diff --git a/blacklist.conf b/blacklist.conf index e666772..375643f 100644 --- a/blacklist.conf +++ b/blacklist.conf @@ -1663,3 +1663,17 @@ a02f6d42357acf6e5de6ffc728e6e77faf3ad217 # breaks powerpc-utils < 1.3.8 5da8e4a658109e3b7e1f45ae672b7c06ac3e7158 # this is part of a 15SP3 feature request, see SLE-13447 a90118c445cc7f07781de26a9684d4ec58bfcfd1 # build warning fix for gcc 9.x and newer 0f091e43310f5c292b7094f9f115e651358e8053 # cleanup +835d1c3a98799914db8aee0973018af21128cd1e # needs 62a679cb2825 ("arm64: simplify ptrauth initialization") +bc93b9ae0151ae5ad5b8504cdc598428ea99570b # not applicable +c8fe99d0701fec9fb849ec880a86bc5592530496 # not applicable, dependencies add new features +2369e827046920ef0599e6a36b975ac5c0a359c2 # CONFIG_BATMAN_ADV is not set +ec0972adecb391a8d8650832263a4790f3bfb4df # not applicable +12856e7acde4702b7c3238c15fcba86ff6aa507f # breaks KABI +08b6e22b850c28b6032da1e4d767a33116e23dfb # depens on 12856e7acde4 ("PCI/IOV: Mark VFs as not implementing PCI_COMMAND_MEMORY") +515ecd5368f1510152fa4f9b9ce55b66ac56c334 # depens on 12856e7acde4 ("PCI/IOV: Mark VFs as not implementing PCI_COMMAND_MEMORY") +c51f8f88d705e06bd696d7510aff22b33eb8e638 # not applicable +4afc850e2e9e781976fb2c7852ce7bac374af938 # breaks KABI +87004abfbc27261edd15716515d89ab42198b405 # duplicate of 2456c290a7889be492cb96092b62d16c11176f72 +40eab0f8956724b0c2bb9e5679269632afb72b26 # duplicate of 0f3cd13d846105795de271ac64bb807df38513b7 +2b405533c2560d7878199c57d95a39151351df72 # duplicate of 028296e480c782f13428f234a8239a0cd007bd92 +62575e270f661aba64778cbc5f354511cf9abb21 # doesn't apply, requires additional patches diff --git a/patches.rt/0415-Add-Anna-Maria-s-Provide-softirq-context-hrtimers-RT-fixups.patch b/patches.rt/0415-Add-Anna-Maria-s-Provide-softirq-context-hrtimers-RT-fixups.patch index 877de16..bd80f9a 100644 --- a/patches.rt/0415-Add-Anna-Maria-s-Provide-softirq-context-hrtimers-RT-fixups.patch +++ b/patches.rt/0415-Add-Anna-Maria-s-Provide-softirq-context-hrtimers-RT-fixups.patch @@ -80,7 +80,7 @@ Signed-off-by: Mike Galbraith --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c -@@ -2177,10 +2177,9 @@ int kvm_create_lapic(struct kvm_vcpu *vc +@@ -2184,10 +2184,9 @@ int kvm_create_lapic(struct kvm_vcpu *vc } apic->vcpu = vcpu; @@ -94,7 +94,7 @@ Signed-off-by: Mike Galbraith * APIC is created enabled. This will prevent kvm_lapic_set_base from --- a/block/blk-mq.c +++ b/block/blk-mq.c -@@ -3197,10 +3197,9 @@ static bool blk_mq_poll_hybrid_sleep(str +@@ -3230,10 +3230,9 @@ static bool blk_mq_poll_hybrid_sleep(str kt = nsecs; mode = HRTIMER_MODE_REL; @@ -459,7 +459,7 @@ Signed-off-by: Mike Galbraith static inline void destroy_hrtimer_on_stack(struct hrtimer *timer) { } #endif -@@ -436,13 +469,7 @@ static inline int hrtimer_is_queued(stru +@@ -442,13 +475,7 @@ static inline bool hrtimer_is_queued(str */ static inline int hrtimer_callback_running(const struct hrtimer *timer) { @@ -474,7 +474,7 @@ Signed-off-by: Mike Galbraith } /* Forward a hrtimer so it expires after now: */ -@@ -478,15 +505,12 @@ extern long hrtimer_nanosleep(struct tim +@@ -484,15 +511,12 @@ extern long hrtimer_nanosleep(struct tim const clockid_t clockid); extern long hrtimer_nanosleep_restart(struct restart_block *restart_block); @@ -551,7 +551,7 @@ Signed-off-by: Mike Galbraith --- a/kernel/events/core.c +++ b/kernel/events/core.c -@@ -1082,9 +1082,8 @@ static void __perf_mux_hrtimer_init(stru +@@ -1084,9 +1084,8 @@ static void __perf_mux_hrtimer_init(stru cpuctx->hrtimer_interval = ns_to_ktime(NSEC_PER_MSEC * interval); raw_spin_lock_init(&cpuctx->hrtimer_lock); @@ -562,7 +562,7 @@ Signed-off-by: Mike Galbraith } static int perf_mux_hrtimer_restart(struct perf_cpu_context *cpuctx) -@@ -9026,9 +9025,8 @@ static void perf_swevent_init_hrtimer(st +@@ -9122,9 +9121,8 @@ static void perf_swevent_init_hrtimer(st if (!is_sampling_event(event)) return; @@ -575,7 +575,7 @@ Signed-off-by: Mike Galbraith * Since hrtimers have a fixed rate, we can do a static freq->period --- a/kernel/futex.c +++ b/kernel/futex.c -@@ -2701,10 +2701,9 @@ static int futex_wait(u32 __user *uaddr, +@@ -2677,10 +2677,9 @@ static int futex_wait(u32 __user *uaddr, if (abs_time) { to = &timeout; @@ -589,7 +589,7 @@ Signed-off-by: Mike Galbraith hrtimer_set_expires_range_ns(&to->timer, *abs_time, current->timer_slack_ns); } -@@ -2800,9 +2799,8 @@ static int futex_lock_pi(u32 __user *uad +@@ -2776,9 +2775,8 @@ static int futex_lock_pi(u32 __user *uad if (time) { to = &timeout; @@ -601,7 +601,7 @@ Signed-off-by: Mike Galbraith hrtimer_set_expires(&to->timer, *time); } -@@ -3220,10 +3218,9 @@ static int futex_wait_requeue_pi(u32 __u +@@ -3196,10 +3194,9 @@ static int futex_wait_requeue_pi(u32 __u if (abs_time) { to = &timeout; @@ -1130,7 +1130,7 @@ Signed-off-by: Mike Galbraith wait_event(base->cpu_base->wait, !(hrtimer_callback_running(timer))); } -@@ -915,11 +964,6 @@ static void __remove_hrtimer(struct hrti +@@ -917,11 +966,6 @@ static void __remove_hrtimer(struct hrti if (!(state & HRTIMER_STATE_ENQUEUED)) return; @@ -1142,7 +1142,7 @@ Signed-off-by: Mike Galbraith if (!timerqueue_del(&base->active, &timer->node)) cpu_base->active_bases &= ~(1 << base->index); -@@ -983,22 +1027,54 @@ static inline ktime_t hrtimer_update_low +@@ -986,22 +1030,54 @@ static inline ktime_t hrtimer_update_low return tim; } @@ -1211,7 +1211,7 @@ Signed-off-by: Mike Galbraith /* Remove an active timer from the queue: */ remove_hrtimer(timer, base, true); -@@ -1013,21 +1089,31 @@ void hrtimer_start_range_ns(struct hrtim +@@ -1016,21 +1092,31 @@ void hrtimer_start_range_ns(struct hrtim /* Switch the timer base, if necessary: */ new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED); @@ -1256,7 +1256,7 @@ Signed-off-by: Mike Galbraith unlock_hrtimer_base(timer, &flags); } EXPORT_SYMBOL_GPL(hrtimer_start_range_ns); -@@ -1135,14 +1221,18 @@ u64 hrtimer_get_next_event(void) +@@ -1138,14 +1224,18 @@ u64 hrtimer_get_next_event(void) static inline int hrtimer_clockid_to_base(clockid_t clock_id) { @@ -1276,7 +1276,7 @@ Signed-off-by: Mike Galbraith } static void __hrtimer_init(struct hrtimer *timer, clockid_t clock_id, -@@ -1160,12 +1250,15 @@ static void __hrtimer_init(struct hrtime +@@ -1163,12 +1253,15 @@ static void __hrtimer_init(struct hrtime * clock modifications, so they needs to become CLOCK_MONOTONIC to * ensure POSIX compliance. */ @@ -1295,7 +1295,7 @@ Signed-off-by: Mike Galbraith timerqueue_init(&timer->node); } -@@ -1192,20 +1285,19 @@ EXPORT_SYMBOL_GPL(hrtimer_init); +@@ -1195,20 +1288,19 @@ EXPORT_SYMBOL_GPL(hrtimer_init); */ bool hrtimer_active(const struct hrtimer *timer) { @@ -1322,7 +1322,7 @@ Signed-off-by: Mike Galbraith return false; } -@@ -1231,7 +1323,8 @@ EXPORT_SYMBOL_GPL(hrtimer_active); +@@ -1234,7 +1326,8 @@ EXPORT_SYMBOL_GPL(hrtimer_active); static void __run_hrtimer(struct hrtimer_cpu_base *cpu_base, struct hrtimer_clock_base *base, @@ -1332,7 +1332,7 @@ Signed-off-by: Mike Galbraith { enum hrtimer_restart (*fn)(struct hrtimer *); int restart; -@@ -1239,16 +1332,16 @@ static void __run_hrtimer(struct hrtimer +@@ -1242,16 +1335,16 @@ static void __run_hrtimer(struct hrtimer lockdep_assert_held(&cpu_base->lock); debug_deactivate(timer); @@ -1352,7 +1352,7 @@ Signed-off-by: Mike Galbraith __remove_hrtimer(timer, base, HRTIMER_STATE_INACTIVE, 0); fn = timer->function; -@@ -1262,15 +1355,23 @@ static void __run_hrtimer(struct hrtimer +@@ -1265,15 +1358,23 @@ static void __run_hrtimer(struct hrtimer timer->is_rel = false; /* @@ -1381,7 +1381,7 @@ Signed-off-by: Mike Galbraith /* * Note: We clear the running state after enqueue_hrtimer and -@@ -1289,125 +1390,28 @@ static void __run_hrtimer(struct hrtimer +@@ -1292,125 +1393,28 @@ static void __run_hrtimer(struct hrtimer * Separate the ->running assignment from the ->state assignment. * * As with a regular write barrier, this ensures the read side in @@ -1519,7 +1519,7 @@ Signed-off-by: Mike Galbraith basenow = ktime_add(now, base->offset); -@@ -1431,13 +1435,27 @@ static int __hrtimer_run_queues(struct h +@@ -1434,13 +1438,27 @@ static int __hrtimer_run_queues(struct h if (basenow < hrtimer_get_softexpires_tv64(timer)) break; @@ -1552,7 +1552,7 @@ Signed-off-by: Mike Galbraith } #ifdef CONFIG_HIGH_RES_TIMERS -@@ -1451,7 +1469,6 @@ void hrtimer_interrupt(struct clock_even +@@ -1454,7 +1472,6 @@ void hrtimer_interrupt(struct clock_even struct hrtimer_cpu_base *cpu_base = this_cpu_ptr(&hrtimer_bases); ktime_t expires_next, now, entry_time, delta; int retries = 0; @@ -1560,7 +1560,7 @@ Signed-off-by: Mike Galbraith BUG_ON(!cpu_base->hres_active); cpu_base->nr_events++; -@@ -1470,9 +1487,15 @@ retry: +@@ -1473,9 +1490,15 @@ retry: */ cpu_base->expires_next = KTIME_MAX; @@ -1578,7 +1578,7 @@ Signed-off-by: Mike Galbraith expires_next = __hrtimer_get_next_event(cpu_base); /* * Store the new expiry value so the migration code can verify -@@ -1481,8 +1504,6 @@ retry: +@@ -1484,8 +1507,6 @@ retry: cpu_base->expires_next = expires_next; cpu_base->in_hrtirq = 0; raw_spin_unlock(&cpu_base->lock); @@ -1587,7 +1587,7 @@ Signed-off-by: Mike Galbraith /* Reprogramming necessary ? */ if (!tick_program_event(expires_next, 0)) { -@@ -1559,7 +1580,6 @@ void hrtimer_run_queues(void) +@@ -1562,7 +1583,6 @@ void hrtimer_run_queues(void) { struct hrtimer_cpu_base *cpu_base = this_cpu_ptr(&hrtimer_bases); ktime_t now; @@ -1595,7 +1595,7 @@ Signed-off-by: Mike Galbraith if (__hrtimer_hres_active(cpu_base)) return; -@@ -1578,10 +1598,15 @@ void hrtimer_run_queues(void) +@@ -1581,10 +1601,15 @@ void hrtimer_run_queues(void) raw_spin_lock(&cpu_base->lock); now = hrtimer_update_base(cpu_base); @@ -1614,7 +1614,7 @@ Signed-off-by: Mike Galbraith } /* -@@ -1600,19 +1625,51 @@ static enum hrtimer_restart hrtimer_wake +@@ -1603,19 +1628,51 @@ static enum hrtimer_restart hrtimer_wake return HRTIMER_NORESTART; } @@ -1670,7 +1670,7 @@ Signed-off-by: Mike Galbraith do { set_current_state(state); hrtimer_start_expires(&t->timer, mode); -@@ -1652,8 +1709,8 @@ long __sched hrtimer_nanosleep_restart(s +@@ -1655,8 +1712,8 @@ long __sched hrtimer_nanosleep_restart(s struct timespec __user *rmtp; int ret = 0; @@ -1681,7 +1681,7 @@ Signed-off-by: Mike Galbraith hrtimer_set_expires_tv64(&t.timer, restart->nanosleep.expires); /* cpu_chill() does not care about restart state. */ -@@ -1688,8 +1745,9 @@ __hrtimer_nanosleep(struct timespec64 *r +@@ -1691,8 +1748,9 @@ __hrtimer_nanosleep(struct timespec64 *r if (dl_task(current) || rt_task(current)) slack = 0; @@ -1692,7 +1692,7 @@ Signed-off-by: Mike Galbraith if (do_nanosleep(&t, mode, state)) goto out; -@@ -1751,7 +1809,7 @@ void cpu_chill(void) +@@ -1754,7 +1812,7 @@ void cpu_chill(void) unsigned int freeze_flag = current->flags & PF_NOFREEZE; current->flags |= PF_NOFREEZE; @@ -1701,7 +1701,7 @@ Signed-off-by: Mike Galbraith TASK_UNINTERRUPTIBLE); if (!freeze_flag) current->flags &= ~PF_NOFREEZE; -@@ -1770,12 +1828,15 @@ int hrtimers_prepare_cpu(unsigned int cp +@@ -1773,12 +1831,15 @@ int hrtimers_prepare_cpu(unsigned int cp for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++) { cpu_base->clock_base[i].cpu_base = cpu_base; timerqueue_init_head(&cpu_base->clock_base[i].active); @@ -1719,7 +1719,7 @@ Signed-off-by: Mike Galbraith #ifdef CONFIG_PREEMPT_RT_BASE init_waitqueue_head(&cpu_base->wait); #endif -@@ -1784,7 +1845,7 @@ int hrtimers_prepare_cpu(unsigned int cp +@@ -1787,7 +1848,7 @@ int hrtimers_prepare_cpu(unsigned int cp #ifdef CONFIG_HOTPLUG_CPU @@ -1728,7 +1728,7 @@ Signed-off-by: Mike Galbraith struct hrtimer_clock_base *new_base) { struct hrtimer *timer; -@@ -1812,25 +1873,17 @@ static int migrate_hrtimer_list(struct h +@@ -1815,25 +1876,17 @@ static int migrate_hrtimer_list(struct h */ enqueue_hrtimer(timer, new_base); } @@ -1756,7 +1756,7 @@ Signed-off-by: Mike Galbraith local_irq_disable(); old_base = &per_cpu(hrtimer_bases, scpu); new_base = this_cpu_ptr(&hrtimer_bases); -@@ -1842,56 +1895,50 @@ int hrtimers_dead_cpu(unsigned int scpu) +@@ -1845,56 +1898,50 @@ int hrtimers_dead_cpu(unsigned int scpu) raw_spin_lock_nested(&old_base->lock, SINGLE_DEPTH_NESTING); for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++) { @@ -1832,7 +1832,7 @@ Signed-off-by: Mike Galbraith { struct hrtimer_sleeper t; -@@ -1912,10 +1959,9 @@ schedule_hrtimeout_range_clock(ktime_t * +@@ -1915,10 +1962,9 @@ schedule_hrtimeout_range_clock(ktime_t * return -EINTR; } @@ -1847,7 +1847,7 @@ Signed-off-by: Mike Galbraith --- a/kernel/time/tick-broadcast-hrtimer.c +++ b/kernel/time/tick-broadcast-hrtimer.c -@@ -105,8 +105,7 @@ static enum hrtimer_restart bc_handler(s +@@ -106,8 +106,7 @@ static enum hrtimer_restart bc_handler(s void tick_setup_hrtimer_broadcast(void) { diff --git a/patches.rt/0417-tracing-Update-the-Inter-event-e.g.-latency-support-patch-to-v2.patch b/patches.rt/0417-tracing-Update-the-Inter-event-e.g.-latency-support-patch-to-v2.patch index 6e5a8f2..a6b6555 100644 --- a/patches.rt/0417-tracing-Update-the-Inter-event-e.g.-latency-support-patch-to-v2.patch +++ b/patches.rt/0417-tracing-Update-the-Inter-event-e.g.-latency-support-patch-to-v2.patch @@ -240,7 +240,7 @@ Signed-off-by: Mike Galbraith case RINGBUF_TYPE_DATA: return rb_event_data_length(event); default: -@@ -2591,61 +2593,29 @@ rb_wakeups(struct ring_buffer *buffer, s +@@ -2593,93 +2593,29 @@ * The lock and unlock are done within a preempt disable section. * The current_context per_cpu variable can only be modified * by the current task between lock and unlock. But it can @@ -249,11 +249,13 @@ Signed-off-by: Mike Galbraith - * access the 'in_interrupt()' functions again (which do show - * a bit of overhead in something as critical as function tracing, - * we use a bitmask trick. -- * -- * bit 0 = NMI context -- * bit 1 = IRQ context -- * bit 2 = SoftIRQ context -- * bit 3 = normal context. ++ * be modified more than once via an interrupt. There are four ++ * different contexts that we need to consider. + * +- * bit 1 = NMI context +- * bit 2 = IRQ context +- * bit 3 = SoftIRQ context +- * bit 4 = normal context. - * - * This works because this is the order of contexts that can - * preempt other contexts. A SoftIRQ never preempts an IRQ @@ -276,9 +278,30 @@ Signed-off-by: Mike Galbraith - * The least significant bit can be cleared this way, and it - * just so happens that it is the same bit corresponding to - * the current context. -+ * be modified more than once via an interrupt. There are four -+ * different contexts that we need to consider. -+ * +- * +- * Now the TRANSITION bit breaks the above slightly. The TRANSITION bit +- * is set when a recursion is detected at the current context, and if +- * the TRANSITION bit is already set, it will fail the recursion. +- * This is needed because there's a lag between the changing of +- * interrupt context and updating the preempt count. In this case, +- * a false positive will be found. To handle this, one extra recursion +- * is allowed, and this is done by the TRANSITION bit. If the TRANSITION +- * bit is already set, then it is considered a recursion and the function +- * ends. Otherwise, the TRANSITION bit is set, and that bit is returned. +- * +- * On the trace_recursive_unlock(), the TRANSITION bit will be the first +- * to be cleared. Even if it wasn't the context that set it. That is, +- * if an interrupt comes in while NORMAL bit is set and the ring buffer +- * is called before preempt_count() is updated, since the check will +- * be on the NORMAL bit, the TRANSITION bit will then be set. If an +- * NMI then comes in, it will set the NMI bit, but when the NMI code +- * does the trace_recursive_unlock() it will clear the TRANSTION bit +- * and leave the NMI bit set. But this is fine, because the interrupt +- * code that set the TRANSITION bit will then clear the NMI bit when it +- * calls trace_recursive_unlock(). If another NMI comes in, it will +- * set the TRANSITION bit and continue. +- * +- * Note: The TRANSITION bit only handles a single transition between context. + * Normal context. + * SoftIRQ context + * IRQ context @@ -287,7 +310,7 @@ Signed-off-by: Mike Galbraith + * If for some reason the ring buffer starts to recurse, we + * only allow that to happen at most 4 times (one for each + * context). If it happens 5 times, then we consider this a -+ * recusive loop and do not let it go further. ++ * recursive loop and do not let it go further. */ static __always_inline int @@ -306,9 +329,18 @@ Signed-off-by: Mike Galbraith - } else - bit = RB_CTX_NORMAL; - -- if (unlikely(val & (1 << bit))) +- if (unlikely(val & (1 << bit))) { +- /* +- * It is possible that this was called by transitioning +- * between interrupt context, and preempt_count() has not +- * been updated yet. In this case, use the TRANSITION bit. +- */ +- bit = RB_CTX_TRANSITION; +- if (val & (1 << bit)) +- return 1; +- } + if (cpu_buffer->current_context >= 4) - return 1; ++ return 1; - val |= (1 << bit); - cpu_buffer->current_context = val; diff --git a/patches.rt/kthread-convert-worker-lock-to-raw-spinlock.patch b/patches.rt/kthread-convert-worker-lock-to-raw-spinlock.patch index 25b1924..171d0c4 100644 --- a/patches.rt/kthread-convert-worker-lock-to-raw-spinlock.patch +++ b/patches.rt/kthread-convert-worker-lock-to-raw-spinlock.patch @@ -30,7 +30,7 @@ Signed-off-by: Mike Galbraith --- a/include/linux/kthread.h +++ b/include/linux/kthread.h -@@ -83,7 +83,7 @@ enum { +@@ -84,7 +84,7 @@ enum { struct kthread_worker { unsigned int flags; @@ -41,7 +41,7 @@ Signed-off-by: Mike Galbraith struct task_struct *task; --- a/kernel/kthread.c +++ b/kernel/kthread.c -@@ -578,7 +578,7 @@ void __kthread_init_worker(struct kthrea +@@ -586,7 +586,7 @@ void __kthread_init_worker(struct kthrea struct lock_class_key *key) { memset(worker, 0, sizeof(struct kthread_worker)); @@ -50,7 +50,7 @@ Signed-off-by: Mike Galbraith lockdep_set_class_and_name(&worker->lock, key, name); INIT_LIST_HEAD(&worker->work_list); INIT_LIST_HEAD(&worker->delayed_work_list); -@@ -620,21 +620,21 @@ int kthread_worker_fn(void *worker_ptr) +@@ -628,21 +628,21 @@ repeat: if (kthread_should_stop()) { __set_current_state(TASK_RUNNING); @@ -76,7 +76,7 @@ Signed-off-by: Mike Galbraith if (work) { __set_current_state(TASK_RUNNING); -@@ -790,12 +790,12 @@ bool kthread_queue_work(struct kthread_w +@@ -798,12 +798,12 @@ bool kthread_queue_work(struct kthread_w bool ret = false; unsigned long flags; @@ -91,7 +91,7 @@ Signed-off-by: Mike Galbraith return ret; } EXPORT_SYMBOL_GPL(kthread_queue_work); -@@ -822,7 +822,7 @@ void kthread_delayed_work_timer_fn(unsig +@@ -830,7 +830,7 @@ void kthread_delayed_work_timer_fn(unsig if (WARN_ON_ONCE(!worker)) return; @@ -100,16 +100,16 @@ Signed-off-by: Mike Galbraith /* Work must not be used with >1 worker, see kthread_queue_work(). */ WARN_ON_ONCE(work->worker != worker); -@@ -831,7 +831,7 @@ void kthread_delayed_work_timer_fn(unsig - list_del_init(&work->node); - kthread_insert_work(worker, work, &worker->work_list); +@@ -840,7 +840,7 @@ void kthread_delayed_work_timer_fn(unsig + if (!work->canceling) + kthread_insert_work(worker, work, &worker->work_list); - spin_unlock(&worker->lock); + raw_spin_unlock(&worker->lock); } EXPORT_SYMBOL(kthread_delayed_work_timer_fn); -@@ -888,14 +888,14 @@ bool kthread_queue_delayed_work(struct k +@@ -897,14 +897,14 @@ bool kthread_queue_delayed_work(struct k unsigned long flags; bool ret = false; @@ -126,7 +126,7 @@ Signed-off-by: Mike Galbraith return ret; } EXPORT_SYMBOL_GPL(kthread_queue_delayed_work); -@@ -931,7 +931,7 @@ void kthread_flush_work(struct kthread_w +@@ -940,7 +940,7 @@ void kthread_flush_work(struct kthread_w if (!worker) return; @@ -135,7 +135,7 @@ Signed-off-by: Mike Galbraith /* Work must not be used with >1 worker, see kthread_queue_work(). */ WARN_ON_ONCE(work->worker != worker); -@@ -943,7 +943,7 @@ void kthread_flush_work(struct kthread_w +@@ -952,7 +952,7 @@ void kthread_flush_work(struct kthread_w else noop = true; @@ -144,7 +144,7 @@ Signed-off-by: Mike Galbraith if (!noop) wait_for_completion(&fwork.done); -@@ -976,9 +976,9 @@ static bool __kthread_cancel_work(struct +@@ -985,9 +985,9 @@ static bool __kthread_cancel_work(struct * any queuing is blocked by setting the canceling counter. */ work->canceling++; @@ -156,7 +156,7 @@ Signed-off-by: Mike Galbraith work->canceling--; } -@@ -1025,7 +1025,7 @@ bool kthread_mod_delayed_work(struct kth +@@ -1034,7 +1034,7 @@ bool kthread_mod_delayed_work(struct kth unsigned long flags; int ret = false; @@ -165,7 +165,7 @@ Signed-off-by: Mike Galbraith /* Do not bother with canceling when never queued. */ if (!work->worker) -@@ -1042,7 +1042,7 @@ bool kthread_mod_delayed_work(struct kth +@@ -1051,7 +1051,7 @@ bool kthread_mod_delayed_work(struct kth fast_queue: __kthread_queue_delayed_work(worker, dwork, delay); out: @@ -174,7 +174,7 @@ Signed-off-by: Mike Galbraith return ret; } EXPORT_SYMBOL_GPL(kthread_mod_delayed_work); -@@ -1056,7 +1056,7 @@ static bool __kthread_cancel_work_sync(s +@@ -1065,7 +1065,7 @@ static bool __kthread_cancel_work_sync(s if (!worker) goto out; @@ -183,7 +183,7 @@ Signed-off-by: Mike Galbraith /* Work must not be used with >1 worker, see kthread_queue_work(). */ WARN_ON_ONCE(work->worker != worker); -@@ -1070,13 +1070,13 @@ static bool __kthread_cancel_work_sync(s +@@ -1079,13 +1079,13 @@ static bool __kthread_cancel_work_sync(s * In the meantime, block any queuing by setting the canceling counter. */ work->canceling++; diff --git a/patches.rt/tracing-Update-the-tracing-Inter-event-e.g.-latency-support-patch.patch b/patches.rt/tracing-Update-the-tracing-Inter-event-e.g.-latency-support-patch.patch index f25716d..780797c 100644 --- a/patches.rt/tracing-Update-the-tracing-Inter-event-e.g.-latency-support-patch.patch +++ b/patches.rt/tracing-Update-the-tracing-Inter-event-e.g.-latency-support-patch.patch @@ -117,18 +117,18 @@ Signed-off-by: Mike Galbraith --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c -@@ -2601,16 +2601,16 @@ rb_wakeups(struct ring_buffer *buffer, s +@@ -2603,16 +2603,16 @@ rb_wakeups(struct ring_buffer *buffer, s * IRQ context * NMI context * - * If for some reason the ring buffer starts to recurse, we - * only allow that to happen at most 4 times (one for each - * context). If it happens 5 times, then we consider this a -- * recusive loop and do not let it go further. +- * recursive loop and do not let it go further. + * If for some reason the ring buffer starts to recurse, we only allow + * that to happen at most 6 times (one for each context, plus possibly + * two levels of synthetic event generation). If it happens 7 times, -+ * then we consider this a recusive loop and do not let it go further. ++ * then we consider this a recursive loop and do not let it go further. */ static __always_inline int @@ -141,7 +141,7 @@ Signed-off-by: Mike Galbraith cpu_buffer->current_context++; --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c -@@ -7570,6 +7570,7 @@ static int instance_mkdir(const char *na +@@ -7599,6 +7599,7 @@ static int instance_mkdir(const char *na struct trace_array *tr; int ret; @@ -149,7 +149,7 @@ Signed-off-by: Mike Galbraith mutex_lock(&trace_types_lock); ret = -EEXIST; -@@ -7626,6 +7627,7 @@ static int instance_mkdir(const char *na +@@ -7655,6 +7656,7 @@ static int instance_mkdir(const char *na list_add(&tr->list, &ftrace_trace_arrays); mutex_unlock(&trace_types_lock); @@ -157,7 +157,7 @@ Signed-off-by: Mike Galbraith return 0; -@@ -7637,6 +7639,7 @@ static int instance_mkdir(const char *na +@@ -7666,6 +7668,7 @@ static int instance_mkdir(const char *na out_unlock: mutex_unlock(&trace_types_lock); @@ -165,7 +165,7 @@ Signed-off-by: Mike Galbraith return ret; -@@ -7649,6 +7652,7 @@ static int instance_rmdir(const char *na +@@ -7678,6 +7681,7 @@ static int instance_rmdir(const char *na int ret; int i; @@ -173,7 +173,7 @@ Signed-off-by: Mike Galbraith mutex_lock(&trace_types_lock); ret = -ENODEV; -@@ -7694,6 +7698,7 @@ static int instance_rmdir(const char *na +@@ -7723,6 +7727,7 @@ static int instance_rmdir(const char *na out_unlock: mutex_unlock(&trace_types_lock); diff --git a/patches.suse/0001-ALSA-usb-audio-Fix-potential-use-after-free-of-strea.patch b/patches.suse/0001-ALSA-usb-audio-Fix-potential-use-after-free-of-strea.patch new file mode 100644 index 0000000..dce63c2 --- /dev/null +++ b/patches.suse/0001-ALSA-usb-audio-Fix-potential-use-after-free-of-strea.patch @@ -0,0 +1,41 @@ +From 215d0e14241aab854297b48f113939df86487c68 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 16 Jun 2020 14:09:21 +0200 +Subject: [PATCH] ALSA: usb-audio: Fix potential use-after-free of streams +Git-commit: ff58bbc7b9704a5869204176f804eff57307fef0 +Patch-mainline: v5.8-rc3 +References: gix-fixes + +With the recent full-duplex support of implicit feedback streams, an +endpoint can be still running after closing the capture stream as long +as the playback stream with the sync-endpoint is running. In such a +state, the URBs are still be handled and they may call retire_data_urb +callback, which tries to transfer the data from the PCM buffer. Since +the PCM stream gets closed, this may lead to use-after-free. + +This patch adds the proper clearance of the callback at stopping the +capture stream for addressing the possible UAF above. + +Fixes: 10ce77e4817f ("ALSA: usb-audio: Add duplex sound support for USB devices using implicit feedback") +Link: https://lore.kernel.org/r/20200616120921.12249-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Acked-by: Denis Kirjanov +--- + sound/usb/pcm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index 31cf6d28741c..914eeb4e2b6a 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -1774,6 +1774,7 @@ static int snd_usb_substream_capture_trigger(struct snd_pcm_substream *substream + return 0; + case SNDRV_PCM_TRIGGER_STOP: + stop_endpoints(subs, false); ++ subs->data_endpoint->retire_data_urb = NULL; + subs->running = 0; + return 0; + case SNDRV_PCM_TRIGGER_PAUSE_PUSH: +-- +2.16.4 + diff --git a/patches.suse/0001-ipmi-use-vzalloc-instead-of-kmalloc-for-user-creatio.patch b/patches.suse/0001-ipmi-use-vzalloc-instead-of-kmalloc-for-user-creatio.patch new file mode 100644 index 0000000..b72241c --- /dev/null +++ b/patches.suse/0001-ipmi-use-vzalloc-instead-of-kmalloc-for-user-creatio.patch @@ -0,0 +1,82 @@ +From 7c47a219b95d0e06b5ef5fcc7bad807895015eac Mon Sep 17 00:00:00 2001 +From: Feng Tang +Date: Fri, 17 Apr 2020 12:48:28 +0800 +Subject: [PATCH] ipmi: use vzalloc instead of kmalloc for user creation +Git-commit: 7c47a219b95d0e06b5ef5fcc7bad807895015eac +Patch-mainline: v5.8-rc1 +References: bsc#1178607 + +We met mulitple times of failure of staring bmc-watchdog, +due to the runtime memory allocation failure of order 4. + + bmc-watchdog: page allocation failure: order:4, mode:0x40cc0(GFP_KERNEL|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0-1 + CPU: 1 PID: 2571 Comm: bmc-watchdog Not tainted 5.5.0-00045-g7d6bb61d6188c #1 + Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.00.01.0015.110720180833 11/07/2018 + Call Trace: + dump_stack+0x66/0x8b + warn_alloc+0xfe/0x160 + __alloc_pages_slowpath+0xd3e/0xd80 + __alloc_pages_nodemask+0x2f0/0x340 + kmalloc_order+0x18/0x70 + kmalloc_order_trace+0x1d/0xb0 + ipmi_create_user+0x55/0x2c0 [ipmi_msghandler] + ipmi_open+0x72/0x110 [ipmi_devintf] + chrdev_open+0xcb/0x1e0 + do_dentry_open+0x1ce/0x380 + path_openat+0x305/0x14f0 + do_filp_open+0x9b/0x110 + do_sys_open+0x1bd/0x250 + do_syscall_64+0x5b/0x1f0 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Using vzalloc/vfree for creating ipmi_user heals the +problem + +Thanks to Stephen Rothwell for finding the vmalloc.h +inclusion issue. + +Signed-off-by: Feng Tang +Signed-off-by: Corey Minyard +Acked-by: Michal Hocko + +--- + drivers/char/ipmi/ipmi_msghandler.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + + #define PFX "IPMI message handler: " + +@@ -1099,7 +1100,7 @@ static void free_user_work(struct work_s + remove_work); + + cleanup_srcu_struct(&user->release_barrier); +- kfree(user); ++ vfree(user); + } + + int ipmi_create_user(unsigned int if_num, +@@ -1140,7 +1141,7 @@ int ipmi_create_user(unsigned int + return -ENODEV; + } + +- new_user = kmalloc(sizeof(*new_user), GFP_KERNEL); ++ new_user = vzalloc(sizeof(*new_user)); + if (!new_user) + return -ENOMEM; + +@@ -1189,7 +1190,7 @@ int ipmi_create_user(unsigned int + + out_kfree: + srcu_read_unlock(&ipmi_interfaces_srcu, index); +- kfree(new_user); ++ vfree(new_user); + return rv; + } + EXPORT_SYMBOL(ipmi_create_user); diff --git a/patches.suse/0005-Revert-drm-amdgpu-Fix-NULL-dereference-in-dpm-sysfs-.patch b/patches.suse/0005-Revert-drm-amdgpu-Fix-NULL-dereference-in-dpm-sysfs-.patch index 3a314ee..cd04c59 100644 --- a/patches.suse/0005-Revert-drm-amdgpu-Fix-NULL-dereference-in-dpm-sysfs-.patch +++ b/patches.suse/0005-Revert-drm-amdgpu-Fix-NULL-dereference-in-dpm-sysfs-.patch @@ -2,8 +2,8 @@ From 87004abfbc27261edd15716515d89ab42198b405 Mon Sep 17 00:00:00 2001 From: Alex Deucher Date: Thu, 30 Jul 2020 11:02:30 -0400 Subject: Revert "drm/amdgpu: Fix NULL dereference in dpm sysfs handlers" -Git-commit: 87004abfbc27261edd15716515d89ab42198b405 -Patch-mainline: v5.8 +Git-commit: 2456c290a7889be492cb96092b62d16c11176f72 +Patch-mainline: v5.10-rc1 References: bsc#1113956 This regressed some working configurations so revert it. Will diff --git a/patches.suse/9P-Cast-to-loff_t-before-multiplying.patch b/patches.suse/9P-Cast-to-loff_t-before-multiplying.patch new file mode 100644 index 0000000..dbd2957 --- /dev/null +++ b/patches.suse/9P-Cast-to-loff_t-before-multiplying.patch @@ -0,0 +1,41 @@ +From f5f7ab168b9a60e12a4b8f2bb6fcc91321dc23c1 Mon Sep 17 00:00:00 2001 +From: "Matthew Wilcox (Oracle)" +Date: Sun, 4 Oct 2020 19:04:22 +0100 +Subject: [PATCH] 9P: Cast to loff_t before multiplying +Git-commit: f5f7ab168b9a60e12a4b8f2bb6fcc91321dc23c1 +Patch-mainline: v5.10-rc1 +References: git-fixes + +On 32-bit systems, this multiplication will overflow for files larger +than 4GB. + +Link: http://lkml.kernel.org/r/20201004180428.14494-2-willy@infradead.org +Cc: stable@vger.kernel.org +Fixes: fb89b45cdfdc ("9P: introduction of a new cache=mmap model.") +Signed-off-by: Matthew Wilcox (Oracle) +Signed-off-by: Dominique Martinet +Acked-by: Takashi Iwai + +--- + fs/9p/vfs_file.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c +index 3576123d8299..6d97b6b4d34b 100644 +--- a/fs/9p/vfs_file.c ++++ b/fs/9p/vfs_file.c +@@ -612,9 +612,9 @@ static void v9fs_mmap_vm_close(struct vm_area_struct *vma) + struct writeback_control wbc = { + .nr_to_write = LONG_MAX, + .sync_mode = WB_SYNC_ALL, +- .range_start = vma->vm_pgoff * PAGE_SIZE, ++ .range_start = (loff_t)vma->vm_pgoff * PAGE_SIZE, + /* absolute end, byte at end included */ +- .range_end = vma->vm_pgoff * PAGE_SIZE + ++ .range_end = (loff_t)vma->vm_pgoff * PAGE_SIZE + + (vma->vm_end - vma->vm_start - 1), + }; + +-- +2.16.4 + diff --git a/patches.suse/ACPI-NFIT-Fix-comparison-to-ENXIO.patch b/patches.suse/ACPI-NFIT-Fix-comparison-to-ENXIO.patch new file mode 100644 index 0000000..baee88a --- /dev/null +++ b/patches.suse/ACPI-NFIT-Fix-comparison-to-ENXIO.patch @@ -0,0 +1,39 @@ +From 85f971b65a692b68181438e099b946cc06ed499b Mon Sep 17 00:00:00 2001 +From: Zhang Qilong +Date: Tue, 27 Oct 2020 21:49:01 +0800 +Subject: [PATCH] ACPI: NFIT: Fix comparison to '-ENXIO' +Git-commit: 85f971b65a692b68181438e099b946cc06ed499b +Patch-mainline: v5.10-rc2 +References: git-fixes + +Initial value of rc is '-ENXIO', and we should +use the initial value to check it. + +Signed-off-by: Zhang Qilong +Reviewed-by: Pankaj Gupta +Reviewed-by: Vishal Verma +[ rjw: Subject edit ] + +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/acpi/nfit/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index 756227837b3b..3a3c209ed3d3 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -1564,7 +1564,7 @@ static ssize_t format1_show(struct device *dev, + le16_to_cpu(nfit_dcr->dcr->code)); + break; + } +- if (rc != ENXIO) ++ if (rc != -ENXIO) + break; + } + mutex_unlock(&acpi_desc->init_mutex); +-- +2.16.4 + diff --git a/patches.suse/ACPI-debug-don-t-allow-debugging-when-ACPI-is-disabl.patch b/patches.suse/ACPI-debug-don-t-allow-debugging-when-ACPI-is-disabl.patch new file mode 100644 index 0000000..857df4f --- /dev/null +++ b/patches.suse/ACPI-debug-don-t-allow-debugging-when-ACPI-is-disabl.patch @@ -0,0 +1,67 @@ +From 0fada277147ffc6d694aa32162f51198d4f10d94 Mon Sep 17 00:00:00 2001 +From: Jamie Iles +Date: Mon, 12 Oct 2020 14:04:46 +0100 +Subject: [PATCH] ACPI: debug: don't allow debugging when ACPI is disabled +Git-commit: 0fada277147ffc6d694aa32162f51198d4f10d94 +Patch-mainline: v5.10-rc1 +References: git-fixes + +If ACPI is disabled then loading the acpi_dbg module will result in the +following splat when lock debugging is enabled. + + DEBUG_LOCKS_WARN_ON(lock->magic != lock) + WARNING: CPU: 0 PID: 1 at kernel/locking/mutex.c:938 __mutex_lock+0xa10/0x1290 + Kernel panic - not syncing: panic_on_warn set ... + CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.9.0-rc8+ #103 + Hardware name: linux,dummy-virt (DT) + Call trace: + dump_backtrace+0x0/0x4d8 + show_stack+0x34/0x48 + dump_stack+0x174/0x1f8 + panic+0x360/0x7a0 + __warn+0x244/0x2ec + report_bug+0x240/0x398 + bug_handler+0x50/0xc0 + call_break_hook+0x160/0x1d8 + brk_handler+0x30/0xc0 + do_debug_exception+0x184/0x340 + el1_dbg+0x48/0xb0 + el1_sync_handler+0x170/0x1c8 + el1_sync+0x80/0x100 + __mutex_lock+0xa10/0x1290 + mutex_lock_nested+0x6c/0xc0 + acpi_register_debugger+0x40/0x88 + acpi_aml_init+0xc4/0x114 + do_one_initcall+0x24c/0xb10 + kernel_init_freeable+0x690/0x728 + kernel_init+0x20/0x1e8 + ret_from_fork+0x10/0x18 + +This is because acpi_debugger.lock has not been initialized as +acpi_debugger_init() is not called when ACPI is disabled. Fail module +loading to avoid this and any subsequent problems that might arise by +trying to debug AML when ACPI is disabled. + +Fixes: 8cfb0cdf07e2 ("ACPI / debugger: Add IO interface to access debugger functionalities") +Reviewed-by: Hanjun Guo +Signed-off-by: Jamie Iles +Cc: 4.10+ # 4.10+ +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/acpi/acpi_dbg.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/acpi/acpi_dbg.c ++++ b/drivers/acpi/acpi_dbg.c +@@ -757,6 +757,9 @@ int __init acpi_aml_init(void) + goto err_exit; + } + ++ if (acpi_disabled) ++ return -ENODEV; ++ + /* Initialize AML IO interface */ + mutex_init(&acpi_aml_io.lock); + init_waitqueue_head(&acpi_aml_io.wait); diff --git a/patches.suse/ACPI-dock-fix-enum-conversion-warning.patch b/patches.suse/ACPI-dock-fix-enum-conversion-warning.patch new file mode 100644 index 0000000..ef672f2 --- /dev/null +++ b/patches.suse/ACPI-dock-fix-enum-conversion-warning.patch @@ -0,0 +1,46 @@ +From be0e97526455fefe3b7668b7fdf6cd247bf13318 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 26 Oct 2020 22:48:34 +0100 +Subject: [PATCH] ACPI: dock: fix enum-conversion warning +Git-commit: be0e97526455fefe3b7668b7fdf6cd247bf13318 +Patch-mainline: v5.10-rc2 +References: git-fixes + +gcc points out a type mismatch: + +Drivers/acpi/dock.c: In function 'hot_remove_dock_devices': +drivers/acpi/dock.c:234:53: warning: implicit conversion from 'enum ' to 'enum dock_callback_type' [-Wenum-conversion] + 234 | dock_hotplug_event(dd, ACPI_NOTIFY_EJECT_REQUEST, false); + +This is harmless because 'false' still has the correct numeric value, +but passing DOCK_CALL_HANDLER documents better what is going on +and avoids the warning. + +Fixes: 37f908778f20 ("ACPI / dock: Walk list in reverse order during removal of devices") +Fixes: f09ce741a03a ("ACPI / dock / PCI: Drop ACPI dock notifier chain") +Signed-off-by: Arnd Bergmann +Reviewed-by: Hanjun Guo +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/acpi/dock.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c +index 45d4b7b69de8..24e076f44d23 100644 +--- a/drivers/acpi/dock.c ++++ b/drivers/acpi/dock.c +@@ -231,7 +231,8 @@ static void hot_remove_dock_devices(struct dock_station *ds) + * between them). + */ + list_for_each_entry_reverse(dd, &ds->dependent_devices, list) +- dock_hotplug_event(dd, ACPI_NOTIFY_EJECT_REQUEST, false); ++ dock_hotplug_event(dd, ACPI_NOTIFY_EJECT_REQUEST, ++ DOCK_CALL_HANDLER); + + list_for_each_entry_reverse(dd, &ds->dependent_devices, list) + acpi_bus_trim(dd->adev); +-- +2.16.4 + diff --git a/patches.suse/ACPI-extlog-Check-for-RDMSR-failure.patch b/patches.suse/ACPI-extlog-Check-for-RDMSR-failure.patch new file mode 100644 index 0000000..bfb9d52 --- /dev/null +++ b/patches.suse/ACPI-extlog-Check-for-RDMSR-failure.patch @@ -0,0 +1,41 @@ +From 7cecb47f55e00282f972a1e0b09136c8cd938221 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Sun, 27 Sep 2020 22:50:42 +0100 +Subject: [PATCH] ACPI / extlog: Check for RDMSR failure +Git-commit: 7cecb47f55e00282f972a1e0b09136c8cd938221 +Patch-mainline: v5.10-rc1 +References: git-fixes + +extlog_init() uses rdmsrl() to read an MSR, which on older CPUs +provokes a error message at boot: + + unchecked MSR access error: RDMSR from 0x179 at rIP: 0xcd047307 (native_read_msr+0x7/0x40) + +Use rdmsrl_safe() instead, and return -ENODEV if it fails. + +Reported-by: jim@photojim.ca +References: https://bugs.debian.org/971058 +Cc: All applicable +Signed-off-by: Ben Hutchings +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/acpi/acpi_extlog.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/acpi/acpi_extlog.c ++++ b/drivers/acpi/acpi_extlog.c +@@ -224,9 +224,9 @@ static int __init extlog_init(void) + u64 cap; + int rc; + +- rdmsrl(MSR_IA32_MCG_CAP, cap); +- +- if (!(cap & MCG_ELOG_P) || !extlog_get_l1addr()) ++ if (rdmsrl_safe(MSR_IA32_MCG_CAP, &cap) || ++ !(cap & MCG_ELOG_P) || ++ !extlog_get_l1addr()) + return -ENODEV; + + if (edac_get_report_status() == EDAC_REPORTING_FORCE) { diff --git a/patches.suse/ACPI-video-use-ACPI-backlight-for-HP-635-Notebook.patch b/patches.suse/ACPI-video-use-ACPI-backlight-for-HP-635-Notebook.patch new file mode 100644 index 0000000..10f475b --- /dev/null +++ b/patches.suse/ACPI-video-use-ACPI-backlight-for-HP-635-Notebook.patch @@ -0,0 +1,47 @@ +From b226faab4e7890bbbccdf794e8b94276414f9058 Mon Sep 17 00:00:00 2001 +From: Alex Hung +Date: Sun, 13 Sep 2020 16:34:03 -0600 +Subject: [PATCH] ACPI: video: use ACPI backlight for HP 635 Notebook +Git-commit: b226faab4e7890bbbccdf794e8b94276414f9058 +Patch-mainline: v5.10-rc1 +References: git-fixes + +The default backlight interface is AMD's radeon_bl0 which does not +work on this system, so use the ACPI backlight interface on it +instead. + +Buglink: https://bugs.launchpad.net/bugs/1894667 +Cc: All applicable +Signed-off-by: Alex Hung +[ rjw: Changelog edits ] + +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/acpi/video_detect.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c +index 2499d7e3c710..36b62e9c8b69 100644 +--- a/drivers/acpi/video_detect.c ++++ b/drivers/acpi/video_detect.c +@@ -282,6 +282,15 @@ static const struct dmi_system_id video_detect_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "530U4E/540U4E"), + }, + }, ++ /* https://bugs.launchpad.net/bugs/1894667 */ ++ { ++ .callback = video_detect_force_video, ++ .ident = "HP 635 Notebook", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP 635 Notebook PC"), ++ }, ++ }, + + /* Non win8 machines which need native backlight nevertheless */ + { +-- +2.16.4 + diff --git a/patches.suse/ALSA-hda-Fix-the-return-value-if-cb-func-is-already-.patch b/patches.suse/ALSA-hda-Fix-the-return-value-if-cb-func-is-already-.patch new file mode 100644 index 0000000..6421b6e --- /dev/null +++ b/patches.suse/ALSA-hda-Fix-the-return-value-if-cb-func-is-already-.patch @@ -0,0 +1,66 @@ +From 033e4040d453f1f7111e5957a54f3019eb089cc6 Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Thu, 22 Oct 2020 11:02:21 +0800 +Subject: [PATCH] ALSA: hda - Fix the return value if cb func is already registered +Git-commit: 033e4040d453f1f7111e5957a54f3019eb089cc6 +Patch-mainline: v5.10-rc1 +References: git-fixes + +If the cb function is already registered, should return the pointer +of the structure hda_jack_callback which contains this cb func, but +instead it returns the NULL. + +Now fix it by replacing func_is_already_in_callback_list() with +find_callback_from_list(). + +Fixes: f4794c6064a8 ("ALSA: hda - Don't register a cb func if it is registered already") +Reported-and-suggested-by: Dan Carpenter +Cc: +Signed-off-by: Hui Wang +Link: https://lore.kernel.org/r/20201022030221.22393-1-hui.wang@canonical.com +Signed-off-by: Takashi Iwai + +--- + sound/pci/hda/hda_jack.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +--- a/sound/pci/hda/hda_jack.c ++++ b/sound/pci/hda/hda_jack.c +@@ -235,16 +235,21 @@ int snd_hda_jack_detect_state(struct hda + } + EXPORT_SYMBOL_GPL(snd_hda_jack_detect_state); + +-static bool func_is_already_in_callback_list(struct hda_jack_tbl *jack, +- hda_jack_callback_fn func) ++static struct hda_jack_callback * ++find_callback_from_list(struct hda_jack_tbl *jack, ++ hda_jack_callback_fn func) + { + struct hda_jack_callback *cb; + ++ if (!func) ++ return NULL; ++ + for (cb = jack->callback; cb; cb = cb->next) { + if (cb->func == func) +- return true; ++ return cb; + } +- return false; ++ ++ return NULL; + } + + /** +@@ -268,7 +273,10 @@ snd_hda_jack_detect_enable_callback(stru + jack = snd_hda_jack_tbl_new(codec, nid); + if (!jack) + return ERR_PTR(-ENOMEM); +- if (func && !func_is_already_in_callback_list(jack, func)) { ++ ++ callback = find_callback_from_list(jack, func); ++ ++ if (func && !callback) { + callback = kzalloc(sizeof(*callback), GFP_KERNEL); + if (!callback) + return ERR_PTR(-ENOMEM); diff --git a/patches.suse/ALSA-hda-prevent-undefined-shift-in-snd_hdac_ext_bus.patch b/patches.suse/ALSA-hda-prevent-undefined-shift-in-snd_hdac_ext_bus.patch new file mode 100644 index 0000000..1721bee --- /dev/null +++ b/patches.suse/ALSA-hda-prevent-undefined-shift-in-snd_hdac_ext_bus.patch @@ -0,0 +1,31 @@ +From 158e1886b6262c1d1c96a18c85fac5219b8bf804 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 3 Nov 2020 13:18:07 +0300 +Subject: [PATCH] ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() +Git-commit: 158e1886b6262c1d1c96a18c85fac5219b8bf804 +Patch-mainline: v5.10-rc3 +References: git-fixes + +This is harmless, but the "addr" comes from the user and it could lead +to a negative shift or to shift wrapping if it's too high. + +Fixes: 0b00a5615dc4 ("ALSA: hdac_ext: add hdac extended controller") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20201103101807.GC1127762@mwanda +Signed-off-by: Takashi Iwai + +--- + sound/hda/ext/hdac_ext_controller.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/hda/ext/hdac_ext_controller.c ++++ b/sound/hda/ext/hdac_ext_controller.c +@@ -155,6 +155,8 @@ struct hdac_ext_link *snd_hdac_ext_bus_g + return NULL; + if (ebus->idx != bus_idx) + return NULL; ++ if (addr < 0 || addr > 31) ++ return NULL; + + list_for_each_entry(hlink, &ebus->hlink_list, list) { + for (i = 0; i < HDA_MAX_CODECS; i++) { diff --git a/patches.suse/USB-Add-NO_LPM-quirk-for-Kingston-flash-drive.patch b/patches.suse/USB-Add-NO_LPM-quirk-for-Kingston-flash-drive.patch new file mode 100644 index 0000000..0adbcc3 --- /dev/null +++ b/patches.suse/USB-Add-NO_LPM-quirk-for-Kingston-flash-drive.patch @@ -0,0 +1,44 @@ +From afaa2e745a246c5ab95103a65b1ed00101e1bc63 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Mon, 2 Nov 2020 09:58:21 -0500 +Subject: [PATCH] USB: Add NO_LPM quirk for Kingston flash drive +Git-commit: afaa2e745a246c5ab95103a65b1ed00101e1bc63 +Patch-mainline: v5.10-rc3 +References: git-fixes + +In Bugzilla #208257, Julien Humbert reports that a 32-GB Kingston +flash drive spontaneously disconnects and reconnects, over and over. +Testing revealed that disabling Link Power Management for the drive +fixed the problem. + +This patch adds a quirk entry for that drive to turn off LPM permanently. + +Cc: Hans de Goede +Cc: +Reported-and-tested-by: Julien Humbert +Signed-off-by: Alan Stern +Link: https://lore.kernel.org/r/20201102145821.GA1478741@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 10574fa3f927..a1e3a037a289 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -378,6 +378,9 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x0926, 0x3333), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, + ++ /* Kingston DataTraveler 3.0 */ ++ { USB_DEVICE(0x0951, 0x1666), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */ + { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF }, + +-- +2.16.4 + diff --git a/patches.suse/USB-adutux-fix-debugging.patch b/patches.suse/USB-adutux-fix-debugging.patch new file mode 100644 index 0000000..8f3f338 --- /dev/null +++ b/patches.suse/USB-adutux-fix-debugging.patch @@ -0,0 +1,35 @@ +From c56150c1bc8da5524831b1dac2eec3c67b89f587 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 17 Sep 2020 13:26:00 +0200 +Subject: [PATCH] USB: adutux: fix debugging +Git-commit: c56150c1bc8da5524831b1dac2eec3c67b89f587 +Patch-mainline: v5.10-rc1 +References: git-fixes + +Handling for removal of the controller was missing at one place. +Add it. + +Signed-off-by: Oliver Neukum +Link: https://lore.kernel.org/r/20200917112600.26508-1-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/misc/adutux.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c +index a7eefe11f31a..45a387979935 100644 +--- a/drivers/usb/misc/adutux.c ++++ b/drivers/usb/misc/adutux.c +@@ -209,6 +209,7 @@ static void adu_interrupt_out_callback(struct urb *urb) + + if (status != 0) { + if ((status != -ENOENT) && ++ (status != -ESHUTDOWN) && + (status != -ECONNRESET)) { + dev_dbg(&dev->udev->dev, + "%s :nonzero status received: %d\n", __func__, +-- +2.16.4 + diff --git a/patches.suse/USB-gadget-f_ncm-Fix-NDP16-datagram-validation.patch b/patches.suse/USB-gadget-f_ncm-Fix-NDP16-datagram-validation.patch index 8958ab0..403646e 100644 --- a/patches.suse/USB-gadget-f_ncm-Fix-NDP16-datagram-validation.patch +++ b/patches.suse/USB-gadget-f_ncm-Fix-NDP16-datagram-validation.patch @@ -2,8 +2,8 @@ From 2b405533c2560d7878199c57d95a39151351df72 Mon Sep 17 00:00:00 2001 From: Bryan O'Donoghue Date: Sun, 20 Sep 2020 18:01:58 +0100 Subject: [PATCH] USB: gadget: f_ncm: Fix NDP16 datagram validation -Git-commit: 2b405533c2560d7878199c57d95a39151351df72 -Patch-mainline: v5.9-rc8 +Git-commit: 028296e480c782f13428f234a8239a0cd007bd92 +Patch-mainline: v5.10-rc1 References: git-fixes commit 2b74b0a04d3e ("USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb()") diff --git a/patches.suse/USB-serial-option-add-LE910Cx-compositions-0x1203-0x.patch b/patches.suse/USB-serial-option-add-LE910Cx-compositions-0x1203-0x.patch new file mode 100644 index 0000000..2b02cef --- /dev/null +++ b/patches.suse/USB-serial-option-add-LE910Cx-compositions-0x1203-0x.patch @@ -0,0 +1,53 @@ +From 489979b4aab490b6b917c11dc02d81b4b742784a Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Sat, 31 Oct 2020 23:54:58 +0100 +Subject: [PATCH] USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231 +Git-commit: 489979b4aab490b6b917c11dc02d81b4b742784a +Patch-mainline: v5.10-rc3 +References: git-fixes + +Add following Telit LE910Cx compositions: + +0x1203: rndis, tty, adb, tty, tty, tty, tty +0x1230: tty, adb, rmnet, audio, tty, tty, tty, tty +0x1231: rndis, tty, adb, audio, tty, tty, tty, tty + +Signed-off-by: Daniele Palmas +Link: https://lore.kernel.org/r/20201031225458.10512-1-dnlplm@gmail.com +[ johan: add comments after entries ] + +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Acked-by: Takashi Iwai + +--- + drivers/usb/serial/option.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 7e879233bc0e..284d086db7a2 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1203,6 +1203,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = NCTRL(0) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1203, 0xff), /* Telit LE910Cx (RNDIS) */ ++ .driver_info = NCTRL(2) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), +@@ -1217,6 +1219,10 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1230, 0xff), /* Telit LE910Cx (rmnet) */ ++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1231, 0xff), /* Telit LE910Cx (RNDIS) */ ++ .driver_info = NCTRL(2) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, 0x1260), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, + { USB_DEVICE(TELIT_VENDOR_ID, 0x1261), +-- +2.16.4 + diff --git a/patches.suse/USB-serial-option-add-Quectel-EC200T-module-support.patch b/patches.suse/USB-serial-option-add-Quectel-EC200T-module-support.patch new file mode 100644 index 0000000..5a5347b --- /dev/null +++ b/patches.suse/USB-serial-option-add-Quectel-EC200T-module-support.patch @@ -0,0 +1,43 @@ +From a46b973bced1ba57420752bf38426acd9f6cbfa6 Mon Sep 17 00:00:00 2001 +From: Ziyi Cao +Date: Tue, 20 Oct 2020 00:08:06 +0800 +Subject: [PATCH] USB: serial: option: add Quectel EC200T module support +Git-commit: a46b973bced1ba57420752bf38426acd9f6cbfa6 +Patch-mainline: v5.10-rc3 +References: git-fixes + +Add usb product id of the Quectel EC200T module. + +Signed-off-by: Ziyi Cao +Link: https://lore.kernel.org/r/17f8a2a3-ce0f-4be7-8544-8fdf286907d0@www.fastmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Acked-by: Takashi Iwai + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 2a3bfd6f867e..7e879233bc0e 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -250,6 +250,7 @@ static void option_instat_callback(struct urb *urb); + #define QUECTEL_PRODUCT_EP06 0x0306 + #define QUECTEL_PRODUCT_EM12 0x0512 + #define QUECTEL_PRODUCT_RM500Q 0x0800 ++#define QUECTEL_PRODUCT_EC200T 0x6026 + + #define CMOTECH_VENDOR_ID 0x16d8 + #define CMOTECH_PRODUCT_6001 0x6001 +@@ -1117,6 +1118,7 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10), + .driver_info = ZLP }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) }, + + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) }, +-- +2.16.4 + diff --git a/patches.suse/USB-serial-option-add-Telit-FN980-composition-0x1055.patch b/patches.suse/USB-serial-option-add-Telit-FN980-composition-0x1055.patch new file mode 100644 index 0000000..d3745cd --- /dev/null +++ b/patches.suse/USB-serial-option-add-Telit-FN980-composition-0x1055.patch @@ -0,0 +1,33 @@ +From db0362eeb22992502764e825c79b922d7467e0eb Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Tue, 3 Nov 2020 13:44:25 +0100 +Subject: [PATCH] USB: serial: option: add Telit FN980 composition 0x1055 +Git-commit: db0362eeb22992502764e825c79b922d7467e0eb +Patch-mainline: v5.10-rc3 +References: git-fixes + +Add the following Telit FN980 composition: + +0x1055: tty, adb, tty, tty, tty, tty + +Signed-off-by: Daniele Palmas +Link: https://lore.kernel.org/r/20201103124425.12940-1-dnlplm@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Acked-by: Takashi Iwai + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1191,6 +1191,8 @@ static const struct usb_device_id option + .driver_info = NCTRL(2) | RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1053, 0xff), /* Telit FN980 (ECM) */ + .driver_info = NCTRL(0) | RSVD(1) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1055, 0xff), /* Telit FN980 (PCIe) */ ++ .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), diff --git a/patches.suse/acpi-cpufreq-Honor-_PSD-table-setting-on-new-AMD-CPU.patch b/patches.suse/acpi-cpufreq-Honor-_PSD-table-setting-on-new-AMD-CPU.patch new file mode 100644 index 0000000..cd5e02f --- /dev/null +++ b/patches.suse/acpi-cpufreq-Honor-_PSD-table-setting-on-new-AMD-CPU.patch @@ -0,0 +1,42 @@ +From 5368512abe08a28525d9b24abbfc2a72493e8dba Mon Sep 17 00:00:00 2001 +From: Wei Huang +Date: Sun, 18 Oct 2020 22:57:41 -0500 +Subject: [PATCH] acpi-cpufreq: Honor _PSD table setting on new AMD CPUs +Git-commit: 5368512abe08a28525d9b24abbfc2a72493e8dba +Patch-mainline: v5.10-rc1 +References: git-fixes + +acpi-cpufreq has a old quirk that overrides the _PSD table supplied by +BIOS on AMD CPUs. However the _PSD table of new AMD CPUs (Family 19h+) +now accurately reports the P-state dependency of CPU cores. Hence this +quirk needs to be fixed in order to support new CPUs' frequency control. + +Fixes: acd316248205 ("acpi-cpufreq: Add quirk to disable _PSD usage on all AMD CPUs") +Signed-off-by: Wei Huang +[ rjw: Subject edit ] + +Cc: 3.10+ # 3.10+ +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/cpufreq/acpi-cpufreq.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c +index e4ff681faaaa..1e4fbb002a31 100644 +--- a/drivers/cpufreq/acpi-cpufreq.c ++++ b/drivers/cpufreq/acpi-cpufreq.c +@@ -691,7 +691,8 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy) + cpumask_copy(policy->cpus, topology_core_cpumask(cpu)); + } + +- if (check_amd_hwpstate_cpu(cpu) && !acpi_pstate_strict) { ++ if (check_amd_hwpstate_cpu(cpu) && boot_cpu_data.x86 < 0x19 && ++ !acpi_pstate_strict) { + cpumask_clear(policy->cpus); + cpumask_set_cpu(cpu, policy->cpus); + cpumask_copy(data->freqdomain_cpus, +-- +2.16.4 + diff --git a/patches.suse/arm64-Run-ARCH_WORKAROUND_1-enabling-code-on-all-CPU.patch b/patches.suse/arm64-Run-ARCH_WORKAROUND_1-enabling-code-on-all-CPU.patch new file mode 100644 index 0000000..3f8ed25 --- /dev/null +++ b/patches.suse/arm64-Run-ARCH_WORKAROUND_1-enabling-code-on-all-CPU.patch @@ -0,0 +1,60 @@ +From 25fc42b6b09d0f4626f8766e29d32e95186d4414 Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Thu, 16 Jul 2020 17:11:09 +0100 +Subject: [PATCH 5/6] arm64: Run ARCH_WORKAROUND_1 enabling code on all CPUs +Git-commit: 18fce56134c987e5b4eceddafdbe4b00c07e2ae1 +Patch-mainline: v5.10-rc1 +References: git-fixes + +Commit 73f381660959 ("arm64: Advertise mitigation of Spectre-v2, or lack +thereof") changed the way we deal with ARCH_WORKAROUND_1, by moving most +of the enabling code to the .matches() callback. + +This has the unfortunate effect that the workaround gets only enabled on +the first affected CPU, and no other. + +In order to address this, forcefully call the .matches() callback from a +.cpu_enable() callback, which brings us back to the original behaviour. + +Fixes: 73f381660959 ("arm64: Advertise mitigation of Spectre-v2, or lack thereof") +Cc: +Reviewed-by: Suzuki K Poulose +Signed-off-by: Marc Zyngier +Signed-off-by: Will Deacon +Acked-by: Denis Kirjanov +--- + arch/arm64/kernel/cpu_errata.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c +index 8d2562f16e7f..858880c86c50 100644 +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@ -646,6 +646,12 @@ check_branch_predictor(const struct arm64_cpu_capabilities *entry, int scope) + return (need_wa > 0); + } + ++static void ++cpu_enable_branch_predictor_hardening(const struct arm64_cpu_capabilities *cap) ++{ ++ cap->matches(cap, SCOPE_LOCAL_CPU); ++} ++ + #ifdef CONFIG_CAVIUM_ERRATUM_27456 + const struct midr_range cavium_erratum_27456_cpus[] = { + /* Cavium ThunderX, T88 pass 1.x - 2.1 */ +@@ -797,9 +803,11 @@ const struct arm64_cpu_capabilities arm64_errata[] = { + }, + #endif + { ++ .desc = "Branch predictor hardening", + .capability = ARM64_HARDEN_BRANCH_PREDICTOR, + .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM, + .matches = check_branch_predictor, ++ .cpu_enable = cpu_enable_branch_predictor_hardening, + }, + { + .desc = "Speculative Store Bypass Disable", +-- +2.16.4 + diff --git a/patches.suse/ata-sata_rcar-Fix-DMA-boundary-mask.patch b/patches.suse/ata-sata_rcar-Fix-DMA-boundary-mask.patch new file mode 100644 index 0000000..5bbbe41 --- /dev/null +++ b/patches.suse/ata-sata_rcar-Fix-DMA-boundary-mask.patch @@ -0,0 +1,74 @@ +From df9c590986fdb6db9d5636d6cd93bc919c01b451 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Thu, 17 Sep 2020 15:09:20 +0200 +Subject: [PATCH] ata: sata_rcar: Fix DMA boundary mask +Git-commit: df9c590986fdb6db9d5636d6cd93bc919c01b451 +Patch-mainline: v5.10-rc1 +References: git-fixes + +Before commit 9495b7e92f716ab2 ("driver core: platform: Initialize +dma_parms for platform devices"), the R-Car SATA device didn't have DMA +parameters. Hence the DMA boundary mask supplied by its driver was +silently ignored, as __scsi_init_queue() doesn't check the return value +of dma_set_seg_boundary(), and the default value of 0xffffffff was used. + +Now the device has gained DMA parameters, the driver-supplied value is +used, and the following warning is printed on Salvator-XS: + + DMA-API: sata_rcar ee300000.sata: mapping sg segment across boundary [start=0x00000000ffffe000] [end=0x00000000ffffefff] [boundary=0x000000001ffffffe] + WARNING: CPU: 5 PID: 38 at kernel/dma/debug.c:1233 debug_dma_map_sg+0x298/0x300 + +(the range of start/end values depend on whether IOMMU support is + enabled or not) + +The issue here is that SATA_RCAR_DMA_BOUNDARY doesn't have bit 0 set, so +any typical end value, which is odd, will trigger the check. + +Fix this by increasing the DMA boundary value by 1. + +This also fixes the following WRITE DMA EXT timeout issue: + + # dd if=/dev/urandom of=/mnt/de1/file1-1024M bs=1M count=1024 + ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x6 frozen + ata1.00: failed command: WRITE DMA EXT + ata1.00: cmd 35/00:00:00:e6:0c/00:0a:00:00:00/e0 tag 0 dma 1310720 out + res 40/00:01:00:00:00/00:00:00:00:00/00 Emask 0x4 (timeout) + ata1.00: status: { DRDY } + +as seen by Shimoda-san since commit 429120f3df2dba2b ("block: fix +splitting segments on boundary masks"). + +Fixes: 8bfbeed58665dbbf ("sata_rcar: correct 'sata_rcar_sht'") +Fixes: 9495b7e92f716ab2 ("driver core: platform: Initialize dma_parms for platform devices") +Fixes: 429120f3df2dba2b ("block: fix splitting segments on boundary masks") +Signed-off-by: Geert Uytterhoeven +Tested-by: Lad Prabhakar +Tested-by: Yoshihiro Shimoda +Reviewed-by: Christoph Hellwig +Reviewed-by: Greg Kroah-Hartman +Reviewed-by: Sergei Shtylyov +Reviewed-by: Ulf Hansson +Cc: stable +Signed-off-by: Jens Axboe +Acked-by: Takashi Iwai + +--- + drivers/ata/sata_rcar.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c +index 141ac600b64c..44b0ed8f6bb8 100644 +--- a/drivers/ata/sata_rcar.c ++++ b/drivers/ata/sata_rcar.c +@@ -120,7 +120,7 @@ + /* Descriptor table word 0 bit (when DTA32M = 1) */ + #define SATA_RCAR_DTEND BIT(0) + +-#define SATA_RCAR_DMA_BOUNDARY 0x1FFFFFFEUL ++#define SATA_RCAR_DMA_BOUNDARY 0x1FFFFFFFUL + + /* Gen2 Physical Layer Control Registers */ + #define RCAR_GEN2_PHY_CTL1_REG 0x1704 +-- +2.16.4 + diff --git a/patches.suse/ath10k-fix-VHT-NSS-calculation-when-STBC-is-enabled.patch b/patches.suse/ath10k-fix-VHT-NSS-calculation-when-STBC-is-enabled.patch new file mode 100644 index 0000000..a4674af --- /dev/null +++ b/patches.suse/ath10k-fix-VHT-NSS-calculation-when-STBC-is-enabled.patch @@ -0,0 +1,58 @@ +From 99f41b8e43b8b4b31262adb8ac3e69088fff1289 Mon Sep 17 00:00:00 2001 +From: Sathishkumar Muruganandam +Date: Fri, 14 Aug 2020 13:46:11 +0530 +Subject: [PATCH] ath10k: fix VHT NSS calculation when STBC is enabled +Git-commit: 99f41b8e43b8b4b31262adb8ac3e69088fff1289 +Patch-mainline: v5.10-rc1 +References: git-fixes + +When STBC is enabled, NSTS_SU value need to be accounted for VHT NSS +calculation for SU case. + +Without this fix, 1SS + STBC enabled case was reported wrongly as 2SS +in radiotap header on monitor mode capture. + +Tested-on: QCA9984 10.4-3.10-00047 + +Signed-off-by: Sathishkumar Muruganandam +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1597392971-3897-1-git-send-email-murugana@codeaurora.org +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/ath/ath10k/htt_rx.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c +index 136cbf001c5b..5c1af2021883 100644 +--- a/drivers/net/wireless/ath/ath10k/htt_rx.c ++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c +@@ -949,6 +949,7 @@ static void ath10k_htt_rx_h_rates(struct ath10k *ar, + u8 preamble = 0; + u8 group_id; + u32 info1, info2, info3; ++ u32 stbc, nsts_su; + + info1 = __le32_to_cpu(rxd->ppdu_start.info1); + info2 = __le32_to_cpu(rxd->ppdu_start.info2); +@@ -993,11 +994,16 @@ static void ath10k_htt_rx_h_rates(struct ath10k *ar, + */ + bw = info2 & 3; + sgi = info3 & 1; ++ stbc = (info2 >> 3) & 1; + group_id = (info2 >> 4) & 0x3F; + + if (GROUP_ID_IS_SU_MIMO(group_id)) { + mcs = (info3 >> 4) & 0x0F; +- nss = ((info2 >> 10) & 0x07) + 1; ++ nsts_su = ((info2 >> 10) & 0x07); ++ if (stbc) ++ nss = (nsts_su >> 2) + 1; ++ else ++ nss = (nsts_su + 1); + } else { + /* Hardware doesn't decode VHT-SIG-B into Rx descriptor + * so it's impossible to decode MCS. Also since +-- +2.16.4 + diff --git a/patches.suse/ath10k-start-recovery-process-when-payload-length-ex.patch b/patches.suse/ath10k-start-recovery-process-when-payload-length-ex.patch new file mode 100644 index 0000000..a4f80a2 --- /dev/null +++ b/patches.suse/ath10k-start-recovery-process-when-payload-length-ex.patch @@ -0,0 +1,84 @@ +From 2fd3c8f34d08af0a6236085f9961866ad92ef9ec Mon Sep 17 00:00:00 2001 +From: Wen Gong +Date: Fri, 14 Aug 2020 18:17:08 +0300 +Subject: [PATCH] ath10k: start recovery process when payload length exceeds max htc length for sdio +Git-commit: 2fd3c8f34d08af0a6236085f9961866ad92ef9ec +Patch-mainline: v5.10-rc1 +References: git-fixes + +When simulate random transfer fail for sdio write and read, it happened +"payload length exceeds max htc length" and recovery later sometimes. + +Test steps: +1. Add config and update kernel: +CONFIG_FAIL_MMC_REQUEST=y +CONFIG_FAULT_INJECTION=y +CONFIG_FAULT_INJECTION_DEBUG_FS=y + +2. Run simulate fail: +cd /sys/kernel/debug/mmc1/fail_mmc_request +echo 10 > probability +echo 10 > times # repeat until hitting issues + +3. It happened payload length exceeds max htc length. +[ 199.935506] ath10k_sdio mmc1:0001:1: payload length 57005 exceeds max htc length: 4088 +.... +[ 264.990191] ath10k_sdio mmc1:0001:1: payload length 57005 exceeds max htc length: 4088 + +4. after some time, such as 60 seconds, it start recovery which triggered +by wmi command timeout for periodic scan. +[ 269.229232] ieee80211 phy0: Hardware restart was requested +[ 269.734693] ath10k_sdio mmc1:0001:1: device successfully recovered + +The simulate fail of sdio is not a real sdio transter fail, it only +set an error status in mmc_should_fail_request after the transfer end, +actually the transfer is success, then sdio_io_rw_ext_helper will +return error status and stop transfer the left data. For example, +the really RX len is 286 bytes, then it will split to 2 blocks in +sdio_io_rw_ext_helper, one is 256 bytes, left is 30 bytes, if the +first 256 bytes get an error status by mmc_should_fail_request,then +the left 30 bytes will not read in this RX operation. Then when the +next RX arrive, the left 30 bytes will be considered as the header +of the read, the top 4 bytes of the 30 bytes will be considered as +lookaheads, but actually the 4 bytes is not the lookaheads, so the len +from this lookaheads is not correct, it exceeds max htc length 4088 +sometimes. When happened exceeds, the buffer chain is not matched between +firmware and ath10k, then it need to start recovery ASAP. Recently then +recovery will be started by wmi command timeout, but it will be long time +later, for example, it is 60+ seconds later from the periodic scan, if +it does not have periodic scan, it will be longer. + +Start recovery when it happened "payload length exceeds max htc length" +will be reasonable. + +This patch only effect sdio chips. + +Tested with QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00029. + +Signed-off-by: Wen Gong +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200108031957.22308-3-wgong@codeaurora.org +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/ath/ath10k/sdio.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c +index 63f882c690bf..0841e69b10b1 100644 +--- a/drivers/net/wireless/ath/ath10k/sdio.c ++++ b/drivers/net/wireless/ath/ath10k/sdio.c +@@ -557,6 +557,10 @@ static int ath10k_sdio_mbox_rx_alloc(struct ath10k *ar, + le16_to_cpu(htc_hdr->len), + ATH10K_HTC_MBOX_MAX_PAYLOAD_LENGTH); + ret = -ENOMEM; ++ ++ queue_work(ar->workqueue, &ar->restart_work); ++ ath10k_warn(ar, "exceeds length, start recovery\n"); ++ + goto err; + } + +-- +2.16.4 + diff --git a/patches.suse/bus-fsl_mc-Do-not-rely-on-caller-to-provide-non-NULL.patch b/patches.suse/bus-fsl_mc-Do-not-rely-on-caller-to-provide-non-NULL.patch new file mode 100644 index 0000000..1478968 --- /dev/null +++ b/patches.suse/bus-fsl_mc-Do-not-rely-on-caller-to-provide-non-NULL.patch @@ -0,0 +1,43 @@ +From 5026cf605143e764e1785bbf9158559d17f8d260 Mon Sep 17 00:00:00 2001 +From: Diana Craciun +Date: Tue, 29 Sep 2020 11:54:38 +0300 +Subject: [PATCH] bus/fsl_mc: Do not rely on caller to provide non NULL mc_io +Git-commit: 5026cf605143e764e1785bbf9158559d17f8d260 +Patch-mainline: v5.10-rc1 +References: git-fixes + +Before destroying the mc_io, check first that it was +allocated. + +Reviewed-by: Laurentiu Tudor +Acked-by: Laurentiu Tudor +Signed-off-by: Diana Craciun +Link: https://lore.kernel.org/r/20200929085441.17448-11-diana.craciun@oss.nxp.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/bus/fsl-mc/mc-io.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/bus/fsl-mc/mc-io.c b/drivers/bus/fsl-mc/mc-io.c +index a30b53f1d87d..305015486b91 100644 +--- a/drivers/bus/fsl-mc/mc-io.c ++++ b/drivers/bus/fsl-mc/mc-io.c +@@ -129,7 +129,12 @@ int __must_check fsl_create_mc_io(struct device *dev, + */ + void fsl_destroy_mc_io(struct fsl_mc_io *mc_io) + { +- struct fsl_mc_device *dpmcp_dev = mc_io->dpmcp_dev; ++ struct fsl_mc_device *dpmcp_dev; ++ ++ if (!mc_io) ++ return; ++ ++ dpmcp_dev = mc_io->dpmcp_dev; + + if (dpmcp_dev) + fsl_mc_io_unset_dpmcp(mc_io); +-- +2.16.4 + diff --git a/patches.suse/can-can_create_echo_skb-fix-echo-skb-generation-alwa.patch b/patches.suse/can-can_create_echo_skb-fix-echo-skb-generation-alwa.patch new file mode 100644 index 0000000..2305fec --- /dev/null +++ b/patches.suse/can-can_create_echo_skb-fix-echo-skb-generation-alwa.patch @@ -0,0 +1,98 @@ +From 286228d382ba6320f04fa2e7c6fc8d4d92e428f4 Mon Sep 17 00:00:00 2001 +From: Oleksij Rempel +Date: Wed, 18 Dec 2019 09:39:02 +0100 +Subject: [PATCH] can: can_create_echo_skb(): fix echo skb generation: always use skb_clone() +Git-commit: 286228d382ba6320f04fa2e7c6fc8d4d92e428f4 +Patch-mainline: v5.10-rc3 +References: git-fixes + +All user space generated SKBs are owned by a socket (unless injected into the +key via AF_PACKET). If a socket is closed, all associated skbs will be cleaned +up. + +This leads to a problem when a CAN driver calls can_put_echo_skb() on a +unshared SKB. If the socket is closed prior to the TX complete handler, +can_get_echo_skb() and the subsequent delivering of the echo SKB to all +registered callbacks, a SKB with a refcount of 0 is delivered. + +To avoid the problem, in can_get_echo_skb() the original SKB is now always +cloned, regardless of shared SKB or not. If the process exists it can now +safely discard its SKBs, without disturbing the delivery of the echo SKB. + +The problem shows up in the j1939 stack, when it clones the incoming skb, which +detects the already 0 refcount. + +We can easily reproduce this with following example: + +testj1939 -B -r can0: & +cansend can0 1823ff40#0123 + +Warning: CPU: 0 PID: 293 at lib/refcount.c:25 refcount_warn_saturate+0x108/0x174 +Refcount_t: addition on 0; use-after-free. +Modules linked in: coda_vpu imx_vdoa videobuf2_vmalloc dw_hdmi_ahb_audio vcan +Cpu: 0 PID: 293 Comm: cansend Not tainted 5.5.0-rc6-00376-g9e20dcb7040d #1 +Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) +Backtrace: +[] (dump_backtrace) from [] (show_stack+0x20/0x24) +[] (show_stack) from [] (dump_stack+0x8c/0xa0) +[] (dump_stack) from [] (__warn+0xe0/0x108) +[] (__warn) from [] (warn_slowpath_fmt+0xa8/0xcc) +[] (warn_slowpath_fmt) from [] (refcount_warn_saturate+0x108/0x174) +[] (refcount_warn_saturate) from [] (j1939_can_recv+0x20c/0x210) +[] (j1939_can_recv) from [] (can_rcv_filter+0xb4/0x268) +[] (can_rcv_filter) from [] (can_receive+0xb0/0xe4) +[] (can_receive) from [] (can_rcv+0x48/0x98) +[] (can_rcv) from [] (__netif_receive_skb_one_core+0x64/0x88) +[] (__netif_receive_skb_one_core) from [] (__netif_receive_skb+0x38/0x94) +[] (__netif_receive_skb) from [] (netif_receive_skb_internal+0x64/0xf8) +[] (netif_receive_skb_internal) from [] (netif_receive_skb+0x34/0x19c) +[] (netif_receive_skb) from [] (can_rx_offload_napi_poll+0x58/0xb4) + +Fixes: 0ae89beb283a ("can: add destructor for self generated skbs") +Signed-off-by: Oleksij Rempel +Link: http://lore.kernel.org/r/20200124132656.22156-1-o.rempel@pengutronix.de +Acked-by: Oliver Hartkopp +Signed-off-by: Marc Kleine-Budde +Acked-by: Takashi Iwai + +--- + include/linux/can/skb.h | 20 ++++++++------------ + 1 file changed, 8 insertions(+), 12 deletions(-) + +diff --git a/include/linux/can/skb.h b/include/linux/can/skb.h +index 900b9f4e0605..fc61cf4eff1c 100644 +--- a/include/linux/can/skb.h ++++ b/include/linux/can/skb.h +@@ -61,21 +61,17 @@ static inline void can_skb_set_owner(struct sk_buff *skb, struct sock *sk) + */ + static inline struct sk_buff *can_create_echo_skb(struct sk_buff *skb) + { +- if (skb_shared(skb)) { +- struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC); ++ struct sk_buff *nskb; + +- if (likely(nskb)) { +- can_skb_set_owner(nskb, skb->sk); +- consume_skb(skb); +- return nskb; +- } else { +- kfree_skb(skb); +- return NULL; +- } ++ nskb = skb_clone(skb, GFP_ATOMIC); ++ if (unlikely(!nskb)) { ++ kfree_skb(skb); ++ return NULL; + } + +- /* we can assume to have an unshared skb with proper owner */ +- return skb; ++ can_skb_set_owner(nskb, skb->sk); ++ consume_skb(skb); ++ return nskb; + } + + #endif /* !_CAN_SKB_H */ +-- +2.16.4 + diff --git a/patches.suse/can-dev-__can_get_echo_skb-fix-real-payload-length-r.patch b/patches.suse/can-dev-__can_get_echo_skb-fix-real-payload-length-r.patch new file mode 100644 index 0000000..7c8f345 --- /dev/null +++ b/patches.suse/can-dev-__can_get_echo_skb-fix-real-payload-length-r.patch @@ -0,0 +1,48 @@ +From ed3320cec279407a86bc4c72edc4a39eb49165ec Mon Sep 17 00:00:00 2001 +From: Oliver Hartkopp +Date: Tue, 20 Oct 2020 08:44:43 +0200 +Subject: [PATCH] can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames +Git-commit: ed3320cec279407a86bc4c72edc4a39eb49165ec +Patch-mainline: v5.10-rc3 +References: git-fixes + +The can_get_echo_skb() function returns the number of received bytes to +be used for netdev statistics. In the case of RTR frames we get a valid +(potential non-zero) data length value which has to be passed for further +operations. But on the wire RTR frames have no payload length. Therefore +the value to be used in the statistics has to be zero for RTR frames. + +Reported-by: Vincent Mailhol +Signed-off-by: Oliver Hartkopp +Link: https://lore.kernel.org/r/20201020064443.80164-1-socketcan@hartkopp.net +Fixes: cf5046b309b3 ("can: dev: let can_get_echo_skb() return dlc of CAN frame") +Signed-off-by: Marc Kleine-Budde +Acked-by: Takashi Iwai + +--- + drivers/net/can/dev.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c +index 73cfcd7e9517..6dee4f8f2024 100644 +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -512,9 +512,13 @@ __can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr) + */ + struct sk_buff *skb = priv->echo_skb[idx]; + struct canfd_frame *cf = (struct canfd_frame *)skb->data; +- u8 len = cf->len; + +- *len_ptr = len; ++ /* get the real payload length for netdev statistics */ ++ if (cf->can_id & CAN_RTR_FLAG) ++ *len_ptr = 0; ++ else ++ *len_ptr = cf->len; ++ + priv->echo_skb[idx] = NULL; + + return skb; +-- +2.16.4 + diff --git a/patches.suse/can-dev-can_get_echo_skb-prevent-call-to-kfree_skb-i.patch b/patches.suse/can-dev-can_get_echo_skb-prevent-call-to-kfree_skb-i.patch new file mode 100644 index 0000000..dc9049a --- /dev/null +++ b/patches.suse/can-dev-can_get_echo_skb-prevent-call-to-kfree_skb-i.patch @@ -0,0 +1,66 @@ +From 2283f79b22684d2812e5c76fc2280aae00390365 Mon Sep 17 00:00:00 2001 +From: Vincent Mailhol +Date: Sat, 3 Oct 2020 00:41:45 +0900 +Subject: [PATCH] can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context +Git-commit: 2283f79b22684d2812e5c76fc2280aae00390365 +Patch-mainline: v5.10-rc3 +References: git-fixes + +If a driver calls can_get_echo_skb() during a hardware IRQ (which is often, but +not always, the case), the 'WARN_ON(in_irq)' in +net/core/skbuff.c#skb_release_head_state() might be triggered, under network +congestion circumstances, together with the potential risk of a NULL pointer +dereference. + +The root cause of this issue is the call to kfree_skb() instead of +dev_kfree_skb_irq() in net/core/dev.c#enqueue_to_backlog(). + +This patch prevents the skb to be freed within the call to netif_rx() by +incrementing its reference count with skb_get(). The skb is finally freed by +one of the in-irq-context safe functions: dev_consume_skb_any() or +dev_kfree_skb_any(). The "any" version is used because some drivers might call +can_get_echo_skb() in a normal context. + +The reason for this issue to occur is that initially, in the core network +stack, loopback skb were not supposed to be received in hardware IRQ context. +The CAN stack is an exeption. + +This bug was previously reported back in 2017 in [1] but the proposed patch +never got accepted. + +While [1] directly modifies net/core/dev.c, we try to propose here a +smoother modification local to CAN network stack (the assumption +behind is that only CAN devices are affected by this issue). + +[1] http://lore.kernel.org/r/57a3ffb6-3309-3ad5-5a34-e93c3fe3614d@cetitec.com + +Signed-off-by: Vincent Mailhol +Link: https://lore.kernel.org/r/20201002154219.4887-2-mailhol.vincent@wanadoo.fr +Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface") +Signed-off-by: Marc Kleine-Budde +Acked-by: Takashi Iwai + +--- + drivers/net/can/dev.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c +index b70ded3760f2..73cfcd7e9517 100644 +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -538,7 +538,11 @@ unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx) + if (!skb) + return 0; + +- netif_rx(skb); ++ skb_get(skb); ++ if (netif_rx(skb) == NET_RX_SUCCESS) ++ dev_consume_skb_any(skb); ++ else ++ dev_kfree_skb_any(skb); + + return len; + } +-- +2.16.4 + diff --git a/patches.suse/can-peak_canfd-pucan_handle_can_rx-fix-echo-manageme.patch b/patches.suse/can-peak_canfd-pucan_handle_can_rx-fix-echo-manageme.patch new file mode 100644 index 0000000..239f77d --- /dev/null +++ b/patches.suse/can-peak_canfd-pucan_handle_can_rx-fix-echo-manageme.patch @@ -0,0 +1,64 @@ +From 93ef65e5a6357cc7381f85fcec9283fe29970045 Mon Sep 17 00:00:00 2001 +From: Stephane Grosjean +Date: Tue, 13 Oct 2020 17:39:47 +0200 +Subject: [PATCH] can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is on +Git-commit: 93ef65e5a6357cc7381f85fcec9283fe29970045 +Patch-mainline: v5.10-rc3 +References: git-fixes + +Echo management is driven by PUCAN_MSG_LOOPED_BACK bit, while loopback +frames are identified with PUCAN_MSG_SELF_RECEIVE bit. Those bits are set +for each outgoing frame written to the IP core so that a copy of each one +will be placed into the rx path. Thus, + +- when PUCAN_MSG_LOOPED_BACK is set then the rx frame is an echo of a + previously sent frame, +- when PUCAN_MSG_LOOPED_BACK+PUCAN_MSG_SELF_RECEIVE are set, then the rx + frame is an echo AND a loopback frame. Therefore, this frame must be + put into the socket rx path too. + +This patch fixes how CAN frames are handled when these are sent while the +can interface is configured in "loopback on" mode. + +Signed-off-by: Stephane Grosjean +Link: https://lore.kernel.org/r/20201013153947.28012-1-s.grosjean@peak-system.com +Fixes: 8ac8321e4a79 ("can: peak: add support for PEAK PCAN-PCIe FD CAN-FD boards") +Signed-off-by: Marc Kleine-Budde +Acked-by: Takashi Iwai + +--- + drivers/net/can/peak_canfd/peak_canfd.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/can/peak_canfd/peak_canfd.c b/drivers/net/can/peak_canfd/peak_canfd.c +index 10aa3e457c33..40c33b8a5fda 100644 +--- a/drivers/net/can/peak_canfd/peak_canfd.c ++++ b/drivers/net/can/peak_canfd/peak_canfd.c +@@ -262,8 +262,7 @@ static int pucan_handle_can_rx(struct peak_canfd_priv *priv, + cf_len = get_can_dlc(pucan_msg_get_dlc(msg)); + + /* if this frame is an echo, */ +- if ((rx_msg_flags & PUCAN_MSG_LOOPED_BACK) && +- !(rx_msg_flags & PUCAN_MSG_SELF_RECEIVE)) { ++ if (rx_msg_flags & PUCAN_MSG_LOOPED_BACK) { + unsigned long flags; + + spin_lock_irqsave(&priv->echo_lock, flags); +@@ -277,7 +276,13 @@ static int pucan_handle_can_rx(struct peak_canfd_priv *priv, + netif_wake_queue(priv->ndev); + + spin_unlock_irqrestore(&priv->echo_lock, flags); +- return 0; ++ ++ /* if this frame is only an echo, stop here. Otherwise, ++ * continue to push this application self-received frame into ++ * its own rx queue. ++ */ ++ if (!(rx_msg_flags & PUCAN_MSG_SELF_RECEIVE)) ++ return 0; + } + + /* otherwise, it should be pushed into rx fifo */ +-- +2.16.4 + diff --git a/patches.suse/can-peak_usb-add-range-checking-in-decode-operations.patch b/patches.suse/can-peak_usb-add-range-checking-in-decode-operations.patch new file mode 100644 index 0000000..ac2096d --- /dev/null +++ b/patches.suse/can-peak_usb-add-range-checking-in-decode-operations.patch @@ -0,0 +1,129 @@ +From a6921dd524fe31d1f460c161d3526a407533b6db Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 13 Aug 2020 17:06:04 +0300 +Subject: [PATCH] can: peak_usb: add range checking in decode operations +Git-commit: a6921dd524fe31d1f460c161d3526a407533b6db +Patch-mainline: v5.10-rc3 +References: git-fixes + +These values come from skb->data so Smatch considers them untrusted. I +believe Smatch is correct but I don't have a way to test this. + +The usb_if->dev[] array has 2 elements but the index is in the 0-15 +range without checks. The cfd->len can be up to 255 but the maximum +valid size is CANFD_MAX_DLEN (64) so that could lead to memory +corruption. + +Fixes: 0a25e1f4f185 ("can: peak_usb: add support for PEAK new CANFD USB adapters") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20200813140604.GA456946@mwanda +Acked-by: Stephane Grosjean +Signed-off-by: Marc Kleine-Budde +Acked-by: Takashi Iwai + +--- + drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 48 +++++++++++++++++++++++------- + 1 file changed, 37 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c +index ab63fd9eb982..d29d20525588 100644 +--- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c ++++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c +@@ -468,12 +468,18 @@ static int pcan_usb_fd_decode_canmsg(struct pcan_usb_fd_if *usb_if, + struct pucan_msg *rx_msg) + { + struct pucan_rx_msg *rm = (struct pucan_rx_msg *)rx_msg; +- struct peak_usb_device *dev = usb_if->dev[pucan_msg_get_channel(rm)]; +- struct net_device *netdev = dev->netdev; ++ struct peak_usb_device *dev; ++ struct net_device *netdev; + struct canfd_frame *cfd; + struct sk_buff *skb; + const u16 rx_msg_flags = le16_to_cpu(rm->flags); + ++ if (pucan_msg_get_channel(rm) >= ARRAY_SIZE(usb_if->dev)) ++ return -ENOMEM; ++ ++ dev = usb_if->dev[pucan_msg_get_channel(rm)]; ++ netdev = dev->netdev; ++ + if (rx_msg_flags & PUCAN_MSG_EXT_DATA_LEN) { + /* CANFD frame case */ + skb = alloc_canfd_skb(netdev, &cfd); +@@ -519,15 +525,21 @@ static int pcan_usb_fd_decode_status(struct pcan_usb_fd_if *usb_if, + struct pucan_msg *rx_msg) + { + struct pucan_status_msg *sm = (struct pucan_status_msg *)rx_msg; +- struct peak_usb_device *dev = usb_if->dev[pucan_stmsg_get_channel(sm)]; +- struct pcan_usb_fd_device *pdev = +- container_of(dev, struct pcan_usb_fd_device, dev); ++ struct pcan_usb_fd_device *pdev; + enum can_state new_state = CAN_STATE_ERROR_ACTIVE; + enum can_state rx_state, tx_state; +- struct net_device *netdev = dev->netdev; ++ struct peak_usb_device *dev; ++ struct net_device *netdev; + struct can_frame *cf; + struct sk_buff *skb; + ++ if (pucan_stmsg_get_channel(sm) >= ARRAY_SIZE(usb_if->dev)) ++ return -ENOMEM; ++ ++ dev = usb_if->dev[pucan_stmsg_get_channel(sm)]; ++ pdev = container_of(dev, struct pcan_usb_fd_device, dev); ++ netdev = dev->netdev; ++ + /* nothing should be sent while in BUS_OFF state */ + if (dev->can.state == CAN_STATE_BUS_OFF) + return 0; +@@ -579,9 +591,14 @@ static int pcan_usb_fd_decode_error(struct pcan_usb_fd_if *usb_if, + struct pucan_msg *rx_msg) + { + struct pucan_error_msg *er = (struct pucan_error_msg *)rx_msg; +- struct peak_usb_device *dev = usb_if->dev[pucan_ermsg_get_channel(er)]; +- struct pcan_usb_fd_device *pdev = +- container_of(dev, struct pcan_usb_fd_device, dev); ++ struct pcan_usb_fd_device *pdev; ++ struct peak_usb_device *dev; ++ ++ if (pucan_ermsg_get_channel(er) >= ARRAY_SIZE(usb_if->dev)) ++ return -EINVAL; ++ ++ dev = usb_if->dev[pucan_ermsg_get_channel(er)]; ++ pdev = container_of(dev, struct pcan_usb_fd_device, dev); + + /* keep a trace of tx and rx error counters for later use */ + pdev->bec.txerr = er->tx_err_cnt; +@@ -595,11 +612,17 @@ static int pcan_usb_fd_decode_overrun(struct pcan_usb_fd_if *usb_if, + struct pucan_msg *rx_msg) + { + struct pcan_ufd_ovr_msg *ov = (struct pcan_ufd_ovr_msg *)rx_msg; +- struct peak_usb_device *dev = usb_if->dev[pufd_omsg_get_channel(ov)]; +- struct net_device *netdev = dev->netdev; ++ struct peak_usb_device *dev; ++ struct net_device *netdev; + struct can_frame *cf; + struct sk_buff *skb; + ++ if (pufd_omsg_get_channel(ov) >= ARRAY_SIZE(usb_if->dev)) ++ return -EINVAL; ++ ++ dev = usb_if->dev[pufd_omsg_get_channel(ov)]; ++ netdev = dev->netdev; ++ + /* allocate an skb to store the error frame */ + skb = alloc_can_err_skb(netdev, &cf); + if (!skb) +@@ -716,6 +739,9 @@ static int pcan_usb_fd_encode_msg(struct peak_usb_device *dev, + u16 tx_msg_size, tx_msg_flags; + u8 can_dlc; + ++ if (cfd->len > CANFD_MAX_DLEN) ++ return -EINVAL; ++ + tx_msg_size = ALIGN(sizeof(struct pucan_tx_msg) + cfd->len, 4); + tx_msg->size = cpu_to_le16(tx_msg_size); + tx_msg->type = cpu_to_le16(PUCAN_MSG_CAN_TX); +-- +2.16.4 + diff --git a/patches.suse/can-peak_usb-peak_usb_get_ts_time-fix-timestamp-wrap.patch b/patches.suse/can-peak_usb-peak_usb_get_ts_time-fix-timestamp-wrap.patch new file mode 100644 index 0000000..43f2a59 --- /dev/null +++ b/patches.suse/can-peak_usb-peak_usb_get_ts_time-fix-timestamp-wrap.patch @@ -0,0 +1,91 @@ +From ecc7b4187dd388549544195fb13a11b4ea8e6a84 Mon Sep 17 00:00:00 2001 +From: Stephane Grosjean +Date: Wed, 14 Oct 2020 10:56:31 +0200 +Subject: [PATCH] can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping +Git-commit: ecc7b4187dd388549544195fb13a11b4ea8e6a84 +Patch-mainline: v5.10-rc3 +References: git-fixes + +Fabian Inostroza has discovered a potential +problem in the hardware timestamp reporting from the PCAN-USB USB CAN interface +(only), related to the fact that a timestamp of an event may precede the +timestamp used for synchronization when both records are part of the same USB +packet. However, this case was used to detect the wrapping of the time counter. + +This patch details and fixes the two identified cases where this problem can +occur. + +Reported-by: Fabian Inostroza +Signed-off-by: Stephane Grosjean +Link: https://lore.kernel.org/r/20201014085631.15128-1-s.grosjean@peak-system.com +Fixes: bb4785551f64 ("can: usb: PEAK-System Technik USB adapters driver core") +Signed-off-by: Marc Kleine-Budde +Acked-by: Takashi Iwai + +--- + drivers/net/can/usb/peak_usb/pcan_usb_core.c | 51 ++++++++++++++++++++++++--- + 1 file changed, 46 insertions(+), 5 deletions(-) + +--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c ++++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c +@@ -154,14 +154,55 @@ void peak_usb_get_ts_tv(struct peak_time + /* protect from getting timeval before setting now */ + if (time_ref->tv_host.tv_sec > 0) { + u64 delta_us; ++ s64 delta_ts = 0; + +- delta_us = ts - time_ref->ts_dev_2; +- if (ts < time_ref->ts_dev_2) +- delta_us &= (1 << time_ref->adapter->ts_used_bits) - 1; ++ /* General case: dev_ts_1 < dev_ts_2 < ts, with: ++ * ++ * - dev_ts_1 = previous sync timestamp ++ * - dev_ts_2 = last sync timestamp ++ * - ts = event timestamp ++ * - ts_period = known sync period (theoretical) ++ * ~ dev_ts2 - dev_ts1 ++ * *but*: ++ * ++ * - time counters wrap (see adapter->ts_used_bits) ++ * - sometimes, dev_ts_1 < ts < dev_ts2 ++ * ++ * "normal" case (sync time counters increase): ++ * must take into account case when ts wraps (tsw) ++ * ++ * < ts_period > < > ++ * | | | ++ * ---+--------+----+-------0-+--+--> ++ * ts_dev_1 | ts_dev_2 | ++ * ts tsw ++ */ ++ if (time_ref->ts_dev_1 < time_ref->ts_dev_2) { ++ /* case when event time (tsw) wraps */ ++ if (ts < time_ref->ts_dev_1) ++ delta_ts = 1 << time_ref->adapter->ts_used_bits; + +- delta_us += time_ref->ts_total; ++ /* Otherwise, sync time counter (ts_dev_2) has wrapped: ++ * handle case when event time (tsn) hasn't. ++ * ++ * < ts_period > < > ++ * | | | ++ * ---+--------+--0-+---------+--+--> ++ * ts_dev_1 | ts_dev_2 | ++ * tsn ts ++ */ ++ } else if (time_ref->ts_dev_1 < ts) { ++ delta_ts = -(1 << time_ref->adapter->ts_used_bits); ++ } + +- delta_us *= time_ref->adapter->us_per_ts_scale; ++ /* add delay between last sync and event timestamps */ ++ delta_ts += (signed int)(ts - time_ref->ts_dev_2); ++ ++ /* add time from beginning to last sync */ ++ delta_ts += time_ref->ts_total; ++ ++ /* convert ticks number into microseconds */ ++ delta_us = delta_ts * time_ref->adapter->us_per_ts_scale; + delta_us >>= time_ref->adapter->us_per_ts_shift; + + *tv = time_ref->tv_host_0; diff --git a/patches.suse/can-rx-offload-don-t-call-kfree_skb-from-IRQ-context.patch b/patches.suse/can-rx-offload-don-t-call-kfree_skb-from-IRQ-context.patch new file mode 100644 index 0000000..0cd3d36 --- /dev/null +++ b/patches.suse/can-rx-offload-don-t-call-kfree_skb-from-IRQ-context.patch @@ -0,0 +1,98 @@ +From 2ddd6bfe7bdbb6c661835c3ff9cab8e0769940a6 Mon Sep 17 00:00:00 2001 +From: Marc Kleine-Budde +Date: Thu, 18 Jun 2020 12:47:06 +0200 +Subject: [PATCH] can: rx-offload: don't call kfree_skb() from IRQ context +Git-commit: 2ddd6bfe7bdbb6c661835c3ff9cab8e0769940a6 +Patch-mainline: v5.10-rc3 +References: git-fixes + +A CAN driver, using the rx-offload infrastructure, is reading CAN frames +(usually in IRQ context) from the hardware and placing it into the rx-offload +queue to be delivered to the networking stack via NAPI. + +In case the rx-offload queue is full, trying to add more skbs results in the +skbs being dropped using kfree_skb(). If done from hard-IRQ context this +results in the following warning: + +[ 682.552693] ------------[ cut here ]------------ +[ 682.557360] WARNING: CPU: 0 PID: 3057 at net/core/skbuff.c:650 skb_release_head_state+0x74/0x84 +[ 682.566075] Modules linked in: can_raw can coda_vpu flexcan dw_hdmi_ahb_audio v4l2_jpeg imx_vdoa can_dev +[ 682.575597] CPU: 0 PID: 3057 Comm: cansend Tainted: G W 5.7.0+ #18 +[ 682.583098] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) +[ 682.589657] [] (unwind_backtrace) from [] (show_stack+0x10/0x14) +[ 682.597423] [] (show_stack) from [] (dump_stack+0xe0/0x114) +[ 682.604759] [] (dump_stack) from [] (__warn+0xc0/0x10c) +[ 682.611742] [] (__warn) from [] (warn_slowpath_fmt+0x5c/0xc0) +[ 682.619248] [] (warn_slowpath_fmt) from [] (skb_release_head_state+0x74/0x84) +[ 682.628143] [] (skb_release_head_state) from [] (skb_release_all+0xc/0x24) +[ 682.636774] [] (skb_release_all) from [] (kfree_skb+0x74/0x1c8) +[ 682.644479] [] (kfree_skb) from [] (can_rx_offload_queue_sorted+0xe0/0xe8 [can_dev]) +[ 682.654051] [] (can_rx_offload_queue_sorted [can_dev]) from [] (can_rx_offload_get_echo_skb+0x48/0x94 [can_dev]) +[ 682.666007] [] (can_rx_offload_get_echo_skb [can_dev]) from [] (flexcan_irq+0x194/0x5dc [flexcan]) +[ 682.676734] [] (flexcan_irq [flexcan]) from [] (__handle_irq_event_percpu+0x4c/0x3ec) +[ 682.686322] [] (__handle_irq_event_percpu) from [] (handle_irq_event_percpu+0x2c/0x88) +[ 682.695993] [] (handle_irq_event_percpu) from [] (handle_irq_event+0x38/0x5c) +[ 682.704887] [] (handle_irq_event) from [] (handle_fasteoi_irq+0xc8/0x180) +[ 682.713432] [] (handle_fasteoi_irq) from [] (generic_handle_irq+0x30/0x44) +[ 682.722063] [] (generic_handle_irq) from [] (__handle_domain_irq+0x64/0xdc) +[ 682.730783] [] (__handle_domain_irq) from [] (gic_handle_irq+0x48/0x9c) +[ 682.739158] [] (gic_handle_irq) from [] (__irq_svc+0x70/0x98) +[ 682.746656] Exception stack(0xe80e9dd8 to 0xe80e9e20) +[ 682.751725] 9dc0: 00000001 e80e8000 +[ 682.759922] 9de0: e820cf80 00000000 ffffe000 00000000 eaf08fe4 00000000 600d0013 00000000 +[ 682.768117] 9e00: c1732e3c c16093a8 e820d4c0 e80e9e28 c018a57c c018b870 600d0013 ffffffff +[ 682.776315] [] (__irq_svc) from [] (lock_acquire+0x108/0x4e8) +[ 682.783821] [] (lock_acquire) from [] (down_write+0x48/0xa8) +[ 682.791242] [] (down_write) from [] (unlink_file_vma+0x24/0x40) +[ 682.798922] [] (unlink_file_vma) from [] (free_pgtables+0x34/0xb8) +[ 682.806858] [] (free_pgtables) from [] (exit_mmap+0xe4/0x170) +[ 682.814361] [] (exit_mmap) from [] (mmput+0x5c/0x110) +[ 682.821171] [] (mmput) from [] (do_exit+0x374/0xbe4) +[ 682.827892] [] (do_exit) from [] (do_group_exit+0x38/0xb4) +[ 682.835132] [] (do_group_exit) from [] (__wake_up_parent+0x0/0x14) +[ 682.843063] irq event stamp: 1936 +[ 682.846399] hardirqs last enabled at (1935): [] rmqueue+0xf4/0xc64 +[ 682.853553] hardirqs last disabled at (1936): [] __irq_svc+0x60/0x98 +[ 682.860799] softirqs last enabled at (1878): [] raw_release+0x108/0x1f0 [can_raw] +[ 682.869256] softirqs last disabled at (1876): [] release_sock+0x18/0x98 +[ 682.876753] ---[ end trace 7bca4751ce44c444 ]--- + +This patch fixes the problem by replacing the kfree_skb() by +dev_kfree_skb_any(), as rx-offload might be called from threaded IRQ handlers +as well. + +Fixes: ca913f1ac024 ("can: rx-offload: can_rx_offload_queue_sorted(): fix error handling, avoid skb mem leak") +Fixes: 6caf8a6d6586 ("can: rx-offload: can_rx_offload_queue_tail(): fix error handling, avoid skb mem leak") +Link: http://lore.kernel.org/r/20201019190524.1285319-3-mkl@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Acked-by: Takashi Iwai + +--- + drivers/net/can/rx-offload.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c +index 3b180269a92d..6e95193b215b 100644 +--- a/drivers/net/can/rx-offload.c ++++ b/drivers/net/can/rx-offload.c +@@ -245,7 +245,7 @@ int can_rx_offload_queue_sorted(struct can_rx_offload *offload, + + if (skb_queue_len(&offload->skb_queue) > + offload->skb_queue_len_max) { +- kfree_skb(skb); ++ dev_kfree_skb_any(skb); + return -ENOBUFS; + } + +@@ -290,7 +290,7 @@ int can_rx_offload_queue_tail(struct can_rx_offload *offload, + { + if (skb_queue_len(&offload->skb_queue) > + offload->skb_queue_len_max) { +- kfree_skb(skb); ++ dev_kfree_skb_any(skb); + return -ENOBUFS; + } + +-- +2.16.4 + diff --git a/patches.suse/clk-ti-clockdomain-fix-static-checker-warning.patch b/patches.suse/clk-ti-clockdomain-fix-static-checker-warning.patch new file mode 100644 index 0000000..63c8b7b --- /dev/null +++ b/patches.suse/clk-ti-clockdomain-fix-static-checker-warning.patch @@ -0,0 +1,35 @@ +From b7a7943fe291b983b104bcbd2f16e8e896f56590 Mon Sep 17 00:00:00 2001 +From: Tero Kristo +Date: Mon, 7 Sep 2020 11:25:59 +0300 +Subject: [PATCH] clk: ti: clockdomain: fix static checker warning +Git-commit: b7a7943fe291b983b104bcbd2f16e8e896f56590 +Patch-mainline: v5.10-rc1 +References: git-fixes + +Fix a memory leak induced by not calling clk_put after doing of_clk_get. + +Reported-by: Dan Murphy +Signed-off-by: Tero Kristo +Link: https://lore.kernel.org/r/20200907082600.454-3-t-kristo@ti.com +Signed-off-by: Stephen Boyd +Acked-by: Takashi Iwai + +--- + drivers/clk/ti/clockdomain.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/clk/ti/clockdomain.c ++++ b/drivers/clk/ti/clockdomain.c +@@ -146,10 +146,12 @@ static void __init of_ti_clockdomain_set + if (clk_hw_get_flags(clk_hw) & CLK_IS_BASIC) { + pr_warn("can't setup clkdm for basic clk %s\n", + __clk_get_name(clk)); ++ clk_put(clk); + continue; + } + to_clk_hw_omap(clk_hw)->clkdm_name = clkdm_name; + omap2_init_clk_clkdm(clk_hw); ++ clk_put(clk); + } + } + diff --git a/patches.suse/crypto-bcm-Verify-GCM-CCM-key-length-in-setkey.patch b/patches.suse/crypto-bcm-Verify-GCM-CCM-key-length-in-setkey.patch new file mode 100644 index 0000000..5d5cc8a --- /dev/null +++ b/patches.suse/crypto-bcm-Verify-GCM-CCM-key-length-in-setkey.patch @@ -0,0 +1,85 @@ +From 10a2f0b311094ffd45463a529a410a51ca025f27 Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Fri, 2 Oct 2020 17:55:22 +1000 +Subject: [PATCH] crypto: bcm - Verify GCM/CCM key length in setkey +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 10a2f0b311094ffd45463a529a410a51ca025f27 +Patch-mainline: v5.10-rc1 +References: git-fixes + +The setkey function for GCM/CCM algorithms didn't verify the key +length before copying the key and subtracting the salt length. + +This patch delays the copying of the key til after the verification +has been done. It also adds checks on the key length to ensure +that it's at least as long as the salt. + +Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver") +Cc: +Reported-by: kiyin(尹亮) +Signed-off-by: Herbert Xu +Acked-by: Takashi Iwai + +--- + drivers/crypto/bcm/cipher.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c +index 5d38b87b9d77..50d169e61b41 100644 +--- a/drivers/crypto/bcm/cipher.c ++++ b/drivers/crypto/bcm/cipher.c +@@ -2867,7 +2867,6 @@ static int aead_gcm_ccm_setkey(struct crypto_aead *cipher, + + ctx->enckeylen = keylen; + ctx->authkeylen = 0; +- memcpy(ctx->enckey, key, ctx->enckeylen); + + switch (ctx->enckeylen) { + case AES_KEYSIZE_128: +@@ -2883,6 +2882,8 @@ static int aead_gcm_ccm_setkey(struct crypto_aead *cipher, + goto badkey; + } + ++ memcpy(ctx->enckey, key, ctx->enckeylen); ++ + flow_log(" enckeylen:%u authkeylen:%u\n", ctx->enckeylen, + ctx->authkeylen); + flow_dump(" enc: ", ctx->enckey, ctx->enckeylen); +@@ -2937,6 +2938,10 @@ static int aead_gcm_esp_setkey(struct crypto_aead *cipher, + struct iproc_ctx_s *ctx = crypto_aead_ctx(cipher); + + flow_log("%s\n", __func__); ++ ++ if (keylen < GCM_ESP_SALT_SIZE) ++ return -EINVAL; ++ + ctx->salt_len = GCM_ESP_SALT_SIZE; + ctx->salt_offset = GCM_ESP_SALT_OFFSET; + memcpy(ctx->salt, key + keylen - GCM_ESP_SALT_SIZE, GCM_ESP_SALT_SIZE); +@@ -2965,6 +2970,10 @@ static int rfc4543_gcm_esp_setkey(struct crypto_aead *cipher, + struct iproc_ctx_s *ctx = crypto_aead_ctx(cipher); + + flow_log("%s\n", __func__); ++ ++ if (keylen < GCM_ESP_SALT_SIZE) ++ return -EINVAL; ++ + ctx->salt_len = GCM_ESP_SALT_SIZE; + ctx->salt_offset = GCM_ESP_SALT_OFFSET; + memcpy(ctx->salt, key + keylen - GCM_ESP_SALT_SIZE, GCM_ESP_SALT_SIZE); +@@ -2994,6 +3003,10 @@ static int aead_ccm_esp_setkey(struct crypto_aead *cipher, + struct iproc_ctx_s *ctx = crypto_aead_ctx(cipher); + + flow_log("%s\n", __func__); ++ ++ if (keylen < CCM_ESP_SALT_SIZE) ++ return -EINVAL; ++ + ctx->salt_len = CCM_ESP_SALT_SIZE; + ctx->salt_offset = CCM_ESP_SALT_OFFSET; + memcpy(ctx->salt, key + keylen - CCM_ESP_SALT_SIZE, CCM_ESP_SALT_SIZE); +-- +2.16.4 + diff --git a/patches.suse/debugfs-Fix-module-state-check-condition.patch b/patches.suse/debugfs-Fix-module-state-check-condition.patch new file mode 100644 index 0000000..e18426b --- /dev/null +++ b/patches.suse/debugfs-Fix-module-state-check-condition.patch @@ -0,0 +1,47 @@ +From ceec802073ef1a539d7605172c44f5f961758f6d Mon Sep 17 00:00:00 2001 +From: Vladis Dronov +Date: Tue, 11 Aug 2020 17:01:29 +0200 +Subject: [PATCH 4/6] debugfs: Fix module state check condition +Git-commit: e3b9fc7eec55e6fdc8beeed18f2ed207086341e2 +Patch-mainline: v5.9-rc5 +References: git-fixes + +The '#ifdef MODULE' check in the original commit does not work as intended. +The code under the check is not built at all if CONFIG_DEBUG_FS=y. Fix this +by using a correct check. + +Fixes: 275678e7a9be ("debugfs: Check module state before warning in {full/open}_proxy_open()") +Signed-off-by: Vladis Dronov +Cc: stable +Link: https://lore.kernel.org/r/20200811150129.53343-1-vdronov@redhat.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Denis Kirjanov +--- + fs/debugfs/file.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c +index 0203582d7474..b5dcdf658fa2 100644 +--- a/fs/debugfs/file.c ++++ b/fs/debugfs/file.c +@@ -152,7 +152,7 @@ static int open_proxy_open(struct inode *inode, struct file *filp) + + real_fops = debugfs_real_fops(filp); + if (!fops_get(real_fops)) { +-#ifdef MODULE ++#ifdef CONFIG_MODULES + if (real_fops->owner && + real_fops->owner->state == MODULE_STATE_GOING) + goto out; +@@ -282,7 +282,7 @@ static int full_proxy_open(struct inode *inode, struct file *filp) + + real_fops = debugfs_real_fops(filp); + if (!fops_get(real_fops)) { +-#ifdef MODULE ++#ifdef CONFIG_MODULES + if (real_fops->owner && + real_fops->owner->state == MODULE_STATE_GOING) + goto out; +-- +2.16.4 + diff --git a/patches.suse/device-property-Don-t-clear-secondary-pointer-for-sh.patch b/patches.suse/device-property-Don-t-clear-secondary-pointer-for-sh.patch new file mode 100644 index 0000000..c050bdd --- /dev/null +++ b/patches.suse/device-property-Don-t-clear-secondary-pointer-for-sh.patch @@ -0,0 +1,54 @@ +From 99aed9227073fb34ce2880cbc7063e04185a65e1 Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Thu, 22 Oct 2020 21:41:00 +0300 +Subject: [PATCH] device property: Don't clear secondary pointer for shared primary firmware node +Git-commit: 99aed9227073fb34ce2880cbc7063e04185a65e1 +Patch-mainline: v5.10-rc2 +References: git-fixes + +It appears that firmware nodes can be shared between devices. In such case +when a (child) device is about to be deleted, its firmware node may be shared +and ACPI_COMPANION_SET(..., NULL) call for it breaks the secondary link +of the shared primary firmware node. + +In order to prevent that, check, if the device has a parent and parent's +firmware node is shared with its child, and avoid crashing the link. + +Fixes: c15e1bdda436 ("device property: Fix the secondary firmware node handling in set_primary_fwnode()") +Reported-by: Ferry Toth +Signed-off-by: Andy Shevchenko +Reviewed-by: Heikki Krogerus +Tested-by: Ferry Toth +Cc: 5.9+ # 5.9+ +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/base/core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index 41feab679fa1..78114ddac755 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -4264,6 +4264,7 @@ static inline bool fwnode_is_primary(struct fwnode_handle *fwnode) + */ + void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode) + { ++ struct device *parent = dev->parent; + struct fwnode_handle *fn = dev->fwnode; + + if (fwnode) { +@@ -4278,7 +4279,8 @@ void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode) + } else { + if (fwnode_is_primary(fn)) { + dev->fwnode = fn->secondary; +- fn->secondary = ERR_PTR(-ENODEV); ++ if (!(parent && fn == parent->fwnode)) ++ fn->secondary = ERR_PTR(-ENODEV); + } else { + dev->fwnode = NULL; + } +-- +2.16.4 + diff --git a/patches.suse/device-property-Keep-secondary-firmware-node-seconda.patch b/patches.suse/device-property-Keep-secondary-firmware-node-seconda.patch new file mode 100644 index 0000000..8f31661 --- /dev/null +++ b/patches.suse/device-property-Keep-secondary-firmware-node-seconda.patch @@ -0,0 +1,59 @@ +From d5dcce0c414fcbfe4c2037b66ac69ea5f9b3f75c Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Thu, 22 Oct 2020 21:40:59 +0300 +Subject: [PATCH] device property: Keep secondary firmware node secondary by type +Git-commit: d5dcce0c414fcbfe4c2037b66ac69ea5f9b3f75c +Patch-mainline: v5.10-rc2 +References: git-fixes + +Behind primary and secondary we understand the type of the nodes +which might define their ordering. However, if primary node gone, +we can't maintain the ordering by definition of the linked list. +Thus, by ordering secondary node becomes first in the list. +But in this case the meaning of it is still secondary (or auxiliary). +The type of the node is maintained by the secondary pointer in it: + + secondary pointer Meaning + NULL or valid primary node + ERR_PTR(-ENODEV) secondary node + +So, if by some reason we do the following sequence of calls + + set_primary_fwnode(dev, NULL); + set_primary_fwnode(dev, primary); + +we should preserve secondary node. + +This concept is supported by the description of set_primary_fwnode() +along with implementation of set_secondary_fwnode(). Hence, fix +the commit c15e1bdda436 to follow this as well. + +Fixes: c15e1bdda436 ("device property: Fix the secondary firmware node handling in set_primary_fwnode()") +Cc: Ferry Toth +Signed-off-by: Andy Shevchenko +Reviewed-by: Heikki Krogerus +Tested-by: Ferry Toth +Cc: 5.9+ # 5.9+ +Signed-off-by: Rafael J. Wysocki +Acked-by: Takashi Iwai + +--- + drivers/base/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index c852f16c111b..41feab679fa1 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -4278,7 +4278,7 @@ void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode) + } else { + if (fwnode_is_primary(fn)) { + dev->fwnode = fn->secondary; +- fn->secondary = NULL; ++ fn->secondary = ERR_PTR(-ENODEV); + } else { + dev->fwnode = NULL; + } +-- +2.16.4 + diff --git a/patches.suse/dpaa_eth-fix-the-RX-headroom-size-alignment.patch b/patches.suse/dpaa_eth-fix-the-RX-headroom-size-alignment.patch new file mode 100644 index 0000000..1ed6f53 --- /dev/null +++ b/patches.suse/dpaa_eth-fix-the-RX-headroom-size-alignment.patch @@ -0,0 +1,67 @@ +From 7834e494f42627769d3f965d5d203e9c6ddb8403 Mon Sep 17 00:00:00 2001 +From: Camelia Groza +Date: Mon, 2 Nov 2020 20:34:36 +0200 +Subject: [PATCH] dpaa_eth: fix the RX headroom size alignment +Git-commit: 7834e494f42627769d3f965d5d203e9c6ddb8403 +Patch-mainline: v5.10-rc2 +References: git-fixes + +The headroom reserved for received frames needs to be aligned to an +RX specific value. There is currently a discrepancy between the values +used in the Ethernet driver and the values passed to the FMan. +Coincidentally, the resulting aligned values are identical. + +Fixes: 3c68b8fffb48 ("dpaa_eth: FMan erratum A050385 workaround") +Acked-by: Willem de Bruijn +Signed-off-by: Camelia Groza +Signed-off-by: Jakub Kicinski +Acked-by: Denis Kirjanov +--- + drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +index 3eaa5f21aab0..d9c285948fc2 100644 +--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c ++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +@@ -2845,7 +2845,8 @@ static int dpaa_ingress_cgr_init(struct dpaa_priv *priv) + return err; + } + +-static inline u16 dpaa_get_headroom(struct dpaa_buffer_layout *bl) ++static u16 dpaa_get_headroom(struct dpaa_buffer_layout *bl, ++ enum port_type port) + { + u16 headroom; + +@@ -2832,11 +2832,12 @@ static inline u16 dpaa_get_headroom(stru + * + * Also make sure the headroom is a multiple of data_align bytes + */ +- headroom = (u16)(bl->priv_data_size + DPAA_HWA_SIZE); ++ headroom = (u16)(bl[port].priv_data_size + DPAA_HWA_SIZE); + +- return DPAA_FD_DATA_ALIGNMENT ? ALIGN(headroom, +- DPAA_FD_DATA_ALIGNMENT) : +- headroom; ++ if (port == RX) ++ return ALIGN(headroom, DPAA_FD_RX_DATA_ALIGNMENT); ++ else ++ return ALIGN(headroom, DPAA_FD_DATA_ALIGNMENT); + } + + static int dpaa_eth_probe(struct platform_device *pdev) +@@ -3029,8 +3033,8 @@ static int dpaa_eth_probe(struct platform_device *pdev) + goto free_dpaa_fqs; + } + +- priv->tx_headroom = dpaa_get_headroom(&priv->buf_layout[TX]); +- priv->rx_headroom = dpaa_get_headroom(&priv->buf_layout[RX]); ++ priv->tx_headroom = dpaa_get_headroom(priv->buf_layout, TX); ++ priv->rx_headroom = dpaa_get_headroom(priv->buf_layout, RX); + + /* All real interfaces need their ports initialized */ + err = dpaa_eth_init_ports(mac_dev, dpaa_bp, &port_fqs, +-- +2.16.4 + diff --git a/patches.suse/dpaa_eth-update-the-buffer-layout-for-non-A050385-er.patch b/patches.suse/dpaa_eth-update-the-buffer-layout-for-non-A050385-er.patch new file mode 100644 index 0000000..9a8b922 --- /dev/null +++ b/patches.suse/dpaa_eth-update-the-buffer-layout-for-non-A050385-er.patch @@ -0,0 +1,65 @@ +From acef159a0cb2a978d62b641e2366a33ad1d5afef Mon Sep 17 00:00:00 2001 +From: Camelia Groza +Date: Mon, 2 Nov 2020 20:34:35 +0200 +Subject: [PATCH] dpaa_eth: update the buffer layout for non-A050385 erratum + scenarios +Git-commit: acef159a0cb2a978d62b641e2366a33ad1d5afef +Patch-mainline: v5.10-rc2 +References: git-fixes + +Impose a larger RX private data area only when the A050385 erratum is +present on the hardware. A smaller buffer size is sufficient in all +other scenarios. This enables a wider range of linear Jumbo frame +sizes in non-erratum scenarios, instead of turning to multi +buffer Scatter/Gather frames. The maximum linear frame size is +increased by 128 bytes for non-erratum arm64 platforms. + +Cleanup the hardware annotations header defines in the process. + +Fixes: 3c68b8fffb48 ("dpaa_eth: FMan erratum A050385 workaround") +Signed-off-by: Camelia Groza +Signed-off-by: Jakub Kicinski +Acked-by: Denis Kirjanov +--- + drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +index 06cc863f4dd6..3eaa5f21aab0 100644 +--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c ++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +@@ -174,12 +174,17 @@ MODULE_PARM_DESC(tx_timeout, "The Tx timeout in ms"); + #define DPAA_PARSE_RESULTS_SIZE sizeof(struct fman_prs_result) + #define DPAA_TIME_STAMP_SIZE 8 + #define DPAA_HASH_RESULTS_SIZE 8 ++#define DPAA_HWA_SIZE (DPAA_PARSE_RESULTS_SIZE + DPAA_TIME_STAMP_SIZE \ ++ + DPAA_HASH_RESULTS_SIZE) ++#define DPAA_RX_PRIV_DATA_DEFAULT_SIZE (DPAA_TX_PRIV_DATA_SIZE + \ ++ dpaa_rx_extra_headroom) + #ifdef CONFIG_DPAA_ERRATUM_A050385 +-#define DPAA_RX_PRIV_DATA_SIZE (DPAA_A050385_ALIGN - (DPAA_PARSE_RESULTS_SIZE\ +- + DPAA_TIME_STAMP_SIZE + DPAA_HASH_RESULTS_SIZE)) ++#define DPAA_RX_PRIV_DATA_A050385_SIZE (DPAA_A050385_ALIGN - DPAA_HWA_SIZE) ++#define DPAA_RX_PRIV_DATA_SIZE (fman_has_errata_a050385() ? \ ++ DPAA_RX_PRIV_DATA_A050385_SIZE : \ ++ DPAA_RX_PRIV_DATA_DEFAULT_SIZE) + #else +-#define DPAA_RX_PRIV_DATA_SIZE (u16)(DPAA_TX_PRIV_DATA_SIZE + \ +- dpaa_rx_extra_headroom) ++#define DPAA_RX_PRIV_DATA_SIZE DPAA_RX_PRIV_DATA_DEFAULT_SIZE + #endif + + #define DPAA_ETH_PCD_RXQ_NUM 128 +@@ -2827,8 +2827,7 @@ static inline u16 dpaa_get_headroom(stru + * + * Also make sure the headroom is a multiple of data_align bytes + */ +- headroom = (u16)(bl->priv_data_size + DPAA_PARSE_RESULTS_SIZE + +- DPAA_TIME_STAMP_SIZE + DPAA_HASH_RESULTS_SIZE); ++ headroom = (u16)(bl->priv_data_size + DPAA_HWA_SIZE); + + return DPAA_FD_DATA_ALIGNMENT ? ALIGN(headroom, + DPAA_FD_DATA_ALIGNMENT) : +-- +2.16.4 + diff --git a/patches.suse/drm-amd-display-Don-t-invoke-kgdb_breakpoint-uncondi.patch b/patches.suse/drm-amd-display-Don-t-invoke-kgdb_breakpoint-uncondi.patch new file mode 100644 index 0000000..f11309b --- /dev/null +++ b/patches.suse/drm-amd-display-Don-t-invoke-kgdb_breakpoint-uncondi.patch @@ -0,0 +1,45 @@ +From 8b7dc1fe1a5c1093551f6cd7dfbb941bd9081c2e Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 23 Oct 2020 09:46:55 +0200 +Subject: [PATCH] drm/amd/display: Don't invoke kgdb_breakpoint() unconditionally +Git-commit: 8b7dc1fe1a5c1093551f6cd7dfbb941bd9081c2e +Patch-mainline: v5.10-rc2 +References: git-fixes + +ASSERT_CRITICAL() invokes kgdb_breakpoint() whenever either +CONFIG_KGDB or CONFIG_HAVE_KGDB is set. This, however, may lead to a +kernel panic when no kdb stuff is attached, since the +kgdb_breakpoint() call issues INT3. It's nothing but a surprise for +normal end-users. + +For avoiding the pitfall, make the kgdb_breakpoint() call only when +CONFIG_DEBUG_KERNEL_DC is set. + +https://bugzilla.opensuse.org/show_bug.cgi?id=1177973 + +Cc: +Acked-by: Alex Deucher +Reviewed-by: Nicholas Kazlauskas +Signed-off-by: Takashi Iwai +Signed-off-by: Alex Deucher + +--- + drivers/gpu/drm/amd/display/dc/os_types.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/os_types.h b/drivers/gpu/drm/amd/display/dc/os_types.h +index 330acaaed79a..32758b245754 100644 +--- a/drivers/gpu/drm/amd/display/dc/os_types.h ++++ b/drivers/gpu/drm/amd/display/dc/os_types.h +@@ -94,7 +94,7 @@ + * general debug capabilities + * + */ +-#if defined(CONFIG_HAVE_KGDB) || defined(CONFIG_KGDB) ++#if defined(CONFIG_DEBUG_KERNEL_DC) && (defined(CONFIG_HAVE_KGDB) || defined(CONFIG_KGDB)) + #define ASSERT_CRITICAL(expr) do { \ + if (WARN_ON(!(expr))) { \ + kgdb_breakpoint(); \ +-- +2.16.4 + diff --git a/patches.suse/drm-amd-display-HDMI-remote-sink-need-mode-validatio.patch b/patches.suse/drm-amd-display-HDMI-remote-sink-need-mode-validatio.patch new file mode 100644 index 0000000..b8ee4e2 --- /dev/null +++ b/patches.suse/drm-amd-display-HDMI-remote-sink-need-mode-validatio.patch @@ -0,0 +1,49 @@ +From 95d620adb48f7728e67d82f56f756e8d451cf8d2 Mon Sep 17 00:00:00 2001 +From: Fangzhi Zuo +Date: Mon, 21 Sep 2020 17:52:43 -0400 +Subject: [PATCH] drm/amd/display: HDMI remote sink need mode validation for Linux +Git-commit: 95d620adb48f7728e67d82f56f756e8d451cf8d2 +Patch-mainline: v5.10-rc1 +References: git-fixes + +[Why] +Currently mode validation is bypassed if remote sink exists. That +leads to mode set issue when a BW bottle neck exists in the link path, +e.g., a DP-to-HDMI converter that only supports HDMI 1.4. + +Any invalid mode passed to Linux user space will cause the modeset +failure due to limitation of Linux user space implementation. + +[How] +Mode validation is skipped only if in edid override. For real remote +sink, clock limit check should be done for HDMI remote sink. + +Have HDMI related remote sink going through mode validation to +elimiate modes which pixel clock exceeds BW limitation. + +Signed-off-by: Fangzhi Zuo +Reviewed-by: Hersen Wu +Acked-by: Eryk Brol +Signed-off-by: Alex Deucher +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/amd/display/dc/core/dc_link.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +index f13396254b5d..fec87a2e210c 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +@@ -2441,7 +2441,7 @@ enum dc_status dc_link_validate_mode_timing( + /* A hack to avoid failing any modes for EDID override feature on + * topology change such as lower quality cable for DP or different dongle + */ +- if (link->remote_sinks[0]) ++ if (link->remote_sinks[0] && link->remote_sinks[0]->sink_signal == SIGNAL_TYPE_VIRTUAL) + return DC_OK; + + /* Passive Dongle */ +-- +2.16.4 + diff --git a/patches.suse/drm-amdgpu-don-t-map-BO-in-reserved-region.patch b/patches.suse/drm-amdgpu-don-t-map-BO-in-reserved-region.patch new file mode 100644 index 0000000..2258e8e --- /dev/null +++ b/patches.suse/drm-amdgpu-don-t-map-BO-in-reserved-region.patch @@ -0,0 +1,50 @@ +From c4aa8dff6091cc9536aeb255e544b0b4ba29faf4 Mon Sep 17 00:00:00 2001 +From: Madhav Chauhan +Date: Fri, 16 Oct 2020 18:03:07 +0530 +Subject: [PATCH] drm/amdgpu: don't map BO in reserved region +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: c4aa8dff6091cc9536aeb255e544b0b4ba29faf4 +Patch-mainline: v5.10-rc2 +References: git-fixes + +2MB area is reserved at top inside VM. + +Suggested-by: Christian König +Signed-off-by: Madhav Chauhan +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c +@@ -563,6 +563,7 @@ int amdgpu_gem_va_ioctl(struct drm_devic + struct ww_acquire_ctx ticket; + struct list_head list, duplicates; + uint64_t va_flags; ++ uint64_t vm_size; + int r = 0; + + if (args->va_address < AMDGPU_VA_RESERVED_SIZE) { +@@ -583,6 +584,15 @@ int amdgpu_gem_va_ioctl(struct drm_devic + + args->va_address &= AMDGPU_VA_HOLE_MASK; + ++ vm_size = adev->vm_manager.max_pfn * AMDGPU_GPU_PAGE_SIZE; ++ vm_size -= AMDGPU_VA_RESERVED_SIZE; ++ if (args->va_address + args->map_size > vm_size) { ++ dev_dbg(&dev->pdev->dev, ++ "va_address 0x%llx is in top reserved area 0x%llx\n", ++ args->va_address + args->map_size, vm_size); ++ return -EINVAL; ++ } ++ + if ((args->flags & ~valid_flags) && (args->flags & ~prt_flags)) { + dev_dbg(&dev->pdev->dev, "invalid flags combination 0x%08X\n", + args->flags); diff --git a/patches.suse/drm-bridge-synopsys-dsi-add-support-for-non-continuo.patch b/patches.suse/drm-bridge-synopsys-dsi-add-support-for-non-continuo.patch new file mode 100644 index 0000000..ec34226 --- /dev/null +++ b/patches.suse/drm-bridge-synopsys-dsi-add-support-for-non-continuo.patch @@ -0,0 +1,62 @@ +From c6d94e37bdbb6dfe7e581e937a915ab58399b8a5 Mon Sep 17 00:00:00 2001 +From: Antonio Borneo +Date: Wed, 1 Jul 2020 21:42:34 +0200 +Subject: [PATCH] drm/bridge/synopsys: dsi: add support for non-continuous HS clock +Git-commit: c6d94e37bdbb6dfe7e581e937a915ab58399b8a5 +Patch-mainline: v5.10-rc1 +References: git-fixes + +Current code enables the HS clock when video mode is started or to +send out a HS command, and disables the HS clock to send out a LP +command. This is not what DSI spec specify. + +Enable HS clock either in command and in video mode. +Set automatic HS clock management for panels and devices that +support non-continuous HS clock. + +Signed-off-by: Antonio Borneo +Tested-by: Philippe Cornu +Reviewed-by: Philippe Cornu +Acked-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20200701194234.18123-1-yannick.fertre@st.com +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c ++++ b/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c +@@ -326,7 +326,6 @@ static void dw_mipi_message_config(struc + if (lpm) + val |= CMD_MODE_ALL_LP; + +- dsi_write(dsi, DSI_LPCLK_CTRL, lpm ? 0 : PHY_TXREQUESTCLKHS); + dsi_write(dsi, DSI_CMD_MODE_CFG, val); + } + +@@ -488,16 +487,22 @@ static void dw_mipi_dsi_video_mode_confi + static void dw_mipi_dsi_set_mode(struct dw_mipi_dsi *dsi, + unsigned long mode_flags) + { ++ u32 val; ++ + dsi_write(dsi, DSI_PWR_UP, RESET); + + if (mode_flags & MIPI_DSI_MODE_VIDEO) { + dsi_write(dsi, DSI_MODE_CFG, ENABLE_VIDEO_MODE); + dw_mipi_dsi_video_mode_config(dsi); +- dsi_write(dsi, DSI_LPCLK_CTRL, PHY_TXREQUESTCLKHS); + } else { + dsi_write(dsi, DSI_MODE_CFG, ENABLE_CMD_MODE); + } + ++ val = PHY_TXREQUESTCLKHS; ++ if (dsi->mode_flags & MIPI_DSI_CLOCK_NON_CONTINUOUS) ++ val |= AUTO_CLKLANE_CTRL; ++ dsi_write(dsi, DSI_LPCLK_CTRL, val); ++ + dsi_write(dsi, DSI_PWR_UP, POWERUP); + } + diff --git a/patches.suse/drm-brige-megachips-Add-checking-if-ge_b850v3_lvds_i.patch b/patches.suse/drm-brige-megachips-Add-checking-if-ge_b850v3_lvds_i.patch new file mode 100644 index 0000000..1fee9cb --- /dev/null +++ b/patches.suse/drm-brige-megachips-Add-checking-if-ge_b850v3_lvds_i.patch @@ -0,0 +1,59 @@ +From f688a345f0d7a6df4dd2aeca8e4f3c05e123a0ee Mon Sep 17 00:00:00 2001 +From: Nadezda Lutovinova +Date: Wed, 19 Aug 2020 17:37:56 +0300 +Subject: [PATCH] drm/brige/megachips: Add checking if ge_b850v3_lvds_init() is working correctly +Git-commit: f688a345f0d7a6df4dd2aeca8e4f3c05e123a0ee +Patch-mainline: v5.10-rc1 +References: git-fixes + +If ge_b850v3_lvds_init() does not allocate memory for ge_b850v3_lvds_ptr, +then a null pointer dereference is accessed. + +The patch adds checking of the return value of ge_b850v3_lvds_init(). + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Nadezda Lutovinova +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20200819143756.30626-1-lutovinova@ispras.ru +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c +index 61a24f265c7a..d2808c4a6fb1 100644 +--- a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c ++++ b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c +@@ -310,8 +310,12 @@ static int stdp4028_ge_b850v3_fw_probe(struct i2c_client *stdp4028_i2c, + const struct i2c_device_id *id) + { + struct device *dev = &stdp4028_i2c->dev; ++ int ret; ++ ++ ret = ge_b850v3_lvds_init(dev); + +- ge_b850v3_lvds_init(dev); ++ if (ret) ++ return ret; + + ge_b850v3_lvds_ptr->stdp4028_i2c = stdp4028_i2c; + i2c_set_clientdata(stdp4028_i2c, ge_b850v3_lvds_ptr); +@@ -372,8 +376,12 @@ static int stdp2690_ge_b850v3_fw_probe(struct i2c_client *stdp2690_i2c, + const struct i2c_device_id *id) + { + struct device *dev = &stdp2690_i2c->dev; ++ int ret; ++ ++ ret = ge_b850v3_lvds_init(dev); + +- ge_b850v3_lvds_init(dev); ++ if (ret) ++ return ret; + + ge_b850v3_lvds_ptr->stdp2690_i2c = stdp2690_i2c; + i2c_set_clientdata(stdp2690_i2c, ge_b850v3_lvds_ptr); +-- +2.16.4 + diff --git a/patches.suse/drm-i915-Break-up-error-capture-compression-loops-wi.patch b/patches.suse/drm-i915-Break-up-error-capture-compression-loops-wi.patch new file mode 100644 index 0000000..1139049 --- /dev/null +++ b/patches.suse/drm-i915-Break-up-error-capture-compression-loops-wi.patch @@ -0,0 +1,49 @@ +From 7d5553147613b50149238ac1385c60e5c7cacb34 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Wed, 16 Sep 2020 10:00:58 +0100 +Subject: [PATCH] drm/i915: Break up error capture compression loops with cond_resched() +Git-commit: 7d5553147613b50149238ac1385c60e5c7cacb34 +Patch-mainline: v5.10-rc1 +No-fix: 293f43c80c0027ff9299036c24218ac705ce584e +References: git-fixes + +As the error capture will compress user buffers as directed to by the +user, it can take an arbitrary amount of time and space. Break up the +compression loops with a call to cond_resched(), that will allow other +processes to schedule (avoiding the soft lockups) and also serve as a +warning should we try to make this loop atomic in the future. + +Testcase: igt/gem_exec_capture/many-* +Signed-off-by: Chris Wilson +Cc: Mika Kuoppala +Cc: stable@vger.kernel.org +Reviewed-by: Mika Kuoppala +Link: https://patchwork.freedesktop.org/patch/msgid/20200916090059.3189-2-chris@chris-wilson.co.uk +(cherry picked from commit 293f43c80c0027ff9299036c24218ac705ce584e) + +Signed-off-by: Rodrigo Vivi +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/i915/i915_gpu_error.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/i915/i915_gpu_error.c ++++ b/drivers/gpu/drm/i915/i915_gpu_error.c +@@ -268,6 +268,8 @@ static int compress_page(struct compress + + if (zlib_deflate(zstream, Z_NO_FLUSH) != Z_OK) + return -EIO; ++ ++ cond_resched(); + } while (zstream->avail_in); + + /* Fallback to uncompressed if we increase size? */ +@@ -347,6 +349,7 @@ static int compress_page(struct compress + if (!i915_memcpy_from_wc(ptr, src, PAGE_SIZE)) + memcpy(ptr, src, PAGE_SIZE); + dst->pages[dst->page_count++] = ptr; ++ cond_resched(); + + return 0; + } diff --git a/patches.suse/drm-i915-Force-VT-d-workarounds-when-running-as-a-gu.patch b/patches.suse/drm-i915-Force-VT-d-workarounds-when-running-as-a-gu.patch new file mode 100644 index 0000000..a1befb2 --- /dev/null +++ b/patches.suse/drm-i915-Force-VT-d-workarounds-when-running-as-a-gu.patch @@ -0,0 +1,61 @@ +From 8195400f7ea95399f721ad21f4d663a62c65036f Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Mon, 19 Oct 2020 11:15:23 +0100 +Subject: [PATCH] drm/i915: Force VT'd workarounds when running as a guest OS +Git-commit: 8195400f7ea95399f721ad21f4d663a62c65036f +Patch-mainline: v5.10-rc1 +No-fix: f566fdcd6cc49a9d5b5d782f56e3e7cb243f01b8 +References: git-fixes + +If i915.ko is being used as a passthrough device, it does not know if +the host is using intel_iommu. Mixing the iommu and gfx causes a few +issues (such as scanout overfetch) which we need to workaround inside +the driver, so if we detect we are running under a hypervisor, also +assume the device access is being virtualised. + +Reported-by: Stefan Fritsch +Suggested-by: Stefan Fritsch +Signed-off-by: Chris Wilson +Cc: Zhenyu Wang +Cc: Joonas Lahtinen +Cc: Stefan Fritsch +Cc: stable@vger.kernel.org +Tested-by: Stefan Fritsch +Reviewed-by: Zhenyu Wang +Link: https://patchwork.freedesktop.org/patch/msgid/20201019101523.4145-1-chris@chris-wilson.co.uk +(cherry picked from commit f566fdcd6cc49a9d5b5d782f56e3e7cb243f01b8) + +Signed-off-by: Rodrigo Vivi +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/i915/i915_drv.h | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h +index eef9a821c49c..8426d5974669 100644 +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -33,6 +33,8 @@ + #include + #include + ++#include ++ + #include + #include + #include +@@ -1760,7 +1762,9 @@ static inline bool intel_vtd_active(void) + if (intel_iommu_gfx_mapped) + return true; + #endif +- return false; ++ ++ /* Running as a guest, we assume the host is enforcing VT'd */ ++ return !hypervisor_is_type(X86_HYPER_NATIVE); + } + + static inline bool intel_scanout_needs_vtd_wa(struct drm_i915_private *dev_priv) +-- +2.16.4 + diff --git a/patches.suse/drm-imx-tve-remove-extraneous-type-qualifier.patch b/patches.suse/drm-imx-tve-remove-extraneous-type-qualifier.patch new file mode 100644 index 0000000..87d1adf --- /dev/null +++ b/patches.suse/drm-imx-tve-remove-extraneous-type-qualifier.patch @@ -0,0 +1,43 @@ +From 36fba366cf9fa386e5905976e68380061feabd2e Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 26 Oct 2020 20:41:02 +0100 +Subject: [PATCH] drm/imx: tve remove extraneous type qualifier +Git-commit: 36fba366cf9fa386e5905976e68380061feabd2e +Patch-mainline: v5.10-rc3 +References: git-fixes + +clang warns about functions returning a 'const int' result: + +drivers/gpu/drm/imx/imx-tve.c:487:8: warning: type qualifiers ignored on function return type [-Wignored-qualifiers] + +Remove the extraneous 'const' qualifier here. I would guess that the +function was intended to be marked __attribute__((const)) instead, +but that would also be wrong since it call other functions without +that attribute. + +Fixes: fcbc51e54d2a ("staging: drm/imx: Add support for Television Encoder (TVEv2)") +Signed-off-by: Arnd Bergmann +Reviewed-by: Nick Desaulniers +Signed-off-by: Philipp Zabel +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/imx/imx-tve.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/imx/imx-tve.c b/drivers/gpu/drm/imx/imx-tve.c +index ef3c25d87d87..2a8d2e32e7b4 100644 +--- a/drivers/gpu/drm/imx/imx-tve.c ++++ b/drivers/gpu/drm/imx/imx-tve.c +@@ -484,7 +484,7 @@ static const char * const imx_tve_modes[] = { + [TVE_MODE_VGA] = "vga", + }; + +-static const int of_get_tve_mode(struct device_node *np) ++static int of_get_tve_mode(struct device_node *np) + { + const char *bm; + int ret, i; +-- +2.16.4 + diff --git a/patches.suse/drm-radeon-revert-Prefer-lower-feedback-dividers.patch b/patches.suse/drm-radeon-revert-Prefer-lower-feedback-dividers.patch index a9b4da1..c28b369 100644 --- a/patches.suse/drm-radeon-revert-Prefer-lower-feedback-dividers.patch +++ b/patches.suse/drm-radeon-revert-Prefer-lower-feedback-dividers.patch @@ -1,13 +1,13 @@ From 40eab0f8956724b0c2bb9e5679269632afb72b26 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Christian=20K=C3=B6nig?= +From: Christian König Date: Wed, 9 Sep 2020 13:12:46 +0200 Subject: [PATCH] drm/radeon: revert "Prefer lower feedback dividers" Mime-version: 1.0 Content-type: text/plain; charset=UTF-8 Content-transfer-encoding: 8bit -Git-commit: 40eab0f8956724b0c2bb9e5679269632afb72b26 +Git-commit: 0f3cd13d846105795de271ac64bb807df38513b7 No-fix: 5150dd85bdfa08143cacf1b4249121651bed3c35 -Patch-mainline: v5.9-rc6 +Patch-mainline: v5.10-rc1 References: git-fixes Turns out this breaks a lot of different hardware. diff --git a/patches.suse/drm-ttm-fix-eviction-valuable-range-check.patch b/patches.suse/drm-ttm-fix-eviction-valuable-range-check.patch new file mode 100644 index 0000000..ef00fb1 --- /dev/null +++ b/patches.suse/drm-ttm-fix-eviction-valuable-range-check.patch @@ -0,0 +1,43 @@ +From fea456d82c19d201c21313864105876deabe148b Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Tue, 20 Oct 2020 08:22:53 +1000 +Subject: [PATCH] drm/ttm: fix eviction valuable range check. +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: fea456d82c19d201c21313864105876deabe148b +Patch-mainline: v5.10-rc1 +References: git-fixes + +This was adding size to start, but pfn and start are in pages, +so it should be using num_pages. + +Not sure this fixes anything in the real world, just noticed it +during refactoring. + +Signed-off-by: Dave Airlie +Reviewed-by: Christian König +Cc: stable@vger.kernel.org +Link: https://patchwork.freedesktop.org/patch/msgid/20201019222257.1684769-2-airlied@gmail.com +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/ttm/ttm_bo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c +index 70b3bee27850..eb4b7df02ca0 100644 +--- a/drivers/gpu/drm/ttm/ttm_bo.c ++++ b/drivers/gpu/drm/ttm/ttm_bo.c +@@ -647,7 +647,7 @@ bool ttm_bo_eviction_valuable(struct ttm_buffer_object *bo, + /* Don't evict this BO if it's outside of the + * requested placement range + */ +- if (place->fpfn >= (bo->mem.start + bo->mem.size) || ++ if (place->fpfn >= (bo->mem.start + bo->mem.num_pages) || + (place->lpfn && place->lpfn <= bo->mem.start)) + return false; + +-- +2.16.4 + diff --git a/patches.suse/drm-vc4-drv-Add-error-handding-for-bind.patch b/patches.suse/drm-vc4-drv-Add-error-handding-for-bind.patch new file mode 100644 index 0000000..5097d43 --- /dev/null +++ b/patches.suse/drm-vc4-drv-Add-error-handding-for-bind.patch @@ -0,0 +1,35 @@ +From 9ce0af3e9573fb84c4c807183d13ea2a68271e4b Mon Sep 17 00:00:00 2001 +From: Hoegeun Kwon +Date: Tue, 27 Oct 2020 13:14:42 +0900 +Subject: [PATCH] drm/vc4: drv: Add error handding for bind +Git-commit: 9ce0af3e9573fb84c4c807183d13ea2a68271e4b +Patch-mainline: v5.10-rc2 +References: git-fixes + +There is a problem that if vc4_drm bind fails, a memory leak occurs on +the drm_property_create side. Add error handding for drm_mode_config. + +Signed-off-by: Hoegeun Kwon +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20201027041442.30352-2-hoegeun.kwon@samsung.com +Acked-by: Takashi Iwai + +--- + drivers/gpu/drm/vc4/vc4_drv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/vc4/vc4_drv.c b/drivers/gpu/drm/vc4/vc4_drv.c +index f1a5fd5dab6f..a17aa1db11b6 100644 +--- a/drivers/gpu/drm/vc4/vc4_drv.c ++++ b/drivers/gpu/drm/vc4/vc4_drv.c +@@ -314,6 +314,7 @@ static int vc4_drm_bind(struct device *dev) + component_unbind_all(dev, drm); + gem_destroy: + vc4_gem_destroy(drm); ++ drm_mode_config_cleanup(drm); + vc4_bo_cache_destroy(drm); + dev_put: + drm_dev_put(drm); +-- +2.16.4 + diff --git a/patches.suse/efivarfs-Replace-invalid-slashes-with-exclamation-ma.patch b/patches.suse/efivarfs-Replace-invalid-slashes-with-exclamation-ma.patch new file mode 100644 index 0000000..ba04e90 --- /dev/null +++ b/patches.suse/efivarfs-Replace-invalid-slashes-with-exclamation-ma.patch @@ -0,0 +1,43 @@ +From 336af6a4686d885a067ecea8c3c3dd129ba4fc75 Mon Sep 17 00:00:00 2001 +From: Michael Schaller +Date: Fri, 25 Sep 2020 09:45:02 +0200 +Subject: [PATCH] efivarfs: Replace invalid slashes with exclamation marks in dentries. +Git-commit: 336af6a4686d885a067ecea8c3c3dd129ba4fc75 +Patch-mainline: v5.10-rc1 +References: git-fixes + +Without this patch efivarfs_alloc_dentry creates dentries with slashes in +their name if the respective EFI variable has slashes in its name. This in +turn causes EIO on getdents64, which prevents a complete directory listing +of /sys/firmware/efi/efivars/. + +This patch replaces the invalid shlashes with exclamation marks like +kobject_set_name_vargs does for /sys/firmware/efi/vars/ to have consistently +named dentries under /sys/firmware/efi/vars/ and /sys/firmware/efi/efivars/. + +Signed-off-by: Michael Schaller +Link: https://lore.kernel.org/r/20200925074502.150448-1-misch@google.com +Signed-off-by: Ard Biesheuvel +Acked-by: Takashi Iwai + +--- + fs/efivarfs/super.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c +index 28bb5689333a..15880a68faad 100644 +--- a/fs/efivarfs/super.c ++++ b/fs/efivarfs/super.c +@@ -141,6 +141,9 @@ static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor, + + name[len + EFI_VARIABLE_GUID_LEN+1] = '\0'; + ++ /* replace invalid slashes like kobject_set_name_vargs does for /sys/firmware/efi/vars. */ ++ strreplace(name, '/', '!'); ++ + inode = efivarfs_get_inode(sb, d_inode(root), S_IFREG | 0644, 0, + is_removable); + if (!inode) +-- +2.16.4 + diff --git a/patches.suse/ftrace-fix-recursion-check-for-nmi-test.patch b/patches.suse/ftrace-fix-recursion-check-for-nmi-test.patch new file mode 100644 index 0000000..983b8c7 --- /dev/null +++ b/patches.suse/ftrace-fix-recursion-check-for-nmi-test.patch @@ -0,0 +1,49 @@ +From: "Steven Rostedt (VMware)" +Date: Thu, 29 Oct 2020 17:31:45 -0400 +Subject: ftrace: Fix recursion check for NMI test +Git-commit: ee11b93f95eabdf8198edd4668bf9102e7248270 +Patch-mainline: v5.10-rc3 +References: git-fixes + +The code that checks recursion will work to only do the recursion check once +if there's nested checks. The top one will do the check, the other nested +checks will see recursion was already checked and return zero for its "bit". +On the return side, nothing will be done if the "bit" is zero. + +The problem is that zero is returned for the "good" bit when in NMI context. +This will set the bit for NMIs making it look like *all* NMI tracing is +recursing, and prevent tracing of anything in NMI context! + +The simple fix is to return "bit + 1" and subtract that bit on the end to +get the real bit. + +Cc: stable@vger.kernel.org +Fixes: edc15cafcbfa3 ("tracing: Avoid unnecessary multiple recursion checks") +Signed-off-by: Steven Rostedt (VMware) +Acked-by: Miroslav Benes +--- + kernel/trace/trace.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h +index f3f5e77123ad..fee535a89560 100644 +--- a/kernel/trace/trace.h ++++ b/kernel/trace/trace.h +@@ -698,7 +698,7 @@ static __always_inline int trace_test_and_set_recursion(int start, int max) + current->trace_recursion = val; + barrier(); + +- return bit; ++ return bit + 1; + } + + static __always_inline void trace_clear_recursion(int bit) +@@ -708,6 +708,7 @@ static __always_inline void trace_clear_recursion(int bit) + if (!bit) + return; + ++ bit--; + bit = 1 << bit; + val &= ~bit; + + diff --git a/patches.suse/ftrace-handle-tracing-when-switching-between-context.patch b/patches.suse/ftrace-handle-tracing-when-switching-between-context.patch new file mode 100644 index 0000000..49d5f07 --- /dev/null +++ b/patches.suse/ftrace-handle-tracing-when-switching-between-context.patch @@ -0,0 +1,89 @@ +From: "Steven Rostedt (VMware)" +Date: Thu, 29 Oct 2020 19:35:08 -0400 +Subject: ftrace: Handle tracing when switching between context +Git-commit: 726b3d3f141fba6f841d715fc4d8a4a84f02c02a +Patch-mainline: v5.10-rc3 +References: git-fixes + +When an interrupt or NMI comes in and switches the context, there's a delay +from when the preempt_count() shows the update. As the preempt_count() is +used to detect recursion having each context have its own bit get set when +tracing starts, and if that bit is already set, it is considered a recursion +and the function exits. But if this happens in that section where context +has changed but preempt_count() has not been updated, this will be +incorrectly flagged as a recursion. + +To handle this case, create another bit call TRANSITION and test it if the +current context bit is already set. Flag the call as a recursion if the +TRANSITION bit is already set, and if not, set it and continue. The +TRANSITION bit will be cleared normally on the return of the function that +set it, or if the current context bit is clear, set it and clear the +TRANSITION bit to allow for another transition between the current context +and an even higher one. + +Cc: stable@vger.kernel.org +Fixes: edc15cafcbfa3 ("tracing: Avoid unnecessary multiple recursion checks") +Signed-off-by: Steven Rostedt (VMware) +Acked-by: Miroslav Benes +--- + kernel/trace/trace.h | 23 +++++++++++++++++++++-- + kernel/trace/trace_selftest.c | 9 +++++++-- + 2 files changed, 28 insertions(+), 4 deletions(-) + +--- a/kernel/trace/trace.h ++++ b/kernel/trace/trace.h +@@ -497,6 +497,12 @@ enum { + * can only be modified by current, we can reuse trace_recursion. + */ + TRACE_IRQ_BIT, ++ ++ /* ++ * When transitioning between context, the preempt_count() may ++ * not be correct. Allow for a single recursion to cover this case. ++ */ ++ TRACE_TRANSITION_BIT, + }; + + #define trace_recursion_set(bit) do { (current)->trace_recursion |= (1<<(bit)); } while (0) +@@ -541,8 +547,21 @@ static __always_inline int trace_test_an + return 0; + + bit = trace_get_context_bit() + start; +- if (unlikely(val & (1 << bit))) +- return -1; ++ if (unlikely(val & (1 << bit))) { ++ /* ++ * It could be that preempt_count has not been updated during ++ * a switch between contexts. Allow for a single recursion. ++ */ ++ bit = TRACE_TRANSITION_BIT; ++ if (trace_recursion_test(bit)) ++ return -1; ++ trace_recursion_set(bit); ++ barrier(); ++ return bit + 1; ++ } ++ ++ /* Normal check passed, clear the transition to allow it again */ ++ trace_recursion_clear(TRACE_TRANSITION_BIT); + + val |= 1 << bit; + current->trace_recursion = val; +--- a/kernel/trace/trace_selftest.c ++++ b/kernel/trace/trace_selftest.c +@@ -491,8 +491,13 @@ trace_selftest_function_recursion(void) + unregister_ftrace_function(&test_rec_probe); + + ret = -1; +- if (trace_selftest_recursion_cnt != 1) { +- pr_cont("*callback not called once (%d)* ", ++ /* ++ * Recursion allows for transitions between context, ++ * and may call the callback twice. ++ */ ++ if (trace_selftest_recursion_cnt != 1 && ++ trace_selftest_recursion_cnt != 2) { ++ pr_cont("*callback not called once (or twice) (%d)* ", + trace_selftest_recursion_cnt); + goto out; + } diff --git a/patches.suse/ibmvnic-add-missing-parenthesis-in-do_reset.patch b/patches.suse/ibmvnic-add-missing-parenthesis-in-do_reset.patch index 0747e1d..efa9017 100644 --- a/patches.suse/ibmvnic-add-missing-parenthesis-in-do_reset.patch +++ b/patches.suse/ibmvnic-add-missing-parenthesis-in-do_reset.patch @@ -4,7 +4,7 @@ Date: Fri, 4 Sep 2020 21:07:49 -0700 Subject: [PATCH] ibmvnic: add missing parenthesis in do_reset() References: bsc#1176700 ltc#188140 -Patch-mainline: v5.9 or v5.9-rc7 (next release) +Patch-mainline: v5.9-rc7 Git-commit: 8ae4dff882eb879c17bf46574201bd37fc6bc8b5 Indentation and logic clearly show that this code is missing diff --git a/patches.suse/icmp-randomize-the-global-rate-limiter.patch b/patches.suse/icmp-randomize-the-global-rate-limiter.patch new file mode 100644 index 0000000..cf78802 --- /dev/null +++ b/patches.suse/icmp-randomize-the-global-rate-limiter.patch @@ -0,0 +1,66 @@ +From: Eric Dumazet +Date: Thu, 15 Oct 2020 11:42:00 -0700 +Subject: icmp: randomize the global rate limiter +Patch-mainline: v5.10-rc1 +Git-commit: b38e7819cae946e2edf869e604af1e65a5d241c5 +References: CVE-2020-25705 bsc#1175721 git-fixes + +Keyu Man reported that the ICMP rate limiter could be used +by attackers to get useful signal. Details will be provided +in an upcoming academic publication. + +Our solution is to add some noise, so that the attackers +no longer can get help from the predictable token bucket limiter. + +Fixes: 4cdf507d5452 ("icmp: add a global rate limitation") +Signed-off-by: Eric Dumazet +Reported-by: Keyu Man +Signed-off-by: Jakub Kicinski +Acked-by: Michal Kubecek + +--- + Documentation/networking/ip-sysctl.txt | 4 +++- + net/ipv4/icmp.c | 7 +++++-- + 2 files changed, 8 insertions(+), 3 deletions(-) + +--- a/Documentation/networking/ip-sysctl.txt ++++ b/Documentation/networking/ip-sysctl.txt +@@ -903,12 +903,14 @@ icmp_ratelimit - INTEGER + icmp_msgs_per_sec - INTEGER + Limit maximal number of ICMP packets sent per second from this host. + Only messages whose type matches icmp_ratemask (see below) are +- controlled by this limit. ++ controlled by this limit. For security reasons, the precise count ++ of messages per second is randomized. + Default: 1000 + + icmp_msgs_burst - INTEGER + icmp_msgs_per_sec controls number of ICMP packets sent per second, + while icmp_msgs_burst controls the burst size of these packets. ++ For security reasons, the precise burst size is randomized. + Default: 50 + + icmp_ratemask - INTEGER +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -244,7 +244,7 @@ static struct { + /** + * icmp_global_allow - Are we allowed to send one more ICMP message ? + * +- * Uses a token bucket to limit our ICMP messages to sysctl_icmp_msgs_per_sec. ++ * Uses a token bucket to limit our ICMP messages to ~sysctl_icmp_msgs_per_sec. + * Returns false if we reached the limit and can not send another packet. + * Note: called with BH disabled + */ +@@ -271,7 +271,10 @@ bool icmp_global_allow(void) + } + credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst); + if (credit) { +- credit--; ++ /* We want to use a credit of one in average, but need to randomize ++ * it for security reasons. ++ */ ++ credit = max_t(int, credit - prandom_u32_max(3), 0); + rc = true; + } + icmp_global.credit = credit; diff --git a/patches.suse/kthread_worker-prevent-queuing-delayed-work-from-tim.patch b/patches.suse/kthread_worker-prevent-queuing-delayed-work-from-tim.patch new file mode 100644 index 0000000..484277a --- /dev/null +++ b/patches.suse/kthread_worker-prevent-queuing-delayed-work-from-tim.patch @@ -0,0 +1,47 @@ +From 6993d0fdbee0eb38bfac350aa016f65ad11ed3b1 Mon Sep 17 00:00:00 2001 +From: Zqiang +Date: Sun, 1 Nov 2020 17:07:53 -0800 +Subject: [PATCH] kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled +Git-commit: 6993d0fdbee0eb38bfac350aa016f65ad11ed3b1 +Patch-mainline: v5.10-rc3 +References: git-fixes + +There is a small race window when a delayed work is being canceled and +the work still might be queued from the timer_fn: + + CPU0 CPU1 +kthread_cancel_delayed_work_sync() + __kthread_cancel_work_sync() + __kthread_cancel_work() + work->canceling++; + kthread_delayed_work_timer_fn() + kthread_insert_work(); + +Bug: kthread_insert_work() should not get called when work->canceling is +set. + +Signed-off-by: Zqiang +Signed-off-by: Andrew Morton +Reviewed-by: Petr Mladek +Acked-by: Tejun Heo +Cc: +Link: https://lkml.kernel.org/r/20201014083030.16895-1-qiang.zhang@windriver.com +Signed-off-by: Linus Torvalds +Acked-by: Takashi Iwai + +--- + kernel/kthread.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/kthread.c ++++ b/kernel/kthread.c +@@ -837,7 +837,8 @@ void kthread_delayed_work_timer_fn(unsig + /* Move the work from worker->delayed_work_list. */ + WARN_ON_ONCE(list_empty(&work->node)); + list_del_init(&work->node); +- kthread_insert_work(worker, work, &worker->work_list); ++ if (!work->canceling) ++ kthread_insert_work(worker, work, &worker->work_list); + + spin_unlock(&worker->lock); + } diff --git a/patches.suse/leds-bcm6328-bcm6358-use-devres-LED-registering-func.patch b/patches.suse/leds-bcm6328-bcm6358-use-devres-LED-registering-func.patch new file mode 100644 index 0000000..fc45ebd --- /dev/null +++ b/patches.suse/leds-bcm6328-bcm6358-use-devres-LED-registering-func.patch @@ -0,0 +1,59 @@ +From ff5c89d44453e7ad99502b04bf798a3fc32c758b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Marek=20Beh=C3=BAn?= +Date: Fri, 18 Sep 2020 00:32:58 +0200 +Subject: [PATCH] leds: bcm6328, bcm6358: use devres LED registering function +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: ff5c89d44453e7ad99502b04bf798a3fc32c758b +Patch-mainline: v5.10-rc1 +References: git-fixes + +These two drivers do not provide remove method and use devres for +allocation of other resources, yet they use led_classdev_register +instead of the devres variant, devm_led_classdev_register. + +Fix this. + +Signed-off-by: Marek Behún +Cc: Álvaro Fernández Rojas +Cc: Kevin Cernekee +Cc: Jaedon Shin +Signed-off-by: Pavel Machek +Cc: stable@kernel.org +Acked-by: Takashi Iwai + +--- + drivers/leds/leds-bcm6328.c | 2 +- + drivers/leds/leds-bcm6358.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/leds/leds-bcm6328.c b/drivers/leds/leds-bcm6328.c +index 73b385d03c0e..d590a2d00bfd 100644 +--- a/drivers/leds/leds-bcm6328.c ++++ b/drivers/leds/leds-bcm6328.c +@@ -383,7 +383,7 @@ static int bcm6328_led(struct device *dev, struct device_node *nc, u32 reg, + led->cdev.brightness_set = bcm6328_led_set; + led->cdev.blink_set = bcm6328_blink_set; + +- rc = led_classdev_register(dev, &led->cdev); ++ rc = devm_led_classdev_register(dev, &led->cdev); + if (rc < 0) + return rc; + +diff --git a/drivers/leds/leds-bcm6358.c b/drivers/leds/leds-bcm6358.c +index 2f71f4b5b72e..eeec4f9c8fb7 100644 +--- a/drivers/leds/leds-bcm6358.c ++++ b/drivers/leds/leds-bcm6358.c +@@ -137,7 +137,7 @@ static int bcm6358_led(struct device *dev, struct device_node *nc, u32 reg, + + led->cdev.brightness_set = bcm6358_led_set; + +- rc = led_classdev_register(dev, &led->cdev); ++ rc = devm_led_classdev_register(dev, &led->cdev); + if (rc < 0) + return rc; + +-- +2.16.4 + diff --git a/patches.suse/livepatch-dump-ipa-clones.patch b/patches.suse/livepatch-dump-ipa-clones.patch index 242dfb7..c2fa504 100644 --- a/patches.suse/livepatch-dump-ipa-clones.patch +++ b/patches.suse/livepatch-dump-ipa-clones.patch @@ -15,19 +15,21 @@ kernel build. for GCC flags in Kconfig. SLE GCC supports the required option though. ] Signed-off-by: Miroslav Benes --- - Makefile | 4 ++++ + Makefile | 6 ++++++ kernel/livepatch/Kconfig | 7 +++++++ - 2 files changed, 11 insertions(+) + 2 files changed, 13 insertions(+) --- a/Makefile +++ b/Makefile -@@ -819,6 +819,10 @@ ifdef CONFIG_LIVEPATCH +@@ -819,6 +819,12 @@ ifdef CONFIG_LIVEPATCH KBUILD_CFLAGS += $(call cc-option, -flive-patching=inline-clone) endif +ifdef CONFIG_LIVEPATCH_IPA_CLONES ++ifeq ($(KBUILD_EXTMOD),) +KBUILD_CFLAGS += $(call cc-option, -fdump-ipa-clones) +endif ++endif + # arch Makefile may override CC so keep this after arch Makefile is included NOSTDINC_FLAGS += -nostdinc -isystem $(shell $(CC) -print-file-name=include) diff --git a/patches.suse/media-platform-Improve-queue-set-up-flow-for-bug-fix.patch b/patches.suse/media-platform-Improve-queue-set-up-flow-for-bug-fix.patch new file mode 100644 index 0000000..a54a2dd --- /dev/null +++ b/patches.suse/media-platform-Improve-queue-set-up-flow-for-bug-fix.patch @@ -0,0 +1,41 @@ +From 5095a6413a0cf896ab468009b6142cb0fe617e66 Mon Sep 17 00:00:00 2001 +From: Xia Jiang +Date: Fri, 14 Aug 2020 09:11:35 +0200 +Subject: [PATCH] media: platform: Improve queue set up flow for bug fixing +Git-commit: 5095a6413a0cf896ab468009b6142cb0fe617e66 +Patch-mainline: v5.10-rc1 +References: git-fixes + +Add checking created buffer size follow in mtk_jpeg_queue_setup(). + +Reviewed-by: Tomasz Figa +Signed-off-by: Xia Jiang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c +index d1b13556e18b..93347ab9b953 100644 +--- a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c ++++ b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c +@@ -571,6 +571,13 @@ static int mtk_jpeg_queue_setup(struct vb2_queue *q, + if (!q_data) + return -EINVAL; + ++ if (*num_planes) { ++ for (i = 0; i < *num_planes; i++) ++ if (sizes[i] < q_data->sizeimage[i]) ++ return -EINVAL; ++ return 0; ++ } ++ + *num_planes = q_data->fmt->colplanes; + for (i = 0; i < q_data->fmt->colplanes; i++) { + sizes[i] = q_data->sizeimage[i]; +-- +2.16.4 + diff --git a/patches.suse/media-tw5864-check-status-of-tw5864_frameinterval_ge.patch b/patches.suse/media-tw5864-check-status-of-tw5864_frameinterval_ge.patch new file mode 100644 index 0000000..c362ba2 --- /dev/null +++ b/patches.suse/media-tw5864-check-status-of-tw5864_frameinterval_ge.patch @@ -0,0 +1,63 @@ +From 780d815dcc9b34d93ae69385a8465c38d423ff0f Mon Sep 17 00:00:00 2001 +From: Tom Rix +Date: Mon, 10 Aug 2020 21:25:18 +0200 +Subject: [PATCH] media: tw5864: check status of tw5864_frameinterval_get +Git-commit: 780d815dcc9b34d93ae69385a8465c38d423ff0f +Patch-mainline: v5.10-rc1 +References: git-fixes + +clang static analysis reports this problem + +tw5864-video.c:773:32: warning: The left expression of the compound + assignment is an uninitialized value. + The computed value will also be garbage + fintv->stepwise.max.numerator *= std_max_fps; + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ + +stepwise.max is set with frameinterval, which comes from + + ret = tw5864_frameinterval_get(input, &frameinterval); + fintv->stepwise.step = frameinterval; + fintv->stepwise.min = frameinterval; + fintv->stepwise.max = frameinterval; + fintv->stepwise.max.numerator *= std_max_fps; + +When tw5864_frameinterval_get() fails, frameinterval is not +set. So check the status and fix another similar problem. + +Signed-off-by: Tom Rix +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/pci/tw5864/tw5864-video.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/media/pci/tw5864/tw5864-video.c b/drivers/media/pci/tw5864/tw5864-video.c +index f4bc72bbe2c5..9131265c2b87 100644 +--- a/drivers/media/pci/tw5864/tw5864-video.c ++++ b/drivers/media/pci/tw5864/tw5864-video.c +@@ -767,6 +767,9 @@ static int tw5864_enum_frameintervals(struct file *file, void *priv, + fintv->type = V4L2_FRMIVAL_TYPE_STEPWISE; + + ret = tw5864_frameinterval_get(input, &frameinterval); ++ if (ret) ++ return ret; ++ + fintv->stepwise.step = frameinterval; + fintv->stepwise.min = frameinterval; + fintv->stepwise.max = frameinterval; +@@ -785,6 +788,9 @@ static int tw5864_g_parm(struct file *file, void *priv, + cp->capability = V4L2_CAP_TIMEPERFRAME; + + ret = tw5864_frameinterval_get(input, &cp->timeperframe); ++ if (ret) ++ return ret; ++ + cp->timeperframe.numerator *= input->frame_interval; + cp->capturemode = 0; + cp->readbuffers = 2; +-- +2.16.4 + diff --git a/patches.suse/memcg-fix-null-pointer-dereference-in-_mem_cgroup_usage_unregister_event.patch b/patches.suse/memcg-fix-null-pointer-dereference-in-_mem_cgroup_usage_unregister_event.patch new file mode 100644 index 0000000..ae4dae3 --- /dev/null +++ b/patches.suse/memcg-fix-null-pointer-dereference-in-_mem_cgroup_usage_unregister_event.patch @@ -0,0 +1,124 @@ +From: Chunguang Xu +Date: Sat, 21 Mar 2020 18:22:10 -0700 +Subject: memcg: fix NULL pointer dereference in + __mem_cgroup_usage_unregister_event +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Git-commit: 7d36665a5886c27ca4c4d0afd3ecc50b400f3587 +Patch-mainline: v5.6-rc7 +References: bsc#1177703 + +An eventfd monitors multiple memory thresholds of the cgroup, closes them, +the kernel deletes all events related to this eventfd. Before all events +are deleted, another eventfd monitors the memory threshold of this cgroup, +leading to a crash: + + BUG: kernel NULL pointer dereference, address: 0000000000000004 + #PF: supervisor write access in kernel mode + #PF: error_code(0x0002) - not-present page + PGD 800000033058e067 P4D 800000033058e067 PUD 3355ce067 PMD 0 + Oops: 0002 [#1] SMP PTI + CPU: 2 PID: 14012 Comm: kworker/2:6 Kdump: loaded Not tainted 5.6.0-rc4 #3 + Hardware name: LENOVO 20AWS01K00/20AWS01K00, BIOS GLET70WW (2.24 ) 05/21/2014 + Workqueue: events memcg_event_remove + RIP: 0010:__mem_cgroup_usage_unregister_event+0xb3/0x190 + RSP: 0018:ffffb47e01c4fe18 EFLAGS: 00010202 + RAX: 0000000000000001 RBX: ffff8bb223a8a000 RCX: 0000000000000001 + RDX: 0000000000000001 RSI: ffff8bb22fb83540 RDI: 0000000000000001 + RBP: ffffb47e01c4fe48 R08: 0000000000000000 R09: 0000000000000010 + R10: 000000000000000c R11: 071c71c71c71c71c R12: ffff8bb226aba880 + R13: ffff8bb223a8a480 R14: 0000000000000000 R15: 0000000000000000 + FS:  0000000000000000(0000) GS:ffff8bb242680000(0000) knlGS:0000000000000000 + CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000004 CR3: 000000032c29c003 CR4: 00000000001606e0 + Call Trace: + memcg_event_remove+0x32/0x90 + process_one_work+0x172/0x380 + worker_thread+0x49/0x3f0 + kthread+0xf8/0x130 + ret_from_fork+0x35/0x40 + CR2: 0000000000000004 + +We can reproduce this problem in the following ways: + +1. We create a new cgroup subdirectory and a new eventfd, and then we + monitor multiple memory thresholds of the cgroup through this eventfd. + +2. closing this eventfd, and __mem_cgroup_usage_unregister_event () + will be called multiple times to delete all events related to this + eventfd. + +The first time __mem_cgroup_usage_unregister_event() is called, the +kernel will clear all items related to this eventfd in thresholds-> +primary. + +Since there is currently only one eventfd, thresholds-> primary becomes +empty, so the kernel will set thresholds-> primary and hresholds-> spare +to NULL. If at this time, the user creates a new eventfd and monitor +the memory threshold of this cgroup, kernel will re-initialize +thresholds-> primary. + +Then when __mem_cgroup_usage_unregister_event () is called for the +second time, because thresholds-> primary is not empty, the system will +access thresholds-> spare, but thresholds-> spare is NULL, which will +trigger a crash. + +In general, the longer it takes to delete all events related to this +eventfd, the easier it is to trigger this problem. + +The solution is to check whether the thresholds associated with the +eventfd has been cleared when deleting the event. If so, we do nothing. + +[akpm@linux-foundation.org: fix comment, per Kirill] +Fixes: 907860ed381a ("cgroups: make cftype.unregister_event() void-returning") +Signed-off-by: Chunguang Xu +Signed-off-by: Andrew Morton +Acked-by: Michal Hocko +Acked-by: Kirill A. Shutemov +Cc: Johannes Weiner +Cc: Vladimir Davydov +Cc: +Link: http://lkml.kernel.org/r/077a6f67-aefa-4591-efec-f2f3af2b0b02@gmail.com +Signed-off-by: Linus Torvalds +Acked-by: Michal Koutný +--- + mm/memcontrol.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index 2058b8da18db..50492aa9d61b 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -4027,7 +4027,7 @@ static void __mem_cgroup_usage_unregister_event(struct mem_cgroup *memcg, + struct mem_cgroup_thresholds *thresholds; + struct mem_cgroup_threshold_ary *new; + unsigned long usage; +- int i, j, size; ++ int i, j, size, entries; + + mutex_lock(&memcg->thresholds_lock); + +@@ -4047,14 +4047,20 @@ static void __mem_cgroup_usage_unregister_event(struct mem_cgroup *memcg, + __mem_cgroup_threshold(memcg, type == _MEMSWAP); + + /* Calculate new number of threshold */ +- size = 0; ++ size = entries = 0; + for (i = 0; i < thresholds->primary->size; i++) { + if (thresholds->primary->entries[i].eventfd != eventfd) + size++; ++ else ++ entries++; + } + + new = thresholds->spare; + ++ /* If no items related to eventfd have been cleared, nothing to do */ ++ if (!entries) ++ goto unlock; ++ + /* Set thresholds array to NULL if we don't have thresholds */ + if (!size) { + kfree(new); + diff --git a/patches.suse/mm-memcg-fix-refcount-error-while-moving-and-swapping.patch b/patches.suse/mm-memcg-fix-refcount-error-while-moving-and-swapping.patch new file mode 100644 index 0000000..f1426e4 --- /dev/null +++ b/patches.suse/mm-memcg-fix-refcount-error-while-moving-and-swapping.patch @@ -0,0 +1,61 @@ +From: Hugh Dickins +Date: Thu, 23 Jul 2020 21:15:24 -0700 +Subject: mm/memcg: fix refcount error while moving and swapping +Git-commit: 8d22a9351035ef2ff12ef163a1091b8b8cf1e49c +Patch-mainline: v5.8-rc7 +References: bsc#1178686 + +It was hard to keep a test running, moving tasks between memcgs with +move_charge_at_immigrate, while swapping: mem_cgroup_id_get_many()'s +refcount is discovered to be 0 (supposedly impossible), so it is then +forced to REFCOUNT_SATURATED, and after thousands of warnings in quick +succession, the test is at last put out of misery by being OOM killed. + +This is because of the way moved_swap accounting was saved up until the +task move gets completed in __mem_cgroup_clear_mc(), deferred from when +mem_cgroup_move_swap_account() actually exchanged old and new ids. +Concurrent activity can free up swap quicker than the task is scanned, +bringing id refcount down 0 (which should only be possible when +offlining). + +Just skip that optimization: do that part of the accounting immediately. + +Fixes: 615d66c37c75 ("mm: memcontrol: fix memcg id ref counter on swap charge move") +Signed-off-by: Hugh Dickins +Signed-off-by: Andrew Morton +Reviewed-by: Alex Shi +Cc: Johannes Weiner +Cc: Alex Shi +Cc: Shakeel Butt +Cc: Michal Hocko +Cc: +Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2007071431050.4726@eggly.anvils +Signed-off-by: Linus Torvalds +Acked-by: Michal Koutný +--- + mm/memcontrol.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index c75c4face02e..13f559af1ab6 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -5669,7 +5669,6 @@ static void __mem_cgroup_clear_mc(void) + if (!mem_cgroup_is_root(mc.to)) + page_counter_uncharge(&mc.to->memory, mc.moved_swap); + +- mem_cgroup_id_get_many(mc.to, mc.moved_swap); + css_put_many(&mc.to->css, mc.moved_swap); + + mc.moved_swap = 0; +@@ -5860,7 +5859,8 @@ static int mem_cgroup_move_charge_pte_range(pmd_t *pmd, + ent = target.ent; + if (!mem_cgroup_move_swap_account(ent, mc.from, mc.to)) { + mc.precharge--; +- /* we fixup refcnts and charges later. */ ++ mem_cgroup_id_get_many(mc.to, 1); ++ /* we fixup other refcnts and charges later. */ + mc.moved_swap++; + } + break; + diff --git a/patches.suse/mmc-sdhci-of-esdhc-set-timeout-to-max-before-tuning.patch b/patches.suse/mmc-sdhci-of-esdhc-set-timeout-to-max-before-tuning.patch new file mode 100644 index 0000000..07d7a58 --- /dev/null +++ b/patches.suse/mmc-sdhci-of-esdhc-set-timeout-to-max-before-tuning.patch @@ -0,0 +1,56 @@ +From 0add6e9b88d0632a25323aaf4987dbacb0e4ae64 Mon Sep 17 00:00:00 2001 +From: Michael Walle +Date: Fri, 23 Oct 2020 00:23:37 +0200 +Subject: [PATCH] mmc: sdhci-of-esdhc: set timeout to max before tuning +Git-commit: 0add6e9b88d0632a25323aaf4987dbacb0e4ae64 +Patch-mainline: v5.10-rc2 +References: git-fixes + +On rare occations there is the following error: + + mmc0: Tuning timeout, falling back to fixed sampling clock + +There are SD cards which takes a significant longer time to reply to the +first CMD19 command. The eSDHC takes the data timeout value into account +during the tuning period. The SDHCI core doesn't explicitly set this +timeout for the tuning procedure. Thus on the slow cards, there might be +a spurious "Buffer Read Ready" interrupt, which in turn triggers a wrong +sequence of events. In the end this will lead to an unsuccessful tuning +procedure and to the above error. + +To workaround this, set the timeout to the maximum value (which is the +best we can do) and the SDHCI core will take care of the proper timeout +handling. + +Fixes: ba49cbd0936e ("mmc: sdhci-of-esdhc: add tuning support") +Signed-off-by: Michael Walle +Acked-by: Adrian Hunter +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20201022222337.19857-1-michael@walle.cc +Signed-off-by: Ulf Hansson +Acked-by: Takashi Iwai + +--- + drivers/mmc/host/sdhci-of-esdhc.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/mmc/host/sdhci-of-esdhc.c ++++ b/drivers/mmc/host/sdhci-of-esdhc.c +@@ -830,6 +830,17 @@ static int esdhc_execute_tuning(struct m + + esdhc_tuning_block_enable(host, true); + ++ /* ++ * The eSDHC controller takes the data timeout value into account ++ * during tuning. If the SD card is too slow sending the response, the ++ * timer will expire and a "Buffer Read Ready" interrupt without data ++ * is triggered. This leads to tuning errors. ++ * ++ * Just set the timeout to the maximum value because the core will ++ * already take care of it in sdhci_send_tuning(). ++ */ ++ sdhci_writeb(host, 0xe, SDHCI_TIMEOUT_CONTROL); ++ + hs400_tuning = host->flags & SDHCI_HS400_TUNING; + ret = sdhci_execute_tuning(mmc, opcode); + diff --git a/patches.suse/msft-hv-1972-video-hyperv-hyperv_fb-Obtain-screen-resolution-from.patch b/patches.suse/msft-hv-1972-video-hyperv-hyperv_fb-Obtain-screen-resolution-from.patch new file mode 100644 index 0000000..14945ed --- /dev/null +++ b/patches.suse/msft-hv-1972-video-hyperv-hyperv_fb-Obtain-screen-resolution-from.patch @@ -0,0 +1,299 @@ +From: Wei Hu +Date: Thu, 5 Sep 2019 09:11:53 +0000 +Patch-mainline: v5.5-rc1 +References: bsc#1175306 +Subject: video: hyperv: hyperv_fb: Obtain screen resolution from Hyper-V host +Git-commit: 67e7cdb4829d3246c98f2ec9b771303ebe162eab + +Beginning from Windows 10 RS5+, VM screen resolution is obtained from host. +The "video=hyperv_fb" boot time option is not needed, but still can be +used to overwrite what the host specifies. The VM resolution on the host +could be set by executing the powershell "set-vmvideo" command. + +Signed-off-by: Iouri Tarassov +Signed-off-by: Wei Hu +Reviewed-by: Michael Kelley +Reviewed-by: Dexuan Cui +Signed-off-by: Sasha Levin +Acked-by: Olaf Hering +Acked-by: Thomas Zimmermann +--- + drivers/video/fbdev/hyperv_fb.c | 159 +++++++++++++++++++++++++++++++++++++--- + 1 file changed, 147 insertions(+), 12 deletions(-) + +diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c +--- a/drivers/video/fbdev/hyperv_fb.c ++++ b/drivers/video/fbdev/hyperv_fb.c +@@ -23,6 +23,14 @@ + * + * Portrait orientation is also supported: + * For example: video=hyperv_fb:864x1152 ++ * ++ * When a Windows 10 RS5+ host is used, the virtual machine screen ++ * resolution is obtained from the host. The "video=hyperv_fb" option is ++ * not needed, but still can be used to overwrite what the host specifies. ++ * The VM resolution on the host could be set by executing the powershell ++ * "set-vmvideo" command. For example ++ * set-vmvideo -vmname name -horizontalresolution:1920 \ ++ * -verticalresolution:1200 -resolutiontype single + */ + + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt +@@ -45,6 +53,10 @@ + #define SYNTHVID_VERSION(major, minor) ((minor) << 16 | (major)) + #define SYNTHVID_VERSION_WIN7 SYNTHVID_VERSION(3, 0) + #define SYNTHVID_VERSION_WIN8 SYNTHVID_VERSION(3, 2) ++#define SYNTHVID_VERSION_WIN10 SYNTHVID_VERSION(3, 5) ++ ++#define SYNTHVID_VER_GET_MAJOR(ver) (ver & 0x0000ffff) ++#define SYNTHVID_VER_GET_MINOR(ver) ((ver & 0xffff0000) >> 16) + + #define SYNTHVID_DEPTH_WIN7 16 + #define SYNTHVID_DEPTH_WIN8 32 +@@ -83,16 +95,25 @@ enum synthvid_msg_type { + SYNTHVID_POINTER_SHAPE = 8, + SYNTHVID_FEATURE_CHANGE = 9, + SYNTHVID_DIRT = 10, ++ SYNTHVID_RESOLUTION_REQUEST = 13, ++ SYNTHVID_RESOLUTION_RESPONSE = 14, + +- SYNTHVID_MAX = 11 ++ SYNTHVID_MAX = 15 + }; + ++#define SYNTHVID_EDID_BLOCK_SIZE 128 ++#define SYNTHVID_MAX_RESOLUTION_COUNT 64 ++ ++struct hvd_screen_info { ++ u16 width; ++ u16 height; ++} __packed; ++ + struct synthvid_msg_hdr { + u32 type; + u32 size; /* size of this header + payload after this field*/ + } __packed; + +- + struct synthvid_version_req { + u32 version; + } __packed; +@@ -103,6 +124,19 @@ struct synthvid_version_resp { + u8 max_video_outputs; + } __packed; + ++struct synthvid_supported_resolution_req { ++ u8 maximum_resolution_count; ++} __packed; ++ ++struct synthvid_supported_resolution_resp { ++ u8 edid_block[SYNTHVID_EDID_BLOCK_SIZE]; ++ u8 resolution_count; ++ u8 default_resolution_index; ++ u8 is_standard; ++ struct hvd_screen_info ++ supported_resolution[SYNTHVID_MAX_RESOLUTION_COUNT]; ++} __packed; ++ + struct synthvid_vram_location { + u64 user_ctx; + u8 is_vram_gpa_specified; +@@ -188,6 +222,8 @@ struct synthvid_msg { + struct synthvid_pointer_shape ptr_shape; + struct synthvid_feature_change feature_chg; + struct synthvid_dirt dirt; ++ struct synthvid_supported_resolution_req resolution_req; ++ struct synthvid_supported_resolution_resp resolution_resp; + }; + } __packed; + +@@ -226,6 +262,8 @@ struct hvfb_par { + + static uint screen_width = HVFB_WIDTH; + static uint screen_height = HVFB_HEIGHT; ++static uint screen_width_max = HVFB_WIDTH; ++static uint screen_height_max = HVFB_HEIGHT; + static uint screen_depth; + static uint screen_fb_size; + +@@ -356,6 +394,7 @@ static void synthvid_recv_sub(struct hv_device *hdev) + + /* Complete the wait event */ + if (msg->vid_hdr.type == SYNTHVID_VERSION_RESPONSE || ++ msg->vid_hdr.type == SYNTHVID_RESOLUTION_RESPONSE || + msg->vid_hdr.type == SYNTHVID_VRAM_LOCATION_ACK) { + memcpy(par->init_buf, msg, MAX_VMBUS_PKT_SIZE); + complete(&par->wait); +@@ -402,6 +441,17 @@ static void synthvid_receive(void *ctx) + } while (bytes_recvd > 0 && ret == 0); + } + ++/* Check if the ver1 version is equal or greater than ver2 */ ++static inline bool synthvid_ver_ge(u32 ver1, u32 ver2) ++{ ++ if (SYNTHVID_VER_GET_MAJOR(ver1) > SYNTHVID_VER_GET_MAJOR(ver2) || ++ (SYNTHVID_VER_GET_MAJOR(ver1) == SYNTHVID_VER_GET_MAJOR(ver2) && ++ SYNTHVID_VER_GET_MINOR(ver1) >= SYNTHVID_VER_GET_MINOR(ver2))) ++ return true; ++ ++ return false; ++} ++ + /* Check synthetic video protocol version with the host */ + static int synthvid_negotiate_ver(struct hv_device *hdev, u32 ver) + { +@@ -430,6 +480,64 @@ static int synthvid_negotiate_ver(struct hv_device *hdev, u32 ver) + } + + par->synthvid_version = ver; ++ pr_info("Synthvid Version major %d, minor %d\n", ++ SYNTHVID_VER_GET_MAJOR(ver), SYNTHVID_VER_GET_MINOR(ver)); ++ ++out: ++ return ret; ++} ++ ++/* Get current resolution from the host */ ++static int synthvid_get_supported_resolution(struct hv_device *hdev) ++{ ++ struct fb_info *info = hv_get_drvdata(hdev); ++ struct hvfb_par *par = info->par; ++ struct synthvid_msg *msg = (struct synthvid_msg *)par->init_buf; ++ int ret = 0; ++ unsigned long t; ++ u8 index; ++ int i; ++ ++ memset(msg, 0, sizeof(struct synthvid_msg)); ++ msg->vid_hdr.type = SYNTHVID_RESOLUTION_REQUEST; ++ msg->vid_hdr.size = sizeof(struct synthvid_msg_hdr) + ++ sizeof(struct synthvid_supported_resolution_req); ++ ++ msg->resolution_req.maximum_resolution_count = ++ SYNTHVID_MAX_RESOLUTION_COUNT; ++ synthvid_send(hdev, msg); ++ ++ t = wait_for_completion_timeout(&par->wait, VSP_TIMEOUT); ++ if (!t) { ++ pr_err("Time out on waiting resolution response\n"); ++ ret = -ETIMEDOUT; ++ goto out; ++ } ++ ++ if (msg->resolution_resp.resolution_count == 0) { ++ pr_err("No supported resolutions\n"); ++ ret = -ENODEV; ++ goto out; ++ } ++ ++ index = msg->resolution_resp.default_resolution_index; ++ if (index >= msg->resolution_resp.resolution_count) { ++ pr_err("Invalid resolution index: %d\n", index); ++ ret = -ENODEV; ++ goto out; ++ } ++ ++ for (i = 0; i < msg->resolution_resp.resolution_count; i++) { ++ screen_width_max = max_t(unsigned int, screen_width_max, ++ msg->resolution_resp.supported_resolution[i].width); ++ screen_height_max = max_t(unsigned int, screen_height_max, ++ msg->resolution_resp.supported_resolution[i].height); ++ } ++ ++ screen_width = ++ msg->resolution_resp.supported_resolution[index].width; ++ screen_height = ++ msg->resolution_resp.supported_resolution[index].height; + + out: + return ret; +@@ -450,11 +558,27 @@ static int synthvid_connect_vsp(struct hv_device *hdev) + } + + /* Negotiate the protocol version with host */ +- if (vmbus_proto_version == VERSION_WS2008 || +- vmbus_proto_version == VERSION_WIN7) +- ret = synthvid_negotiate_ver(hdev, SYNTHVID_VERSION_WIN7); +- else ++ switch (vmbus_proto_version) { ++ case VERSION_WIN10: ++ case VERSION_WIN10_V5: ++ ret = synthvid_negotiate_ver(hdev, SYNTHVID_VERSION_WIN10); ++ if (!ret) ++ break; ++ /* Fallthrough */ ++ case VERSION_WIN8: ++ case VERSION_WIN8_1: + ret = synthvid_negotiate_ver(hdev, SYNTHVID_VERSION_WIN8); ++ if (!ret) ++ break; ++ /* Fallthrough */ ++ case VERSION_WS2008: ++ case VERSION_WIN7: ++ ret = synthvid_negotiate_ver(hdev, SYNTHVID_VERSION_WIN7); ++ break; ++ default: ++ ret = synthvid_negotiate_ver(hdev, SYNTHVID_VERSION_WIN10); ++ break; ++ } + + if (ret) { + pr_err("Synthetic video device version not accepted\n"); +@@ -466,6 +590,12 @@ static int synthvid_connect_vsp(struct hv_device *hdev) + else + screen_depth = SYNTHVID_DEPTH_WIN8; + ++ if (synthvid_ver_ge(par->synthvid_version, SYNTHVID_VERSION_WIN10)) { ++ ret = synthvid_get_supported_resolution(hdev); ++ if (ret) ++ pr_info("Failed to get supported resolution from host, use default\n"); ++ } ++ + screen_fb_size = hdev->channel->offermsg.offer. + mmio_megabytes * 1024 * 1024; + +@@ -655,6 +785,8 @@ static void hvfb_get_option(struct fb_info *info) + } + + if (x < HVFB_WIDTH_MIN || y < HVFB_HEIGHT_MIN || ++ (synthvid_ver_ge(par->synthvid_version, SYNTHVID_VERSION_WIN10) && ++ (x > screen_width_max || y > screen_height_max)) || + (par->synthvid_version == SYNTHVID_VERSION_WIN8 && + x * y * screen_depth / 8 > SYNTHVID_FB_SIZE_WIN8) || + (par->synthvid_version == SYNTHVID_VERSION_WIN7 && +@@ -691,8 +823,12 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info) + } + + if (!(pci_resource_flags(pdev, 0) & IORESOURCE_MEM) || +- pci_resource_len(pdev, 0) < screen_fb_size) ++ pci_resource_len(pdev, 0) < screen_fb_size) { ++ pr_err("Resource not available or (0x%lx < 0x%lx)\n", ++ (unsigned long) pci_resource_len(pdev, 0), ++ (unsigned long) screen_fb_size); + goto err1; ++ } + + pot_end = pci_resource_end(pdev, 0); + pot_start = pot_end - screen_fb_size + 1; +@@ -781,17 +917,16 @@ static int hvfb_probe(struct hv_device *hdev, + goto error1; + } + ++ hvfb_get_option(info); ++ pr_info("Screen resolution: %dx%d, Color depth: %d\n", ++ screen_width, screen_height, screen_depth); ++ + ret = hvfb_getmem(hdev, info); + if (ret) { + pr_err("No memory for framebuffer\n"); + goto error2; + } + +- hvfb_get_option(info); +- pr_info("Screen resolution: %dx%d, Color depth: %d\n", +- screen_width, screen_height, screen_depth); +- +- + /* Set up fb_info */ + info->flags = FBINFO_DEFAULT; + diff --git a/patches.suse/msft-hv-1973-video-hyperv-hyperv_fb-Support-deferred-IO-for-Hyper.patch b/patches.suse/msft-hv-1973-video-hyperv-hyperv_fb-Support-deferred-IO-for-Hyper.patch new file mode 100644 index 0000000..1e636e1 --- /dev/null +++ b/patches.suse/msft-hv-1973-video-hyperv-hyperv_fb-Support-deferred-IO-for-Hyper.patch @@ -0,0 +1,424 @@ +From: Wei Hu +Date: Wed, 18 Sep 2019 06:03:20 +0000 +Patch-mainline: v5.5-rc1 +References: bsc#1175306 +Subject: video: hyperv: hyperv_fb: Support deferred IO for Hyper-V frame buffer driver +Git-commit: d21987d709e807ba7bbf47044deb56a3c02e8be4 + +Without deferred IO support, hyperv_fb driver informs the host to refresh +the entire guest frame buffer at fixed rate, e.g. at 20Hz, no matter there +is screen update or not. This patch supports deferred IO for screens in +graphics mode and also enables the frame buffer on-demand refresh. The +highest refresh rate is still set at 20Hz. + +Currently Hyper-V only takes a physical address from guest as the starting +address of frame buffer. This implies the guest must allocate contiguous +physical memory for frame buffer. In addition, Hyper-V Gen 2 VMs only +accept address from MMIO region as frame buffer address. Due to these +limitations on Hyper-V host, we keep a shadow copy of frame buffer +in the guest. This means one more copy of the dirty rectangle inside +guest when doing the on-demand refresh. This can be optimized in the +future with help from host. For now the host performance gain from deferred +IO outweighs the shadow copy impact in the guest. + +Signed-off-by: Wei Hu +Reviewed-by: Dexuan Cui +Reviewed-by: Michael Kelley +Signed-off-by: Sasha Levin +Acked-by: Olaf Hering +Acked-by: Thomas Zimmermann +--- + drivers/video/fbdev/Kconfig | 1 + + drivers/video/fbdev/hyperv_fb.c | 210 ++++++++++++++++++++++++++++++++++++---- + 2 files changed, 190 insertions(+), 21 deletions(-) + +diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig +--- a/drivers/video/fbdev/Kconfig ++++ b/drivers/video/fbdev/Kconfig +@@ -2214,6 +2214,7 @@ config FB_HYPERV + select FB_CFB_FILLRECT + select FB_CFB_COPYAREA + select FB_CFB_IMAGEBLIT ++ select FB_DEFERRED_IO + help + This framebuffer driver supports Microsoft Hyper-V Synthetic Video. + +diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c +--- a/drivers/video/fbdev/hyperv_fb.c ++++ b/drivers/video/fbdev/hyperv_fb.c +@@ -238,6 +238,7 @@ struct synthvid_msg { + #define RING_BUFSIZE (256 * 1024) + #define VSP_TIMEOUT (10 * HZ) + #define HVFB_UPDATE_DELAY (HZ / 20) ++#define HVFB_ONDEMAND_THROTTLE (HZ / 20) + + struct hvfb_par { + struct fb_info *info; +@@ -258,6 +259,16 @@ struct hvfb_par { + bool synchronous_fb; + + struct notifier_block hvfb_panic_nb; ++ ++ /* Memory for deferred IO and frame buffer itself */ ++ unsigned char *dio_vp; ++ unsigned char *mmio_vp; ++ unsigned long mmio_pp; ++ ++ /* Dirty rectangle, protected by delayed_refresh_lock */ ++ int x1, y1, x2, y2; ++ bool delayed_refresh; ++ spinlock_t delayed_refresh_lock; + }; + + static uint screen_width = HVFB_WIDTH; +@@ -266,6 +277,7 @@ static uint screen_width_max = HVFB_WIDTH; + static uint screen_height_max = HVFB_HEIGHT; + static uint screen_depth; + static uint screen_fb_size; ++static uint dio_fb_size; /* FB size for deferred IO */ + + /* Send message to Hyper-V host */ + static inline int synthvid_send(struct hv_device *hdev, +@@ -352,28 +364,88 @@ static int synthvid_send_ptr(struct hv_device *hdev) + } + + /* Send updated screen area (dirty rectangle) location to host */ +-static int synthvid_update(struct fb_info *info) ++static int ++synthvid_update(struct fb_info *info, int x1, int y1, int x2, int y2) + { + struct hv_device *hdev = device_to_hv_device(info->device); + struct synthvid_msg msg; + + memset(&msg, 0, sizeof(struct synthvid_msg)); ++ if (x2 == INT_MAX) ++ x2 = info->var.xres; ++ if (y2 == INT_MAX) ++ y2 = info->var.yres; + + msg.vid_hdr.type = SYNTHVID_DIRT; + msg.vid_hdr.size = sizeof(struct synthvid_msg_hdr) + + sizeof(struct synthvid_dirt); + msg.dirt.video_output = 0; + msg.dirt.dirt_count = 1; +- msg.dirt.rect[0].x1 = 0; +- msg.dirt.rect[0].y1 = 0; +- msg.dirt.rect[0].x2 = info->var.xres; +- msg.dirt.rect[0].y2 = info->var.yres; ++ msg.dirt.rect[0].x1 = (x1 > x2) ? 0 : x1; ++ msg.dirt.rect[0].y1 = (y1 > y2) ? 0 : y1; ++ msg.dirt.rect[0].x2 = ++ (x2 < x1 || x2 > info->var.xres) ? info->var.xres : x2; ++ msg.dirt.rect[0].y2 = ++ (y2 < y1 || y2 > info->var.yres) ? info->var.yres : y2; + + synthvid_send(hdev, &msg); + + return 0; + } + ++static void hvfb_docopy(struct hvfb_par *par, ++ unsigned long offset, ++ unsigned long size) ++{ ++ if (!par || !par->mmio_vp || !par->dio_vp || !par->fb_ready || ++ size == 0 || offset >= dio_fb_size) ++ return; ++ ++ if (offset + size > dio_fb_size) ++ size = dio_fb_size - offset; ++ ++ memcpy(par->mmio_vp + offset, par->dio_vp + offset, size); ++} ++ ++/* Deferred IO callback */ ++static void synthvid_deferred_io(struct fb_info *p, ++ struct list_head *pagelist) ++{ ++ struct hvfb_par *par = p->par; ++ struct page *page; ++ unsigned long start, end; ++ int y1, y2, miny, maxy; ++ ++ miny = INT_MAX; ++ maxy = 0; ++ ++ /* ++ * Merge dirty pages. It is possible that last page cross ++ * over the end of frame buffer row yres. This is taken care of ++ * in synthvid_update function by clamping the y2 ++ * value to yres. ++ */ ++ list_for_each_entry(page, pagelist, lru) { ++ start = page->index << PAGE_SHIFT; ++ end = start + PAGE_SIZE - 1; ++ y1 = start / p->fix.line_length; ++ y2 = end / p->fix.line_length; ++ miny = min_t(int, miny, y1); ++ maxy = max_t(int, maxy, y2); ++ ++ /* Copy from dio space to mmio address */ ++ if (par->fb_ready) ++ hvfb_docopy(par, start, PAGE_SIZE); ++ } ++ ++ if (par->fb_ready && par->update) ++ synthvid_update(p, 0, miny, p->var.xres, maxy + 1); ++} ++ ++static struct fb_deferred_io synthvid_defio = { ++ .delay = HZ / 20, ++ .deferred_io = synthvid_deferred_io, ++}; + + /* + * Actions on received messages from host: +@@ -620,7 +692,7 @@ static int synthvid_send_config(struct hv_device *hdev) + msg->vid_hdr.type = SYNTHVID_VRAM_LOCATION; + msg->vid_hdr.size = sizeof(struct synthvid_msg_hdr) + + sizeof(struct synthvid_vram_location); +- msg->vram.user_ctx = msg->vram.vram_gpa = info->fix.smem_start; ++ msg->vram.user_ctx = msg->vram.vram_gpa = par->mmio_pp; + msg->vram.is_vram_gpa_specified = 1; + synthvid_send(hdev, msg); + +@@ -630,7 +702,7 @@ static int synthvid_send_config(struct hv_device *hdev) + ret = -ETIMEDOUT; + goto out; + } +- if (msg->vram_ack.user_ctx != info->fix.smem_start) { ++ if (msg->vram_ack.user_ctx != par->mmio_pp) { + pr_err("Unable to set VRAM location\n"); + ret = -ENODEV; + goto out; +@@ -647,19 +719,77 @@ out: + + /* + * Delayed work callback: +- * It is called at HVFB_UPDATE_DELAY or longer time interval to process +- * screen updates. It is re-scheduled if further update is necessary. ++ * It is scheduled to call whenever update request is received and it has ++ * not been called in last HVFB_ONDEMAND_THROTTLE time interval. + */ + static void hvfb_update_work(struct work_struct *w) + { + struct hvfb_par *par = container_of(w, struct hvfb_par, dwork.work); + struct fb_info *info = par->info; ++ unsigned long flags; ++ int x1, x2, y1, y2; ++ int j; ++ ++ spin_lock_irqsave(&par->delayed_refresh_lock, flags); ++ /* Reset the request flag */ ++ par->delayed_refresh = false; ++ ++ /* Store the dirty rectangle to local variables */ ++ x1 = par->x1; ++ x2 = par->x2; ++ y1 = par->y1; ++ y2 = par->y2; ++ ++ /* Clear dirty rectangle */ ++ par->x1 = par->y1 = INT_MAX; ++ par->x2 = par->y2 = 0; ++ ++ spin_unlock_irqrestore(&par->delayed_refresh_lock, flags); ++ ++ if (x1 > info->var.xres || x2 > info->var.xres || ++ y1 > info->var.yres || y2 > info->var.yres || x2 <= x1) ++ return; ++ ++ /* Copy the dirty rectangle to frame buffer memory */ ++ for (j = y1; j < y2; j++) { ++ hvfb_docopy(par, ++ j * info->fix.line_length + ++ (x1 * screen_depth / 8), ++ (x2 - x1) * screen_depth / 8); ++ } ++ ++ /* Refresh */ ++ if (par->fb_ready && par->update) ++ synthvid_update(info, x1, y1, x2, y2); ++} + +- if (par->fb_ready) +- synthvid_update(info); ++/* ++ * Control the on-demand refresh frequency. It schedules a delayed ++ * screen update if it has not yet. ++ */ ++static void hvfb_ondemand_refresh_throttle(struct hvfb_par *par, ++ int x1, int y1, int w, int h) ++{ ++ unsigned long flags; ++ int x2 = x1 + w; ++ int y2 = y1 + h; ++ ++ spin_lock_irqsave(&par->delayed_refresh_lock, flags); ++ ++ /* Merge dirty rectangle */ ++ par->x1 = min_t(int, par->x1, x1); ++ par->y1 = min_t(int, par->y1, y1); ++ par->x2 = max_t(int, par->x2, x2); ++ par->y2 = max_t(int, par->y2, y2); ++ ++ /* Schedule a delayed screen update if not yet */ ++ if (par->delayed_refresh == false) { ++ schedule_delayed_work(&par->dwork, ++ HVFB_ONDEMAND_THROTTLE); ++ par->delayed_refresh = true; ++ } + +- if (par->update) +- schedule_delayed_work(&par->dwork, HVFB_UPDATE_DELAY); ++ spin_unlock_irqrestore(&par->delayed_refresh_lock, flags); + } + + static int hvfb_on_panic(struct notifier_block *nb, +@@ -671,7 +801,8 @@ static int hvfb_on_panic(struct notifier_block *nb, + par = container_of(nb, struct hvfb_par, hvfb_panic_nb); + par->synchronous_fb = true; + info = par->info; +- synthvid_update(info); ++ hvfb_docopy(par, 0, dio_fb_size); ++ synthvid_update(info, 0, 0, INT_MAX, INT_MAX); + + return NOTIFY_DONE; + } +@@ -732,7 +863,10 @@ static void hvfb_cfb_fillrect(struct fb_info *p, + + cfb_fillrect(p, rect); + if (par->synchronous_fb) +- synthvid_update(p); ++ synthvid_update(p, 0, 0, INT_MAX, INT_MAX); ++ else ++ hvfb_ondemand_refresh_throttle(par, rect->dx, rect->dy, ++ rect->width, rect->height); + } + + static void hvfb_cfb_copyarea(struct fb_info *p, +@@ -742,7 +876,10 @@ static void hvfb_cfb_copyarea(struct fb_info *p, + + cfb_copyarea(p, area); + if (par->synchronous_fb) +- synthvid_update(p); ++ synthvid_update(p, 0, 0, INT_MAX, INT_MAX); ++ else ++ hvfb_ondemand_refresh_throttle(par, area->dx, area->dy, ++ area->width, area->height); + } + + static void hvfb_cfb_imageblit(struct fb_info *p, +@@ -752,7 +889,10 @@ static void hvfb_cfb_imageblit(struct fb_info *p, + + cfb_imageblit(p, image); + if (par->synchronous_fb) +- synthvid_update(p); ++ synthvid_update(p, 0, 0, INT_MAX, INT_MAX); ++ else ++ hvfb_ondemand_refresh_throttle(par, image->dx, image->dy, ++ image->width, image->height); + } + + static struct fb_ops hvfb_ops = { +@@ -811,6 +951,9 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info) + resource_size_t pot_start, pot_end; + int ret; + ++ dio_fb_size = ++ screen_width * screen_height * screen_depth / 8; ++ + if (gen2vm) { + pot_start = 0; + pot_end = -1; +@@ -845,9 +988,14 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info) + if (!fb_virt) + goto err2; + ++ /* Allocate memory for deferred IO */ ++ par->dio_vp = vzalloc(round_up(dio_fb_size, PAGE_SIZE)); ++ if (par->dio_vp == NULL) ++ goto err3; ++ + info->apertures = alloc_apertures(1); + if (!info->apertures) +- goto err3; ++ goto err4; + + if (gen2vm) { + info->apertures->ranges[0].base = screen_info.lfb_base; +@@ -859,16 +1007,23 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info) + info->apertures->ranges[0].size = pci_resource_len(pdev, 0); + } + ++ /* Physical address of FB device */ ++ par->mmio_pp = par->mem->start; ++ /* Virtual address of FB device */ ++ par->mmio_vp = (unsigned char *) fb_virt; ++ + info->fix.smem_start = par->mem->start; +- info->fix.smem_len = screen_fb_size; +- info->screen_base = fb_virt; +- info->screen_size = screen_fb_size; ++ info->fix.smem_len = dio_fb_size; ++ info->screen_base = par->dio_vp; ++ info->screen_size = dio_fb_size; + + if (!gen2vm) + pci_dev_put(pdev); + + return 0; + ++err4: ++ vfree(par->dio_vp); + err3: + iounmap(fb_virt); + err2: +@@ -886,6 +1041,7 @@ static void hvfb_putmem(struct fb_info *info) + { + struct hvfb_par *par = info->par; + ++ vfree(par->dio_vp); + iounmap(info->screen_base); + vmbus_free_mmio(par->mem->start, screen_fb_size); + par->mem = NULL; +@@ -909,6 +1065,11 @@ static int hvfb_probe(struct hv_device *hdev, + init_completion(&par->wait); + INIT_DELAYED_WORK(&par->dwork, hvfb_update_work); + ++ par->delayed_refresh = false; ++ spin_lock_init(&par->delayed_refresh_lock); ++ par->x1 = par->y1 = INT_MAX; ++ par->x2 = par->y2 = 0; ++ + /* Connect to VSP */ + hv_set_drvdata(hdev, info); + ret = synthvid_connect_vsp(hdev); +@@ -960,6 +1121,10 @@ static int hvfb_probe(struct hv_device *hdev, + info->fbops = &hvfb_ops; + info->pseudo_palette = par->pseudo_palette; + ++ /* Initialize deferred IO */ ++ info->fbdefio = &synthvid_defio; ++ fb_deferred_io_init(info); ++ + /* Send config to host */ + ret = synthvid_send_config(hdev); + if (ret) +@@ -981,6 +1146,7 @@ static int hvfb_probe(struct hv_device *hdev, + return 0; + + error: ++ fb_deferred_io_cleanup(info); + hvfb_putmem(info); + error2: + vmbus_close(hdev->channel); +@@ -1003,6 +1169,8 @@ static int hvfb_remove(struct hv_device *hdev) + par->update = false; + par->fb_ready = false; + ++ fb_deferred_io_cleanup(info); ++ + unregister_framebuffer(info); + cancel_delayed_work_sync(&par->dwork); + diff --git a/patches.suse/msft-hv-2010-hv_netvsc-Add-XDP-support.patch b/patches.suse/msft-hv-2010-hv_netvsc-Add-XDP-support.patch new file mode 100644 index 0000000..9e79007 --- /dev/null +++ b/patches.suse/msft-hv-2010-hv_netvsc-Add-XDP-support.patch @@ -0,0 +1,850 @@ +From: Haiyang Zhang +Date: Thu, 23 Jan 2020 13:52:34 -0800 +Patch-mainline: v5.6-rc1 +Subject: hv_netvsc: Add XDP support +Git-commit: 351e1581395fcc7fb952bbd7dda01238f69968fd +References: bsc#1177819, bsc#1177820 + +This patch adds support of XDP in native mode for hv_netvsc driver, and +transparently sets the XDP program on the associated VF NIC as well. + +Setting / unsetting XDP program on synthetic NIC (netvsc) propagates to +VF NIC automatically. Setting / unsetting XDP program on VF NIC directly +is not recommended, also not propagated to synthetic NIC, and may be +overwritten by setting of synthetic NIC. + +The Azure/Hyper-V synthetic NIC receive buffer doesn't provide headroom +for XDP. We thought about re-use the RNDIS header space, but it's too +small. So we decided to copy the packets to a page buffer for XDP. And, +most of our VMs on Azure have Accelerated Network (SRIOV) enabled, so +most of the packets run on VF NIC. The synthetic NIC is considered as a +fallback data-path. So the data copy on netvsc won't impact performance +significantly. + +XDP program cannot run with LRO (RSC) enabled, so you need to disable LRO +before running XDP: + ethtool -K eth0 lro off + +XDP actions not yet supported: + XDP_REDIRECT + +Signed-off-by: Haiyang Zhang +Signed-off-by: David S. Miller +Acked-by: Olaf Hering +--- + drivers/net/hyperv/Makefile | 2 +- + drivers/net/hyperv/hyperv_net.h | 21 +++- + drivers/net/hyperv/netvsc.c | 31 +++++- + drivers/net/hyperv/netvsc_bpf.c | 209 ++++++++++++++++++++++++++++++++++++++ + drivers/net/hyperv/netvsc_drv.c | 183 +++++++++++++++++++++++++++------ + drivers/net/hyperv/rndis_filter.c | 2 +- + 6 files changed, 409 insertions(+), 39 deletions(-) + create mode 100644 drivers/net/hyperv/netvsc_bpf.c + +diff --git a/drivers/net/hyperv/Makefile b/drivers/net/hyperv/Makefile +--- a/drivers/net/hyperv/Makefile ++++ b/drivers/net/hyperv/Makefile +@@ -1,3 +1,3 @@ + obj-$(CONFIG_HYPERV_NET) += hv_netvsc.o + +-hv_netvsc-y := netvsc_drv.o netvsc.o rndis_filter.o netvsc_trace.o ++hv_netvsc-y := netvsc_drv.o netvsc.o rndis_filter.o netvsc_trace.o netvsc_bpf.o +diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h +--- a/drivers/net/hyperv/hyperv_net.h ++++ b/drivers/net/hyperv/hyperv_net.h +@@ -142,6 +142,8 @@ struct netvsc_device_info { + u32 send_section_size; + u32 recv_section_size; + ++ struct bpf_prog *bprog; ++ + u8 rss_key[NETVSC_HASH_KEYLEN]; + }; + +@@ -189,7 +191,8 @@ int netvsc_send(struct net_device *net, + struct hv_netvsc_packet *packet, + struct rndis_message *rndis_msg, + struct hv_page_buffer *page_buffer, +- struct sk_buff *skb); ++ struct sk_buff *skb, ++ bool xdp_tx); + void netvsc_linkstatus_callback(struct net_device *net, + struct rndis_message *resp); + int netvsc_recv_callback(struct net_device *net, +@@ -198,6 +201,16 @@ int netvsc_recv_callback(struct net_device *net, + void netvsc_channel_cb(void *context); + int netvsc_poll(struct napi_struct *napi, int budget); + ++u32 netvsc_run_xdp(struct net_device *ndev, struct netvsc_channel *nvchan, ++ struct xdp_buff *xdp); ++unsigned int netvsc_xdp_fraglen(unsigned int len); ++struct bpf_prog *netvsc_xdp_get(struct netvsc_device *nvdev); ++int netvsc_xdp_set(struct net_device *dev, struct bpf_prog *prog, ++ struct netlink_ext_ack *extack, ++ struct netvsc_device *nvdev); ++int netvsc_vf_setxdp(struct net_device *vf_netdev, struct bpf_prog *prog); ++int netvsc_bpf(struct net_device *dev, struct netdev_bpf *bpf); ++ + int rndis_set_subchannel(struct net_device *ndev, + struct netvsc_device *nvdev, + struct netvsc_device_info *dev_info); +@@ -832,6 +845,8 @@ struct nvsp_message { + #define RNDIS_MAX_PKT_DEFAULT 8 + #define RNDIS_PKT_ALIGN_DEFAULT 8 + ++#define NETVSC_XDP_HDRM 256 ++ + struct multi_send_data { + struct sk_buff *skb; /* skb containing the pkt */ + struct hv_netvsc_packet *pkt; /* netvsc pkt pending */ +@@ -867,6 +882,7 @@ struct netvsc_stats { + u64 bytes; + u64 broadcast; + u64 multicast; ++ u64 xdp_drop; + struct u64_stats_sync syncp; + }; + +@@ -972,6 +988,9 @@ struct netvsc_channel { + atomic_t queue_sends; + struct nvsc_rsc rsc; + ++ struct bpf_prog __rcu *bpf_prog; ++ struct xdp_rxq_info xdp_rxq; ++ + struct netvsc_stats tx_stats; + struct netvsc_stats rx_stats; + }; +diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c +--- a/drivers/net/hyperv/netvsc.c ++++ b/drivers/net/hyperv/netvsc.c +@@ -122,8 +122,10 @@ static void free_netvsc_device(struct rcu_head *head) + vfree(nvdev->send_buf); + kfree(nvdev->send_section_map); + +- for (i = 0; i < VRSS_CHANNEL_MAX; i++) ++ for (i = 0; i < VRSS_CHANNEL_MAX; i++) { ++ xdp_rxq_info_unreg(&nvdev->chan_table[i].xdp_rxq); + vfree(nvdev->chan_table[i].mrc.slots); ++ } + + kfree(nvdev); + } +@@ -900,7 +902,8 @@ int netvsc_send(struct net_device *ndev, + struct hv_netvsc_packet *packet, + struct rndis_message *rndis_msg, + struct hv_page_buffer *pb, +- struct sk_buff *skb) ++ struct sk_buff *skb, ++ bool xdp_tx) + { + struct net_device_context *ndev_ctx = netdev_priv(ndev); + struct netvsc_device *net_device +@@ -923,10 +926,11 @@ int netvsc_send(struct net_device *ndev, + packet->send_buf_index = NETVSC_INVALID_INDEX; + packet->cp_partial = false; + +- /* Send control message directly without accessing msd (Multi-Send +- * Data) field which may be changed during data packet processing. ++ /* Send a control message or XDP packet directly without accessing ++ * msd (Multi-Send Data) field which may be changed during data packet ++ * processing. + */ +- if (!skb) ++ if (!skb || xdp_tx) + return netvsc_send_pkt(device, packet, net_device, pb, skb); + + /* batch packets in send buffer if possible */ +@@ -1392,6 +1396,21 @@ struct netvsc_device *netvsc_device_add(struct hv_device *device, + nvchan->net_device = net_device; + u64_stats_init(&nvchan->tx_stats.syncp); + u64_stats_init(&nvchan->rx_stats.syncp); ++ ++ ret = xdp_rxq_info_reg(&nvchan->xdp_rxq, ndev, i); ++ ++ if (ret) { ++ netdev_err(ndev, "xdp_rxq_info_reg fail: %d\n", ret); ++ goto cleanup2; ++ } ++ ++ ret = xdp_rxq_info_reg_mem_model(&nvchan->xdp_rxq, ++ MEM_TYPE_PAGE_SHARED, NULL); ++ ++ if (ret) { ++ netdev_err(ndev, "xdp reg_mem_model fail: %d\n", ret); ++ goto cleanup2; ++ } + } + + /* Enable NAPI handler before init callbacks */ +@@ -1437,6 +1456,8 @@ close: + + cleanup: + netif_napi_del(&net_device->chan_table[0].napi); ++ ++cleanup2: + free_netvsc_device(&net_device->rcu); + + return ERR_PTR(ret); +diff --git a/drivers/net/hyperv/netvsc_bpf.c b/drivers/net/hyperv/netvsc_bpf.c +new file mode 100644 +index 000000000000..20adfe544294 +--- /dev/null ++++ b/drivers/net/hyperv/netvsc_bpf.c +@@ -0,0 +1,209 @@ ++// SPDX-License-Identifier: GPL-2.0-only ++/* Copyright (c) 2019, Microsoft Corporation. ++ * ++ * Author: ++ * Haiyang Zhang ++ */ ++ ++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt ++ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#include ++#include ++ ++#include "hyperv_net.h" ++ ++u32 netvsc_run_xdp(struct net_device *ndev, struct netvsc_channel *nvchan, ++ struct xdp_buff *xdp) ++{ ++ void *data = nvchan->rsc.data[0]; ++ u32 len = nvchan->rsc.len[0]; ++ struct page *page = NULL; ++ struct bpf_prog *prog; ++ u32 act = XDP_PASS; ++ ++ xdp->data_hard_start = NULL; ++ ++ rcu_read_lock(); ++ prog = rcu_dereference(nvchan->bpf_prog); ++ ++ if (!prog) ++ goto out; ++ ++ /* allocate page buffer for data */ ++ page = alloc_page(GFP_ATOMIC); ++ if (!page) { ++ act = XDP_DROP; ++ goto out; ++ } ++ ++ xdp->data_hard_start = page_address(page); ++ xdp->data = xdp->data_hard_start + NETVSC_XDP_HDRM; ++ xdp_set_data_meta_invalid(xdp); ++ xdp->data_end = xdp->data + len; ++ xdp->rxq = &nvchan->xdp_rxq; ++ xdp->handle = 0; ++ ++ memcpy(xdp->data, data, len); ++ ++ act = bpf_prog_run_xdp(prog, xdp); ++ ++ switch (act) { ++ case XDP_PASS: ++ case XDP_TX: ++ case XDP_DROP: ++ break; ++ ++ case XDP_ABORTED: ++ trace_xdp_exception(ndev, prog, act); ++ break; ++ ++ default: ++ bpf_warn_invalid_xdp_action(act); ++ } ++ ++out: ++ rcu_read_unlock(); ++ ++ if (page && act != XDP_PASS && act != XDP_TX) { ++ __free_page(page); ++ xdp->data_hard_start = NULL; ++ } ++ ++ return act; ++} ++ ++unsigned int netvsc_xdp_fraglen(unsigned int len) ++{ ++ return SKB_DATA_ALIGN(len) + ++ SKB_DATA_ALIGN(sizeof(struct skb_shared_info)); ++} ++ ++struct bpf_prog *netvsc_xdp_get(struct netvsc_device *nvdev) ++{ ++ return rtnl_dereference(nvdev->chan_table[0].bpf_prog); ++} ++ ++int netvsc_xdp_set(struct net_device *dev, struct bpf_prog *prog, ++ struct netlink_ext_ack *extack, ++ struct netvsc_device *nvdev) ++{ ++ struct bpf_prog *old_prog; ++ int buf_max, i; ++ ++ old_prog = netvsc_xdp_get(nvdev); ++ ++ if (!old_prog && !prog) ++ return 0; ++ ++ buf_max = NETVSC_XDP_HDRM + netvsc_xdp_fraglen(dev->mtu + ETH_HLEN); ++ if (prog && buf_max > PAGE_SIZE) { ++ netdev_err(dev, "XDP: mtu:%u too large, buf_max:%u\n", ++ dev->mtu, buf_max); ++ NL_SET_ERR_MSG_MOD(extack, "XDP: mtu too large"); ++ ++ return -EOPNOTSUPP; ++ } ++ ++ if (prog && (dev->features & NETIF_F_LRO)) { ++ netdev_err(dev, "XDP: not support LRO\n"); ++ NL_SET_ERR_MSG_MOD(extack, "XDP: not support LRO"); ++ ++ return -EOPNOTSUPP; ++ } ++ ++ if (prog) ++ bpf_prog_add(prog, nvdev->num_chn); ++ ++ for (i = 0; i < nvdev->num_chn; i++) ++ rcu_assign_pointer(nvdev->chan_table[i].bpf_prog, prog); ++ ++ if (old_prog) ++ for (i = 0; i < nvdev->num_chn; i++) ++ bpf_prog_put(old_prog); ++ ++ return 0; ++} ++ ++int netvsc_vf_setxdp(struct net_device *vf_netdev, struct bpf_prog *prog) ++{ ++ struct netdev_bpf xdp; ++ bpf_op_t ndo_bpf; ++ ++ ASSERT_RTNL(); ++ ++ if (!vf_netdev) ++ return 0; ++ ++ ndo_bpf = vf_netdev->netdev_ops->ndo_bpf; ++ if (!ndo_bpf) ++ return 0; ++ ++ memset(&xdp, 0, sizeof(xdp)); ++ ++ xdp.command = XDP_SETUP_PROG; ++ xdp.prog = prog; ++ ++ return ndo_bpf(vf_netdev, &xdp); ++} ++ ++static u32 netvsc_xdp_query(struct netvsc_device *nvdev) ++{ ++ struct bpf_prog *prog = netvsc_xdp_get(nvdev); ++ ++ if (prog) ++ return prog->aux->id; ++ ++ return 0; ++} ++ ++int netvsc_bpf(struct net_device *dev, struct netdev_bpf *bpf) ++{ ++ struct net_device_context *ndevctx = netdev_priv(dev); ++ struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev); ++ struct net_device *vf_netdev = rtnl_dereference(ndevctx->vf_netdev); ++ struct netlink_ext_ack *extack = bpf->extack; ++ int ret; ++ ++ if (!nvdev || nvdev->destroy) { ++ if (bpf->command == XDP_QUERY_PROG) { ++ bpf->prog_id = 0; ++ return 0; /* Query must always succeed */ ++ } else { ++ return -ENODEV; ++ } ++ } ++ ++ switch (bpf->command) { ++ case XDP_SETUP_PROG: ++ ret = netvsc_xdp_set(dev, bpf->prog, extack, nvdev); ++ ++ if (ret) ++ return ret; ++ ++ ret = netvsc_vf_setxdp(vf_netdev, bpf->prog); ++ ++ if (ret) { ++ netdev_err(dev, "vf_setxdp failed:%d\n", ret); ++ NL_SET_ERR_MSG_MOD(extack, "vf_setxdp failed"); ++ ++ netvsc_xdp_set(dev, NULL, extack, nvdev); ++ } ++ ++ return ret; ++ ++ case XDP_QUERY_PROG: ++ bpf->prog_id = netvsc_xdp_query(nvdev); ++ return 0; ++ ++ default: ++ return -EINVAL; ++ } ++} +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -519,7 +520,7 @@ static int netvsc_vf_xmit(struct net_device *net, struct net_device *vf_netdev, + return rc; + } + +-static int netvsc_start_xmit(struct sk_buff *skb, struct net_device *net) ++static int netvsc_xmit(struct sk_buff *skb, struct net_device *net, bool xdp_tx) + { + struct net_device_context *net_device_ctx = netdev_priv(net); + struct hv_netvsc_packet *packet = NULL; +@@ -686,7 +687,7 @@ static int netvsc_start_xmit(struct sk_buff *skb, struct net_device *net) + /* timestamp packet in software */ + skb_tx_timestamp(skb); + +- ret = netvsc_send(net, packet, rndis_msg, pb, skb); ++ ret = netvsc_send(net, packet, rndis_msg, pb, skb, xdp_tx); + if (likely(ret == 0)) + return NETDEV_TX_OK; + +@@ -709,6 +710,11 @@ no_memory: + goto drop; + } + ++static int netvsc_start_xmit(struct sk_buff *skb, struct net_device *ndev) ++{ ++ return netvsc_xmit(skb, ndev, false); ++} ++ + /* + * netvsc_linkstatus_callback - Link up/down notification + */ +@@ -751,6 +757,22 @@ void netvsc_linkstatus_callback(struct net_device *net, + schedule_delayed_work(&ndev_ctx->dwork, 0); + } + ++static void netvsc_xdp_xmit(struct sk_buff *skb, struct net_device *ndev) ++{ ++ int rc; ++ ++ skb->queue_mapping = skb_get_rx_queue(skb); ++ __skb_push(skb, ETH_HLEN); ++ ++ rc = netvsc_xmit(skb, ndev, true); ++ ++ if (dev_xmit_complete(rc)) ++ return; ++ ++ dev_kfree_skb_any(skb); ++ ndev->stats.tx_dropped++; ++} ++ + static void netvsc_comp_ipcsum(struct sk_buff *skb) + { + struct iphdr *iph = (struct iphdr *)skb->data; +@@ -760,7 +782,8 @@ static void netvsc_comp_ipcsum(struct sk_buff *skb) + } + + static struct sk_buff *netvsc_alloc_recv_skb(struct net_device *net, +- struct netvsc_channel *nvchan) ++ struct netvsc_channel *nvchan, ++ struct xdp_buff *xdp) + { + struct napi_struct *napi = &nvchan->napi; + const struct ndis_pkt_8021q_info *vlan = nvchan->rsc.vlan; +@@ -768,18 +791,37 @@ static struct sk_buff *netvsc_alloc_recv_skb(struct net_device *net, + const struct ndis_tcp_ip_checksum_info *csum_info = + nvchan->rsc.csum_info; + struct sk_buff *skb; ++ void *xbuf = xdp->data_hard_start; + int i; + +- skb = napi_alloc_skb(napi, nvchan->rsc.pktlen); +- if (!skb) +- return skb; ++ if (xbuf) { ++ unsigned int hdroom = xdp->data - xdp->data_hard_start; ++ unsigned int xlen = xdp->data_end - xdp->data; ++ unsigned int frag_size = netvsc_xdp_fraglen(hdroom + xlen); + +- /* +- * Copy to skb. This copy is needed here since the memory pointed by +- * hv_netvsc_packet cannot be deallocated +- */ +- for (i = 0; i < nvchan->rsc.cnt; i++) +- skb_put_data(skb, nvchan->rsc.data[i], nvchan->rsc.len[i]); ++ skb = build_skb(xbuf, frag_size); ++ ++ if (!skb) { ++ __free_page(virt_to_page(xbuf)); ++ return NULL; ++ } ++ ++ skb_reserve(skb, hdroom); ++ skb_put(skb, xlen); ++ skb->dev = napi->dev; ++ } else { ++ skb = napi_alloc_skb(napi, nvchan->rsc.pktlen); ++ ++ if (!skb) ++ return NULL; ++ ++ /* Copy to skb. This copy is needed here since the memory ++ * pointed by hv_netvsc_packet cannot be deallocated. ++ */ ++ for (i = 0; i < nvchan->rsc.cnt; i++) ++ skb_put_data(skb, nvchan->rsc.data[i], ++ nvchan->rsc.len[i]); ++ } + + skb->protocol = eth_type_trans(skb, net); + +@@ -829,13 +871,25 @@ int netvsc_recv_callback(struct net_device *net, + struct vmbus_channel *channel = nvchan->channel; + u16 q_idx = channel->offermsg.offer.sub_channel_index; + struct sk_buff *skb; +- struct netvsc_stats *rx_stats; ++ struct netvsc_stats *rx_stats = &nvchan->rx_stats; ++ struct xdp_buff xdp; ++ u32 act; + + if (net->reg_state != NETREG_REGISTERED) + return NVSP_STAT_FAIL; + ++ act = netvsc_run_xdp(net, nvchan, &xdp); ++ ++ if (act != XDP_PASS && act != XDP_TX) { ++ u64_stats_update_begin(&rx_stats->syncp); ++ rx_stats->xdp_drop++; ++ u64_stats_update_end(&rx_stats->syncp); ++ ++ return NVSP_STAT_SUCCESS; /* consumed by XDP */ ++ } ++ + /* Allocate a skb - TODO direct I/O to pages? */ +- skb = netvsc_alloc_recv_skb(net, nvchan); ++ skb = netvsc_alloc_recv_skb(net, nvchan, &xdp); + + if (unlikely(!skb)) { + ++net_device_ctx->eth_stats.rx_no_memory; +@@ -849,7 +903,6 @@ int netvsc_recv_callback(struct net_device *net, + * on the synthetic device because modifying the VF device + * statistics will not work correctly. + */ +- rx_stats = &nvchan->rx_stats; + u64_stats_update_begin(&rx_stats->syncp); + rx_stats->packets++; + rx_stats->bytes += nvchan->rsc.pktlen; +@@ -860,6 +913,11 @@ int netvsc_recv_callback(struct net_device *net, + ++rx_stats->multicast; + u64_stats_update_end(&rx_stats->syncp); + ++ if (act == XDP_TX) { ++ netvsc_xdp_xmit(skb, net); ++ return NVSP_STAT_SUCCESS; ++ } ++ + napi_gro_receive(&nvchan->napi, skb); + return NVSP_STAT_SUCCESS; + } +@@ -886,10 +944,11 @@ static void netvsc_get_channels(struct net_device *net, + /* Alloc struct netvsc_device_info, and initialize it from either existing + * struct netvsc_device, or from default values. + */ +-static struct netvsc_device_info *netvsc_devinfo_get +- (struct netvsc_device *nvdev) ++static ++struct netvsc_device_info *netvsc_devinfo_get(struct netvsc_device *nvdev) + { + struct netvsc_device_info *dev_info; ++ struct bpf_prog *prog; + + dev_info = kzalloc(sizeof(*dev_info), GFP_ATOMIC); + +@@ -897,6 +956,8 @@ static struct netvsc_device_info *netvsc_devinfo_get + return NULL; + + if (nvdev) { ++ ASSERT_RTNL(); ++ + dev_info->num_chn = nvdev->num_chn; + dev_info->send_sections = nvdev->send_section_cnt; + dev_info->send_section_size = nvdev->send_section_size; +@@ -905,6 +966,12 @@ static struct netvsc_device_info *netvsc_devinfo_get + + memcpy(dev_info->rss_key, nvdev->extension->rss_key, + NETVSC_HASH_KEYLEN); ++ ++ prog = netvsc_xdp_get(nvdev); ++ if (prog) { ++ bpf_prog_inc(prog); ++ dev_info->bprog = prog; ++ } + } else { + dev_info->num_chn = VRSS_CHANNEL_DEFAULT; + dev_info->send_sections = NETVSC_DEFAULT_TX; +@@ -916,6 +983,17 @@ static struct netvsc_device_info *netvsc_devinfo_get + return dev_info; + } + ++/* Free struct netvsc_device_info */ ++static void netvsc_devinfo_put(struct netvsc_device_info *dev_info) ++{ ++ if (dev_info->bprog) { ++ ASSERT_RTNL(); ++ bpf_prog_put(dev_info->bprog); ++ } ++ ++ kfree(dev_info); ++} ++ + static int netvsc_detach(struct net_device *ndev, + struct netvsc_device *nvdev) + { +@@ -927,6 +1005,8 @@ static int netvsc_detach(struct net_device *ndev, + if (cancel_work_sync(&nvdev->subchan_work)) + nvdev->num_chn = 1; + ++ netvsc_xdp_set(ndev, NULL, NULL, nvdev); ++ + /* If device was up (receiving) then shutdown */ + if (netif_running(ndev)) { + netvsc_tx_disable(nvdev, ndev); +@@ -960,7 +1040,8 @@ static int netvsc_attach(struct net_device *ndev, + struct hv_device *hdev = ndev_ctx->device_ctx; + struct netvsc_device *nvdev; + struct rndis_device *rdev; +- int ret; ++ struct bpf_prog *prog; ++ int ret = 0; + + nvdev = rndis_filter_device_add(hdev, dev_info); + if (IS_ERR(nvdev)) +@@ -976,6 +1057,13 @@ static int netvsc_attach(struct net_device *ndev, + } + } + ++ prog = dev_info->bprog; ++ if (prog) { ++ ret = netvsc_xdp_set(ndev, prog, NULL, nvdev); ++ if (ret) ++ goto err1; ++ } ++ + /* In any case device is now ready */ + netif_device_attach(ndev); + +@@ -985,7 +1073,7 @@ static int netvsc_attach(struct net_device *ndev, + if (netif_running(ndev)) { + ret = rndis_filter_open(nvdev); + if (ret) +- goto err; ++ goto err2; + + rdev = nvdev->extension; + if (!rdev->link_state) +@@ -994,9 +1082,10 @@ static int netvsc_attach(struct net_device *ndev, + + return 0; + +-err: ++err2: + netif_device_detach(ndev); + ++err1: + rndis_filter_device_remove(hdev, nvdev); + + return ret; +@@ -1046,7 +1135,7 @@ static int netvsc_set_channels(struct net_device *net, + } + + out: +- kfree(device_info); ++ netvsc_devinfo_put(device_info); + return ret; + } + +@@ -1153,7 +1242,7 @@ rollback_vf: + dev_set_mtu(vf_netdev, orig_mtu); + + out: +- kfree(device_info); ++ netvsc_devinfo_put(device_info); + return ret; + } + +@@ -1378,8 +1467,8 @@ static const struct { + /* statistics per queue (rx/tx packets/bytes) */ + #define NETVSC_PCPU_STATS_LEN (num_present_cpus() * ARRAY_SIZE(pcpu_stats)) + +-/* 4 statistics per queue (rx/tx packets/bytes) */ +-#define NETVSC_QUEUE_STATS_LEN(dev) ((dev)->num_chn * 4) ++/* 5 statistics per queue (rx/tx packets/bytes, rx xdp_drop) */ ++#define NETVSC_QUEUE_STATS_LEN(dev) ((dev)->num_chn * 5) + + static int netvsc_get_sset_count(struct net_device *dev, int string_set) + { +@@ -1411,6 +1500,7 @@ static void netvsc_get_ethtool_stats(struct net_device *dev, + struct netvsc_ethtool_pcpu_stats *pcpu_sum; + unsigned int start; + u64 packets, bytes; ++ u64 xdp_drop; + int i, j, cpu; + + if (!nvdev) +@@ -1439,9 +1529,11 @@ static void netvsc_get_ethtool_stats(struct net_device *dev, + start = u64_stats_fetch_begin_irq(&qstats->syncp); + packets = qstats->packets; + bytes = qstats->bytes; ++ xdp_drop = qstats->xdp_drop; + } while (u64_stats_fetch_retry_irq(&qstats->syncp, start)); + data[i++] = packets; + data[i++] = bytes; ++ data[i++] = xdp_drop; + } + + pcpu_sum = kvmalloc_array(num_possible_cpus(), +@@ -1489,6 +1581,8 @@ static void netvsc_get_strings(struct net_device *dev, u32 stringset, u8 *data) + p += ETH_GSTRING_LEN; + sprintf(p, "rx_queue_%u_bytes", i); + p += ETH_GSTRING_LEN; ++ sprintf(p, "rx_queue_%u_xdp_drop", i); ++ p += ETH_GSTRING_LEN; + } + + for_each_present_cpu(cpu) { +@@ -1785,10 +1879,27 @@ static int netvsc_set_ringparam(struct net_device *ndev, + } + + out: +- kfree(device_info); ++ netvsc_devinfo_put(device_info); + return ret; + } + ++static netdev_features_t netvsc_fix_features(struct net_device *ndev, ++ netdev_features_t features) ++{ ++ struct net_device_context *ndevctx = netdev_priv(ndev); ++ struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev); ++ ++ if (!nvdev || nvdev->destroy) ++ return features; ++ ++ if ((features & NETIF_F_LRO) && netvsc_xdp_get(nvdev)) { ++ features ^= NETIF_F_LRO; ++ netdev_info(ndev, "Skip LRO - unsupported with XDP\n"); ++ } ++ ++ return features; ++} ++ + static int netvsc_set_features(struct net_device *ndev, + netdev_features_t features) + { +@@ -1875,12 +1986,14 @@ static const struct net_device_ops device_ops = { + .ndo_start_xmit = netvsc_start_xmit, + .ndo_change_rx_flags = netvsc_change_rx_flags, + .ndo_set_rx_mode = netvsc_set_rx_mode, ++ .ndo_fix_features = netvsc_fix_features, + .ndo_set_features = netvsc_set_features, + .ndo_change_mtu = netvsc_change_mtu, + .ndo_validate_addr = eth_validate_addr, + .ndo_set_mac_address = netvsc_set_mac_addr, + .ndo_select_queue = netvsc_select_queue, + .ndo_get_stats64 = netvsc_get_stats64, ++ .ndo_bpf = netvsc_bpf, + }; + + /* +@@ -2167,6 +2280,7 @@ static int netvsc_register_vf(struct net_device *vf_netdev) + { + struct net_device_context *net_device_ctx; + struct netvsc_device *netvsc_dev; ++ struct bpf_prog *prog; + struct net_device *ndev; + int ret; + +@@ -2211,6 +2325,9 @@ static int netvsc_register_vf(struct net_device *vf_netdev) + + dev_hold(vf_netdev); + rcu_assign_pointer(net_device_ctx->vf_netdev, vf_netdev); ++ prog = netvsc_xdp_get(netvsc_dev); ++ netvsc_vf_setxdp(vf_netdev, prog); ++ + return NOTIFY_OK; + } + +@@ -2252,6 +2369,8 @@ static int netvsc_unregister_vf(struct net_device *vf_netdev) + + netdev_info(ndev, "VF unregistering: %s\n", vf_netdev->name); + ++ netvsc_vf_setxdp(vf_netdev, NULL); ++ + netdev_rx_handler_unregister(vf_netdev); + netdev_upper_dev_unlink(vf_netdev, ndev); + RCU_INIT_POINTER(net_device_ctx->vf_netdev, NULL); +@@ -2363,14 +2482,14 @@ static int netvsc_probe(struct hv_device *dev, + list_add(&net_device_ctx->list, &netvsc_dev_list); + rtnl_unlock(); + +- kfree(device_info); ++ netvsc_devinfo_put(device_info); + return 0; + + register_failed: + rtnl_unlock(); + rndis_filter_device_remove(dev, nvdev); + rndis_failed: +- kfree(device_info); ++ netvsc_devinfo_put(device_info); + devinfo_failed: + free_percpu(net_device_ctx->vf_stats); + no_stats: +@@ -2398,8 +2517,10 @@ static int netvsc_remove(struct hv_device *dev) + + rtnl_lock(); + nvdev = rtnl_dereference(ndev_ctx->nvdev); +- if (nvdev) ++ if (nvdev) { + cancel_work_sync(&nvdev->subchan_work); ++ netvsc_xdp_set(net, NULL, NULL, nvdev); ++ } + + /* + * Call to the vsc driver to let it know that the device is being +diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c +--- a/drivers/net/hyperv/rndis_filter.c ++++ b/drivers/net/hyperv/rndis_filter.c +@@ -235,7 +235,7 @@ static int rndis_filter_send_request(struct rndis_device *dev, + trace_rndis_send(dev->ndev, 0, &req->request_msg); + + rcu_read_lock_bh(); +- ret = netvsc_send(dev->ndev, packet, NULL, pb, NULL); ++ ret = netvsc_send(dev->ndev, packet, NULL, pb, NULL, false); + rcu_read_unlock_bh(); + + return ret; diff --git a/patches.suse/msft-hv-2015-video-hyperv-hyperv_fb-Use-physical-memory-for-fb-on.patch b/patches.suse/msft-hv-2015-video-hyperv-hyperv_fb-Use-physical-memory-for-fb-on.patch new file mode 100644 index 0000000..d93db6b --- /dev/null +++ b/patches.suse/msft-hv-2015-video-hyperv-hyperv_fb-Use-physical-memory-for-fb-on.patch @@ -0,0 +1,353 @@ +From: Wei Hu +Date: Mon, 9 Dec 2019 15:57:49 +0800 +Patch-mainline: v5.6-rc1 +References: bsc#1175306 +Subject: video: hyperv: hyperv_fb: Use physical memory for fb on HyperV Gen 1 VMs. +Git-commit: 3a6fb6c4255c3893ab61e2bd4e9ae01ca6bbcd94 + +On Hyper-V, Generation 1 VMs can directly use VM's physical memory for +their framebuffers. This can improve the efficiency of framebuffer and +overall performence for VM. The physical memory assigned to framebuffer +must be contiguous. We use CMA allocator to get contiguouse physicial +memory when the framebuffer size is greater than 4MB. For size under +4MB, we use alloc_pages to achieve this. + +To enable framebuffer memory allocation from CMA, supply a kernel +parameter to give enough space to CMA allocator at boot time. For +example: + cma=130m +This gives 130MB memory to CAM allocator that can be allocated to +framebuffer. If this fails, we fall back to the old way of using +mmio for framebuffer. + +Reported-by: kbuild test robot +Signed-off-by: Wei Hu +Acked-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Sasha Levin +Acked-by: Olaf Hering +--- + drivers/video/fbdev/Kconfig | 1 + + drivers/video/fbdev/hyperv_fb.c | 182 +++++++++++++++++++++++++++++++--------- + 2 files changed, 144 insertions(+), 39 deletions(-) + +diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig +--- a/drivers/video/fbdev/Kconfig ++++ b/drivers/video/fbdev/Kconfig +@@ -2215,6 +2215,7 @@ config FB_HYPERV + select FB_CFB_COPYAREA + select FB_CFB_IMAGEBLIT + select FB_DEFERRED_IO ++ select DMA_CMA if HAVE_DMA_CONTIGUOUS && CMA + help + This framebuffer driver supports Microsoft Hyper-V Synthetic Video. + +diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c +--- a/drivers/video/fbdev/hyperv_fb.c ++++ b/drivers/video/fbdev/hyperv_fb.c +@@ -31,6 +31,16 @@ + * "set-vmvideo" command. For example + * set-vmvideo -vmname name -horizontalresolution:1920 \ + * -verticalresolution:1200 -resolutiontype single ++ * ++ * Gen 1 VMs also support direct using VM's physical memory for framebuffer. ++ * It could improve the efficiency and performance for framebuffer and VM. ++ * This requires to allocate contiguous physical memory from Linux kernel's ++ * CMA memory allocator. To enable this, supply a kernel parameter to give ++ * enough memory space to CMA allocator for framebuffer. For example: ++ * cma=130m ++ * This gives 130MB memory to CMA allocator that can be allocated to ++ * framebuffer. For reference, 8K resolution (7680x4320) takes about ++ * 127MB memory. + */ + + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt +@@ -228,7 +238,6 @@ struct synthvid_msg { + } __packed; + + +- + /* FB driver definitions and structures */ + #define HVFB_WIDTH 1152 /* default screen width */ + #define HVFB_HEIGHT 864 /* default screen height */ +@@ -258,12 +267,15 @@ struct hvfb_par { + /* If true, the VSC notifies the VSP on every framebuffer change */ + bool synchronous_fb; + ++ /* If true, need to copy from deferred IO mem to framebuffer mem */ ++ bool need_docopy; ++ + struct notifier_block hvfb_panic_nb; + + /* Memory for deferred IO and frame buffer itself */ + unsigned char *dio_vp; + unsigned char *mmio_vp; +- unsigned long mmio_pp; ++ phys_addr_t mmio_pp; + + /* Dirty rectangle, protected by delayed_refresh_lock */ + int x1, y1, x2, y2; +@@ -434,7 +446,7 @@ static void synthvid_deferred_io(struct fb_info *p, + maxy = max_t(int, maxy, y2); + + /* Copy from dio space to mmio address */ +- if (par->fb_ready) ++ if (par->fb_ready && par->need_docopy) + hvfb_docopy(par, start, PAGE_SIZE); + } + +@@ -751,12 +763,12 @@ static void hvfb_update_work(struct work_struct *w) + return; + + /* Copy the dirty rectangle to frame buffer memory */ +- for (j = y1; j < y2; j++) { +- hvfb_docopy(par, +- j * info->fix.line_length + +- (x1 * screen_depth / 8), +- (x2 - x1) * screen_depth / 8); +- } ++ if (par->need_docopy) ++ for (j = y1; j < y2; j++) ++ hvfb_docopy(par, ++ j * info->fix.line_length + ++ (x1 * screen_depth / 8), ++ (x2 - x1) * screen_depth / 8); + + /* Refresh */ + if (par->fb_ready && par->update) +@@ -801,7 +813,8 @@ static int hvfb_on_panic(struct notifier_block *nb, + par = container_of(nb, struct hvfb_par, hvfb_panic_nb); + par->synchronous_fb = true; + info = par->info; +- hvfb_docopy(par, 0, dio_fb_size); ++ if (par->need_docopy) ++ hvfb_docopy(par, 0, dio_fb_size); + synthvid_update(info, 0, 0, INT_MAX, INT_MAX); + + return NOTIFY_DONE; +@@ -940,6 +953,62 @@ static void hvfb_get_option(struct fb_info *info) + return; + } + ++/* ++ * Allocate enough contiguous physical memory. ++ * Return physical address if succeeded or -1 if failed. ++ */ ++static phys_addr_t hvfb_get_phymem(struct hv_device *hdev, ++ unsigned int request_size) ++{ ++ struct page *page = NULL; ++ dma_addr_t dma_handle; ++ void *vmem; ++ phys_addr_t paddr = 0; ++ unsigned int order = get_order(request_size); ++ ++ if (request_size == 0) ++ return -1; ++ ++ if (order < MAX_ORDER) { ++ /* Call alloc_pages if the size is less than 2^MAX_ORDER */ ++ page = alloc_pages(GFP_KERNEL | __GFP_ZERO, order); ++ if (!page) ++ return -1; ++ ++ paddr = (page_to_pfn(page) << PAGE_SHIFT); ++ } else { ++ /* Allocate from CMA */ ++ hdev->device.coherent_dma_mask = DMA_BIT_MASK(64); ++ ++ vmem = dma_alloc_coherent(&hdev->device, ++ round_up(request_size, PAGE_SIZE), ++ &dma_handle, ++ GFP_KERNEL | __GFP_NOWARN); ++ ++ if (!vmem) ++ return -1; ++ ++ paddr = virt_to_phys(vmem); ++ } ++ ++ return paddr; ++} ++ ++/* Release contiguous physical memory */ ++static void hvfb_release_phymem(struct hv_device *hdev, ++ phys_addr_t paddr, unsigned int size) ++{ ++ unsigned int order = get_order(size); ++ ++ if (order < MAX_ORDER) ++ __free_pages(pfn_to_page(paddr >> PAGE_SHIFT), order); ++ else ++ dma_free_coherent(&hdev->device, ++ round_up(size, PAGE_SIZE), ++ phys_to_virt(paddr), ++ paddr); ++} ++ + + /* Get framebuffer memory from Hyper-V video pci space */ + static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info) +@@ -949,22 +1018,61 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info) + void __iomem *fb_virt; + int gen2vm = efi_enabled(EFI_BOOT); + resource_size_t pot_start, pot_end; ++ phys_addr_t paddr; + int ret; + +- dio_fb_size = +- screen_width * screen_height * screen_depth / 8; ++ info->apertures = alloc_apertures(1); ++ if (!info->apertures) ++ return -ENOMEM; + +- if (gen2vm) { +- pot_start = 0; +- pot_end = -1; +- } else { ++ if (!gen2vm) { + pdev = pci_get_device(PCI_VENDOR_ID_MICROSOFT, +- PCI_DEVICE_ID_HYPERV_VIDEO, NULL); ++ PCI_DEVICE_ID_HYPERV_VIDEO, NULL); + if (!pdev) { + pr_err("Unable to find PCI Hyper-V video\n"); ++ kfree(info->apertures); + return -ENODEV; + } + ++ info->apertures->ranges[0].base = pci_resource_start(pdev, 0); ++ info->apertures->ranges[0].size = pci_resource_len(pdev, 0); ++ ++ /* ++ * For Gen 1 VM, we can directly use the contiguous memory ++ * from VM. If we succeed, deferred IO happens directly ++ * on this allocated framebuffer memory, avoiding extra ++ * memory copy. ++ */ ++ paddr = hvfb_get_phymem(hdev, screen_fb_size); ++ if (paddr != (phys_addr_t) -1) { ++ par->mmio_pp = paddr; ++ par->mmio_vp = par->dio_vp = __va(paddr); ++ ++ info->fix.smem_start = paddr; ++ info->fix.smem_len = screen_fb_size; ++ info->screen_base = par->mmio_vp; ++ info->screen_size = screen_fb_size; ++ ++ par->need_docopy = false; ++ goto getmem_done; ++ } ++ pr_info("Unable to allocate enough contiguous physical memory on Gen 1 VM. Using MMIO instead.\n"); ++ } else { ++ info->apertures->ranges[0].base = screen_info.lfb_base; ++ info->apertures->ranges[0].size = screen_info.lfb_size; ++ } ++ ++ /* ++ * Cannot use the contiguous physical memory. ++ * Allocate mmio space for framebuffer. ++ */ ++ dio_fb_size = ++ screen_width * screen_height * screen_depth / 8; ++ ++ if (gen2vm) { ++ pot_start = 0; ++ pot_end = -1; ++ } else { + if (!(pci_resource_flags(pdev, 0) & IORESOURCE_MEM) || + pci_resource_len(pdev, 0) < screen_fb_size) { + pr_err("Resource not available or (0x%lx < 0x%lx)\n", +@@ -993,20 +1101,6 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info) + if (par->dio_vp == NULL) + goto err3; + +- info->apertures = alloc_apertures(1); +- if (!info->apertures) +- goto err4; +- +- if (gen2vm) { +- info->apertures->ranges[0].base = screen_info.lfb_base; +- info->apertures->ranges[0].size = screen_info.lfb_size; +- remove_conflicting_framebuffers(info->apertures, +- KBUILD_MODNAME, false); +- } else { +- info->apertures->ranges[0].base = pci_resource_start(pdev, 0); +- info->apertures->ranges[0].size = pci_resource_len(pdev, 0); +- } +- + /* Physical address of FB device */ + par->mmio_pp = par->mem->start; + /* Virtual address of FB device */ +@@ -1017,13 +1111,15 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info) + info->screen_base = par->dio_vp; + info->screen_size = dio_fb_size; + ++getmem_done: ++ remove_conflicting_framebuffers(info->apertures, ++ KBUILD_MODNAME, false); + if (!gen2vm) + pci_dev_put(pdev); ++ kfree(info->apertures); + + return 0; + +-err4: +- vfree(par->dio_vp); + err3: + iounmap(fb_virt); + err2: +@@ -1032,18 +1128,25 @@ err2: + err1: + if (!gen2vm) + pci_dev_put(pdev); ++ kfree(info->apertures); + + return -ENOMEM; + } + + /* Release the framebuffer */ +-static void hvfb_putmem(struct fb_info *info) ++static void hvfb_putmem(struct hv_device *hdev, struct fb_info *info) + { + struct hvfb_par *par = info->par; + +- vfree(par->dio_vp); +- iounmap(info->screen_base); +- vmbus_free_mmio(par->mem->start, screen_fb_size); ++ if (par->need_docopy) { ++ vfree(par->dio_vp); ++ iounmap(info->screen_base); ++ vmbus_free_mmio(par->mem->start, screen_fb_size); ++ } else { ++ hvfb_release_phymem(hdev, info->fix.smem_start, ++ screen_fb_size); ++ } ++ + par->mem = NULL; + } + +@@ -1062,6 +1165,7 @@ static int hvfb_probe(struct hv_device *hdev, + par = info->par; + par->info = info; + par->fb_ready = false; ++ par->need_docopy = true; + init_completion(&par->wait); + INIT_DELAYED_WORK(&par->dwork, hvfb_update_work); + +@@ -1147,7 +1251,7 @@ static int hvfb_probe(struct hv_device *hdev, + + error: + fb_deferred_io_cleanup(info); +- hvfb_putmem(info); ++ hvfb_putmem(hdev, info); + error2: + vmbus_close(hdev->channel); + error1: +@@ -1177,7 +1281,7 @@ static int hvfb_remove(struct hv_device *hdev) + vmbus_close(hdev->channel); + hv_set_drvdata(hdev, NULL); + +- hvfb_putmem(info); ++ hvfb_putmem(hdev, info); + framebuffer_release(info); + + return 0; diff --git a/patches.suse/msft-hv-2023-hv_netvsc-Fix-XDP-refcnt-for-synthetic-and-VF-NICs.patch b/patches.suse/msft-hv-2023-hv_netvsc-Fix-XDP-refcnt-for-synthetic-and-VF-NICs.patch new file mode 100644 index 0000000..c223370 --- /dev/null +++ b/patches.suse/msft-hv-2023-hv_netvsc-Fix-XDP-refcnt-for-synthetic-and-VF-NICs.patch @@ -0,0 +1,89 @@ +From: Haiyang Zhang +Date: Thu, 6 Feb 2020 14:01:05 -0800 +Patch-mainline: v5.6-rc1 +Subject: hv_netvsc: Fix XDP refcnt for synthetic and VF NICs +Git-commit: 184367dce4f744bde54377203305ccc8889aa79f +References: bsc#1177819, bsc#1177820 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The caller of XDP_SETUP_PROG has already incremented refcnt in +__bpf_prog_get(), so drivers should only increment refcnt by +num_queues - 1. + +To fix the issue, update netvsc_xdp_set() to add the correct number +to refcnt. + +Hold a refcnt in netvsc_xdp_set()’s other caller, netvsc_attach(). + +And, do the same in netvsc_vf_setxdp(). Otherwise, every time when VF is +removed and added from the host side, the refcnt will be decreased by one, +which may cause page fault when unloading xdp program. + +Fixes: 351e1581395f ("hv_netvsc: Add XDP support") +Signed-off-by: Haiyang Zhang +Signed-off-by: David S. Miller +Acked-by: Olaf Hering +--- + drivers/net/hyperv/netvsc_bpf.c | 13 +++++++++++-- + drivers/net/hyperv/netvsc_drv.c | 5 ++++- + 2 files changed, 15 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/hyperv/netvsc_bpf.c b/drivers/net/hyperv/netvsc_bpf.c +--- a/drivers/net/hyperv/netvsc_bpf.c ++++ b/drivers/net/hyperv/netvsc_bpf.c +@@ -120,7 +120,7 @@ int netvsc_xdp_set(struct net_device *dev, struct bpf_prog *prog, + } + + if (prog) +- bpf_prog_add(prog, nvdev->num_chn); ++ bpf_prog_add(prog, nvdev->num_chn - 1); + + for (i = 0; i < nvdev->num_chn; i++) + rcu_assign_pointer(nvdev->chan_table[i].bpf_prog, prog); +@@ -136,6 +136,7 @@ int netvsc_vf_setxdp(struct net_device *vf_netdev, struct bpf_prog *prog) + { + struct netdev_bpf xdp; + bpf_op_t ndo_bpf; ++ int ret; + + ASSERT_RTNL(); + +@@ -148,10 +149,18 @@ int netvsc_vf_setxdp(struct net_device *vf_netdev, struct bpf_prog *prog) + + memset(&xdp, 0, sizeof(xdp)); + ++ if (prog) ++ bpf_prog_inc(prog); ++ + xdp.command = XDP_SETUP_PROG; + xdp.prog = prog; + +- return ndo_bpf(vf_netdev, &xdp); ++ ret = ndo_bpf(vf_netdev, &xdp); ++ ++ if (ret && prog) ++ bpf_prog_put(prog); ++ ++ return ret; + } + + static u32 netvsc_xdp_query(struct netvsc_device *nvdev) +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -1059,9 +1059,12 @@ static int netvsc_attach(struct net_device *ndev, + + prog = dev_info->bprog; + if (prog) { ++ bpf_prog_inc(prog); + ret = netvsc_xdp_set(ndev, prog, NULL, nvdev); +- if (ret) ++ if (ret) { ++ bpf_prog_put(prog); + goto err1; ++ } + } + + /* In any case device is now ready */ diff --git a/patches.suse/msft-hv-2073-hv_netvsc-Fix-netvsc_start_xmit-s-return-type.patch b/patches.suse/msft-hv-2073-hv_netvsc-Fix-netvsc_start_xmit-s-return-type.patch index 9d1df4d..13e24a3 100644 --- a/patches.suse/msft-hv-2073-hv_netvsc-Fix-netvsc_start_xmit-s-return-type.patch +++ b/patches.suse/msft-hv-2073-hv_netvsc-Fix-netvsc_start_xmit-s-return-type.patch @@ -86,12 +86,12 @@ diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c --- a/drivers/net/hyperv/netvsc_drv.c +++ b/drivers/net/hyperv/netvsc_drv.c @@ -707,7 +707,8 @@ no_memory: - return rc; + goto drop; } --static int netvsc_start_xmit(struct sk_buff *skb, struct net_device *net) +-static int netvsc_start_xmit(struct sk_buff *skb, struct net_device *ndev) +static netdev_tx_t netvsc_start_xmit(struct sk_buff *skb, -+ struct net_device *net) ++ struct net_device *ndev) { - struct net_device_context *net_device_ctx = netdev_priv(net); - struct hv_netvsc_packet *packet = NULL; + return netvsc_xmit(skb, ndev, false); + } diff --git a/patches.suse/msft-hv-2164-hyperv_fb-Update-screen_info-after-removing-old-fram.patch b/patches.suse/msft-hv-2164-hyperv_fb-Update-screen_info-after-removing-old-fram.patch new file mode 100644 index 0000000..3f046fa --- /dev/null +++ b/patches.suse/msft-hv-2164-hyperv_fb-Update-screen_info-after-removing-old-fram.patch @@ -0,0 +1,50 @@ +From: Kairui Song +Date: Wed, 14 Oct 2020 17:24:29 +0800 +Patch-mainline: v5.10-rc2 +References: bsc#1175306 +Subject: hyperv_fb: Update screen_info after removing old framebuffer +Git-commit: 3cb73bc3fa2a3cb80b88aa63b48409939e0d996b + +On gen2 HyperV VM, hyperv_fb will remove the old framebuffer, and the +new allocated framebuffer address could be at a differnt location, +and it might be no longer a VGA framebuffer. + +Update screen_info so that after kexec the kernel won't try to reuse +the old invalid/stale framebuffer address as VGA, corrupting memory. + +[ mingo: Tidied up the changelog. ] + +Signed-off-by: Kairui Song +Signed-off-by: Ingo Molnar +Cc: Dexuan Cui +Cc: Jake Oshins +Cc: Wei Hu +Cc: "K. Y. Srinivasan" +Cc: Haiyang Zhang +Cc: Stephen Hemminger +Link: https://lore.kernel.org/r/20201014092429.1415040-3-kasong@redhat.com +Acked-by: Olaf Hering +--- + drivers/video/fbdev/hyperv_fb.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c +--- a/drivers/video/fbdev/hyperv_fb.c ++++ b/drivers/video/fbdev/hyperv_fb.c +@@ -1114,8 +1114,15 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info) + getmem_done: + remove_conflicting_framebuffers(info->apertures, + KBUILD_MODNAME, false); +- if (!gen2vm) ++ ++ if (gen2vm) { ++ /* framebuffer is reallocated, clear screen_info to avoid misuse from kexec */ ++ screen_info.lfb_size = 0; ++ screen_info.lfb_base = 0; ++ screen_info.orig_video_isVGA = 0; ++ } else { + pci_dev_put(pdev); ++ } + kfree(info->apertures); + + return 0; diff --git a/patches.suse/mtd-lpddr-Fix-bad-logic-in-print_drs_error.patch b/patches.suse/mtd-lpddr-Fix-bad-logic-in-print_drs_error.patch new file mode 100644 index 0000000..785c959 --- /dev/null +++ b/patches.suse/mtd-lpddr-Fix-bad-logic-in-print_drs_error.patch @@ -0,0 +1,55 @@ +From 1c9c02bb22684f6949d2e7ddc0a3ff364fd5a6fc Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Mon, 27 Apr 2020 14:50:37 -0500 +Subject: [PATCH] mtd: lpddr: Fix bad logic in print_drs_error +Git-commit: 1c9c02bb22684f6949d2e7ddc0a3ff364fd5a6fc +Patch-mainline: v5.10-rc1 +References: git-fixes + +Update logic for broken test. Use a more common logging style. + +It appears the logic in this function is broken for the +consecutive tests of + + if (prog_status & 0x3) + ... + else if (prog_status & 0x2) + ... + else (prog_status & 0x1) + ... + +Likely the first test should be + + if ((prog_status & 0x3) == 0x3) + +Found by inspection of include files using printk. + +Fixes: eb3db27507f7 ("[MTD] LPDDR PFOW definition") +Cc: stable@vger.kernel.org +Reported-by: Joe Perches +Signed-off-by: Gustavo A. R. Silva +Acked-by: Miquel Raynal +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/3fb0e29f5b601db8be2938a01d974b00c8788501.1588016644.git.gustavo@embeddedor.com +Acked-by: Takashi Iwai + +--- + include/linux/mtd/pfow.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/mtd/pfow.h b/include/linux/mtd/pfow.h +index 6166e7c60869..b8da6f8e854b 100644 +--- a/include/linux/mtd/pfow.h ++++ b/include/linux/mtd/pfow.h +@@ -128,7 +128,7 @@ static inline void print_drs_error(unsigned dsr) + + if (!(dsr & DSR_AVAILABLE)) + printk(KERN_NOTICE"DSR.15: (0) Device not Available\n"); +- if (prog_status & 0x03) ++ if ((prog_status & 0x03) == 0x03) + printk(KERN_NOTICE"DSR.9,8: (11) Attempt to program invalid " + "half with 41h command\n"); + else if (prog_status & 0x02) +-- +2.16.4 + diff --git a/patches.suse/net-usb-qmi_wwan-add-Telit-LE910Cx-0x1230-compositio.patch b/patches.suse/net-usb-qmi_wwan-add-Telit-LE910Cx-0x1230-compositio.patch new file mode 100644 index 0000000..12df2bf --- /dev/null +++ b/patches.suse/net-usb-qmi_wwan-add-Telit-LE910Cx-0x1230-compositio.patch @@ -0,0 +1,40 @@ +From 5fd8477ed8ca77e64b93d44a6dae4aa70c191396 Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Mon, 2 Nov 2020 12:01:08 +0100 +Subject: [PATCH] net: usb: qmi_wwan: add Telit LE910Cx 0x1230 composition +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: 5fd8477ed8ca77e64b93d44a6dae4aa70c191396 +Patch-mainline: v5.10-rc3 +References: git-fixes + +Add support for Telit LE910Cx 0x1230 composition: + +0x1230: tty, adb, rmnet, audio, tty, tty, tty, tty + +Signed-off-by: Daniele Palmas +Acked-by: Bjørn Mork +Link: https://lore.kernel.org/r/20201102110108.17244-1-dnlplm@gmail.com +Signed-off-by: Jakub Kicinski +Acked-by: Takashi Iwai + +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index a322f51873d0..581ed51abb53 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1309,6 +1309,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ + {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)}, /* Telit LE920, LE920A4 */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1230, 2)}, /* Telit LE910Cx */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1260, 2)}, /* Telit LE910Cx */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1261, 2)}, /* Telit LE910Cx */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1900, 1)}, /* Telit LN940 series */ +-- +2.16.4 + diff --git a/patches.suse/ocfs2-fix-unbalanced-locking.patch b/patches.suse/ocfs2-fix-unbalanced-locking.patch new file mode 100644 index 0000000..d79e264 --- /dev/null +++ b/patches.suse/ocfs2-fix-unbalanced-locking.patch @@ -0,0 +1,55 @@ +From c74821447915812231409bc1ee815007c1602a24 Mon Sep 17 00:00:00 2001 +From: Pavel Machek +Date: Thu, 6 Aug 2020 23:18:09 -0700 +Subject: [PATCH 2/6] ocfs2: fix unbalanced locking +Git-commit: 57c720d4144a9c2b88105c3e8f7b0e97e4b5cc93 +Patch-mainline: v5.9-rc1 +References: git-fixes + +Based on what fails, function can return with nfs_sync_rwlock either +locked or unlocked. That can not be right. + +Always return with lock unlocked on error. + +Fixes: 4cd9973f9ff6 ("ocfs2: avoid inode removal while nfsd is accessing it") +Signed-off-by: Pavel Machek (CIP) +Signed-off-by: Andrew Morton +Reviewed-by: Joseph Qi +Reviewed-by: Andrew Morton +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Gang He +Cc: Jun Piao +Link: http://lkml.kernel.org/r/20200724124443.GA28164@duo.ucw.cz +Signed-off-by: Linus Torvalds +Acked-by: Denis Kirjanov +--- + fs/ocfs2/dlmglue.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c +index 586b083e723e..9ccbf868f264 100644 +--- a/fs/ocfs2/dlmglue.c ++++ b/fs/ocfs2/dlmglue.c +@@ -2801,9 +2801,15 @@ int ocfs2_nfs_sync_lock(struct ocfs2_super *osb, int ex) + + status = ocfs2_cluster_lock(osb, lockres, ex ? LKM_EXMODE : LKM_PRMODE, + 0, 0); +- if (status < 0) ++ if (status < 0) { + mlog(ML_ERROR, "lock on nfs sync lock failed %d\n", status); + ++ if (ex) ++ up_write(&osb->nfs_sync_rwlock); ++ else ++ up_read(&osb->nfs_sync_rwlock); ++ } ++ + return status; + } + +-- +2.16.4 + diff --git a/patches.suse/p54-avoid-accessing-the-data-mapped-to-streaming-DMA.patch b/patches.suse/p54-avoid-accessing-the-data-mapped-to-streaming-DMA.patch new file mode 100644 index 0000000..8f3871c --- /dev/null +++ b/patches.suse/p54-avoid-accessing-the-data-mapped-to-streaming-DMA.patch @@ -0,0 +1,55 @@ +From 478762855b5ae9f68fa6ead1edf7abada70fcd5f Mon Sep 17 00:00:00 2001 +From: Jia-Ju Bai +Date: Sun, 2 Aug 2020 21:29:49 +0800 +Subject: [PATCH] p54: avoid accessing the data mapped to streaming DMA +Git-commit: 478762855b5ae9f68fa6ead1edf7abada70fcd5f +Patch-mainline: v5.10-rc1 +References: git-fixes + +In p54p_tx(), skb->data is mapped to streaming DMA on line 337: + mapping = pci_map_single(..., skb->data, ...); + +Then skb->data is accessed on line 349: + desc->device_addr = ((struct p54_hdr *)skb->data)->req_id; + +This access may cause data inconsistency between CPU cache and hardware. + +To fix this problem, ((struct p54_hdr *)skb->data)->req_id is stored in +a local variable before DMA mapping, and then the driver accesses this +local variable instead of skb->data. + +Cc: +Signed-off-by: Jia-Ju Bai +Acked-by: Christian Lamparter +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200802132949.26788-1-baijiaju@tsinghua.edu.cn +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/intersil/p54/p54pci.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/intersil/p54/p54pci.c ++++ b/drivers/net/wireless/intersil/p54/p54pci.c +@@ -332,10 +332,12 @@ static void p54p_tx(struct ieee80211_hw + struct p54p_desc *desc; + dma_addr_t mapping; + u32 idx, i; ++ __le32 device_addr; + + spin_lock_irqsave(&priv->lock, flags); + idx = le32_to_cpu(ring_control->host_idx[1]); + i = idx % ARRAY_SIZE(ring_control->tx_data); ++ device_addr = ((struct p54_hdr *)skb->data)->req_id; + + mapping = pci_map_single(priv->pdev, skb->data, skb->len, + PCI_DMA_TODEVICE); +@@ -349,7 +351,7 @@ static void p54p_tx(struct ieee80211_hw + + desc = &ring_control->tx_data[i]; + desc->host_addr = cpu_to_le32(mapping); +- desc->device_addr = ((struct p54_hdr *)skb->data)->req_id; ++ desc->device_addr = device_addr; + desc->len = cpu_to_le16(skb->len); + desc->flags = 0; + diff --git a/patches.suse/perf-core-fix-a-memory-leak-in-perf_event_parse_addr_filter.patch b/patches.suse/perf-core-fix-a-memory-leak-in-perf_event_parse_addr_filter.patch new file mode 100644 index 0000000..fdaa320 --- /dev/null +++ b/patches.suse/perf-core-fix-a-memory-leak-in-perf_event_parse_addr_filter.patch @@ -0,0 +1,93 @@ +From: =?utf-8?b?ImtpeWluKOWwueS6rikiIDxraXlpbkB0ZW5jZW50LmNvbT4=?= +Date: Wed, 4 Nov 2020 08:23:22 +0300 +Subject: perf/core: Fix a memory leak in perf_event_parse_addr_filter() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Git-commit: 7bdb157cdebbf95a1cd94ed2e01b338714075d00 +Patch-mainline: v5.10-rc3 +References: bsc#1178393, CVE-2020-25704 + +As shown through runtime testing, the "filename" allocation is not +always freed in perf_event_parse_addr_filter(). + +There are three possible ways that this could happen: + + - It could be allocated twice on subsequent iterations through the loop, + - or leaked on the success path, + - or on the failure path. + +Clean up the code flow to make it obvious that 'filename' is always +freed in the reallocation path and in the two return paths as well. + +We rely on the fact that kfree(NULL) is NOP and filename is initialized +with NULL. + +This fixes the leak. No other side effects expected. + +[ Dan Carpenter: cleaned up the code flow & added a changelog. ] +[ Ingo Molnar: updated the changelog some more. ] + +Fixes: 375637bc5249 ("perf/core: Introduce address range filtering") +Signed-off-by: "kiyin(尹亮)" +Signed-off-by: Dan Carpenter +Signed-off-by: Ingo Molnar +Cc: "Srivatsa S. Bhat" +Cc: Anthony Liguori +-- + kernel/events/core.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +Signed-off-by: Tony Jones +--- + kernel/events/core.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index da467e1dd49a..5a29ab09e72d 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -10085,6 +10085,7 @@ perf_event_parse_addr_filter(struct perf_event *event, char *fstr, + if (token == IF_SRC_FILE || token == IF_SRC_FILEADDR) { + int fpos = token == IF_SRC_FILE ? 2 : 1; + ++ kfree(filename); + filename = match_strdup(&args[fpos]); + if (!filename) { + ret = -ENOMEM; +@@ -10131,16 +10132,13 @@ perf_event_parse_addr_filter(struct perf_event *event, char *fstr, + */ + ret = -EOPNOTSUPP; + if (!event->ctx->task) +- goto fail_free_name; ++ goto fail; + + /* look up the path and grab its inode */ + ret = kern_path(filename, LOOKUP_FOLLOW, + &filter->path); + if (ret) +- goto fail_free_name; +- +- kfree(filename); +- filename = NULL; ++ goto fail; + + ret = -EINVAL; + if (!filter->path.dentry || +@@ -10160,13 +10158,13 @@ perf_event_parse_addr_filter(struct perf_event *event, char *fstr, + if (state != IF_STATE_ACTION) + goto fail; + ++ kfree(filename); + kfree(orig); + + return 0; + +-fail_free_name: +- kfree(filename); + fail: ++ kfree(filename); + free_filters_list(filters); + kfree(orig); + + diff --git a/patches.suse/power-supply-test_power-add-missing-newlines-when-pr.patch b/patches.suse/power-supply-test_power-add-missing-newlines-when-pr.patch new file mode 100644 index 0000000..992052c --- /dev/null +++ b/patches.suse/power-supply-test_power-add-missing-newlines-when-pr.patch @@ -0,0 +1,83 @@ +From c07fa6c1631333f02750cf59f22b615d768b4d8f Mon Sep 17 00:00:00 2001 +From: Xiongfeng Wang +Date: Fri, 4 Sep 2020 14:09:58 +0800 +Subject: [PATCH] power: supply: test_power: add missing newlines when printing parameters by sysfs +Git-commit: c07fa6c1631333f02750cf59f22b615d768b4d8f +Patch-mainline: v5.10-rc1 +References: git-fixes + +When I cat some module parameters by sysfs, it displays as follows. +It's better to add a newline for easy reading. + +root@syzkaller:~# cd /sys/module/test_power/parameters/ +root@syzkaller:/sys/module/test_power/parameters# cat ac_online +onroot@syzkaller:/sys/module/test_power/parameters# cat battery_present +trueroot@syzkaller:/sys/module/test_power/parameters# cat battery_health +goodroot@syzkaller:/sys/module/test_power/parameters# cat battery_status +dischargingroot@syzkaller:/sys/module/test_power/parameters# cat battery_technology +LIONroot@syzkaller:/sys/module/test_power/parameters# cat usb_online +onroot@syzkaller:/sys/module/test_power/parameters# + +Signed-off-by: Xiongfeng Wang +Signed-off-by: Sebastian Reichel +Acked-by: Takashi Iwai + +--- + drivers/power/supply/test_power.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/power/supply/test_power.c b/drivers/power/supply/test_power.c +index 04acd76bbaa1..4895ee5e63a9 100644 +--- a/drivers/power/supply/test_power.c ++++ b/drivers/power/supply/test_power.c +@@ -353,6 +353,7 @@ static int param_set_ac_online(const char *key, const struct kernel_param *kp) + static int param_get_ac_online(char *buffer, const struct kernel_param *kp) + { + strcpy(buffer, map_get_key(map_ac_online, ac_online, "unknown")); ++ strcat(buffer, "\n"); + return strlen(buffer); + } + +@@ -366,6 +367,7 @@ static int param_set_usb_online(const char *key, const struct kernel_param *kp) + static int param_get_usb_online(char *buffer, const struct kernel_param *kp) + { + strcpy(buffer, map_get_key(map_ac_online, usb_online, "unknown")); ++ strcat(buffer, "\n"); + return strlen(buffer); + } + +@@ -380,6 +382,7 @@ static int param_set_battery_status(const char *key, + static int param_get_battery_status(char *buffer, const struct kernel_param *kp) + { + strcpy(buffer, map_get_key(map_status, battery_status, "unknown")); ++ strcat(buffer, "\n"); + return strlen(buffer); + } + +@@ -394,6 +397,7 @@ static int param_set_battery_health(const char *key, + static int param_get_battery_health(char *buffer, const struct kernel_param *kp) + { + strcpy(buffer, map_get_key(map_health, battery_health, "unknown")); ++ strcat(buffer, "\n"); + return strlen(buffer); + } + +@@ -409,6 +413,7 @@ static int param_get_battery_present(char *buffer, + const struct kernel_param *kp) + { + strcpy(buffer, map_get_key(map_present, battery_present, "unknown")); ++ strcat(buffer, "\n"); + return strlen(buffer); + } + +@@ -426,6 +431,7 @@ static int param_get_battery_technology(char *buffer, + { + strcpy(buffer, + map_get_key(map_technology, battery_technology, "unknown")); ++ strcat(buffer, "\n"); + return strlen(buffer); + } + +-- +2.16.4 + diff --git a/patches.suse/powercap-Restrict-energy-meter-to-root-access.patch b/patches.suse/powercap-Restrict-energy-meter-to-root-access.patch new file mode 100644 index 0000000..373015f --- /dev/null +++ b/patches.suse/powercap-Restrict-energy-meter-to-root-access.patch @@ -0,0 +1,46 @@ +From: Len Brown +Date: Sat, 17 Oct 2020 16:06:48 +0200 +Subject: [PATCH] powercap: Restrict energy meter to root access +Git-commit: 949dd0104c496fa7c14991a23c03c62e44637e71 +Patch-mainline: v5.10-rc4 +References: bsc#1170415 CVE-2020-8694 + +Remove non-privileged user access to power data contained in +/sys/class/powercap/intel_rapl/*/energy_uj. + +Non-privileged users currently have read access to power data +and can use this data to form a security attack. Some privileged +drivers/applications need read access to this data, but don't expose it +to non-privileged users. + +For example, thermald uses this data to ensure that power management +works correctly. Thus removing non-privileged access is preferred +over completely disabling this power reporting capability with +CONFIG_INTEL_RAPL=n. + +Fixes: 95677a9a3847 ("PowerCap: Fix mode for energy counter") +Signed-off-by: Len Brown +Acked-by: Borislav Petkov +--- + drivers/powercap/powercap_sys.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c +index f808c5fa9838..3f0b8e2ef3d4 100644 +--- a/drivers/powercap/powercap_sys.c ++++ b/drivers/powercap/powercap_sys.c +@@ -367,9 +367,9 @@ static void create_power_zone_common_attributes( + &dev_attr_max_energy_range_uj.attr; + if (power_zone->ops->get_energy_uj) { + if (power_zone->ops->reset_energy_uj) +- dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUGO; ++ dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUSR; + else +- dev_attr_energy_uj.attr.mode = S_IRUGO; ++ dev_attr_energy_uj.attr.mode = S_IRUSR; + power_zone->zone_dev_attrs[count++] = + &dev_attr_energy_uj.attr; + } +-- +2.21.0 + diff --git a/patches.suse/powerpc-Fix-circular-dependency-between-percpu.h-and.patch b/patches.suse/powerpc-Fix-circular-dependency-between-percpu.h-and.patch new file mode 100644 index 0000000..3e969f0 --- /dev/null +++ b/patches.suse/powerpc-Fix-circular-dependency-between-percpu.h-and.patch @@ -0,0 +1,70 @@ +From a9bf0611fb243bd93070ba432dd13c45c0b5f8ff Mon Sep 17 00:00:00 2001 +From: Michael Ellerman +Date: Tue, 4 Aug 2020 22:44:06 +1000 +Subject: [PATCH 1/6] powerpc: Fix circular dependency between percpu.h and + mmu.h +Git-commit: 0c83b277ada72b585e6a3e52b067669df15bcedb +Patch-mainline: v5.9-rc1 +References: git-fixes + +Recently random.h started including percpu.h (see commit +f227e3ec3b5c ("random32: update the net random state on interrupt and +activity")), which broke corenet64_smp_defconfig: + + In file included from /linux/arch/powerpc/include/asm/paca.h:18, + from /linux/arch/powerpc/include/asm/percpu.h:13, + from /linux/include/linux/random.h:14, + from /linux/lib/uuid.c:14: + /linux/arch/powerpc/include/asm/mmu.h:139:22: error: unknown type name 'next_tlbcam_idx' + 139 | DECLARE_PER_CPU(int, next_tlbcam_idx); + +This is due to a circular header dependency: + asm/mmu.h includes asm/percpu.h, which includes asm/paca.h, which + includes asm/mmu.h + +Which means DECLARE_PER_CPU() isn't defined when mmu.h needs it. + +We can fix it by moving the include of paca.h below the include of +asm-generic/percpu.h. + +This moves the include of paca.h out of the #ifdef __powerpc64__, but +that is OK because paca.h is almost entirely inside #ifdef +CONFIG_PPC64 anyway. + +It also moves the include of paca.h out of the #ifdef CONFIG_SMP, +which could possibly break something, but seems to have no ill +effects. + +Fixes: f227e3ec3b5c ("random32: update the net random state on interrupt and activity") +Cc: stable@vger.kernel.org # v5.8 +Reported-by: Stephen Rothwell +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200804130558.292328-1-mpe@ellerman.id.au +Acked-by: Denis Kirjanov +--- + arch/powerpc/include/asm/percpu.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/include/asm/percpu.h b/arch/powerpc/include/asm/percpu.h +index 2cedefddba37..61c78205a1d3 100644 +--- a/arch/powerpc/include/asm/percpu.h ++++ b/arch/powerpc/include/asm/percpu.h +@@ -9,8 +9,6 @@ + + #ifdef CONFIG_SMP + +-#include +- + #define __my_cpu_offset local_paca->data_offset + + #endif /* CONFIG_SMP */ +@@ -18,4 +16,6 @@ + + #include + ++#include ++ + #endif /* _ASM_POWERPC_PERCPU_H_ */ +-- +2.16.4 + diff --git a/patches.suse/powerpc-pseries-cpuidle-add-polling-idle-for-shared-.patch b/patches.suse/powerpc-pseries-cpuidle-add-polling-idle-for-shared-.patch new file mode 100644 index 0000000..81c039c --- /dev/null +++ b/patches.suse/powerpc-pseries-cpuidle-add-polling-idle-for-shared-.patch @@ -0,0 +1,54 @@ +From f2ac428e0edabbca41b9dfe9473a90147962e4e9 Mon Sep 17 00:00:00 2001 +From: Nicholas Piggin +Date: Tue, 10 Oct 2017 17:11:09 +1000 +Subject: [PATCH] powerpc/pseries/cpuidle: add polling idle for shared + processor guests + +References: bsc#1178765 ltc#188968 +Patch-mainline: v4.16-rc1 +Git-commit: f2ac428e0edabbca41b9dfe9473a90147962e4e9 + +For shared processor guests (e.g., KVM), add an idle polling mode rather +than immediately returning to the hypervisor when the guest CPU goes +idle. + +Test setup is a 2 socket POWER9 with 4 guests running, each with vCPUs +equal to 1/2 of real of CPUs. Saturated each guest with tbench. Using +polling idle gives about 1.4x throughput. + +Kernel compile speed was not changed significantly. + +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Acked-by: Michal Suchanek +--- + drivers/cpuidle/cpuidle-pseries.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpuidle/cpuidle-pseries.c b/drivers/cpuidle/cpuidle-pseries.c +index 0f2b697cbb27..9e56bc411061 100644 +--- a/drivers/cpuidle/cpuidle-pseries.c ++++ b/drivers/cpuidle/cpuidle-pseries.c +@@ -174,11 +174,17 @@ static struct cpuidle_state dedicated_states[] = { + * States for shared partition case. + */ + static struct cpuidle_state shared_states[] = { ++ { /* Snooze */ ++ .name = "snooze", ++ .desc = "snooze", ++ .exit_latency = 0, ++ .target_residency = 0, ++ .enter = &snooze_loop }, + { /* Shared Cede */ + .name = "Shared Cede", + .desc = "Shared Cede", +- .exit_latency = 0, +- .target_residency = 0, ++ .exit_latency = 10, ++ .target_residency = 100, + .enter = &shared_cede_loop }, + }; + +-- +2.26.2 + diff --git a/patches.suse/powerpc-vnic-Extend-failover-pending-window.patch b/patches.suse/powerpc-vnic-Extend-failover-pending-window.patch new file mode 100644 index 0000000..1bbdd57 --- /dev/null +++ b/patches.suse/powerpc-vnic-Extend-failover-pending-window.patch @@ -0,0 +1,142 @@ +From 1d8504937478fdc2f3ef2174a816fd3302eca882 Mon Sep 17 00:00:00 2001 +From: Sukadev Bhattiprolu +Date: Fri, 30 Oct 2020 10:07:11 -0700 +Subject: [PATCH] powerpc/vnic: Extend "failover pending" window + +References: bsc#1176855 ltc#187293 +Patch-mainline: v5.10-rc3 +Git-commit: 1d8504937478fdc2f3ef2174a816fd3302eca882 + +Commit 5a18e1e0c193b introduced the 'failover_pending' state to track +the "failover pending window" - where we wait for the partner to become +ready (after a transport event) before actually attempting to failover. +i.e window is between following two events: + + a. we get a transport event due to a FAILOVER + + b. later, we get CRQ_INITIALIZED indicating the partner is + ready at which point we schedule a FAILOVER reset. + +and ->failover_pending is true during this window. + +If during this window, we attempt to open (or close) a device, we pretend +that the operation succeded and let the FAILOVER reset path complete the +operation. + +This is fine, except if the transport event ("a" above) occurs during the +open and after open has already checked whether a failover is pending. If +that happens, we fail the open, which can cause the boot scripts to leave +the interface down requiring administrator to manually bring up the device. + +This fix "extends" the failover pending window till we are _actually_ +ready to perform the failover reset (i.e until after we get the RTNL +lock). Since open() holds the RTNL lock, we can be sure that we either +finish the open or if the open() fails due to the failover pending window, +we can again pretend that open is done and let the failover complete it. + +We could try and block the open until failover is completed but a) that +could still timeout the application and b) Existing code "pretends" that +failover occurred "just after" open succeeded, so marks the open successful +and lets the failover complete the open. So, mark the open successful even +if the transport event occurs before we actually start the open. + +Fixes: 5a18e1e0c193 ("ibmvnic: Fix failover case for non-redundant configuration") +Signed-off-by: Sukadev Bhattiprolu +Acked-by: Dany Madden +Link: https://lore.kernel.org/r/20201030170711.1562994-1-sukadev@linux.ibm.com +Signed-off-by: Jakub Kicinski +Acked-by: Michal Suchanek +--- + drivers/net/ethernet/ibm/ibmvnic.c | 36 ++++++++++++++++++++++++++---- + 1 file changed, 32 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index af4dfbe28d56..da15913879f8 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1185,18 +1185,27 @@ static int ibmvnic_open(struct net_device *netdev) + if (adapter->state != VNIC_CLOSED) { + rc = ibmvnic_login(netdev); + if (rc) +- return rc; ++ goto out; + + rc = init_resources(adapter); + if (rc) { + netdev_err(netdev, "failed to initialize resources\n"); + release_resources(adapter); +- return rc; ++ goto out; + } + } + + rc = __ibmvnic_open(netdev); + ++out: ++ /* ++ * If open fails due to a pending failover, set device state and ++ * return. Device operation will be handled by reset routine. ++ */ ++ if (rc && adapter->failover_pending) { ++ adapter->state = VNIC_OPEN; ++ rc = 0; ++ } + return rc; + } + +@@ -1922,6 +1931,13 @@ static int do_reset(struct ibmvnic_adapter *adapter, + rwi->reset_reason); + + rtnl_lock(); ++ /* ++ * Now that we have the rtnl lock, clear any pending failover. ++ * This will ensure ibmvnic_open() has either completed or will ++ * block until failover is complete. ++ */ ++ if (rwi->reset_reason == VNIC_RESET_FAILOVER) ++ adapter->failover_pending = false; + + netif_carrier_off(netdev); + adapter->reset_reason = rwi->reset_reason; +@@ -2202,6 +2218,13 @@ static void __ibmvnic_reset(struct work_struct *work) + /* CHANGE_PARAM requestor holds rtnl_lock */ + rc = do_change_param_reset(adapter, rwi, reset_state); + } else if (adapter->force_reset_recovery) { ++ /* ++ * Since we are doing a hard reset now, clear the ++ * failover_pending flag so we don't ignore any ++ * future MOBILITY or other resets. ++ */ ++ adapter->failover_pending = false; ++ + /* Transport event occurred during previous reset */ + if (adapter->wait_for_reset) { + /* Previous was CHANGE_PARAM; caller locked */ +@@ -2266,9 +2289,15 @@ static int ibmvnic_reset(struct ibmvnic_adapter *adapter, + unsigned long flags; + int ret; + ++ /* ++ * If failover is pending don't schedule any other reset. ++ * Instead let the failover complete. If there is already a ++ * a failover reset scheduled, we will detect and drop the ++ * duplicate reset when walking the ->rwi_list below. ++ */ + if (adapter->state == VNIC_REMOVING || + adapter->state == VNIC_REMOVED || +- adapter->failover_pending) { ++ (adapter->failover_pending && reason != VNIC_RESET_FAILOVER)) { + ret = EBUSY; + netdev_dbg(netdev, "Adapter removing or pending failover, skipping reset\n"); + goto err; +@@ -4713,7 +4742,6 @@ static void ibmvnic_handle_crq(union ibmvnic_crq *crq, + case IBMVNIC_CRQ_INIT: + dev_info(dev, "Partner initialized\n"); + adapter->from_passive_init = true; +- adapter->failover_pending = false; + if (!completion_done(&adapter->init_done)) { + complete(&adapter->init_done); + adapter->init_done_rc = -EIO; +-- +2.26.2 + diff --git a/patches.suse/regulator-defer-probe-when-trying-to-get-voltage-fro.patch b/patches.suse/regulator-defer-probe-when-trying-to-get-voltage-fro.patch new file mode 100644 index 0000000..f699e93 --- /dev/null +++ b/patches.suse/regulator-defer-probe-when-trying-to-get-voltage-fro.patch @@ -0,0 +1,42 @@ +From cf1ad559a20d1930aa7b47a52f54e1f8718de301 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= +Date: Mon, 2 Nov 2020 22:27:27 +0100 +Subject: [PATCH] regulator: defer probe when trying to get voltage from unresolved supply +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: cf1ad559a20d1930aa7b47a52f54e1f8718de301 +Patch-mainline: v5.10-rc3 +References: git-fixes + +regulator_get_voltage_rdev() is called in regulator probe() when +applying machine constraints. The "fixed" commit exposed the problem +that non-bypassed regulators can forward the request to its parent +(like bypassed ones) supply. Return -EPROBE_DEFER when the supply +is expected but not resolved yet. + +Fixes: aea6cb99703e ("regulator: resolve supply after creating regulator") +Cc: stable@vger.kernel.org +Signed-off-by: Michał Mirosław +Reported-by: Ondřej Jirman +Reported-by: Corentin Labbe +Tested-by: Ondřej Jirman +Link: https://lore.kernel.org/r/a9041d68b4d35e4a2dd71629c8a6422662acb5ee.1604351936.git.mirq-linux@rere.qmqm.pl +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + drivers/regulator/core.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -3202,6 +3202,8 @@ static int _regulator_get_voltage(struct + ret = rdev->desc->fixed_uV; + } else if (rdev->supply) { + ret = _regulator_get_voltage(rdev->supply->rdev); ++ } else if (rdev->supply_name) { ++ return -EPROBE_DEFER; + } else { + return -EINVAL; + } diff --git a/patches.suse/regulator-resolve-supply-after-creating-regulator.patch b/patches.suse/regulator-resolve-supply-after-creating-regulator.patch new file mode 100644 index 0000000..e62531f --- /dev/null +++ b/patches.suse/regulator-resolve-supply-after-creating-regulator.patch @@ -0,0 +1,67 @@ +From aea6cb99703e17019e025aa71643b4d3e0a24413 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= +Date: Sat, 26 Sep 2020 23:32:41 +0200 +Subject: [PATCH] regulator: resolve supply after creating regulator +Mime-version: 1.0 +Content-type: text/plain; charset=UTF-8 +Content-transfer-encoding: 8bit +Git-commit: aea6cb99703e17019e025aa71643b4d3e0a24413 +Patch-mainline: v5.10-rc1 +References: git-fixes + +When creating a new regulator its supply cannot create the sysfs link +because the device is not yet published. Remove early supply resolving +since it will be done later anyway. This makes the following error +disappear and the symlinks get created instead. + + DCDC_REG1: supplied by VSYS + VSYS: could not add device link regulator.3 err -2 + +Note: It doesn't fix the problem for bypassed regulators, though. + +Fixes: 45389c47526d ("regulator: core: Add early supply resolution for regulators") +Signed-off-by: Michał Mirosław +Link: https://lore.kernel.org/r/ba09e0a8617ffeeb25cb4affffe6f3149319cef8.1601155770.git.mirq-linux@rere.qmqm.pl +Signed-off-by: Mark Brown +Acked-by: Takashi Iwai + +--- + drivers/regulator/core.c | 21 +++++++++++++-------- + 1 file changed, 13 insertions(+), 8 deletions(-) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index ff8e99ca0306..9f704a6c4802 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -5280,15 +5280,20 @@ regulator_register(const struct regulator_desc *regulator_desc, + else if (regulator_desc->supply_name) + rdev->supply_name = regulator_desc->supply_name; + +- /* +- * Attempt to resolve the regulator supply, if specified, +- * but don't return an error if we fail because we will try +- * to resolve it again later as more regulators are added. +- */ +- if (regulator_resolve_supply(rdev)) +- rdev_dbg(rdev, "unable to resolve supply\n"); +- + ret = set_machine_constraints(rdev, constraints); ++ if (ret == -EPROBE_DEFER) { ++ /* Regulator might be in bypass mode and so needs its supply ++ * to set the constraints */ ++ /* FIXME: this currently triggers a chicken-and-egg problem ++ * when creating -SUPPLY symlink in sysfs to a regulator ++ * that is just being created */ ++ ret = regulator_resolve_supply(rdev); ++ if (!ret) ++ ret = set_machine_constraints(rdev, constraints); ++ else ++ rdev_dbg(rdev, "unable to resolve supply early: %pe\n", ++ ERR_PTR(ret)); ++ } + if (ret < 0) + goto wash; + +-- +2.16.4 + diff --git a/patches.suse/ring-buffer-fix-recursion-protection-transitions-between-interrupt-context.patch b/patches.suse/ring-buffer-fix-recursion-protection-transitions-between-interrupt-context.patch new file mode 100644 index 0000000..99cc12a --- /dev/null +++ b/patches.suse/ring-buffer-fix-recursion-protection-transitions-between-interrupt-context.patch @@ -0,0 +1,114 @@ +From: "Steven Rostedt (VMware)" +Date: Mon, 2 Nov 2020 15:31:27 -0500 +Subject: ring-buffer: Fix recursion protection transitions between interrupt + context +Git-commit: b02414c8f045ab3b9afc816c3735bc98c5c3d262 +Patch-mainline: v5.10-rc3 +References: git-fixes + +The recursion protection of the ring buffer depends on preempt_count() to be +correct. But it is possible that the ring buffer gets called after an +interrupt comes in but before it updates the preempt_count(). This will +trigger a false positive in the recursion code. + +Use the same trick from the ftrace function callback recursion code which +uses a "transition" bit that gets set, to allow for a single recursion for +to handle transitions between contexts. + +Cc: stable@vger.kernel.org +Fixes: 567cd4da54ff4 ("ring-buffer: User context bit recursion checking") +Signed-off-by: Steven Rostedt (VMware) +[ mb: adapted to the current SLE15-SP1 code ] +Acked-by: Miroslav Benes +--- + kernel/trace/ring_buffer.c | 54 ++++++++++++++++++++++++++++++++++++--------- + 1 file changed, 44 insertions(+), 10 deletions(-) + +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -417,14 +417,16 @@ struct rb_event_info { + + /* + * Used for which event context the event is in. +- * NMI = 0 +- * IRQ = 1 +- * SOFTIRQ = 2 +- * NORMAL = 3 ++ * TRANSITION = 0 ++ * NMI = 1 ++ * IRQ = 2 ++ * SOFTIRQ = 3 ++ * NORMAL = 4 + * + * See trace_recursive_lock() comment below for more details. + */ + enum { ++ RB_CTX_TRANSITION, + RB_CTX_NMI, + RB_CTX_IRQ, + RB_CTX_SOFTIRQ, +@@ -2555,10 +2557,10 @@ rb_wakeups(struct ring_buffer *buffer, s + * a bit of overhead in something as critical as function tracing, + * we use a bitmask trick. + * +- * bit 0 = NMI context +- * bit 1 = IRQ context +- * bit 2 = SoftIRQ context +- * bit 3 = normal context. ++ * bit 1 = NMI context ++ * bit 2 = IRQ context ++ * bit 3 = SoftIRQ context ++ * bit 4 = normal context. + * + * This works because this is the order of contexts that can + * preempt other contexts. A SoftIRQ never preempts an IRQ +@@ -2581,6 +2583,30 @@ rb_wakeups(struct ring_buffer *buffer, s + * The least significant bit can be cleared this way, and it + * just so happens that it is the same bit corresponding to + * the current context. ++ * ++ * Now the TRANSITION bit breaks the above slightly. The TRANSITION bit ++ * is set when a recursion is detected at the current context, and if ++ * the TRANSITION bit is already set, it will fail the recursion. ++ * This is needed because there's a lag between the changing of ++ * interrupt context and updating the preempt count. In this case, ++ * a false positive will be found. To handle this, one extra recursion ++ * is allowed, and this is done by the TRANSITION bit. If the TRANSITION ++ * bit is already set, then it is considered a recursion and the function ++ * ends. Otherwise, the TRANSITION bit is set, and that bit is returned. ++ * ++ * On the trace_recursive_unlock(), the TRANSITION bit will be the first ++ * to be cleared. Even if it wasn't the context that set it. That is, ++ * if an interrupt comes in while NORMAL bit is set and the ring buffer ++ * is called before preempt_count() is updated, since the check will ++ * be on the NORMAL bit, the TRANSITION bit will then be set. If an ++ * NMI then comes in, it will set the NMI bit, but when the NMI code ++ * does the trace_recursive_unlock() it will clear the TRANSTION bit ++ * and leave the NMI bit set. But this is fine, because the interrupt ++ * code that set the TRANSITION bit will then clear the NMI bit when it ++ * calls trace_recursive_unlock(). If another NMI comes in, it will ++ * set the TRANSITION bit and continue. ++ * ++ * Note: The TRANSITION bit only handles a single transition between context. + */ + + static __always_inline int +@@ -2599,8 +2625,16 @@ trace_recursive_lock(struct ring_buffer_ + } else + bit = RB_CTX_NORMAL; + +- if (unlikely(val & (1 << bit))) +- return 1; ++ if (unlikely(val & (1 << bit))) { ++ /* ++ * It is possible that this was called by transitioning ++ * between interrupt context, and preempt_count() has not ++ * been updated yet. In this case, use the TRANSITION bit. ++ */ ++ bit = RB_CTX_TRANSITION; ++ if (val & (1 << bit)) ++ return 1; ++ } + + val |= (1 << bit); + cpu_buffer->current_context = val; diff --git a/patches.suse/scsi-ibmvscsi-Fix-potential-race-after-loss-of-trans.patch b/patches.suse/scsi-ibmvscsi-Fix-potential-race-after-loss-of-trans.patch index 2dfcd95..48f8ce8 100644 --- a/patches.suse/scsi-ibmvscsi-Fix-potential-race-after-loss-of-trans.patch +++ b/patches.suse/scsi-ibmvscsi-Fix-potential-race-after-loss-of-trans.patch @@ -4,8 +4,7 @@ Date: Sat, 24 Oct 2020 19:13:55 -0500 Subject: [PATCH] scsi: ibmvscsi: Fix potential race after loss of transport References: bsc#1178166 ltc#188226 -Patch-mainline: queued -Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git +Patch-mainline: v5.10-rc2 Git-commit: 665e0224a3d76f36da40bd9012270fa629aa42ed After a loss of transport due to an adapter migration or crash/disconnect diff --git a/patches.suse/staging-comedi-cb_pcidas-Allow-2-channel-commands-fo.patch b/patches.suse/staging-comedi-cb_pcidas-Allow-2-channel-commands-fo.patch new file mode 100644 index 0000000..035b013 --- /dev/null +++ b/patches.suse/staging-comedi-cb_pcidas-Allow-2-channel-commands-fo.patch @@ -0,0 +1,46 @@ +From 647a6002cb41d358d9ac5de101a8a6dc74748a59 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Wed, 21 Oct 2020 13:21:42 +0100 +Subject: [PATCH] staging: comedi: cb_pcidas: Allow 2-channel commands for AO subdevice +Git-commit: 647a6002cb41d358d9ac5de101a8a6dc74748a59 +Patch-mainline: v5.10-rc2 +References: git-fixes + +The "cb_pcidas" driver supports asynchronous commands on the analog +output (AO) subdevice for those boards that have an AO FIFO. The code +(in `cb_pcidas_ao_check_chanlist()` and `cb_pcidas_ao_cmd()`) to +validate and set up the command supports output to a single channel or +to two channels simultaneously (the boards have two AO channels). +However, the code in `cb_pcidas_auto_attach()` that initializes the +subdevices neglects to initialize the AO subdevice's `len_chanlist` +member, leaving it set to 0, but the Comedi core will "correct" it to 1 +if the driver neglected to set it. This limits commands to use a single +channel (either channel 0 or 1), but the limit should be two channels. +Set the AO subdevice's `len_chanlist` member to be the same value as the +`n_chan` member, which will be 2. + +Cc: +Signed-off-by: Ian Abbott +Link: https://lore.kernel.org/r/20201021122142.81628-1-abbotti@mev.co.uk +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/staging/comedi/drivers/cb_pcidas.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/staging/comedi/drivers/cb_pcidas.c b/drivers/staging/comedi/drivers/cb_pcidas.c +index 48ec2ee953dc..d740c4782775 100644 +--- a/drivers/staging/comedi/drivers/cb_pcidas.c ++++ b/drivers/staging/comedi/drivers/cb_pcidas.c +@@ -1342,6 +1342,7 @@ static int cb_pcidas_auto_attach(struct comedi_device *dev, + if (dev->irq && board->has_ao_fifo) { + dev->write_subdev = s; + s->subdev_flags |= SDF_CMD_WRITE; ++ s->len_chanlist = s->n_chan; + s->do_cmdtest = cb_pcidas_ao_cmdtest; + s->do_cmd = cb_pcidas_ao_cmd; + s->cancel = cb_pcidas_ao_cancel; +-- +2.16.4 + diff --git a/patches.suse/staging-octeon-Drop-on-uncorrectable-alignment-or-FC.patch b/patches.suse/staging-octeon-Drop-on-uncorrectable-alignment-or-FC.patch new file mode 100644 index 0000000..1222aa9 --- /dev/null +++ b/patches.suse/staging-octeon-Drop-on-uncorrectable-alignment-or-FC.patch @@ -0,0 +1,90 @@ +From 49d28ebdf1e30d806410eefc7de0a7a1ca5d747c Mon Sep 17 00:00:00 2001 +From: Alexander Sverdlin +Date: Fri, 16 Oct 2020 16:56:30 +0200 +Subject: [PATCH] staging: octeon: Drop on uncorrectable alignment or FCS error +Git-commit: 49d28ebdf1e30d806410eefc7de0a7a1ca5d747c +Patch-mainline: v5.10-rc2 +References: git-fixes + +Currently in case of alignment or FCS error if the packet cannot be +corrected it's still not dropped. Report the error properly and drop the +packet while making the code around a little bit more readable. + +Fixes: 80ff0fd3ab64 ("Staging: Add octeon-ethernet driver files.") +Signed-off-by: Alexander Sverdlin +Cc: stable +Link: https://lore.kernel.org/r/20201016145630.41852-1-alexander.sverdlin@nokia.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/staging/octeon/ethernet-rx.c | 34 +++++++++++++++++++--------------- + 1 file changed, 19 insertions(+), 15 deletions(-) + +--- a/drivers/staging/octeon/ethernet-rx.c ++++ b/drivers/staging/octeon/ethernet-rx.c +@@ -83,15 +83,17 @@ static inline int cvm_oct_check_rcv_erro + else + port = work->word1.cn38xx.ipprt; + +- if ((work->word2.snoip.err_code == 10) && (work->word1.len <= 64)) { ++ if ((work->word2.snoip.err_code == 10) && (work->word1.len <= 64)) + /* + * Ignore length errors on min size packets. Some + * equipment incorrectly pads packets to 64+4FCS + * instead of 60+4FCS. Note these packets still get + * counted as frame errors. + */ +- } else if (work->word2.snoip.err_code == 5 || +- work->word2.snoip.err_code == 7) { ++ return 0; ++ ++ if (work->word2.snoip.err_code == 5 || ++ work->word2.snoip.err_code == 7) { + /* + * We received a packet with either an alignment error + * or a FCS error. This may be signalling that we are +@@ -122,7 +124,10 @@ static inline int cvm_oct_check_rcv_erro + /* Port received 0xd5 preamble */ + work->packet_ptr.s.addr += i + 1; + work->word1.len -= i + 5; +- } else if ((*ptr & 0xf) == 0xd) { ++ return 0; ++ } ++ ++ if ((*ptr & 0xf) == 0xd) { + /* Port received 0xd preamble */ + work->packet_ptr.s.addr += i; + work->word1.len -= i + 4; +@@ -132,21 +137,20 @@ static inline int cvm_oct_check_rcv_erro + ((*(ptr + 1) & 0xf) << 4); + ptr++; + } +- } else { +- printk_ratelimited("Port %d unknown preamble, packet dropped\n", +- port); +- cvm_oct_free_work(work); +- return 1; ++ return 0; + } ++ ++ printk_ratelimited("Port %d unknown preamble, packet dropped\n", ++ port); ++ cvm_oct_free_work(work); ++ return 1; + } +- } else { +- printk_ratelimited("Port %d receive error code %d, packet dropped\n", +- port, work->word2.snoip.err_code); +- cvm_oct_free_work(work); +- return 1; + } + +- return 0; ++ printk_ratelimited("Port %d receive error code %d, packet dropped\n", ++ port, work->word2.snoip.err_code); ++ cvm_oct_free_work(work); ++ return 1; + } + + static int cvm_oct_poll(struct oct_rx_group *rx_group, int budget) diff --git a/patches.suse/staging-octeon-repair-fixed-link-support.patch b/patches.suse/staging-octeon-repair-fixed-link-support.patch new file mode 100644 index 0000000..ab95259 --- /dev/null +++ b/patches.suse/staging-octeon-repair-fixed-link-support.patch @@ -0,0 +1,70 @@ +From 179f5dc36b0a1aa31538d7d8823deb65c39847b3 Mon Sep 17 00:00:00 2001 +From: Alexander Sverdlin +Date: Fri, 16 Oct 2020 12:18:57 +0200 +Subject: [PATCH] staging: octeon: repair "fixed-link" support +Git-commit: 179f5dc36b0a1aa31538d7d8823deb65c39847b3 +Patch-mainline: v5.10-rc2 +References: git-fixes + +The PHYs must be registered once in device probe function, not in device +open callback because it's only possible to register them once. + +Fixes: a25e278020bf ("staging: octeon: support fixed-link phys") +Signed-off-by: Alexander Sverdlin +Cc: stable +Link: https://lore.kernel.org/r/20201016101858.11374-1-alexander.sverdlin@nokia.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/staging/octeon/ethernet-mdio.c | 6 ------ + drivers/staging/octeon/ethernet.c | 9 +++++++++ + 2 files changed, 9 insertions(+), 6 deletions(-) + +diff --git a/drivers/staging/octeon/ethernet-mdio.c b/drivers/staging/octeon/ethernet-mdio.c +index cfb673a52b25..0bf545849b11 100644 +--- a/drivers/staging/octeon/ethernet-mdio.c ++++ b/drivers/staging/octeon/ethernet-mdio.c +@@ -147,12 +147,6 @@ int cvm_oct_phy_setup_device(struct net_device *dev) + + phy_node = of_parse_phandle(priv->of_node, "phy-handle", 0); + if (!phy_node && of_phy_is_fixed_link(priv->of_node)) { +- int rc; +- +- rc = of_phy_register_fixed_link(priv->of_node); +- if (rc) +- return rc; +- + phy_node = of_node_get(priv->of_node); + } + if (!phy_node) +diff --git a/drivers/staging/octeon/ethernet.c b/drivers/staging/octeon/ethernet.c +index 204f0b1e2739..5dea6e96ec90 100644 +--- a/drivers/staging/octeon/ethernet.c ++++ b/drivers/staging/octeon/ethernet.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -892,6 +893,14 @@ static int cvm_oct_probe(struct platform_device *pdev) + break; + } + ++ if (priv->of_node && of_phy_is_fixed_link(priv->of_node)) { ++ if (of_phy_register_fixed_link(priv->of_node)) { ++ netdev_err(dev, "Failed to register fixed link for interface %d, port %d\n", ++ interface, priv->port); ++ dev->netdev_ops = NULL; ++ } ++ } ++ + if (!dev->netdev_ops) { + free_netdev(dev); + } else if (register_netdev(dev) < 0) { +-- +2.16.4 + diff --git a/patches.suse/tty-make-FONTX-ioctl-use-the-tty-pointer-they-were-a.patch b/patches.suse/tty-make-FONTX-ioctl-use-the-tty-pointer-they-were-a.patch new file mode 100644 index 0000000..7dc65fd --- /dev/null +++ b/patches.suse/tty-make-FONTX-ioctl-use-the-tty-pointer-they-were-a.patch @@ -0,0 +1,150 @@ +From: Linus Torvalds +Date: Mon, 26 Oct 2020 13:15:23 -0700 +Subject: tty: make FONTX ioctl use the tty pointer they were actually passed +Git-commit: 90bfdeef83f1d6c696039b6a917190dcbbad3220 +Patch-mainline: v5.10-rc3 +References: bsc#1178123 CVE-2020-25668 + +Some of the font tty ioctl's always used the current foreground VC for +their operations. Don't do that then. + +This fixes a data race on fg_console. + +Side note: both Michael Ellerman and Jiri Slaby point out that all these +ioctls are deprecated, and should probably have been removed long ago, +and everything seems to be using the KDFONTOP ioctl instead. + +In fact, Michael points out that it looks like busybox's loadfont +program seems to have switched over to using KDFONTOP exactly _because_ +of this bug (ahem.. 12 years ago ;-). + +Reported-by: Minh Yuan +Acked-by: Michael Ellerman +Acked-by: Jiri Slaby +Cc: Greg KH +Signed-off-by: Linus Torvalds +Signed-off-by: Jiri Slaby +--- + drivers/tty/vt/vt_ioctl.c | 32 +++++++++++++++++--------------- + 1 file changed, 17 insertions(+), 15 deletions(-) + +--- a/drivers/tty/vt/vt_ioctl.c ++++ b/drivers/tty/vt/vt_ioctl.c +@@ -242,7 +242,7 @@ int vt_waitactive(int n) + + + static inline int +-do_fontx_ioctl(int cmd, struct consolefontdesc __user *user_cfd, int perm, struct console_font_op *op) ++do_fontx_ioctl(struct vc_data *vc, int cmd, struct consolefontdesc __user *user_cfd, int perm, struct console_font_op *op) + { + struct consolefontdesc cfdarg; + int i; +@@ -260,15 +260,16 @@ do_fontx_ioctl(int cmd, struct consolefo + op->height = cfdarg.charheight; + op->charcount = cfdarg.charcount; + op->data = cfdarg.chardata; +- return con_font_op(vc_cons[fg_console].d, op); +- case GIO_FONTX: { ++ return con_font_op(vc, op); ++ ++ case GIO_FONTX: + op->op = KD_FONT_OP_GET; + op->flags = KD_FONT_FLAG_OLD; + op->width = 8; + op->height = cfdarg.charheight; + op->charcount = cfdarg.charcount; + op->data = cfdarg.chardata; +- i = con_font_op(vc_cons[fg_console].d, op); ++ i = con_font_op(vc, op); + if (i) + return i; + cfdarg.charheight = op->height; +@@ -276,7 +277,6 @@ do_fontx_ioctl(int cmd, struct consolefo + if (copy_to_user(user_cfd, &cfdarg, sizeof(struct consolefontdesc))) + return -EFAULT; + return 0; +- } + } + return -EINVAL; + } +@@ -931,7 +931,7 @@ int vt_ioctl(struct tty_struct *tty, + op.height = 0; + op.charcount = 256; + op.data = up; +- ret = con_font_op(vc_cons[fg_console].d, &op); ++ ret = con_font_op(vc, &op); + break; + } + +@@ -942,7 +942,7 @@ int vt_ioctl(struct tty_struct *tty, + op.height = 32; + op.charcount = 256; + op.data = up; +- ret = con_font_op(vc_cons[fg_console].d, &op); ++ ret = con_font_op(vc, &op); + break; + } + +@@ -959,7 +959,7 @@ int vt_ioctl(struct tty_struct *tty, + + case PIO_FONTX: + case GIO_FONTX: +- ret = do_fontx_ioctl(cmd, up, perm, &op); ++ ret = do_fontx_ioctl(vc, cmd, up, perm, &op); + break; + + case PIO_FONTRESET: +@@ -976,11 +976,11 @@ int vt_ioctl(struct tty_struct *tty, + { + op.op = KD_FONT_OP_SET_DEFAULT; + op.data = NULL; +- ret = con_font_op(vc_cons[fg_console].d, &op); ++ ret = con_font_op(vc, &op); + if (ret) + break; + console_lock(); +- con_set_default_unimap(vc_cons[fg_console].d); ++ con_set_default_unimap(vc); + console_unlock(); + break; + } +@@ -1107,8 +1107,9 @@ struct compat_consolefontdesc { + }; + + static inline int +-compat_fontx_ioctl(int cmd, struct compat_consolefontdesc __user *user_cfd, +- int perm, struct console_font_op *op) ++compat_fontx_ioctl(struct vc_data *vc, int cmd, ++ struct compat_consolefontdesc __user *user_cfd, ++ int perm, struct console_font_op *op) + { + struct compat_consolefontdesc cfdarg; + int i; +@@ -1126,7 +1127,8 @@ compat_fontx_ioctl(int cmd, struct compa + op->height = cfdarg.charheight; + op->charcount = cfdarg.charcount; + op->data = compat_ptr(cfdarg.chardata); +- return con_font_op(vc_cons[fg_console].d, op); ++ return con_font_op(vc, op); ++ + case GIO_FONTX: + op->op = KD_FONT_OP_GET; + op->flags = KD_FONT_FLAG_OLD; +@@ -1134,7 +1136,7 @@ compat_fontx_ioctl(int cmd, struct compa + op->height = cfdarg.charheight; + op->charcount = cfdarg.charcount; + op->data = compat_ptr(cfdarg.chardata); +- i = con_font_op(vc_cons[fg_console].d, op); ++ i = con_font_op(vc, op); + if (i) + return i; + cfdarg.charheight = op->height; +@@ -1228,7 +1230,7 @@ long vt_compat_ioctl(struct tty_struct * + */ + case PIO_FONTX: + case GIO_FONTX: +- return compat_fontx_ioctl(cmd, up, perm, &op); ++ return compat_fontx_ioctl(vc, cmd, up, perm, &op); + + case KDFONTOP: + return compat_kdfontop_ioctl(up, perm, &op, vc); diff --git a/patches.suse/usb-cdc-acm-fix-cooldown-mechanism.patch b/patches.suse/usb-cdc-acm-fix-cooldown-mechanism.patch new file mode 100644 index 0000000..1996a28 --- /dev/null +++ b/patches.suse/usb-cdc-acm-fix-cooldown-mechanism.patch @@ -0,0 +1,124 @@ +From 38203b8385bf6283537162bde7d499f830964711 Mon Sep 17 00:00:00 2001 +From: Jerome Brunet +Date: Mon, 19 Oct 2020 19:07:02 +0200 +Subject: [PATCH] usb: cdc-acm: fix cooldown mechanism +Git-commit: 38203b8385bf6283537162bde7d499f830964711 +References: git-fixes +Patch-mainline: v5.10-rc2 + +Commit a4e7279cd1d1 ("cdc-acm: introduce a cool down") is causing +regression if there is some USB error, such as -EPROTO. + +This has been reported on some samples of the Odroid-N2 using the Combee II +Zibgee USB dongle. + +> struct acm *acm = container_of(work, struct acm, work) + +is incorrect in case of a delayed work and causes warnings, usually from +the workqueue: + +> WARNING: CPU: 0 PID: 0 at kernel/workqueue.c:1474 __queue_work+0x480/0x528. + +When this happens, USB eventually stops working completely after a while. +Also the ACM_ERROR_DELAY bit is never set, so the cooldown mechanism +previously introduced cannot be triggered and acm_submit_read_urb() is +never called. + +This changes makes the cdc-acm driver use a single delayed work, fixing the +pointer arithmetic in acm_softint() and set the ACM_ERROR_DELAY when the +cooldown mechanism appear to be needed. + +Fixes: a4e7279cd1d1 ("cdc-acm: introduce a cool down") +Cc: Oliver Neukum +Reported-by: Pascal Vizeli +Acked-by: Oliver Neukum +Signed-off-by: Jerome Brunet +Link: https://lore.kernel.org/r/20201019170702.150534-1-jbrunet@baylibre.com +Cc: stable +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Oliver Neukum +--- + drivers/usb/class/cdc-acm.c | 12 +++++------- + drivers/usb/class/cdc-acm.h | 3 +-- + 2 files changed, 6 insertions(+), 9 deletions(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -520,6 +520,7 @@ static void acm_read_bulk_callback(struc + "%s - cooling babbling device\n", __func__); + usb_mark_last_busy(acm->dev); + set_bit(rb->index, &acm->urbs_in_error_delay); ++ set_bit(ACM_ERROR_DELAY, &acm->flags); + cooldown = true; + break; + default: +@@ -545,7 +546,7 @@ static void acm_read_bulk_callback(struc + + if (stopped || stalled || cooldown) { + if (stalled) +- schedule_work(&acm->work); ++ schedule_delayed_work(&acm->dwork, 0); + else if (cooldown) + schedule_delayed_work(&acm->dwork, HZ / 2); + return; +@@ -580,13 +581,13 @@ static void acm_write_bulk(struct urb *u + acm_write_done(acm, wb); + spin_unlock_irqrestore(&acm->write_lock, flags); + set_bit(EVENT_TTY_WAKEUP, &acm->flags); +- schedule_work(&acm->work); ++ schedule_delayed_work(&acm->dwork, 0); + } + + static void acm_softint(struct work_struct *work) + { + int i; +- struct acm *acm = container_of(work, struct acm, work); ++ struct acm *acm = container_of(work, struct acm, dwork.work); + + if (test_bit(EVENT_RX_STALL, &acm->flags)) { + smp_mb(); /* against acm_suspend() */ +@@ -602,7 +603,7 @@ static void acm_softint(struct work_stru + if (test_and_clear_bit(ACM_ERROR_DELAY, &acm->flags)) { + for (i = 0; i < acm->rx_buflimit; i++) + if (test_and_clear_bit(i, &acm->urbs_in_error_delay)) +- acm_submit_read_urb(acm, i, GFP_NOIO); ++ acm_submit_read_urb(acm, i, GFP_KERNEL); + } + + if (test_and_clear_bit(EVENT_TTY_WAKEUP, &acm->flags)) +@@ -1404,7 +1405,6 @@ made_compressed_probe: + acm->ctrlsize = ctrlsize; + acm->readsize = readsize; + acm->rx_buflimit = num_rx_buf; +- INIT_WORK(&acm->work, acm_softint); + INIT_DELAYED_WORK(&acm->dwork, acm_softint); + init_waitqueue_head(&acm->wioctl); + spin_lock_init(&acm->write_lock); +@@ -1618,7 +1618,6 @@ static void acm_disconnect(struct usb_in + } + + acm_kill_urbs(acm); +- cancel_work_sync(&acm->work); + cancel_delayed_work_sync(&acm->dwork); + + tty_unregister_device(acm_tty_driver, acm->minor); +@@ -1661,7 +1660,6 @@ static int acm_suspend(struct usb_interf + return 0; + + acm_kill_urbs(acm); +- cancel_work_sync(&acm->work); + cancel_delayed_work_sync(&acm->dwork); + acm->urbs_in_error_delay = 0; + +--- a/drivers/usb/class/cdc-acm.h ++++ b/drivers/usb/class/cdc-acm.h +@@ -109,8 +109,7 @@ struct acm { + # define EVENT_RX_STALL 1 + # define ACM_ERROR_DELAY 3 + struct usb_cdc_line_coding line; /* bits, stop, parity */ +- struct work_struct work; /* work queue entry for various purposes */ +- struct delayed_work dwork; /* for cool downs needed in error recovery */ ++ struct delayed_work dwork; /* work queue entry for various purposes */ + unsigned long urbs_in_error_delay; /* these need to be restarted after a delay */ + unsigned int ctrlin; /* input control lines (DCD, DSR, RI, break, overruns) */ + unsigned int ctrlout; /* output control lines (DTR, RTS) */ diff --git a/patches.suse/usb-host-fsl-mph-dr-of-check-return-of-dma_set_mask.patch b/patches.suse/usb-host-fsl-mph-dr-of-check-return-of-dma_set_mask.patch new file mode 100644 index 0000000..b0e1702 --- /dev/null +++ b/patches.suse/usb-host-fsl-mph-dr-of-check-return-of-dma_set_mask.patch @@ -0,0 +1,47 @@ +From 3cd54a618834430a26a648d880dd83d740f2ae30 Mon Sep 17 00:00:00 2001 +From: Ran Wang +Date: Sat, 10 Oct 2020 14:03:08 +0800 +Subject: [PATCH] usb: host: fsl-mph-dr-of: check return of dma_set_mask() +Git-commit: 3cd54a618834430a26a648d880dd83d740f2ae30 +Patch-mainline: v5.10-rc2 +References: git-fixes + +fsl_usb2_device_register() should stop init if dma_set_mask() return +error. + +Fixes: cae058610465 ("drivers/usb/host: fsl: Set DMA_MASK of usb platform device") +Reviewed-by: Peter Chen +Signed-off-by: Ran Wang +Link: https://lore.kernel.org/r/20201010060308.33693-1-ran.wang_1@nxp.com +Cc: stable +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/host/fsl-mph-dr-of.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/host/fsl-mph-dr-of.c b/drivers/usb/host/fsl-mph-dr-of.c +index ae8f60f6e6a5..44a7e58a26e3 100644 +--- a/drivers/usb/host/fsl-mph-dr-of.c ++++ b/drivers/usb/host/fsl-mph-dr-of.c +@@ -94,10 +94,13 @@ static struct platform_device *fsl_usb2_device_register( + + pdev->dev.coherent_dma_mask = ofdev->dev.coherent_dma_mask; + +- if (!pdev->dev.dma_mask) ++ if (!pdev->dev.dma_mask) { + pdev->dev.dma_mask = &ofdev->dev.coherent_dma_mask; +- else +- dma_set_mask(&pdev->dev, DMA_BIT_MASK(32)); ++ } else { ++ retval = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32)); ++ if (retval) ++ goto error; ++ } + + retval = platform_device_add_data(pdev, pdata, sizeof(*pdata)); + if (retval) +-- +2.16.4 + diff --git a/patches.suse/usb-host-xhci-fix-ep-context-print-mismatch-in-debug.patch b/patches.suse/usb-host-xhci-fix-ep-context-print-mismatch-in-debug.patch new file mode 100644 index 0000000..6343f05 --- /dev/null +++ b/patches.suse/usb-host-xhci-fix-ep-context-print-mismatch-in-debug.patch @@ -0,0 +1,47 @@ +From 0077b1b2c8d9ad5f7a08b62fb8524cdb9938388f Mon Sep 17 00:00:00 2001 +From: Li Jun +Date: Fri, 21 Aug 2020 12:15:47 +0300 +Subject: [PATCH] usb: host: xhci: fix ep context print mismatch in debugfs +Git-commit: 0077b1b2c8d9ad5f7a08b62fb8524cdb9938388f +References: git-fixes +Patch-mainline: v5.9-rc3 + +dci is 0 based and xhci_get_ep_ctx() will do ep index increment to get +the ep context. + +[rename dci to ep_index -Mathias] +Cc: stable # v4.15+ +Fixes: 02b6fdc2a153 ("usb: xhci: Add debugfs interface for xHCI driver") +Signed-off-by: Li Jun +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20200821091549.20556-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Oliver Neukum +--- + drivers/usb/host/xhci-debugfs.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/host/xhci-debugfs.c ++++ b/drivers/usb/host/xhci-debugfs.c +@@ -276,7 +276,7 @@ static int xhci_slot_context_show(struct + + static int xhci_endpoint_context_show(struct seq_file *s, void *unused) + { +- int dci; ++ int ep_index; + dma_addr_t dma; + struct xhci_hcd *xhci; + struct xhci_ep_ctx *ep_ctx; +@@ -285,9 +285,9 @@ static int xhci_endpoint_context_show(st + + xhci = hcd_to_xhci(bus_to_hcd(dev->udev->bus)); + +- for (dci = 1; dci < 32; dci++) { +- ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, dci); +- dma = dev->out_ctx->dma + dci * CTX_SIZE(xhci->hcc_params); ++ for (ep_index = 0; ep_index < 31; ep_index++) { ++ ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, ep_index); ++ dma = dev->out_ctx->dma + (ep_index + 1) * CTX_SIZE(xhci->hcc_params); + seq_printf(s, "%pad: %s\n", &dma, + xhci_decode_ep_context(ep_ctx->ep_info, + ep_ctx->ep_info2, diff --git a/patches.suse/usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch b/patches.suse/usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch new file mode 100644 index 0000000..3bc3944 --- /dev/null +++ b/patches.suse/usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch @@ -0,0 +1,76 @@ +From 20914919ad31849ee2b9cfe0428f4a20335c9e2a Mon Sep 17 00:00:00 2001 +From: Macpaul Lin +Date: Fri, 6 Nov 2020 13:54:29 +0800 +Subject: [PATCH] usb: mtu3: fix panic in mtu3_gadget_stop() +Git-commit: 20914919ad31849ee2b9cfe0428f4a20335c9e2a +Patch-mainline: v5.10-rc3 +References: git-fixes + +This patch fixes a possible issue when mtu3_gadget_stop() +already assigned NULL to mtu->gadget_driver during mtu_gadget_disconnect(). + +[] notifier_call_chain+0xa4/0x128 +[] __atomic_notifier_call_chain+0x84/0x138 +[] notify_die+0xb0/0x120 +[] die+0x1f8/0x5d0 +[] __do_kernel_fault+0x19c/0x280 +[] do_bad_area+0x44/0x140 +[] do_translation_fault+0x4c/0x90 +[] do_mem_abort+0xb8/0x258 +[] el1_da+0x24/0x3c +[] mtu3_gadget_disconnect+0xac/0x128 +[] mtu3_irq+0x34c/0xc18 +[] __handle_irq_event_percpu+0x2ac/0xcd0 +[] handle_irq_event_percpu+0x80/0x138 +[] handle_irq_event+0xac/0x148 +[] handle_fasteoi_irq+0x234/0x568 +[] generic_handle_irq+0x48/0x68 +[] __handle_domain_irq+0x264/0x1740 +[] gic_handle_irq+0x14c/0x250 +[] el1_irq+0xec/0x194 +[] dma_pool_alloc+0x6e4/0xae0 +[] cmdq_mbox_pool_alloc_impl+0xb0/0x238 +[] cmdq_pkt_alloc_buf+0x2dc/0x7c0 +[] cmdq_pkt_add_cmd_buffer+0x178/0x270 +[] cmdq_pkt_perf_begin+0x108/0x148 +[] cmdq_pkt_create+0x178/0x1f0 +[] mtk_crtc_config_default_path+0x328/0x7a0 +[] mtk_drm_idlemgr_kick+0xa6c/0x1460 +[] mtk_drm_crtc_atomic_begin+0x1a4/0x1a68 +[] drm_atomic_helper_commit_planes+0x154/0x878 +[] mtk_atomic_complete.isra.16+0xe80/0x19c8 +[] mtk_atomic_commit+0x258/0x898 +[] drm_atomic_commit+0xcc/0x108 +[] drm_mode_atomic_ioctl+0x1c20/0x2580 +[] drm_ioctl_kernel+0x118/0x1b0 +[] drm_ioctl+0x5c0/0x920 +[] do_vfs_ioctl+0x188/0x1820 +[] SyS_ioctl+0x8c/0xa0 + +Fixes: df2069acb005 ("usb: Add MediaTek USB3 DRD driver") +Signed-off-by: Macpaul Lin +Acked-by: Chunfeng Yun +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/1604642069-20961-1-git-send-email-macpaul.lin@mediatek.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/mtu3/mtu3_gadget.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c +index 1de5c9a1d20a..38f17d66d5bc 100644 +--- a/drivers/usb/mtu3/mtu3_gadget.c ++++ b/drivers/usb/mtu3/mtu3_gadget.c +@@ -564,6 +564,7 @@ static int mtu3_gadget_stop(struct usb_gadget *g) + + spin_unlock_irqrestore(&mtu->lock, flags); + ++ synchronize_irq(mtu->irq); + return 0; + } + +-- +2.16.4 + diff --git a/patches.suse/usb-typec-tcpm-During-PR_SWAP-source-caps-should-be-.patch b/patches.suse/usb-typec-tcpm-During-PR_SWAP-source-caps-should-be-.patch new file mode 100644 index 0000000..f3a22a5 --- /dev/null +++ b/patches.suse/usb-typec-tcpm-During-PR_SWAP-source-caps-should-be-.patch @@ -0,0 +1,79 @@ +From 6bbe2a90a0bb4af8dd99c3565e907fe9b5e7fd88 Mon Sep 17 00:00:00 2001 +From: Badhri Jagan Sridharan +Date: Mon, 17 Aug 2020 11:38:27 -0700 +Subject: [PATCH] usb: typec: tcpm: During PR_SWAP, source caps should be sent only after tSwapSourceStart +Git-commit: 6bbe2a90a0bb4af8dd99c3565e907fe9b5e7fd88 +Patch-mainline: v5.10-rc1 +References: git-fixes + +The patch addresses the compliance test failures while running +TD.PD.CP.E3, TD.PD.CP.E4, TD.PD.CP.E5 of the "Deterministic PD +Compliance MOI" test plan published in https://www.usb.org/usbc. +For a product to be Type-C compliant, it's expected that these tests +are run on usb.org certified Type-C compliance tester as mentioned in +https://www.usb.org/usbc. + +The purpose of the tests TD.PD.CP.E3, TD.PD.CP.E4, TD.PD.CP.E5 is to +verify the PR_SWAP response of the device. While doing so, the test +asserts that Source Capabilities message is NOT received from the test +device within tSwapSourceStart min (20 ms) from the time the last bit +of GoodCRC corresponding to the RS_RDY message sent by the UUT was +sent. If it does then the test fails. + +This is in line with the requirements from the USB Power Delivery +Specification Revision 3.0, Version 1.2: +"6.6.8.1 SwapSourceStartTimer +The SwapSourceStartTimer Shall be used by the new Source, after a +Power Role Swap or Fast Role Swap, to ensure that it does not send +Source_Capabilities Message before the new Sink is ready to receive +the +Source_Capabilities Message. The new Source Shall Not send the +Source_Capabilities Message earlier than tSwapSourceStart after the +last bit of the EOP of GoodCRC Message sent in response to the PS_RDY +Message sent by the new Source indicating that its power supply is +ready." + +The patch makes sure that TCPM does not send the Source_Capabilities +Message within tSwapSourceStart(20ms) by transitioning into +SRC_STARTUP only after tSwapSourceStart(20ms). + +Signed-off-by: Badhri Jagan Sridharan +Reviewed-by: Guenter Roeck +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20200817183828.1895015-1-badhri@google.com +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/usb/typec/tcpm/tcpm.c | 2 +- + include/linux/usb/pd.h | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c +index 3ef37202ee37..d38347bd3335 100644 +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -3555,7 +3555,7 @@ static void run_state_machine(struct tcpm_port *port) + */ + tcpm_set_pwr_role(port, TYPEC_SOURCE); + tcpm_pd_send_control(port, PD_CTRL_PS_RDY); +- tcpm_set_state(port, SRC_STARTUP, 0); ++ tcpm_set_state(port, SRC_STARTUP, PD_T_SWAP_SRC_START); + break; + + case VCONN_SWAP_ACCEPT: +diff --git a/include/linux/usb/pd.h b/include/linux/usb/pd.h +index b6c233e79bd4..1df895e4680b 100644 +--- a/include/linux/usb/pd.h ++++ b/include/linux/usb/pd.h +@@ -473,6 +473,7 @@ static inline unsigned int rdo_max_power(u32 rdo) + #define PD_T_ERROR_RECOVERY 100 /* minimum 25 is insufficient */ + #define PD_T_SRCSWAPSTDBY 625 /* Maximum of 650ms */ + #define PD_T_NEWSRC 250 /* Maximum of 275ms */ ++#define PD_T_SWAP_SRC_START 20 /* Minimum of 20ms */ + + #define PD_T_DRP_TRY 100 /* 75 - 150 ms */ + #define PD_T_DRP_TRYWAIT 600 /* 400 - 800 ms */ +-- +2.16.4 + diff --git a/patches.suse/usb-typec-tcpm-reset-hard_reset_count-for-any-discon.patch b/patches.suse/usb-typec-tcpm-reset-hard_reset_count-for-any-discon.patch new file mode 100644 index 0000000..c14fe08 --- /dev/null +++ b/patches.suse/usb-typec-tcpm-reset-hard_reset_count-for-any-discon.patch @@ -0,0 +1,98 @@ +From 2d9c6442a9c81f4f8dee678d0b3c183173ab1e2d Mon Sep 17 00:00:00 2001 +From: Li Jun +Date: Mon, 12 Oct 2020 19:03:12 +0800 +Subject: [PATCH] usb: typec: tcpm: reset hard_reset_count for any disconnect +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Git-commit: 2d9c6442a9c81f4f8dee678d0b3c183173ab1e2d +References: git-fixes +Patch-mainline: v5.10-rc2 + +Current tcpm_detach() only reset hard_reset_count if port->attached +is true, this may cause this counter clear is missed if the CC +disconnect event is generated after tcpm_port_reset() is done +by other events, e.g. VBUS off comes first before CC disconect for +a power sink, in that case the first tcpm_detach() will only clear +port->attached flag but leave hard_reset_count there because +tcpm_port_is_disconnected() is still false, then later tcpm_detach() +by CC disconnect will directly return due to port->attached is cleared, +finally this will result tcpm will not try hard reset or error recovery +for later attach. + +ChiYuan reported this issue on his platform with below tcpm trace: +After power sink session setup after hard reset 2 times, detach +from the power source and then attach: +[ 4848.046358] VBUS off +[ 4848.046384] state change SNK_READY -> SNK_UNATTACHED +[ 4848.050908] Setting voltage/current limit 0 mV 0 mA +[ 4848.050936] polarity 0 +[ 4848.052593] Requesting mux state 0, usb-role 0, orientation 0 +[ 4848.053222] Start toggling +[ 4848.086500] state change SNK_UNATTACHED -> TOGGLING +[ 4848.089983] CC1: 0 -> 0, CC2: 3 -> 3 [state TOGGLING, polarity 0, connected] +[ 4848.089993] state change TOGGLING -> SNK_ATTACH_WAIT +[ 4848.090031] pending state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED @200 ms +[ 4848.141162] CC1: 0 -> 0, CC2: 3 -> 0 [state SNK_ATTACH_WAIT, polarity 0, disconnected] +[ 4848.141170] state change SNK_ATTACH_WAIT -> SNK_ATTACH_WAIT +[ 4848.141184] pending state change SNK_ATTACH_WAIT -> SNK_UNATTACHED @20 ms +[ 4848.163156] state change SNK_ATTACH_WAIT -> SNK_UNATTACHED [delayed 20 ms] +[ 4848.163162] Start toggling +[ 4848.216918] CC1: 0 -> 0, CC2: 0 -> 3 [state TOGGLING, polarity 0, connected] +[ 4848.216954] state change TOGGLING -> SNK_ATTACH_WAIT +[ 4848.217080] pending state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED @200 ms +[ 4848.231771] CC1: 0 -> 0, CC2: 3 -> 0 [state SNK_ATTACH_WAIT, polarity 0, disconnected] +[ 4848.231800] state change SNK_ATTACH_WAIT -> SNK_ATTACH_WAIT +[ 4848.231857] pending state change SNK_ATTACH_WAIT -> SNK_UNATTACHED @20 ms +[ 4848.256022] state change SNK_ATTACH_WAIT -> SNK_UNATTACHED [delayed20 ms] +[ 4848.256049] Start toggling +[ 4848.871148] VBUS on +[ 4848.885324] CC1: 0 -> 0, CC2: 0 -> 3 [state TOGGLING, polarity 0, connected] +[ 4848.885372] state change TOGGLING -> SNK_ATTACH_WAIT +[ 4848.885548] pending state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED @200 ms +[ 4849.088240] state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED [delayed200 ms] +[ 4849.088284] state change SNK_DEBOUNCED -> SNK_ATTACHED +[ 4849.088291] polarity 1 +[ 4849.088769] Requesting mux state 1, usb-role 2, orientation 2 +[ 4849.088895] state change SNK_ATTACHED -> SNK_STARTUP +[ 4849.088907] state change SNK_STARTUP -> SNK_DISCOVERY +[ 4849.088915] Setting voltage/current limit 5000 mV 0 mA +[ 4849.088927] vbus=0 charge:=1 +[ 4849.090505] state change SNK_DISCOVERY -> SNK_WAIT_CAPABILITIES +[ 4849.090828] pending state change SNK_WAIT_CAPABILITIES -> SNK_READY @240 ms +[ 4849.335878] state change SNK_WAIT_CAPABILITIES -> SNK_READY [delayed240 ms] + +this patch fix this issue by clear hard_reset_count at any cases +of cc disconnect, í.e. don't check port->attached flag. + +Fixes: 4b4e02c83167 ("typec: tcpm: Move out of staging") +Cc: stable@vger.kernel.org +Reported-and-tested-by: ChiYuan Huang +Reviewed-by: Guenter Roeck +Reviewed-by: Heikki Krogerus +Signed-off-by: Li Jun +Link: https://lore.kernel.org/r/1602500592-3817-1-git-send-email-jun.li@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Oliver Neukum +--- + drivers/usb/typec/tcpm/tcpm.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -2724,12 +2724,12 @@ static void tcpm_reset_port(struct tcpm_ + + static void tcpm_detach(struct tcpm_port *port) + { +- if (!port->attached) +- return; +- + if (tcpm_port_is_disconnected(port)) + port->hard_reset_count = 0; + ++ if (!port->attached) ++ return; ++ + tcpm_reset_port(port); + } + diff --git a/patches.suse/vfs-add-super_operations-get_inode_dev b/patches.suse/vfs-add-super_operations-get_inode_dev index a8daca5..6b2f08d 100644 --- a/patches.suse/vfs-add-super_operations-get_inode_dev +++ b/patches.suse/vfs-add-super_operations-get_inode_dev @@ -1,6 +1,6 @@ From: Jeff Mahoney Subject: vfs: add super_operations->get_inode_dev -References: bsc#927455 +References: bsc#927455 bsc#1176983 Patch-mainline: Never, Upstream submissions have been met with a request to use per-subvolume superblocks, which is unworkable in practice There are many places where a dev_t:ino_t pair are passed to userspace @@ -27,6 +27,7 @@ Signed-off-by: Jeff Mahoney fs/proc/nommu.c | 2 +- fs/proc/task_mmu.c | 2 +- fs/proc/task_nommu.c | 2 +- + fs/proc_namespace.c | 3 ++- fs/stat.c | 2 +- include/linux/fs.h | 9 +++++++++ include/trace/events/filelock.h | 8 ++++---- @@ -40,7 +41,7 @@ Signed-off-by: Jeff Mahoney mm/memory-failure.c | 2 +- net/unix/diag.c | 2 +- security/tomoyo/condition.c | 2 +- - 23 files changed, 41 insertions(+), 32 deletions(-) + 24 files changed, 43 insertions(+), 33 deletions(-) --- a/arch/arc/kernel/troubleshoot.c +++ b/arch/arc/kernel/troubleshoot.c @@ -181,6 +182,21 @@ Signed-off-by: Jeff Mahoney ino = inode->i_ino; pgoff = (loff_t)vma->vm_pgoff << PAGE_SHIFT; } +--- a/fs/proc_namespace.c ++++ b/fs/proc_namespace.c +@@ -133,10 +133,11 @@ static int show_mountinfo(struct seq_fil + struct mount *r = real_mount(mnt); + struct super_block *sb = mnt->mnt_sb; + struct path mnt_path = { .dentry = mnt->mnt_root, .mnt = mnt }; ++ dev_t dev = inode_get_dev(mnt->mnt_root->d_inode); + int err; + + seq_printf(m, "%i %i %u:%u ", r->mnt_id, r->mnt_parent->mnt_id, +- MAJOR(sb->s_dev), MINOR(sb->s_dev)); ++ MAJOR(dev), MINOR(dev)); + if (sb->s_op->show_path) { + err = sb->s_op->show_path(m, mnt->mnt_root); + if (err) --- a/fs/stat.c +++ b/fs/stat.c @@ -31,7 +31,7 @@ @@ -202,7 +218,7 @@ Signed-off-by: Jeff Mahoney }; /* -@@ -3358,4 +3359,12 @@ static inline bool dir_relax_shared(stru +@@ -3363,4 +3364,12 @@ static inline bool dir_relax_shared(stru extern bool path_noexec(const struct path *path); extern void inode_nohighmem(struct inode *inode); @@ -266,7 +282,7 @@ Signed-off-by: Jeff Mahoney ), --- a/include/trace/events/writeback.h +++ b/include/trace/events/writeback.h -@@ -709,7 +709,7 @@ DECLARE_EVENT_CLASS(writeback_inode_temp +@@ -708,7 +708,7 @@ DECLARE_EVENT_CLASS(writeback_inode_temp ), TP_fast_assign( @@ -348,7 +364,7 @@ Signed-off-by: Jeff Mahoney if (n->type == AUDIT_TYPE_UNKNOWN) --- a/kernel/events/core.c +++ b/kernel/events/core.c -@@ -6874,7 +6874,7 @@ static void perf_event_mmap_event(struct +@@ -7169,7 +7169,7 @@ static void perf_event_mmap_event(struct goto cpy_name; } inode = file_inode(vma->vm_file); diff --git a/patches.suse/video-fbdev-pvr2fb-initialize-variables.patch b/patches.suse/video-fbdev-pvr2fb-initialize-variables.patch new file mode 100644 index 0000000..ec3841a --- /dev/null +++ b/patches.suse/video-fbdev-pvr2fb-initialize-variables.patch @@ -0,0 +1,49 @@ +From 8e1ba47c60bcd325fdd097cd76054639155e5d2e Mon Sep 17 00:00:00 2001 +From: Tom Rix +Date: Mon, 20 Jul 2020 12:18:45 -0700 +Subject: [PATCH] video: fbdev: pvr2fb: initialize variables +Git-commit: 8e1ba47c60bcd325fdd097cd76054639155e5d2e +Patch-mainline: v5.10-rc1 +References: git-fixes + +clang static analysis reports this repesentative error + +pvr2fb.c:1049:2: warning: 1st function call argument + is an uninitialized value [core.CallAndMessage] + if (*cable_arg) + ^~~~~~~~~~~~~~~ + +Problem is that cable_arg depends on the input loop to +set the cable_arg[0]. If it does not, then some random +value from the stack is used. + +A similar problem exists for output_arg. + +So initialize cable_arg and output_arg. + +Signed-off-by: Tom Rix +Acked-by: Arnd Bergmann +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20200720191845.20115-1-trix@redhat.com +Acked-by: Takashi Iwai + +--- + drivers/video/fbdev/pvr2fb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/video/fbdev/pvr2fb.c b/drivers/video/fbdev/pvr2fb.c +index 2d9f69b93392..f4add36cb5f4 100644 +--- a/drivers/video/fbdev/pvr2fb.c ++++ b/drivers/video/fbdev/pvr2fb.c +@@ -1028,6 +1028,8 @@ static int __init pvr2fb_setup(char *options) + if (!options || !*options) + return 0; + ++ cable_arg[0] = output_arg[0] = 0; ++ + while ((this_opt = strsep(&options, ","))) { + if (!*this_opt) + continue; +-- +2.16.4 + diff --git a/patches.suse/vt-Disable-KD_FONT_OP_COPY.patch b/patches.suse/vt-Disable-KD_FONT_OP_COPY.patch new file mode 100644 index 0000000..2d3ec58 --- /dev/null +++ b/patches.suse/vt-Disable-KD_FONT_OP_COPY.patch @@ -0,0 +1,122 @@ +From 3c4e0dff2095c579b142d5a0693257f1c58b4804 Mon Sep 17 00:00:00 2001 +From: Daniel Vetter +Date: Sun, 8 Nov 2020 16:38:06 +0100 +Subject: [PATCH] vt: Disable KD_FONT_OP_COPY +Git-commit: 3c4e0dff2095c579b142d5a0693257f1c58b4804 +Patch-mainline: v5.10-rc3 +References: bsc#1178589 + +It's buggy: + +On Fri, Nov 06, 2020 at 10:30:08PM +0800, Minh Yuan wrote: +> We recently discovered a slab-out-of-bounds read in fbcon in the latest +> kernel ( v5.10-rc2 for now ). The root cause of this vulnerability is that +> "fbcon_do_set_font" did not handle "vc->vc_font.data" and +> "vc->vc_font.height" correctly, and the patch +> for VT_RESIZEX can't handle this +> issue. +> +> Specifically, we use KD_FONT_OP_SET to set a small font.data for tty6, and +> use KD_FONT_OP_SET again to set a large font.height for tty1. After that, +> we use KD_FONT_OP_COPY to assign tty6's vc_font.data to tty1's vc_font.data +> in "fbcon_do_set_font", while tty1 retains the original larger +> height. Obviously, this will cause an out-of-bounds read, because we can +> access a smaller vc_font.data with a larger vc_font.height. + +Further there was only one user ever. +- Android's loadfont, busybox and console-tools only ever use OP_GET + and OP_SET +- fbset documentation only mentions the kernel cmdline font: option, + not anything else. +- systemd used OP_COPY before release 232 published in Nov 2016 + +Now unfortunately the crucial report seems to have gone down with +gmane, and the commit message doesn't say much. But the pull request +hints at OP_COPY being broken + +https://github.com/systemd/systemd/pull/3651 + +So in other words, this never worked, and the only project which +foolishly every tried to use it, realized that rather quickly too. + +Instead of trying to fix security issues here on dead code by adding +missing checks, fix the entire thing by removing the functionality. + +Note that systemd code using the OP_COPY function ignored the return +value, so it doesn't matter what we're doing here really - just in +case a lone server somewhere happens to be extremely unlucky and +running an affected old version of systemd. The relevant code from +font_copy_to_all_vcs() in systemd was: + + /* copy font from active VT, where the font was uploaded to */ + cfo.op = KD_FONT_OP_COPY; + cfo.height = vcs.v_active-1; /* tty1 == index 0 */ + (void) ioctl(vcfd, KDFONTOP, &cfo); + +Note this just disables the ioctl, garbage collecting the now unused +callbacks is left for -next. + +V2: Tetsuo found the old mail, which allowed me to find it on another +archive. Add the link too. + +Acked-by: Peilin Ye +Reported-by: Minh Yuan +References: https://lists.freedesktop.org/archives/systemd-devel/2016-June/036935.html +References: https://github.com/systemd/systemd/pull/3651 +Cc: Greg KH +Cc: Peilin Ye +Cc: Tetsuo Handa +Signed-off-by: Daniel Vetter +Link: https://lore.kernel.org/r/20201108153806.3140315-1-daniel.vetter@ffwll.ch +Signed-off-by: Greg Kroah-Hartman +Acked-by: Takashi Iwai + +--- + drivers/tty/vt/vt.c | 24 ++---------------------- + 1 file changed, 2 insertions(+), 22 deletions(-) + +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index 9506a76f3ab6..d04a162939a4 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -4704,27 +4704,6 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op) + return rc; + } + +-static int con_font_copy(struct vc_data *vc, struct console_font_op *op) +-{ +- int con = op->height; +- int rc; +- +- +- console_lock(); +- if (vc->vc_mode != KD_TEXT) +- rc = -EINVAL; +- else if (!vc->vc_sw->con_font_copy) +- rc = -ENOSYS; +- else if (con < 0 || !vc_cons_allocated(con)) +- rc = -ENOTTY; +- else if (con == vc->vc_num) /* nothing to do */ +- rc = 0; +- else +- rc = vc->vc_sw->con_font_copy(vc, con); +- console_unlock(); +- return rc; +-} +- + int con_font_op(struct vc_data *vc, struct console_font_op *op) + { + switch (op->op) { +@@ -4735,7 +4714,8 @@ int con_font_op(struct vc_data *vc, struct console_font_op *op) + case KD_FONT_OP_SET_DEFAULT: + return con_font_default(vc, op); + case KD_FONT_OP_COPY: +- return con_font_copy(vc, op); ++ /* was buggy and never really used */ ++ return -EINVAL; + } + return -ENOSYS; + } +-- +2.16.4 + diff --git a/patches.suse/vt-keyboard-extend-func_buf_lock-to-readers.patch b/patches.suse/vt-keyboard-extend-func_buf_lock-to-readers.patch new file mode 100644 index 0000000..fcb85b2 --- /dev/null +++ b/patches.suse/vt-keyboard-extend-func_buf_lock-to-readers.patch @@ -0,0 +1,91 @@ +From: Jiri Slaby +Date: Mon, 19 Oct 2020 10:55:17 +0200 +Subject: vt: keyboard, extend func_buf_lock to readers +Git-commit: 82e61c3909db51d91b9d3e2071557b6435018b80 +Patch-mainline: 5.10-rc2 +References: bnc#1177766 CVE-2020-25656 + +Both read-side users of func_table/func_buf need locking. Without that, +one can easily confuse the code by repeatedly setting altering strings +like: +while (1) + for (a = 0; a < 2; a++) { + struct kbsentry kbs = {}; + strcpy((char *)kbs.kb_string, a ? ".\n" : "88888\n"); + ioctl(fd, KDSKBSENT, &kbs); + } + +When that program runs, one can get unexpected output by holding F1 +(note the unxpected period on the last line): +. +88888 +.8888 + +So protect all accesses to 'func_table' (and func_buf) by preexisting +'func_buf_lock'. + +It is easy in 'k_fn' handler as 'puts_queue' is expected not to sleep. +On the other hand, KDGKBSENT needs a local (atomic) copy of the string +because copy_to_user can sleep. Use already allocated, but unused +'kbs->kb_string' for that purpose. + +Note that the program above needs at least CAP_SYS_TTY_CONFIG. + +This depends on the previous patch and on the func_buf_lock lock added +in commit 46ca3f735f34 (tty/vt: fix write/write race in ioctl(KDSKBSENT) +handler) in 5.2. + +Likely fixes CVE-2020-25656. + +Cc: +Reported-by: Minh Yuan +Signed-off-by: Jiri Slaby +Link: https://lore.kernel.org/r/20201019085517.10176-2-jslaby@suse.cz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/vt/keyboard.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- a/drivers/tty/vt/keyboard.c ++++ b/drivers/tty/vt/keyboard.c +@@ -713,8 +713,13 @@ static void k_fn(struct vc_data *vc, uns + return; + + if ((unsigned)value < ARRAY_SIZE(func_table)) { ++ unsigned long flags; ++ ++ spin_lock_irqsave(&func_buf_lock, flags); + if (func_table[value]) + puts_queue(vc, func_table[value]); ++ spin_unlock_irqrestore(&func_buf_lock, flags); ++ + } else + pr_err("k_fn called with value=%d\n", value); + } +@@ -1960,7 +1965,7 @@ out: + #undef s + #undef v + +-/* FIXME: This one needs untangling and locking */ ++/* FIXME: This one needs untangling */ + int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) + { + struct kbsentry *kbs; +@@ -1992,10 +1997,14 @@ int vt_do_kdgkb_ioctl(int cmd, struct kb + switch (cmd) { + case KDGKBSENT: { + /* size should have been a struct member */ +- unsigned char *from = func_table[i] ? : ""; ++ ssize_t len = sizeof(user_kdgkb->kb_string); ++ ++ spin_lock_irqsave(&func_buf_lock, flags); ++ len = strlcpy(kbs->kb_string, func_table[i] ? : "", len); ++ spin_unlock_irqrestore(&func_buf_lock, flags); + +- ret = copy_to_user(user_kdgkb->kb_string, from, +- strlen(from) + 1) ? -EFAULT : 0; ++ ret = copy_to_user(user_kdgkb->kb_string, kbs->kb_string, ++ len + 1) ? -EFAULT : 0; + + goto reterr; + } diff --git a/patches.suse/vt-keyboard-simplify-vt_kdgkbsent.patch b/patches.suse/vt-keyboard-simplify-vt_kdgkbsent.patch new file mode 100644 index 0000000..c677a5e --- /dev/null +++ b/patches.suse/vt-keyboard-simplify-vt_kdgkbsent.patch @@ -0,0 +1,70 @@ +From: Jiri Slaby +Date: Mon, 19 Oct 2020 10:55:16 +0200 +Subject: vt: keyboard, simplify vt_kdgkbsent +Git-commit: 6ca03f90527e499dd5e32d6522909e2ad390896b +Patch-mainline: 5.10-rc2 +References: bnc#1177766 CVE-2020-25656 + +Use 'strlen' of the string, add one for NUL terminator and simply do +'copy_to_user' instead of the explicit 'for' loop. This makes the +KDGKBSENT case more compact. + +The only thing we need to take care about is NULL 'func_table[i]'. Use +an empty string in that case. + +The original check for overflow could never trigger as the func_buf +strings are always shorter or equal to 'struct kbsentry's. + +Cc: +Signed-off-by: Jiri Slaby +Link: https://lore.kernel.org/r/20201019085517.10176-1-jslaby@suse.cz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/vt/keyboard.c | 28 +++++++++------------------- + 1 file changed, 9 insertions(+), 19 deletions(-) + +--- a/drivers/tty/vt/keyboard.c ++++ b/drivers/tty/vt/keyboard.c +@@ -1964,9 +1964,7 @@ out: + int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) + { + struct kbsentry *kbs; +- char *p; + u_char *q; +- u_char __user *up; + int sz, fnw_sz; + int delta; + char *first_free, *fj, *fnw; +@@ -1992,23 +1990,15 @@ int vt_do_kdgkb_ioctl(int cmd, struct kb + i = kbs->kb_func; + + switch (cmd) { +- case KDGKBSENT: +- sz = sizeof(kbs->kb_string) - 1; /* sz should have been +- a struct member */ +- up = user_kdgkb->kb_string; +- p = func_table[i]; +- if(p) +- for ( ; *p && sz; p++, sz--) +- if (put_user(*p, up++)) { +- ret = -EFAULT; +- goto reterr; +- } +- if (put_user('\0', up)) { +- ret = -EFAULT; +- goto reterr; +- } +- kfree(kbs); +- return ((p && *p) ? -EOVERFLOW : 0); ++ case KDGKBSENT: { ++ /* size should have been a struct member */ ++ unsigned char *from = func_table[i] ? : ""; ++ ++ ret = copy_to_user(user_kdgkb->kb_string, from, ++ strlen(from) + 1) ? -EFAULT : 0; ++ ++ goto reterr; ++ } + case KDSKBSENT: + if (!perm) { + ret = -EPERM; diff --git a/patches.suse/x86-kexec-Use-up-to-dated-screen_info-copy-to-fill-b.patch b/patches.suse/x86-kexec-Use-up-to-dated-screen_info-copy-to-fill-b.patch new file mode 100644 index 0000000..70b6740 --- /dev/null +++ b/patches.suse/x86-kexec-Use-up-to-dated-screen_info-copy-to-fill-b.patch @@ -0,0 +1,44 @@ +From: Kairui Song +Date: Wed, 14 Oct 2020 17:24:28 +0800 +Patch-mainline: v5.10-rc2 +References: bsc#1175306 +Subject: x86/kexec: Use up-to-dated screen_info copy to fill boot params +Git-commit: afc18069a2cb7ead5f86623a5f3d4ad6e21f940d + +kexec_file_load() currently reuses the old boot_params.screen_info, +but if drivers have change the hardware state, boot_param.screen_info +could contain invalid info. + +For example, the video type might be no longer VGA, or the frame buffer +address might be changed. If the kexec kernel keeps using the old screen_info, +kexec'ed kernel may attempt to write to an invalid framebuffer +memory region. + +There are two screen_info instances globally available, boot_params.screen_info +and screen_info. Later one is a copy, and is updated by drivers. + +So let kexec_file_load use the updated copy. + +[ mingo: Tidied up the changelog. ] + +Signed-off-by: Kairui Song +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20201014092429.1415040-2-kasong@redhat.com +Acked-by: Olaf Hering +--- + arch/x86/kernel/kexec-bzimage64.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c +--- a/arch/x86/kernel/kexec-bzimage64.c ++++ b/arch/x86/kernel/kexec-bzimage64.c +@@ -200,8 +200,7 @@ setup_boot_parameters(struct kimage *image, struct boot_params *params, + params->hdr.hardware_subarch = boot_params.hdr.hardware_subarch; + + /* Copying screen_info will do? */ +- memcpy(¶ms->screen_info, &boot_params.screen_info, +- sizeof(struct screen_info)); ++ memcpy(¶ms->screen_info, &screen_info, sizeof(struct screen_info)); + + /* Fill in memsize later */ + params->screen_info.ext_mem_k = 0; diff --git a/patches.suse/x86-unwind-orc-fix-inactive-tasks-with-stack-pointer-in-sp-on-gcc-10-compiled-kernels.patch b/patches.suse/x86-unwind-orc-fix-inactive-tasks-with-stack-pointer-in-sp-on-gcc-10-compiled-kernels.patch new file mode 100644 index 0000000..2ae5755 --- /dev/null +++ b/patches.suse/x86-unwind-orc-fix-inactive-tasks-with-stack-pointer-in-sp-on-gcc-10-compiled-kernels.patch @@ -0,0 +1,142 @@ +From: Jiri Slaby +Date: Wed, 14 Oct 2020 07:30:51 +0200 +Subject: x86/unwind/orc: Fix inactive tasks with stack pointer in %sp on GCC + 10 compiled kernels +Git-commit: f2ac57a4c49d40409c21c82d23b5706df9b438af +Patch-mainline: v5.10-rc2 +References: bsc#1058115 bsc#1176907 + +GCC 10 optimizes the scheduler code differently than its predecessors. + +When CONFIG_DEBUG_SECTION_MISMATCH=y, the Makefile forces GCC not +to inline some functions (-fno-inline-functions-called-once). Before GCC +10, "no-inlined" __schedule() starts with the usual prologue: + + push %bp + mov %sp, %bp + +So the ORC unwinder simply picks stack pointer from %bp and +unwinds from __schedule() just perfectly: + + $ cat /proc/1/stack + [<0>] ep_poll+0x3e9/0x450 + [<0>] do_epoll_wait+0xaa/0xc0 + [<0>] __x64_sys_epoll_wait+0x1a/0x20 + [<0>] do_syscall_64+0x33/0x40 + [<0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +But now, with GCC 10, there is no %bp prologue in __schedule(): + + $ cat /proc/1/stack + + +The ORC entry of the point in __schedule() is: + + sp:sp+88 bp:last_sp-48 type:call end:0 + +In this case, nobody subtracts sizeof "struct inactive_task_frame" in +__unwind_start(). The struct is put on the stack by __switch_to_asm() and +only then __switch_to_asm() stores %sp to task->thread.sp. But we start +unwinding from a point in __schedule() (stored in frame->ret_addr by +'call') and not in __switch_to_asm(). + +So for these example values in __unwind_start(): + + sp=ffff94b50001fdc8 bp=ffff8e1f41d29340 ip=__schedule+0x1f0 + +The stack is: + + ffff94b50001fdc8: ffff8e1f41578000 # struct inactive_task_frame + ffff94b50001fdd0: 0000000000000000 + ffff94b50001fdd8: ffff8e1f41d29340 + ffff94b50001fde0: ffff8e1f41611d40 # ... + ffff94b50001fde8: ffffffff93c41920 # bx + ffff94b50001fdf0: ffff8e1f41d29340 # bp + ffff94b50001fdf8: ffffffff9376cad0 # ret_addr (and end of the struct) + +0xffffffff9376cad0 is __schedule+0x1f0 (after the call to +__switch_to_asm). Now follow those 88 bytes from the ORC entry (sp+88). +The entry is correct, __schedule() really pushes 48 bytes (8*7) + 32 bytes +via subq to store some local values (like 4U below). So to unwind, look +at the offset 88-sizeof(long) = 0x50 from here: + + ffff94b50001fe00: ffff8e1f41578618 + ffff94b50001fe08: 00000cc000000255 + ffff94b50001fe10: 0000000500000004 + ffff94b50001fe18: 7793fab6956b2d00 # NOTE (see below) + ffff94b50001fe20: ffff8e1f41578000 + ffff94b50001fe28: ffff8e1f41578000 + ffff94b50001fe30: ffff8e1f41578000 + ffff94b50001fe38: ffff8e1f41578000 + ffff94b50001fe40: ffff94b50001fed8 + ffff94b50001fe48: ffff8e1f41577ff0 + ffff94b50001fe50: ffffffff9376cf12 + +Here ^^^^^^^^^^^^^^^^ is the correct ret addr from +__schedule(). It translates to schedule+0x42 (insn after a call to +__schedule()). + +BUT, unwind_next_frame() tries to take the address starting from +0xffff94b50001fdc8. That is exactly from thread.sp+88-sizeof(long) = +0xffff94b50001fdc8+88-8 = 0xffff94b50001fe18, which is garbage marked as +NOTE above. So this quits the unwinding as 7793fab6956b2d00 is obviously +not a kernel address. + +There was a fix to skip 'struct inactive_task_frame' in +unwind_get_return_address_ptr in the following commit: + + 187b96db5ca7 ("x86/unwind/orc: Fix unwind_get_return_address_ptr() for inactive tasks") + +But we need to skip the struct already in the unwinder proper. So +subtract the size (increase the stack pointer) of the structure in +__unwind_start() directly. This allows for removal of the code added by +commit 187b96db5ca7 completely, as the address is now at +'(unsigned long *)state->sp - 1', the same as in the generic case. + +[ mingo: Cleaned up the changelog a bit, for better readability. ] + +Fixes: ee9f8fce9964 ("x86/unwind: Add the ORC unwinder") +Bug: https://bugzilla.suse.com/show_bug.cgi?id=1176907 +Signed-off-by: Jiri Slaby +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20201014053051.24199-1-jslaby@suse.cz + +Acked-by: Miroslav Benes +--- + arch/x86/kernel/unwind_orc.c | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c +index ec88bbe08a32..4a96aa3de7d8 100644 +--- a/arch/x86/kernel/unwind_orc.c ++++ b/arch/x86/kernel/unwind_orc.c +@@ -320,19 +320,12 @@ EXPORT_SYMBOL_GPL(unwind_get_return_address); + + unsigned long *unwind_get_return_address_ptr(struct unwind_state *state) + { +- struct task_struct *task = state->task; +- + if (unwind_done(state)) + return NULL; + + if (state->regs) + return &state->regs->ip; + +- if (task != current && state->sp == task->thread.sp) { +- struct inactive_task_frame *frame = (void *)task->thread.sp; +- return &frame->ret_addr; +- } +- + if (state->sp) + return (unsigned long *)state->sp - 1; + +@@ -662,7 +655,7 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task, + } else { + struct inactive_task_frame *frame = (void *)task->thread.sp; + +- state->sp = task->thread.sp; ++ state->sp = task->thread.sp + sizeof(*frame); + state->bp = READ_ONCE_NOCHECK(frame->bp); + state->ip = READ_ONCE_NOCHECK(frame->ret_addr); + state->signal = (void *)state->ip == ret_from_fork; + diff --git a/patches.suse/xfs-don-t-update-mtime-on-COW-faults.patch b/patches.suse/xfs-don-t-update-mtime-on-COW-faults.patch new file mode 100644 index 0000000..9c4b33d --- /dev/null +++ b/patches.suse/xfs-don-t-update-mtime-on-COW-faults.patch @@ -0,0 +1,72 @@ +From b17164e258e3888d376a7434415013175d637377 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Sat, 5 Sep 2020 08:13:02 -0400 +Subject: [PATCH] xfs: don't update mtime on COW faults +Git-commit: b17164e258e3888d376a7434415013175d637377 +Patch-mainline: v5.9-rc4 +References: bsc#1167030 + +When running in a dax mode, if the user maps a page with MAP_PRIVATE and +PROT_WRITE, the xfs filesystem would incorrectly update ctime and mtime +when the user hits a COW fault. + +This breaks building of the Linux kernel. How to reproduce: + + 1. extract the Linux kernel tree on dax-mounted xfs filesystem + 2. run make clean + 3. run make -j12 + 4. run make -j12 + +at step 4, make would incorrectly rebuild the whole kernel (although it +was already built in step 3). + +The reason for the breakage is that almost all object files depend on +objtool. When we run objtool, it takes COW page fault on its .data +section, and these faults will incorrectly update the timestamp of the +objtool binary. The updated timestamp causes make to rebuild the whole +tree. + +Signed-off-by: Mikulas Patocka +Cc: stable@vger.kernel.org +Signed-off-by: Linus Torvalds +Acked-by: Anthony Iliopoulos + +--- + fs/xfs/xfs_file.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/fs/xfs/xfs_file.c ++++ b/fs/xfs/xfs_file.c +@@ -1109,6 +1109,14 @@ + return ret; + } + ++static inline bool ++xfs_is_write_fault( ++ struct vm_fault *vmf) ++{ ++ return (vmf->flags & FAULT_FLAG_WRITE) && ++ (vmf->vma->vm_flags & VM_SHARED); ++} ++ + static int + xfs_filemap_fault( + struct vm_fault *vmf) +@@ -1116,7 +1124,7 @@ + /* DAX can shortcut the normal fault path on write faults! */ + return __xfs_filemap_fault(vmf, PE_SIZE_PTE, + IS_DAX(file_inode(vmf->vma->vm_file)) && +- (vmf->flags & FAULT_FLAG_WRITE)); ++ xfs_is_write_fault(vmf)); + } + + static int +@@ -1129,7 +1137,7 @@ + + /* DAX can shortcut the normal fault path on write faults! */ + return __xfs_filemap_fault(vmf, pe_size, +- (vmf->flags & FAULT_FLAG_WRITE)); ++ xfs_is_write_fault(vmf)); + } + + static int diff --git a/patches.suse/xfs-flush-new-eof-page-on-truncate-to-avoid-post-eof.patch b/patches.suse/xfs-flush-new-eof-page-on-truncate-to-avoid-post-eof.patch new file mode 100644 index 0000000..82d5314 --- /dev/null +++ b/patches.suse/xfs-flush-new-eof-page-on-truncate-to-avoid-post-eof.patch @@ -0,0 +1,66 @@ +From 869ae85dae64b5540e4362d7fe4cd520e10ec05c Mon Sep 17 00:00:00 2001 +From: Brian Foster +Date: Thu, 29 Oct 2020 14:30:48 -0700 +Subject: [PATCH] xfs: flush new eof page on truncate to avoid post-eof + corruption +Git-commit: 869ae85dae64b5540e4362d7fe4cd520e10ec05c +Patch-mainline: v5.10-rc3 +References: git-fixes + +It is possible to expose non-zeroed post-EOF data in XFS if the new +EOF page is dirty, backed by an unwritten block and the truncate +happens to race with writeback. iomap_truncate_page() will not zero +the post-EOF portion of the page if the underlying block is +unwritten. The subsequent call to truncate_setsize() will, but +doesn't dirty the page. Therefore, if writeback happens to complete +after iomap_truncate_page() (so it still sees the unwritten block) +but before truncate_setsize(), the cached page becomes inconsistent +with the on-disk block. A mapped read after the associated page is +reclaimed or invalidated exposes non-zero post-EOF data. + +For example, consider the following sequence when run on a kernel +modified to explicitly flush the new EOF page within the race +Window: + +$ xfs_io -fc "falloc 0 4k" -c fsync /mnt/file +$ xfs_io -c "pwrite 0 4k" -c "truncate 1k" /mnt/file + ... +$ xfs_io -c "mmap 0 4k" -c "mread -v 1k 8" /mnt/file +00000400: 00 00 00 00 00 00 00 00 ........ +$ umount /mnt/; mount /mnt/ +$ xfs_io -c "mmap 0 4k" -c "mread -v 1k 8" /mnt/file +00000400: cd cd cd cd cd cd cd cd ........ + +Update xfs_setattr_size() to explicitly flush the new EOF page prior +to the page truncate to ensure iomap has the latest state of the +underlying block. + +Fixes: 68a9f5e7007c ("xfs: implement iomap based buffered write path") +Signed-off-by: Brian Foster +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Acked-by: Anthony Iliopoulos + +--- + fs/xfs/xfs_iops.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/fs/xfs/xfs_iops.c ++++ b/fs/xfs/xfs_iops.c +@@ -886,6 +886,16 @@ + error = iomap_zero_range(inode, oldsize, newsize - oldsize, + &did_zeroing, &xfs_iomap_ops); + } else { ++ /* ++ * iomap won't detect a dirty page over an unwritten block (or a ++ * cow block over a hole) and subsequently skips zeroing the ++ * newly post-EOF portion of the page. Flush the new EOF to ++ * convert the block before the pagecache truncate. ++ */ ++ error = filemap_write_and_wait_range(inode->i_mapping, newsize, ++ newsize); ++ if (error) ++ return error; + error = iomap_truncate_page(inode, newsize, &did_zeroing, + &xfs_iomap_ops); + } diff --git a/patches.suse/xhci-don-t-create-endpoint-debugfs-entry-before-ring.patch b/patches.suse/xhci-don-t-create-endpoint-debugfs-entry-before-ring.patch new file mode 100644 index 0000000..0d95c9a --- /dev/null +++ b/patches.suse/xhci-don-t-create-endpoint-debugfs-entry-before-ring.patch @@ -0,0 +1,46 @@ +From 167657a1bb5fcde53ac304ce6c564bd90a2f9185 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Fri, 18 Sep 2020 16:17:51 +0300 +Subject: [PATCH] xhci: don't create endpoint debugfs entry before ring buffer + is set. +Git-commit: 167657a1bb5fcde53ac304ce6c564bd90a2f9185 +References: git-fixes +Patch-mainline: v5.10-rc1 + +Make sure xHC completes the configure endpoint command and xhci driver +sets the ring pointers correctly before we create the user readable +debugfs file. + +In theory there was a small gap where a user could have read the +debugfs file and cause a NULL pointer dereference error as ring +pointer was not yet set, in practise we want this change to simplify +the upcoming streams debugfs support. + +Fixes: 02b6fdc2a153 ("usb: xhci: Add debugfs interface for xHCI driver") +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20200918131752.16488-10-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Oliver Neukum +--- + drivers/usb/host/xhci.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -1899,8 +1899,6 @@ static int xhci_add_endpoint(struct usb_ + /* Store the usb_device pointer for later use */ + ep->hcpriv = udev; + +- xhci_debugfs_create_endpoint(xhci, virt_dev, ep_index); +- + xhci_dbg(xhci, "add ep 0x%x, slot id %d, new drop flags = %#x, new add flags = %#x\n", + (unsigned int) ep->desc.bEndpointAddress, + udev->slot_id, +@@ -2927,6 +2925,7 @@ static int xhci_check_bandwidth(struct u + xhci_check_bw_drop_ep_streams(xhci, virt_dev, i); + virt_dev->eps[i].ring = virt_dev->eps[i].new_ring; + virt_dev->eps[i].new_ring = NULL; ++ xhci_debugfs_create_endpoint(xhci, virt_dev, i); + } + command_cleanup: + kfree(command->completion); diff --git a/rpm/kernel-binary.spec.in b/rpm/kernel-binary.spec.in index d33d8be..aff7ff9 100644 --- a/rpm/kernel-binary.spec.in +++ b/rpm/kernel-binary.spec.in @@ -818,13 +818,16 @@ if [ %CONFIG_MODULES = y ]; then fi # These files are required for building external modules - for FILE in arch/powerpc/lib/crtsavres.o arch/arm64/kernel/ftrace-mod.o arch/*/kernel/macros.s; do + for FILE in arch/powerpc/lib/crtsavres.o arch/arm64/kernel/ftrace-mod.o \ + arch/*/kernel/macros.s scripts/module.lds + do if [ -f %kernel_build_dir/$FILE ]; then echo $FILE >> %my_builddir/obj-files fi done - tar --exclude=\*.ipa-clones -cf - -T %my_builddir/obj-files | \ + tar --exclude=\*.ipa-clones --exclude=.config.old --exclude=.kernel-binary.spec.buildenv \ + -cf - -T %my_builddir/obj-files | \ tar -xf - -C %rpm_install_dir/%cpu_arch_flavor # bnc#507084 find %rpm_install_dir/%cpu_arch_flavor/scripts -type f -perm -111 | \ @@ -841,10 +844,6 @@ if [ %CONFIG_MODULES = y ]; then fi rm -rf %{buildroot}/lib/firmware -if [ %CONFIG_MODULES = y ]; then - # file contains number of CPUs, making builds hard to reproduce - find %{buildroot}/usr/src/linux-*-obj/ -name .kernel-binary.spec.buildenv -delete -fi add_dirs_to_filelist() { sed -rn ' @@ -1172,7 +1171,7 @@ fi %preun -n @KMP_NAME@-%build_flavor nvr=@KMP_NAME@-%build_flavor-%version-%release -rpm -ql "$nvr" | grep '\.ko$' > "/var/run/rpm-$nvr-modules" +rpm -ql "$nvr" | grep '\.ko\(\.xz\)\?$' > "/var/run/rpm-$nvr-modules" %postun -n @KMP_NAME@-%build_flavor wm2=/usr/lib/module-init-tools/weak-modules2 diff --git a/rpm/kernel-module-subpackage b/rpm/kernel-module-subpackage index 325f352..84cedc3 100644 --- a/rpm/kernel-module-subpackage +++ b/rpm/kernel-module-subpackage @@ -9,7 +9,7 @@ for spec in {%_sourcedir,%_specdir}/%name.spec /dev/null; do done awk ' BEGIN { tags["summary"] = "Summary: %summary" - tags["group"] = "Group: %group" } + tags["group"] = "" } /^%%/ { in_pkg_header = \ ($0 ~ /^%%package[ \t]+KMP[ \t]*$/ || $0 ~ /^%%package[ \t]+-n[ \t]*%name-KMP[ \t]*$/) @@ -18,7 +18,7 @@ in_pkg_header && /^(Summary|Group):[ \t]*/ \ { tag = tolower($1) ; sub(/:$/, "", tag) tags[tag] = $0 } END { print tags["summary"] - print tags["group"] } + if ( tags["group"] != "" ) print tags["group"] } ' $spec ) Provides: %{-n*}-kmp = %_this_kmp_version diff --git a/scripts/renamepatches b/scripts/renamepatches index bc26dc9..f86d7da 100755 --- a/scripts/renamepatches +++ b/scripts/renamepatches @@ -1,4 +1,26 @@ #!/bin/sh + +# Especially during feature development it can easily happen that a patch that +# was added to base branch as fix is added to derived branch as part of a +# feature by different developer under different name. Merging the base branch +# then becomes difficult. + +# This script checks a few patch tags to match patch files across two +# kernel-source branches and moves patch files in the working tree to match +# filenames in the branch you specify. + +# This then allows merging more easily: instead of duplicated patch files that +# git does not know how to detect you get conflicting added files under same +# filename which git does point out. + +# Also if the reference branch contains duplicate files the rename is not +# stable. That is if you run renamefiles, commit the result, run it again, and +# there are changes again you have duplicate patches in the reference branch +# with which you are trying to aling patch names. This can be either false +# positive because mutiple patch tags are checked or an actual patch that +# applies indefinitely because it adds the same context it applies to which is +# applied multiple times. + if [ $# != 1 ] ; then echo Usage: $0 "" echo Run in kernel-source to rename patches in the current branch to the same filename as they ahve in the given branch. diff --git a/series.conf b/series.conf index 8b810bf..87261f3 100644 --- a/series.conf +++ b/series.conf @@ -23663,6 +23663,7 @@ patches.suse/powerpc-pseries-radix-is-not-subject-to-RMA-limit-re.patch patches.suse/powerpc-pseries-lift-RTAS-limit-for-radix.patch patches.suse/powerpc-64s-Relax-PACA-address-limitations.patch + patches.suse/powerpc-pseries-cpuidle-add-polling-idle-for-shared-.patch patches.suse/powerpc-initial-pkey-plumbing.patch patches.suse/powerpc-track-allocation-status-of-all-pkeys.patch patches.suse/powerpc-helper-function-to-read-write-AMR-IAMR-UAMOR.patch @@ -53039,6 +53040,8 @@ patches.suse/powerpc-fadump-when-fadump-is-supported-register-the.patch patches.suse/powerpc-mm-drop-ifdef-CONFIG_MMU-in-is_ioremap_addr.patch patches.suse/powerpc-powernv-Disable-native-PCIe-port-management.patch + patches.suse/msft-hv-1972-video-hyperv-hyperv_fb-Obtain-screen-resolution-from.patch + patches.suse/msft-hv-1973-video-hyperv-hyperv_fb-Support-deferred-IO-for-Hyper.patch patches.suse/msft-hv-1976-Drivers-hv-Specify-receive-buffer-size-using-Hyper-V.patch patches.suse/msft-hv-1980-Drivers-hv-balloon-Remove-dependencies-on-guest-page.patch patches.suse/compat_ioctl-handle-SIOCOUTQNSD.patch @@ -53707,6 +53710,7 @@ patches.suse/vmxnet3-Remove-always-false-conditional-statement.patch patches.suse/ptr_ring-add-include-of-linux-mm.h.patch patches.suse/0055-amd-xgbe-remove-unnecessary-conversion-to-bool.patch + patches.suse/msft-hv-2010-hv_netvsc-Add-XDP-support.patch patches.suse/net_sched-ematch-reject-invalid-TCF_EM_SIMPLE.patch patches.suse/Bluetooth-Fix-race-condition-in-hci_release_sock.patch patches.suse/mwifiex-drop-most-magic-numbers-from-mwifiex_process.patch @@ -53904,6 +53908,7 @@ patches.suse/vfs-fix-do_last-regression.patch patches.suse/cifs-fix-soft-mounts-hanging-in-the-reconnect-code.patch patches.suse/msft-hv-2011-hv_balloon-Balloon-up-according-to-request-page-numb.patch + patches.suse/msft-hv-2015-video-hyperv-hyperv_fb-Use-physical-memory-for-fb-on.patch patches.suse/mfd-dln2-More-sanity-checking-for-endpoints.patch patches.suse/mfd-da9062-Fix-watchdog-compatible-string.patch patches.suse/mfd-rn5t618-Mark-ADC-control-register-volatile.patch @@ -53989,6 +53994,7 @@ patches.suse/net-systemport-Avoid-RBUF-stuck-in-Wake-on-LAN-mode.patch patches.suse/net-mlx5-IPsec-Fix-esp-modify-function-attribute.patch patches.suse/net-mlx5-IPsec-fix-memory-leak-at-mlx5_fpga_ipsec_de.patch + patches.suse/msft-hv-2023-hv_netvsc-Fix-XDP-refcnt-for-synthetic-and-VF-NICs.patch patches.suse/mlxsw-spectrum_dpipe-Add-missing-error-path.patch patches.suse/mwifiex-fix-unbalanced-locking-in-mwifiex_process_co.patch patches.suse/mwifiex-Fix-possible-buffer-overflows-in-mwifiex_ret.patch @@ -54309,6 +54315,7 @@ patches.suse/intel_th-Fix-user-visible-error-codes.patch patches.suse/intel_th-pci-Add-Elkhart-Lake-CPU-support.patch patches.suse/nvme-rdma-Avoid-double-freeing-of-async-event-data.patch + patches.suse/memcg-fix-null-pointer-dereference-in-_mem_cgroup_usage_unregister_event.patch patches.suse/x86-mm-split-vmalloc_sync_all.patch patches.suse/btrfs-fix-log-context-list-corruption-after-rename-w.patch patches.suse/net_sched-keep-alloc_hash-updated-after-hash-allocat.patch @@ -55241,6 +55248,7 @@ patches.suse/vfio-type1-support-faulting-pfnmap-vmas patches.suse/vfio-pci-fault-mmaps-to-enable-vma-tracking patches.suse/vfio-pci-invalidate-mmaps-and-block-mmio-access-on-disabled-memory + patches.suse/0001-ipmi-use-vzalloc-instead-of-kmalloc-for-user-creatio.patch patches.suse/gpiolib-Document-that-GPIO-line-names-are-not-global.patch patches.suse/RDMA-efa-Fix-setting-of-wrong-bit-in-get-set_feature.patch patches.suse/scsi-qla2xxx-Split-qla2x00_configure_local_loop.patch @@ -55408,6 +55416,7 @@ patches.suse/btrfs-fix-RWF_NOWAIT-write-not-failling-when-we-need.patch patches.suse/btrfs-fix-RWF_NOWAIT-writes-blocking-on-extent-locks.patch patches.suse/ALSA-hda-realtek-Add-quirk-for-MSI-GE63-laptop.patch + patches.suse/0001-ALSA-usb-audio-Fix-potential-use-after-free-of-strea.patch patches.suse/ALSA-hda-realtek-Add-mute-LED-and-micmute-LED-suppor.patch patches.suse/RDMA-efa-Set-maximum-pkeys-device-attribute.patch patches.suse/tracing-fix-event-trigger-to-accept-redundant-spaces.patch @@ -55564,6 +55573,7 @@ patches.suse/btrfs-fix-double-free-on-ulist-after-backref-resolut.patch patches.suse/btrfs-qgroup-fix-data-leak-caused-by-race-between-wr.patch patches.suse/btrfs-fix-page-leaks-after-failure-to-lock-page-for-.patch + patches.suse/mm-memcg-fix-refcount-error-while-moving-and-swapping.patch patches.suse/io-mapping-indicate-mapping-failure.patch patches.suse/bnxt_en-Fix-completion-ring-sizing-with-TPA-enabled.patch patches.suse/ip6_gre-fix-null-ptr-deref-in-ip6gre_init_net.patch @@ -55605,7 +55615,6 @@ patches.suse/0004-drm-hold-gem-reference-until-object-is-no-longer-acc.patch patches.suse/nvme-add-a-identify-namespace-identification-descriptor-list-quirk.patch patches.suse/drm-amdgpu-Prevent-kernel-infoleak-in-amdgpu_info_io.patch - patches.suse/0005-Revert-drm-amdgpu-Fix-NULL-dereference-in-dpm-sysfs-.patch patches.suse/0007-ALSA-hda-realtek-enable-headset-mic-of-ASUS-ROG-Zeph.patch patches.suse/ALSA-hda-realtek-typo_fix-enable-headset-mic-of-ASUS.patch patches.suse/ALSA-hda-realtek-Fix-add-a-ultra_low_power-function-.patch @@ -55889,6 +55898,7 @@ patches.suse/powerpc-xmon-Use-dcbf-inplace-of-dcbi-instruction-fo.patch patches.suse/powerpc-book3s64-radix-Add-kernel-command-line-optio.patch patches.suse/powerpc-pseries-hotplug-cpu-Remove-double-free-in-er.patch + patches.suse/powerpc-Fix-circular-dependency-between-percpu.h-and.patch patches.suse/0001-xen-balloon-fix-accounting-in-alloc_xenballooned_pag.patch patches.suse/0001-xen-balloon-make-the-balloon-wait-interruptible.patch patches.suse/0001-Revert-xen-balloon-Fix-crash-when-ballooning-on-x86-.patch @@ -55896,6 +55906,7 @@ patches.suse/xfs-fix-inode-allocation-block-res-calculation-prece.patch patches.suse/ocfs2-fix-remounting-needed-after-setfacl-command.patch patches.suse/ocfs2-change-slot-number-type-s16-to-u16.patch + patches.suse/ocfs2-fix-unbalanced-locking.patch patches.suse/mm-filemap-clear-idle-flag-for-writes.patch patches.suse/media-pci-ttpci-av7110-fix-possible-buffer-overflow-.patch patches.suse/media-budget-core-Improve-exception-handling-in-budg.patch @@ -56073,6 +56084,7 @@ patches.suse/USB-lvtest-return-proper-error-code-in-probe.patch patches.suse/usb-gadget-f_tcm-Fix-some-resource-leaks-in-some-err.patch patches.suse/usb-uas-Add-quirk-for-PNY-Pro-Elite.patch + patches.suse/usb-host-xhci-fix-ep-context-print-mismatch-in-debug.patch patches.suse/xhci-Do-warm-reset-when-both-CAS-and-XDEV_RESUME-are.patch patches.suse/USB-gadget-u_f-add-overflow-checks-to-VLA-macros.patch patches.suse/USB-gadget-f_ncm-add-bounds-checks-to-ncm_unwrap_ntb.patch @@ -56119,6 +56131,7 @@ patches.suse/thermal-ti-soc-thermal-Fix-bogus-thermal-shutdowns-f.patch patches.suse/block-ensure-bdi-io_pages-is-always-initialized.patch patches.suse/block-allow-for_each_bvec-to-support-zero-len-bvec.patch + patches.suse/xfs-don-t-update-mtime-on-COW-faults.patch patches.suse/mm-rmap-fixup-copying-of-soft-dirty-and-uffd-ptes.patch patches.suse/0001-mm-hugetlb-fix-a-race-between-hugetlb-sysctl-handler.patch patches.suse/x86-fakenuma-fix-invalid-starting-node-id.patch @@ -56136,6 +56149,7 @@ patches.suse/rbd-require-global-cap_sys_admin-for-mapping-and-unmapping.patch patches.suse/btrfs-require-only-sector-size-alignment-for-parent-.patch patches.suse/video-fbdev-fix-OOB-read-in-vga_8planes_imageblit.patch + patches.suse/debugfs-Fix-module-state-check-condition.patch patches.suse/iio-adc-ti-ads1015-fix-conversion-when-CONFIG_PM-is-.patch patches.suse/iio-accel-kxsd9-Fix-alignment-of-local-buffer.patch patches.suse/iio-accel-bmc150-accel-Fix-timestamp-alignment-and-p.patch @@ -56159,7 +56173,6 @@ patches.suse/msft-hv-2136-Drivers-hv-vmbus-Add-timeout-to-vmbus_wait_for_unloa.patch patches.suse/clk-rockchip-Fix-initialization-of-mux_pll_src_4plls.patch patches.suse/drm-amdkfd-fix-a-memory-leak-issue.patch - patches.suse/drm-radeon-revert-Prefer-lower-feedback-dividers.patch patches.suse/drm-mediatek-Add-exception-handing-in-mtk_drm_probe-.patch patches.suse/drm-mediatek-Add-missing-put_device-call-in-mtk_hdmi.patch patches.suse/iommu-amd-fix-potential-entry-null-deref @@ -56205,7 +56218,6 @@ patches.suse/pinctrl-mvebu-Fix-i2c-sda-definition-for-98DX3236.patch patches.suse/Input-i8042-add-nopnp-quirk-for-Acer-Aspire-5-A515.patch patches.suse/i2c-cpm-Fix-i2c_ram-structure.patch - patches.suse/USB-gadget-f_ncm-Fix-NDP16-datagram-validation.patch patches.suse/xen-events-don-t-use-chip_data-for-legacy-IRQs.patch patches.suse/vmxnet3-fix-cksum-offload-issues-for-non-udp-tunnels.patch patches.suse/platform-x86-thinkpad_acpi-initialize-tp_nvram_state.patch @@ -56218,8 +56230,10 @@ patches.suse/net-usb-qmi_wwan-add-Cellient-MPL200-card.patch patches.suse/mmc-core-don-t-set-limits.discard_granularity-as-0.patch patches.suse/i2c-meson-fix-clock-setting-overwrite.patch + patches.suse/arm64-Run-ARCH_WORKAROUND_1-enabling-code-on-all-CPU.patch patches.suse/edac-i5100-fix-error-handling-order-in-i5100_init_one.patch patches.suse/x86-fpu-allow-multiple-bits-in-clearcpuid-parameter.patch + patches.suse/efivarfs-Replace-invalid-slashes-with-exclamation-ma.patch patches.suse/perf-x86-amd-fix-sampling-large-increment-per-cycle-events.patch patches.suse/perf-x86-fix-n_pair-for-cancelled-txn.patch patches.suse/0001-perf-core-Fix-race-in-the-perf_mmap_close-function.patch @@ -56229,11 +56243,14 @@ patches.suse/crypto-omap-sham-fix-digcnt-register-handling-with-e.patch patches.suse/cypto-mediatek-fix-leaks-in-mtk_desc_ring_alloc.patch patches.suse/crypto-ccp-fix-error-handling.patch + patches.suse/crypto-bcm-Verify-GCM-CCM-key-length-in-setkey.patch patches.suse/btrfs-qgroup-fix-wrong-qgroup-metadata-reserve-for-d.patch patches.suse/btrfs-qgroup-fix-qgroup-meta-rsv-leak-for-subvolume-.patch patches.suse/btrfs-tree-checker-fix-false-alert-caused-by-legacy-.patch patches.suse/mmc-sdio-Check-for-CISTPL_VERS_1-buffer-size.patch patches.suse/media-tuner-simple-fix-regression-in-simple_set_radi.patch + patches.suse/media-platform-Improve-queue-set-up-flow-for-bug-fix.patch + patches.suse/media-tw5864-check-status-of-tw5864_frameinterval_ge.patch patches.suse/media-Revert-media-exynos4-is-Add-missed-check-for-p.patch patches.suse/media-m5mols-Check-function-pointer-in-m5mols_sensor.patch patches.suse/media-saa7134-avoid-a-shift-overflow.patch @@ -56256,9 +56273,12 @@ patches.suse/media-ati_remote-sanity-check-for-both-endpoints.patch patches.suse/media-firewire-fix-memory-leak.patch patches.suse/media-usbtv-Fix-refcounting-mixup.patch + patches.suse/regulator-resolve-supply-after-creating-regulator.patch patches.suse/xen-gntdev.c-Mark-pages-as-dirty.patch patches.suse/x86-xen-disable-Firmware-First-mode-for-correctable-.patch patches.suse/platform-x86-mlx-platform-Remove-PSU-EEPROM-configur.patch + patches.suse/ACPI-video-use-ACPI-backlight-for-HP-635-Notebook.patch + patches.suse/ACPI-extlog-Check-for-RDMSR-failure.patch patches.suse/scsi-smartpqi-identify-physical-devices-without-issuing-inquiry.patch patches.suse/scsi-smartpqi-add-id-support-for-smartraid-3152-8i.patch patches.suse/scsi-smartpqi-update-logical-volume-size-after-expansion.patch @@ -56304,6 +56324,7 @@ patches.suse/scsi-qla2xxx-Fix-inconsistent-format-argument-type-i-250bd009.patch patches.suse/scsi-qla2xxx-Fix-inconsistent-format-argument-type-i-72e813d9.patch patches.suse/leds-mt6323-move-period-calculation.patch + patches.suse/leds-bcm6328-bcm6358-use-devres-LED-registering-func.patch patches.suse/mfd-sm501-Fix-leaks-in-probe.patch patches.suse/backlight-sky81452-backlight-Fix-refcount-imbalance-.patch patches.suse/tty-serial-earlycon-dependency.patch @@ -56318,11 +56339,15 @@ patches.suse/iio-adc-ti-adc0832-Fix-alignment-issue-with-timestam.patch patches.suse/iio-adc-ti-adc12138-Fix-alignment-issue-with-timesta.patch patches.suse/usb-core-Solve-race-condition-in-anchor-cleanup-func.patch + patches.suse/usb-typec-tcpm-During-PR_SWAP-source-caps-should-be-.patch patches.suse/usb-ohci-Default-to-per-port-over-current-protection.patch + patches.suse/USB-adutux-fix-debugging.patch + patches.suse/xhci-don-t-create-endpoint-debugfs-entry-before-ring.patch patches.suse/USB-cdc-acm-handle-broken-union-descriptors.patch patches.suse/USB-cdc-wdm-Make-wdm_flush-interruptible-and-add-wdm.patch patches.suse/usb-dwc2-Fix-parameter-type-in-function-pointer-prot.patch patches.suse/usb-gadget-function-printer-fix-use-after-free-in-__.patch + patches.suse/USB-gadget-f_ncm-Fix-NDP16-datagram-validation.patch patches.suse/usb-gadget-f_ncm-fix-ncm_bitrate-for-SuperSpeed-and-.patch patches.suse/usb-gadget-f_ncm-allow-using-NCM-in-SuperSpeed-Plus-.patch patches.suse/usb-gadget-u_ether-enable-qmult-on-SuperSpeed-Plus-a.patch @@ -56339,13 +56364,21 @@ patches.suse/w1-mxc_w1-Fix-timeout-resolution-problem-leading-to-.patch patches.suse/misc-vop-add-round_up-x-4-for-vring_size-to-avoid-ke.patch patches.suse/mic-vop-copy-data-to-kernel-space-then-write-to-io-m.patch + patches.suse/bus-fsl_mc-Do-not-rely-on-caller-to-provide-non-NULL.patch + patches.suse/video-fbdev-pvr2fb-initialize-variables.patch patches.suse/drm-gma500-fix-error-check.patch + patches.suse/drm-brige-megachips-Add-checking-if-ge_b850v3_lvds_i.patch + patches.suse/0005-Revert-drm-amdgpu-Fix-NULL-dereference-in-dpm-sysfs-.patch patches.suse/pwm-lpss-Fix-off-by-one-error-in-base_unit-math-in-p.patch patches.suse/pwm-lpss-Add-range-limit-check-for-the-base_unit-reg.patch + patches.suse/drm-radeon-revert-Prefer-lower-feedback-dividers.patch + patches.suse/drm-bridge-synopsys-dsi-add-support-for-non-continuo.patch patches.suse/video-fbdev-vga16fb-fix-setting-of-pixclock-because-.patch patches.suse/video-fbdev-sis-fix-null-ptr-dereference.patch patches.suse/Fix-use-after-free-in-get_capset_info-callback.patch patches.suse/drm-msm-Drop-debug-print-in-_dpu_crtc_setup_lm_bound.patch + patches.suse/drm-i915-Break-up-error-capture-compression-loops-wi.patch + patches.suse/drm-amd-display-HDMI-remote-sink-need-mode-validatio.patch patches.suse/ALSA-hda-Don-t-register-a-cb-func-if-it-is-registere.patch patches.suse/ALSA-hda-realtek-Add-mute-Led-support-for-HP-Elitebo.patch patches.suse/ALSA-hda-realtek-Enable-audio-jacks-of-ASUS-D700SA-w.patch @@ -56376,11 +56409,14 @@ patches.suse/mwifiex-Do-not-use-GFP_KERNEL-in-atomic-context.patch patches.suse/ath10k-provide-survey-info-as-accumulated-data.patch patches.suse/ath10k-check-idx-validity-in-__ath10k_htt_rx_ring_fi.patch + patches.suse/ath10k-start-recovery-process-when-payload-length-ex.patch patches.suse/ath6kl-prevent-potential-array-overflow-in-ath6kl_ad.patch patches.suse/ath9k-Fix-potential-out-of-bounds-in-ath9k_htc_txcom.patch patches.suse/ath10k-Fix-the-size-used-in-a-dma_free_coherent-call.patch patches.suse/wcn36xx-Fix-reported-802.11n-rx_highest-rate-wcn3660.patch + patches.suse/ath10k-fix-VHT-NSS-calculation-when-STBC-is-enabled.patch patches.suse/mwifiex-don-t-call-del_timer_sync-on-uninitialized-t.patch + patches.suse/p54-avoid-accessing-the-data-mapped-to-streaming-DMA.patch patches.suse/mwifiex-Remove-unnecessary-braces-from-HostCmd_SET_S.patch patches.suse/rtl8xxxu-prevent-potential-memory-leak.patch patches.suse/mwifiex-remove-function-pointer-check.patch @@ -56413,6 +56449,7 @@ patches.suse/powerpc-pseries-explicitly-reschedule-during-drmem_l.patch patches.suse/powerpc-powernv-elog-Fix-race-while-processing-OPAL-.patch patches.suse/powerpc-perf-hv-gpci-Fix-starting-index-value.patch + patches.suse/mtd-lpddr-Fix-bad-logic-in-print_drs_error.patch patches.suse/mtd-lpddr-fix-excessive-stack-usage-with-clang.patch patches.suse/mtd-mtdoops-Don-t-write-panic-data-twice.patch patches.suse/mailbox-avoid-timer-start-from-callback.patch @@ -56429,32 +56466,90 @@ patches.suse/0010-xen-events-use-a-common-cpu-hotplug-hook-for-event-c.patch patches.suse/0011-xen-events-defer-eoi-in-case-of-excessive-number-of-.patch patches.suse/0012-xen-events-block-rogue-events-for-some-time.patch + patches.suse/power-supply-test_power-add-missing-newlines-when-pr.patch patches.suse/ceph-promote-to-unsigned-long-long-before-shifting.patch patches.suse/libceph-clear-con-out_msg-on-policy-stateful_server-faults.patch patches.suse/i2c-imx-Fix-external-abort-on-interrupt-in-exit-path.patch + patches.suse/9P-Cast-to-loff_t-before-multiplying.patch + patches.suse/clk-ti-clockdomain-fix-static-checker-warning.patch patches.suse/clk-at91-remove-the-checking-of-parent_name.patch patches.suse/clk-at91-clk-main-update-key-before-writing-AT91_CKG.patch patches.suse/clk-imx8mq-fix-usdhc-parents-order.patch patches.suse/clk-bcm2835-add-missing-release-if-devm_clk_hw_regis.patch patches.suse/Werror-return-type.patch + patches.suse/icmp-randomize-the-global-rate-limiter.patch patches.suse/nfc-Ensure-presence-of-NFC_ATTR_FIRMWARE_NAME-attrib.patch patches.suse/ibmvnic-save-changed-mac-address-to-adapter-mac_addr.patch + patches.suse/drm-ttm-fix-eviction-valuable-range-check.patch + patches.suse/drm-i915-Force-VT-d-workarounds-when-running-as-a-gu.patch + patches.suse/ALSA-hda-Fix-the-return-value-if-cb-func-is-already-.patch patches.suse/Input-imx6ul_tsc-clean-up-some-errors-in-imx6ul_tsc_.patch patches.suse/Input-ep93xx_keypad-fix-handling-of-platform_get_irq.patch patches.suse/Input-omap4-keypad-fix-handling-of-platform_get_irq-.patch patches.suse/Input-twl4030_keypad-fix-handling-of-platform_get_ir.patch patches.suse/Input-sun4i-ps2-fix-handling-of-platform_get_irq-err.patch + patches.suse/acpi-cpufreq-Honor-_PSD-table-setting-on-new-AMD-CPU.patch + patches.suse/ACPI-debug-don-t-allow-debugging-when-ACPI-is-disabl.patch patches.suse/ring-buffer-return-0-on-success-from-ring_buffer_resize.patch patches.suse/memory-omap-gpmc-Fix-a-couple-off-by-ones.patch patches.suse/memory-fsl-corenet-cf-Fix-handling-of-platform_get_i.patch patches.suse/powerpc-powernv-dump-Fix-race-while-processing-OPAL-.patch patches.suse/powerpc-Fix-undetected-data-corruption-with-P9N-DD2..patch + patches.suse/ata-sata_rcar-Fix-DMA-boundary-mask.patch patches.suse/nvme-rdma-fix-crash-when-connect-rejected.patch patches.suse/nvme-rdma-fix-crash-due-to-incorrect-cqe.patch patches.suse/NTB-hw-amd-fix-an-issue-about-leak-system-resources.patch + patches.suse/x86-kexec-Use-up-to-dated-screen_info-copy-to-fill-b.patch + patches.suse/msft-hv-2164-hyperv_fb-Update-screen_info-after-removing-old-fram.patch + patches.suse/x86-unwind-orc-fix-inactive-tasks-with-stack-pointer-in-sp-on-gcc-10-compiled-kernels.patch patches.suse/ibmveth-Fix-use-of-ibmveth-in-a-bridge.patch patches.suse/tipc-fix-memory-leak-caused-by-tipc_buf_append.patch patches.suse/ibmvnic-fix-ibmvnic_set_mac.patch + patches.suse/drm-amdgpu-don-t-map-BO-in-reserved-region.patch + patches.suse/drm-amd-display-Don-t-invoke-kgdb_breakpoint-uncondi.patch + patches.suse/drm-vc4-drv-Add-error-handding-for-bind.patch + patches.suse/mmc-sdhci-of-esdhc-set-timeout-to-max-before-tuning.patch + patches.suse/ACPI-NFIT-Fix-comparison-to-ENXIO.patch + patches.suse/ACPI-dock-fix-enum-conversion-warning.patch + patches.suse/device-property-Keep-secondary-firmware-node-seconda.patch + patches.suse/device-property-Don-t-clear-secondary-pointer-for-sh.patch + patches.suse/scsi-ibmvscsi-Fix-potential-race-after-loss-of-trans.patch + patches.suse/usb-host-fsl-mph-dr-of-check-return-of-dma_set_mask.patch + patches.suse/usb-cdc-acm-fix-cooldown-mechanism.patch + patches.suse/usb-typec-tcpm-reset-hard_reset_count-for-any-discon.patch + patches.suse/vt-keyboard-simplify-vt_kdgkbsent.patch + patches.suse/vt-keyboard-extend-func_buf_lock-to-readers.patch + patches.suse/staging-octeon-repair-fixed-link-support.patch + patches.suse/staging-octeon-Drop-on-uncorrectable-alignment-or-FC.patch + patches.suse/staging-comedi-cb_pcidas-Allow-2-channel-commands-fo.patch + patches.suse/kthread_worker-prevent-queuing-delayed-work-from-tim.patch + patches.suse/tty-make-FONTX-ioctl-use-the-tty-pointer-they-were-a.patch + patches.suse/regulator-defer-probe-when-trying-to-get-voltage-fro.patch + patches.suse/ftrace-fix-recursion-check-for-nmi-test.patch + patches.suse/ftrace-handle-tracing-when-switching-between-context.patch + patches.suse/ring-buffer-fix-recursion-protection-transitions-between-interrupt-context.patch + patches.suse/dpaa_eth-update-the-buffer-layout-for-non-A050385-er.patch + patches.suse/dpaa_eth-fix-the-RX-headroom-size-alignment.patch + patches.suse/powerpc-vnic-Extend-failover-pending-window.patch + patches.suse/net-usb-qmi_wwan-add-Telit-LE910Cx-0x1230-compositio.patch + patches.suse/can-rx-offload-don-t-call-kfree_skb-from-IRQ-context.patch + patches.suse/can-dev-can_get_echo_skb-prevent-call-to-kfree_skb-i.patch + patches.suse/can-dev-__can_get_echo_skb-fix-real-payload-length-r.patch + patches.suse/can-can_create_echo_skb-fix-echo-skb-generation-alwa.patch + patches.suse/can-peak_usb-add-range-checking-in-decode-operations.patch + patches.suse/can-peak_usb-peak_usb_get_ts_time-fix-timestamp-wrap.patch + patches.suse/can-peak_canfd-pucan_handle_can_rx-fix-echo-manageme.patch + patches.suse/drm-imx-tve-remove-extraneous-type-qualifier.patch + patches.suse/ALSA-hda-prevent-undefined-shift-in-snd_hdac_ext_bus.patch + patches.suse/perf-core-fix-a-memory-leak-in-perf_event_parse_addr_filter.patch + patches.suse/xfs-flush-new-eof-page-on-truncate-to-avoid-post-eof.patch + patches.suse/USB-Add-NO_LPM-quirk-for-Kingston-flash-drive.patch + patches.suse/usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch + patches.suse/USB-serial-option-add-Quectel-EC200T-module-support.patch + patches.suse/USB-serial-option-add-LE910Cx-compositions-0x1203-0x.patch + patches.suse/USB-serial-option-add-Telit-FN980-composition-0x1055.patch + patches.suse/vt-Disable-KD_FONT_OP_COPY.patch + patches.suse/powercap-Restrict-energy-meter-to-root-access.patch # dhowells/linux-fs keys-uefi patches.suse/0001-KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch @@ -56463,9 +56558,6 @@ patches.suse/0005-MODSIGN-Allow-the-db-UEFI-variable-to-be-suppressed.patch patches.suse/0006-modsign-Use-secondary-trust-keyring-for-module-signi.patch - # mkp/scsi fixes - patches.suse/scsi-ibmvscsi-Fix-potential-race-after-loss-of-trans.patch - # out-of-tree patches patches.suse/net-mvpp2-fix-condition-for-setting-up-link-interrup.patch patches.suse/cifs-handle-netapp-error-codes.patch