--- /dev/null
+From 640bf95b2c7c2981fb471acdafbd3e0458f8390d Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Sat, 20 May 2023 11:48:55 +0200
+Subject: 3c589_cs: Fix an error handling path in tc589_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+commit 640bf95b2c7c2981fb471acdafbd3e0458f8390d upstream.
+
+Should tc589_config() fail, some resources need to be released as already
+done in the remove function.
+
+Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/r/d8593ae867b24c79063646e36f9b18b0790107cb.1684575975.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/3com/3c589_cs.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/3com/3c589_cs.c
++++ b/drivers/net/ethernet/3com/3c589_cs.c
+@@ -195,6 +195,7 @@ static int tc589_probe(struct pcmcia_dev
+ {
+ struct el3_private *lp;
+ struct net_device *dev;
++ int ret;
+
+ dev_dbg(&link->dev, "3c589_attach()\n");
+
+@@ -218,7 +219,15 @@ static int tc589_probe(struct pcmcia_dev
+
+ dev->ethtool_ops = &netdev_ethtool_ops;
+
+- return tc589_config(link);
++ ret = tc589_config(link);
++ if (ret)
++ goto err_free_netdev;
++
++ return 0;
++
++err_free_netdev:
++ free_netdev(dev);
++ return ret;
+ }
+
+ static void tc589_detach(struct pcmcia_device *link)
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
- arch/arm64/boot/dts/freescale/imx8mn-var-som.dtsi | 8 +++++++-
+ arch/arm64/boot/dts/freescale/imx8mn-var-som.dtsi | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
-diff --git a/arch/arm64/boot/dts/freescale/imx8mn-var-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mn-var-som.dtsi
-index 67072e6c77d5..cbd9d124c80d 100644
--- a/arch/arm64/boot/dts/freescale/imx8mn-var-som.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mn-var-som.dtsi
-@@ -98,11 +98,17 @@ mdio {
+@@ -98,11 +98,17 @@
#address-cells = <1>;
#size-cells = <0>;
};
};
};
---
-2.40.1
-
--- /dev/null
+From 111a833dc5cbef3d05b2a796a7e23cb7f6ff2192 Mon Sep 17 00:00:00 2001
+From: Sudeep Holla <sudeep.holla@arm.com>
+Date: Wed, 3 May 2023 14:12:52 +0100
+Subject: firmware: arm_ffa: Set reserved/MBZ fields to zero in the memory descriptors
+
+From: Sudeep Holla <sudeep.holla@arm.com>
+
+commit 111a833dc5cbef3d05b2a796a7e23cb7f6ff2192 upstream.
+
+The transmit buffers allocated by the driver can be used to transmit data
+by any messages/commands needing the buffer. However, it is not guaranteed
+to have been zero-ed before every new transmission and hence it will just
+contain residual value from the previous transmission. There are several
+reserved fields in the memory descriptors that must be zero(MBZ). The
+receiver can reject the transmission if any such MBZ fields are non-zero.
+
+While we can set the whole page to zero, it is not optimal as most of the
+fields get initialised to the value required for the current transmission.
+
+So, just set the reserved/MBZ fields to zero in the memory descriptors
+explicitly to honour the requirement and keep the receiver happy.
+
+Fixes: cc2195fe536c ("firmware: arm_ffa: Add support for MEM_* interfaces")
+Reported-by: Marc Bonnici <marc.bonnici@arm.com>
+Link: https://lore.kernel.org/r/20230503131252.12585-1-sudeep.holla@arm.com
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/firmware/arm_ffa/driver.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/firmware/arm_ffa/driver.c
++++ b/drivers/firmware/arm_ffa/driver.c
+@@ -501,12 +501,17 @@ ffa_setup_and_transmit(u32 func_id, void
+ ep_mem_access->receiver = args->attrs[idx].receiver;
+ ep_mem_access->attrs = args->attrs[idx].attrs;
+ ep_mem_access->composite_off = COMPOSITE_OFFSET(args->nattrs);
++ ep_mem_access->flag = 0;
++ ep_mem_access->reserved = 0;
+ }
++ mem_region->reserved_0 = 0;
++ mem_region->reserved_1 = 0;
+ mem_region->ep_count = args->nattrs;
+
+ composite = buffer + COMPOSITE_OFFSET(args->nattrs);
+ composite->total_pg_cnt = ffa_get_num_pages_sg(args->sg);
+ composite->addr_range_cnt = num_entries;
++ composite->reserved = 0;
+
+ length = COMPOSITE_CONSTITUENTS_OFFSET(args->nattrs, num_entries);
+ frag_len = COMPOSITE_CONSTITUENTS_OFFSET(args->nattrs, 0);
+@@ -541,6 +546,7 @@ ffa_setup_and_transmit(u32 func_id, void
+
+ constituents->address = sg_phys(args->sg);
+ constituents->pg_cnt = args->sg->length / FFA_PAGE_SIZE;
++ constituents->reserved = 0;
+ constituents++;
+ frag_len += sizeof(struct ffa_mem_region_addr_range);
+ } while ((args->sg = sg_next(args->sg)));
--- /dev/null
+From 57fb54ab9f6945e204740b696bd4cee61ee04e5e Mon Sep 17 00:00:00 2001
+From: David Epping <david.epping@missinglinkelectronics.com>
+Date: Tue, 23 May 2023 17:31:05 +0200
+Subject: net: phy: mscc: add VSC8502 to MODULE_DEVICE_TABLE
+
+From: David Epping <david.epping@missinglinkelectronics.com>
+
+commit 57fb54ab9f6945e204740b696bd4cee61ee04e5e upstream.
+
+The mscc driver implements support for VSC8502, so its ID should be in
+the MODULE_DEVICE_TABLE for automatic loading.
+
+Signed-off-by: David Epping <david.epping@missinglinkelectronics.com>
+Fixes: d3169863310d ("net: phy: mscc: add support for VSC8502")
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/mscc/mscc_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/phy/mscc/mscc_main.c
++++ b/drivers/net/phy/mscc/mscc_main.c
+@@ -2664,6 +2664,7 @@ static struct phy_driver vsc85xx_driver[
+ module_phy_driver(vsc85xx_driver);
+
+ static struct mdio_device_id __maybe_unused vsc85xx_tbl[] = {
++ { PHY_ID_VSC8502, 0xfffffff0, },
+ { PHY_ID_VSC8504, 0xfffffff0, },
+ { PHY_ID_VSC8514, 0xfffffff0, },
+ { PHY_ID_VSC8530, 0xfffffff0, },
--- /dev/null
+From 35112271672ae98f45df7875244a4e33aa215e31 Mon Sep 17 00:00:00 2001
+From: Wen Gu <guwen@linux.alibaba.com>
+Date: Thu, 18 May 2023 13:14:55 +0800
+Subject: net/smc: Reset connection when trying to use SMCRv2 fails.
+
+From: Wen Gu <guwen@linux.alibaba.com>
+
+commit 35112271672ae98f45df7875244a4e33aa215e31 upstream.
+
+We found a crash when using SMCRv2 with 2 Mellanox ConnectX-4. It
+can be reproduced by:
+
+- smc_run nginx
+- smc_run wrk -t 32 -c 500 -d 30 http://<ip>:<port>
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000014
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+ PGD 8000000108713067 P4D 8000000108713067 PUD 151127067 PMD 0
+ Oops: 0000 [#1] PREEMPT SMP PTI
+ CPU: 4 PID: 2441 Comm: kworker/4:249 Kdump: loaded Tainted: G W E 6.4.0-rc1+ #42
+ Workqueue: smc_hs_wq smc_listen_work [smc]
+ RIP: 0010:smc_clc_send_confirm_accept+0x284/0x580 [smc]
+ RSP: 0018:ffffb8294b2d7c78 EFLAGS: 00010a06
+ RAX: ffff8f1873238880 RBX: ffffb8294b2d7dc8 RCX: 0000000000000000
+ RDX: 00000000000000b4 RSI: 0000000000000001 RDI: 0000000000b40c00
+ RBP: ffffb8294b2d7db8 R08: ffff8f1815c5860c R09: 0000000000000000
+ R10: 0000000000000400 R11: 0000000000000000 R12: ffff8f1846f56180
+ R13: ffff8f1815c5860c R14: 0000000000000001 R15: 0000000000000001
+ FS: 0000000000000000(0000) GS:ffff8f1aefd00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000000000014 CR3: 00000001027a0001 CR4: 00000000003706e0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ Call Trace:
+ <TASK>
+ ? mlx5_ib_map_mr_sg+0xa1/0xd0 [mlx5_ib]
+ ? smcr_buf_map_link+0x24b/0x290 [smc]
+ ? __smc_buf_create+0x4ee/0x9b0 [smc]
+ smc_clc_send_accept+0x4c/0xb0 [smc]
+ smc_listen_work+0x346/0x650 [smc]
+ ? __schedule+0x279/0x820
+ process_one_work+0x1e5/0x3f0
+ worker_thread+0x4d/0x2f0
+ ? __pfx_worker_thread+0x10/0x10
+ kthread+0xe5/0x120
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork+0x2c/0x50
+ </TASK>
+
+During the CLC handshake, server sequentially tries available SMCRv2
+and SMCRv1 devices in smc_listen_work().
+
+If an SMCRv2 device is found. SMCv2 based link group and link will be
+assigned to the connection. Then assumed that some buffer assignment
+errors happen later in the CLC handshake, such as RMB registration
+failure, server will give up SMCRv2 and try SMCRv1 device instead. But
+the resources assigned to the connection won't be reset.
+
+When server tries SMCRv1 device, the connection creation process will
+be executed again. Since conn->lnk has been assigned when trying SMCRv2,
+it will not be set to the correct SMCRv1 link in
+smcr_lgr_conn_assign_link(). So in such situation, conn->lgr points to
+correct SMCRv1 link group but conn->lnk points to the SMCRv2 link
+mistakenly.
+
+Then in smc_clc_send_confirm_accept(), conn->rmb_desc->mr[link->link_idx]
+will be accessed. Since the link->link_idx is not correct, the related
+MR may not have been initialized, so crash happens.
+
+ | Try SMCRv2 device first
+ | |-> conn->lgr: assign existed SMCRv2 link group;
+ | |-> conn->link: assign existed SMCRv2 link (link_idx may be 1 in SMC_LGR_SYMMETRIC);
+ | |-> sndbuf & RMB creation fails, quit;
+ |
+ | Try SMCRv1 device then
+ | |-> conn->lgr: create SMCRv1 link group and assign;
+ | |-> conn->link: keep SMCRv2 link mistakenly;
+ | |-> sndbuf & RMB creation succeed, only RMB->mr[link_idx = 0]
+ | initialized.
+ |
+ | Then smc_clc_send_confirm_accept() accesses
+ | conn->rmb_desc->mr[conn->link->link_idx, which is 1], then crash.
+ v
+
+This patch tries to fix this by cleaning conn->lnk before assigning
+link. In addition, it is better to reset the connection and clean the
+resources assigned if trying SMCRv2 failed in buffer creation or
+registration.
+
+Fixes: e49300a6bf62 ("net/smc: add listen processing for SMC-Rv2")
+Link: https://lore.kernel.org/r/20220523055056.2078994-1-liuyacan@corp.netease.com/
+Signed-off-by: Wen Gu <guwen@linux.alibaba.com>
+Reviewed-by: Tony Lu <tonylu@linux.alibaba.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/smc/af_smc.c | 9 +++++++--
+ net/smc/smc_core.c | 1 +
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -1987,8 +1987,10 @@ static int smc_listen_rdma_init(struct s
+ return rc;
+
+ /* create send buffer and rmb */
+- if (smc_buf_create(new_smc, false))
++ if (smc_buf_create(new_smc, false)) {
++ smc_conn_abort(new_smc, ini->first_contact_local);
+ return SMC_CLC_DECL_MEM;
++ }
+
+ return 0;
+ }
+@@ -2204,8 +2206,11 @@ static void smc_find_rdma_v2_device_serv
+ smcr_version = ini->smcr_version;
+ ini->smcr_version = SMC_V2;
+ rc = smc_listen_rdma_init(new_smc, ini);
+- if (!rc)
++ if (!rc) {
+ rc = smc_listen_rdma_reg(new_smc, ini->first_contact_local);
++ if (rc)
++ smc_conn_abort(new_smc, ini->first_contact_local);
++ }
+ if (!rc)
+ return;
+ ini->smcr_version = smcr_version;
+--- a/net/smc/smc_core.c
++++ b/net/smc/smc_core.c
+@@ -127,6 +127,7 @@ static int smcr_lgr_conn_assign_link(str
+ int i, j;
+
+ /* do link balancing */
++ conn->lnk = NULL; /* reset conn->lnk first */
+ for (i = 0; i < SMC_LINKS_PER_LGR_MAX; i++) {
+ struct smc_link *lnk = &conn->lgr->lnk[i];
+
--- /dev/null
+From a511637502b1caa135046d0f8fdabd55a31af8ef Mon Sep 17 00:00:00 2001
+From: Sen Chu <sen.chu@mediatek.com>
+Date: Thu, 18 May 2023 12:06:46 +0800
+Subject: regulator: mt6359: add read check for PMIC MT6359
+
+From: Sen Chu <sen.chu@mediatek.com>
+
+commit a511637502b1caa135046d0f8fdabd55a31af8ef upstream.
+
+Add hardware version read check for PMIC MT6359
+
+Signed-off-by: Sen Chu <sen.chu@mediatek.com
+Fixes: 4cfc96547512 ("regulator: mt6359: Add support for MT6359P regulator")
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com
+Link: https://lore.kernel.org/r/20230518040646.8730-1-sen.chu@mediatek.com
+Signed-off-by: Mark Brown <broonie@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/regulator/mt6359-regulator.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/regulator/mt6359-regulator.c
++++ b/drivers/regulator/mt6359-regulator.c
+@@ -951,9 +951,12 @@ static int mt6359_regulator_probe(struct
+ struct regulator_config config = {};
+ struct regulator_dev *rdev;
+ struct mt6359_regulator_info *mt6359_info;
+- int i, hw_ver;
++ int i, hw_ver, ret;
++
++ ret = regmap_read(mt6397->regmap, MT6359P_HWCID, &hw_ver);
++ if (ret)
++ return ret;
+
+- regmap_read(mt6397->regmap, MT6359P_HWCID, &hw_ver);
+ if (hw_ver >= MT6359P_CHIP_VER)
+ mt6359_info = mt6359p_regulators;
+ else
net-mlx5-devcom-fix-error-flow-in-mlx5_devcom_register_device.patch
net-mlx5-devcom-serialize-devcom-registration.patch
arm64-dts-imx8mn-var-som-fix-phy-detection-bug-by-adding-deassert-delay.patch
+firmware-arm_ffa-set-reserved-mbz-fields-to-zero-in-the-memory-descriptors.patch
+regulator-mt6359-add-read-check-for-pmic-mt6359.patch
+net-smc-reset-connection-when-trying-to-use-smcrv2-fails.patch
+3c589_cs-fix-an-error-handling-path-in-tc589_probe.patch
+net-phy-mscc-add-vsc8502-to-module_device_table.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
