From bf2affe7892519ca4da9d10b18bdb24df78de2b9 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sat, 16 Dec 2023 16:00:35 -0500 Subject: [PATCH] Fixes for 5.15 Signed-off-by: Sasha Levin --- ...nlock-fix-queued_spin_value_unlocked.patch | 51 +++++++ ...comments-for-bch_btree_node_get-and-.patch | 50 +++++++ ...l-checking-to-c-root-in-run_cache_se.patch | 39 +++++ ...rsize-memory-allocation-by-small-str.patch | 90 ++++++++++++ ...dundant-assignment-to-variable-cur_i.patch | 42 ++++++ ...s-blkcg_deactivate_policy-after-dest.patch | 55 +++++++ ...-lockdep-warning-of-cgroup_mutex-or-.patch | 49 +++++++ ...-spinlock-for-setting-vblank-event-i.patch | 54 +++++++ ...d-add-always_poll-quirk-for-apple-kb.patch | 34 +++++ ...ious-fix-glorious-model-i-hid-report.patch | 135 ++++++++++++++++++ ...-const-to-read-only-outgoing-usb-buf.patch | 65 +++++++++ ...et-the-backlight-brightness-level-on.patch | 67 +++++++++ ...dd-quirk-for-honor-glo-gxxx-touchpad.patch | 46 ++++++ ...wwan-claim-interface-4-for-zte-mf290.patch | 68 +++++++++ ...el_telemetry-fix-kernel-doc-descript.patch | 57 ++++++++ queue-5.15/series | 17 +++ ...loongson-add-architecture-dependency.patch | 39 +++++ ...heck-packet-for-fixup-for-true-limit.patch | 58 ++++++++ 18 files changed, 1016 insertions(+) create mode 100644 queue-5.15/asm-generic-qspinlock-fix-queued_spin_value_unlocked.patch create mode 100644 queue-5.15/bcache-add-code-comments-for-bch_btree_node_get-and-.patch create mode 100644 queue-5.15/bcache-avoid-null-checking-to-c-root-in-run_cache_se.patch create mode 100644 queue-5.15/bcache-avoid-oversize-memory-allocation-by-small-str.patch create mode 100644 queue-5.15/bcache-remove-redundant-assignment-to-variable-cur_i.patch create mode 100644 queue-5.15/blk-cgroup-bypass-blkcg_deactivate_policy-after-dest.patch create mode 100644 queue-5.15/blk-throttle-fix-lockdep-warning-of-cgroup_mutex-or-.patch create mode 100644 queue-5.15/drm-mediatek-add-spinlock-for-setting-vblank-event-i.patch create mode 100644 queue-5.15/hid-add-always_poll-quirk-for-apple-kb.patch create mode 100644 queue-5.15/hid-glorious-fix-glorious-model-i-hid-report.patch create mode 100644 queue-5.15/hid-hid-asus-add-const-to-read-only-outgoing-usb-buf.patch create mode 100644 queue-5.15/hid-hid-asus-reset-the-backlight-brightness-level-on.patch create mode 100644 queue-5.15/hid-multitouch-add-quirk-for-honor-glo-gxxx-touchpad.patch create mode 100644 queue-5.15/net-usb-qmi_wwan-claim-interface-4-for-zte-mf290.patch create mode 100644 queue-5.15/platform-x86-intel_telemetry-fix-kernel-doc-descript.patch create mode 100644 queue-5.15/stmmac-dwmac-loongson-add-architecture-dependency.patch create mode 100644 queue-5.15/usb-aqc111-check-packet-for-fixup-for-true-limit.patch diff --git a/queue-5.15/asm-generic-qspinlock-fix-queued_spin_value_unlocked.patch b/queue-5.15/asm-generic-qspinlock-fix-queued_spin_value_unlocked.patch new file mode 100644 index 00000000000..d47729b1800 --- /dev/null +++ b/queue-5.15/asm-generic-qspinlock-fix-queued_spin_value_unlocked.patch @@ -0,0 +1,51 @@ +From 6cee23e9236b7823679f00fec3289e0249bfd7e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Nov 2023 22:22:13 -0800 +Subject: asm-generic: qspinlock: fix queued_spin_value_unlocked() + implementation + +From: Linus Torvalds + +[ Upstream commit 125b0bb95dd6bec81b806b997a4ccb026eeecf8f ] + +We really don't want to do atomic_read() or anything like that, since we +already have the value, not the lock. The whole point of this is that +we've loaded the lock from memory, and we want to check whether the +value we loaded was a locked one or not. + +The main use of this is the lockref code, which loads both the lock and +the reference count in one atomic operation, and then works on that +combined value. With the atomic_read(), the compiler would pointlessly +spill the value to the stack, in order to then be able to read it back +"atomically". + +This is the qspinlock version of commit c6f4a9002252 ("asm-generic: +ticket-lock: Optimize arch_spin_value_unlocked()") which fixed this same +bug for ticket locks. + +Cc: Guo Ren +Cc: Ingo Molnar +Cc: Waiman Long +Link: https://lore.kernel.org/all/CAHk-=whNRv0v6kQiV5QO6DJhjH4KEL36vWQ6Re8Csrnh4zbRkQ@mail.gmail.com/ +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/asm-generic/qspinlock.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/asm-generic/qspinlock.h b/include/asm-generic/qspinlock.h +index d74b138255014..95cfcfb8a3b4d 100644 +--- a/include/asm-generic/qspinlock.h ++++ b/include/asm-generic/qspinlock.h +@@ -41,7 +41,7 @@ static __always_inline int queued_spin_is_locked(struct qspinlock *lock) + */ + static __always_inline int queued_spin_value_unlocked(struct qspinlock lock) + { +- return !atomic_read(&lock.val); ++ return !lock.val.counter; + } + + /** +-- +2.43.0 + diff --git a/queue-5.15/bcache-add-code-comments-for-bch_btree_node_get-and-.patch b/queue-5.15/bcache-add-code-comments-for-bch_btree_node_get-and-.patch new file mode 100644 index 00000000000..eaa5afb6b9a --- /dev/null +++ b/queue-5.15/bcache-add-code-comments-for-bch_btree_node_get-and-.patch @@ -0,0 +1,50 @@ +From 203d63eff2fd180577a9ad817811d5deb61915a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Nov 2023 13:25:02 +0800 +Subject: bcache: add code comments for bch_btree_node_get() and + __bch_btree_node_alloc() + +From: Coly Li + +[ Upstream commit 31f5b956a197d4ec25c8a07cb3a2ab69d0c0b82f ] + +This patch adds code comments to bch_btree_node_get() and +__bch_btree_node_alloc() that NULL pointer will not be returned and it +is unnecessary to check NULL pointer by the callers of these routines. + +Signed-off-by: Coly Li +Link: https://lore.kernel.org/r/20231120052503.6122-10-colyli@suse.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/bcache/btree.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c +index c7878ba35f3cc..e22dfcf1ed6d8 100644 +--- a/drivers/md/bcache/btree.c ++++ b/drivers/md/bcache/btree.c +@@ -974,6 +974,9 @@ static struct btree *mca_alloc(struct cache_set *c, struct btree_op *op, + * + * The btree node will have either a read or a write lock held, depending on + * level and op->lock. ++ * ++ * Note: Only error code or btree pointer will be returned, it is unncessary ++ * for callers to check NULL pointer. + */ + struct btree *bch_btree_node_get(struct cache_set *c, struct btree_op *op, + struct bkey *k, int level, bool write, +@@ -1085,6 +1088,10 @@ static void btree_node_free(struct btree *b) + mutex_unlock(&b->c->bucket_lock); + } + ++/* ++ * Only error code or btree pointer will be returned, it is unncessary for ++ * callers to check NULL pointer. ++ */ + struct btree *__bch_btree_node_alloc(struct cache_set *c, struct btree_op *op, + int level, bool wait, + struct btree *parent) +-- +2.43.0 + diff --git a/queue-5.15/bcache-avoid-null-checking-to-c-root-in-run_cache_se.patch b/queue-5.15/bcache-avoid-null-checking-to-c-root-in-run_cache_se.patch new file mode 100644 index 00000000000..a1ef141b981 --- /dev/null +++ b/queue-5.15/bcache-avoid-null-checking-to-c-root-in-run_cache_se.patch @@ -0,0 +1,39 @@ +From 0c919b06dac27d684d6bc0e78121f34b947572a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Nov 2023 13:25:03 +0800 +Subject: bcache: avoid NULL checking to c->root in run_cache_set() + +From: Coly Li + +[ Upstream commit 3eba5e0b2422aec3c9e79822029599961fdcab97 ] + +In run_cache_set() after c->root returned from bch_btree_node_get(), it +is checked by IS_ERR_OR_NULL(). Indeed it is unncessary to check NULL +because bch_btree_node_get() will not return NULL pointer to caller. + +This patch replaces IS_ERR_OR_NULL() by IS_ERR() for the above reason. + +Signed-off-by: Coly Li +Link: https://lore.kernel.org/r/20231120052503.6122-11-colyli@suse.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/bcache/super.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 5ad83924d8e3b..8ec48d8a5821c 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -2024,7 +2024,7 @@ static int run_cache_set(struct cache_set *c) + c->root = bch_btree_node_get(c, NULL, k, + j->btree_level, + true, NULL); +- if (IS_ERR_OR_NULL(c->root)) ++ if (IS_ERR(c->root)) + goto err; + + list_del_init(&c->root->list); +-- +2.43.0 + diff --git a/queue-5.15/bcache-avoid-oversize-memory-allocation-by-small-str.patch b/queue-5.15/bcache-avoid-oversize-memory-allocation-by-small-str.patch new file mode 100644 index 00000000000..206265c7932 --- /dev/null +++ b/queue-5.15/bcache-avoid-oversize-memory-allocation-by-small-str.patch @@ -0,0 +1,90 @@ +From 7c1fadb586dd729f0bc15829db49affdff46a992 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Nov 2023 13:24:54 +0800 +Subject: bcache: avoid oversize memory allocation by small stripe_size + +From: Coly Li + +[ Upstream commit baf8fb7e0e5ec54ea0839f0c534f2cdcd79bea9c ] + +Arraies bcache->stripe_sectors_dirty and bcache->full_dirty_stripes are +used for dirty data writeback, their sizes are decided by backing device +capacity and stripe size. Larger backing device capacity or smaller +stripe size make these two arraies occupies more dynamic memory space. + +Currently bcache->stripe_size is directly inherited from +queue->limits.io_opt of underlying storage device. For normal hard +drives, its limits.io_opt is 0, and bcache sets the corresponding +stripe_size to 1TB (1<<31 sectors), it works fine 10+ years. But for +devices do declare value for queue->limits.io_opt, small stripe_size +(comparing to 1TB) becomes an issue for oversize memory allocations of +bcache->stripe_sectors_dirty and bcache->full_dirty_stripes, while the +capacity of hard drives gets much larger in recent decade. + +For example a raid5 array assembled by three 20TB hardrives, the raid +device capacity is 40TB with typical 512KB limits.io_opt. After the math +calculation in bcache code, these two arraies will occupy 400MB dynamic +memory. Even worse Andrea Tomassetti reports that a 4KB limits.io_opt is +declared on a new 2TB hard drive, then these two arraies request 2GB and +512MB dynamic memory from kzalloc(). The result is that bcache device +always fails to initialize on his system. + +To avoid the oversize memory allocation, bcache->stripe_size should not +directly inherited by queue->limits.io_opt from the underlying device. +This patch defines BCH_MIN_STRIPE_SZ (4MB) as minimal bcache stripe size +and set bcache device's stripe size against the declared limits.io_opt +value from the underlying storage device, +- If the declared limits.io_opt > BCH_MIN_STRIPE_SZ, bcache device will + set its stripe size directly by this limits.io_opt value. +- If the declared limits.io_opt < BCH_MIN_STRIPE_SZ, bcache device will + set its stripe size by a value multiplying limits.io_opt and euqal or + large than BCH_MIN_STRIPE_SZ. + +Then the minimal stripe size of a bcache device will always be >= 4MB. +For a 40TB raid5 device with 512KB limits.io_opt, memory occupied by +bcache->stripe_sectors_dirty and bcache->full_dirty_stripes will be 50MB +in total. For a 2TB hard drive with 4KB limits.io_opt, memory occupied +by these two arraies will be 2.5MB in total. + +Such mount of memory allocated for bcache->stripe_sectors_dirty and +bcache->full_dirty_stripes is reasonable for most of storage devices. + +Reported-by: Andrea Tomassetti +Signed-off-by: Coly Li +Reviewed-by: Eric Wheeler +Link: https://lore.kernel.org/r/20231120052503.6122-2-colyli@suse.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/bcache/bcache.h | 1 + + drivers/md/bcache/super.c | 2 ++ + 2 files changed, 3 insertions(+) + +diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h +index 5fc989a6d4528..21344aaf1bdae 100644 +--- a/drivers/md/bcache/bcache.h ++++ b/drivers/md/bcache/bcache.h +@@ -265,6 +265,7 @@ struct bcache_device { + #define BCACHE_DEV_WB_RUNNING 3 + #define BCACHE_DEV_RATE_DW_RUNNING 4 + int nr_stripes; ++#define BCH_MIN_STRIPE_SZ ((4 << 20) >> SECTOR_SHIFT) + unsigned int stripe_size; + atomic_t *stripe_sectors_dirty; + unsigned long *full_dirty_stripes; +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 9e7a6c3faa420..5ad83924d8e3b 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -909,6 +909,8 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size, + + if (!d->stripe_size) + d->stripe_size = 1 << 31; ++ else if (d->stripe_size < BCH_MIN_STRIPE_SZ) ++ d->stripe_size = roundup(BCH_MIN_STRIPE_SZ, d->stripe_size); + + n = DIV_ROUND_UP_ULL(sectors, d->stripe_size); + if (!n || n > max_stripes) { +-- +2.43.0 + diff --git a/queue-5.15/bcache-remove-redundant-assignment-to-variable-cur_i.patch b/queue-5.15/bcache-remove-redundant-assignment-to-variable-cur_i.patch new file mode 100644 index 00000000000..83ac70ec707 --- /dev/null +++ b/queue-5.15/bcache-remove-redundant-assignment-to-variable-cur_i.patch @@ -0,0 +1,42 @@ +From 9a9633f765227396b1d74783f74fecbe7327c457 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Nov 2023 13:24:56 +0800 +Subject: bcache: remove redundant assignment to variable cur_idx + +From: Colin Ian King + +[ Upstream commit be93825f0e6428c2d3f03a6e4d447dc48d33d7ff ] + +Variable cur_idx is being initialized with a value that is never read, +it is being re-assigned later in a while-loop. Remove the redundant +assignment. Cleans up clang scan build warning: + +drivers/md/bcache/writeback.c:916:2: warning: Value stored to 'cur_idx' +is never read [deadcode.DeadStores] + +Signed-off-by: Colin Ian King +Reviewed-by: Coly Li +Signed-off-by: Coly Li +Link: https://lore.kernel.org/r/20231120052503.6122-4-colyli@suse.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/bcache/writeback.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c +index 3bc29ed633cb3..1e96679afcf4a 100644 +--- a/drivers/md/bcache/writeback.c ++++ b/drivers/md/bcache/writeback.c +@@ -903,7 +903,7 @@ static int bch_dirty_init_thread(void *arg) + int cur_idx, prev_idx, skip_nr; + + k = p = NULL; +- cur_idx = prev_idx = 0; ++ prev_idx = 0; + + bch_btree_iter_init(&c->root->keys, &iter, NULL); + k = bch_btree_iter_next_filter(&iter, &c->root->keys, bch_ptr_bad); +-- +2.43.0 + diff --git a/queue-5.15/blk-cgroup-bypass-blkcg_deactivate_policy-after-dest.patch b/queue-5.15/blk-cgroup-bypass-blkcg_deactivate_policy-after-dest.patch new file mode 100644 index 00000000000..b8fbc94fba3 --- /dev/null +++ b/queue-5.15/blk-cgroup-bypass-blkcg_deactivate_policy-after-dest.patch @@ -0,0 +1,55 @@ +From 52fe32b78b6f984f18b0f8672d5f729a2d5cc31e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 10:35:24 +0800 +Subject: blk-cgroup: bypass blkcg_deactivate_policy after destroying + +From: Ming Lei + +[ Upstream commit e63a57303599b17290cd8bc48e6f20b24289a8bc ] + +blkcg_deactivate_policy() can be called after blkg_destroy_all() +returns, and it isn't necessary since blkg_destroy_all has covered +policy deactivation. + +Signed-off-by: Ming Lei +Link: https://lore.kernel.org/r/20231117023527.3188627-4-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-cgroup.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index 3ee4c1217b636..fd81a73708645 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -425,6 +425,7 @@ static void blkg_destroy_all(struct request_queue *q) + { + struct blkcg_gq *blkg, *n; + int count = BLKG_DESTROY_BATCH_SIZE; ++ int i; + + restart: + spin_lock_irq(&q->queue_lock); +@@ -447,6 +448,18 @@ static void blkg_destroy_all(struct request_queue *q) + } + } + ++ /* ++ * Mark policy deactivated since policy offline has been done, and ++ * the free is scheduled, so future blkcg_deactivate_policy() can ++ * be bypassed ++ */ ++ for (i = 0; i < BLKCG_MAX_POLS; i++) { ++ struct blkcg_policy *pol = blkcg_policy[i]; ++ ++ if (pol) ++ __clear_bit(pol->plid, q->blkcg_pols); ++ } ++ + q->root_blkg = NULL; + spin_unlock_irq(&q->queue_lock); + } +-- +2.43.0 + diff --git a/queue-5.15/blk-throttle-fix-lockdep-warning-of-cgroup_mutex-or-.patch b/queue-5.15/blk-throttle-fix-lockdep-warning-of-cgroup_mutex-or-.patch new file mode 100644 index 00000000000..9f61c4d9ae8 --- /dev/null +++ b/queue-5.15/blk-throttle-fix-lockdep-warning-of-cgroup_mutex-or-.patch @@ -0,0 +1,49 @@ +From ee869353f31f7a2d4369586fe48c699d369b177d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 10:35:22 +0800 +Subject: blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock + required!" + +From: Ming Lei + +[ Upstream commit 27b13e209ddca5979847a1b57890e0372c1edcee ] + +Inside blkg_for_each_descendant_pre(), both +css_for_each_descendant_pre() and blkg_lookup() requires RCU read lock, +and either cgroup_assert_mutex_or_rcu_locked() or rcu_read_lock_held() +is called. + +Fix the warning by adding rcu read lock. + +Reported-by: Changhui Zhong +Signed-off-by: Ming Lei +Link: https://lore.kernel.org/r/20231117023527.3188627-2-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-throttle.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/block/blk-throttle.c b/block/blk-throttle.c +index 68cf8dbb4c67a..4da4b25b12f48 100644 +--- a/block/blk-throttle.c ++++ b/block/blk-throttle.c +@@ -1415,6 +1415,7 @@ static void tg_conf_updated(struct throtl_grp *tg, bool global) + tg_bps_limit(tg, READ), tg_bps_limit(tg, WRITE), + tg_iops_limit(tg, READ), tg_iops_limit(tg, WRITE)); + ++ rcu_read_lock(); + /* + * Update has_rules[] flags for the updated tg's subtree. A tg is + * considered to have rules if either the tg itself or any of its +@@ -1442,6 +1443,7 @@ static void tg_conf_updated(struct throtl_grp *tg, bool global) + this_tg->latency_target = max(this_tg->latency_target, + parent_tg->latency_target); + } ++ rcu_read_unlock(); + + /* + * We're already holding queue_lock and know @tg is valid. Let's +-- +2.43.0 + diff --git a/queue-5.15/drm-mediatek-add-spinlock-for-setting-vblank-event-i.patch b/queue-5.15/drm-mediatek-add-spinlock-for-setting-vblank-event-i.patch new file mode 100644 index 00000000000..15f9b812595 --- /dev/null +++ b/queue-5.15/drm-mediatek-add-spinlock-for-setting-vblank-event-i.patch @@ -0,0 +1,54 @@ +From 3288a1c327bc630827b992e44d89496d36780d77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Sep 2023 17:06:58 +0800 +Subject: drm/mediatek: Add spinlock for setting vblank event in atomic_begin + +From: Jason-JH.Lin + +[ Upstream commit fe4c5f662097978b6c91c23a13c24ed92339a180 ] + +Add spinlock protection to avoid race condition on vblank event +between mtk_drm_crtc_atomic_begin() and mtk_drm_finish_page_flip(). + +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Jason-JH.Lin +Suggested-by: AngeloGioacchino Del Regno +Reviewed-by: Alexandre Mergnat +Reviewed-by: Fei Shao +Tested-by: Fei Shao +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: CK Hu +Link: https://patchwork.kernel.org/project/dri-devel/patch/20230920090658.31181-1-jason-jh.lin@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +index f2264633be1b7..d6781e54b3356 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +@@ -680,6 +680,7 @@ static void mtk_drm_crtc_atomic_begin(struct drm_crtc *crtc, + crtc); + struct mtk_crtc_state *mtk_crtc_state = to_mtk_crtc_state(crtc_state); + struct mtk_drm_crtc *mtk_crtc = to_mtk_crtc(crtc); ++ unsigned long flags; + + if (mtk_crtc->event && mtk_crtc_state->base.event) + DRM_ERROR("new event while there is still a pending event\n"); +@@ -687,7 +688,11 @@ static void mtk_drm_crtc_atomic_begin(struct drm_crtc *crtc, + if (mtk_crtc_state->base.event) { + mtk_crtc_state->base.event->pipe = drm_crtc_index(crtc); + WARN_ON(drm_crtc_vblank_get(crtc) != 0); ++ ++ spin_lock_irqsave(&crtc->dev->event_lock, flags); + mtk_crtc->event = mtk_crtc_state->base.event; ++ spin_unlock_irqrestore(&crtc->dev->event_lock, flags); ++ + mtk_crtc_state->base.event = NULL; + } + } +-- +2.43.0 + diff --git a/queue-5.15/hid-add-always_poll-quirk-for-apple-kb.patch b/queue-5.15/hid-add-always_poll-quirk-for-apple-kb.patch new file mode 100644 index 00000000000..53dc3f3f061 --- /dev/null +++ b/queue-5.15/hid-add-always_poll-quirk-for-apple-kb.patch @@ -0,0 +1,34 @@ +From 6680c2f7e58d6a90e436989f64c0cd90165f7c3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Nov 2023 15:54:30 +0100 +Subject: HID: add ALWAYS_POLL quirk for Apple kb + +From: Oliver Neukum + +[ Upstream commit c55092187d9ad7b2f8f5a8645286fa03997d442f ] + +These devices disconnect if suspended without remote wakeup. They can operate +with the standard driver. + +Signed-off-by: Oliver Neukum +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-quirks.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 225138a39d323..fbce6e892fc83 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -33,6 +33,7 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_AKAI, USB_DEVICE_ID_AKAI_MPKMINI2), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_ALPS, USB_DEVICE_ID_IBM_GAMEPAD), HID_QUIRK_BADPAD }, + { HID_USB_DEVICE(USB_VENDOR_ID_AMI, USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE), HID_QUIRK_ALWAYS_POLL }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_REVB_ANSI), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVM), HID_QUIRK_NOGET }, +-- +2.43.0 + diff --git a/queue-5.15/hid-glorious-fix-glorious-model-i-hid-report.patch b/queue-5.15/hid-glorious-fix-glorious-model-i-hid-report.patch new file mode 100644 index 00000000000..10d37691ece --- /dev/null +++ b/queue-5.15/hid-glorious-fix-glorious-model-i-hid-report.patch @@ -0,0 +1,135 @@ +From 4603b82ad149f321aa7507b99f3934f916b88e9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Nov 2023 18:10:38 -0700 +Subject: HID: glorious: fix Glorious Model I HID report + +From: Brett Raye + +[ Upstream commit a5e913c25b6b2b6ae02acef6d9400645ac03dfdf ] + +The Glorious Model I mouse has a buggy HID report descriptor for its +keyboard endpoint (used for programmable buttons). For report ID 2, there +is a mismatch between Logical Minimum and Usage Minimum in the array that +reports keycodes. + +The offending portion of the descriptor: (from hid-decode) + +0x95, 0x05, // Report Count (5) 30 +0x75, 0x08, // Report Size (8) 32 +0x15, 0x00, // Logical Minimum (0) 34 +0x25, 0x65, // Logical Maximum (101) 36 +0x05, 0x07, // Usage Page (Keyboard) 38 +0x19, 0x01, // Usage Minimum (1) 40 +0x29, 0x65, // Usage Maximum (101) 42 +0x81, 0x00, // Input (Data,Arr,Abs) 44 + +This bug shifts all programmed keycodes up by 1. Importantly, this causes +"empty" array indexes of 0x00 to be interpreted as 0x01, ErrorRollOver. +The presence of ErrorRollOver causes the system to ignore all keypresses +from the endpoint and breaks the ability to use the programmable buttons. + +Setting byte 41 to 0x00 fixes this, and causes keycodes to be interpreted +correctly. + +Also, USB_VENDOR_ID_GLORIOUS is changed to USB_VENDOR_ID_SINOWEALTH, +and a new ID for Laview Technology is added. Glorious seems to be +white-labeling controller boards or mice from these vendors. There isn't a +single canonical vendor ID for Glorious products. + +Signed-off-by: Brett Raye +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-glorious.c | 16 ++++++++++++++-- + drivers/hid/hid-ids.h | 11 +++++++---- + 2 files changed, 21 insertions(+), 6 deletions(-) + +diff --git a/drivers/hid/hid-glorious.c b/drivers/hid/hid-glorious.c +index 558eb08c19ef9..281b3a7187cec 100644 +--- a/drivers/hid/hid-glorious.c ++++ b/drivers/hid/hid-glorious.c +@@ -21,6 +21,10 @@ MODULE_DESCRIPTION("HID driver for Glorious PC Gaming Race mice"); + * Glorious Model O and O- specify the const flag in the consumer input + * report descriptor, which leads to inputs being ignored. Fix this + * by patching the descriptor. ++ * ++ * Glorious Model I incorrectly specifes the Usage Minimum for its ++ * keyboard HID report, causing keycodes to be misinterpreted. ++ * Fix this by setting Usage Minimum to 0 in that report. + */ + static __u8 *glorious_report_fixup(struct hid_device *hdev, __u8 *rdesc, + unsigned int *rsize) +@@ -32,6 +36,10 @@ static __u8 *glorious_report_fixup(struct hid_device *hdev, __u8 *rdesc, + rdesc[85] = rdesc[113] = rdesc[141] = \ + HID_MAIN_ITEM_VARIABLE | HID_MAIN_ITEM_RELATIVE; + } ++ if (*rsize == 156 && rdesc[41] == 1) { ++ hid_info(hdev, "patching Glorious Model I keyboard report descriptor\n"); ++ rdesc[41] = 0; ++ } + return rdesc; + } + +@@ -44,6 +52,8 @@ static void glorious_update_name(struct hid_device *hdev) + model = "Model O"; break; + case USB_DEVICE_ID_GLORIOUS_MODEL_D: + model = "Model D"; break; ++ case USB_DEVICE_ID_GLORIOUS_MODEL_I: ++ model = "Model I"; break; + } + + snprintf(hdev->name, sizeof(hdev->name), "%s %s", "Glorious", model); +@@ -66,10 +76,12 @@ static int glorious_probe(struct hid_device *hdev, + } + + static const struct hid_device_id glorious_devices[] = { +- { HID_USB_DEVICE(USB_VENDOR_ID_GLORIOUS, ++ { HID_USB_DEVICE(USB_VENDOR_ID_SINOWEALTH, + USB_DEVICE_ID_GLORIOUS_MODEL_O) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_GLORIOUS, ++ { HID_USB_DEVICE(USB_VENDOR_ID_SINOWEALTH, + USB_DEVICE_ID_GLORIOUS_MODEL_D) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_LAVIEW, ++ USB_DEVICE_ID_GLORIOUS_MODEL_I) }, + { } + }; + MODULE_DEVICE_TABLE(hid, glorious_devices); +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index caca5d6e95d64..06c53c817a02c 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -482,10 +482,6 @@ + #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_010A 0x010a + #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_E100 0xe100 + +-#define USB_VENDOR_ID_GLORIOUS 0x258a +-#define USB_DEVICE_ID_GLORIOUS_MODEL_D 0x0033 +-#define USB_DEVICE_ID_GLORIOUS_MODEL_O 0x0036 +- + #define I2C_VENDOR_ID_GOODIX 0x27c6 + #define I2C_DEVICE_ID_GOODIX_01F0 0x01f0 + +@@ -708,6 +704,9 @@ + #define USB_VENDOR_ID_LABTEC 0x1020 + #define USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD 0x0006 + ++#define USB_VENDOR_ID_LAVIEW 0x22D4 ++#define USB_DEVICE_ID_GLORIOUS_MODEL_I 0x1503 ++ + #define USB_VENDOR_ID_LCPOWER 0x1241 + #define USB_DEVICE_ID_LCPOWER_LC1000 0xf767 + +@@ -1094,6 +1093,10 @@ + #define USB_VENDOR_ID_SIGMATEL 0x066F + #define USB_DEVICE_ID_SIGMATEL_STMP3780 0x3780 + ++#define USB_VENDOR_ID_SINOWEALTH 0x258a ++#define USB_DEVICE_ID_GLORIOUS_MODEL_D 0x0033 ++#define USB_DEVICE_ID_GLORIOUS_MODEL_O 0x0036 ++ + #define USB_VENDOR_ID_SIS_TOUCH 0x0457 + #define USB_DEVICE_ID_SIS9200_TOUCH 0x9200 + #define USB_DEVICE_ID_SIS817_TOUCH 0x0817 +-- +2.43.0 + diff --git a/queue-5.15/hid-hid-asus-add-const-to-read-only-outgoing-usb-buf.patch b/queue-5.15/hid-hid-asus-add-const-to-read-only-outgoing-usb-buf.patch new file mode 100644 index 00000000000..69a7a3e337c --- /dev/null +++ b/queue-5.15/hid-hid-asus-add-const-to-read-only-outgoing-usb-buf.patch @@ -0,0 +1,65 @@ +From f0e8cfb9ce947b37ea416abf5f13f9ef18e80680 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 14:15:55 +1300 +Subject: HID: hid-asus: add const to read-only outgoing usb buffer + +From: Denis Benato + +[ Upstream commit 06ae5afce8cc1f7621cc5c7751e449ce20d68af7 ] + +In the function asus_kbd_set_report the parameter buf is read-only +as it gets copied in a memory portion suitable for USB transfer, +but the parameter is not marked as const: add the missing const and mark +const immutable buffers passed to that function. + +Signed-off-by: Denis Benato +Signed-off-by: Luke D. Jones +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-asus.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c +index 8c16995105043..493814f7f09cf 100644 +--- a/drivers/hid/hid-asus.c ++++ b/drivers/hid/hid-asus.c +@@ -382,7 +382,7 @@ static int asus_raw_event(struct hid_device *hdev, + return 0; + } + +-static int asus_kbd_set_report(struct hid_device *hdev, u8 *buf, size_t buf_size) ++static int asus_kbd_set_report(struct hid_device *hdev, const u8 *buf, size_t buf_size) + { + unsigned char *dmabuf; + int ret; +@@ -405,7 +405,7 @@ static int asus_kbd_set_report(struct hid_device *hdev, u8 *buf, size_t buf_size + + static int asus_kbd_init(struct hid_device *hdev) + { +- u8 buf[] = { FEATURE_KBD_REPORT_ID, 0x41, 0x53, 0x55, 0x53, 0x20, 0x54, ++ const u8 buf[] = { FEATURE_KBD_REPORT_ID, 0x41, 0x53, 0x55, 0x53, 0x20, 0x54, + 0x65, 0x63, 0x68, 0x2e, 0x49, 0x6e, 0x63, 0x2e, 0x00 }; + int ret; + +@@ -419,7 +419,7 @@ static int asus_kbd_init(struct hid_device *hdev) + static int asus_kbd_get_functions(struct hid_device *hdev, + unsigned char *kbd_func) + { +- u8 buf[] = { FEATURE_KBD_REPORT_ID, 0x05, 0x20, 0x31, 0x00, 0x08 }; ++ const u8 buf[] = { FEATURE_KBD_REPORT_ID, 0x05, 0x20, 0x31, 0x00, 0x08 }; + u8 *readbuf; + int ret; + +@@ -450,7 +450,7 @@ static int asus_kbd_get_functions(struct hid_device *hdev, + + static int rog_nkey_led_init(struct hid_device *hdev) + { +- u8 buf_init_start[] = { FEATURE_KBD_LED_REPORT_ID1, 0xB9 }; ++ const u8 buf_init_start[] = { FEATURE_KBD_LED_REPORT_ID1, 0xB9 }; + u8 buf_init2[] = { FEATURE_KBD_LED_REPORT_ID1, 0x41, 0x53, 0x55, 0x53, 0x20, + 0x54, 0x65, 0x63, 0x68, 0x2e, 0x49, 0x6e, 0x63, 0x2e, 0x00 }; + u8 buf_init3[] = { FEATURE_KBD_LED_REPORT_ID1, +-- +2.43.0 + diff --git a/queue-5.15/hid-hid-asus-reset-the-backlight-brightness-level-on.patch b/queue-5.15/hid-hid-asus-reset-the-backlight-brightness-level-on.patch new file mode 100644 index 00000000000..48c5ac24529 --- /dev/null +++ b/queue-5.15/hid-hid-asus-reset-the-backlight-brightness-level-on.patch @@ -0,0 +1,67 @@ +From 92338b00d3ffa4d205a6fcc2fc4d1b9e3f2bad11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 14:15:56 +1300 +Subject: HID: hid-asus: reset the backlight brightness level on resume + +From: Denis Benato + +[ Upstream commit 546edbd26cff7ae990e480a59150e801a06f77b1 ] + +Some devices managed by this driver automatically set brightness to 0 +before entering a suspended state and reset it back to a default +brightness level after the resume: +this has the effect of having the kernel report wrong brightness +status after a sleep, and on some devices (like the Asus RC71L) that +brightness is the intensity of LEDs directly facing the user. + +Fix the above issue by setting back brightness to the level it had +before entering a sleep state. + +Signed-off-by: Denis Benato +Signed-off-by: Luke D. Jones +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-asus.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c +index 16832e79f6a87..8c16995105043 100644 +--- a/drivers/hid/hid-asus.c ++++ b/drivers/hid/hid-asus.c +@@ -1014,6 +1014,24 @@ static int asus_start_multitouch(struct hid_device *hdev) + return 0; + } + ++static int __maybe_unused asus_resume(struct hid_device *hdev) { ++ struct asus_drvdata *drvdata = hid_get_drvdata(hdev); ++ int ret = 0; ++ ++ if (drvdata->kbd_backlight) { ++ const u8 buf[] = { FEATURE_KBD_REPORT_ID, 0xba, 0xc5, 0xc4, ++ drvdata->kbd_backlight->cdev.brightness }; ++ ret = asus_kbd_set_report(hdev, buf, sizeof(buf)); ++ if (ret < 0) { ++ hid_err(hdev, "Asus failed to set keyboard backlight: %d\n", ret); ++ goto asus_resume_err; ++ } ++ } ++ ++asus_resume_err: ++ return ret; ++} ++ + static int __maybe_unused asus_reset_resume(struct hid_device *hdev) + { + struct asus_drvdata *drvdata = hid_get_drvdata(hdev); +@@ -1305,6 +1323,7 @@ static struct hid_driver asus_driver = { + .input_configured = asus_input_configured, + #ifdef CONFIG_PM + .reset_resume = asus_reset_resume, ++ .resume = asus_resume, + #endif + .event = asus_event, + .raw_event = asus_raw_event +-- +2.43.0 + diff --git a/queue-5.15/hid-multitouch-add-quirk-for-honor-glo-gxxx-touchpad.patch b/queue-5.15/hid-multitouch-add-quirk-for-honor-glo-gxxx-touchpad.patch new file mode 100644 index 00000000000..29daa5d505b --- /dev/null +++ b/queue-5.15/hid-multitouch-add-quirk-for-honor-glo-gxxx-touchpad.patch @@ -0,0 +1,46 @@ +From be7c5ae94d6ec98037adf3810382a5d1e1be973f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Nov 2023 20:23:11 +0800 +Subject: HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad + +From: Aoba K + +[ Upstream commit 9ffccb691adb854e7b7f3ee57fbbda12ff70533f ] + +Honor MagicBook 13 2023 has a touchpad which do not switch to the multitouch +mode until the input mode feature is written by the host. The touchpad do +report the input mode at touchpad(3), while itself working under mouse mode. As +a workaround, it is possible to call MT_QUIRE_FORCE_GET_FEATURE to force set +feature in mt_set_input_mode for such device. + +The touchpad reports as BLTP7853, which cannot retrive any useful manufacture +information on the internel by this string at present. As the serial number of +the laptop is GLO-G52, while DMI info reports the laptop serial number as +GLO-GXXX, this workaround should applied to all models which has the GLO-GXXX. + +Signed-off-by: Aoba K +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-multitouch.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 4ec8ca06a0bd0..fc04538d93cbb 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -2046,6 +2046,11 @@ static const struct hid_device_id mt_devices[] = { + MT_USB_DEVICE(USB_VENDOR_ID_HANVON_ALT, + USB_DEVICE_ID_HANVON_ALT_MULTITOUCH) }, + ++ /* HONOR GLO-GXXX panel */ ++ { .driver_data = MT_CLS_VTL, ++ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, ++ 0x347d, 0x7853) }, ++ + /* Ilitek dual touch panel */ + { .driver_data = MT_CLS_NSMU, + MT_USB_DEVICE(USB_VENDOR_ID_ILITEK, +-- +2.43.0 + diff --git a/queue-5.15/net-usb-qmi_wwan-claim-interface-4-for-zte-mf290.patch b/queue-5.15/net-usb-qmi_wwan-claim-interface-4-for-zte-mf290.patch new file mode 100644 index 00000000000..5671ce565b8 --- /dev/null +++ b/queue-5.15/net-usb-qmi_wwan-claim-interface-4-for-zte-mf290.patch @@ -0,0 +1,68 @@ +From a3eda85b9563b00bd733f23245487ba32aed150b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Nov 2023 00:19:18 +0100 +Subject: net: usb: qmi_wwan: claim interface 4 for ZTE MF290 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lech Perczak + +[ Upstream commit 99360d9620f09fb8bc15548d855011bbb198c680 ] + +Interface 4 is used by for QMI interface in stock firmware of MF28D, the +router which uses MF290 modem. Rebind it to qmi_wwan after freeing it up +from option driver. +The proper configuration is: + +Interface mapping is: +0: QCDM, 1: (unknown), 2: AT (PCUI), 2: AT (Modem), 4: QMI + +T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=19d2 ProdID=0189 Rev= 0.00 +S: Manufacturer=ZTE, Incorporated +S: Product=ZTE LTE Technologies MSM +C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=84(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms + +Cc: Bjørn Mork +Signed-off-by: Lech Perczak +Link: https://lore.kernel.org/r/20231117231918.100278-3-lech.perczak@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 5c516bf4d3a5f..846ace9830d3b 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1286,6 +1286,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x19d2, 0x0168, 4)}, + {QMI_FIXED_INTF(0x19d2, 0x0176, 3)}, + {QMI_FIXED_INTF(0x19d2, 0x0178, 3)}, ++ {QMI_FIXED_INTF(0x19d2, 0x0189, 4)}, /* ZTE MF290 */ + {QMI_FIXED_INTF(0x19d2, 0x0191, 4)}, /* ZTE EuFi890 */ + {QMI_FIXED_INTF(0x19d2, 0x0199, 1)}, /* ZTE MF820S */ + {QMI_FIXED_INTF(0x19d2, 0x0200, 1)}, +-- +2.43.0 + diff --git a/queue-5.15/platform-x86-intel_telemetry-fix-kernel-doc-descript.patch b/queue-5.15/platform-x86-intel_telemetry-fix-kernel-doc-descript.patch new file mode 100644 index 00000000000..4afdff685be --- /dev/null +++ b/queue-5.15/platform-x86-intel_telemetry-fix-kernel-doc-descript.patch @@ -0,0 +1,57 @@ +From 22d092c27c73abf3fc999b24cbae589ff2c5f837 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Nov 2023 17:07:56 +0200 +Subject: platform/x86: intel_telemetry: Fix kernel doc descriptions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andy Shevchenko + +[ Upstream commit a6584711e64d9d12ab79a450ec3628fd35e4f476 ] + +LKP found issues with a kernel doc in the driver: + +core.c:116: warning: Function parameter or member 'ioss_evtconfig' not described in 'telemetry_update_events' +core.c:188: warning: Function parameter or member 'ioss_evtconfig' not described in 'telemetry_get_eventconfig' + +It looks like it were copy'n'paste typos when these descriptions +had been introduced. Fix the typos. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202310070743.WALmRGSY-lkp@intel.com/ +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20231120150756.1661425-1-andriy.shevchenko@linux.intel.com +Reviewed-by: Rajneesh Bhardwaj +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/telemetry/core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/intel/telemetry/core.c b/drivers/platform/x86/intel/telemetry/core.c +index fdf55b5d69480..e4be40f73eebf 100644 +--- a/drivers/platform/x86/intel/telemetry/core.c ++++ b/drivers/platform/x86/intel/telemetry/core.c +@@ -102,7 +102,7 @@ static const struct telemetry_core_ops telm_defpltops = { + /** + * telemetry_update_events() - Update telemetry Configuration + * @pss_evtconfig: PSS related config. No change if num_evts = 0. +- * @pss_evtconfig: IOSS related config. No change if num_evts = 0. ++ * @ioss_evtconfig: IOSS related config. No change if num_evts = 0. + * + * This API updates the IOSS & PSS Telemetry configuration. Old config + * is overwritten. Call telemetry_reset_events when logging is over +@@ -176,7 +176,7 @@ EXPORT_SYMBOL_GPL(telemetry_reset_events); + /** + * telemetry_get_eventconfig() - Returns the pss and ioss events enabled + * @pss_evtconfig: Pointer to PSS related configuration. +- * @pss_evtconfig: Pointer to IOSS related configuration. ++ * @ioss_evtconfig: Pointer to IOSS related configuration. + * @pss_len: Number of u32 elements allocated for pss_evtconfig array + * @ioss_len: Number of u32 elements allocated for ioss_evtconfig array + * +-- +2.43.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 92d0bf79a4e..0fe4b2adf9a 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -44,3 +44,20 @@ net-stmmac-use-dev_err_probe-for-reporting-mdio-bus-.patch net-stmmac-handle-disabled-mdio-busses-from-devicetr.patch appletalk-fix-use-after-free-in-atalk_ioctl.patch net-atlantic-fix-double-free-in-ring-reinit-logic.patch +drm-mediatek-add-spinlock-for-setting-vblank-event-i.patch +usb-aqc111-check-packet-for-fixup-for-true-limit.patch +stmmac-dwmac-loongson-add-architecture-dependency.patch +blk-throttle-fix-lockdep-warning-of-cgroup_mutex-or-.patch +blk-cgroup-bypass-blkcg_deactivate_policy-after-dest.patch +bcache-avoid-oversize-memory-allocation-by-small-str.patch +bcache-remove-redundant-assignment-to-variable-cur_i.patch +bcache-add-code-comments-for-bch_btree_node_get-and-.patch +bcache-avoid-null-checking-to-c-root-in-run_cache_se.patch +platform-x86-intel_telemetry-fix-kernel-doc-descript.patch +hid-glorious-fix-glorious-model-i-hid-report.patch +hid-add-always_poll-quirk-for-apple-kb.patch +hid-hid-asus-reset-the-backlight-brightness-level-on.patch +hid-multitouch-add-quirk-for-honor-glo-gxxx-touchpad.patch +asm-generic-qspinlock-fix-queued_spin_value_unlocked.patch +net-usb-qmi_wwan-claim-interface-4-for-zte-mf290.patch +hid-hid-asus-add-const-to-read-only-outgoing-usb-buf.patch diff --git a/queue-5.15/stmmac-dwmac-loongson-add-architecture-dependency.patch b/queue-5.15/stmmac-dwmac-loongson-add-architecture-dependency.patch new file mode 100644 index 00000000000..df8575bb400 --- /dev/null +++ b/queue-5.15/stmmac-dwmac-loongson-add-architecture-dependency.patch @@ -0,0 +1,39 @@ +From 28b823113c2d230cf950d8db1d7be66aa0e48e57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Nov 2023 11:53:31 +0100 +Subject: stmmac: dwmac-loongson: Add architecture dependency + +From: Jean Delvare + +[ Upstream commit 7fbd5fc2b35a8f559a6b380dfa9bcd964a758186 ] + +Only present the DWMAC_LOONGSON option on architectures where it can +actually be used. + +This follows the same logic as the DWMAC_INTEL option. + +Signed-off-by: Jean Delvare +Cc: Keguang Zhang +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/Kconfig b/drivers/net/ethernet/stmicro/stmmac/Kconfig +index 929cfc22cd0cf..d19844be9fe50 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig ++++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig +@@ -253,7 +253,7 @@ config DWMAC_INTEL + config DWMAC_LOONGSON + tristate "Loongson PCI DWMAC support" + default MACH_LOONGSON64 +- depends on STMMAC_ETH && PCI ++ depends on (MACH_LOONGSON64 || COMPILE_TEST) && STMMAC_ETH && PCI + depends on COMMON_CLK + help + This selects the LOONGSON PCI bus support for the stmmac driver, +-- +2.43.0 + diff --git a/queue-5.15/usb-aqc111-check-packet-for-fixup-for-true-limit.patch b/queue-5.15/usb-aqc111-check-packet-for-fixup-for-true-limit.patch new file mode 100644 index 00000000000..d9a4b7b10ee --- /dev/null +++ b/queue-5.15/usb-aqc111-check-packet-for-fixup-for-true-limit.patch @@ -0,0 +1,58 @@ +From a1a0e277ef640841528441d19158acc79dce1b47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Nov 2023 11:08:57 +0100 +Subject: usb: aqc111: check packet for fixup for true limit + +From: Oliver Neukum + +[ Upstream commit ccab434e674ca95d483788b1895a70c21b7f016a ] + +If a device sends a packet that is inbetween 0 +and sizeof(u64) the value passed to skb_trim() +as length will wrap around ending up as some very +large value. + +The driver will then proceed to parse the header +located at that position, which will either oops or +process some random value. + +The fix is to check against sizeof(u64) rather than +0, which the driver currently does. The issue exists +since the introduction of the driver. + +Signed-off-by: Oliver Neukum +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/aqc111.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/usb/aqc111.c b/drivers/net/usb/aqc111.c +index e8d49886d6953..bc5e3f45c499e 100644 +--- a/drivers/net/usb/aqc111.c ++++ b/drivers/net/usb/aqc111.c +@@ -1079,17 +1079,17 @@ static int aqc111_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + u16 pkt_count = 0; + u64 desc_hdr = 0; + u16 vlan_tag = 0; +- u32 skb_len = 0; ++ u32 skb_len; + + if (!skb) + goto err; + +- if (skb->len == 0) ++ skb_len = skb->len; ++ if (skb_len < sizeof(desc_hdr)) + goto err; + +- skb_len = skb->len; + /* RX Descriptor Header */ +- skb_trim(skb, skb->len - sizeof(desc_hdr)); ++ skb_trim(skb, skb_len - sizeof(desc_hdr)); + desc_hdr = le64_to_cpup((u64 *)skb_tail_pointer(skb)); + + /* Check these packets */ +-- +2.43.0 + -- 2.47.3