From: Sasha Levin Date: Tue, 28 Mar 2023 10:06:56 +0000 (-0400) Subject: Fixes for 6.1 X-Git-Tag: v5.15.105~48 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=293e8033e127c25a74c680d61505f9f19b917ccf;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.1 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/acpi-x86-drop-quirk-for-hp-elitebook.patch b/queue-6.1/acpi-x86-drop-quirk-for-hp-elitebook.patch new file mode 100644 index 00000000000..9b579b96ed3 --- /dev/null +++ b/queue-6.1/acpi-x86-drop-quirk-for-hp-elitebook.patch @@ -0,0 +1,74 @@ +From 704ef9379cc6bed35956925879b7b498e825acfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Feb 2023 14:26:22 -0600 +Subject: ACPI: x86: Drop quirk for HP Elitebook + +From: Mario Limonciello + +[ Upstream commit e32d546c483a2a0f607687f5b521c2a2f942ffbe ] + +There was a quirk in `acpi/x86/s2idle.c` for an HP Elitebook G9 +platforms to force AMD GUID codepath instead of Microsoft codepath. + +This was due to a bug with WCN6855 WLAN firmware interaction with +the system. + +This bug is fixed by WCN6855 firmware: +WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 + +Remove the quirk as it's no longer necessary with this firmware. + +Link: https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=c7a57ef688f7d99d8338a5d8edddc8836ff0e6de +Tested-by: Anson Tsao +Signed-off-by: Mario Limonciello +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/x86/s2idle.c | 24 ------------------------ + 1 file changed, 24 deletions(-) + +diff --git a/drivers/acpi/x86/s2idle.c b/drivers/acpi/x86/s2idle.c +index c7afce465a071..e499c60c45791 100644 +--- a/drivers/acpi/x86/s2idle.c ++++ b/drivers/acpi/x86/s2idle.c +@@ -384,29 +384,6 @@ static const struct acpi_device_id amd_hid_ids[] = { + {} + }; + +-static int lps0_prefer_amd(const struct dmi_system_id *id) +-{ +- pr_debug("Using AMD GUID w/ _REV 2.\n"); +- rev_id = 2; +- return 0; +-} +-static const struct dmi_system_id s2idle_dmi_table[] __initconst = { +- { +- /* +- * AMD Rembrandt based HP EliteBook 835/845/865 G9 +- * Contains specialized AML in AMD/_REV 2 path to avoid +- * triggering a bug in Qualcomm WLAN firmware. This may be +- * removed in the future if that firmware is fixed. +- */ +- .callback = lps0_prefer_amd, +- .matches = { +- DMI_MATCH(DMI_BOARD_VENDOR, "HP"), +- DMI_MATCH(DMI_BOARD_NAME, "8990"), +- }, +- }, +- {} +-}; +- + static int lps0_device_attach(struct acpi_device *adev, + const struct acpi_device_id *not_used) + { +@@ -586,7 +563,6 @@ static const struct platform_s2idle_ops acpi_s2idle_ops_lps0 = { + + void __init acpi_s2idle_setup(void) + { +- dmi_check_system(s2idle_dmi_table); + acpi_scan_add_handler(&lps0_handler); + s2idle_set_ops(&acpi_s2idle_ops_lps0); + } +-- +2.39.2 + diff --git a/queue-6.1/acpi-x86-utils-add-cezanne-to-the-list-for-forcing-s.patch b/queue-6.1/acpi-x86-utils-add-cezanne-to-the-list-for-forcing-s.patch new file mode 100644 index 00000000000..1b8d6815fa4 --- /dev/null +++ b/queue-6.1/acpi-x86-utils-add-cezanne-to-the-list-for-forcing-s.patch @@ -0,0 +1,95 @@ +From d1a0acd7c4229a1e8e9a36a5a1a29b9b698f2f34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 16:11:28 -0600 +Subject: ACPI: x86: utils: Add Cezanne to the list for forcing StorageD3Enable + +From: Mario Limonciello + +[ Upstream commit e2a56364485e7789e7b8f342637c7f3a219f7ede ] + +commit 018d6711c26e4 ("ACPI: x86: Add a quirk for Dell Inspiron 14 2-in-1 +for StorageD3Enable") introduced a quirk to allow a system with ambiguous +use of _ADR 0 to force StorageD3Enable. + +It was reported that several more Dell systems suffered the same symptoms. +As the list is continuing to grow but these are all Cezanne systems, +instead add Cezanne to the CPU list to apply the StorageD3Enable property +and remove the whole list. + +It was also reported that an HP system only has StorageD3Enable on the ACPI +device for the first NVME disk, not the second. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217003 +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216773 +Reported-by: David Alvarez Lombardi +Reported-by: dbilios@stdio.gr +Reported-and-tested-by: Elvis Angelaccio +Tested-by: victor.bonnelle@proton.me +Tested-by: hurricanepootis@protonmail.com +Signed-off-by: Mario Limonciello +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/x86/utils.c | 37 +++++++++++++------------------------ + 1 file changed, 13 insertions(+), 24 deletions(-) + +diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c +index 4e816bb402f68..e45285d4e62a4 100644 +--- a/drivers/acpi/x86/utils.c ++++ b/drivers/acpi/x86/utils.c +@@ -200,39 +200,28 @@ bool acpi_device_override_status(struct acpi_device *adev, unsigned long long *s + * a hardcoded allowlist for D3 support, which was used for these platforms. + * + * This allows quirking on Linux in a similar fashion. ++ * ++ * Cezanne systems shouldn't *normally* need this as the BIOS includes ++ * StorageD3Enable. But for two reasons we have added it. ++ * 1) The BIOS on a number of Dell systems have ambiguity ++ * between the same value used for _ADR on ACPI nodes GPP1.DEV0 and GPP1.NVME. ++ * GPP1.NVME is needed to get StorageD3Enable node set properly. ++ * https://bugzilla.kernel.org/show_bug.cgi?id=216440 ++ * https://bugzilla.kernel.org/show_bug.cgi?id=216773 ++ * https://bugzilla.kernel.org/show_bug.cgi?id=217003 ++ * 2) On at least one HP system StorageD3Enable is missing on the second NVME ++ disk in the system. + */ + static const struct x86_cpu_id storage_d3_cpu_ids[] = { + X86_MATCH_VENDOR_FAM_MODEL(AMD, 23, 96, NULL), /* Renoir */ + X86_MATCH_VENDOR_FAM_MODEL(AMD, 23, 104, NULL), /* Lucienne */ +- {} +-}; +- +-static const struct dmi_system_id force_storage_d3_dmi[] = { +- { +- /* +- * _ADR is ambiguous between GPP1.DEV0 and GPP1.NVME +- * but .NVME is needed to get StorageD3Enable node +- * https://bugzilla.kernel.org/show_bug.cgi?id=216440 +- */ +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), +- DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 14 7425 2-in-1"), +- } +- }, +- { +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), +- DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 16 5625"), +- } +- }, ++ X86_MATCH_VENDOR_FAM_MODEL(AMD, 25, 80, NULL), /* Cezanne */ + {} + }; + + bool force_storage_d3(void) + { +- const struct dmi_system_id *dmi_id = dmi_first_match(force_storage_d3_dmi); +- +- return dmi_id || x86_match_cpu(storage_d3_cpu_ids); ++ return x86_match_cpu(storage_d3_cpu_ids); + } + + /* +-- +2.39.2 + diff --git a/queue-6.1/act_mirred-use-the-backlog-for-nested-calls-to-mirre.patch b/queue-6.1/act_mirred-use-the-backlog-for-nested-calls-to-mirre.patch new file mode 100644 index 00000000000..87f7c44e7cd --- /dev/null +++ b/queue-6.1/act_mirred-use-the-backlog-for-nested-calls-to-mirre.patch @@ -0,0 +1,139 @@ +From d4b653a334929b57f050a1c5b07ef89aca430602 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Jan 2023 18:01:40 +0100 +Subject: act_mirred: use the backlog for nested calls to mirred ingress + +From: Davide Caratti + +[ Upstream commit ca22da2fbd693b54dc8e3b7b54ccc9f7e9ba3640 ] + +William reports kernel soft-lockups on some OVS topologies when TC mirred +egress->ingress action is hit by local TCP traffic [1]. +The same can also be reproduced with SCTP (thanks Xin for verifying), when +client and server reach themselves through mirred egress to ingress, and +one of the two peers sends a "heartbeat" packet (from within a timer). + +Enqueueing to backlog proved to fix this soft lockup; however, as Cong +noticed [2], we should preserve - when possible - the current mirred +behavior that counts as "overlimits" any eventual packet drop subsequent to +the mirred forwarding action [3]. A compromise solution might use the +backlog only when tcf_mirred_act() has a nest level greater than one: +change tcf_mirred_forward() accordingly. + +Also, add a kselftest that can reproduce the lockup and verifies TC mirred +ability to account for further packet drops after TC mirred egress->ingress +(when the nest level is 1). + + [1] https://lore.kernel.org/netdev/33dc43f587ec1388ba456b4915c75f02a8aae226.1663945716.git.dcaratti@redhat.com/ + [2] https://lore.kernel.org/netdev/Y0w%2FWWY60gqrtGLp@pop-os.localdomain/ + [3] such behavior is not guaranteed: for example, if RPS or skb RX + timestamping is enabled on the mirred target device, the kernel + can defer receiving the skb and return NET_RX_SUCCESS inside + tcf_mirred_forward(). + +Reported-by: William Zhao +CC: Xin Long +Signed-off-by: Davide Caratti +Reviewed-by: Marcelo Ricardo Leitner +Acked-by: Jamal Hadi Salim +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/sched/act_mirred.c | 7 +++ + .../selftests/net/forwarding/tc_actions.sh | 49 ++++++++++++++++++- + 2 files changed, 55 insertions(+), 1 deletion(-) + +diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c +index ded6ee054be14..baeae5e5c8f0c 100644 +--- a/net/sched/act_mirred.c ++++ b/net/sched/act_mirred.c +@@ -205,12 +205,19 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla, + return err; + } + ++static bool is_mirred_nested(void) ++{ ++ return unlikely(__this_cpu_read(mirred_nest_level) > 1); ++} ++ + static int tcf_mirred_forward(bool want_ingress, struct sk_buff *skb) + { + int err; + + if (!want_ingress) + err = tcf_dev_queue_xmit(skb, dev_queue_xmit); ++ else if (is_mirred_nested()) ++ err = netif_rx(skb); + else + err = netif_receive_skb(skb); + +diff --git a/tools/testing/selftests/net/forwarding/tc_actions.sh b/tools/testing/selftests/net/forwarding/tc_actions.sh +index 1e0a62f638fec..919c0dd9fe4bc 100755 +--- a/tools/testing/selftests/net/forwarding/tc_actions.sh ++++ b/tools/testing/selftests/net/forwarding/tc_actions.sh +@@ -3,7 +3,8 @@ + + ALL_TESTS="gact_drop_and_ok_test mirred_egress_redirect_test \ + mirred_egress_mirror_test matchall_mirred_egress_mirror_test \ +- gact_trap_test mirred_egress_to_ingress_test" ++ gact_trap_test mirred_egress_to_ingress_test \ ++ mirred_egress_to_ingress_tcp_test" + NUM_NETIFS=4 + source tc_common.sh + source lib.sh +@@ -198,6 +199,52 @@ mirred_egress_to_ingress_test() + log_test "mirred_egress_to_ingress ($tcflags)" + } + ++mirred_egress_to_ingress_tcp_test() ++{ ++ local tmpfile=$(mktemp) tmpfile1=$(mktemp) ++ ++ RET=0 ++ dd conv=sparse status=none if=/dev/zero bs=1M count=2 of=$tmpfile ++ tc filter add dev $h1 protocol ip pref 100 handle 100 egress flower \ ++ $tcflags ip_proto tcp src_ip 192.0.2.1 dst_ip 192.0.2.2 \ ++ action ct commit nat src addr 192.0.2.2 pipe \ ++ action ct clear pipe \ ++ action ct commit nat dst addr 192.0.2.1 pipe \ ++ action ct clear pipe \ ++ action skbedit ptype host pipe \ ++ action mirred ingress redirect dev $h1 ++ tc filter add dev $h1 protocol ip pref 101 handle 101 egress flower \ ++ $tcflags ip_proto icmp \ ++ action mirred ingress redirect dev $h1 ++ tc filter add dev $h1 protocol ip pref 102 handle 102 ingress flower \ ++ ip_proto icmp \ ++ action drop ++ ++ ip vrf exec v$h1 nc --recv-only -w10 -l -p 12345 -o $tmpfile1 & ++ local rpid=$! ++ ip vrf exec v$h1 nc -w1 --send-only 192.0.2.2 12345 <$tmpfile ++ wait -n $rpid ++ cmp -s $tmpfile $tmpfile1 ++ check_err $? "server output check failed" ++ ++ $MZ $h1 -c 10 -p 64 -a $h1mac -b $h1mac -A 192.0.2.1 -B 192.0.2.1 \ ++ -t icmp "ping,id=42,seq=5" -q ++ tc_check_packets "dev $h1 egress" 101 10 ++ check_err $? "didn't mirred redirect ICMP" ++ tc_check_packets "dev $h1 ingress" 102 10 ++ check_err $? "didn't drop mirred ICMP" ++ local overlimits=$(tc_rule_stats_get ${h1} 101 egress .overlimits) ++ test ${overlimits} = 10 ++ check_err $? "wrong overlimits, expected 10 got ${overlimits}" ++ ++ tc filter del dev $h1 egress protocol ip pref 100 handle 100 flower ++ tc filter del dev $h1 egress protocol ip pref 101 handle 101 flower ++ tc filter del dev $h1 ingress protocol ip pref 102 handle 102 flower ++ ++ rm -f $tmpfile $tmpfile1 ++ log_test "mirred_egress_to_ingress_tcp ($tcflags)" ++} ++ + setup_prepare() + { + h1=${NETIFS[p1]} +-- +2.39.2 + diff --git a/queue-6.1/asoc-amd-yc-add-dmi-entries-to-support-hp-omen-16-n0.patch b/queue-6.1/asoc-amd-yc-add-dmi-entries-to-support-hp-omen-16-n0.patch new file mode 100644 index 00000000000..1be4b65f2ec --- /dev/null +++ b/queue-6.1/asoc-amd-yc-add-dmi-entries-to-support-hp-omen-16-n0.patch @@ -0,0 +1,40 @@ +From c6ac9b87f33d17d8a79b5d3420885e0d32523fa9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 00:49:21 +0100 +Subject: ASoC: amd: yc: Add DMI entries to support HP OMEN 16-n0xxx (8A43) + +From: Duc Anh Le + +[ Upstream commit d52279d5c9204a041e9ba02a66a353573b2f96e4 ] + +This model requires an additional detection quirk to enable the internal microphone. + +Signed-off-by: Duc Anh Le +Link: https://lore.kernel.org/r/20230227234921.7784-1-lub.the.studio@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 4e681e9c08fe5..4a69ce702360c 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -262,6 +262,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "OMEN by HP Gaming Laptop 16z-n000"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "HP"), ++ DMI_MATCH(DMI_BOARD_NAME, "8A43"), ++ } ++ }, + {} + }; + +-- +2.39.2 + diff --git a/queue-6.1/asoc-amd-yp-add-omen-by-hp-gaming-laptop-16z-n000-to.patch b/queue-6.1/asoc-amd-yp-add-omen-by-hp-gaming-laptop-16z-n000-to.patch new file mode 100644 index 00000000000..d820439fa62 --- /dev/null +++ b/queue-6.1/asoc-amd-yp-add-omen-by-hp-gaming-laptop-16z-n000-to.patch @@ -0,0 +1,40 @@ +From c3be0d69cab07ed5f1988ec991ef0c9bf96cb132 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 10:50:07 -0500 +Subject: ASoC: amd: yp: Add OMEN by HP Gaming Laptop 16z-n000 to quirks + +From: Joseph Hunkeler + +[ Upstream commit 22ce6843abec19270bf69b176d7ee0a4ef781da5 ] + +Enables display microphone on the HP OMEN 16z-n000 (8A42) laptop + +Signed-off-by: Joseph Hunkeler +Link: https://lore.kernel.org/r/20230216155007.26143-1-jhunkeler@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 36314753923b8..4e681e9c08fe5 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -255,6 +255,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "15NBC1011"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "HP"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "OMEN by HP Gaming Laptop 16z-n000"), ++ } ++ }, + {} + }; + +-- +2.39.2 + diff --git a/queue-6.1/ca8210-fix-mac_len-negative-array-access.patch b/queue-6.1/ca8210-fix-mac_len-negative-array-access.patch new file mode 100644 index 00000000000..784ef669bf7 --- /dev/null +++ b/queue-6.1/ca8210-fix-mac_len-negative-array-access.patch @@ -0,0 +1,37 @@ +From 760b8c4f27dece6c778ae01ff2c3fc2e99614019 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 23:25:04 -0500 +Subject: ca8210: fix mac_len negative array access + +From: Alexander Aring + +[ Upstream commit 6c993779ea1d0cccdb3a5d7d45446dd229e610a3 ] + +This patch fixes a buffer overflow access of skb->data if +ieee802154_hdr_peek_addrs() fails. + +Reported-by: lianhui tang +Signed-off-by: Alexander Aring +Link: https://lore.kernel.org/r/20230217042504.3303396-1-aahringo@redhat.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +--- + drivers/net/ieee802154/ca8210.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c +index e1a569b99e4a6..0b0c6c0764fe9 100644 +--- a/drivers/net/ieee802154/ca8210.c ++++ b/drivers/net/ieee802154/ca8210.c +@@ -1913,6 +1913,8 @@ static int ca8210_skb_tx( + * packet + */ + mac_len = ieee802154_hdr_peek_addrs(skb, &header); ++ if (mac_len < 0) ++ return mac_len; + + secspec.security_level = header.sec.level; + secspec.key_id_mode = header.sec.key_id_mode; +-- +2.39.2 + diff --git a/queue-6.1/drm-amd-display-update-clock-table-to-include-highes.patch b/queue-6.1/drm-amd-display-update-clock-table-to-include-highes.patch new file mode 100644 index 00000000000..babe1b235a1 --- /dev/null +++ b/queue-6.1/drm-amd-display-update-clock-table-to-include-highes.patch @@ -0,0 +1,75 @@ +From c55d59c5334fee7e5a519df89c0fd5522e3d9357 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Mar 2023 14:33:33 -0500 +Subject: drm/amd/display: Update clock table to include highest clock setting + +From: Swapnil Patel + +[ Upstream commit 2d99a7ec25cf456cd3680eb314d6454138e5aa64 ] + +[Why] +Currently, the clk manager matches SocVoltage with voltage from +fused settings (dfPstate clock table). And then corresponding clocks +are selected. + +However in certain situations, this leads to clk manager not +including at least one entry with highest supported clock setting. + +[How] +Update the clk manager to include at least one entry with highest +supported clock setting. + +Reviewed-by: Pavle Kotarac +Acked-by: Qingqing Zhuo +Signed-off-by: Swapnil Patel +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../display/dc/clk_mgr/dcn301/vg_clk_mgr.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c +index 24715ca2fa944..01383aac6b419 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c +@@ -529,6 +529,19 @@ static struct clk_bw_params vg_bw_params = { + + }; + ++static uint32_t find_max_clk_value(const uint32_t clocks[], uint32_t num_clocks) ++{ ++ uint32_t max = 0; ++ int i; ++ ++ for (i = 0; i < num_clocks; ++i) { ++ if (clocks[i] > max) ++ max = clocks[i]; ++ } ++ ++ return max; ++} ++ + static unsigned int find_dcfclk_for_voltage(const struct vg_dpm_clocks *clock_table, + unsigned int voltage) + { +@@ -572,12 +585,16 @@ static void vg_clk_mgr_helper_populate_bw_params( + + bw_params->clk_table.num_entries = j + 1; + +- for (i = 0; i < bw_params->clk_table.num_entries; i++, j--) { ++ for (i = 0; i < bw_params->clk_table.num_entries - 1; i++, j--) { + bw_params->clk_table.entries[i].fclk_mhz = clock_table->DfPstateTable[j].fclk; + bw_params->clk_table.entries[i].memclk_mhz = clock_table->DfPstateTable[j].memclk; + bw_params->clk_table.entries[i].voltage = clock_table->DfPstateTable[j].voltage; + bw_params->clk_table.entries[i].dcfclk_mhz = find_dcfclk_for_voltage(clock_table, clock_table->DfPstateTable[j].voltage); + } ++ bw_params->clk_table.entries[i].fclk_mhz = clock_table->DfPstateTable[j].fclk; ++ bw_params->clk_table.entries[i].memclk_mhz = clock_table->DfPstateTable[j].memclk; ++ bw_params->clk_table.entries[i].voltage = clock_table->DfPstateTable[j].voltage; ++ bw_params->clk_table.entries[i].dcfclk_mhz = find_max_clk_value(clock_table->DcfClocks, VG_NUM_DCFCLK_DPM_LEVELS); + + bw_params->vram_type = bios_info->memory_type; + bw_params->num_channels = bios_info->ma_channel_number; +-- +2.39.2 + diff --git a/queue-6.1/drm-amd-fix-initialization-mistake-for-nbio-7.3.0.patch b/queue-6.1/drm-amd-fix-initialization-mistake-for-nbio-7.3.0.patch new file mode 100644 index 00000000000..d0fd3ebce0f --- /dev/null +++ b/queue-6.1/drm-amd-fix-initialization-mistake-for-nbio-7.3.0.patch @@ -0,0 +1,63 @@ +From 012877c55f6524ebd0d1f4c450fa50ef5920c85f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Mar 2023 09:36:06 -0600 +Subject: drm/amd: Fix initialization mistake for NBIO 7.3.0 + +From: Mario Limonciello + +[ Upstream commit 1717cc5f2962a4652c76ed3858b499ccae6c277c ] + +The same strapping initialization issue that happened on NBIO 7.5.1 +appears to be happening on NBIO 7.3.0. +Apply the same fix to 7.3.0 as well. + +Note: This workaround relies upon the integrated GPU being enabled +in BIOS. If the integrated GPU is disabled in BIOS a different +workaround will be required. + +Reported-by: Thomas Glanzmann +Cc: Basavaraj Natikar +Link: https://lore.kernel.org/linux-usb/Y%2Fz9GdHjPyF2rNG3@glanzmann.de/T/#u +Signed-off-by: Mario Limonciello +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/nbio_v7_2.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v7_2.c b/drivers/gpu/drm/amd/amdgpu/nbio_v7_2.c +index 4b0d563c6522c..4ef1fa4603c8e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_2.c ++++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_2.c +@@ -382,11 +382,6 @@ static void nbio_v7_2_init_registers(struct amdgpu_device *adev) + if (def != data) + WREG32_PCIE_PORT(SOC15_REG_OFFSET(NBIO, 0, regBIF1_PCIE_MST_CTRL_3), data); + break; +- case IP_VERSION(7, 5, 1): +- data = RREG32_SOC15(NBIO, 0, regRCC_DEV2_EPF0_STRAP2); +- data &= ~RCC_DEV2_EPF0_STRAP2__STRAP_NO_SOFT_RESET_DEV2_F0_MASK; +- WREG32_SOC15(NBIO, 0, regRCC_DEV2_EPF0_STRAP2, data); +- fallthrough; + default: + def = data = RREG32_PCIE_PORT(SOC15_REG_OFFSET(NBIO, 0, regPCIE_CONFIG_CNTL)); + data = REG_SET_FIELD(data, PCIE_CONFIG_CNTL, +@@ -399,6 +394,15 @@ static void nbio_v7_2_init_registers(struct amdgpu_device *adev) + break; + } + ++ switch (adev->ip_versions[NBIO_HWIP][0]) { ++ case IP_VERSION(7, 3, 0): ++ case IP_VERSION(7, 5, 1): ++ data = RREG32_SOC15(NBIO, 0, regRCC_DEV2_EPF0_STRAP2); ++ data &= ~RCC_DEV2_EPF0_STRAP2__STRAP_NO_SOFT_RESET_DEV2_F0_MASK; ++ WREG32_SOC15(NBIO, 0, regRCC_DEV2_EPF0_STRAP2, data); ++ break; ++ } ++ + if (amdgpu_sriov_vf(adev)) + adev->rmmio_remap.reg_offset = SOC15_REG_OFFSET(NBIO, 0, + regBIF_BX_PF0_HDP_MEM_COHERENCY_FLUSH_CNTL) << 2; +-- +2.39.2 + diff --git a/queue-6.1/drm-amdgpu-fix-call-trace-warning-and-hang-when-remo.patch b/queue-6.1/drm-amdgpu-fix-call-trace-warning-and-hang-when-remo.patch new file mode 100644 index 00000000000..e6df30f0f3e --- /dev/null +++ b/queue-6.1/drm-amdgpu-fix-call-trace-warning-and-hang-when-remo.patch @@ -0,0 +1,66 @@ +From a6b32f6400dd55cf766e4505431b69808b2da77c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Mar 2023 14:18:12 +0800 +Subject: drm/amdgpu: Fix call trace warning and hang when removing amdgpu + device +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: lyndonli + +[ Upstream commit 93bb18d2a873d2fa9625c8ea927723660a868b95 ] + +On GPUs with RAS enabled, below call trace and hang are observed when +shutting down device. + +v2: use DRM device unplugged flag instead of shutdown flag as the check to +prevent memory wipe in shutdown stage. + +[ +0.000000] RIP: 0010:amdgpu_vram_mgr_fini+0x18d/0x1c0 [amdgpu] +[ +0.000001] PKRU: 55555554 +[ +0.000001] Call Trace: +[ +0.000001] +[ +0.000002] amdgpu_ttm_fini+0x140/0x1c0 [amdgpu] +[ +0.000183] amdgpu_bo_fini+0x27/0xa0 [amdgpu] +[ +0.000184] gmc_v11_0_sw_fini+0x2b/0x40 [amdgpu] +[ +0.000163] amdgpu_device_fini_sw+0xb6/0x510 [amdgpu] +[ +0.000152] amdgpu_driver_release_kms+0x16/0x30 [amdgpu] +[ +0.000090] drm_dev_release+0x28/0x50 [drm] +[ +0.000016] devm_drm_dev_init_release+0x38/0x60 [drm] +[ +0.000011] devm_action_release+0x15/0x20 +[ +0.000003] release_nodes+0x40/0xc0 +[ +0.000001] devres_release_all+0x9e/0xe0 +[ +0.000001] device_unbind_cleanup+0x12/0x80 +[ +0.000003] device_release_driver_internal+0xff/0x160 +[ +0.000001] driver_detach+0x4a/0x90 +[ +0.000001] bus_remove_driver+0x6c/0xf0 +[ +0.000001] driver_unregister+0x31/0x50 +[ +0.000001] pci_unregister_driver+0x40/0x90 +[ +0.000003] amdgpu_exit+0x15/0x120 [amdgpu] + +Signed-off-by: lyndonli +Reviewed-by: Guchun Chen +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +index cfd78c4a45baa..4feedf518a191 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +@@ -1312,7 +1312,7 @@ void amdgpu_bo_release_notify(struct ttm_buffer_object *bo) + + if (!bo->resource || bo->resource->mem_type != TTM_PL_VRAM || + !(abo->flags & AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE) || +- adev->in_suspend || adev->shutdown) ++ adev->in_suspend || drm_dev_is_unplugged(adev_to_drm(adev))) + return; + + if (WARN_ON_ONCE(!dma_resv_trylock(bo->base.resv))) +-- +2.39.2 + diff --git a/queue-6.1/drm-cirrus-null-check-pipe-plane.state-fb-in-cirrus_.patch b/queue-6.1/drm-cirrus-null-check-pipe-plane.state-fb-in-cirrus_.patch new file mode 100644 index 00000000000..7dbfee52bd6 --- /dev/null +++ b/queue-6.1/drm-cirrus-null-check-pipe-plane.state-fb-in-cirrus_.patch @@ -0,0 +1,44 @@ +From 1ddf2479fec38bc565eef5e68f3112a3f346bc1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Feb 2023 20:15:49 +0300 +Subject: drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update() + +From: Alexandr Sapozhnikov + +[ Upstream commit 7245e629dcaaf308f1868aeffa218e9849c77893 ] + +After having been compared to NULL value at cirrus.c:455, pointer +'pipe->plane.state->fb' is passed as 1st parameter in call to function +'cirrus_fb_blit_rect' at cirrus.c:461, where it is dereferenced at +cirrus.c:316. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +v2: + * aligned commit message to line-length limits + +Signed-off-by: Alexandr Sapozhnikov +Reviewed-by: Thomas Zimmermann +Signed-off-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/20230215171549.16305-1-alsp705@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tiny/cirrus.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/tiny/cirrus.c b/drivers/gpu/drm/tiny/cirrus.c +index 354d5e854a6f0..b27e469e90217 100644 +--- a/drivers/gpu/drm/tiny/cirrus.c ++++ b/drivers/gpu/drm/tiny/cirrus.c +@@ -455,7 +455,7 @@ static void cirrus_pipe_update(struct drm_simple_display_pipe *pipe, + if (state->fb && cirrus->cpp != cirrus_cpp(state->fb)) + cirrus_mode_set(cirrus, &crtc->mode, state->fb); + +- if (drm_atomic_helper_damage_merged(old_state, state, &rect)) ++ if (state->fb && drm_atomic_helper_damage_merged(old_state, state, &rect)) + cirrus_fb_blit_rect(state->fb, &shadow_plane_state->data[0], &rect); + } + +-- +2.39.2 + diff --git a/queue-6.1/hid-cp2112-fix-driver-not-registering-gpio-irq-chip-.patch b/queue-6.1/hid-cp2112-fix-driver-not-registering-gpio-irq-chip-.patch new file mode 100644 index 00000000000..50c6481af1e --- /dev/null +++ b/queue-6.1/hid-cp2112-fix-driver-not-registering-gpio-irq-chip-.patch @@ -0,0 +1,37 @@ +From 7b31916eea05e278622e49802ddaa9a035f7d65c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Feb 2023 11:00:44 -0600 +Subject: HID: cp2112: Fix driver not registering GPIO IRQ chip as threaded + +From: Danny Kaehn + +[ Upstream commit 37f5b858a66543b2b67c0288280af623985abc29 ] + +The CP2112 generates interrupts from a polling routine on a thread, +and can only support threaded interrupts. This patch configures the +gpiochip irq chip with this flag, disallowing consumers to request +a hard IRQ from this driver, which resulted in a segfault previously. + +Signed-off-by: Danny Kaehn +Link: https://lore.kernel.org/r/20230210170044.11835-1-kaehndan@gmail.com +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-cp2112.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c +index 1e16b0fa310d1..27cadadda7c9d 100644 +--- a/drivers/hid/hid-cp2112.c ++++ b/drivers/hid/hid-cp2112.c +@@ -1354,6 +1354,7 @@ static int cp2112_probe(struct hid_device *hdev, const struct hid_device_id *id) + girq->parents = NULL; + girq->default_type = IRQ_TYPE_NONE; + girq->handler = handle_simple_irq; ++ girq->threaded = true; + + ret = gpiochip_add_data(&dev->gc, dev); + if (ret < 0) { +-- +2.39.2 + diff --git a/queue-6.1/hid-intel-ish-hid-ipc-fix-potential-use-after-free-i.patch b/queue-6.1/hid-intel-ish-hid-ipc-fix-potential-use-after-free-i.patch new file mode 100644 index 00000000000..7c6c03f7334 --- /dev/null +++ b/queue-6.1/hid-intel-ish-hid-ipc-fix-potential-use-after-free-i.patch @@ -0,0 +1,70 @@ +From f67833862dfc776df4fc61b74cdc00bfb74b358b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 13:49:38 +1100 +Subject: HID: intel-ish-hid: ipc: Fix potential use-after-free in work + function + +From: Reka Norman + +[ Upstream commit 8ae2f2b0a28416ed2f6d8478ac8b9f7862f36785 ] + +When a reset notify IPC message is received, the ISR schedules a work +function and passes the ISHTP device to it via a global pointer +ishtp_dev. If ish_probe() fails, the devm-managed device resources +including ishtp_dev are freed, but the work is not cancelled, causing a +use-after-free when the work function tries to access ishtp_dev. Use +devm_work_autocancel() instead, so that the work is automatically +cancelled if probe fails. + +Signed-off-by: Reka Norman +Acked-by: Srinivas Pandruvada +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/intel-ish-hid/ipc/ipc.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/intel-ish-hid/ipc/ipc.c b/drivers/hid/intel-ish-hid/ipc/ipc.c +index 15e14239af829..a49c6affd7c4c 100644 +--- a/drivers/hid/intel-ish-hid/ipc/ipc.c ++++ b/drivers/hid/intel-ish-hid/ipc/ipc.c +@@ -5,6 +5,7 @@ + * Copyright (c) 2014-2016, Intel Corporation. + */ + ++#include + #include + #include + #include +@@ -621,7 +622,6 @@ static void recv_ipc(struct ishtp_device *dev, uint32_t doorbell_val) + case MNG_RESET_NOTIFY: + if (!ishtp_dev) { + ishtp_dev = dev; +- INIT_WORK(&fw_reset_work, fw_reset_work_fn); + } + schedule_work(&fw_reset_work); + break; +@@ -940,6 +940,7 @@ struct ishtp_device *ish_dev_init(struct pci_dev *pdev) + { + struct ishtp_device *dev; + int i; ++ int ret; + + dev = devm_kzalloc(&pdev->dev, + sizeof(struct ishtp_device) + sizeof(struct ish_hw), +@@ -975,6 +976,12 @@ struct ishtp_device *ish_dev_init(struct pci_dev *pdev) + list_add_tail(&tx_buf->link, &dev->wr_free_list); + } + ++ ret = devm_work_autocancel(&pdev->dev, &fw_reset_work, fw_reset_work_fn); ++ if (ret) { ++ dev_err(dev->devc, "Failed to initialise FW reset work\n"); ++ return NULL; ++ } ++ + dev->ops = &ish_hw_ops; + dev->devc = &pdev->dev; + dev->mtu = IPC_PAYLOAD_SIZE - sizeof(struct ishtp_msg_hdr); +-- +2.39.2 + diff --git a/queue-6.1/hid-logitech-hidpp-add-support-for-logitech-mx-maste.patch b/queue-6.1/hid-logitech-hidpp-add-support-for-logitech-mx-maste.patch new file mode 100644 index 00000000000..e03abb0a22a --- /dev/null +++ b/queue-6.1/hid-logitech-hidpp-add-support-for-logitech-mx-maste.patch @@ -0,0 +1,38 @@ +From e94570ae45aaa51d81777bfda5019b45831b652b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Mar 2023 02:23:56 +0100 +Subject: HID: logitech-hidpp: Add support for Logitech MX Master 3S mouse +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Szalecki + +[ Upstream commit db50f7a3983f0154e730f1147ef729e0c5c2f90c ] + +Add signature for the Logitech MX Master 3S mouse over Bluetooth. + +Signed-off-by: Rafał Szalecki +Reviewed-by: Bastien Nocera +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-logitech-hidpp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index fdb66dc065822..e906ee375298a 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -4378,6 +4378,8 @@ static const struct hid_device_id hidpp_devices[] = { + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb01e) }, + { /* MX Master 3 mouse over Bluetooth */ + HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb023) }, ++ { /* MX Master 3S mouse over Bluetooth */ ++ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb034) }, + {} + }; + +-- +2.39.2 + diff --git a/queue-6.1/m68k-mm-fix-systems-with-memory-at-end-of-32-bit-add.patch b/queue-6.1/m68k-mm-fix-systems-with-memory-at-end-of-32-bit-add.patch new file mode 100644 index 00000000000..1d5ce7f1c8b --- /dev/null +++ b/queue-6.1/m68k-mm-fix-systems-with-memory-at-end-of-32-bit-add.patch @@ -0,0 +1,65 @@ +From 88a1242bac45df7e41bd42000397353bd5f44e00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Feb 2023 12:23:49 +0100 +Subject: m68k: mm: Fix systems with memory at end of 32-bit address space + +From: Kars de Jong + +[ Upstream commit 0d9fad91abfd723ea5070a46d98a9f4496c93ba9 ] + +The calculation of end addresses of memory chunks overflowed to 0 when +a memory chunk is located at the end of 32-bit address space. +This is the case for the HP300 architecture. + +Link: https://lore.kernel.org/linux-m68k/CACz-3rhUo5pgNwdWHaPWmz+30Qo9xCg70wNxdf7o5x-6tXq8QQ@mail.gmail.com/ +Signed-off-by: Kars de Jong +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230223112349.26675-1-jongk@linux-m68k.org +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/mm/motorola.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/m68k/mm/motorola.c b/arch/m68k/mm/motorola.c +index 2a375637e0077..9113012240789 100644 +--- a/arch/m68k/mm/motorola.c ++++ b/arch/m68k/mm/motorola.c +@@ -437,7 +437,7 @@ void __init paging_init(void) + } + + min_addr = m68k_memory[0].addr; +- max_addr = min_addr + m68k_memory[0].size; ++ max_addr = min_addr + m68k_memory[0].size - 1; + memblock_add_node(m68k_memory[0].addr, m68k_memory[0].size, 0, + MEMBLOCK_NONE); + for (i = 1; i < m68k_num_memory;) { +@@ -452,21 +452,21 @@ void __init paging_init(void) + } + memblock_add_node(m68k_memory[i].addr, m68k_memory[i].size, i, + MEMBLOCK_NONE); +- addr = m68k_memory[i].addr + m68k_memory[i].size; ++ addr = m68k_memory[i].addr + m68k_memory[i].size - 1; + if (addr > max_addr) + max_addr = addr; + i++; + } + m68k_memoffset = min_addr - PAGE_OFFSET; +- m68k_virt_to_node_shift = fls(max_addr - min_addr - 1) - 6; ++ m68k_virt_to_node_shift = fls(max_addr - min_addr) - 6; + + module_fixup(NULL, __start_fixup, __stop_fixup); + flush_icache(); + +- high_memory = phys_to_virt(max_addr); ++ high_memory = phys_to_virt(max_addr) + 1; + + min_low_pfn = availmem >> PAGE_SHIFT; +- max_pfn = max_low_pfn = max_addr >> PAGE_SHIFT; ++ max_pfn = max_low_pfn = (max_addr >> PAGE_SHIFT) + 1; + + /* Reserve kernel text/data/bss and the memory allocated in head.S */ + memblock_reserve(m68k_memory[0].addr, availmem - m68k_memory[0].addr); +-- +2.39.2 + diff --git a/queue-6.1/m68k-only-force-030-bus-error-if-pc-not-in-exception.patch b/queue-6.1/m68k-only-force-030-bus-error-if-pc-not-in-exception.patch new file mode 100644 index 00000000000..3b19aa781e3 --- /dev/null +++ b/queue-6.1/m68k-only-force-030-bus-error-if-pc-not-in-exception.patch @@ -0,0 +1,75 @@ +From 4f3f63b9e8086eba4861d4af44625060c2a4648f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Mar 2023 15:11:07 +1300 +Subject: m68k: Only force 030 bus error if PC not in exception table + +From: Michael Schmitz + +[ Upstream commit e36a82bebbf7da814530d5a179bef9df5934b717 ] + +__get_kernel_nofault() does copy data in supervisor mode when +forcing a task backtrace log through /proc/sysrq_trigger. +This is expected cause a bus error exception on e.g. NULL +pointer dereferencing when logging a kernel task has no +workqueue associated. This bus error ought to be ignored. + +Our 030 bus error handler is ill equipped to deal with this: + +Whenever ssw indicates a kernel mode access on a data fault, +we don't even attempt to handle the fault and instead always +send a SEGV signal (or panic). As a result, the check +for exception handling at the fault PC (buried in +send_sig_fault() which gets called from do_page_fault() +eventually) is never used. + +In contrast, both 040 and 060 access error handlers do not +care whether a fault happened on supervisor mode access, +and will call do_page_fault() on those, ultimately honoring +the exception table. + +Add a check in bus_error030 to call do_page_fault() in case +we do have an entry for the fault PC in our exception table. + +I had attempted a fix for this earlier in 2019 that did rely +on testing pagefault_disabled() (see link below) to achieve +the same thing, but this patch should be more generic. + +Tested on 030 Atari Falcon. + +Reported-by: Eero Tamminen +Link: https://lore.kernel.org/r/alpine.LNX.2.21.1904091023540.25@nippy.intranet +Link: https://lore.kernel.org/r/63130691-1984-c423-c1f2-73bfd8d3dcd3@gmail.com +Signed-off-by: Michael Schmitz +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230301021107.26307-1-schmitzmic@gmail.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/kernel/traps.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/m68k/kernel/traps.c b/arch/m68k/kernel/traps.c +index 5c8cba0efc63e..a700807c9b6d9 100644 +--- a/arch/m68k/kernel/traps.c ++++ b/arch/m68k/kernel/traps.c +@@ -30,6 +30,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -545,7 +546,8 @@ static inline void bus_error030 (struct frame *fp) + errorcode |= 2; + + if (mmusr & (MMU_I | MMU_WP)) { +- if (ssw & 4) { ++ /* We might have an exception table for this PC */ ++ if (ssw & 4 && !search_exception_tables(fp->ptregs.pc)) { + pr_err("Data %s fault at %#010lx in %s (pc=%#lx)\n", + ssw & RW ? "read" : "write", + fp->un.fmtb.daddr, +-- +2.39.2 + diff --git a/queue-6.1/net-sched-act_mirred-better-wording-on-protection-ag.patch b/queue-6.1/net-sched-act_mirred-better-wording-on-protection-ag.patch new file mode 100644 index 00000000000..6afcb359b3f --- /dev/null +++ b/queue-6.1/net-sched-act_mirred-better-wording-on-protection-ag.patch @@ -0,0 +1,89 @@ +From 4d85e6fc4345cb3822e9669f0c49a28861cfa8da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Jan 2023 18:01:39 +0100 +Subject: net/sched: act_mirred: better wording on protection against excessive + stack growth + +From: Davide Caratti + +[ Upstream commit 78dcdffe0418ac8f3f057f26fe71ccf4d8ed851f ] + +with commit e2ca070f89ec ("net: sched: protect against stack overflow in +TC act_mirred"), act_mirred protected itself against excessive stack growth +using per_cpu counter of nested calls to tcf_mirred_act(), and capping it +to MIRRED_RECURSION_LIMIT. However, such protection does not detect +recursion/loops in case the packet is enqueued to the backlog (for example, +when the mirred target device has RPS or skb timestamping enabled). Change +the wording from "recursion" to "nesting" to make it more clear to readers. + +CC: Jamal Hadi Salim +Signed-off-by: Davide Caratti +Reviewed-by: Marcelo Ricardo Leitner +Acked-by: Jamal Hadi Salim +Signed-off-by: Paolo Abeni +Stable-dep-of: ca22da2fbd69 ("act_mirred: use the backlog for nested calls to mirred ingress") +Signed-off-by: Sasha Levin +--- + net/sched/act_mirred.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c +index b8ad6ae282c02..ded6ee054be14 100644 +--- a/net/sched/act_mirred.c ++++ b/net/sched/act_mirred.c +@@ -28,8 +28,8 @@ + static LIST_HEAD(mirred_list); + static DEFINE_SPINLOCK(mirred_list_lock); + +-#define MIRRED_RECURSION_LIMIT 4 +-static DEFINE_PER_CPU(unsigned int, mirred_rec_level); ++#define MIRRED_NEST_LIMIT 4 ++static DEFINE_PER_CPU(unsigned int, mirred_nest_level); + + static bool tcf_mirred_is_act_redirect(int action) + { +@@ -224,7 +224,7 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, + struct sk_buff *skb2 = skb; + bool m_mac_header_xmit; + struct net_device *dev; +- unsigned int rec_level; ++ unsigned int nest_level; + int retval, err = 0; + bool use_reinsert; + bool want_ingress; +@@ -235,11 +235,11 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, + int mac_len; + bool at_nh; + +- rec_level = __this_cpu_inc_return(mirred_rec_level); +- if (unlikely(rec_level > MIRRED_RECURSION_LIMIT)) { ++ nest_level = __this_cpu_inc_return(mirred_nest_level); ++ if (unlikely(nest_level > MIRRED_NEST_LIMIT)) { + net_warn_ratelimited("Packet exceeded mirred recursion limit on dev %s\n", + netdev_name(skb->dev)); +- __this_cpu_dec(mirred_rec_level); ++ __this_cpu_dec(mirred_nest_level); + return TC_ACT_SHOT; + } + +@@ -308,7 +308,7 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, + err = tcf_mirred_forward(want_ingress, skb); + if (err) + tcf_action_inc_overlimit_qstats(&m->common); +- __this_cpu_dec(mirred_rec_level); ++ __this_cpu_dec(mirred_nest_level); + return TC_ACT_CONSUMED; + } + } +@@ -320,7 +320,7 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, + if (tcf_mirred_is_act_redirect(m_eaction)) + retval = TC_ACT_SHOT; + } +- __this_cpu_dec(mirred_rec_level); ++ __this_cpu_dec(mirred_nest_level); + + return retval; + } +-- +2.39.2 + diff --git a/queue-6.1/net-usb-cdc_mbim-avoid-altsetting-toggling-for-telit.patch b/queue-6.1/net-usb-cdc_mbim-avoid-altsetting-toggling-for-telit.patch new file mode 100644 index 00000000000..01727aa6960 --- /dev/null +++ b/queue-6.1/net-usb-cdc_mbim-avoid-altsetting-toggling-for-telit.patch @@ -0,0 +1,39 @@ +From fdfeb99ec8eb43e3c35526fbce6c724a52631e4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 12:59:33 +0100 +Subject: net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990 + +From: Enrico Sau + +[ Upstream commit 418383e6ed6b4624a54ec05c535f13d184fbf33b ] + +Add quirk CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE for Telit FE990 +0x1081 composition in order to avoid bind error. + +Signed-off-by: Enrico Sau +Link: https://lore.kernel.org/r/20230306115933.198259-1-enrico.sau@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/usb/cdc_mbim.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c +index c89639381eca3..cd4083e0b3b9e 100644 +--- a/drivers/net/usb/cdc_mbim.c ++++ b/drivers/net/usb/cdc_mbim.c +@@ -665,6 +665,11 @@ static const struct usb_device_id mbim_devs[] = { + .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle, + }, + ++ /* Telit FE990 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x1bc7, 0x1081, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE), ++ .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle, ++ }, ++ + /* default entry */ + { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE), + .driver_info = (unsigned long)&cdc_mbim_info_zlp, +-- +2.39.2 + diff --git a/queue-6.1/net-usb-qmi_wwan-add-telit-0x1080-composition.patch b/queue-6.1/net-usb-qmi_wwan-add-telit-0x1080-composition.patch new file mode 100644 index 00000000000..ca54fc93622 --- /dev/null +++ b/queue-6.1/net-usb-qmi_wwan-add-telit-0x1080-composition.patch @@ -0,0 +1,36 @@ +From 9000cbd09f859cd3710c9469cc127eaa16fb1c5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 13:05:28 +0100 +Subject: net: usb: qmi_wwan: add Telit 0x1080 composition + +From: Enrico Sau + +[ Upstream commit 382e363d5bed0cec5807b35761d14e55955eee63 ] + +Add the following Telit FE990 composition: + +0x1080: tty, adb, rmnet, tty, tty, tty, tty + +Signed-off-by: Enrico Sau +Link: https://lore.kernel.org/r/20230306120528.198842-1-enrico.sau@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 554d4e2a84a4e..2cc28af52ee25 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1363,6 +1363,7 @@ static const struct usb_device_id products[] = { + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1057, 2)}, /* Telit FN980 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1060, 2)}, /* Telit LN920 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1070, 2)}, /* Telit FN990 */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1080, 2)}, /* Telit FE990 */ + {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */ + {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ + {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ +-- +2.39.2 + diff --git a/queue-6.1/platform-x86-int3472-add-gpios-to-surface-go-3-board.patch b/queue-6.1/platform-x86-int3472-add-gpios-to-surface-go-3-board.patch new file mode 100644 index 00000000000..106a41a66ba --- /dev/null +++ b/queue-6.1/platform-x86-int3472-add-gpios-to-surface-go-3-board.patch @@ -0,0 +1,42 @@ +From 339c7398fe1e4beecbf9d02ba21556ce5a3228a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Mar 2023 10:26:11 +0000 +Subject: platform/x86: int3472: Add GPIOs to Surface Go 3 Board data + +From: Daniel Scally + +[ Upstream commit e8059d393158e927e36898aca89986a52025b9f3 ] + +Add the INT347E GPIO lookup table to the board data for the Surface +Go 3. This is necessary to allow the ov7251 IR camera to probe +properly on that platform. + +Signed-off-by: Daniel Scally +Link: https://lore.kernel.org/r/20230302102611.314341-1-dan.scally@ideasonboard.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/int3472/tps68470_board_data.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/intel/int3472/tps68470_board_data.c b/drivers/platform/x86/intel/int3472/tps68470_board_data.c +index 309eab9c05588..322237e056f32 100644 +--- a/drivers/platform/x86/intel/int3472/tps68470_board_data.c ++++ b/drivers/platform/x86/intel/int3472/tps68470_board_data.c +@@ -159,9 +159,10 @@ static const struct int3472_tps68470_board_data surface_go_tps68470_board_data = + static const struct int3472_tps68470_board_data surface_go3_tps68470_board_data = { + .dev_name = "i2c-INT3472:01", + .tps68470_regulator_pdata = &surface_go_tps68470_pdata, +- .n_gpiod_lookups = 1, ++ .n_gpiod_lookups = 2, + .tps68470_gpio_lookup_tables = { +- &surface_go_int347a_gpios ++ &surface_go_int347a_gpios, ++ &surface_go_int347e_gpios, + }, + }; + +-- +2.39.2 + diff --git a/queue-6.1/riscv-bump-command_line_size-value-to-1024.patch b/queue-6.1/riscv-bump-command_line_size-value-to-1024.patch new file mode 100644 index 00000000000..6f49d68b735 --- /dev/null +++ b/queue-6.1/riscv-bump-command_line_size-value-to-1024.patch @@ -0,0 +1,46 @@ +From 94ce380234d8ac6522ec30769dcb3d1f7fd0cc1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Mar 2021 15:34:20 -0400 +Subject: riscv: Bump COMMAND_LINE_SIZE value to 1024 + +From: Alexandre Ghiti + +[ Upstream commit 61fc1ee8be26bc192d691932b0a67eabee45d12f ] + +Increase COMMAND_LINE_SIZE as the current default value is too low +for syzbot kernel command line. + +There has been considerable discussion on this patch that has led to a +larger patch set removing COMMAND_LINE_SIZE from the uapi headers on all +ports. That's not quite done yet, but it's gotten far enough we're +confident this is not a uABI change so this is safe. + +Reported-by: Dmitry Vyukov +Signed-off-by: Alexandre Ghiti +Link: https://lore.kernel.org/r/20210316193420.904-1-alex@ghiti.fr +[Palmer: it's not uabi] +Link: https://lore.kernel.org/linux-riscv/874b8076-b0d1-4aaa-bcd8-05d523060152@app.fastmail.com/#t +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/include/uapi/asm/setup.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + create mode 100644 arch/riscv/include/uapi/asm/setup.h + +diff --git a/arch/riscv/include/uapi/asm/setup.h b/arch/riscv/include/uapi/asm/setup.h +new file mode 100644 +index 0000000000000..66b13a5228808 +--- /dev/null ++++ b/arch/riscv/include/uapi/asm/setup.h +@@ -0,0 +1,8 @@ ++/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */ ++ ++#ifndef _UAPI_ASM_RISCV_SETUP_H ++#define _UAPI_ASM_RISCV_SETUP_H ++ ++#define COMMAND_LINE_SIZE 1024 ++ ++#endif /* _UAPI_ASM_RISCV_SETUP_H */ +-- +2.39.2 + diff --git a/queue-6.1/scsi-hisi_sas-check-devm_add_action-return-value.patch b/queue-6.1/scsi-hisi_sas-check-devm_add_action-return-value.patch new file mode 100644 index 00000000000..fb64c5af6ba --- /dev/null +++ b/queue-6.1/scsi-hisi_sas-check-devm_add_action-return-value.patch @@ -0,0 +1,38 @@ +From b71b24762ab01db53949f1060a7e6a4da5825b7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 11:10:30 +0800 +Subject: scsi: hisi_sas: Check devm_add_action() return value + +From: Kang Chen + +[ Upstream commit 06d1a90de60208054cca15ef200138cfdbb642a9 ] + +In case devm_add_action() fails, check it in the caller of +interrupt_preinit_v3_hw(). + +Link: https://lore.kernel.org/r/20230227031030.893324-1-void0red@gmail.com +Signed-off-by: Kang Chen +Acked-by: Xiang Chen +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index d56b4bfd27678..620dcefe7b6f4 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -2448,8 +2448,7 @@ static int interrupt_preinit_v3_hw(struct hisi_hba *hisi_hba) + hisi_hba->cq_nvecs = vectors - BASE_VECTORS_V3_HW; + shost->nr_hw_queues = hisi_hba->cq_nvecs; + +- devm_add_action(&pdev->dev, hisi_sas_v3_free_vectors, pdev); +- return 0; ++ return devm_add_action(&pdev->dev, hisi_sas_v3_free_vectors, pdev); + } + + static int interrupt_init_v3_hw(struct hisi_hba *hisi_hba) +-- +2.39.2 + diff --git a/queue-6.1/scsi-lpfc-avoid-usage-of-list-iterator-variable-afte.patch b/queue-6.1/scsi-lpfc-avoid-usage-of-list-iterator-variable-afte.patch new file mode 100644 index 00000000000..61a87f8c233 --- /dev/null +++ b/queue-6.1/scsi-lpfc-avoid-usage-of-list-iterator-variable-afte.patch @@ -0,0 +1,61 @@ +From 39e884b9f751c25645834bccbd3b5b6d9dd2dfb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Mar 2023 18:19:14 +0100 +Subject: scsi: lpfc: Avoid usage of list iterator variable after loop + +From: Jakob Koschel + +[ Upstream commit 2850b23e9f9ae3696e472d2883ea1b43aafa884e ] + +If the &epd_pool->list is empty when executing +lpfc_get_io_buf_from_expedite_pool() the function would return an invalid +pointer. Even in the case if the list is guaranteed to be populated, the +iterator variable should not be used after the loop to be more robust for +future changes. + +Linus proposed to avoid any use of the list iterator variable after the +loop, in the attempt to move the list iterator variable declaration into +the macro to avoid any potential misuse after the loop [1]. + +Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ [1] +Signed-off-by: Jakob Koschel +Link: https://lore.kernel.org/r/20230301-scsi-lpfc-avoid-list-iterator-after-loop-v1-1-325578ae7561@gmail.com +Reviewed-by: Justin Tee +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_sli.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 43e06bb917e77..b44bb3ae22ad9 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -21886,20 +21886,20 @@ lpfc_get_io_buf_from_private_pool(struct lpfc_hba *phba, + static struct lpfc_io_buf * + lpfc_get_io_buf_from_expedite_pool(struct lpfc_hba *phba) + { +- struct lpfc_io_buf *lpfc_ncmd; ++ struct lpfc_io_buf *lpfc_ncmd = NULL, *iter; + struct lpfc_io_buf *lpfc_ncmd_next; + unsigned long iflag; + struct lpfc_epd_pool *epd_pool; + + epd_pool = &phba->epd_pool; +- lpfc_ncmd = NULL; + + spin_lock_irqsave(&epd_pool->lock, iflag); + if (epd_pool->count > 0) { +- list_for_each_entry_safe(lpfc_ncmd, lpfc_ncmd_next, ++ list_for_each_entry_safe(iter, lpfc_ncmd_next, + &epd_pool->list, list) { +- list_del(&lpfc_ncmd->list); ++ list_del(&iter->list); + epd_pool->count--; ++ lpfc_ncmd = iter; + break; + } + } +-- +2.39.2 + diff --git a/queue-6.1/scsi-lpfc-check-kzalloc-in-lpfc_sli4_cgn_params_read.patch b/queue-6.1/scsi-lpfc-check-kzalloc-in-lpfc_sli4_cgn_params_read.patch new file mode 100644 index 00000000000..da3153a9f7f --- /dev/null +++ b/queue-6.1/scsi-lpfc-check-kzalloc-in-lpfc_sli4_cgn_params_read.patch @@ -0,0 +1,59 @@ +From 196c81d89d138192c7bb45cf8987fb30d5de10a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 20:43:36 -0800 +Subject: scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read() + +From: Justin Tee + +[ Upstream commit 312320b0e0ec21249a17645683fe5304d796aec1 ] + +If kzalloc() fails in lpfc_sli4_cgn_params_read(), then we rely on +lpfc_read_object()'s routine to NULL check pdata. + +Currently, an early return error is thrown from lpfc_read_object() to +protect us from NULL ptr dereference, but the errno code is -ENODEV. + +Change the errno code to a more appropriate -ENOMEM. + +Reported-by: Kang Chen +Link: https://lore.kernel.org/all/20230226102338.3362585-1-void0red@gmail.com +Signed-off-by: Justin Tee +Link: https://lore.kernel.org/r/20230228044336.5195-1-justintee8345@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_init.c | 2 ++ + drivers/scsi/lpfc/lpfc_sli.c | 4 ---- + 2 files changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c +index b535f1fd30100..2f38c8d5a48a9 100644 +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -7234,6 +7234,8 @@ lpfc_sli4_cgn_params_read(struct lpfc_hba *phba) + /* Find out if the FW has a new set of congestion parameters. */ + len = sizeof(struct lpfc_cgn_param); + pdata = kzalloc(len, GFP_KERNEL); ++ if (!pdata) ++ return -ENOMEM; + ret = lpfc_read_object(phba, (char *)LPFC_PORT_CFG_NAME, + pdata, len); + +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index b93c948c4fcc4..43e06bb917e77 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -22096,10 +22096,6 @@ lpfc_read_object(struct lpfc_hba *phba, char *rdobject, uint32_t *datap, + struct lpfc_dmabuf *pcmd; + u32 rd_object_name[LPFC_MBX_OBJECT_NAME_LEN_DW] = {0}; + +- /* sanity check on queue memory */ +- if (!datap) +- return -ENODEV; +- + mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL); + if (!mbox) + return -ENOMEM; +-- +2.39.2 + diff --git a/queue-6.1/scsi-mpi3mr-bad-drive-in-topology-results-kernel-cra.patch b/queue-6.1/scsi-mpi3mr-bad-drive-in-topology-results-kernel-cra.patch new file mode 100644 index 00000000000..eb9f386f020 --- /dev/null +++ b/queue-6.1/scsi-mpi3mr-bad-drive-in-topology-results-kernel-cra.patch @@ -0,0 +1,70 @@ +From e1f926048d8c201b2a66f070e6b09950ee98020a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 06:08:35 -0800 +Subject: scsi: mpi3mr: Bad drive in topology results kernel crash + +From: Ranjan Kumar + +[ Upstream commit 8e45183978d64699df639e795235433a60f35047 ] + +When the SAS Transport Layer support is enabled and a device exposed to +the OS by the driver fails INQUIRY commands, the driver frees up the memory +allocated for an internal HBA port data structure. However, in some places, +the reference to the freed memory is not cleared. When the firmware sends +the Device Info change event for the same device again, the freed memory is +accessed and that leads to memory corruption and OS crash. + +Signed-off-by: Ranjan Kumar +Signed-off-by: Sreekanth Reddy +Link: https://lore.kernel.org/r/20230228140835.4075-7-ranjan.kumar@broadcom.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpi3mr/mpi3mr_transport.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/mpi3mr/mpi3mr_transport.c b/drivers/scsi/mpi3mr/mpi3mr_transport.c +index 90f61a0a8f4ef..5748bd9369ff7 100644 +--- a/drivers/scsi/mpi3mr/mpi3mr_transport.c ++++ b/drivers/scsi/mpi3mr/mpi3mr_transport.c +@@ -2355,15 +2355,16 @@ int mpi3mr_report_tgtdev_to_sas_transport(struct mpi3mr_ioc *mrioc, + tgtdev->host_exposed = 1; + if (!mpi3mr_sas_port_add(mrioc, tgtdev->dev_handle, + sas_address_parent, hba_port)) { +- tgtdev->host_exposed = 0; + retval = -1; +- } else if ((!tgtdev->starget)) { +- if (!mrioc->is_driver_loading) ++ } else if ((!tgtdev->starget) && (!mrioc->is_driver_loading)) { + mpi3mr_sas_port_remove(mrioc, sas_address, + sas_address_parent, hba_port); +- tgtdev->host_exposed = 0; + retval = -1; + } ++ if (retval) { ++ tgtdev->dev_spec.sas_sata_inf.hba_port = NULL; ++ tgtdev->host_exposed = 0; ++ } + return retval; + } + +@@ -2392,6 +2393,7 @@ void mpi3mr_remove_tgtdev_from_sas_transport(struct mpi3mr_ioc *mrioc, + mpi3mr_sas_port_remove(mrioc, sas_address, sas_address_parent, + hba_port); + tgtdev->host_exposed = 0; ++ tgtdev->dev_spec.sas_sata_inf.hba_port = NULL; + } + + /** +@@ -2448,7 +2450,7 @@ static u8 mpi3mr_get_port_id_by_rphy(struct mpi3mr_ioc *mrioc, struct sas_rphy * + + tgtdev = __mpi3mr_get_tgtdev_by_addr_and_rphy(mrioc, + rphy->identify.sas_address, rphy); +- if (tgtdev) { ++ if (tgtdev && tgtdev->dev_spec.sas_sata_inf.hba_port) { + port_id = + tgtdev->dev_spec.sas_sata_inf.hba_port->port_id; + mpi3mr_tgtdev_put(tgtdev); +-- +2.39.2 + diff --git a/queue-6.1/scsi-mpi3mr-driver-unload-crashes-host-when-enhanced.patch b/queue-6.1/scsi-mpi3mr-driver-unload-crashes-host-when-enhanced.patch new file mode 100644 index 00000000000..ae7456c7b39 --- /dev/null +++ b/queue-6.1/scsi-mpi3mr-driver-unload-crashes-host-when-enhanced.patch @@ -0,0 +1,39 @@ +From e6471c923b36f9f7160562b8c01c17bb3b3a6047 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 06:08:31 -0800 +Subject: scsi: mpi3mr: Driver unload crashes host when enhanced logging is + enabled + +From: Ranjan Kumar + +[ Upstream commit 5b06a7169c59ce0c77ef8b9c82aa07c478f82aac ] + +Prevent driver from trying to dereference a NULL pointer in a debug print +while removing a device during driver unload. + +Signed-off-by: Ranjan Kumar +Signed-off-by: Sreekanth Reddy +Link: https://lore.kernel.org/r/20230228140835.4075-3-ranjan.kumar@broadcom.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpi3mr/mpi3mr_transport.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/mpi3mr/mpi3mr_transport.c b/drivers/scsi/mpi3mr/mpi3mr_transport.c +index 50263ba4f8428..90f61a0a8f4ef 100644 +--- a/drivers/scsi/mpi3mr/mpi3mr_transport.c ++++ b/drivers/scsi/mpi3mr/mpi3mr_transport.c +@@ -1549,7 +1549,8 @@ static void mpi3mr_sas_port_remove(struct mpi3mr_ioc *mrioc, u64 sas_address, + + list_for_each_entry_safe(mr_sas_phy, next_phy, + &mr_sas_port->phy_list, port_siblings) { +- if ((mrioc->logging_level & MPI3_DEBUG_TRANSPORT_INFO)) ++ if ((!mrioc->stop_drv_processing) && ++ (mrioc->logging_level & MPI3_DEBUG_TRANSPORT_INFO)) + dev_info(&mr_sas_port->port->dev, + "remove: sas_address(0x%016llx), phy(%d)\n", + (unsigned long long) +-- +2.39.2 + diff --git a/queue-6.1/scsi-mpi3mr-nvme-command-size-greater-than-8k-fails.patch b/queue-6.1/scsi-mpi3mr-nvme-command-size-greater-than-8k-fails.patch new file mode 100644 index 00000000000..eb57f30b8b6 --- /dev/null +++ b/queue-6.1/scsi-mpi3mr-nvme-command-size-greater-than-8k-fails.patch @@ -0,0 +1,48 @@ +From b39ec816bfbe17fec22fc7f16edaccdeb35f4b9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 06:08:34 -0800 +Subject: scsi: mpi3mr: NVMe command size greater than 8K fails + +From: Ranjan Kumar + +[ Upstream commit 4f297e856a7b5da2f2c66a12e739666e23943560 ] + +A wrong variable is checked while populating PRP entries in the PRP page +and this results in failure. No PRP entries in the PRP page were +successfully created and any NVMe Encapsulated commands with PRP of size +greater than 8K failed. + +Signed-off-by: Ranjan Kumar +Signed-off-by: Sreekanth Reddy +Link: https://lore.kernel.org/r/20230228140835.4075-6-ranjan.kumar@broadcom.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpi3mr/mpi3mr_app.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/mpi3mr/mpi3mr_app.c b/drivers/scsi/mpi3mr/mpi3mr_app.c +index bff6377023979..d10c6afb7f9cd 100644 +--- a/drivers/scsi/mpi3mr/mpi3mr_app.c ++++ b/drivers/scsi/mpi3mr/mpi3mr_app.c +@@ -886,7 +886,7 @@ static int mpi3mr_build_nvme_prp(struct mpi3mr_ioc *mrioc, + * each time through the loop. + */ + *prp_entry = cpu_to_le64(dma_addr); +- if (*prp1_entry & sgemod_mask) { ++ if (*prp_entry & sgemod_mask) { + dprint_bsg_err(mrioc, + "%s: PRP address collides with SGE modifier\n", + __func__); +@@ -895,7 +895,7 @@ static int mpi3mr_build_nvme_prp(struct mpi3mr_ioc *mrioc, + *prp_entry &= ~sgemod_mask; + *prp_entry |= sgemod_val; + prp_entry++; +- prp_entry_dma++; ++ prp_entry_dma += prp_size; + } + + /* +-- +2.39.2 + diff --git a/queue-6.1/scsi-mpi3mr-wait-for-diagnostic-save-during-controll.patch b/queue-6.1/scsi-mpi3mr-wait-for-diagnostic-save-during-controll.patch new file mode 100644 index 00000000000..f759fe51d0e --- /dev/null +++ b/queue-6.1/scsi-mpi3mr-wait-for-diagnostic-save-during-controll.patch @@ -0,0 +1,62 @@ +From f6aaee7525ba0085c0b640f118d4fa0c7df49754 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 06:08:32 -0800 +Subject: scsi: mpi3mr: Wait for diagnostic save during controller init + +From: Ranjan Kumar + +[ Upstream commit 0a319f1629495d27879b7ebf6eee62b8cf6e4c37 ] + +If a controller reset operation is triggered to recover the controller from +a fault state, then wait for the snapdump to be saved in the firmware +region before proceeding to reset the controller. + +Signed-off-by: Ranjan Kumar +Signed-off-by: Sreekanth Reddy +Link: https://lore.kernel.org/r/20230228140835.4075-4-ranjan.kumar@broadcom.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpi3mr/mpi3mr_fw.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/mpi3mr/mpi3mr_fw.c b/drivers/scsi/mpi3mr/mpi3mr_fw.c +index 74fa7f90399e3..ea9e69fb62826 100644 +--- a/drivers/scsi/mpi3mr/mpi3mr_fw.c ++++ b/drivers/scsi/mpi3mr/mpi3mr_fw.c +@@ -1198,7 +1198,7 @@ mpi3mr_revalidate_factsdata(struct mpi3mr_ioc *mrioc) + */ + static int mpi3mr_bring_ioc_ready(struct mpi3mr_ioc *mrioc) + { +- u32 ioc_config, ioc_status, timeout; ++ u32 ioc_config, ioc_status, timeout, host_diagnostic; + int retval = 0; + enum mpi3mr_iocstate ioc_state; + u64 base_info; +@@ -1252,6 +1252,23 @@ static int mpi3mr_bring_ioc_ready(struct mpi3mr_ioc *mrioc) + retval, mpi3mr_iocstate_name(ioc_state)); + } + if (ioc_state != MRIOC_STATE_RESET) { ++ if (ioc_state == MRIOC_STATE_FAULT) { ++ timeout = MPI3_SYSIF_DIAG_SAVE_TIMEOUT * 10; ++ mpi3mr_print_fault_info(mrioc); ++ do { ++ host_diagnostic = ++ readl(&mrioc->sysif_regs->host_diagnostic); ++ if (!(host_diagnostic & ++ MPI3_SYSIF_HOST_DIAG_SAVE_IN_PROGRESS)) ++ break; ++ if (!pci_device_is_present(mrioc->pdev)) { ++ mrioc->unrecoverable = 1; ++ ioc_err(mrioc, "controller is not present at the bringup\n"); ++ goto out_device_not_present; ++ } ++ msleep(100); ++ } while (--timeout); ++ } + mpi3mr_print_fault_info(mrioc); + ioc_info(mrioc, "issuing soft reset to bring to reset state\n"); + retval = mpi3mr_issue_reset(mrioc, +-- +2.39.2 + diff --git a/queue-6.1/scsi-qla2xxx-add-option-to-disable-fc2-target-suppor.patch b/queue-6.1/scsi-qla2xxx-add-option-to-disable-fc2-target-suppor.patch new file mode 100644 index 00000000000..cd34cd75cbd --- /dev/null +++ b/queue-6.1/scsi-qla2xxx-add-option-to-disable-fc2-target-suppor.patch @@ -0,0 +1,83 @@ +From f59efbe688424417d13628ba6123dc0e649151de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Feb 2023 16:20:14 +0100 +Subject: scsi: qla2xxx: Add option to disable FC2 Target support + +From: Daniel Wagner + +[ Upstream commit 877b03795fcf29ff2e2351f7e574ecc9b9c51732 ] + +Commit 44c57f205876 ("scsi: qla2xxx: Changes to support FCP2 Target") added +support for FC2 Targets. Unfortunately, there are older setups which break +with this new feature enabled. + +Allow to disable it via module option. + +Link: https://lore.kernel.org/r/20230208152014.109214-1-dwagner@suse.de +Signed-off-by: Daniel Wagner +Reviewed-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_gbl.h | 1 + + drivers/scsi/qla2xxx/qla_init.c | 3 ++- + drivers/scsi/qla2xxx/qla_os.c | 10 +++++++++- + 3 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h +index e3256e721be14..ee54207fc5319 100644 +--- a/drivers/scsi/qla2xxx/qla_gbl.h ++++ b/drivers/scsi/qla2xxx/qla_gbl.h +@@ -192,6 +192,7 @@ extern int ql2xsecenable; + extern int ql2xenforce_iocb_limit; + extern int ql2xabts_wait_nvme; + extern u32 ql2xnvme_queues; ++extern int ql2xfc2target; + + extern int qla2x00_loop_reset(scsi_qla_host_t *); + extern void qla2x00_abort_all_cmds(scsi_qla_host_t *, int); +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index a8d822c4e3bac..93f7f3dd5d82b 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -1841,7 +1841,8 @@ void qla2x00_handle_rscn(scsi_qla_host_t *vha, struct event_arg *ea) + case RSCN_PORT_ADDR: + fcport = qla2x00_find_fcport_by_nportid(vha, &ea->id, 1); + if (fcport) { +- if (fcport->flags & FCF_FCP2_DEVICE && ++ if (ql2xfc2target && ++ fcport->flags & FCF_FCP2_DEVICE && + atomic_read(&fcport->state) == FCS_ONLINE) { + ql_dbg(ql_dbg_disc, vha, 0x2115, + "Delaying session delete for FCP2 portid=%06x %8phC ", +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index e010812015b14..7d2d872bae3c5 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -360,6 +360,13 @@ MODULE_PARM_DESC(ql2xnvme_queues, + "1 - Minimum number of queues supported\n" + "8 - Default value"); + ++int ql2xfc2target = 1; ++module_param(ql2xfc2target, int, 0444); ++MODULE_PARM_DESC(qla2xfc2target, ++ "Enables FC2 Target support. " ++ "0 - FC2 Target support is disabled. " ++ "1 - FC2 Target support is enabled (default)."); ++ + static struct scsi_transport_template *qla2xxx_transport_template = NULL; + struct scsi_transport_template *qla2xxx_transport_vport_template = NULL; + +@@ -4087,7 +4094,8 @@ qla2x00_mark_all_devices_lost(scsi_qla_host_t *vha) + "Mark all dev lost\n"); + + list_for_each_entry(fcport, &vha->vp_fcports, list) { +- if (fcport->loop_id != FC_NO_LOOP_ID && ++ if (ql2xfc2target && ++ fcport->loop_id != FC_NO_LOOP_ID && + (fcport->flags & FCF_FCP2_DEVICE) && + fcport->port_type == FCT_TARGET && + !qla2x00_reset_active(vha)) { +-- +2.39.2 + diff --git a/queue-6.1/scsi-storvsc-handle-blocksize-change-in-hyper-v-vhd-.patch b/queue-6.1/scsi-storvsc-handle-blocksize-change-in-hyper-v-vhd-.patch new file mode 100644 index 00000000000..2731c08bfe6 --- /dev/null +++ b/queue-6.1/scsi-storvsc-handle-blocksize-change-in-hyper-v-vhd-.patch @@ -0,0 +1,89 @@ +From c6f1348786b44df7cb8d350d48e0d0383a862277 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 08:48:34 -0800 +Subject: scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX file + +From: Michael Kelley + +[ Upstream commit 11d9874c4204a785f43d899a1ab12f9dc8d9de3e ] + +Hyper-V uses a VHD or VHDX file on the host as the underlying storage for a +virtual disk. The VHD/VHDX file format is a sparse format where real disk +space on the host is assigned in chunks that the VHD/VHDX file format calls +the BlockSize. This BlockSize is not to be confused with the 512-byte (or +4096-byte) sector size of the underlying storage device. The default block +size for a new VHD/VHDX file is 32 Mbytes. When a guest VM touches any +disk space within a 32 Mbyte chunk of the VHD/VHDX file, Hyper-V allocates +32 Mbytes of real disk space for that section of the VHD/VHDX. Similarly, +if a discard operation is done that covers an entire 32 Mbyte chunk, +Hyper-V will free the real disk space for that portion of the VHD/VHDX. +This BlockSize is surfaced in Linux as the "discard_granularity" in +/sys/block/sd/queue, which makes sense. + +Hyper-V also has differencing disks that can overlay a VHD/VHDX file to +capture changes to the VHD/VHDX while preserving the original VHD/VHDX. +One example of this differencing functionality is for VM snapshots. When a +snapshot is created, a differencing disk is created. If the snapshot is +rolled back, Hyper-V can just delete the differencing disk, and the VM will +see the original disk contents at the time the snapshot was taken. +Differencing disks are used in other scenarios as well. + +The BlockSize for a differencing disk defaults to 2 Mbytes, not 32 Mbytes. +The smaller default is used because changes to differencing disks are +typically scattered all over, and Hyper-V doesn't want to allocate 32 +Mbytes of real disk space for a stray write here or there. The smaller +BlockSize provides more efficient use of real disk space. + +When a differencing disk is added to a VHD/VHDX, Hyper-V reports +UNIT_ATTENTION with a sense code indicating "Operating parameters have +changed", because the value of discard_granularity should be changed to 2 +Mbytes. When the differencing disk is removed, discard_granularity should +be changed back to 32 Mbytes. However, current code simply reports a +message from scsi_report_sense() and the value of +/sys/block/sd/queue/discard_granularity is not updated. The message +isn't very actionable by a sysadmin. + +Fix this by having the storvsc driver check for the sense code indicating +that the underly VHD/VHDX block size has changed, and do a rescan of the +device to pick up the new discard_granularity. With this change the entire +transition to/from differencing disks is handled automatically and +transparently, with no confusing messages being output. + +Link: https://lore.kernel.org/r/1677516514-86060-1-git-send-email-mikelley@microsoft.com +Signed-off-by: Michael Kelley +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/storvsc_drv.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index 55d6fb4526804..a0665bca54b99 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -987,6 +987,22 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb, + goto do_work; + } + ++ /* ++ * Check for "Operating parameters have changed" ++ * due to Hyper-V changing the VHD/VHDX BlockSize ++ * when adding/removing a differencing disk. This ++ * causes discard_granularity to change, so do a ++ * rescan to pick up the new granularity. We don't ++ * want scsi_report_sense() to output a message ++ * that a sysadmin wouldn't know what to do with. ++ */ ++ if ((asc == 0x3f) && (ascq != 0x03) && ++ (ascq != 0x0e)) { ++ process_err_fn = storvsc_device_scan; ++ set_host_byte(scmnd, DID_REQUEUE); ++ goto do_work; ++ } ++ + /* + * Otherwise, let upper layer deal with the + * error when sense message is present +-- +2.39.2 + diff --git a/queue-6.1/scsi-target-iscsi-fix-an-error-message-in-iscsi_chec.patch b/queue-6.1/scsi-target-iscsi-fix-an-error-message-in-iscsi_chec.patch new file mode 100644 index 00000000000..a935514810e --- /dev/null +++ b/queue-6.1/scsi-target-iscsi-fix-an-error-message-in-iscsi_chec.patch @@ -0,0 +1,55 @@ +From 2d3eb4e0ac867fa7ccdfe8b75bebfeb1c3ea868d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Feb 2023 15:15:56 +0100 +Subject: scsi: target: iscsi: Fix an error message in iscsi_check_key() + +From: Maurizio Lombardi + +[ Upstream commit 6cc55c969b7ce8d85e09a636693d4126c3676c11 ] + +The first half of the error message is printed by pr_err(), the second half +is printed by pr_debug(). The user will therefore see only the first part +of the message and will miss some useful information. + +Link: https://lore.kernel.org/r/20230214141556.762047-1-mlombard@redhat.com +Signed-off-by: Maurizio Lombardi +Reviewed-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/iscsi/iscsi_target_parameters.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c +index 2317fb077db0e..557516c642c3b 100644 +--- a/drivers/target/iscsi/iscsi_target_parameters.c ++++ b/drivers/target/iscsi/iscsi_target_parameters.c +@@ -1262,18 +1262,20 @@ static struct iscsi_param *iscsi_check_key( + return param; + + if (!(param->phase & phase)) { +- pr_err("Key \"%s\" may not be negotiated during ", +- param->name); ++ char *phase_name; ++ + switch (phase) { + case PHASE_SECURITY: +- pr_debug("Security phase.\n"); ++ phase_name = "Security"; + break; + case PHASE_OPERATIONAL: +- pr_debug("Operational phase.\n"); ++ phase_name = "Operational"; + break; + default: +- pr_debug("Unknown phase.\n"); ++ phase_name = "Unknown"; + } ++ pr_err("Key \"%s\" may not be negotiated during %s phase.\n", ++ param->name, phase_name); + return NULL; + } + +-- +2.39.2 + diff --git a/queue-6.1/scsi-ufs-core-add-soft-dependency-on-governor_simple.patch b/queue-6.1/scsi-ufs-core-add-soft-dependency-on-governor_simple.patch new file mode 100644 index 00000000000..f335f6e6db1 --- /dev/null +++ b/queue-6.1/scsi-ufs-core-add-soft-dependency-on-governor_simple.patch @@ -0,0 +1,35 @@ +From e2e1622635836c314f88963a15aa26c26c9f17bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Feb 2023 09:07:40 -0500 +Subject: scsi: ufs: core: Add soft dependency on governor_simpleondemand + +From: Adrien Thierry + +[ Upstream commit 2ebe16155dc8bd4e602cad5b5f65458d2eaa1a75 ] + +The ufshcd driver uses simpleondemand governor for devfreq. Add it to the +list of ufshcd softdeps to allow userspace initramfs tools like dracut to +automatically pull the governor module into the initramfs together with UFS +drivers. + +Link: https://lore.kernel.org/r/20230220140740.14379-1-athierry@redhat.com +Signed-off-by: Adrien Thierry +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index e652624c449a9..82ecf776f9054 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -10089,4 +10089,5 @@ module_exit(ufshcd_core_exit); + MODULE_AUTHOR("Santosh Yaragnavi "); + MODULE_AUTHOR("Vinayak Holikatti "); + MODULE_DESCRIPTION("Generic UFS host controller driver Core"); ++MODULE_SOFTDEP("pre: governor_simpleondemand"); + MODULE_LICENSE("GPL"); +-- +2.39.2 + diff --git a/queue-6.1/scsi-ufs-core-initialize-devfreq-synchronously.patch b/queue-6.1/scsi-ufs-core-initialize-devfreq-synchronously.patch new file mode 100644 index 00000000000..44f34fc3329 --- /dev/null +++ b/queue-6.1/scsi-ufs-core-initialize-devfreq-synchronously.patch @@ -0,0 +1,175 @@ +From 3703580d87d909b29327f0c613010154410bf79b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Feb 2023 14:44:22 -0500 +Subject: scsi: ufs: core: Initialize devfreq synchronously + +From: Adrien Thierry + +[ Upstream commit 7dafc3e007918384c8693ff8d70381b5c1e9c247 ] + +During UFS initialization, devfreq initialization is asynchronous: +ufshcd_async_scan() calls ufshcd_add_lus(), which in turn initializes +devfreq for UFS. The simple ondemand governor is then loaded. If it is +built as a module, request_module() is called and throws a warning: + + WARNING: CPU: 7 PID: 167 at kernel/kmod.c:136 __request_module+0x1e0/0x460 + Modules linked in: crct10dif_ce llcc_qcom phy_qcom_qmp_usb ufs_qcom phy_qcom_snps_femto_v2 ufshcd_pltfrm phy_qcom_qmp_combo ufshcd_core phy_qcom_qmp_ufs qcom_wdt socinfo fuse ipv6 + CPU: 7 PID: 167 Comm: kworker/u16:3 Not tainted 6.2.0-rc6-00009-g58706f7fb045 #1 + Hardware name: Qualcomm SA8540P Ride (DT) + Workqueue: events_unbound async_run_entry_fn + pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : __request_module+0x1e0/0x460 + lr : __request_module+0x1d8/0x460 + sp : ffff800009323b90 + x29: ffff800009323b90 x28: 0000000000000000 x27: 0000000000000000 + x26: ffff800009323d50 x25: ffff7b9045f57810 x24: ffff7b9045f57830 + x23: ffffdc5a83e426e8 x22: ffffdc5ae80a9818 x21: 0000000000000001 + x20: ffffdc5ae7502f98 x19: ffff7b9045f57800 x18: ffffffffffffffff + x17: 312f716572667665 x16: 642f7366752e3030 x15: 0000000000000000 + x14: 000000000000021c x13: 0000000000005400 x12: ffff7b9042ed7614 + x11: ffff7b9042ed7600 x10: 00000000636c0890 x9 : 0000000000000038 + x8 : ffff7b9045f2c880 x7 : ffff7b9045f57c68 x6 : 0000000000000080 + x5 : 0000000000000000 x4 : 8000000000000000 x3 : 0000000000000000 + x2 : 0000000000000000 x1 : ffffdc5ae5d382f0 x0 : 0000000000000001 + Call trace: + __request_module+0x1e0/0x460 + try_then_request_governor+0x7c/0x100 + devfreq_add_device+0x4b0/0x5fc + ufshcd_async_scan+0x1d4/0x310 [ufshcd_core] + async_run_entry_fn+0x34/0xe0 + process_one_work+0x1d0/0x320 + worker_thread+0x14c/0x444 + kthread+0x10c/0x110 + ret_from_fork+0x10/0x20 + +This occurs because synchronous module loading from async is not +allowed. According to __request_module(): + + /* + * We don't allow synchronous module loading from async. Module + * init may invoke async_synchronize_full() which will end up + * waiting for this task which already is waiting for the module + * loading to complete, leading to a deadlock. + */ + +Such a deadlock was experienced on the Qualcomm QDrive3/sa8540p-ride. With +DEVFREQ_GOV_SIMPLE_ONDEMAND=m, the boot hangs after the warning. + +Fix both the warning and the deadlock by moving devfreq initialization out +of the async routine. + +Tested on the sa8540p-ride by using fio to put the UFS under load, and +printing the trace generated by +/sys/kernel/tracing/events/ufs/ufshcd_clk_scaling events. The trace looks +similar with and without the change. + +Link: https://lore.kernel.org/r/20230217194423.42553-1-athierry@redhat.com +Signed-off-by: Adrien Thierry +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 47 ++++++++++++++++++++++++++------------- + include/ufs/ufshcd.h | 1 + + 2 files changed, 32 insertions(+), 16 deletions(-) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index edd34dac91b1d..e652624c449a9 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -1354,6 +1354,13 @@ static int ufshcd_devfreq_target(struct device *dev, + struct ufs_clk_info *clki; + unsigned long irq_flags; + ++ /* ++ * Skip devfreq if UFS initialization is not finished. ++ * Otherwise ufs could be in a inconsistent state. ++ */ ++ if (!smp_load_acquire(&hba->logical_unit_scan_finished)) ++ return 0; ++ + if (!ufshcd_is_clkscaling_supported(hba)) + return -EINVAL; + +@@ -8184,22 +8191,6 @@ static int ufshcd_add_lus(struct ufs_hba *hba) + if (ret) + goto out; + +- /* Initialize devfreq after UFS device is detected */ +- if (ufshcd_is_clkscaling_supported(hba)) { +- memcpy(&hba->clk_scaling.saved_pwr_info.info, +- &hba->pwr_info, +- sizeof(struct ufs_pa_layer_attr)); +- hba->clk_scaling.saved_pwr_info.is_valid = true; +- hba->clk_scaling.is_allowed = true; +- +- ret = ufshcd_devfreq_init(hba); +- if (ret) +- goto out; +- +- hba->clk_scaling.is_enabled = true; +- ufshcd_init_clk_scaling_sysfs(hba); +- } +- + ufs_bsg_probe(hba); + ufshpb_init(hba); + scsi_scan_host(hba->host); +@@ -8338,6 +8329,12 @@ static void ufshcd_async_scan(void *data, async_cookie_t cookie) + if (ret) { + pm_runtime_put_sync(hba->dev); + ufshcd_hba_exit(hba); ++ } else { ++ /* ++ * Make sure that when reader code sees UFS initialization has finished, ++ * all initialization steps have really been executed. ++ */ ++ smp_store_release(&hba->logical_unit_scan_finished, true); + } + } + +@@ -9892,12 +9889,30 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) + */ + ufshcd_set_ufs_dev_active(hba); + ++ /* Initialize devfreq */ ++ if (ufshcd_is_clkscaling_supported(hba)) { ++ memcpy(&hba->clk_scaling.saved_pwr_info.info, ++ &hba->pwr_info, ++ sizeof(struct ufs_pa_layer_attr)); ++ hba->clk_scaling.saved_pwr_info.is_valid = true; ++ hba->clk_scaling.is_allowed = true; ++ ++ err = ufshcd_devfreq_init(hba); ++ if (err) ++ goto rpm_put_sync; ++ ++ hba->clk_scaling.is_enabled = true; ++ ufshcd_init_clk_scaling_sysfs(hba); ++ } ++ + async_schedule(ufshcd_async_scan, hba); + ufs_sysfs_add_nodes(hba->dev); + + device_enable_async_suspend(dev); + return 0; + ++rpm_put_sync: ++ pm_runtime_put_sync(dev); + free_tmf_queue: + blk_mq_destroy_queue(hba->tmf_queue); + free_tmf_tag_set: +diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h +index b54f22840dabf..0ef1ec6a3b4d1 100644 +--- a/include/ufs/ufshcd.h ++++ b/include/ufs/ufshcd.h +@@ -894,6 +894,7 @@ struct ufs_hba { + struct completion *uic_async_done; + + enum ufshcd_state ufshcd_state; ++ bool logical_unit_scan_finished; + u32 eh_flags; + u32 intr_mask; + u16 ee_ctrl_mask; +-- +2.39.2 + diff --git a/queue-6.1/selftests-bpf-check-that-modifier-resolves-after-poi.patch b/queue-6.1/selftests-bpf-check-that-modifier-resolves-after-poi.patch new file mode 100644 index 00000000000..0c2e83b4e71 --- /dev/null +++ b/queue-6.1/selftests-bpf-check-that-modifier-resolves-after-poi.patch @@ -0,0 +1,63 @@ +From abbccda1934a69165b4fa224d3dbcc4ba48d2367 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 11:21:38 +0000 +Subject: selftests/bpf: check that modifier resolves after pointer + +From: Lorenz Bauer + +[ Upstream commit dfdd608c3b365f0fd49d7e13911ebcde06b9865b ] + +Add a regression test that ensures that a VAR pointing at a +modifier which follows a PTR (or STRUCT or ARRAY) is resolved +correctly by the datasec validator. + +Signed-off-by: Lorenz Bauer +Link: https://lore.kernel.org/r/20230306112138.155352-3-lmb@isovalent.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/btf.c | 28 ++++++++++++++++++++ + 1 file changed, 28 insertions(+) + +diff --git a/tools/testing/selftests/bpf/prog_tests/btf.c b/tools/testing/selftests/bpf/prog_tests/btf.c +index 24dd6214394e0..d711f4bea98ea 100644 +--- a/tools/testing/selftests/bpf/prog_tests/btf.c ++++ b/tools/testing/selftests/bpf/prog_tests/btf.c +@@ -879,6 +879,34 @@ static struct btf_raw_test raw_tests[] = { + .btf_load_err = true, + .err_str = "Invalid elem", + }, ++{ ++ .descr = "var after datasec, ptr followed by modifier", ++ .raw_types = { ++ /* .bss section */ /* [1] */ ++ BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_DATASEC, 0, 2), ++ sizeof(void*)+4), ++ BTF_VAR_SECINFO_ENC(4, 0, sizeof(void*)), ++ BTF_VAR_SECINFO_ENC(6, sizeof(void*), 4), ++ /* int */ /* [2] */ ++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), ++ /* int* */ /* [3] */ ++ BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 2), ++ BTF_VAR_ENC(NAME_TBD, 3, 0), /* [4] */ ++ /* const int */ /* [5] */ ++ BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_CONST, 0, 0), 2), ++ BTF_VAR_ENC(NAME_TBD, 5, 0), /* [6] */ ++ BTF_END_RAW, ++ }, ++ .str_sec = "\0a\0b\0c\0", ++ .str_sec_size = sizeof("\0a\0b\0c\0"), ++ .map_type = BPF_MAP_TYPE_ARRAY, ++ .map_name = ".bss", ++ .key_size = sizeof(int), ++ .value_size = sizeof(void*)+4, ++ .key_type_id = 0, ++ .value_type_id = 1, ++ .max_entries = 1, ++}, + /* Test member exceeds the size of struct. + * + * struct A { +-- +2.39.2 + diff --git a/queue-6.1/series b/queue-6.1/series index b59a5f7e0b4..ff1ed1e6324 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -113,3 +113,37 @@ thunderbolt-disable-interrupt-auto-clear-for-rings.patch thunderbolt-add-missing-unset_inbound_sbtx-for-retimer-access.patch thunderbolt-use-const-qualifier-for-ring_interrupt_index.patch thunderbolt-rename-shadowed-variables-bit-to-interrupt_bit-and-auto_clear_bit.patch +asoc-amd-yp-add-omen-by-hp-gaming-laptop-16z-n000-to.patch +scsi-ufs-core-initialize-devfreq-synchronously.patch +asoc-amd-yc-add-dmi-entries-to-support-hp-omen-16-n0.patch +acpi-x86-drop-quirk-for-hp-elitebook.patch +acpi-x86-utils-add-cezanne-to-the-list-for-forcing-s.patch +riscv-bump-command_line_size-value-to-1024.patch +drm-cirrus-null-check-pipe-plane.state-fb-in-cirrus_.patch +hid-cp2112-fix-driver-not-registering-gpio-irq-chip-.patch +ca8210-fix-mac_len-negative-array-access.patch +hid-logitech-hidpp-add-support-for-logitech-mx-maste.patch +hid-intel-ish-hid-ipc-fix-potential-use-after-free-i.patch +m68k-mm-fix-systems-with-memory-at-end-of-32-bit-add.patch +m68k-only-force-030-bus-error-if-pc-not-in-exception.patch +selftests-bpf-check-that-modifier-resolves-after-poi.patch +scsi-target-iscsi-fix-an-error-message-in-iscsi_chec.patch +scsi-qla2xxx-add-option-to-disable-fc2-target-suppor.patch +scsi-hisi_sas-check-devm_add_action-return-value.patch +scsi-ufs-core-add-soft-dependency-on-governor_simple.patch +scsi-lpfc-check-kzalloc-in-lpfc_sli4_cgn_params_read.patch +scsi-lpfc-avoid-usage-of-list-iterator-variable-afte.patch +scsi-mpi3mr-driver-unload-crashes-host-when-enhanced.patch +scsi-mpi3mr-wait-for-diagnostic-save-during-controll.patch +scsi-mpi3mr-nvme-command-size-greater-than-8k-fails.patch +scsi-mpi3mr-bad-drive-in-topology-results-kernel-cra.patch +scsi-storvsc-handle-blocksize-change-in-hyper-v-vhd-.patch +platform-x86-int3472-add-gpios-to-surface-go-3-board.patch +net-usb-cdc_mbim-avoid-altsetting-toggling-for-telit.patch +net-usb-qmi_wwan-add-telit-0x1080-composition.patch +drm-amd-display-update-clock-table-to-include-highes.patch +sh-sanitize-the-flags-on-sigreturn.patch +drm-amdgpu-fix-call-trace-warning-and-hang-when-remo.patch +drm-amd-fix-initialization-mistake-for-nbio-7.3.0.patch +net-sched-act_mirred-better-wording-on-protection-ag.patch +act_mirred-use-the-backlog-for-nested-calls-to-mirre.patch diff --git a/queue-6.1/sh-sanitize-the-flags-on-sigreturn.patch b/queue-6.1/sh-sanitize-the-flags-on-sigreturn.patch new file mode 100644 index 00000000000..93e97aeec49 --- /dev/null +++ b/queue-6.1/sh-sanitize-the-flags-on-sigreturn.patch @@ -0,0 +1,58 @@ +From b2fe5847fcc58fd182966608ff301e4f1b5f7d64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 01:20:30 +0000 +Subject: sh: sanitize the flags on sigreturn + +From: Al Viro + +[ Upstream commit 573b22ccb7ce9ab7f0539a2e11a9d3609a8783f5 ] + +We fetch %SR value from sigframe; it might have been modified by signal +handler, so we can't trust it with any bits that are not modifiable in +user mode. + +Signed-off-by: Al Viro +Cc: Rich Felker +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/sh/include/asm/processor_32.h | 1 + + arch/sh/kernel/signal_32.c | 3 +++ + 2 files changed, 4 insertions(+) + +diff --git a/arch/sh/include/asm/processor_32.h b/arch/sh/include/asm/processor_32.h +index 27aebf1e75a20..3ef7adf739c83 100644 +--- a/arch/sh/include/asm/processor_32.h ++++ b/arch/sh/include/asm/processor_32.h +@@ -50,6 +50,7 @@ + #define SR_FD 0x00008000 + #define SR_MD 0x40000000 + ++#define SR_USER_MASK 0x00000303 // M, Q, S, T bits + /* + * DSP structure and data + */ +diff --git a/arch/sh/kernel/signal_32.c b/arch/sh/kernel/signal_32.c +index 90f495d35db29..a6bfc6f374911 100644 +--- a/arch/sh/kernel/signal_32.c ++++ b/arch/sh/kernel/signal_32.c +@@ -115,6 +115,7 @@ static int + restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc, int *r0_p) + { + unsigned int err = 0; ++ unsigned int sr = regs->sr & ~SR_USER_MASK; + + #define COPY(x) err |= __get_user(regs->x, &sc->sc_##x) + COPY(regs[1]); +@@ -130,6 +131,8 @@ restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc, int *r0_p + COPY(sr); COPY(pc); + #undef COPY + ++ regs->sr = (regs->sr & SR_USER_MASK) | sr; ++ + #ifdef CONFIG_SH_FPU + if (boot_cpu_data.flags & CPU_HAS_FPU) { + int owned_fp; +-- +2.39.2 +