suse/drm-bridge-adv7533-remove-dynamic-lane-switching-fro.patch @@ -17244,6 +17309,11 @@ patches.suse/mmc-core-Normalize-the-error-handling-branch-in-sd_r.patch patches.suse/mmc-vub300-fix-warning-do-not-call-blocking-ops-when.patch patches.suse/mmc-sdhci-sprd-Disable-CLK_AUTO-when-the-clock-is-le.patch + patches.suse/clk-mxl-Switch-from-direct-readl-writel-based-IO-to-.patch + patches.suse/clk-mxl-Remove-redundant-spinlocks.patch + patches.suse/clk-mxl-Add-option-to-override-gate-clks.patch + patches.suse/clk-mxl-Fix-a-clk-entry-by-adding-relevant-flags.patch + patches.suse/clk-mxl-syscon_node_to_regmap-returns-error-pointers.patch patches.suse/clk-samsung-Fix-memory-leak-in-_samsung_clk_register.patch patches.suse/clk-st-Fix-memory-leak-in-st_of_quadfs_setup.patch patches.suse/clk-socfpga-Fix-memory-leak-in-socfpga_gate_init.patch @@ -17511,7 +17581,11 @@ patches.suse/HSI-omap_ssi_core-fix-unbalanced-pm_runtime_disable.patch patches.suse/HSI-omap_ssi_core-fix-possible-memory-leak-in-ssi_pr.patch patches.suse/HSI-omap_ssi_core-Fix-error-handling-in-ssi_init.patch + patches.suse/x86-mm-Randomize-per-cpu-entry-area.patch patches.suse/powerpc-xive-add-missing-iounmap-in-error-path-in-xi.patch + patches.suse/selftests-powerpc-Move-perror-closer-to-its-use.patch + patches.suse/selftests-powerpc-Bump-up-rlimit-for-perf-hwbreak-test.patch + patches.suse/selftests-powerpc-Account-for-offline-cpus-in-perf-hwbreak-test.patch patches.suse/powerpc-perf-callchain-validate-kernel-stack-pointer.patch patches.suse/selftests-powerpc-Fix-resource-leaks.patch patches.suse/powerpc-export-the-CPU-node-count.patch @@ -17608,6 +17682,7 @@ patches.suse/0001-exit-Use-READ_ONCE-for-all-oops-warn-limit-reads.patch patches.suse/regulator-core-fix-deadlock-on-regulator-enable.patch patches.suse/0054-block-bfq-fix-uaf-for-bfqq-in-bfq_exit_icq_bfqq.patch + patches.suse/nvme-auth-fix-smatch-warning-complaints.patch patches.suse/ALSA-line6-correct-midi-status-byte-when-receiving-d.patch patches.suse/ALSA-line6-fix-stack-overflow-in-line6_midi_transmit.patch patches.suse/ALSA-hda-realtek-Apply-dual-codec-fixup-for-Dell-Lat.patch @@ -17639,6 +17714,7 @@ patches.suse/net-sched-cbq-dont-intepret-cls-results-when-asked-t.patch patches.suse/octeontx2-pf-Fix-lmtst-ID-used-in-aura-free.patch patches.suse/usb-rndis_host-Secure-rndis_query-check-against-int-.patch + patches.suse/net-ulp-prevent-ULP-without-clone-op-from-entering-t.patch patches.suse/caif-fix-memory-leak-in-cfctrl_linkup_request.patch patches.suse/thermal-int340x-Add-missing-attribute-for-data-rate-.patch patches.suse/ARM-renumber-bits-related-to-_TIF_WORK_MASK.patch @@ -17649,6 +17725,7 @@ patches.suse/drm-i915-unpin-on-error-in-intel_vgpu_shadow_mm_pin.patch patches.suse/drm-i915-gvt-fix-gvt-debugfs-destroy.patch patches.suse/drm-i915-gvt-fix-vgpu-debugfs-clean-in-remove.patch + patches.suse/0001-drm-i915-gvt-fix-double-free-bug-in-split_2MB_gtt_en.patch patches.suse/RDMA-srp-Move-large-values-to-a-new-enum-for-gcc13.patch patches.suse/RDMA-mlx5-Fix-mlx5_ib_get_hw_stats-when-used-for-dev.patch patches.suse/RDMA-mlx5-Fix-validation-of-max_rd_atomic-caps-for-D.patch @@ -17739,6 +17816,7 @@ patches.suse/wifi-brcmfmac-fix-regression-for-Broadcom-PCIe-wifi-.patch patches.suse/wifi-rndis_wlan-Prevent-buffer-overflow-in-rndis_que.patch patches.suse/Revert-wifi-mac80211-fix-memory-leak-in-ieee80211_if.patch + patches.suse/net-ulp-use-consistent-error-code-when-blocking-ULP.patch patches.suse/phy-ti-fix-Kconfig-warning-and-operator-precedence.patch patches.suse/phy-rockchip-inno-usb2-Fix-missing-clk_disable_unpre.patch patches.suse/phy-Revert-phy-qualcomm-usb28nm-Add-MDM9607-init-seq.patch @@ -17858,20 +17936,27 @@ patches.suse/i2c-rk3x-fix-a-bunch-of-kernel-doc-warnings.patch patches.suse/tracing-Make-sure-trace_printk-can-output-as-soon-as-it-can-be-used.patch patches.suse/trace_events_hist-add-check-for-return-value-of-create_hist_field.patch + patches.suse/cifs-Fix-oops-due-to-uncleared-server-smbd_conn-in-reconnect.patch patches.suse/Revert-Input-synaptics-switch-touchpad-on-HP-Laptop-.patch patches.suse/scsi-Revert-scsi-core-map-PQ-1-PDT-other-values-to-SCSI_SCAN_TARGET_PRESENT.patch patches.suse/firewire-fix-memory-leak-for-payload-of-request-suba.patch patches.suse/ALSA-hda-realtek-fix-mute-micmute-LEDs-speaker-don-t.patch patches.suse/ALSA-hda-via-Avoid-potential-array-out-of-bound-in-a.patch + patches.suse/ALSA-hda-Do-not-unset-preset-when-cleaning-up-codec.patch patches.suse/ALSA-hda-realtek-Add-Acer-Predator-PH315-54.patch patches.suse/ASoC-Intel-bytcht_es8316-Drop-reference-count-of-ACP.patch patches.suse/ASoC-Intel-bytcr_rt5651-Drop-reference-count-of-ACPI.patch patches.suse/ASoC-Intel-bytcr_wm5102-Drop-reference-count-of-ACPI.patch + patches.suse/ASoC-Intel-sof_rt5682-always-set-dpcm_capture-for-am.patch + patches.suse/ASoC-Intel-sof_cs42l42-always-set-dpcm_capture-for-a.patch + patches.suse/ASoC-cs42l56-fix-DT-probe.patch + patches.suse/platform-x86-touchscreen_dmi-Add-Chuwi-Vi8-CWI501-DM.patch patches.suse/watchdog-diag288_wdt-do-not-use-stack-buffers-for-ha.patch patches.suse/watchdog-diag288_wdt-fix-__diag288-inline-assembly.patch patches.suse/bus-sunxi-rsb-Fix-error-handling-in-sunxi_rsb_init.patch patches.suse/arm64-dts-imx8mm-Fix-pad-control-for-UART1_DTE_RX.patch patches.suse/bpf-Fix-a-possible-task-gone-issue-with-bpf_send_signal-_thread-helpers.patch + patches.suse/net-rose-Fix-to-not-accept-on-connected-socket.patch patches.suse/net-phy-dp83822-Fix-null-pointer-access-on-DP83825-D.patch patches.suse/netrom-Fix-use-after-free-caused-by-accept-on-alread.patch patches.suse/net-phy-meson-gxl-Add-generic-dummy-stubs-for-MMD-re.patch @@ -17883,11 +17968,14 @@ patches.suse/can-j1939-fix-errant-WARN_ON_ONCE-in-j1939_session_d.patch patches.suse/ata-libata-Fix-sata_down_spd_limit-when-no-link-spee.patch patches.suse/drm-vc4-hdmi-make-CEC-adapter-name-unique.patch + patches.suse/drm-nouveau-devinit-tu102-wait-for-GFW_BOOT_PROGRESS.patch patches.suse/drm-i915-Fix-potential-bit_17-double-free.patch patches.suse/drm-i915-adlp-Fix-typo-for-reference-clock.patch + patches.suse/drm-amd-display-Properly-handle-additional-cases-whe.patch patches.suse/efi-Accept-version-2-of-memory-attributes-table.patch patches.suse/efi-fix-potential-NULL-deref-in-efi_mem_reserve_pers.patch patches.suse/block-bfq-fix-uaf-for-bfqq-in-bic_set_bfqq-b600.patch + patches.suse/nvme-auth-use-workqueue-dedicated-to-authentication.patch patches.suse/powerpc-64s-Fix-local-irq-disable-when-PMIs-are-disa.patch patches.suse/powerpc-kexec_file-Fix-division-by-zero-in-extra-siz.patch patches.suse/powerpc-64s-radix-Fix-crash-with-unaligned-relocated.patch @@ -17917,6 +18005,9 @@ patches.suse/usb-gadget-f_uac2-Fix-incorrect-increment-of-bNumEnd.patch patches.suse/tracing-Fix-poll-and-select-do-not-work-on-per_cpu-trace_pipe-and-trace_pipe_raw.patch patches.suse/of-address-Return-an-error-when-no-valid-dma-ranges-.patch + patches.suse/cifs-Fix-use-after-free-in-rdata-read_into_pages-.patch + patches.suse/HID-elecom-add-support-for-TrackBall-056E-011C.patch + patches.suse/HID-core-Fix-deadloop-in-hid_apply_multiplier.patch patches.suse/net-phy-meson-gxl-use-MMD-access-dummy-stubs-for-GXL.patch patches.suse/net-USB-Fix-wrong-direction-WARNING-in-plusb.c.patch patches.suse/msft-hv-2748-hv_netvsc-Allocate-memory-in-netvsc_dma_map-with-GFP.patch @@ -17937,9 +18028,13 @@ patches.suse/ALSA-hda-realtek-Add-quirk-for-ASUS-UM3402-using-CS3.patch patches.suse/ALSA-hda-realtek-fix-mute-micmute-LEDs-don-t-work-fo-6c4715aa5b0a.patch patches.suse/ALSA-emux-Avoid-potential-array-out-of-bound-in-snd_.patch + patches.suse/ASoC-rt715-sdca-fix-clock-stop-prepare-timeout-issue.patch patches.suse/ASoC-topology-Return-ENOMEM-on-memory-allocation-fai.patch patches.suse/ALSA-hda-realtek-Add-Positivo-N14KP6-TG.patch + patches.suse/nvme-auth-mark-nvme_auth_wq-static.patch patches.suse/ceph-flush-cap-releases-when-the-session-is-flushed.patch + patches.suse/arm64-dts-rockchip-drop-unused-LED-mode-property-fro.patch + patches.suse/ARM-dts-rockchip-add-power-domains-property-to-dp-no.patch patches.suse/arm64-dts-meson-axg-Make-mmc-host-controller-interru.patch patches.suse/arm64-dts-meson-g12-common-Make-mmc-host-controller-.patch patches.suse/arm64-dts-meson-gx-Make-mmc-host-controller-interrup.patch @@ -17948,6 +18043,7 @@ patches.suse/pinctrl-single-fix-potential-NULL-dereference.patch patches.suse/pinctrl-intel-Restore-the-pins-that-used-to-be-in-Di.patch patches.suse/clk-ingenic-jz4760-Update-M-N-OD-calculation-algorit.patch + patches.suse/ACPI-NFIT-fix-a-potential-deadlock-during-NFIT-teard.patch patches.suse/spi-dw-Fix-wrong-FIFO-level-setting-for-long-xfers.patch patches.suse/Fix-page-corruption-caused-by-racy-check-in-__free_pages.patch patches.suse/usb-typec-altmodes-displayport-Fix-probe-pin-assign-.patch @@ -17957,9 +18053,143 @@ patches.suse/net-usb-kalmia-Don-t-pass-act_len-in-usb_bulk_msg-er.patch patches.suse/net-mpls-fix-stale-pointer-if-allocation-fails-durin.patch patches.suse/drm-amd-display-Fail-atomic_check-early-on-normalize.patch + patches.suse/drm-i915-gen11-Wa_1408615072-Wa_1407596294-should-be.patch + patches.suse/mmc-sdio-fix-possible-resource-leaks-in-some-error-p.patch + patches.suse/mmc-mmc_spi-fix-error-handling-in-mmc_spi_probe.patch + patches.suse/mmc-jz4740-Work-around-bug-on-JZ4760-B.patch + patches.suse/ALSA-hda-conexant-add-a-new-hda-codec-SN6180.patch + patches.suse/ALSA-hda-realtek-fixed-wrong-gpio-assigned.patch + patches.suse/nvme-auth-don-t-use-NVMe-status-codes.patch patches.suse/s390-dasd-Fix-potential-memleak-in-dasd_eckd_init.patch patches.suse/block-bio-integrity-Copy-flags-when-bio_integrity_pa.patch + patches.suse/ARM-OMAP2-Fix-memory-leak-in-realtime_counter_init.patch + patches.suse/ARM-OMAP1-call-platform_device_put-in-error-case-in-.patch + patches.suse/ARM-s3c-fix-s3c64xx_set_timer_source-prototype.patch + patches.suse/ARM-imx-Call-ida_simple_remove-for-ida_simple_get.patch + patches.suse/ARM-zynq-Fix-refcount-leak-in-zynq_early_slcr_init.patch + patches.suse/ARM-bcm2835_defconfig-Enable-the-framebuffer.patch + patches.suse/arm64-dts-qcom-qcs404-use-symbol-names-for-PCIe-rese.patch + patches.suse/arm64-dts-qcom-sm8150-kumano-Panel-framebuffer-is-2..patch + patches.suse/arm64-dts-qcom-sdm845-db845c-fix-audio-codec-interru.patch + patches.suse/arm64-dts-qcom-sc7180-correct-SPMI-bus-address-cells.patch + patches.suse/arm64-dts-qcom-sc7280-correct-SPMI-bus-address-cells.patch + patches.suse/arm64-dts-qcom-ipq8074-correct-USB3-QMP-PHY-s-clock-.patch + patches.suse/arm64-dts-qcom-ipq8074-correct-Gen2-PCIe-ranges.patch + patches.suse/arm64-dts-qcom-ipq8074-fix-Gen3-PCIe-node.patch + patches.suse/arm64-dts-renesas-beacon-renesom-Fix-gpio-expander-r.patch + patches.suse/ARM-dts-sun8i-nanopi-duo2-Fix-regulator-GPIO-referen.patch + patches.suse/ARM-dts-exynos-correct-wr-active-property-in-Exynos3.patch + patches.suse/ARM-dts-exynos-correct-HDMI-phy-compatible-in-Exynos.patch + patches.suse/dt-bindings-arm-fsl-Fix-bindings-for-APF28Dev-board.patch + patches.suse/ARM-dts-imx7s-correct-iomuxc-gpr-mux-controller-cell.patch + patches.suse/arm64-dts-imx8m-Align-SoC-unique-ID-node-unit-addres.patch + patches.suse/arm64-dts-meson-gx-Fix-Ethernet-MAC-address-unit-nam.patch + patches.suse/arm64-dts-meson-g12a-Fix-internal-Ethernet-PHY-unit-.patch + patches.suse/arm64-dts-meson-gx-Fix-the-SCPI-DVFS-node-name-and-u.patch + patches.suse/arm64-dts-meson-remove-CPU-opps-below-1GHz-for-G12A-.patch + patches.suse/arm64-dts-amlogic-meson-sm1-odroid-hc4-fix-active-fa.patch + patches.suse/arm64-dts-meson-bananapi-m5-switch-VDDIO_C-pin-to-OP.patch + patches.suse/arm64-dts-mediatek-mt8183-Fix-systimer-13-MHz-clock-.patch + patches.suse/arm64-dts-mt8192-Fix-CPU-map-for-single-cluster-SoC.patch + patches.suse/arm64-dts-mediatek-mt7622-Add-missing-pwm-cells-to-p.patch + patches.suse/arm64-dts-ti-k3-j7200-Fix-wakeup-pinmux-range.patch + patches.suse/ARM-dts-qcom-sdx55-Add-Qcom-SMMU-500-as-the-fallback.patch + patches.suse/locking-rwsem-Prevent-non-first-waiter-from-spinning.patch + patches.suse/locking-rwsem-Disable-preemption-in-all-down_read-an.patch + patches.suse/locking-rwsem-Disable-preemption-in-all-down_write-a.patch patches.suse/powercap-fix-possible-name-leak-in-powercap_register.patch + patches.suse/ACPICA-Drop-port-I-O-validation-for-some-regions.patch + patches.suse/ACPICA-nsrepair-handle-cases-without-a-return-value-.patch + patches.suse/ACPI-battery-Fix-missing-NUL-termination-with-large-.patch + patches.suse/thermal-drivers-tsens-Drop-msm8976-specific-defines.patch + patches.suse/thermal-drivers-tsens-Sort-out-msm8976-vs-msm8956-da.patch + patches.suse/thermal-drivers-tsens-fix-slope-values-for-msm8939.patch + patches.suse/thermal-drivers-tsens-limit-num_sensors-to-9-for-msm.patch + patches.suse/thermal-intel-powerclamp-Fix-cur_state-for-multi-pac.patch + patches.suse/thermal-drivers-hisi-Drop-second-sensor-hi3660.patch + patches.suse/leds-led-class-Add-missing-put_device-to-led_put.patch + patches.suse/crypto-x86-ghash-fix-unaligned-access-in-ghash_setke.patch + patches.suse/lib-mpi-Fix-buffer-overrun-when-SG-is-too-long.patch + patches.suse/crypto-ccp-Avoid-page-allocation-failure-warning-for.patch + patches.suse/crypto-ccp-Failure-on-re-initialization-due-to-dupli.patch + patches.suse/crypto-essiv-Handle-EBUSY-correctly.patch + patches.suse/crypto-seqiv-Handle-EBUSY-correctly.patch + patches.suse/crypto-xts-Handle-EBUSY-correctly.patch + patches.suse/Revert-crypto-rsa-pkcs1pad-Replace-GFP_ATOMIC-with-G.patch + patches.suse/crypto-qat-fix-out-of-bounds-read.patch + patches.suse/crypto-rsa-pkcs1pad-Use-akcipher_request_complete.patch + patches.suse/crypto-crypto4xx-Call-dma_unmap_page-when-done.patch + patches.suse/wifi-rsi-Fix-memory-leak-in-rsi_coex_attach.patch + patches.suse/wifi-rtlwifi-rtl8821ae-don-t-call-kfree_skb-under-sp.patch + patches.suse/wifi-rtlwifi-rtl8188ee-don-t-call-kfree_skb-under-sp.patch + patches.suse/wifi-rtlwifi-rtl8723be-don-t-call-kfree_skb-under-sp.patch + patches.suse/wifi-iwlegacy-common-don-t-call-dev_kfree_skb-under-.patch + patches.suse/wifi-libertas-fix-memory-leak-in-lbs_init_adapter.patch + patches.suse/wifi-rtl8xxxu-don-t-call-dev_kfree_skb-under-spin_lo.patch + patches.suse/wifi-rtlwifi-Fix-global-out-of-bounds-bug-in-_rtl881.patch + patches.suse/wifi-ipw2x00-don-t-call-dev_kfree_skb-under-spin_loc.patch + patches.suse/wifi-ipw2200-fix-memory-leak-in-ipw_wdev_init.patch + patches.suse/wifi-wilc1000-fix-potential-memory-leak-in-wilc_mac_.patch + patches.suse/wifi-brcmfmac-fix-potential-memory-leak-in-brcmf_net.patch + patches.suse/wifi-brcmfmac-unmap-dma-buffer-in-brcmf_msgbuf_alloc.patch + patches.suse/wifi-libertas_tf-don-t-call-kfree_skb-under-spin_loc.patch + patches.suse/wifi-libertas-if_usb-don-t-call-kfree_skb-under-spin.patch + patches.suse/wifi-libertas-main-don-t-call-kfree_skb-under-spin_l.patch + patches.suse/wifi-libertas-cmdresp-don-t-call-kfree_skb-under-spi.patch + patches.suse/wifi-wl3501_cs-don-t-call-kfree_skb-under-spin_lock_.patch + patches.suse/wifi-rtw89-Add-missing-check-for-alloc_workqueue.patch + patches.suse/wifi-rtl8xxxu-Fix-memory-leaks-with-RTL8723BU-RTL819.patch + patches.suse/wifi-orinoco-check-return-value-of-hermes_write_word.patch + patches.suse/wifi-cfg80211-Fix-extended-KCK-key-length-check-in-n.patch + patches.suse/Bluetooth-L2CAP-Fix-potential-user-after-free.patch + patches.suse/Bluetooth-hci_qca-get-wakeup-status-from-serdev-devi.patch + patches.suse/msft-hv-2767-hv_netvsc-Check-status-in-SEND_RNDIS_PKT-completion-.patch + patches.suse/dt-bindings-net-snps-dwmac-Fix-snps-reset-delays-us-.patch + patches.suse/wifi-iwl3945-Add-missing-check-for-create_singlethre.patch + patches.suse/wifi-iwl4965-Add-missing-check-for-create_singlethre.patch + patches.suse/wifi-mwifiex-Add-missing-compatible-string-for-SD878.patch + patches.suse/wifi-mwifiex-fix-loop-iterator-in-mwifiex_update_amp.patch + patches.suse/wifi-ath9k-htc_hst-free-skb-in-ath9k_htc_rx_msg-if-t.patch + patches.suse/wifi-ath9k-Fix-potential-stack-out-of-bounds-write-i.patch + patches.suse/wifi-ath11k-Fix-memory-leak-in-ath11k_peer_rx_frag_s.patch + patches.suse/wifi-cfg80211-Fix-use-after-free-for-wext.patch + patches.suse/wifi-mac80211-make-rate-u32-in-sta_set_rate_info_rx.patch + patches.suse/qede-fix-interrupt-coalescing-configuration.patch + patches.suse/sefltests-netdevsim-wait-for-devlink-instance-after-.patch + patches.suse/ALSA-hda-ca0132-minor-fix-for-allocation-size.patch + patches.suse/ASoC-soc-compress.c-fixup-private_data-on-snd_soc_ne.patch + patches.suse/ASoC-mchp-spdifrx-fix-controls-which-rely-on-rsr-reg.patch + patches.suse/ASoC-mchp-spdifrx-disable-all-interrupts-in-mchp_spd.patch + patches.suse/ASoC-rsnd-fixup-endif-position.patch + patches.suse/ASoC-rsnd-Remove-unnecessary-rsnd_dbg_dai_call.patch + patches.suse/ASoC-mchp-spdifrx-Fix-uninitialized-use-of-mr-in-mch.patch + patches.suse/ASoC-dt-bindings-meson-fix-gx-card-codec-node-regex.patch + patches.suse/ASoC-tlv320adcx140-fix-ti-gpio-config-DT-property-in.patch + patches.suse/ASoC-soc-dapm.h-fixup-warning-struct-snd_pcm_substre.patch + patches.suse/spi-bcm63xx-hsspi-Endianness-fix-for-ARM-based-SoC.patch + patches.suse/spi-synquacer-Fix-timeout-handling-in-synquacer_spi_.patch + patches.suse/gpio-vf610-connect-GPIO-label-to-dev-name.patch + patches.suse/gpio-tegra186-remove-unneeded-loop-in-tegra186_gpio_.patch + patches.suse/pinctrl-qcom-pinctrl-msm8976-Correct-function-names-.patch + patches.suse/pinctrl-stm32-Fix-refcount-leak-in-stm32_pctrl_get_i.patch + patches.suse/pinctrl-rockchip-Fix-refcount-leak-in-rockchip_pinct.patch + patches.suse/pinctrl-mediatek-Initialize-variable-buf-to-zero.patch + patches.suse/HID-asus-use-spinlock-to-protect-concurrent-accesses.patch + patches.suse/HID-asus-use-spinlock-to-safely-schedule-workers.patch + patches.suse/HID-bigben-use-spinlock-to-protect-concurrent-access.patch + patches.suse/HID-bigben_worker-remove-unneeded-check-on-report_fi.patch + patches.suse/HID-bigben-use-spinlock-to-safely-schedule-workers.patch + patches.suse/hid-bigben_probe-validate-report-count.patch + patches.suse/Revert-HID-logitech-hidpp-add-a-module-parameter-to-.patch + patches.suse/hwmon-ftsteutates-Fix-scaling-of-measurements.patch + patches.suse/hwmon-ltc2945-Handle-error-case-in-ltc2945_value_sto.patch + patches.suse/hwmon-mlxreg-fan-Return-zero-speed-for-broken-fan.patch + patches.suse/ipmi-ssif-resend_msg-cannot-fail.patch + patches.suse/ipmi_ssif-Rename-idle-state-and-check.patch + patches.suse/ipmi-ssif-Remove-rtc_us_timer.patch + patches.suse/ipmi-ssif-Add-a-timer-between-request-retries.patch + patches.suse/docs-ftrace-fix-a-issue-with-duplicated-subtitle-num.patch + patches.suse/audit-update-the-mailing-list-in-MAINTAINERS.patch patches.suse/scsi-qla2xxx-check-if-port-is-online-before-sending-els.patch patches.suse/scsi-qla2xxx-fix-link-failure-in-npiv-environment.patch patches.suse/scsi-qla2xxx-fix-dma-api-call-trace-on-nvme-ls-requests.patch @@ -17998,8 +18228,210 @@ patches.suse/scsi-qla2xxx-use-a-variable-for-repeated-mem_size-computation.patch patches.suse/scsi-qla2xxx-simplify-if-condition-evaluation.patch patches.suse/scsi-qla2xxx-remove-the-unused-variable-wwn.patch + patches.suse/cifs-Use-kstrtobool-instead-of-strtobool-.patch + patches.suse/cifs-Replace-zero-length-arrays-with-flexible-array-members.patch + patches.suse/cifs-print-last-update-time-for-interface-list.patch + patches.suse/cifs-Get-rid-of-unneeded-conditional-in-the-smb2_get_aead_req-.patch + patches.suse/cifs-prevent-data-race-in-smb2_reconnect-.patch + patches.suse/cifs-get-rid-of-unneeded-conditional-in-cifs_get_num_sgs-.patch + patches.suse/cifs-introduce-cifs_io_parms-in-smb2_async_writev-.patch + patches.suse/cifs-split-out-smb3_use_rdma_offload-helper.patch + patches.suse/cifs-don-t-try-to-use-rdma-offload-on-encrypted-connections.patch + patches.suse/cifs-Fix-uninitialized-memory-read-in-smb3_qfs_tcon-.patch + patches.suse/cifs-remove-unneeded-2bytes-of-padding-from-smb2-tree-connect.patch + patches.suse/cifs-Fix-uninitialized-memory-reads-for-oparms-mode.patch + patches.suse/cifs-fix-mount-on-old-smb-servers.patch + patches.suse/cifs-Convert-struct-fealist-away-from-1-element-array.patch + patches.suse/cifs-Replace-remaining-1-element-arrays.patch + patches.suse/cifs-Check-the-lease-context-if-we-actually-got-a-lease.patch + patches.suse/cifs-return-a-single-use-cfid-if-we-did-not-get-a-lease.patch + patches.suse/cifs-Fix-lost-destroy-smbd-connection-when-MR-allocate-failed.patch + patches.suse/cifs-Fix-warning-and-UAF-when-destroy-the-MR-list.patch + patches.suse/cifs-get-rid-of-dns-resolve-worker.patch + patches.suse/smb3-Replace-smb2pdu-1-element-arrays-with-flex-arrays.patch + patches.suse/cifs-use-the-least-loaded-channel-for-sending-requests.patch + patches.suse/cifs-use-tcon-allocation-functions-even-for-dummy-tcon.patch + patches.suse/cifs-update-ip_addr-for-ses-only-for-primary-chan-setup.patch + patches.suse/cifs-update-internal-module-number-fdbf8072.patch + patches.suse/drm-Fix-potential-null-ptr-deref-due-to-drmm_mode_co.patch + patches.suse/drm-fourcc-Add-missing-big-endian-XRGB1555-and-RGB56.patch + patches.suse/drm-mxsfb-DRM_MXSFB-should-depend-on-ARCH_MXS-ARCH_M.patch + patches.suse/drm-vc4-vec-Use-pm_runtime_resume_and_get-in-vc4_vec.patch + patches.suse/drm-bridge-megachips-Fix-error-handling-in-i2c_regis.patch + patches.suse/drm-vkms-Fix-memory-leak-in-vkms_init.patch + patches.suse/drm-vkms-Fix-null-ptr-deref-in-vkms_release.patch + patches.suse/drm-bridge-lt8912b-Add-hot-plug-detection.patch + patches.suse/drm-tidss-Fix-pixel-format-definition.patch + patches.suse/drm-omapdrm-Remove-unused-struct-csc_coef_rgb2yuv.patch + patches.suse/gpu-ipu-v3-common-Add-of_node_put-for-reference-retu.patch + patches.suse/drm-vc4-hvs-Set-AXI-panic-modes.patch + patches.suse/drm-vc4-hvs-Fix-colour-order-for-xRGB1555-on-HVS5.patch + patches.suse/drm-vc4-hdmi-Correct-interlaced-timings-again.patch + patches.suse/drm-bridge-lt9611-fix-sleep-mode-setup.patch + patches.suse/drm-bridge-lt9611-fix-HPD-reenablement.patch + patches.suse/drm-bridge-lt9611-fix-polarity-programming.patch + patches.suse/drm-bridge-lt9611-fix-programming-of-video-modes.patch + patches.suse/drm-bridge-lt9611-fix-clock-calculation.patch + patches.suse/drm-bridge-lt9611-pass-a-pointer-to-the-of-node.patch + patches.suse/drm-mipi-dsi-Fix-byte-order-of-16-bit-DCS-set-get-br.patch + patches.suse/gpu-host1x-Don-t-skip-assigning-syncpoints-to-channe.patch + patches.suse/drm-mediatek-dsi-Reduce-the-time-of-dsi-from-LP11-to.patch + patches.suse/drm-mediatek-Use-NULL-instead-of-0-for-NULL-pointer.patch + patches.suse/drm-mediatek-Drop-unbalanced-obj-unref.patch + patches.suse/drm-mediatek-mtk_drm_crtc-Add-checks-for-devm_kcallo.patch + patches.suse/drm-mediatek-Clean-dangling-pointer-on-bind-error-pa.patch + patches.suse/drm-msm-adreno-Fix-null-ptr-access-in-adreno_gpu_cle.patch + patches.suse/drm-msm-clean-event_thread-worker-in-case-of-an-erro.patch + patches.suse/drm-msm-gem-Add-check-for-kmalloc.patch + patches.suse/drm-msm-dpu-Disallow-unallocated-resources-to-be-ret.patch + patches.suse/dt-bindings-msm-dsi-controller-main-Add-vdd-descript.patch + patches.suse/drm-msm-hdmi-Add-missing-check-for-alloc_ordered_wor.patch + patches.suse/drm-msm-use-strscpy-instead-of-strncpy.patch + patches.suse/drm-msm-dpu-drop-stale-comment-from-struct-dpu_mdp_c.patch + patches.suse/drm-msm-dpu-Add-check-for-cstate.patch + patches.suse/drm-msm-dpu-Add-check-for-pstates.patch + patches.suse/drm-msm-mdp5-Add-check-for-kzalloc.patch + patches.suse/drm-msm-dpu-set-pdpu-is_rt_pipe-early-in-dpu_plane_s.patch + patches.suse/drm-amd-display-reduce-else-if-to-else-in-dcn10_blan.patch + patches.suse/drm-amdgpu-fix-enum-odm_combine_mode-mismatch.patch + patches.suse/docs-gdbmacros-print-newest-record.patch + patches.suse/printf-fix-errname.c-list.patch + patches.suse/arm64-efi-Make-efi_rt_lock-a-raw_spinlock.patch + patches.suse/mfd-cs5535-Don-t-build-on-UML.patch + patches.suse/mfd-pcf50633-adc-Fix-potential-memleak-in-pcf50633_a.patch + patches.suse/backlight-backlight-Fix-doc-for-backlight_device_get.patch + patches.suse/leds-led-core-Fix-refcount-leak-in-of_led_get.patch + patches.suse/lib-zlib-remove-redundation-assignement-of-avail_in-.patch + patches.suse/usb-gadget-fusb300_udc-free-irq-on-the-error-path-in.patch + patches.suse/media-uvcvideo-Fix-race-condition-with-usb_kill_urb.patch + patches.suse/usb-early-xhci-dbc-Fix-a-potential-out-of-bound-memo.patch + patches.suse/USB-core-Don-t-hold-device-lock-while-reading-the-de.patch + patches.suse/usb-musb-mediatek-don-t-unregister-something-that-wa.patch + patches.suse/usb-max-3421-Fix-setting-of-I-O-pins.patch + patches.suse/dt-bindings-usb-amlogic-meson-g12a-usb-ctrl-make-G12.patch + patches.suse/usb-gadget-u_serial-Add-null-pointer-check-in-gseria.patch + patches.suse/usb-dwc3-pci-add-support-for-the-Intel-Meteor-Lake-M.patch + patches.suse/USB-serial-option-add-support-for-VW-Skoda-Carstick-.patch + patches.suse/tty-serial-fsl_lpuart-disable-Rx-Tx-DMA-in-lpuart32_.patch + patches.suse/tty-serial-fsl_lpuart-clear-LPUART-Status-Register-i.patch + patches.suse/tty-serial-qcom-geni-serial-stop-operations-in-progr.patch + patches.suse/serial-tegra-Add-missing-clk_disable_unprepare-in-te.patch + patches.suse/tty-serial-fsl_lpuart-Fix-the-wrong-RXWATER-setting-.patch + patches.suse/serial-fsl_lpuart-fix-RS485-RTS-polariy-inverse-issu.patch + patches.suse/Revert-char-pcmcia-cm4000_cs-Replace-mdelay-with-usl.patch + patches.suse/comedi-use-menuconfig-for-main-Comedi-menu.patch + patches.suse/eeprom-idt_89hpesx-Fix-error-handling-in-idt_init.patch + patches.suse/applicom-Fix-PCI-device-refcount-leak-in-applicom_in.patch + patches.suse/firmware-stratix10-svc-add-missing-gen_pool_destroy-.patch + patches.suse/VMCI-check-context-notify_page-after-call-to-get_use.patch + patches.suse/misc-enclosure-Fix-doc-for-enclosure_find.patch + patches.suse/misc-mei-hdcp-Use-correct-macros-to-initialize-uuid_.patch + patches.suse/firmware-dmi-sysfs-Fix-null-ptr-deref-in-dmi_sysfs_r.patch + patches.suse/iio-light-tsl2563-Do-not-hardcode-interrupt-trigger-.patch + patches.suse/firmware-coreboot-Remove-GOOGLE_COREBOOT_TABLE_ACPI-.patch + patches.suse/driver-core-fix-potential-null-ptr-deref-in-device_a.patch + patches.suse/driver-core-fix-resource-leak-in-device_add.patch + patches.suse/drivers-base-transport_class-fix-possible-memory-lea.patch + patches.suse/drivers-base-transport_class-fix-resource-leak-when-.patch + patches.suse/driver-core-fw_devlink-Add-DL_FLAG_CYCLE-support-to-.patch + patches.suse/PCI-hotplug-Allow-marking-devices-as-disconnected-du.patch + patches.suse/PCI-IOV-Enlarge-virtfn-sysfs-name-buffer.patch + patches.suse/PCI-PM-Observe-reset-delay-irrespective-of-bridge_d3.patch + patches.suse/PCI-Fix-dropping-valid-root-bus-resources-with-.end-.patch + patches.suse/dmaengine-dw-edma-Fix-missing-src-dst-address-of-int.patch + patches.suse/dmaengine-dw-edma-Don-t-permit-non-inc-interleaved-x.patch + patches.suse/dmaengine-dw-edma-Fix-invalid-interleaved-xfers-sema.patch + patches.suse/dmaengine-dw-edma-Drop-chancnt-initialization.patch + patches.suse/dmaengine-dw-edma-Fix-readq_ch-return-value-truncati.patch + patches.suse/PCI-switchtec-Return-EFAULT-for-copy_to_user-errors.patch + patches.suse/dt-bindings-power-supply-pm8941-coincell-Don-t-requi.patch + patches.suse/i2c-designware-fix-i2c_dw_clk_rate-return-size-to-be.patch + patches.suse/dmaengine-idxd-Set-traffic-class-values-in-GRPCFG-on.patch + patches.suse/dmaengine-dw-axi-dmac-Do-not-dereference-NULL-struct.patch + patches.suse/dmaengine-ptdma-check-for-null-desc-before-calling-p.patch + patches.suse/phy-rockchip-typec-fix-tcphy_get_mode-error-case.patch + patches.suse/soundwire-cadence-Don-t-overflow-the-command-FIFOs.patch patches.suse/powerpc-eeh-Set-channel-state-after-notifying-the-dr.patch + patches.suse/vdpa_sim-not-reset-state-in-vdpasim_queue_ready.patch + patches.suse/Input-iqs269a-drop-unused-device-node-references.patch + patches.suse/Input-iqs269a-increase-interrupt-handler-return-dela.patch + patches.suse/Input-iqs269a-configure-device-with-a-single-block-w.patch + patches.suse/Input-ads7846-don-t-report-pressure-for-ads7845.patch + patches.suse/Input-ads7846-always-set-last-command-to-PWRDOWN.patch + patches.suse/Input-ads7846-don-t-check-penirq-immediately-for-784.patch + patches.suse/Input-iqs626a-drop-unused-device-node-references.patch + patches.suse/dt-bindings-input-iqs626a-Redefine-trackpad-property.patch + patches.suse/mtd-dataflash-remove-duplicate-SPI-ID-table.patch + patches.suse/mtd-spi-nor-sfdp-Fix-index-value-for-SCCR-dwords.patch + patches.suse/mtd-spi-nor-core-fix-implicit-declaration-warning.patch + patches.suse/mtd-spi-nor-spansion-Consider-reserved-bits-in-CFR5-.patch + patches.suse/mtd-spi-nor-Fix-shift-out-of-bounds-in-spi_nor_set_e.patch + patches.suse/mtd-rawnand-sunxi-Clean-up-chips-after-failed-init.patch + patches.suse/mtd-rawnand-sunxi-Fix-the-size-of-the-last-OOB-regio.patch + patches.suse/mtd-rawnand-fsl_elbc-Propagate-HW-ECC-settings-to-HW.patch + patches.suse/clk-ralink-fix-mt7621_gate_is_enabled-function.patch + patches.suse/clk-renesas-cpg-mssr-Fix-use-after-free-if-cpg_mssr_.patch + patches.suse/clk-renesas-cpg-mssr-Remove-superfluous-check-in-res.patch + patches.suse/clk-imx-avoid-memory-leak.patch + patches.suse/clk-Honor-CLK_OPS_PARENT_ENABLE-in-clk_core_is_enabl.patch + patches.suse/clk-qcom-gcc-qcs404-disable-gpll-04-_out_aux-parents.patch + patches.suse/clk-qcom-gcc-qcs404-fix-names-of-the-DSI-clocks-used.patch + patches.suse/Documentation-simplify-and-clarify-DCO-contribution-.patch + patches.suse/media-ti-cal-fix-possible-memory-leak-in-cal_ctx_cre.patch + patches.suse/media-platform-ti-Add-missing-check-for-devm_regulat.patch + patches.suse/media-imx-imx7-media-csi-fix-missing-clk_disable_unp.patch + patches.suse/media-max9286-Fix-memleak-in-max9286_v4l2_register.patch + patches.suse/media-ov2740-Fix-memleak-in-ov2740_init_controls.patch + patches.suse/media-ov5675-Fix-memleak-in-ov5675_init_controls.patch + patches.suse/media-i2c-ov772x-Fix-memleak-in-ov772x_probe.patch + patches.suse/media-ipu3-cio2-Fix-PM-runtime-usage_count-in-driver.patch + patches.suse/media-v4l2-jpeg-correct-the-skip-count-in-jpeg_parse.patch + patches.suse/media-v4l2-jpeg-ignore-the-unknown-APP14-marker.patch + patches.suse/media-rc-Fix-use-after-free-bugs-caused-by-ene_tx_ir.patch + patches.suse/media-i2c-ov7670-0-instead-of-EINVAL-was-returned.patch + patches.suse/media-usb-siano-Fix-use-after-free-bugs-caused-by-do.patch + patches.suse/media-saa7134-Use-video_unregister_device-for-radio_.patch + patches.suse/dt-bindings-hwlock-sun6i-Add-missing-hwlock-cells.patch + patches.suse/remoteproc-mtk_scp-Move-clk-ops-outside-send_lock.patch + patches.suse/remoteproc-qcom_q6v5_mss-Use-a-carveout-to-authentic.patch patches.suse/fuse-add-inode-permission-checks-to-fileattr_get-fileattr_set.patch + patches.suse/ARM-dts-spear320-hmi-correct-STMPE-GPIO-compatible.patch + patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Exynos4.patch + patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Exynos4210.patch + patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Exynos5250.patch + patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Odroid-XU.patch + patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Odroid-HC1.patch + patches.suse/ARM-dts-exynos-correct-TMU-phandle-in-Odroid-XU3-fam.patch + patches.suse/nfc-fix-memory-leak-of-se_io-context-in-nfc_genl_se_.patch + patches.suse/qede-avoid-uninitialized-entries-in-coal_entry-array.patch + patches.suse/wifi-ath11k-allow-system-suspend-to-survive-ath11k.patch + patches.suse/vc_screen-modify-vcs_size-handling-in-vcs_read.patch + patches.suse/vc_screen-don-t-clobber-return-value-in-vcs_read.patch + patches.suse/spi-tegra210-quad-Fix-validate-combined-sequence.patch + patches.suse/auxdisplay-hd44780-Fix-potential-memory-leak-in-hd44.patch + patches.suse/watchdog-at91sam9_wdt-use-devm_request_irq-to-avoid-.patch + patches.suse/watchdog-Fix-kmemleak-in-watchdog_cdev_register.patch + patches.suse/watchdog-pcwd_usb-Fix-attempting-to-access-uninitial.patch + patches.suse/watchdog-sbsa_wdog-Make-sure-the-timeout-programming.patch + patches.suse/drm-i915-Don-t-use-BAR-mappings-for-ring-buffers-wit.patch + patches.suse/rtc-sun6i-Always-export-the-internal-oscillator.patch + patches.suse/rtc-pm8xxx-fix-set-alarm-race.patch + patches.suse/rtc-allow-rtc_read_alarm-without-read_alarm-callback.patch + patches.suse/nvme-auth-fix-an-error-code-in-nvme_auth_process_dhc.patch + patches.suse/nvme-fabrics-show-well-known-discovery-name.patch + patches.suse/thermal-intel-quark_dts-fix-error-pointer-dereferenc.patch + patches.suse/thermal-intel-BXT_PMIC-select-REGMAP-instead-of-depe.patch + patches.suse/cifs-match-even-the-scope-id-for-ipv6-addresses.patch + patches.suse/cifs-reuse-cifs_match_ipaddr-for-comparison-of-dstaddr-too.patch + patches.suse/cifs-improve-checking-of-DFS-links-over-STATUS_OBJECT_NAME_INVALID.patch + patches.suse/cifs-prevent-data-race-in-cifs_reconnect_tcon-.patch + patches.suse/ASoC-adau7118-don-t-disable-regulators-on-device-unb.patch + patches.suse/ALSA-ice1712-Do-not-left-ice-gpio_mutex-locked-in-au.patch + patches.suse/ALSA-ice1712-Delete-unreachable-code-in-aureon_add_c.patch + patches.suse/platform-x86-MLX_PLATFORM-select-REGMAP-instead-of-d.patch + + # mkp/scsi fixes + patches.suse/scsi-qla2xxx-Add-option-to-disable-FC2-Target-suppor.patch ######################################################## # end of sorted patches @@ -18029,13 +18461,8 @@ patches.suse/arm64-Implement-HAVE_PREEMPT_DYNAMIC.patch patches.suse/static_call-Fix-tools_headers.patch patches.suse/sched-preempt-Tell-about-PREEMPT_DYNAMIC-on-kernel-h.patch - patches.suse/media-dvb-core-Fix-UAF-due-to-refcount-races-at-rele.patch patches.suse/scsi-core-Add-BLIST_NO_ASK_VPD_SIZE-for-some-VDASD.patch patches.suse/char-pcmcia-synclink_cs-Fix-use-after-free-in-mgslpc.patch - patches.suse/ipmi-ssif-resend_msg-cannot-fail.patch - patches.suse/ipmi_ssif-Rename-idle-state-and-check.patch - patches.suse/ipmi-ssif-Remove-rtc_us_timer.patch - patches.suse/ipmi-ssif-Add-a-timer-between-request-retries.patch ######################################################## # kbuild/module infrastructure fixes @@ -18193,10 +18620,12 @@ patches.suse/nfsd-dont-revoke-v4-0-states.patch patches.suse/nfs-access-cache-no-negative.patch patches.suse/NFS-Handle-missing-attributes-in-OPEN-reply.patch + patches.suse/NFSv3-handle-out-of-order-write-replies.patch # other patches.suse/pstore_disable_efi_backend_by_default.patch patches.suse/io_uring-disable-polling-signalfd-pollfree-files.patch + patches.suse/ocfs2-fix-data-corruption-after-failed-write.patch ######################################################## # Block layer @@ -18310,7 +18739,6 @@ ######################################################## patches.suse/0002-drm-ast-Create-the-driver-for-ASPEED-proprietory-Dis.patch patches.suse/0001-firmware-sysfb-Add-parameter-to-enable-sysfb-support.patch - patches.suse/0001-drm-i915-gvt-fix-double-free-bug-in-split_2MB_gtt_en.patch patches.suse/0001-drm-vmwgfx-Avoid-NULL-ptr-deref-in-vmw_cmd_dx_define.patch ######################################################## @@ -18366,9 +18794,6 @@ patches.suse/rdma-core-create-ib_cm-with-wq_mem_reclaim-flag.patch patches.suse/nvme-multipath-skip-not-ready-namespaces-when-revalidating.patch - # bsc#1198438: introduces a regression, revert it for the time beeing - patches.suse/revert-scsi-qla2xxx-Changes-to-support-FCP2-Target.patch - # bsc#1189297 patches.suse/scsi_probe_lun-retry-after-timeout.patch @@ -18587,6 +19012,12 @@ patches.kabi/kABI-Preserve-TRACE_EVENT_FL-values.patch patches.kabi/jbd2-fixup-fast-commit-kabi.patch patches.kabi/mbcache-entry-flags-kabi-fixup.patch + patches.kabi/NFSv3-handle-out-of-order-write-replies.patch + patches.kabi/kabi-workaround-for-migrate_vma.fault_page.patch + patches.kabi/struct-uvc_device-move-flush_status-new-member-to-en.patch + patches.kabi/NFS-Further-optimisations-for-ls-l.patch + patches.kabi/NFSD-Have-legacy-NFSD-WRITE-decoders-use-xdr_stream_.patch + patches.kabi/NFSv4.1-query-for-fs_location-attr-on-a-new-file-sys.patch ######################################################## # SLE15-SP3 OOT performance patches evaluated but left