From: Greg Kroah-Hartman Date: Sun, 22 Jan 2023 13:32:52 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v4.14.304~31 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2268febf193d6068dc6735fe47f702c41c5dc620;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: dmaengine-tegra210-adma-fix-global-intr-clear.patch drm-amd-display-calculate-output_color_space-after-pixel-encoding-adjustment.patch drm-amd-display-fix-color_space_ycbcr2020_type-matrix.patch drm-amd-display-fix-set-scaling-doesn-s-work.patch drm-i915-re-disable-rc6p-on-sandy-bridge.patch dt-bindings-phy-g12a-usb2-phy-fix-compatible-string-documentation.patch dt-bindings-phy-g12a-usb3-pcie-phy-fix-compatible-string-documentation.patch gsmi-fix-null-deref-in-gsmi_get_variable.patch mei-me-add-meteor-lake-point-m-did.patch serial-atmel-fix-incorrect-baudrate-setup.patch serial-pch_uart-pass-correct-sg-to-dma_unmap_sg.patch tty-serial-qcom-geni-serial-fix-slab-out-of-bounds-on-rx-fifo-buffer.patch usb-gadget-f_ncm-fix-potential-null-ptr-deref-in-ncm_bitrate.patch usb-gadget-g_webcam-send-color-matching-descriptor-per-frame.patch usb-gadgetfs-fix-race-between-mounting-and-unmounting.patch usb-host-ehci-fsl-fix-module-alias.patch usb-serial-cp210x-add-scalance-lpe-9000-device-id.patch usb-storage-apply-ignore_uas-only-for-hiksemi-md202-on-rtl9210.patch usb-typec-altmodes-displayport-add-pin-assignment-helper.patch usb-typec-altmodes-displayport-fix-pin-assignment-calculation.patch --- diff --git a/queue-5.10/dmaengine-tegra210-adma-fix-global-intr-clear.patch b/queue-5.10/dmaengine-tegra210-adma-fix-global-intr-clear.patch new file mode 100644 index 00000000000..f80c3539917 --- /dev/null +++ b/queue-5.10/dmaengine-tegra210-adma-fix-global-intr-clear.patch @@ -0,0 +1,33 @@ +From 9c7e355ccbb33d239360c876dbe49ad5ade65b47 Mon Sep 17 00:00:00 2001 +From: Mohan Kumar +Date: Mon, 2 Jan 2023 12:18:44 +0530 +Subject: dmaengine: tegra210-adma: fix global intr clear + +From: Mohan Kumar + +commit 9c7e355ccbb33d239360c876dbe49ad5ade65b47 upstream. + +The current global interrupt clear programming register offset +was not correct. Fix the programming with right offset + +Fixes: ded1f3db4cd6 ("dmaengine: tegra210-adma: prepare for supporting newer Tegra chips") +Cc: stable@vger.kernel.org +Signed-off-by: Mohan Kumar +Link: https://lore.kernel.org/r/20230102064844.31306-1-mkumard@nvidia.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/tegra210-adma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/dma/tegra210-adma.c ++++ b/drivers/dma/tegra210-adma.c +@@ -224,7 +224,7 @@ static int tegra_adma_init(struct tegra_ + int ret; + + /* Clear any interrupts */ +- tdma_write(tdma, tdma->cdata->global_int_clear, 0x1); ++ tdma_write(tdma, tdma->cdata->ch_base_offset + tdma->cdata->global_int_clear, 0x1); + + /* Assert soft reset */ + tdma_write(tdma, ADMA_GLOBAL_SOFT_RESET, 0x1); diff --git a/queue-5.10/drm-amd-display-calculate-output_color_space-after-pixel-encoding-adjustment.patch b/queue-5.10/drm-amd-display-calculate-output_color_space-after-pixel-encoding-adjustment.patch new file mode 100644 index 00000000000..aeef979707e --- /dev/null +++ b/queue-5.10/drm-amd-display-calculate-output_color_space-after-pixel-encoding-adjustment.patch @@ -0,0 +1,45 @@ +From 79601b894849cb6f6d6122e6590f1887ac4a66b3 Mon Sep 17 00:00:00 2001 +From: Joshua Ashton +Date: Tue, 10 Jan 2023 20:12:21 +0000 +Subject: drm/amd/display: Calculate output_color_space after pixel encoding adjustment + +From: Joshua Ashton + +commit 79601b894849cb6f6d6122e6590f1887ac4a66b3 upstream. + +Code in get_output_color_space depends on knowing the pixel encoding to +determine whether to pick between eg. COLOR_SPACE_SRGB or +COLOR_SPACE_YCBCR709 for transparent RGB -> YCbCr 4:4:4 in the driver. + +v2: Fixed patch being accidentally based on a personal feature branch, oops! + +Fixes: ea117312ea9f ("drm/amd/display: Reduce HDMI pixel encoding if max clock is exceeded") +Reviewed-by: Melissa Wen +Signed-off-by: Joshua Ashton +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -4567,8 +4567,6 @@ static void fill_stream_properties_from_ + timing_out->pix_clk_100hz = mode_in->crtc_clock * 10; + timing_out->aspect_ratio = get_aspect_ratio(mode_in); + +- stream->output_color_space = get_output_color_space(timing_out); +- + stream->out_transfer_func->type = TF_TYPE_PREDEFINED; + stream->out_transfer_func->tf = TRANSFER_FUNCTION_SRGB; + if (stream->signal == SIGNAL_TYPE_HDMI_TYPE_A) { +@@ -4579,6 +4577,8 @@ static void fill_stream_properties_from_ + adjust_colour_depth_from_display_info(timing_out, info); + } + } ++ ++ stream->output_color_space = get_output_color_space(timing_out); + } + + static void fill_audio_info(struct audio_info *audio_info, diff --git a/queue-5.10/drm-amd-display-fix-color_space_ycbcr2020_type-matrix.patch b/queue-5.10/drm-amd-display-fix-color_space_ycbcr2020_type-matrix.patch new file mode 100644 index 00000000000..97e2fe13e1f --- /dev/null +++ b/queue-5.10/drm-amd-display-fix-color_space_ycbcr2020_type-matrix.patch @@ -0,0 +1,43 @@ +From 973a9c810c785ac270a6d50d8cf862b0c1643a10 Mon Sep 17 00:00:00 2001 +From: Joshua Ashton +Date: Tue, 10 Jan 2023 22:50:42 +0000 +Subject: drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix + +From: Joshua Ashton + +commit 973a9c810c785ac270a6d50d8cf862b0c1643a10 upstream. + +The YCC conversion matrix for RGB -> COLOR_SPACE_YCBCR2020_TYPE is +missing the values for the fourth column of the matrix. + +The fourth column of the matrix is essentially just a value that is +added given that the color is 3 components in size. +These values are needed to bias the chroma from the [-1, 1] -> [0, 1] +range. + +This fixes color being very green when using Gamescope HDR on HDMI +output which prefers YCC 4:4:4. + +Fixes: 40df2f809e8f ("drm/amd/display: color space ycbcr709 support") +Reviewed-by: Melissa Wen +Signed-off-by: Joshua Ashton +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c +@@ -92,8 +92,8 @@ static const struct out_csc_color_matrix + { 0xE00, 0xF349, 0xFEB7, 0x1000, 0x6CE, 0x16E3, + 0x24F, 0x200, 0xFCCB, 0xF535, 0xE00, 0x1000} }, + { COLOR_SPACE_YCBCR2020_TYPE, +- { 0x1000, 0xF149, 0xFEB7, 0x0000, 0x0868, 0x15B2, +- 0x01E6, 0x0000, 0xFB88, 0xF478, 0x1000, 0x0000} }, ++ { 0x1000, 0xF149, 0xFEB7, 0x1004, 0x0868, 0x15B2, ++ 0x01E6, 0x201, 0xFB88, 0xF478, 0x1000, 0x1004} }, + { COLOR_SPACE_YCBCR709_BLACK_TYPE, + { 0x0000, 0x0000, 0x0000, 0x1000, 0x0000, 0x0000, + 0x0000, 0x0200, 0x0000, 0x0000, 0x0000, 0x1000} }, diff --git a/queue-5.10/drm-amd-display-fix-set-scaling-doesn-s-work.patch b/queue-5.10/drm-amd-display-fix-set-scaling-doesn-s-work.patch new file mode 100644 index 00000000000..02a0f8bc8c3 --- /dev/null +++ b/queue-5.10/drm-amd-display-fix-set-scaling-doesn-s-work.patch @@ -0,0 +1,41 @@ +From 040625ab82ce6dca7772cb3867fe5c9eb279a344 Mon Sep 17 00:00:00 2001 +From: hongao +Date: Tue, 22 Nov 2022 19:20:34 +0800 +Subject: drm/amd/display: Fix set scaling doesn's work + +From: hongao + +commit 040625ab82ce6dca7772cb3867fe5c9eb279a344 upstream. + +[Why] +Setting scaling does not correctly update CRTC state. As a result +dc stream state's src (composition area) && dest (addressable area) +was not calculated as expected. This causes set scaling doesn's work. + +[How] +Correctly update CRTC state when setting scaling property. + +Reviewed-by: Harry Wentland +Tested-by: Rodrigo Siqueira +Signed-off-by: hongao +Signed-off-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -8783,8 +8783,8 @@ static int amdgpu_dm_atomic_check(struct + goto fail; + } + +- if (dm_old_con_state->abm_level != +- dm_new_con_state->abm_level) ++ if (dm_old_con_state->abm_level != dm_new_con_state->abm_level || ++ dm_old_con_state->scaling != dm_new_con_state->scaling) + new_crtc_state->connectors_changed = true; + } + diff --git a/queue-5.10/drm-i915-re-disable-rc6p-on-sandy-bridge.patch b/queue-5.10/drm-i915-re-disable-rc6p-on-sandy-bridge.patch new file mode 100644 index 00000000000..c67983250cf --- /dev/null +++ b/queue-5.10/drm-i915-re-disable-rc6p-on-sandy-bridge.patch @@ -0,0 +1,44 @@ +From 67b0b4ed259e425b7eed09da75b42c80682ca003 Mon Sep 17 00:00:00 2001 +From: Sasa Dragic +Date: Mon, 19 Dec 2022 18:29:27 +0100 +Subject: drm/i915: re-disable RC6p on Sandy Bridge +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sasa Dragic + +commit 67b0b4ed259e425b7eed09da75b42c80682ca003 upstream. + +RC6p on Sandy Bridge got re-enabled over time, causing visual glitches +and GPU hangs. + +Disabled originally in commit 1c8ecf80fdee ("drm/i915: do not enable +RC6p on Sandy Bridge"). + +Signed-off-by: Sasa Dragic +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20221219172927.9603-2-sasa.dragic@gmail.com +Fixes: fb6db0f5bf1d ("drm/i915: Remove unsafe i915.enable_rc6") +Fixes: 13c5a577b342 ("drm/i915/gt: Select the deepest available parking mode for rc6") +Cc: stable@vger.kernel.org +Reviewed-by: Rodrigo Vivi +(cherry picked from commit 0c8a6e9ea232c221976a0670256bd861408d9917) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/i915_pci.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/i915_pci.c ++++ b/drivers/gpu/drm/i915/i915_pci.c +@@ -403,7 +403,8 @@ static const struct intel_device_info il + .has_coherent_ggtt = true, \ + .has_llc = 1, \ + .has_rc6 = 1, \ +- .has_rc6p = 1, \ ++ /* snb does support rc6p, but enabling it causes various issues */ \ ++ .has_rc6p = 0, \ + .has_rps = true, \ + .dma_mask_size = 40, \ + .ppgtt_type = INTEL_PPGTT_ALIASING, \ diff --git a/queue-5.10/dt-bindings-phy-g12a-usb2-phy-fix-compatible-string-documentation.patch b/queue-5.10/dt-bindings-phy-g12a-usb2-phy-fix-compatible-string-documentation.patch new file mode 100644 index 00000000000..a90a0594633 --- /dev/null +++ b/queue-5.10/dt-bindings-phy-g12a-usb2-phy-fix-compatible-string-documentation.patch @@ -0,0 +1,188 @@ +From c63835bf1c750c9b3aec1d5c23d811d6375fc23d Mon Sep 17 00:00:00 2001 +From: Heiner Kallweit +Date: Mon, 16 Jan 2023 21:17:39 +0100 +Subject: dt-bindings: phy: g12a-usb2-phy: fix compatible string documentation + +From: Heiner Kallweit + +commit c63835bf1c750c9b3aec1d5c23d811d6375fc23d upstream. + +The compatible strings in the driver don't have the meson prefix. +Fix this in the documentation and rename the file accordingly. + +Fixes: da86d286cce8 ("dt-bindings: phy: meson-g12a-usb2-phy: convert to yaml") +Cc: stable@vger.kernel.org +Signed-off-by: Heiner Kallweit +Reviewed-by: Martin Blumenstingl +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/8d960029-e94d-224b-911f-03e5deb47ebc@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/phy/amlogic,g12a-usb2-phy.yaml | 78 ++++++++++ + Documentation/devicetree/bindings/phy/amlogic,meson-g12a-usb2-phy.yaml | 78 ---------- + 2 files changed, 78 insertions(+), 78 deletions(-) + rename Documentation/devicetree/bindings/phy/{amlogic,meson-g12a-usb2-phy.yaml => amlogic,g12a-usb2-phy.yaml} (85%) + +--- /dev/null ++++ b/Documentation/devicetree/bindings/phy/amlogic,g12a-usb2-phy.yaml +@@ -0,0 +1,78 @@ ++# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause) ++# Copyright 2019 BayLibre, SAS ++%YAML 1.2 ++--- ++$id: "http://devicetree.org/schemas/phy/amlogic,g12a-usb2-phy.yaml#" ++$schema: "http://devicetree.org/meta-schemas/core.yaml#" ++ ++title: Amlogic G12A USB2 PHY ++ ++maintainers: ++ - Neil Armstrong ++ ++properties: ++ compatible: ++ enum: ++ - amlogic,g12a-usb2-phy ++ - amlogic,a1-usb2-phy ++ ++ reg: ++ maxItems: 1 ++ ++ clocks: ++ maxItems: 1 ++ ++ clock-names: ++ items: ++ - const: xtal ++ ++ resets: ++ maxItems: 1 ++ ++ reset-names: ++ items: ++ - const: phy ++ ++ "#phy-cells": ++ const: 0 ++ ++ phy-supply: ++ description: ++ Phandle to a regulator that provides power to the PHY. This ++ regulator will be managed during the PHY power on/off sequence. ++ ++required: ++ - compatible ++ - reg ++ - clocks ++ - clock-names ++ - resets ++ - reset-names ++ - "#phy-cells" ++ ++if: ++ properties: ++ compatible: ++ enum: ++ - amlogic,meson-a1-usb-ctrl ++ ++then: ++ properties: ++ power-domains: ++ maxItems: 1 ++ required: ++ - power-domains ++ ++additionalProperties: false ++ ++examples: ++ - | ++ phy@36000 { ++ compatible = "amlogic,g12a-usb2-phy"; ++ reg = <0x36000 0x2000>; ++ clocks = <&xtal>; ++ clock-names = "xtal"; ++ resets = <&phy_reset>; ++ reset-names = "phy"; ++ #phy-cells = <0>; ++ }; +--- a/Documentation/devicetree/bindings/phy/amlogic,meson-g12a-usb2-phy.yaml ++++ /dev/null +@@ -1,78 +0,0 @@ +-# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause) +-# Copyright 2019 BayLibre, SAS +-%YAML 1.2 +---- +-$id: "http://devicetree.org/schemas/phy/amlogic,meson-g12a-usb2-phy.yaml#" +-$schema: "http://devicetree.org/meta-schemas/core.yaml#" +- +-title: Amlogic G12A USB2 PHY +- +-maintainers: +- - Neil Armstrong +- +-properties: +- compatible: +- enum: +- - amlogic,meson-g12a-usb2-phy +- - amlogic,meson-a1-usb2-phy +- +- reg: +- maxItems: 1 +- +- clocks: +- maxItems: 1 +- +- clock-names: +- items: +- - const: xtal +- +- resets: +- maxItems: 1 +- +- reset-names: +- items: +- - const: phy +- +- "#phy-cells": +- const: 0 +- +- phy-supply: +- description: +- Phandle to a regulator that provides power to the PHY. This +- regulator will be managed during the PHY power on/off sequence. +- +-required: +- - compatible +- - reg +- - clocks +- - clock-names +- - resets +- - reset-names +- - "#phy-cells" +- +-if: +- properties: +- compatible: +- enum: +- - amlogic,meson-a1-usb-ctrl +- +-then: +- properties: +- power-domains: +- maxItems: 1 +- required: +- - power-domains +- +-additionalProperties: false +- +-examples: +- - | +- phy@36000 { +- compatible = "amlogic,meson-g12a-usb2-phy"; +- reg = <0x36000 0x2000>; +- clocks = <&xtal>; +- clock-names = "xtal"; +- resets = <&phy_reset>; +- reset-names = "phy"; +- #phy-cells = <0>; +- }; diff --git a/queue-5.10/dt-bindings-phy-g12a-usb3-pcie-phy-fix-compatible-string-documentation.patch b/queue-5.10/dt-bindings-phy-g12a-usb3-pcie-phy-fix-compatible-string-documentation.patch new file mode 100644 index 00000000000..689da7ffaee --- /dev/null +++ b/queue-5.10/dt-bindings-phy-g12a-usb3-pcie-phy-fix-compatible-string-documentation.patch @@ -0,0 +1,150 @@ +From e181119046a0ec16126b682163040e8e33f310c1 Mon Sep 17 00:00:00 2001 +From: Heiner Kallweit +Date: Mon, 16 Jan 2023 21:19:03 +0100 +Subject: dt-bindings: phy: g12a-usb3-pcie-phy: fix compatible string documentation + +From: Heiner Kallweit + +commit e181119046a0ec16126b682163040e8e33f310c1 upstream. + +The compatible string in the driver doesn't have the meson prefix. +Fix this in the documentation and rename the file accordingly. + +Fixes: 87a55485f2fc ("dt-bindings: phy: meson-g12a-usb3-pcie-phy: convert to yaml") +Cc: stable@vger.kernel.org +Signed-off-by: Heiner Kallweit +Reviewed-by: Martin Blumenstingl +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/0a82be92-ce85-da34-9d6f-4b33034473e5@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/phy/amlogic,g12a-usb3-pcie-phy.yaml | 59 ++++++++++ + Documentation/devicetree/bindings/phy/amlogic,meson-g12a-usb3-pcie-phy.yaml | 59 ---------- + 2 files changed, 59 insertions(+), 59 deletions(-) + rename Documentation/devicetree/bindings/phy/{amlogic,meson-g12a-usb3-pcie-phy.yaml => amlogic,g12a-usb3-pcie-phy.yaml} (82%) + +--- /dev/null ++++ b/Documentation/devicetree/bindings/phy/amlogic,g12a-usb3-pcie-phy.yaml +@@ -0,0 +1,59 @@ ++# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause) ++# Copyright 2019 BayLibre, SAS ++%YAML 1.2 ++--- ++$id: "http://devicetree.org/schemas/phy/amlogic,g12a-usb3-pcie-phy.yaml#" ++$schema: "http://devicetree.org/meta-schemas/core.yaml#" ++ ++title: Amlogic G12A USB3 + PCIE Combo PHY ++ ++maintainers: ++ - Neil Armstrong ++ ++properties: ++ compatible: ++ enum: ++ - amlogic,g12a-usb3-pcie-phy ++ ++ reg: ++ maxItems: 1 ++ ++ clocks: ++ maxItems: 1 ++ ++ clock-names: ++ items: ++ - const: ref_clk ++ ++ resets: ++ maxItems: 1 ++ ++ reset-names: ++ items: ++ - const: phy ++ ++ "#phy-cells": ++ const: 1 ++ ++required: ++ - compatible ++ - reg ++ - clocks ++ - clock-names ++ - resets ++ - reset-names ++ - "#phy-cells" ++ ++additionalProperties: false ++ ++examples: ++ - | ++ phy@46000 { ++ compatible = "amlogic,g12a-usb3-pcie-phy"; ++ reg = <0x46000 0x2000>; ++ clocks = <&ref_clk>; ++ clock-names = "ref_clk"; ++ resets = <&phy_reset>; ++ reset-names = "phy"; ++ #phy-cells = <1>; ++ }; +--- a/Documentation/devicetree/bindings/phy/amlogic,meson-g12a-usb3-pcie-phy.yaml ++++ /dev/null +@@ -1,59 +0,0 @@ +-# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause) +-# Copyright 2019 BayLibre, SAS +-%YAML 1.2 +---- +-$id: "http://devicetree.org/schemas/phy/amlogic,meson-g12a-usb3-pcie-phy.yaml#" +-$schema: "http://devicetree.org/meta-schemas/core.yaml#" +- +-title: Amlogic G12A USB3 + PCIE Combo PHY +- +-maintainers: +- - Neil Armstrong +- +-properties: +- compatible: +- enum: +- - amlogic,meson-g12a-usb3-pcie-phy +- +- reg: +- maxItems: 1 +- +- clocks: +- maxItems: 1 +- +- clock-names: +- items: +- - const: ref_clk +- +- resets: +- maxItems: 1 +- +- reset-names: +- items: +- - const: phy +- +- "#phy-cells": +- const: 1 +- +-required: +- - compatible +- - reg +- - clocks +- - clock-names +- - resets +- - reset-names +- - "#phy-cells" +- +-additionalProperties: false +- +-examples: +- - | +- phy@46000 { +- compatible = "amlogic,meson-g12a-usb3-pcie-phy"; +- reg = <0x46000 0x2000>; +- clocks = <&ref_clk>; +- clock-names = "ref_clk"; +- resets = <&phy_reset>; +- reset-names = "phy"; +- #phy-cells = <1>; +- }; diff --git a/queue-5.10/gsmi-fix-null-deref-in-gsmi_get_variable.patch b/queue-5.10/gsmi-fix-null-deref-in-gsmi_get_variable.patch new file mode 100644 index 00000000000..94467885649 --- /dev/null +++ b/queue-5.10/gsmi-fix-null-deref-in-gsmi_get_variable.patch @@ -0,0 +1,41 @@ +From a769b05eeed7accc4019a1ed9799dd72067f1ce8 Mon Sep 17 00:00:00 2001 +From: Khazhismel Kumykov +Date: Tue, 17 Jan 2023 17:02:12 -0800 +Subject: gsmi: fix null-deref in gsmi_get_variable + +From: Khazhismel Kumykov + +commit a769b05eeed7accc4019a1ed9799dd72067f1ce8 upstream. + +We can get EFI variables without fetching the attribute, so we must +allow for that in gsmi. + +commit 859748255b43 ("efi: pstore: Omit efivars caching EFI varstore +access layer") added a new get_variable call with attr=NULL, which +triggers panic in gsmi. + +Fixes: 74c5b31c6618 ("driver: Google EFI SMI") +Cc: stable +Signed-off-by: Khazhismel Kumykov +Link: https://lore.kernel.org/r/20230118010212.1268474-1-khazhy@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/firmware/google/gsmi.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/firmware/google/gsmi.c ++++ b/drivers/firmware/google/gsmi.c +@@ -360,9 +360,10 @@ static efi_status_t gsmi_get_variable(ef + memcpy(data, gsmi_dev.data_buf->start, *data_size); + + /* All variables are have the following attributes */ +- *attr = EFI_VARIABLE_NON_VOLATILE | +- EFI_VARIABLE_BOOTSERVICE_ACCESS | +- EFI_VARIABLE_RUNTIME_ACCESS; ++ if (attr) ++ *attr = EFI_VARIABLE_NON_VOLATILE | ++ EFI_VARIABLE_BOOTSERVICE_ACCESS | ++ EFI_VARIABLE_RUNTIME_ACCESS; + } + + spin_unlock_irqrestore(&gsmi_dev.lock, flags); diff --git a/queue-5.10/mei-me-add-meteor-lake-point-m-did.patch b/queue-5.10/mei-me-add-meteor-lake-point-m-did.patch new file mode 100644 index 00000000000..d653bca937b --- /dev/null +++ b/queue-5.10/mei-me-add-meteor-lake-point-m-did.patch @@ -0,0 +1,43 @@ +From 0c4d68261717f89fa8c4f98a6967c3832fcb3ad0 Mon Sep 17 00:00:00 2001 +From: Alexander Usyskin +Date: Tue, 13 Dec 2022 00:02:47 +0200 +Subject: mei: me: add meteor lake point M DID + +From: Alexander Usyskin + +commit 0c4d68261717f89fa8c4f98a6967c3832fcb3ad0 upstream. + +Add Meteor Lake Point M device id. + +Cc: +Signed-off-by: Alexander Usyskin +Signed-off-by: Tomas Winkler +Link: https://lore.kernel.org/r/20221212220247.286019-2-tomas.winkler@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/mei/hw-me-regs.h | 2 ++ + drivers/misc/mei/pci-me.c | 2 ++ + 2 files changed, 4 insertions(+) + +--- a/drivers/misc/mei/hw-me-regs.h ++++ b/drivers/misc/mei/hw-me-regs.h +@@ -111,6 +111,8 @@ + + #define MEI_DEV_ID_RPL_S 0x7A68 /* Raptor Lake Point S */ + ++#define MEI_DEV_ID_MTL_M 0x7E70 /* Meteor Lake Point M */ ++ + /* + * MEI HW Section + */ +--- a/drivers/misc/mei/pci-me.c ++++ b/drivers/misc/mei/pci-me.c +@@ -117,6 +117,8 @@ static const struct pci_device_id mei_me + + {MEI_PCI_DEVICE(MEI_DEV_ID_RPL_S, MEI_ME_PCH15_CFG)}, + ++ {MEI_PCI_DEVICE(MEI_DEV_ID_MTL_M, MEI_ME_PCH15_CFG)}, ++ + /* required last entry */ + {0, } + }; diff --git a/queue-5.10/serial-atmel-fix-incorrect-baudrate-setup.patch b/queue-5.10/serial-atmel-fix-incorrect-baudrate-setup.patch new file mode 100644 index 00000000000..2f29294faad --- /dev/null +++ b/queue-5.10/serial-atmel-fix-incorrect-baudrate-setup.patch @@ -0,0 +1,53 @@ +From 5bfdd3c654bd879bff50c2e85e42f85ae698b42f Mon Sep 17 00:00:00 2001 +From: Tobias Schramm +Date: Mon, 9 Jan 2023 08:29:40 +0100 +Subject: serial: atmel: fix incorrect baudrate setup + +From: Tobias Schramm + +commit 5bfdd3c654bd879bff50c2e85e42f85ae698b42f upstream. + +Commit ba47f97a18f2 ("serial: core: remove baud_rates when serial console +setup") changed uart_set_options to select the correct baudrate +configuration based on the absolute error between requested baudrate and +available standard baudrate settings. +Prior to that commit the baudrate was selected based on which predefined +standard baudrate did not exceed the requested baudrate. +This change of selection logic was never reflected in the atmel serial +driver. Thus the comment left in the atmel serial driver is no longer +accurate. +Additionally the manual rounding up described in that comment and applied +via (quot - 1) requests an incorrect baudrate. Since uart_set_options uses +tty_termios_encode_baud_rate to determine the appropriate baudrate flags +this can cause baudrate selection to fail entirely because +tty_termios_encode_baud_rate will only select a baudrate if relative error +between requested and selected baudrate does not exceed +/-2%. +Fix that by requesting actual, exact baudrate used by the serial. + +Fixes: ba47f97a18f2 ("serial: core: remove baud_rates when serial console setup") +Cc: stable +Signed-off-by: Tobias Schramm +Acked-by: Richard Genoud +Link: https://lore.kernel.org/r/20230109072940.202936-1-t.schramm@manjaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/atmel_serial.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -2633,13 +2633,7 @@ static void __init atmel_console_get_opt + else if (mr == ATMEL_US_PAR_ODD) + *parity = 'o'; + +- /* +- * The serial core only rounds down when matching this to a +- * supported baud rate. Make sure we don't end up slightly +- * lower than one of those, as it would make us fall through +- * to a much lower baud rate than we really want. +- */ +- *baud = port->uartclk / (16 * (quot - 1)); ++ *baud = port->uartclk / (16 * quot); + } + + static int __init atmel_console_setup(struct console *co, char *options) diff --git a/queue-5.10/serial-pch_uart-pass-correct-sg-to-dma_unmap_sg.patch b/queue-5.10/serial-pch_uart-pass-correct-sg-to-dma_unmap_sg.patch new file mode 100644 index 00000000000..227776a6369 --- /dev/null +++ b/queue-5.10/serial-pch_uart-pass-correct-sg-to-dma_unmap_sg.patch @@ -0,0 +1,41 @@ +From e8914b52e5b024e4af3d810a935fe0805eee8a36 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= +Date: Tue, 3 Jan 2023 11:34:35 +0200 +Subject: serial: pch_uart: Pass correct sg to dma_unmap_sg() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +commit e8914b52e5b024e4af3d810a935fe0805eee8a36 upstream. + +A local variable sg is used to store scatterlist pointer in +pch_dma_tx_complete(). The for loop doing Tx byte accounting before +dma_unmap_sg() alters sg in its increment statement. Therefore, the +pointer passed into dma_unmap_sg() won't match to the one given to +dma_map_sg(). + +To fix the problem, use priv->sg_tx_p directly in dma_unmap_sg() +instead of the local variable. + +Fixes: da3564ee027e ("pch_uart: add multi-scatter processing") +Cc: stable@vger.kernel.org +Signed-off-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20230103093435.4396-1-ilpo.jarvinen@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/pch_uart.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/pch_uart.c ++++ b/drivers/tty/serial/pch_uart.c +@@ -769,7 +769,7 @@ static void pch_dma_tx_complete(void *ar + } + xmit->tail &= UART_XMIT_SIZE - 1; + async_tx_ack(priv->desc_tx); +- dma_unmap_sg(port->dev, sg, priv->orig_nent, DMA_TO_DEVICE); ++ dma_unmap_sg(port->dev, priv->sg_tx_p, priv->orig_nent, DMA_TO_DEVICE); + priv->tx_dma_use = 0; + priv->nent = 0; + priv->orig_nent = 0; diff --git a/queue-5.10/series b/queue-5.10/series index 49dc5d7e1f0..69faff074c3 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -57,3 +57,23 @@ mmc-sdhci-esdhc-imx-correct-the-tuning-start-tap-and-step-setting.patch btrfs-fix-race-between-quota-rescan-and-disable-leading-to-null-pointer-deref.patch cifs-do-not-include-page-data-when-checking-signature.patch thunderbolt-use-correct-function-to-calculate-maximum-usb3-link-rate.patch +tty-serial-qcom-geni-serial-fix-slab-out-of-bounds-on-rx-fifo-buffer.patch +usb-gadgetfs-fix-race-between-mounting-and-unmounting.patch +usb-serial-cp210x-add-scalance-lpe-9000-device-id.patch +usb-host-ehci-fsl-fix-module-alias.patch +usb-typec-altmodes-displayport-add-pin-assignment-helper.patch +usb-typec-altmodes-displayport-fix-pin-assignment-calculation.patch +usb-gadget-g_webcam-send-color-matching-descriptor-per-frame.patch +usb-gadget-f_ncm-fix-potential-null-ptr-deref-in-ncm_bitrate.patch +usb-storage-apply-ignore_uas-only-for-hiksemi-md202-on-rtl9210.patch +dt-bindings-phy-g12a-usb2-phy-fix-compatible-string-documentation.patch +dt-bindings-phy-g12a-usb3-pcie-phy-fix-compatible-string-documentation.patch +serial-pch_uart-pass-correct-sg-to-dma_unmap_sg.patch +dmaengine-tegra210-adma-fix-global-intr-clear.patch +serial-atmel-fix-incorrect-baudrate-setup.patch +gsmi-fix-null-deref-in-gsmi_get_variable.patch +mei-me-add-meteor-lake-point-m-did.patch +drm-i915-re-disable-rc6p-on-sandy-bridge.patch +drm-amd-display-fix-set-scaling-doesn-s-work.patch +drm-amd-display-calculate-output_color_space-after-pixel-encoding-adjustment.patch +drm-amd-display-fix-color_space_ycbcr2020_type-matrix.patch diff --git a/queue-5.10/tty-serial-qcom-geni-serial-fix-slab-out-of-bounds-on-rx-fifo-buffer.patch b/queue-5.10/tty-serial-qcom-geni-serial-fix-slab-out-of-bounds-on-rx-fifo-buffer.patch new file mode 100644 index 00000000000..b89ba774d32 --- /dev/null +++ b/queue-5.10/tty-serial-qcom-geni-serial-fix-slab-out-of-bounds-on-rx-fifo-buffer.patch @@ -0,0 +1,111 @@ +From b8caf69a6946e18ffebad49847e258f5b6d52ac2 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Wed, 21 Dec 2022 17:40:22 +0100 +Subject: tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer + +From: Krzysztof Kozlowski + +commit b8caf69a6946e18ffebad49847e258f5b6d52ac2 upstream. + +Driver's probe allocates memory for RX FIFO (port->rx_fifo) based on +default RX FIFO depth, e.g. 16. Later during serial startup the +qcom_geni_serial_port_setup() updates the RX FIFO depth +(port->rx_fifo_depth) to match real device capabilities, e.g. to 32. + +The RX UART handle code will read "port->rx_fifo_depth" number of words +into "port->rx_fifo" buffer, thus exceeding the bounds. This can be +observed in certain configurations with Qualcomm Bluetooth HCI UART +device and KASAN: + + Bluetooth: hci0: QCA Product ID :0x00000010 + Bluetooth: hci0: QCA SOC Version :0x400a0200 + Bluetooth: hci0: QCA ROM Version :0x00000200 + Bluetooth: hci0: QCA Patch Version:0x00000d2b + Bluetooth: hci0: QCA controller version 0x02000200 + Bluetooth: hci0: QCA Downloading qca/htbtfw20.tlv + bluetooth hci0: Direct firmware load for qca/htbtfw20.tlv failed with error -2 + Bluetooth: hci0: QCA Failed to request file: qca/htbtfw20.tlv (-2) + Bluetooth: hci0: QCA Failed to download patch (-2) + ================================================================== + BUG: KASAN: slab-out-of-bounds in handle_rx_uart+0xa8/0x18c + Write of size 4 at addr ffff279347d578c0 by task swapper/0/0 + + CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26 + Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) + Call trace: + dump_backtrace.part.0+0xe0/0xf0 + show_stack+0x18/0x40 + dump_stack_lvl+0x8c/0xb8 + print_report+0x188/0x488 + kasan_report+0xb4/0x100 + __asan_store4+0x80/0xa4 + handle_rx_uart+0xa8/0x18c + qcom_geni_serial_handle_rx+0x84/0x9c + qcom_geni_serial_isr+0x24c/0x760 + __handle_irq_event_percpu+0x108/0x500 + handle_irq_event+0x6c/0x110 + handle_fasteoi_irq+0x138/0x2cc + generic_handle_domain_irq+0x48/0x64 + +If the RX FIFO depth changes after probe, be sure to resize the buffer. + +Fixes: f9d690b6ece7 ("tty: serial: qcom_geni_serial: Allocate port->rx_fifo buffer in probe") +Cc: +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Jiri Slaby +Link: https://lore.kernel.org/r/20221221164022.1087814-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/qcom_geni_serial.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +--- a/drivers/tty/serial/qcom_geni_serial.c ++++ b/drivers/tty/serial/qcom_geni_serial.c +@@ -866,9 +866,10 @@ out_unlock: + return IRQ_HANDLED; + } + +-static void get_tx_fifo_size(struct qcom_geni_serial_port *port) ++static int setup_fifos(struct qcom_geni_serial_port *port) + { + struct uart_port *uport; ++ u32 old_rx_fifo_depth = port->rx_fifo_depth; + + uport = &port->uport; + port->tx_fifo_depth = geni_se_get_tx_fifo_depth(&port->se); +@@ -876,6 +877,16 @@ static void get_tx_fifo_size(struct qcom + port->rx_fifo_depth = geni_se_get_rx_fifo_depth(&port->se); + uport->fifosize = + (port->tx_fifo_depth * port->tx_fifo_width) / BITS_PER_BYTE; ++ ++ if (port->rx_fifo && (old_rx_fifo_depth != port->rx_fifo_depth) && port->rx_fifo_depth) { ++ port->rx_fifo = devm_krealloc(uport->dev, port->rx_fifo, ++ port->rx_fifo_depth * sizeof(u32), ++ GFP_KERNEL); ++ if (!port->rx_fifo) ++ return -ENOMEM; ++ } ++ ++ return 0; + } + + +@@ -890,6 +901,7 @@ static int qcom_geni_serial_port_setup(s + u32 rxstale = DEFAULT_BITS_PER_CHAR * STALE_TIMEOUT; + u32 proto; + u32 pin_swap; ++ int ret; + + proto = geni_se_read_proto(&port->se); + if (proto != GENI_SE_UART) { +@@ -899,7 +911,9 @@ static int qcom_geni_serial_port_setup(s + + qcom_geni_serial_stop_rx(uport); + +- get_tx_fifo_size(port); ++ ret = setup_fifos(port); ++ if (ret) ++ return ret; + + writel(rxstale, uport->membase + SE_UART_RX_STALE_CNT); + diff --git a/queue-5.10/usb-gadget-f_ncm-fix-potential-null-ptr-deref-in-ncm_bitrate.patch b/queue-5.10/usb-gadget-f_ncm-fix-potential-null-ptr-deref-in-ncm_bitrate.patch new file mode 100644 index 00000000000..78e0b6eac69 --- /dev/null +++ b/queue-5.10/usb-gadget-f_ncm-fix-potential-null-ptr-deref-in-ncm_bitrate.patch @@ -0,0 +1,95 @@ +From c6ec929595c7443250b2a4faea988c62019d5cd2 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= +Date: Tue, 17 Jan 2023 05:18:39 -0800 +Subject: usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maciej Żenczykowski + +commit c6ec929595c7443250b2a4faea988c62019d5cd2 upstream. + +In Google internal bug 265639009 we've received an (as yet) unreproducible +crash report from an aarch64 GKI 5.10.149-android13 running device. + +AFAICT the source code is at: + https://android.googlesource.com/kernel/common/+/refs/tags/ASB-2022-12-05_13-5.10 + +The call stack is: + ncm_close() -> ncm_notify() -> ncm_do_notify() +with the crash at: + ncm_do_notify+0x98/0x270 +Code: 79000d0b b9000a6c f940012a f9400269 (b9405d4b) + +Which I believe disassembles to (I don't know ARM assembly, but it looks sane enough to me...): + + // halfword (16-bit) store presumably to event->wLength (at offset 6 of struct usb_cdc_notification) + 0B 0D 00 79 strh w11, [x8, #6] + + // word (32-bit) store presumably to req->Length (at offset 8 of struct usb_request) + 6C 0A 00 B9 str w12, [x19, #8] + + // x10 (NULL) was read here from offset 0 of valid pointer x9 + // IMHO we're reading 'cdev->gadget' and getting NULL + // gadget is indeed at offset 0 of struct usb_composite_dev + 2A 01 40 F9 ldr x10, [x9] + + // loading req->buf pointer, which is at offset 0 of struct usb_request + 69 02 40 F9 ldr x9, [x19] + + // x10 is null, crash, appears to be attempt to read cdev->gadget->max_speed + 4B 5D 40 B9 ldr w11, [x10, #0x5c] + +which seems to line up with ncm_do_notify() case NCM_NOTIFY_SPEED code fragment: + + event->wLength = cpu_to_le16(8); + req->length = NCM_STATUS_BYTECOUNT; + + /* SPEED_CHANGE data is up/down speeds in bits/sec */ + data = req->buf + sizeof *event; + data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget)); + +My analysis of registers and NULL ptr deref crash offset + (Unable to handle kernel NULL pointer dereference at virtual address 000000000000005c) +heavily suggests that the crash is due to 'cdev->gadget' being NULL when executing: + data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget)); +which calls: + ncm_bitrate(NULL) +which then calls: + gadget_is_superspeed(NULL) +which reads + ((struct usb_gadget *)NULL)->max_speed +and hits a panic. + +AFAICT, if I'm counting right, the offset of max_speed is indeed 0x5C. +(remember there's a GKI KABI reservation of 16 bytes in struct work_struct) + +It's not at all clear to me how this is all supposed to work... +but returning 0 seems much better than panic-ing... + +Cc: Felipe Balbi +Cc: Lorenzo Colitti +Cc: Carlos Llamas +Cc: stable@vger.kernel.org +Signed-off-by: Maciej Żenczykowski +Cc: stable +Link: https://lore.kernel.org/r/20230117131839.1138208-1-maze@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/f_ncm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/gadget/function/f_ncm.c ++++ b/drivers/usb/gadget/function/f_ncm.c +@@ -85,7 +85,9 @@ static inline struct f_ncm *func_to_ncm( + /* peak (theoretical) bulk transfer rate in bits-per-second */ + static inline unsigned ncm_bitrate(struct usb_gadget *g) + { +- if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS) ++ if (!g) ++ return 0; ++ else if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS) + return 4250000000U; + else if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER) + return 3750000000U; diff --git a/queue-5.10/usb-gadget-g_webcam-send-color-matching-descriptor-per-frame.patch b/queue-5.10/usb-gadget-g_webcam-send-color-matching-descriptor-per-frame.patch new file mode 100644 index 00000000000..713f8b30f7c --- /dev/null +++ b/queue-5.10/usb-gadget-g_webcam-send-color-matching-descriptor-per-frame.patch @@ -0,0 +1,59 @@ +From e95765e97d9cb93258a4840440d410fa6ff7e819 Mon Sep 17 00:00:00 2001 +From: Daniel Scally +Date: Fri, 16 Dec 2022 16:05:28 +0000 +Subject: usb: gadget: g_webcam: Send color matching descriptor per frame + +From: Daniel Scally + +commit e95765e97d9cb93258a4840440d410fa6ff7e819 upstream. + +Currently the color matching descriptor is only sent across the wire +a single time, following the descriptors for each format and frame. +According to the UVC 1.5 Specification 3.9.2.6 ("Color Matching +Descriptors"): + +"Only one instance is allowed for a given format and if present, +the Color Matching descriptor shall be placed following the Video +and Still Image Frame descriptors for that format". + +Add another reference to the color matching descriptor after the +yuyv frames so that it's correctly transmitted for that format +too. + +Fixes: a9914127e834 ("USB gadget: Webcam device") +Cc: stable +Signed-off-by: Daniel Scally +Reviewed-by: Laurent Pinchart +Reviewed-by: Kieran Bingham +Link: https://lore.kernel.org/r/20221216160528.479094-1-dan.scally@ideasonboard.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/legacy/webcam.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/gadget/legacy/webcam.c ++++ b/drivers/usb/gadget/legacy/webcam.c +@@ -293,6 +293,7 @@ static const struct uvc_descriptor_heade + (const struct uvc_descriptor_header *) &uvc_format_yuv, + (const struct uvc_descriptor_header *) &uvc_frame_yuv_360p, + (const struct uvc_descriptor_header *) &uvc_frame_yuv_720p, ++ (const struct uvc_descriptor_header *) &uvc_color_matching, + (const struct uvc_descriptor_header *) &uvc_format_mjpg, + (const struct uvc_descriptor_header *) &uvc_frame_mjpg_360p, + (const struct uvc_descriptor_header *) &uvc_frame_mjpg_720p, +@@ -305,6 +306,7 @@ static const struct uvc_descriptor_heade + (const struct uvc_descriptor_header *) &uvc_format_yuv, + (const struct uvc_descriptor_header *) &uvc_frame_yuv_360p, + (const struct uvc_descriptor_header *) &uvc_frame_yuv_720p, ++ (const struct uvc_descriptor_header *) &uvc_color_matching, + (const struct uvc_descriptor_header *) &uvc_format_mjpg, + (const struct uvc_descriptor_header *) &uvc_frame_mjpg_360p, + (const struct uvc_descriptor_header *) &uvc_frame_mjpg_720p, +@@ -317,6 +319,7 @@ static const struct uvc_descriptor_heade + (const struct uvc_descriptor_header *) &uvc_format_yuv, + (const struct uvc_descriptor_header *) &uvc_frame_yuv_360p, + (const struct uvc_descriptor_header *) &uvc_frame_yuv_720p, ++ (const struct uvc_descriptor_header *) &uvc_color_matching, + (const struct uvc_descriptor_header *) &uvc_format_mjpg, + (const struct uvc_descriptor_header *) &uvc_frame_mjpg_360p, + (const struct uvc_descriptor_header *) &uvc_frame_mjpg_720p, diff --git a/queue-5.10/usb-gadgetfs-fix-race-between-mounting-and-unmounting.patch b/queue-5.10/usb-gadgetfs-fix-race-between-mounting-and-unmounting.patch new file mode 100644 index 00000000000..224b118ce50 --- /dev/null +++ b/queue-5.10/usb-gadgetfs-fix-race-between-mounting-and-unmounting.patch @@ -0,0 +1,130 @@ +From d18dcfe9860e842f394e37ba01ca9440ab2178f4 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Fri, 23 Dec 2022 09:59:09 -0500 +Subject: USB: gadgetfs: Fix race between mounting and unmounting + +From: Alan Stern + +commit d18dcfe9860e842f394e37ba01ca9440ab2178f4 upstream. + +The syzbot fuzzer and Gerald Lee have identified a use-after-free bug +in the gadgetfs driver, involving processes concurrently mounting and +unmounting the gadgetfs filesystem. In particular, gadgetfs_fill_super() +can race with gadgetfs_kill_sb(), causing the latter to deallocate +the_device while the former is using it. The output from KASAN says, +in part: + +BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:102 [inline] +BUG: KASAN: use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline] +BUG: KASAN: use-after-free in __refcount_sub_and_test include/linux/refcount.h:272 [inline] +BUG: KASAN: use-after-free in __refcount_dec_and_test include/linux/refcount.h:315 [inline] +BUG: KASAN: use-after-free in refcount_dec_and_test include/linux/refcount.h:333 [inline] +BUG: KASAN: use-after-free in put_dev drivers/usb/gadget/legacy/inode.c:159 [inline] +BUG: KASAN: use-after-free in gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086 +Write of size 4 at addr ffff8880276d7840 by task syz-executor126/18689 + +CPU: 0 PID: 18689 Comm: syz-executor126 Not tainted 6.1.0-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 +Call Trace: + +... + atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline] + __refcount_sub_and_test include/linux/refcount.h:272 [inline] + __refcount_dec_and_test include/linux/refcount.h:315 [inline] + refcount_dec_and_test include/linux/refcount.h:333 [inline] + put_dev drivers/usb/gadget/legacy/inode.c:159 [inline] + gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086 + deactivate_locked_super+0xa7/0xf0 fs/super.c:332 + vfs_get_super fs/super.c:1190 [inline] + get_tree_single+0xd0/0x160 fs/super.c:1207 + vfs_get_tree+0x88/0x270 fs/super.c:1531 + vfs_fsconfig_locked fs/fsopen.c:232 [inline] + +The simplest solution is to ensure that gadgetfs_fill_super() and +gadgetfs_kill_sb() are serialized by making them both acquire a new +mutex. + +Signed-off-by: Alan Stern +Reported-and-tested-by: syzbot+33d7ad66d65044b93f16@syzkaller.appspotmail.com +Reported-and-tested-by: Gerald Lee +Link: https://lore.kernel.org/linux-usb/CAO3qeMVzXDP-JU6v1u5Ags6Q-bb35kg3=C6d04DjzA9ffa5x1g@mail.gmail.com/ +Fixes: e5d82a7360d1 ("vfs: Convert gadgetfs to use the new mount API") +CC: +Link: https://lore.kernel.org/r/Y6XCPXBpn3tmjdCC@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/legacy/inode.c | 28 +++++++++++++++++++++------- + 1 file changed, 21 insertions(+), 7 deletions(-) + +--- a/drivers/usb/gadget/legacy/inode.c ++++ b/drivers/usb/gadget/legacy/inode.c +@@ -229,6 +229,7 @@ static void put_ep (struct ep_data *data + */ + + static const char *CHIP; ++static DEFINE_MUTEX(sb_mutex); /* Serialize superblock operations */ + + /*----------------------------------------------------------------------*/ + +@@ -2012,13 +2013,20 @@ gadgetfs_fill_super (struct super_block + { + struct inode *inode; + struct dev_data *dev; ++ int rc; + +- if (the_device) +- return -ESRCH; ++ mutex_lock(&sb_mutex); ++ ++ if (the_device) { ++ rc = -ESRCH; ++ goto Done; ++ } + + CHIP = usb_get_gadget_udc_name(); +- if (!CHIP) +- return -ENODEV; ++ if (!CHIP) { ++ rc = -ENODEV; ++ goto Done; ++ } + + /* superblock */ + sb->s_blocksize = PAGE_SIZE; +@@ -2055,13 +2063,17 @@ gadgetfs_fill_super (struct super_block + * from binding to a controller. + */ + the_device = dev; +- return 0; ++ rc = 0; ++ goto Done; + +-Enomem: ++ Enomem: + kfree(CHIP); + CHIP = NULL; ++ rc = -ENOMEM; + +- return -ENOMEM; ++ Done: ++ mutex_unlock(&sb_mutex); ++ return rc; + } + + /* "mount -t gadgetfs path /dev/gadget" ends up here */ +@@ -2083,6 +2095,7 @@ static int gadgetfs_init_fs_context(stru + static void + gadgetfs_kill_sb (struct super_block *sb) + { ++ mutex_lock(&sb_mutex); + kill_litter_super (sb); + if (the_device) { + put_dev (the_device); +@@ -2090,6 +2103,7 @@ gadgetfs_kill_sb (struct super_block *sb + } + kfree(CHIP); + CHIP = NULL; ++ mutex_unlock(&sb_mutex); + } + + /*----------------------------------------------------------------------*/ diff --git a/queue-5.10/usb-host-ehci-fsl-fix-module-alias.patch b/queue-5.10/usb-host-ehci-fsl-fix-module-alias.patch new file mode 100644 index 00000000000..07aa139133d --- /dev/null +++ b/queue-5.10/usb-host-ehci-fsl-fix-module-alias.patch @@ -0,0 +1,36 @@ +From 5d3d01ae15d2f37ed0325c99ab47ef0ae5d05f3c Mon Sep 17 00:00:00 2001 +From: Alexander Stein +Date: Fri, 20 Jan 2023 13:27:14 +0100 +Subject: usb: host: ehci-fsl: Fix module alias + +From: Alexander Stein + +commit 5d3d01ae15d2f37ed0325c99ab47ef0ae5d05f3c upstream. + +Commit ca07e1c1e4a6 ("drivers:usb:fsl:Make fsl ehci drv an independent +driver module") changed DRV_NAME which was used for MODULE_ALIAS as well. +Starting from this the module alias didn't match the platform device +name created in fsl-mph-dr-of.c +Change DRV_NAME to match the driver name for host mode in fsl-mph-dr-of. +This is needed for module autoloading on ls1021a. + +Fixes: ca07e1c1e4a6 ("drivers:usb:fsl:Make fsl ehci drv an independent driver module") +Cc: stable +Signed-off-by: Alexander Stein +Link: https://lore.kernel.org/r/20230120122714.3848784-1-alexander.stein@ew.tq-group.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/ehci-fsl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/ehci-fsl.c ++++ b/drivers/usb/host/ehci-fsl.c +@@ -29,7 +29,7 @@ + #include "ehci-fsl.h" + + #define DRIVER_DESC "Freescale EHCI Host controller driver" +-#define DRV_NAME "ehci-fsl" ++#define DRV_NAME "fsl-ehci" + + static struct hc_driver __read_mostly fsl_ehci_hc_driver; + diff --git a/queue-5.10/usb-serial-cp210x-add-scalance-lpe-9000-device-id.patch b/queue-5.10/usb-serial-cp210x-add-scalance-lpe-9000-device-id.patch new file mode 100644 index 00000000000..8e6ee7f8704 --- /dev/null +++ b/queue-5.10/usb-serial-cp210x-add-scalance-lpe-9000-device-id.patch @@ -0,0 +1,30 @@ +From 3f9e76e31704a325170e5aec2243c8d084d74854 Mon Sep 17 00:00:00 2001 +From: Michael Adler +Date: Tue, 3 Jan 2023 14:48:50 +0100 +Subject: USB: serial: cp210x: add SCALANCE LPE-9000 device id + +From: Michael Adler + +commit 3f9e76e31704a325170e5aec2243c8d084d74854 upstream. + +Add the USB serial console device ID for Siemens SCALANCE LPE-9000 +which have a USB port for their serial console. + +Signed-off-by: Michael Adler +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -64,6 +64,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */ + { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */ + { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */ ++ { USB_DEVICE(0x0908, 0x0070) }, /* Siemens SCALANCE LPE-9000 USB Serial Console */ + { USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */ + { USB_DEVICE(0x0988, 0x0578) }, /* Teraoka AD2000 */ + { USB_DEVICE(0x0B00, 0x3070) }, /* Ingenico 3070 */ diff --git a/queue-5.10/usb-storage-apply-ignore_uas-only-for-hiksemi-md202-on-rtl9210.patch b/queue-5.10/usb-storage-apply-ignore_uas-only-for-hiksemi-md202-on-rtl9210.patch new file mode 100644 index 00000000000..26c6e3ef6e1 --- /dev/null +++ b/queue-5.10/usb-storage-apply-ignore_uas-only-for-hiksemi-md202-on-rtl9210.patch @@ -0,0 +1,77 @@ +From dbd24ec17b85b45f4e823d1aa5607721920f2b05 Mon Sep 17 00:00:00 2001 +From: Juhyung Park +Date: Tue, 17 Jan 2023 17:51:54 +0900 +Subject: usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210 + +From: Juhyung Park + +commit dbd24ec17b85b45f4e823d1aa5607721920f2b05 upstream. + +The commit e00b488e813f ("usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS") +blacklists UAS for all of RTL9210 enclosures. + +The RTL9210 controller was advertised with UAS since its release back in +2019 and was shipped with a lot of enclosure products with different +firmware combinations. + +Blacklist UAS only for HIKSEMI MD202. + +This should hopefully be replaced with more robust method than just +comparing strings. But with limited information [1] provided thus far +(dmesg when the device is plugged in, which includes manufacturer and +product, but no lsusb -v to compare against), this is the best we can do +for now. + +[1] https://lore.kernel.org/all/20230109115550.71688-1-qkrwngud825@gmail.com + +Fixes: e00b488e813f ("usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS") +Cc: Alan Stern +Cc: Hongling Zeng +Cc: stable@vger.kernel.org +Signed-off-by: Juhyung Park +Acked-by: Oliver Neukum +Link: https://lore.kernel.org/r/20230117085154.123301-1-qkrwngud825@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/storage/uas-detect.h | 13 +++++++++++++ + drivers/usb/storage/unusual_uas.h | 7 ------- + 2 files changed, 13 insertions(+), 7 deletions(-) + +--- a/drivers/usb/storage/uas-detect.h ++++ b/drivers/usb/storage/uas-detect.h +@@ -116,6 +116,19 @@ static int uas_use_uas_driver(struct usb + if (le16_to_cpu(udev->descriptor.idVendor) == 0x0bc2) + flags |= US_FL_NO_ATA_1X; + ++ /* ++ * RTL9210-based enclosure from HIKSEMI, MD202 reportedly have issues ++ * with UAS. This isn't distinguishable with just idVendor and ++ * idProduct, use manufacturer and product too. ++ * ++ * Reported-by: Hongling Zeng ++ */ ++ if (le16_to_cpu(udev->descriptor.idVendor) == 0x0bda && ++ le16_to_cpu(udev->descriptor.idProduct) == 0x9210 && ++ (udev->manufacturer && !strcmp(udev->manufacturer, "HIKSEMI")) && ++ (udev->product && !strcmp(udev->product, "MD202"))) ++ flags |= US_FL_IGNORE_UAS; ++ + usb_stor_adjust_quirks(udev, &flags); + + if (flags & US_FL_IGNORE_UAS) { +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -83,13 +83,6 @@ UNUSUAL_DEV(0x0bc2, 0x331a, 0x0000, 0x99 + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_NO_REPORT_LUNS), + +-/* Reported-by: Hongling Zeng */ +-UNUSUAL_DEV(0x0bda, 0x9210, 0x0000, 0x9999, +- "Hiksemi", +- "External HDD", +- USB_SC_DEVICE, USB_PR_DEVICE, NULL, +- US_FL_IGNORE_UAS), +- + /* Reported-by: Benjamin Tissoires */ + UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999, + "Initio Corporation", diff --git a/queue-5.10/usb-typec-altmodes-displayport-add-pin-assignment-helper.patch b/queue-5.10/usb-typec-altmodes-displayport-add-pin-assignment-helper.patch new file mode 100644 index 00000000000..e6d66644103 --- /dev/null +++ b/queue-5.10/usb-typec-altmodes-displayport-add-pin-assignment-helper.patch @@ -0,0 +1,73 @@ +From 582836e3cfab4faafbdc93bbec96fce036a08ee1 Mon Sep 17 00:00:00 2001 +From: Prashant Malani +Date: Wed, 11 Jan 2023 02:05:41 +0000 +Subject: usb: typec: altmodes/displayport: Add pin assignment helper + +From: Prashant Malani + +commit 582836e3cfab4faafbdc93bbec96fce036a08ee1 upstream. + +The code to extract a peripheral's currently supported Pin Assignments +is repeated in a couple of locations. Factor it out into a separate +function. + +This will also make it easier to add fixes (we only need to update 1 +location instead of 2). + +Fixes: c1e5c2f0cb8a ("usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles") +Cc: stable@vger.kernel.org +Cc: Heikki Krogerus +Signed-off-by: Prashant Malani +Reviewed-by: Benson Leung +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20230111020546.3384569-1-pmalani@chromium.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/altmodes/displayport.c | 22 ++++++++++++++-------- + 1 file changed, 14 insertions(+), 8 deletions(-) + +--- a/drivers/usb/typec/altmodes/displayport.c ++++ b/drivers/usb/typec/altmodes/displayport.c +@@ -409,6 +409,18 @@ static const char * const pin_assignment + [DP_PIN_ASSIGN_F] = "F", + }; + ++/* ++ * Helper function to extract a peripheral's currently supported ++ * Pin Assignments from its DisplayPort alternate mode state. ++ */ ++static u8 get_current_pin_assignments(struct dp_altmode *dp) ++{ ++ if (DP_CONF_CURRENTLY(dp->data.conf) == DP_CONF_DFP_D) ++ return DP_CAP_UFP_D_PIN_ASSIGN(dp->alt->vdo); ++ else ++ return DP_CAP_DFP_D_PIN_ASSIGN(dp->alt->vdo); ++} ++ + static ssize_t + pin_assignment_store(struct device *dev, struct device_attribute *attr, + const char *buf, size_t size) +@@ -435,10 +447,7 @@ pin_assignment_store(struct device *dev, + goto out_unlock; + } + +- if (DP_CONF_CURRENTLY(dp->data.conf) == DP_CONF_DFP_D) +- assignments = DP_CAP_UFP_D_PIN_ASSIGN(dp->alt->vdo); +- else +- assignments = DP_CAP_DFP_D_PIN_ASSIGN(dp->alt->vdo); ++ assignments = get_current_pin_assignments(dp); + + if (!(DP_CONF_GET_PIN_ASSIGN(conf) & assignments)) { + ret = -EINVAL; +@@ -475,10 +484,7 @@ static ssize_t pin_assignment_show(struc + + cur = get_count_order(DP_CONF_GET_PIN_ASSIGN(dp->data.conf)); + +- if (DP_CONF_CURRENTLY(dp->data.conf) == DP_CONF_DFP_D) +- assignments = DP_CAP_UFP_D_PIN_ASSIGN(dp->alt->vdo); +- else +- assignments = DP_CAP_DFP_D_PIN_ASSIGN(dp->alt->vdo); ++ assignments = get_current_pin_assignments(dp); + + for (i = 0; assignments; assignments >>= 1, i++) { + if (assignments & 1) { diff --git a/queue-5.10/usb-typec-altmodes-displayport-fix-pin-assignment-calculation.patch b/queue-5.10/usb-typec-altmodes-displayport-fix-pin-assignment-calculation.patch new file mode 100644 index 00000000000..4e3299ffd4e --- /dev/null +++ b/queue-5.10/usb-typec-altmodes-displayport-fix-pin-assignment-calculation.patch @@ -0,0 +1,43 @@ +From 9682b41e52cc9f42f5c33caf410464392adaef04 Mon Sep 17 00:00:00 2001 +From: Prashant Malani +Date: Wed, 11 Jan 2023 02:05:42 +0000 +Subject: usb: typec: altmodes/displayport: Fix pin assignment calculation + +From: Prashant Malani + +commit 9682b41e52cc9f42f5c33caf410464392adaef04 upstream. + +Commit c1e5c2f0cb8a ("usb: typec: altmodes/displayport: correct pin +assignment for UFP receptacles") fixed the pin assignment calculation +to take into account whether the peripheral was a plug or a receptacle. + +But the "pin_assignments" sysfs logic was not updated. Address this by +using the macros introduced in the aforementioned commit in the sysfs +logic too. + +Fixes: c1e5c2f0cb8a ("usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles") +Cc: stable@vger.kernel.org +Cc: Heikki Krogerus +Signed-off-by: Prashant Malani +Reviewed-by: Benson Leung +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20230111020546.3384569-2-pmalani@chromium.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/altmodes/displayport.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/typec/altmodes/displayport.c ++++ b/drivers/usb/typec/altmodes/displayport.c +@@ -416,9 +416,9 @@ static const char * const pin_assignment + static u8 get_current_pin_assignments(struct dp_altmode *dp) + { + if (DP_CONF_CURRENTLY(dp->data.conf) == DP_CONF_DFP_D) +- return DP_CAP_UFP_D_PIN_ASSIGN(dp->alt->vdo); ++ return DP_CAP_PIN_ASSIGN_DFP_D(dp->alt->vdo); + else +- return DP_CAP_DFP_D_PIN_ASSIGN(dp->alt->vdo); ++ return DP_CAP_PIN_ASSIGN_UFP_D(dp->alt->vdo); + } + + static ssize_t