From: Sasha Levin Date: Mon, 13 Mar 2023 12:06:05 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v4.14.310~87^2~2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=382a38eac687c5866d62eb387c15dac2d5ddd735;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/arm-dts-exynos-add-gpu-thermal-zone-cooling-maps-for.patch b/queue-5.4/arm-dts-exynos-add-gpu-thermal-zone-cooling-maps-for.patch new file mode 100644 index 00000000000..31528a768f8 --- /dev/null +++ b/queue-5.4/arm-dts-exynos-add-gpu-thermal-zone-cooling-maps-for.patch @@ -0,0 +1,137 @@ +From ee4b1d5dc30f85c5aad0d30cadc62156bdacfbfb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jan 2020 08:05:10 +0100 +Subject: ARM: dts: exynos: Add GPU thermal zone cooling maps for Odroid + XU3/XU4/HC1 + +From: Marek Szyprowski + +[ Upstream commit 1c651356f482ff08f6acef197a362f2e71d55a98 ] + +Add trip points and cooling maps for GPU thermal zone for Odroid +XU3/XU4/HC1 boards. Trip points are based on the CPU thermal zone for the +those boards. + +Signed-off-by: Marek Szyprowski +Signed-off-by: Krzysztof Kozlowski +Stable-dep-of: 2e3d0e20d845 ("ARM: dts: exynos: correct TMU phandle in Odroid HC1") +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5422-odroidhc1.dts | 30 ++++++++++ + .../boot/dts/exynos5422-odroidxu3-common.dtsi | 59 +++++++++++++++++++ + 2 files changed, 89 insertions(+) + +diff --git a/arch/arm/boot/dts/exynos5422-odroidhc1.dts b/arch/arm/boot/dts/exynos5422-odroidhc1.dts +index fce5a4579693e..3235d7a27e042 100644 +--- a/arch/arm/boot/dts/exynos5422-odroidhc1.dts ++++ b/arch/arm/boot/dts/exynos5422-odroidhc1.dts +@@ -215,6 +215,36 @@ + }; + }; + }; ++ gpu_thermal: gpu-thermal { ++ thermal-sensors = <&tmu_gpu 0>; ++ trips { ++ gpu_alert0: gpu-alert-0 { ++ temperature = <70000>; ++ hysteresis = <10000>; ++ type = "active"; ++ }; ++ gpu_alert1: gpu-alert-1 { ++ temperature = <85000>; ++ hysteresis = <10000>; ++ type = "active"; ++ }; ++ gpu_crit0: gpu-crit-0 { ++ temperature = <120000>; ++ hysteresis = <0>; ++ type = "critical"; ++ }; ++ }; ++ cooling-maps { ++ map0 { ++ trip = <&gpu_alert0>; ++ cooling-device = <&gpu 0 2>; ++ }; ++ map1 { ++ trip = <&gpu_alert1>; ++ cooling-device = <&gpu 3 6>; ++ }; ++ }; ++ }; + }; + + }; +diff --git a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi +index 8388720374932..5cf48af9884c9 100644 +--- a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi ++++ b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi +@@ -357,6 +357,65 @@ + }; + }; + }; ++ gpu_thermal: gpu-thermal { ++ thermal-sensors = <&tmu_gpu 0>; ++ polling-delay-passive = <250>; ++ polling-delay = <0>; ++ trips { ++ gpu_alert0: gpu-alert-0 { ++ temperature = <50000>; ++ hysteresis = <5000>; ++ type = "active"; ++ }; ++ gpu_alert1: gpu-alert-1 { ++ temperature = <60000>; ++ hysteresis = <5000>; ++ type = "active"; ++ }; ++ gpu_alert2: gpu-alert-2 { ++ temperature = <70000>; ++ hysteresis = <5000>; ++ type = "active"; ++ }; ++ gpu_crit0: gpu-crit-0 { ++ temperature = <120000>; ++ hysteresis = <0>; ++ type = "critical"; ++ }; ++ gpu_alert3: gpu-alert-3 { ++ temperature = <70000>; ++ hysteresis = <10000>; ++ type = "passive"; ++ }; ++ gpu_alert4: gpu-alert-4 { ++ temperature = <85000>; ++ hysteresis = <10000>; ++ type = "passive"; ++ }; ++ }; ++ cooling-maps { ++ map0 { ++ trip = <&gpu_alert0>; ++ cooling-device = <&fan0 0 1>; ++ }; ++ map1 { ++ trip = <&gpu_alert1>; ++ cooling-device = <&fan0 1 2>; ++ }; ++ map2 { ++ trip = <&gpu_alert2>; ++ cooling-device = <&fan0 2 3>; ++ }; ++ map3 { ++ trip = <&gpu_alert3>; ++ cooling-device = <&gpu 0 2>; ++ }; ++ map4 { ++ trip = <&gpu_alert4>; ++ cooling-device = <&gpu 3 6>; ++ }; ++ }; ++ }; + }; + }; + +-- +2.39.2 + diff --git a/queue-5.4/arm-dts-exynos-correct-tmu-phandle-in-exynos4210.patch b/queue-5.4/arm-dts-exynos-correct-tmu-phandle-in-exynos4210.patch new file mode 100644 index 00000000000..860ebb99044 --- /dev/null +++ b/queue-5.4/arm-dts-exynos-correct-tmu-phandle-in-exynos4210.patch @@ -0,0 +1,38 @@ +From dda521d9a0e34c1362fc51dca2de53c634d2f9fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Feb 2023 11:58:37 +0100 +Subject: ARM: dts: exynos: correct TMU phandle in Exynos4210 + +From: Krzysztof Kozlowski + +[ Upstream commit 408ab6786dbf6dd696488054c9559681112ef994 ] + +TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing +it must not have an argument to phandle. Since thermal-sensors property is +already defined in included exynos4-cpu-thermal.dtsi, drop it from +exynos4210.dtsi to fix the error and remoev redundancy. + +Fixes: 9843a2236003 ("ARM: dts: Provide dt bindings identical for Exynos TMU") +Cc: +Link: https://lore.kernel.org/r/20230209105841.779596-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos4210.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos4210.dtsi b/arch/arm/boot/dts/exynos4210.dtsi +index d341dcad8da6d..505b49118d2cf 100644 +--- a/arch/arm/boot/dts/exynos4210.dtsi ++++ b/arch/arm/boot/dts/exynos4210.dtsi +@@ -389,7 +389,6 @@ + &cpu_thermal { + polling-delay-passive = <0>; + polling-delay = <0>; +- thermal-sensors = <&tmu 0>; + }; + + &gic { +-- +2.39.2 + diff --git a/queue-5.4/arm-dts-exynos-correct-tmu-phandle-in-exynos5250.patch b/queue-5.4/arm-dts-exynos-correct-tmu-phandle-in-exynos5250.patch new file mode 100644 index 00000000000..0ec36522bac --- /dev/null +++ b/queue-5.4/arm-dts-exynos-correct-tmu-phandle-in-exynos5250.patch @@ -0,0 +1,37 @@ +From 9cc944cbe9d2b6375898acea3f438298ffd47456 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Feb 2023 11:58:38 +0100 +Subject: ARM: dts: exynos: correct TMU phandle in Exynos5250 + +From: Krzysztof Kozlowski + +[ Upstream commit 33e2c595e2e4016991ead44933a29d1ef93d5f26 ] + +TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing +it must not have an argument to phandle. + +Cc: +Fixes: 9843a2236003 ("ARM: dts: Provide dt bindings identical for Exynos TMU") +Link: https://lore.kernel.org/r/20230209105841.779596-3-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5250.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi +index 624fa234e7175..d5eccc86f5f78 100644 +--- a/arch/arm/boot/dts/exynos5250.dtsi ++++ b/arch/arm/boot/dts/exynos5250.dtsi +@@ -1122,7 +1122,7 @@ + &cpu_thermal { + polling-delay-passive = <0>; + polling-delay = <0>; +- thermal-sensors = <&tmu 0>; ++ thermal-sensors = <&tmu>; + + cooling-maps { + map0 { +-- +2.39.2 + diff --git a/queue-5.4/arm-dts-exynos-correct-tmu-phandle-in-odroid-hc1.patch b/queue-5.4/arm-dts-exynos-correct-tmu-phandle-in-odroid-hc1.patch new file mode 100644 index 00000000000..7c102f57688 --- /dev/null +++ b/queue-5.4/arm-dts-exynos-correct-tmu-phandle-in-odroid-hc1.patch @@ -0,0 +1,82 @@ +From 0e21b33a5076396bbb70c3b0c2965d3c17569400 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Feb 2023 11:58:40 +0100 +Subject: ARM: dts: exynos: correct TMU phandle in Odroid HC1 + +From: Krzysztof Kozlowski + +[ Upstream commit 2e3d0e20d8456f876607a8af61fdb83dfbf98cb6 ] + +TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing +it must not have an argument to phandle. This was not critical before, +but since rework of thermal Devicetree initialization in the +commit 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree +initialization"), this leads to errors registering thermal zones other +than first one: + + thermal_sys: cpu0-thermal: Failed to read thermal-sensors cells: -2 + thermal_sys: Failed to find thermal zone for tmu id=0 + exynos-tmu 10064000.tmu: Failed to register sensor: -2 + exynos-tmu: probe of 10064000.tmu failed with error -2 + +Fixes: 1ac49427b566 ("ARM: dts: exynos: Add support for Hardkernel's Odroid HC1 board") +Cc: +Link: https://lore.kernel.org/r/20230209105841.779596-5-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5422-odroidhc1.dts | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/boot/dts/exynos5422-odroidhc1.dts b/arch/arm/boot/dts/exynos5422-odroidhc1.dts +index 3235d7a27e042..b423cea4c0e99 100644 +--- a/arch/arm/boot/dts/exynos5422-odroidhc1.dts ++++ b/arch/arm/boot/dts/exynos5422-odroidhc1.dts +@@ -29,7 +29,7 @@ + + thermal-zones { + cpu0_thermal: cpu0-thermal { +- thermal-sensors = <&tmu_cpu0 0>; ++ thermal-sensors = <&tmu_cpu0>; + trips { + cpu0_alert0: cpu-alert-0 { + temperature = <70000>; /* millicelsius */ +@@ -84,7 +84,7 @@ + }; + }; + cpu1_thermal: cpu1-thermal { +- thermal-sensors = <&tmu_cpu1 0>; ++ thermal-sensors = <&tmu_cpu1>; + trips { + cpu1_alert0: cpu-alert-0 { + temperature = <70000>; +@@ -128,7 +128,7 @@ + }; + }; + cpu2_thermal: cpu2-thermal { +- thermal-sensors = <&tmu_cpu2 0>; ++ thermal-sensors = <&tmu_cpu2>; + trips { + cpu2_alert0: cpu-alert-0 { + temperature = <70000>; +@@ -172,7 +172,7 @@ + }; + }; + cpu3_thermal: cpu3-thermal { +- thermal-sensors = <&tmu_cpu3 0>; ++ thermal-sensors = <&tmu_cpu3>; + trips { + cpu3_alert0: cpu-alert-0 { + temperature = <70000>; +@@ -216,7 +216,7 @@ + }; + }; + gpu_thermal: gpu-thermal { +- thermal-sensors = <&tmu_gpu 0>; ++ thermal-sensors = <&tmu_gpu>; + trips { + gpu_alert0: gpu-alert-0 { + temperature = <70000>; +-- +2.39.2 + diff --git a/queue-5.4/arm-dts-exynos-correct-tmu-phandle-in-odroid-xu3-fam.patch b/queue-5.4/arm-dts-exynos-correct-tmu-phandle-in-odroid-xu3-fam.patch new file mode 100644 index 00000000000..59ddd381062 --- /dev/null +++ b/queue-5.4/arm-dts-exynos-correct-tmu-phandle-in-odroid-xu3-fam.patch @@ -0,0 +1,82 @@ +From fe2530507d6df156cf4b5ac64c445890ed15d693 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Feb 2023 11:58:41 +0100 +Subject: ARM: dts: exynos: correct TMU phandle in Odroid XU3 family + +From: Krzysztof Kozlowski + +[ Upstream commit a3583e92d188ec6c58c7f603ac5e72dd8a11c21a ] + +TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing +it must not have an argument to phandle. This was not critical before, +but since rework of thermal Devicetree initialization in the +commit 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree +initialization"), this leads to errors registering thermal zones other +than first one: + + thermal_sys: cpu0-thermal: Failed to read thermal-sensors cells: -2 + thermal_sys: Failed to find thermal zone for tmu id=0 + exynos-tmu 10064000.tmu: Failed to register sensor: -2 + exynos-tmu: probe of 10064000.tmu failed with error -2 + +Fixes: f1722d7dd8b8 ("ARM: dts: Define default thermal-zones for exynos5422") +Cc: +Link: https://lore.kernel.org/r/20230209105841.779596-6-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi +index 5cf48af9884c9..56a0e1eba36fc 100644 +--- a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi ++++ b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi +@@ -50,7 +50,7 @@ + + thermal-zones { + cpu0_thermal: cpu0-thermal { +- thermal-sensors = <&tmu_cpu0 0>; ++ thermal-sensors = <&tmu_cpu0>; + polling-delay-passive = <250>; + polling-delay = <0>; + trips { +@@ -139,7 +139,7 @@ + }; + }; + cpu1_thermal: cpu1-thermal { +- thermal-sensors = <&tmu_cpu1 0>; ++ thermal-sensors = <&tmu_cpu1>; + polling-delay-passive = <250>; + polling-delay = <0>; + trips { +@@ -212,7 +212,7 @@ + }; + }; + cpu2_thermal: cpu2-thermal { +- thermal-sensors = <&tmu_cpu2 0>; ++ thermal-sensors = <&tmu_cpu2>; + polling-delay-passive = <250>; + polling-delay = <0>; + trips { +@@ -285,7 +285,7 @@ + }; + }; + cpu3_thermal: cpu3-thermal { +- thermal-sensors = <&tmu_cpu3 0>; ++ thermal-sensors = <&tmu_cpu3>; + polling-delay-passive = <250>; + polling-delay = <0>; + trips { +@@ -358,7 +358,7 @@ + }; + }; + gpu_thermal: gpu-thermal { +- thermal-sensors = <&tmu_gpu 0>; ++ thermal-sensors = <&tmu_gpu>; + polling-delay-passive = <250>; + polling-delay = <0>; + trips { +-- +2.39.2 + diff --git a/queue-5.4/arm-dts-exynos-override-thermal-by-label-in-exynos42.patch b/queue-5.4/arm-dts-exynos-override-thermal-by-label-in-exynos42.patch new file mode 100644 index 00000000000..7cbf62c71ca --- /dev/null +++ b/queue-5.4/arm-dts-exynos-override-thermal-by-label-in-exynos42.patch @@ -0,0 +1,76 @@ +From 4572182b40a2be85d99e32e7a5866202912dfd07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Aug 2020 15:51:43 +0200 +Subject: ARM: dts: exynos: Override thermal by label in Exynos4210 + +From: Krzysztof Kozlowski + +[ Upstream commit 1708f56081e239a29ed8646aa7fde6853235d93f ] + +Using full paths to extend or override a device tree node is error prone +since if there was a typo error, a new node will be created instead of +extending the node as it was desired. This will lead to run-time errors +that could be hard to detect. + +A mistyped label on the other hand, will cause a dtc compile error +(during build time). + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20200830135200.24304-16-krzk@kernel.org +Stable-dep-of: 408ab6786dbf ("ARM: dts: exynos: correct TMU phandle in Exynos4210") +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos4210.dtsi | 36 +++++++++++++++---------------- + 1 file changed, 17 insertions(+), 19 deletions(-) + +diff --git a/arch/arm/boot/dts/exynos4210.dtsi b/arch/arm/boot/dts/exynos4210.dtsi +index f220716239dbf..d341dcad8da6d 100644 +--- a/arch/arm/boot/dts/exynos4210.dtsi ++++ b/arch/arm/boot/dts/exynos4210.dtsi +@@ -372,26 +372,24 @@ + }; + }; + }; ++}; + +- thermal-zones { +- cpu_thermal: cpu-thermal { +- polling-delay-passive = <0>; +- polling-delay = <0>; +- thermal-sensors = <&tmu 0>; +- +- trips { +- cpu_alert0: cpu-alert-0 { +- temperature = <85000>; /* millicelsius */ +- }; +- cpu_alert1: cpu-alert-1 { +- temperature = <100000>; /* millicelsius */ +- }; +- cpu_alert2: cpu-alert-2 { +- temperature = <110000>; /* millicelsius */ +- }; +- }; +- }; +- }; ++&cpu_alert0 { ++ temperature = <85000>; /* millicelsius */ ++}; ++ ++&cpu_alert1 { ++ temperature = <100000>; /* millicelsius */ ++}; ++ ++&cpu_alert2 { ++ temperature = <110000>; /* millicelsius */ ++}; ++ ++&cpu_thermal { ++ polling-delay-passive = <0>; ++ polling-delay = <0>; ++ thermal-sensors = <&tmu 0>; + }; + + &gic { +-- +2.39.2 + diff --git a/queue-5.4/arm-dts-exynos-override-thermal-by-label-in-exynos52.patch b/queue-5.4/arm-dts-exynos-override-thermal-by-label-in-exynos52.patch new file mode 100644 index 00000000000..54b940edecc --- /dev/null +++ b/queue-5.4/arm-dts-exynos-override-thermal-by-label-in-exynos52.patch @@ -0,0 +1,84 @@ +From f5f62ff385b0977362ad4ef89affd9a38ed0a7f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Sep 2020 09:54:11 +0200 +Subject: ARM: dts: exynos: Override thermal by label in Exynos5250 + +From: Krzysztof Kozlowski + +[ Upstream commit 7e86ef5cc89609cbad8b9dd2f476789c638dbb92 ] + +Using full paths to extend or override a device tree node is error prone +since if there was a typo error, a new node will be created instead of +extending the node as it was desired. This will lead to run-time errors +that could be hard to detect. + +A mistyped label on the other hand, will cause a dtc compile error +(during build time). + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20200901075417.22481-8-krzk@kernel.org +Stable-dep-of: 33e2c595e2e4 ("ARM: dts: exynos: correct TMU phandle in Exynos5250") +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5250.dtsi | 38 +++++++++++++++---------------- + 1 file changed, 18 insertions(+), 20 deletions(-) + +diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi +index fc966c10cf498..624fa234e7175 100644 +--- a/arch/arm/boot/dts/exynos5250.dtsi ++++ b/arch/arm/boot/dts/exynos5250.dtsi +@@ -1104,26 +1104,6 @@ + }; + }; + +- thermal-zones { +- cpu_thermal: cpu-thermal { +- polling-delay-passive = <0>; +- polling-delay = <0>; +- thermal-sensors = <&tmu 0>; +- +- cooling-maps { +- map0 { +- /* Corresponds to 800MHz at freq_table */ +- cooling-device = <&cpu0 9 9>, <&cpu1 9 9>; +- }; +- map1 { +- /* Corresponds to 200MHz at freq_table */ +- cooling-device = <&cpu0 15 15>, +- <&cpu1 15 15>; +- }; +- }; +- }; +- }; +- + timer { + compatible = "arm,armv7-timer"; + interrupts = , +@@ -1139,6 +1119,24 @@ + }; + }; + ++&cpu_thermal { ++ polling-delay-passive = <0>; ++ polling-delay = <0>; ++ thermal-sensors = <&tmu 0>; ++ ++ cooling-maps { ++ map0 { ++ /* Corresponds to 800MHz at freq_table */ ++ cooling-device = <&cpu0 9 9>, <&cpu1 9 9>; ++ }; ++ map1 { ++ /* Corresponds to 200MHz at freq_table */ ++ cooling-device = <&cpu0 15 15>, ++ <&cpu1 15 15>; ++ }; ++ }; ++}; ++ + &dp { + power-domains = <&pd_disp1>; + clocks = <&clock CLK_DP>; +-- +2.39.2 + diff --git a/queue-5.4/bnxt_en-avoid-order-5-memory-allocation-for-tpa-data.patch b/queue-5.4/bnxt_en-avoid-order-5-memory-allocation-for-tpa-data.patch new file mode 100644 index 00000000000..13d27eb3cfa --- /dev/null +++ b/queue-5.4/bnxt_en-avoid-order-5-memory-allocation-for-tpa-data.patch @@ -0,0 +1,114 @@ +From c83e31d83a97f44d1cff57d197d049e0be78df1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 18:43:57 -0800 +Subject: bnxt_en: Avoid order-5 memory allocation for TPA data + +From: Michael Chan + +[ Upstream commit accd7e23693aaaa9aa0d3e9eca0ae77d1be80ab3 ] + +The driver needs to keep track of all the possible concurrent TPA (GRO/LRO) +completions on the aggregation ring. On P5 chips, the maximum number +of concurrent TPA is 256 and the amount of memory we allocate is order-5 +on systems using 4K pages. Memory allocation failure has been reported: + +NetworkManager: page allocation failure: order:5, mode:0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 +CPU: 15 PID: 2995 Comm: NetworkManager Kdump: loaded Not tainted 5.10.156 #1 +Hardware name: Dell Inc. PowerEdge R660/0M1CC5, BIOS 0.2.25 08/12/2022 +Call Trace: + dump_stack+0x57/0x6e + warn_alloc.cold.120+0x7b/0xdd + ? _cond_resched+0x15/0x30 + ? __alloc_pages_direct_compact+0x15f/0x170 + __alloc_pages_slowpath.constprop.108+0xc58/0xc70 + __alloc_pages_nodemask+0x2d0/0x300 + kmalloc_order+0x24/0xe0 + kmalloc_order_trace+0x19/0x80 + bnxt_alloc_mem+0x1150/0x15c0 [bnxt_en] + ? bnxt_get_func_stat_ctxs+0x13/0x60 [bnxt_en] + __bnxt_open_nic+0x12e/0x780 [bnxt_en] + bnxt_open+0x10b/0x240 [bnxt_en] + __dev_open+0xe9/0x180 + __dev_change_flags+0x1af/0x220 + dev_change_flags+0x21/0x60 + do_setlink+0x35c/0x1100 + +Instead of allocating this big chunk of memory and dividing it up for the +concurrent TPA instances, allocate each small chunk separately for each +TPA instance. This will reduce it to order-0 allocations. + +Fixes: 79632e9ba386 ("bnxt_en: Expand bnxt_tpa_info struct to support 57500 chips.") +Reviewed-by: Somnath Kotur +Reviewed-by: Damodharam Ammepalli +Reviewed-by: Pavan Chebbi +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index ef8225b7445d3..9fb1da36e9eb8 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -2747,7 +2747,7 @@ static int bnxt_alloc_ring(struct bnxt *bp, struct bnxt_ring_mem_info *rmem) + + static void bnxt_free_tpa_info(struct bnxt *bp) + { +- int i; ++ int i, j; + + for (i = 0; i < bp->rx_nr_rings; i++) { + struct bnxt_rx_ring_info *rxr = &bp->rx_ring[i]; +@@ -2755,8 +2755,10 @@ static void bnxt_free_tpa_info(struct bnxt *bp) + kfree(rxr->rx_tpa_idx_map); + rxr->rx_tpa_idx_map = NULL; + if (rxr->rx_tpa) { +- kfree(rxr->rx_tpa[0].agg_arr); +- rxr->rx_tpa[0].agg_arr = NULL; ++ for (j = 0; j < bp->max_tpa; j++) { ++ kfree(rxr->rx_tpa[j].agg_arr); ++ rxr->rx_tpa[j].agg_arr = NULL; ++ } + } + kfree(rxr->rx_tpa); + rxr->rx_tpa = NULL; +@@ -2765,14 +2767,13 @@ static void bnxt_free_tpa_info(struct bnxt *bp) + + static int bnxt_alloc_tpa_info(struct bnxt *bp) + { +- int i, j, total_aggs = 0; ++ int i, j; + + bp->max_tpa = MAX_TPA; + if (bp->flags & BNXT_FLAG_CHIP_P5) { + if (!bp->max_tpa_v2) + return 0; + bp->max_tpa = max_t(u16, bp->max_tpa_v2, MAX_TPA_P5); +- total_aggs = bp->max_tpa * MAX_SKB_FRAGS; + } + + for (i = 0; i < bp->rx_nr_rings; i++) { +@@ -2786,12 +2787,12 @@ static int bnxt_alloc_tpa_info(struct bnxt *bp) + + if (!(bp->flags & BNXT_FLAG_CHIP_P5)) + continue; +- agg = kcalloc(total_aggs, sizeof(*agg), GFP_KERNEL); +- rxr->rx_tpa[0].agg_arr = agg; +- if (!agg) +- return -ENOMEM; +- for (j = 1; j < bp->max_tpa; j++) +- rxr->rx_tpa[j].agg_arr = agg + j * MAX_SKB_FRAGS; ++ for (j = 0; j < bp->max_tpa; j++) { ++ agg = kcalloc(MAX_SKB_FRAGS, sizeof(*agg), GFP_KERNEL); ++ if (!agg) ++ return -ENOMEM; ++ rxr->rx_tpa[j].agg_arr = agg; ++ } + rxr->rx_tpa_idx_map = kzalloc(sizeof(*rxr->rx_tpa_idx_map), + GFP_KERNEL); + if (!rxr->rx_tpa_idx_map) +-- +2.39.2 + diff --git a/queue-5.4/btf-fix-resolving-btf_kind_var-after-array-struct-un.patch b/queue-5.4/btf-fix-resolving-btf_kind_var-after-array-struct-un.patch new file mode 100644 index 00000000000..709cc37327d --- /dev/null +++ b/queue-5.4/btf-fix-resolving-btf_kind_var-after-array-struct-un.patch @@ -0,0 +1,98 @@ +From 6f2a5556308d2c3241de2fda7133c263435e3f3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 11:21:37 +0000 +Subject: btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR + +From: Lorenz Bauer + +[ Upstream commit 9b459804ff9973e173fabafba2a1319f771e85fa ] + +btf_datasec_resolve contains a bug that causes the following BTF +to fail loading: + + [1] DATASEC a size=2 vlen=2 + type_id=4 offset=0 size=1 + type_id=7 offset=1 size=1 + [2] INT (anon) size=1 bits_offset=0 nr_bits=8 encoding=(none) + [3] PTR (anon) type_id=2 + [4] VAR a type_id=3 linkage=0 + [5] INT (anon) size=1 bits_offset=0 nr_bits=8 encoding=(none) + [6] TYPEDEF td type_id=5 + [7] VAR b type_id=6 linkage=0 + +This error message is printed during btf_check_all_types: + + [1] DATASEC a size=2 vlen=2 + type_id=7 offset=1 size=1 Invalid type + +By tracing btf_*_resolve we can pinpoint the problem: + + btf_datasec_resolve(depth: 1, type_id: 1, mode: RESOLVE_TBD) = 0 + btf_var_resolve(depth: 2, type_id: 4, mode: RESOLVE_TBD) = 0 + btf_ptr_resolve(depth: 3, type_id: 3, mode: RESOLVE_PTR) = 0 + btf_var_resolve(depth: 2, type_id: 4, mode: RESOLVE_PTR) = 0 + btf_datasec_resolve(depth: 1, type_id: 1, mode: RESOLVE_PTR) = -22 + +The last invocation of btf_datasec_resolve should invoke btf_var_resolve +by means of env_stack_push, instead it returns EINVAL. The reason is that +env_stack_push is never executed for the second VAR. + + if (!env_type_is_resolve_sink(env, var_type) && + !env_type_is_resolved(env, var_type_id)) { + env_stack_set_next_member(env, i + 1); + return env_stack_push(env, var_type, var_type_id); + } + +env_type_is_resolve_sink() changes its behaviour based on resolve_mode. +For RESOLVE_PTR, we can simplify the if condition to the following: + + (btf_type_is_modifier() || btf_type_is_ptr) && !env_type_is_resolved() + +Since we're dealing with a VAR the clause evaluates to false. This is +not sufficient to trigger the bug however. The log output and EINVAL +are only generated if btf_type_id_size() fails. + + if (!btf_type_id_size(btf, &type_id, &type_size)) { + btf_verifier_log_vsi(env, v->t, vsi, "Invalid type"); + return -EINVAL; + } + +Most types are sized, so for example a VAR referring to an INT is not a +problem. The bug is only triggered if a VAR points at a modifier. Since +we skipped btf_var_resolve that modifier was also never resolved, which +means that btf_resolved_type_id returns 0 aka VOID for the modifier. +This in turn causes btf_type_id_size to return NULL, triggering EINVAL. + +To summarise, the following conditions are necessary: + +- VAR pointing at PTR, STRUCT, UNION or ARRAY +- Followed by a VAR pointing at TYPEDEF, VOLATILE, CONST, RESTRICT or + TYPE_TAG + +The fix is to reset resolve_mode to RESOLVE_TBD before attempting to +resolve a VAR from a DATASEC. + +Fixes: 1dc92851849c ("bpf: kernel side support for BTF Var and DataSec") +Signed-off-by: Lorenz Bauer +Link: https://lore.kernel.org/r/20230306112138.155352-2-lmb@isovalent.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + kernel/bpf/btf.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index 8fd65a0eb7f3e..5189bc5ebd895 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -2719,6 +2719,7 @@ static int btf_datasec_resolve(struct btf_verifier_env *env, + struct btf *btf = env->btf; + u16 i; + ++ env->resolve_mode = RESOLVE_TBD; + for_each_vsi_from(i, v->next_member, v->t, vsi) { + u32 var_type_id = vsi->type, type_id, type_size = 0; + const struct btf_type *var_type = btf_type_by_id(env->btf, +-- +2.39.2 + diff --git a/queue-5.4/cifs-fix-uninitialized-memory-read-in-smb3_qfs_tcon.patch b/queue-5.4/cifs-fix-uninitialized-memory-read-in-smb3_qfs_tcon.patch new file mode 100644 index 00000000000..6265e6d7cc8 --- /dev/null +++ b/queue-5.4/cifs-fix-uninitialized-memory-read-in-smb3_qfs_tcon.patch @@ -0,0 +1,47 @@ +From b4b58b11649d72a227b7cf4eb191132028693f52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 12:37:58 +0100 +Subject: cifs: Fix uninitialized memory read in smb3_qfs_tcon() + +From: Volker Lendecke + +[ Upstream commit d447e794a37288ec7a080aa1b044a8d9deebbab7 ] + +oparms was not fully initialized + +Signed-off-by: Volker Lendecke +Reviewed-by: Paulo Alcantara (SUSE) +Cc: stable@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/smb2ops.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index a3bb2c7468c75..4cb0ebe7330eb 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -823,12 +823,13 @@ smb3_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon, + struct cifs_fid fid; + bool no_cached_open = tcon->nohandlecache; + +- oparms.tcon = tcon; +- oparms.desired_access = FILE_READ_ATTRIBUTES; +- oparms.disposition = FILE_OPEN; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = FILE_READ_ATTRIBUTES, ++ .disposition = FILE_OPEN, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .fid = &fid, ++ }; + + if (no_cached_open) + rc = SMB2_open(xid, &oparms, &srch_path, &oplock, NULL, NULL, +-- +2.39.2 + diff --git a/queue-5.4/drm-edid-add-aspect-ratios-to-hdmi-4k-modes.patch b/queue-5.4/drm-edid-add-aspect-ratios-to-hdmi-4k-modes.patch new file mode 100644 index 00000000000..bb3a00b83e5 --- /dev/null +++ b/queue-5.4/drm-edid-add-aspect-ratios-to-hdmi-4k-modes.patch @@ -0,0 +1,171 @@ +From 66bafaa0a6491d056b102bf4dad574203995755f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Nov 2019 18:18:31 +0800 +Subject: drm/edid: Add aspect ratios to HDMI 4K modes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Wayne Lin + +[ Upstream commit d2b434730f301a7ad74473eb66422f0008186306 ] + +[Why] +HDMI 2.0 adds aspect ratio attribute to distinguish different +4k modes. According to Appendix E of HDMI 2.0 spec, source should +use VSIF to indicate video mode only when the mode is one defined +in HDMI 1.4b 4K modes. Otherwise, use AVI infoframes to convey VIC. + +Current code doesn't take aspect ratio into consideration while +constructing avi infoframe. Should modify that. + +[How] +Inherit Ville Syrjälä's work +"drm/edid: Prep for HDMI VIC aspect ratio" at +https://patchwork.kernel.org/patch/11174639/ + +Add picture_aspect_ratio attributes to edid_4k_modes[] and +construct VIC and HDMI_VIC by taking aspect ratio into +consideration. + +v2: Correct missing initializer error at adding aspect ratio of +SMPTE mode. + +Signed-off-by: Wayne Lin +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20191118101832.15487-1-Wayne.Lin@amd.com +Stable-dep-of: 1cbc1f0d324b ("drm/edid: fix AVI infoframe aspect ratio handling") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_edid.c | 45 +++++++++++++++++++++++++++++--------- + 1 file changed, 35 insertions(+), 10 deletions(-) + +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index 245e495f57c93..f9735861741c1 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -1292,25 +1292,25 @@ static const struct drm_display_mode edid_4k_modes[] = { + 3840, 4016, 4104, 4400, 0, + 2160, 2168, 2178, 2250, 0, + DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC), +- .vrefresh = 30, }, ++ .vrefresh = 30, .picture_aspect_ratio = HDMI_PICTURE_ASPECT_16_9, }, + /* 2 - 3840x2160@25Hz */ + { DRM_MODE("3840x2160", DRM_MODE_TYPE_DRIVER, 297000, + 3840, 4896, 4984, 5280, 0, + 2160, 2168, 2178, 2250, 0, + DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC), +- .vrefresh = 25, }, ++ .vrefresh = 25, .picture_aspect_ratio = HDMI_PICTURE_ASPECT_16_9, }, + /* 3 - 3840x2160@24Hz */ + { DRM_MODE("3840x2160", DRM_MODE_TYPE_DRIVER, 297000, + 3840, 5116, 5204, 5500, 0, + 2160, 2168, 2178, 2250, 0, + DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC), +- .vrefresh = 24, }, ++ .vrefresh = 24, .picture_aspect_ratio = HDMI_PICTURE_ASPECT_16_9, }, + /* 4 - 4096x2160@24Hz (SMPTE) */ + { DRM_MODE("4096x2160", DRM_MODE_TYPE_DRIVER, 297000, + 4096, 5116, 5204, 5500, 0, + 2160, 2168, 2178, 2250, 0, + DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC), +- .vrefresh = 24, }, ++ .vrefresh = 24, .picture_aspect_ratio = HDMI_PICTURE_ASPECT_256_135, }, + }; + + /*** DDC fetch and block validation ***/ +@@ -3122,6 +3122,11 @@ enum hdmi_picture_aspect drm_get_cea_aspect_ratio(const u8 video_code) + } + EXPORT_SYMBOL(drm_get_cea_aspect_ratio); + ++static enum hdmi_picture_aspect drm_get_hdmi_aspect_ratio(const u8 video_code) ++{ ++ return edid_4k_modes[video_code].picture_aspect_ratio; ++} ++ + /* + * Calculate the alternate clock for HDMI modes (those from the HDMI vendor + * specific block). +@@ -3148,6 +3153,9 @@ static u8 drm_match_hdmi_mode_clock_tolerance(const struct drm_display_mode *to_ + if (!to_match->clock) + return 0; + ++ if (to_match->picture_aspect_ratio) ++ match_flags |= DRM_MODE_MATCH_ASPECT_RATIO; ++ + for (vic = 1; vic < ARRAY_SIZE(edid_4k_modes); vic++) { + const struct drm_display_mode *hdmi_mode = &edid_4k_modes[vic]; + unsigned int clock1, clock2; +@@ -3183,6 +3191,9 @@ static u8 drm_match_hdmi_mode(const struct drm_display_mode *to_match) + if (!to_match->clock) + return 0; + ++ if (to_match->picture_aspect_ratio) ++ match_flags |= DRM_MODE_MATCH_ASPECT_RATIO; ++ + for (vic = 1; vic < ARRAY_SIZE(edid_4k_modes); vic++) { + const struct drm_display_mode *hdmi_mode = &edid_4k_modes[vic]; + unsigned int clock1, clock2; +@@ -5123,6 +5134,7 @@ drm_hdmi_avi_infoframe_from_display_mode(struct hdmi_avi_infoframe *frame, + const struct drm_display_mode *mode) + { + enum hdmi_picture_aspect picture_aspect; ++ u8 vic, hdmi_vic; + int err; + + if (!frame || !mode) +@@ -5135,7 +5147,8 @@ drm_hdmi_avi_infoframe_from_display_mode(struct hdmi_avi_infoframe *frame, + if (mode->flags & DRM_MODE_FLAG_DBLCLK) + frame->pixel_repeat = 1; + +- frame->video_code = drm_mode_cea_vic(connector, mode); ++ vic = drm_mode_cea_vic(connector, mode); ++ hdmi_vic = drm_mode_hdmi_vic(connector, mode); + + frame->picture_aspect = HDMI_PICTURE_ASPECT_NONE; + +@@ -5149,11 +5162,15 @@ drm_hdmi_avi_infoframe_from_display_mode(struct hdmi_avi_infoframe *frame, + + /* + * Populate picture aspect ratio from either +- * user input (if specified) or from the CEA mode list. ++ * user input (if specified) or from the CEA/HDMI mode lists. + */ + picture_aspect = mode->picture_aspect_ratio; +- if (picture_aspect == HDMI_PICTURE_ASPECT_NONE) +- picture_aspect = drm_get_cea_aspect_ratio(frame->video_code); ++ if (picture_aspect == HDMI_PICTURE_ASPECT_NONE) { ++ if (vic) ++ picture_aspect = drm_get_cea_aspect_ratio(vic); ++ else if (hdmi_vic) ++ picture_aspect = drm_get_hdmi_aspect_ratio(hdmi_vic); ++ } + + /* + * The infoframe can't convey anything but none, 4:3 +@@ -5161,12 +5178,20 @@ drm_hdmi_avi_infoframe_from_display_mode(struct hdmi_avi_infoframe *frame, + * we can only satisfy it by specifying the right VIC. + */ + if (picture_aspect > HDMI_PICTURE_ASPECT_16_9) { +- if (picture_aspect != +- drm_get_cea_aspect_ratio(frame->video_code)) ++ if (vic) { ++ if (picture_aspect != drm_get_cea_aspect_ratio(vic)) ++ return -EINVAL; ++ } else if (hdmi_vic) { ++ if (picture_aspect != drm_get_hdmi_aspect_ratio(hdmi_vic)) ++ return -EINVAL; ++ } else { + return -EINVAL; ++ } ++ + picture_aspect = HDMI_PICTURE_ASPECT_NONE; + } + ++ frame->video_code = vic; + frame->picture_aspect = picture_aspect; + frame->active_aspect = HDMI_ACTIVE_ASPECT_PICTURE; + frame->scan_mode = HDMI_SCAN_MODE_UNDERSCAN; +-- +2.39.2 + diff --git a/queue-5.4/drm-edid-extract-drm_mode_cea_vic.patch b/queue-5.4/drm-edid-extract-drm_mode_cea_vic.patch new file mode 100644 index 00000000000..37371670ae4 --- /dev/null +++ b/queue-5.4/drm-edid-extract-drm_mode_cea_vic.patch @@ -0,0 +1,100 @@ +From ee13bd559ce240afa08ec469a70dd0587cc39f1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Oct 2019 17:19:12 +0300 +Subject: drm/edid: Extract drm_mode_cea_vic() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +[ Upstream commit cfd6f8c3a94a96c003a8929b66d6d54181b9420d ] + +Extract the logic to compute the final CEA VIC to a small helper. +We'll reorder it a bit to make future modifications more +straightforward. No function changes. + +Cc: Wayne Lin +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20191004141914.20600-2-ville.syrjala@linux.intel.com +Reviewed-by: Uma Shankar +Stable-dep-of: 1cbc1f0d324b ("drm/edid: fix AVI infoframe aspect ratio handling") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_edid.c | 53 +++++++++++++++++++++----------------- + 1 file changed, 30 insertions(+), 23 deletions(-) + +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index 2dc6dd6230d76..10eb78b9347e1 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -5065,6 +5065,35 @@ drm_hdmi_infoframe_set_hdr_metadata(struct hdmi_drm_infoframe *frame, + } + EXPORT_SYMBOL(drm_hdmi_infoframe_set_hdr_metadata); + ++static u8 drm_mode_cea_vic(struct drm_connector *connector, ++ const struct drm_display_mode *mode) ++{ ++ u8 vendor_if_vic = drm_match_hdmi_mode(mode); ++ bool is_s3d = mode->flags & DRM_MODE_FLAG_3D_MASK; ++ u8 vic; ++ ++ /* ++ * HDMI spec says if a mode is found in HDMI 1.4b 4K modes ++ * we should send its VIC in vendor infoframes, else send the ++ * VIC in AVI infoframes. Lets check if this mode is present in ++ * HDMI 1.4b 4K modes ++ */ ++ if (drm_valid_hdmi_vic(vendor_if_vic) && !is_s3d) ++ return 0; ++ ++ vic = drm_match_cea_mode(mode); ++ ++ /* ++ * HDMI 1.4 VIC range: 1 <= VIC <= 64 (CEA-861-D) but ++ * HDMI 2.0 VIC range: 1 <= VIC <= 107 (CEA-861-F). So we ++ * have to make sure we dont break HDMI 1.4 sinks. ++ */ ++ if (!is_hdmi2_sink(connector) && vic > 64) ++ return 0; ++ ++ return vic; ++} ++ + /** + * drm_hdmi_avi_infoframe_from_display_mode() - fill an HDMI AVI infoframe with + * data from a DRM display mode +@@ -5092,29 +5121,7 @@ drm_hdmi_avi_infoframe_from_display_mode(struct hdmi_avi_infoframe *frame, + if (mode->flags & DRM_MODE_FLAG_DBLCLK) + frame->pixel_repeat = 1; + +- frame->video_code = drm_match_cea_mode(mode); +- +- /* +- * HDMI 1.4 VIC range: 1 <= VIC <= 64 (CEA-861-D) but +- * HDMI 2.0 VIC range: 1 <= VIC <= 107 (CEA-861-F). So we +- * have to make sure we dont break HDMI 1.4 sinks. +- */ +- if (!is_hdmi2_sink(connector) && frame->video_code > 64) +- frame->video_code = 0; +- +- /* +- * HDMI spec says if a mode is found in HDMI 1.4b 4K modes +- * we should send its VIC in vendor infoframes, else send the +- * VIC in AVI infoframes. Lets check if this mode is present in +- * HDMI 1.4b 4K modes +- */ +- if (frame->video_code) { +- u8 vendor_if_vic = drm_match_hdmi_mode(mode); +- bool is_s3d = mode->flags & DRM_MODE_FLAG_3D_MASK; +- +- if (drm_valid_hdmi_vic(vendor_if_vic) && !is_s3d) +- frame->video_code = 0; +- } ++ frame->video_code = drm_mode_cea_vic(connector, mode); + + frame->picture_aspect = HDMI_PICTURE_ASPECT_NONE; + +-- +2.39.2 + diff --git a/queue-5.4/drm-edid-fix-avi-infoframe-aspect-ratio-handling.patch b/queue-5.4/drm-edid-fix-avi-infoframe-aspect-ratio-handling.patch new file mode 100644 index 00000000000..8015d0a60e3 --- /dev/null +++ b/queue-5.4/drm-edid-fix-avi-infoframe-aspect-ratio-handling.patch @@ -0,0 +1,88 @@ +From 0b862dc6ccc7dfe316c77eea18fad34f9ddda600 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jan 2023 12:05:16 +0200 +Subject: drm/edid: fix AVI infoframe aspect ratio handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jani Nikula + +[ Upstream commit 1cbc1f0d324ba6c4d1b10ac6362b5e0b029f63d5 ] + +We try to avoid sending VICs defined in the later specs in AVI +infoframes to sinks that conform to the earlier specs, to not upset +them, and use 0 for the VIC instead. However, we do this detection and +conversion to 0 too early, as we'll need the actual VIC to figure out +the aspect ratio. + +In particular, for a mode with 64:27 aspect ratio, 0 for VIC fails the +AVI infoframe generation altogether with -EINVAL. + +Separate the VIC lookup from the "filtering", and postpone the +filtering, to use the proper VIC for aspect ratio handling, and the 0 +VIC for the infoframe video code as needed. + +Reported-by: William Tseng +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6153 +References: https://lore.kernel.org/r/20220920062316.43162-1-william.tseng@intel.com +Cc: +Cc: Ville Syrjälä +Signed-off-by: Jani Nikula +Reviewed-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/c3e78cc6d01ed237f71ad0038826b08d83d75eef.1672826282.git.jani.nikula@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_edid.c | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index f9735861741c1..2e73042e5d070 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -5095,8 +5095,6 @@ static u8 drm_mode_hdmi_vic(struct drm_connector *connector, + static u8 drm_mode_cea_vic(struct drm_connector *connector, + const struct drm_display_mode *mode) + { +- u8 vic; +- + /* + * HDMI spec says if a mode is found in HDMI 1.4b 4K modes + * we should send its VIC in vendor infoframes, else send the +@@ -5106,13 +5104,18 @@ static u8 drm_mode_cea_vic(struct drm_connector *connector, + if (drm_mode_hdmi_vic(connector, mode)) + return 0; + +- vic = drm_match_cea_mode(mode); ++ return drm_match_cea_mode(mode); ++} + +- /* +- * HDMI 1.4 VIC range: 1 <= VIC <= 64 (CEA-861-D) but +- * HDMI 2.0 VIC range: 1 <= VIC <= 107 (CEA-861-F). So we +- * have to make sure we dont break HDMI 1.4 sinks. +- */ ++/* ++ * Avoid sending VICs defined in HDMI 2.0 in AVI infoframes to sinks that ++ * conform to HDMI 1.4. ++ * ++ * HDMI 1.4 (CTA-861-D) VIC range: [1..64] ++ * HDMI 2.0 (CTA-861-F) VIC range: [1..107] ++ */ ++static u8 vic_for_avi_infoframe(const struct drm_connector *connector, u8 vic) ++{ + if (!is_hdmi2_sink(connector) && vic > 64) + return 0; + +@@ -5191,7 +5194,7 @@ drm_hdmi_avi_infoframe_from_display_mode(struct hdmi_avi_infoframe *frame, + picture_aspect = HDMI_PICTURE_ASPECT_NONE; + } + +- frame->video_code = vic; ++ frame->video_code = vic_for_avi_infoframe(connector, vic); + frame->picture_aspect = picture_aspect; + frame->active_aspect = HDMI_ACTIVE_ASPECT_PICTURE; + frame->scan_mode = HDMI_SCAN_MODE_UNDERSCAN; +-- +2.39.2 + diff --git a/queue-5.4/drm-edid-fix-hdmi-vic-handling.patch b/queue-5.4/drm-edid-fix-hdmi-vic-handling.patch new file mode 100644 index 00000000000..4c6e0d09dbe --- /dev/null +++ b/queue-5.4/drm-edid-fix-hdmi-vic-handling.patch @@ -0,0 +1,117 @@ +From 099c0f75cc95cf4026dfa0b9087c949040171324 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Oct 2019 17:19:13 +0300 +Subject: drm/edid: Fix HDMI VIC handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +[ Upstream commit 949561eb85bcee10248e7da51d44a0325d5e0d1b ] + +Extract drm_mode_hdmi_vic() to correctly calculate the final HDMI +VIC for us. Currently this is being done a bit differently between +the AVI and HDMI infoframes. Let's get both to agree on this. + +We need to allow the case where a mode is both 3D and has a HDMI +VIC. Currently we'll just refuse to generate the HDMI infoframe when +we really should be setting HDMI VIC to 0 and instead enabling 3D +stereo signalling. + +If the sink doesn't even support the HDMI infoframe we should +not be picking the HDMI VIC in favor of the CEA VIC, because then +we'll end up not sending either VIC in the end. + +Cc: Wayne Lin +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20191004141914.20600-3-ville.syrjala@linux.intel.com +Reviewed-by: Uma Shankar +Stable-dep-of: 1cbc1f0d324b ("drm/edid: fix AVI infoframe aspect ratio handling") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_edid.c | 37 +++++++++++++++++++++---------------- + 1 file changed, 21 insertions(+), 16 deletions(-) + +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index 10eb78b9347e1..245e495f57c93 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -5065,11 +5065,25 @@ drm_hdmi_infoframe_set_hdr_metadata(struct hdmi_drm_infoframe *frame, + } + EXPORT_SYMBOL(drm_hdmi_infoframe_set_hdr_metadata); + ++static u8 drm_mode_hdmi_vic(struct drm_connector *connector, ++ const struct drm_display_mode *mode) ++{ ++ bool has_hdmi_infoframe = connector ? ++ connector->display_info.has_hdmi_infoframe : false; ++ ++ if (!has_hdmi_infoframe) ++ return 0; ++ ++ /* No HDMI VIC when signalling 3D video format */ ++ if (mode->flags & DRM_MODE_FLAG_3D_MASK) ++ return 0; ++ ++ return drm_match_hdmi_mode(mode); ++} ++ + static u8 drm_mode_cea_vic(struct drm_connector *connector, + const struct drm_display_mode *mode) + { +- u8 vendor_if_vic = drm_match_hdmi_mode(mode); +- bool is_s3d = mode->flags & DRM_MODE_FLAG_3D_MASK; + u8 vic; + + /* +@@ -5078,7 +5092,7 @@ static u8 drm_mode_cea_vic(struct drm_connector *connector, + * VIC in AVI infoframes. Lets check if this mode is present in + * HDMI 1.4b 4K modes + */ +- if (drm_valid_hdmi_vic(vendor_if_vic) && !is_s3d) ++ if (drm_mode_hdmi_vic(connector, mode)) + return 0; + + vic = drm_match_cea_mode(mode); +@@ -5338,8 +5352,6 @@ drm_hdmi_vendor_infoframe_from_display_mode(struct hdmi_vendor_infoframe *frame, + bool has_hdmi_infoframe = connector ? + connector->display_info.has_hdmi_infoframe : false; + int err; +- u32 s3d_flags; +- u8 vic; + + if (!frame || !mode) + return -EINVAL; +@@ -5347,8 +5359,9 @@ drm_hdmi_vendor_infoframe_from_display_mode(struct hdmi_vendor_infoframe *frame, + if (!has_hdmi_infoframe) + return -EINVAL; + +- vic = drm_match_hdmi_mode(mode); +- s3d_flags = mode->flags & DRM_MODE_FLAG_3D_MASK; ++ err = hdmi_vendor_infoframe_init(frame); ++ if (err < 0) ++ return err; + + /* + * Even if it's not absolutely necessary to send the infoframe +@@ -5359,15 +5372,7 @@ drm_hdmi_vendor_infoframe_from_display_mode(struct hdmi_vendor_infoframe *frame, + * mode if the source simply stops sending the infoframe when + * it wants to switch from 3D to 2D. + */ +- +- if (vic && s3d_flags) +- return -EINVAL; +- +- err = hdmi_vendor_infoframe_init(frame); +- if (err < 0) +- return err; +- +- frame->vic = vic; ++ frame->vic = drm_mode_hdmi_vic(connector, mode); + frame->s3d_struct = s3d_structure_from_display_mode(mode); + + return 0; +-- +2.39.2 + diff --git a/queue-5.4/drm-msm-a5xx-fix-setting-of-the-cp_preempt_enable_lo.patch b/queue-5.4/drm-msm-a5xx-fix-setting-of-the-cp_preempt_enable_lo.patch new file mode 100644 index 00000000000..2c3fdb492c6 --- /dev/null +++ b/queue-5.4/drm-msm-a5xx-fix-setting-of-the-cp_preempt_enable_lo.patch @@ -0,0 +1,41 @@ +From febc42d9e37a3232c01520d0f1acbd422f5f0538 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Feb 2023 05:09:53 +0300 +Subject: drm/msm/a5xx: fix setting of the CP_PREEMPT_ENABLE_LOCAL register + +From: Dmitry Baryshkov + +[ Upstream commit a7a4c19c36de1e4b99b06e4060ccc8ab837725bc ] + +Rather than writing CP_PREEMPT_ENABLE_GLOBAL twice, follow the vendor +kernel and set CP_PREEMPT_ENABLE_LOCAL register instead. a5xx_submit() +will override it during submission, but let's get the sequence correct. + +Fixes: b1fc2839d2f9 ("drm/msm: Implement preemption for A5XX targets") +Signed-off-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/522638/ +Link: https://lore.kernel.org/r/20230214020956.164473-2-dmitry.baryshkov@linaro.org +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c +index e3579e5ffa146..593b8d83179c9 100644 +--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c +@@ -135,8 +135,8 @@ static void a5xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit, + OUT_RING(ring, 1); + + /* Enable local preemption for finegrain preemption */ +- OUT_PKT7(ring, CP_PREEMPT_ENABLE_GLOBAL, 1); +- OUT_RING(ring, 0x02); ++ OUT_PKT7(ring, CP_PREEMPT_ENABLE_LOCAL, 1); ++ OUT_RING(ring, 0x1); + + /* Allow CP_CONTEXT_SWITCH_YIELD packets in the IB2 */ + OUT_PKT7(ring, CP_YIELD_ENABLE, 1); +-- +2.39.2 + diff --git a/queue-5.4/ext4-fix-possible-corruption-when-moving-a-directory.patch b/queue-5.4/ext4-fix-possible-corruption-when-moving-a-directory.patch new file mode 100644 index 00000000000..1e5aad38683 --- /dev/null +++ b/queue-5.4/ext4-fix-possible-corruption-when-moving-a-directory.patch @@ -0,0 +1,59 @@ +From a3153ce3caa13735cf8d91037fd2cd07217acf1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jan 2023 12:22:21 +0100 +Subject: ext4: Fix possible corruption when moving a directory + +From: Jan Kara + +[ Upstream commit 0813299c586b175d7edb25f56412c54b812d0379 ] + +When we are renaming a directory to a different directory, we need to +update '..' entry in the moved directory. However nothing prevents moved +directory from being modified and even converted from the inline format +to the normal format. When such race happens the rename code gets +confused and we crash. Fix the problem by locking the moved directory. + +CC: stable@vger.kernel.org +Fixes: 32f7f22c0b52 ("ext4: let ext4_rename handle inline dir") +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20230126112221.11866-1-jack@suse.cz +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/namei.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 30c37ef8b8af3..f9d11f59df7d2 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -3855,9 +3855,16 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, + if (new.dir != old.dir && EXT4_DIR_LINK_MAX(new.dir)) + goto end_rename; + } ++ /* ++ * We need to protect against old.inode directory getting ++ * converted from inline directory format into a normal one. ++ */ ++ inode_lock_nested(old.inode, I_MUTEX_NONDIR2); + retval = ext4_rename_dir_prepare(handle, &old); +- if (retval) ++ if (retval) { ++ inode_unlock(old.inode); + goto end_rename; ++ } + } + /* + * If we're renaming a file within an inline_data dir and adding or +@@ -3953,6 +3960,8 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, + } else { + ext4_journal_stop(handle); + } ++ if (old.dir_bh) ++ inode_unlock(old.inode); + release_bh: + brelse(old.dir_bh); + brelse(old.bh); +-- +2.39.2 + diff --git a/queue-5.4/ila-do-not-generate-empty-messages-in-ila_xlat_nl_cm.patch b/queue-5.4/ila-do-not-generate-empty-messages-in-ila_xlat_nl_cm.patch new file mode 100644 index 00000000000..1ac62cb7b02 --- /dev/null +++ b/queue-5.4/ila-do-not-generate-empty-messages-in-ila_xlat_nl_cm.patch @@ -0,0 +1,113 @@ +From e34797c19ab53c6bc0bbe9fcd6165266a00915e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 15:30:24 +0000 +Subject: ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() + +From: Eric Dumazet + +[ Upstream commit 693aa2c0d9b6d5b1f2745d31b6e70d09dbbaf06e ] + +ila_xlat_nl_cmd_get_mapping() generates an empty skb, +triggerring a recent sanity check [1]. + +Instead, return an error code, so that user space +can get it. + +[1] +skb_assert_len +WARNING: CPU: 0 PID: 5923 at include/linux/skbuff.h:2527 skb_assert_len include/linux/skbuff.h:2527 [inline] +WARNING: CPU: 0 PID: 5923 at include/linux/skbuff.h:2527 __dev_queue_xmit+0x1bc0/0x3488 net/core/dev.c:4156 +Modules linked in: +CPU: 0 PID: 5923 Comm: syz-executor269 Not tainted 6.2.0-syzkaller-18300-g2ebd1fbb946d #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 +pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : skb_assert_len include/linux/skbuff.h:2527 [inline] +pc : __dev_queue_xmit+0x1bc0/0x3488 net/core/dev.c:4156 +lr : skb_assert_len include/linux/skbuff.h:2527 [inline] +lr : __dev_queue_xmit+0x1bc0/0x3488 net/core/dev.c:4156 +sp : ffff80001e0d6c40 +x29: ffff80001e0d6e60 x28: dfff800000000000 x27: ffff0000c86328c0 +x26: dfff800000000000 x25: ffff0000c8632990 x24: ffff0000c8632a00 +x23: 0000000000000000 x22: 1fffe000190c6542 x21: ffff0000c8632a10 +x20: ffff0000c8632a00 x19: ffff80001856e000 x18: ffff80001e0d5fc0 +x17: 0000000000000000 x16: ffff80001235d16c x15: 0000000000000000 +x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000001 +x11: ff80800008353a30 x10: 0000000000000000 x9 : 21567eaf25bfb600 +x8 : 21567eaf25bfb600 x7 : 0000000000000001 x6 : 0000000000000001 +x5 : ffff80001e0d6558 x4 : ffff800015c74760 x3 : ffff800008596744 +x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000000e +Call trace: +skb_assert_len include/linux/skbuff.h:2527 [inline] +__dev_queue_xmit+0x1bc0/0x3488 net/core/dev.c:4156 +dev_queue_xmit include/linux/netdevice.h:3033 [inline] +__netlink_deliver_tap_skb net/netlink/af_netlink.c:307 [inline] +__netlink_deliver_tap+0x45c/0x6f8 net/netlink/af_netlink.c:325 +netlink_deliver_tap+0xf4/0x174 net/netlink/af_netlink.c:338 +__netlink_sendskb net/netlink/af_netlink.c:1283 [inline] +netlink_sendskb+0x6c/0x154 net/netlink/af_netlink.c:1292 +netlink_unicast+0x334/0x8d4 net/netlink/af_netlink.c:1380 +nlmsg_unicast include/net/netlink.h:1099 [inline] +genlmsg_unicast include/net/genetlink.h:433 [inline] +genlmsg_reply include/net/genetlink.h:443 [inline] +ila_xlat_nl_cmd_get_mapping+0x620/0x7d0 net/ipv6/ila/ila_xlat.c:493 +genl_family_rcv_msg_doit net/netlink/genetlink.c:968 [inline] +genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline] +genl_rcv_msg+0x938/0xc1c net/netlink/genetlink.c:1065 +netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2574 +genl_rcv+0x38/0x50 net/netlink/genetlink.c:1076 +netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] +netlink_unicast+0x660/0x8d4 net/netlink/af_netlink.c:1365 +netlink_sendmsg+0x800/0xae0 net/netlink/af_netlink.c:1942 +sock_sendmsg_nosec net/socket.c:714 [inline] +sock_sendmsg net/socket.c:734 [inline] +____sys_sendmsg+0x558/0x844 net/socket.c:2479 +___sys_sendmsg net/socket.c:2533 [inline] +__sys_sendmsg+0x26c/0x33c net/socket.c:2562 +__do_sys_sendmsg net/socket.c:2571 [inline] +__se_sys_sendmsg net/socket.c:2569 [inline] +__arm64_sys_sendmsg+0x80/0x94 net/socket.c:2569 +__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] +invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 +el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 +do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:193 +el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 +el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 +el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591 +irq event stamp: 136484 +hardirqs last enabled at (136483): [] __up_console_sem+0x60/0xb4 kernel/printk/printk.c:345 +hardirqs last disabled at (136484): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405 +softirqs last enabled at (136418): [] softirq_handle_end kernel/softirq.c:414 [inline] +softirqs last enabled at (136418): [] __do_softirq+0xd4c/0xfa4 kernel/softirq.c:600 +softirqs last disabled at (136371): [] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 +---[ end trace 0000000000000000 ]--- +skb len=0 headroom=0 headlen=0 tailroom=192 +mac=(0,0) net=(0,-1) trans=-1 +shinfo(txflags=0 nr_frags=0 gso(size=0 type=0 segs=0)) +csum(0x0 ip_summed=0 complete_sw=0 valid=0 level=0) +hash(0x0 sw=0 l4=0) proto=0x0010 pkttype=6 iif=0 +dev name=nlmon0 feat=0x0000000000005861 + +Fixes: 7f00feaf1076 ("ila: Add generic ILA translation facility") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv6/ila/ila_xlat.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c +index 5fc1f4e0c0cf0..10f1367eb4ca0 100644 +--- a/net/ipv6/ila/ila_xlat.c ++++ b/net/ipv6/ila/ila_xlat.c +@@ -477,6 +477,7 @@ int ila_xlat_nl_cmd_get_mapping(struct sk_buff *skb, struct genl_info *info) + + rcu_read_lock(); + ++ ret = -ESRCH; + ila = ila_lookup_by_params(&xp, ilan); + if (ila) { + ret = ila_dump_info(ila, +-- +2.39.2 + diff --git a/queue-5.4/iommu-amd-add-a-length-limitation-for-the-ivrs_acpih.patch b/queue-5.4/iommu-amd-add-a-length-limitation-for-the-ivrs_acpih.patch new file mode 100644 index 00000000000..f76a8a2b424 --- /dev/null +++ b/queue-5.4/iommu-amd-add-a-length-limitation-for-the-ivrs_acpih.patch @@ -0,0 +1,73 @@ +From ffaa53b7a5b909ec94b14cde82335e8a57a26383 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 08:26:56 +0000 +Subject: iommu/amd: Add a length limitation for the ivrs_acpihid command-line + parameter + +From: Gavrilov Ilia + +[ Upstream commit b6b26d86c61c441144c72f842f7469bb686e1211 ] + +The 'acpiid' buffer in the parse_ivrs_acpihid function may overflow, +because the string specifier in the format string sscanf() +has no width limitation. + +Found by InfoTeCS on behalf of Linux Verification Center +(linuxtesting.org) with SVACE. + +Fixes: ca3bf5d47cec ("iommu/amd: Introduces ivrs_acpihid kernel parameter") +Cc: stable@vger.kernel.org +Signed-off-by: Ilia.Gavrilov +Reviewed-by: Kim Phillips +Link: https://lore.kernel.org/r/20230202082719.1513849-1-Ilia.Gavrilov@infotecs.ru +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd_iommu_init.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c +index 71e4a8eac3c92..4a9feff340da7 100644 +--- a/drivers/iommu/amd_iommu_init.c ++++ b/drivers/iommu/amd_iommu_init.c +@@ -3049,15 +3049,26 @@ static int __init parse_ivrs_hpet(char *str) + return 1; + } + ++#define ACPIID_LEN (ACPIHID_UID_LEN + ACPIHID_HID_LEN) ++ + static int __init parse_ivrs_acpihid(char *str) + { + u32 seg = 0, bus, dev, fn; + char *hid, *uid, *p, *addr; +- char acpiid[ACPIHID_UID_LEN + ACPIHID_HID_LEN] = {0}; ++ char acpiid[ACPIID_LEN] = {0}; + int i; + + addr = strchr(str, '@'); + if (!addr) { ++ addr = strchr(str, '='); ++ if (!addr) ++ goto not_found; ++ ++ ++addr; ++ ++ if (strlen(addr) > ACPIID_LEN) ++ goto not_found; ++ + if (sscanf(str, "[%x:%x.%x]=%s", &bus, &dev, &fn, acpiid) == 4 || + sscanf(str, "[%x:%x:%x.%x]=%s", &seg, &bus, &dev, &fn, acpiid) == 5) { + pr_warn("ivrs_acpihid%s option format deprecated; use ivrs_acpihid=%s@%04x:%02x:%02x.%d instead\n", +@@ -3070,6 +3081,9 @@ static int __init parse_ivrs_acpihid(char *str) + /* We have the '@', make it the terminator to get just the acpiid */ + *addr++ = 0; + ++ if (strlen(str) > ACPIID_LEN + 1) ++ goto not_found; ++ + if (sscanf(str, "=%s", acpiid) != 1) + goto not_found; + +-- +2.39.2 + diff --git a/queue-5.4/iommu-amd-add-pci-segment-support-for-ivrs_-ioapic-h.patch b/queue-5.4/iommu-amd-add-pci-segment-support-for-ivrs_-ioapic-h.patch new file mode 100644 index 00000000000..4e18581afa1 --- /dev/null +++ b/queue-5.4/iommu-amd-add-pci-segment-support-for-ivrs_-ioapic-h.patch @@ -0,0 +1,193 @@ +From 5465580ed1c93c2087ba13d8524f98176c57adfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 17:08:22 +0530 +Subject: iommu/amd: Add PCI segment support for ivrs_[ioapic/hpet/acpihid] + commands + +From: Suravee Suthikulpanit + +[ Upstream commit bbe3a106580c21bc883fb0c9fa3da01534392fe8 ] + +By default, PCI segment is zero and can be omitted. To support system +with non-zero PCI segment ID, modify the parsing functions to allow +PCI segment ID. + +Co-developed-by: Vasant Hegde +Signed-off-by: Vasant Hegde +Signed-off-by: Suravee Suthikulpanit +Link: https://lore.kernel.org/r/20220706113825.25582-33-vasant.hegde@amd.com +Signed-off-by: Joerg Roedel +Stable-dep-of: b6b26d86c61c ("iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter") +Signed-off-by: Sasha Levin +--- + .../admin-guide/kernel-parameters.txt | 34 ++++++++++---- + drivers/iommu/amd_iommu_init.c | 44 ++++++++++++------- + 2 files changed, 52 insertions(+), 26 deletions(-) + +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index 8f71a17ad5442..9164263839216 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -1944,23 +1944,39 @@ + + ivrs_ioapic [HW,X86_64] + Provide an override to the IOAPIC-ID<->DEVICE-ID +- mapping provided in the IVRS ACPI table. For +- example, to map IOAPIC-ID decimal 10 to +- PCI device 00:14.0 write the parameter as: ++ mapping provided in the IVRS ACPI table. ++ By default, PCI segment is 0, and can be omitted. ++ For example: ++ * To map IOAPIC-ID decimal 10 to PCI device 00:14.0 ++ write the parameter as: + ivrs_ioapic[10]=00:14.0 ++ * To map IOAPIC-ID decimal 10 to PCI segment 0x1 and ++ PCI device 00:14.0 write the parameter as: ++ ivrs_ioapic[10]=0001:00:14.0 + + ivrs_hpet [HW,X86_64] + Provide an override to the HPET-ID<->DEVICE-ID +- mapping provided in the IVRS ACPI table. For +- example, to map HPET-ID decimal 0 to +- PCI device 00:14.0 write the parameter as: ++ mapping provided in the IVRS ACPI table. ++ By default, PCI segment is 0, and can be omitted. ++ For example: ++ * To map HPET-ID decimal 0 to PCI device 00:14.0 ++ write the parameter as: + ivrs_hpet[0]=00:14.0 ++ * To map HPET-ID decimal 10 to PCI segment 0x1 and ++ PCI device 00:14.0 write the parameter as: ++ ivrs_ioapic[10]=0001:00:14.0 + + ivrs_acpihid [HW,X86_64] + Provide an override to the ACPI-HID:UID<->DEVICE-ID +- mapping provided in the IVRS ACPI table. For +- example, to map UART-HID:UID AMD0020:0 to +- PCI device 00:14.5 write the parameter as: ++ mapping provided in the IVRS ACPI table. ++ ++ For example, to map UART-HID:UID AMD0020:0 to ++ PCI segment 0x1 and PCI device ID 00:14.5, ++ write the parameter as: ++ ivrs_acpihid[0001:00:14.5]=AMD0020:0 ++ ++ By default, PCI segment is 0, and can be omitted. ++ For example, PCI device 00:14.5 write the parameter as: + ivrs_acpihid[00:14.5]=AMD0020:0 + + js= [HW,JOY] Analog joystick +diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c +index 533b920ed7df2..f4e6173e749a4 100644 +--- a/drivers/iommu/amd_iommu_init.c ++++ b/drivers/iommu/amd_iommu_init.c +@@ -84,6 +84,10 @@ + #define ACPI_DEVFLAG_ATSDIS 0x10000000 + + #define LOOP_TIMEOUT 2000000 ++ ++#define IVRS_GET_SBDF_ID(seg, bus, dev, fd) (((seg & 0xffff) << 16) | ((bus & 0xff) << 8) \ ++ | ((dev & 0x1f) << 3) | (fn & 0x7)) ++ + /* + * ACPI table definitions + * +@@ -2971,15 +2975,17 @@ static int __init parse_amd_iommu_options(char *str) + + static int __init parse_ivrs_ioapic(char *str) + { +- unsigned int bus, dev, fn; ++ u32 seg = 0, bus, dev, fn; + int ret, id, i; +- u16 devid; ++ u32 devid; + + ret = sscanf(str, "[%d]=%x:%x.%x", &id, &bus, &dev, &fn); +- + if (ret != 4) { +- pr_err("Invalid command line: ivrs_ioapic%s\n", str); +- return 1; ++ ret = sscanf(str, "[%d]=%x:%x:%x.%x", &id, &seg, &bus, &dev, &fn); ++ if (ret != 5) { ++ pr_err("Invalid command line: ivrs_ioapic%s\n", str); ++ return 1; ++ } + } + + if (early_ioapic_map_size == EARLY_MAP_SIZE) { +@@ -2988,7 +2994,7 @@ static int __init parse_ivrs_ioapic(char *str) + return 1; + } + +- devid = ((bus & 0xff) << 8) | ((dev & 0x1f) << 3) | (fn & 0x7); ++ devid = IVRS_GET_SBDF_ID(seg, bus, dev, fn); + + cmdline_maps = true; + i = early_ioapic_map_size++; +@@ -3001,15 +3007,17 @@ static int __init parse_ivrs_ioapic(char *str) + + static int __init parse_ivrs_hpet(char *str) + { +- unsigned int bus, dev, fn; ++ u32 seg = 0, bus, dev, fn; + int ret, id, i; +- u16 devid; ++ u32 devid; + + ret = sscanf(str, "[%d]=%x:%x.%x", &id, &bus, &dev, &fn); +- + if (ret != 4) { +- pr_err("Invalid command line: ivrs_hpet%s\n", str); +- return 1; ++ ret = sscanf(str, "[%d]=%x:%x:%x.%x", &id, &seg, &bus, &dev, &fn); ++ if (ret != 5) { ++ pr_err("Invalid command line: ivrs_hpet%s\n", str); ++ return 1; ++ } + } + + if (early_hpet_map_size == EARLY_MAP_SIZE) { +@@ -3018,7 +3026,7 @@ static int __init parse_ivrs_hpet(char *str) + return 1; + } + +- devid = ((bus & 0xff) << 8) | ((dev & 0x1f) << 3) | (fn & 0x7); ++ devid = IVRS_GET_SBDF_ID(seg, bus, dev, fn); + + cmdline_maps = true; + i = early_hpet_map_size++; +@@ -3031,15 +3039,18 @@ static int __init parse_ivrs_hpet(char *str) + + static int __init parse_ivrs_acpihid(char *str) + { +- u32 bus, dev, fn; ++ u32 seg = 0, bus, dev, fn; + char *hid, *uid, *p; + char acpiid[ACPIHID_UID_LEN + ACPIHID_HID_LEN] = {0}; + int ret, i; + + ret = sscanf(str, "[%x:%x.%x]=%s", &bus, &dev, &fn, acpiid); + if (ret != 4) { +- pr_err("Invalid command line: ivrs_acpihid(%s)\n", str); +- return 1; ++ ret = sscanf(str, "[%x:%x:%x.%x]=%s", &seg, &bus, &dev, &fn, acpiid); ++ if (ret != 5) { ++ pr_err("Invalid command line: ivrs_acpihid(%s)\n", str); ++ return 1; ++ } + } + + p = acpiid; +@@ -3061,8 +3072,7 @@ static int __init parse_ivrs_acpihid(char *str) + i = early_acpihid_map_size++; + memcpy(early_acpihid_map[i].hid, hid, strlen(hid)); + memcpy(early_acpihid_map[i].uid, uid, strlen(uid)); +- early_acpihid_map[i].devid = +- ((bus & 0xff) << 8) | ((dev & 0x1f) << 3) | (fn & 0x7); ++ early_acpihid_map[i].devid = IVRS_GET_SBDF_ID(seg, bus, dev, fn); + early_acpihid_map[i].cmd_line = true; + + return 1; +-- +2.39.2 + diff --git a/queue-5.4/iommu-amd-fix-ill-formed-ivrs_ioapic-ivrs_hpet-and-i.patch b/queue-5.4/iommu-amd-fix-ill-formed-ivrs_ioapic-ivrs_hpet-and-i.patch new file mode 100644 index 00000000000..ea550cf8eea --- /dev/null +++ b/queue-5.4/iommu-amd-fix-ill-formed-ivrs_ioapic-ivrs_hpet-and-i.patch @@ -0,0 +1,217 @@ +From 550753a8f23ab4dc9ffa1576c1294e1458fa4a34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Sep 2022 10:56:38 -0500 +Subject: iommu/amd: Fix ill-formed ivrs_ioapic, ivrs_hpet and ivrs_acpihid + options + +From: Kim Phillips + +[ Upstream commit 1198d2316dc4265a97d0e8445a22c7a6d17580a4 ] + +Currently, these options cause the following libkmod error: + +libkmod: ERROR ../libkmod/libkmod-config.c:489 kcmdline_parse_result: \ + Ignoring bad option on kernel command line while parsing module \ + name: 'ivrs_xxxx[XX:XX' + +Fix by introducing a new parameter format for these options and +throw a warning for the deprecated format. + +Users are still allowed to omit the PCI Segment if zero. + +Adding a Link: to the reason why we're modding the syntax parsing +in the driver and not in libkmod. + +Fixes: ca3bf5d47cec ("iommu/amd: Introduces ivrs_acpihid kernel parameter") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/linux-modules/20200310082308.14318-2-lucas.demarchi@intel.com/ +Reported-by: Kim Phillips +Co-developed-by: Suravee Suthikulpanit +Signed-off-by: Suravee Suthikulpanit +Signed-off-by: Kim Phillips +Link: https://lore.kernel.org/r/20220919155638.391481-2-kim.phillips@amd.com +Signed-off-by: Joerg Roedel +Stable-dep-of: b6b26d86c61c ("iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter") +Signed-off-by: Sasha Levin +--- + .../admin-guide/kernel-parameters.txt | 27 +++++-- + drivers/iommu/amd_iommu_init.c | 79 +++++++++++++------ + 2 files changed, 76 insertions(+), 30 deletions(-) + +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index 9164263839216..5e5704faae24a 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -1946,7 +1946,13 @@ + Provide an override to the IOAPIC-ID<->DEVICE-ID + mapping provided in the IVRS ACPI table. + By default, PCI segment is 0, and can be omitted. +- For example: ++ ++ For example, to map IOAPIC-ID decimal 10 to ++ PCI segment 0x1 and PCI device 00:14.0, ++ write the parameter as: ++ ivrs_ioapic=10@0001:00:14.0 ++ ++ Deprecated formats: + * To map IOAPIC-ID decimal 10 to PCI device 00:14.0 + write the parameter as: + ivrs_ioapic[10]=00:14.0 +@@ -1958,7 +1964,13 @@ + Provide an override to the HPET-ID<->DEVICE-ID + mapping provided in the IVRS ACPI table. + By default, PCI segment is 0, and can be omitted. +- For example: ++ ++ For example, to map HPET-ID decimal 10 to ++ PCI segment 0x1 and PCI device 00:14.0, ++ write the parameter as: ++ ivrs_hpet=10@0001:00:14.0 ++ ++ Deprecated formats: + * To map HPET-ID decimal 0 to PCI device 00:14.0 + write the parameter as: + ivrs_hpet[0]=00:14.0 +@@ -1969,15 +1981,20 @@ + ivrs_acpihid [HW,X86_64] + Provide an override to the ACPI-HID:UID<->DEVICE-ID + mapping provided in the IVRS ACPI table. ++ By default, PCI segment is 0, and can be omitted. + + For example, to map UART-HID:UID AMD0020:0 to + PCI segment 0x1 and PCI device ID 00:14.5, + write the parameter as: +- ivrs_acpihid[0001:00:14.5]=AMD0020:0 ++ ivrs_acpihid=AMD0020:0@0001:00:14.5 + +- By default, PCI segment is 0, and can be omitted. +- For example, PCI device 00:14.5 write the parameter as: ++ Deprecated formats: ++ * To map UART-HID:UID AMD0020:0 to PCI segment is 0, ++ PCI device ID 00:14.5, write the parameter as: + ivrs_acpihid[00:14.5]=AMD0020:0 ++ * To map UART-HID:UID AMD0020:0 to PCI segment 0x1 and ++ PCI device ID 00:14.5, write the parameter as: ++ ivrs_acpihid[0001:00:14.5]=AMD0020:0 + + js= [HW,JOY] Analog joystick + See Documentation/input/joydev/joystick.rst. +diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c +index f4e6173e749a4..71e4a8eac3c92 100644 +--- a/drivers/iommu/amd_iommu_init.c ++++ b/drivers/iommu/amd_iommu_init.c +@@ -2976,18 +2976,24 @@ static int __init parse_amd_iommu_options(char *str) + static int __init parse_ivrs_ioapic(char *str) + { + u32 seg = 0, bus, dev, fn; +- int ret, id, i; ++ int id, i; + u32 devid; + +- ret = sscanf(str, "[%d]=%x:%x.%x", &id, &bus, &dev, &fn); +- if (ret != 4) { +- ret = sscanf(str, "[%d]=%x:%x:%x.%x", &id, &seg, &bus, &dev, &fn); +- if (ret != 5) { +- pr_err("Invalid command line: ivrs_ioapic%s\n", str); +- return 1; +- } ++ if (sscanf(str, "=%d@%x:%x.%x", &id, &bus, &dev, &fn) == 4 || ++ sscanf(str, "=%d@%x:%x:%x.%x", &id, &seg, &bus, &dev, &fn) == 5) ++ goto found; ++ ++ if (sscanf(str, "[%d]=%x:%x.%x", &id, &bus, &dev, &fn) == 4 || ++ sscanf(str, "[%d]=%x:%x:%x.%x", &id, &seg, &bus, &dev, &fn) == 5) { ++ pr_warn("ivrs_ioapic%s option format deprecated; use ivrs_ioapic=%d@%04x:%02x:%02x.%d instead\n", ++ str, id, seg, bus, dev, fn); ++ goto found; + } + ++ pr_err("Invalid command line: ivrs_ioapic%s\n", str); ++ return 1; ++ ++found: + if (early_ioapic_map_size == EARLY_MAP_SIZE) { + pr_err("Early IOAPIC map overflow - ignoring ivrs_ioapic%s\n", + str); +@@ -3008,18 +3014,24 @@ static int __init parse_ivrs_ioapic(char *str) + static int __init parse_ivrs_hpet(char *str) + { + u32 seg = 0, bus, dev, fn; +- int ret, id, i; ++ int id, i; + u32 devid; + +- ret = sscanf(str, "[%d]=%x:%x.%x", &id, &bus, &dev, &fn); +- if (ret != 4) { +- ret = sscanf(str, "[%d]=%x:%x:%x.%x", &id, &seg, &bus, &dev, &fn); +- if (ret != 5) { +- pr_err("Invalid command line: ivrs_hpet%s\n", str); +- return 1; +- } ++ if (sscanf(str, "=%d@%x:%x.%x", &id, &bus, &dev, &fn) == 4 || ++ sscanf(str, "=%d@%x:%x:%x.%x", &id, &seg, &bus, &dev, &fn) == 5) ++ goto found; ++ ++ if (sscanf(str, "[%d]=%x:%x.%x", &id, &bus, &dev, &fn) == 4 || ++ sscanf(str, "[%d]=%x:%x:%x.%x", &id, &seg, &bus, &dev, &fn) == 5) { ++ pr_warn("ivrs_hpet%s option format deprecated; use ivrs_hpet=%d@%04x:%02x:%02x.%d instead\n", ++ str, id, seg, bus, dev, fn); ++ goto found; + } + ++ pr_err("Invalid command line: ivrs_hpet%s\n", str); ++ return 1; ++ ++found: + if (early_hpet_map_size == EARLY_MAP_SIZE) { + pr_err("Early HPET map overflow - ignoring ivrs_hpet%s\n", + str); +@@ -3040,19 +3052,36 @@ static int __init parse_ivrs_hpet(char *str) + static int __init parse_ivrs_acpihid(char *str) + { + u32 seg = 0, bus, dev, fn; +- char *hid, *uid, *p; ++ char *hid, *uid, *p, *addr; + char acpiid[ACPIHID_UID_LEN + ACPIHID_HID_LEN] = {0}; +- int ret, i; +- +- ret = sscanf(str, "[%x:%x.%x]=%s", &bus, &dev, &fn, acpiid); +- if (ret != 4) { +- ret = sscanf(str, "[%x:%x:%x.%x]=%s", &seg, &bus, &dev, &fn, acpiid); +- if (ret != 5) { +- pr_err("Invalid command line: ivrs_acpihid(%s)\n", str); +- return 1; ++ int i; ++ ++ addr = strchr(str, '@'); ++ if (!addr) { ++ if (sscanf(str, "[%x:%x.%x]=%s", &bus, &dev, &fn, acpiid) == 4 || ++ sscanf(str, "[%x:%x:%x.%x]=%s", &seg, &bus, &dev, &fn, acpiid) == 5) { ++ pr_warn("ivrs_acpihid%s option format deprecated; use ivrs_acpihid=%s@%04x:%02x:%02x.%d instead\n", ++ str, acpiid, seg, bus, dev, fn); ++ goto found; + } ++ goto not_found; + } + ++ /* We have the '@', make it the terminator to get just the acpiid */ ++ *addr++ = 0; ++ ++ if (sscanf(str, "=%s", acpiid) != 1) ++ goto not_found; ++ ++ if (sscanf(addr, "%x:%x.%x", &bus, &dev, &fn) == 3 || ++ sscanf(addr, "%x:%x:%x.%x", &seg, &bus, &dev, &fn) == 4) ++ goto found; ++ ++not_found: ++ pr_err("Invalid command line: ivrs_acpihid%s\n", str); ++ return 1; ++ ++found: + p = acpiid; + hid = strsep(&p, ":"); + uid = p; +-- +2.39.2 + diff --git a/queue-5.4/iommu-vt-d-fix-pasid-directory-pointer-coherency.patch b/queue-5.4/iommu-vt-d-fix-pasid-directory-pointer-coherency.patch new file mode 100644 index 00000000000..ce108b56475 --- /dev/null +++ b/queue-5.4/iommu-vt-d-fix-pasid-directory-pointer-coherency.patch @@ -0,0 +1,82 @@ +From 599d2b068fe90620f816cc0148ee88d52e29ff16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 21:08:15 +0800 +Subject: iommu/vt-d: Fix PASID directory pointer coherency + +From: Jacob Pan + +[ Upstream commit 194b3348bdbb7db65375c72f3f774aee4cc6614e ] + +On platforms that do not support IOMMU Extended capability bit 0 +Page-walk Coherency, CPU caches are not snooped when IOMMU is accessing +any translation structures. IOMMU access goes only directly to +memory. Intel IOMMU code was missing a flush for the PASID table +directory that resulted in the unrecoverable fault as shown below. + +This patch adds clflush calls whenever allocating and updating +a PASID table directory to ensure cache coherency. + +On the reverse direction, there's no need to clflush the PASID directory +pointer when we deactivate a context entry in that IOMMU hardware will +not see the old PASID directory pointer after we clear the context entry. +PASID directory entries are also never freed once allocated. + + DMAR: DRHD: handling fault status reg 3 + DMAR: [DMA Read NO_PASID] Request device [00:0d.2] fault addr 0x1026a4000 + [fault reason 0x51] SM: Present bit in Directory Entry is clear + DMAR: Dump dmar1 table entries for IOVA 0x1026a4000 + DMAR: scalable mode root entry: hi 0x0000000102448001, low 0x0000000101b3e001 + DMAR: context entry: hi 0x0000000000000000, low 0x0000000101b4d401 + DMAR: pasid dir entry: 0x0000000101b4e001 + DMAR: pasid table entry[0]: 0x0000000000000109 + DMAR: pasid table entry[1]: 0x0000000000000001 + DMAR: pasid table entry[2]: 0x0000000000000000 + DMAR: pasid table entry[3]: 0x0000000000000000 + DMAR: pasid table entry[4]: 0x0000000000000000 + DMAR: pasid table entry[5]: 0x0000000000000000 + DMAR: pasid table entry[6]: 0x0000000000000000 + DMAR: pasid table entry[7]: 0x0000000000000000 + DMAR: PTE not present at level 4 + +Cc: +Fixes: 0bbeb01a4faf ("iommu/vt-d: Manage scalalble mode PASID tables") +Reviewed-by: Kevin Tian +Reported-by: Sukumar Ghorai +Signed-off-by: Ashok Raj +Signed-off-by: Jacob Pan +Link: https://lore.kernel.org/r/20230209212843.1788125-1-jacob.jun.pan@linux.intel.com +Signed-off-by: Lu Baolu +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel-pasid.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/iommu/intel-pasid.c b/drivers/iommu/intel-pasid.c +index e7cb0b8a73327..58f060006ba31 100644 +--- a/drivers/iommu/intel-pasid.c ++++ b/drivers/iommu/intel-pasid.c +@@ -166,6 +166,9 @@ int intel_pasid_alloc_table(struct device *dev) + attach_out: + device_attach_pasid_table(info, pasid_table); + ++ if (!ecap_coherent(info->iommu->ecap)) ++ clflush_cache_range(pasid_table->table, size); ++ + return 0; + } + +@@ -250,6 +253,10 @@ struct pasid_entry *intel_pasid_get_entry(struct device *dev, int pasid) + + WRITE_ONCE(dir[dir_index].val, + (u64)virt_to_phys(entries) | PASID_PTE_PRESENT); ++ if (!ecap_coherent(info->iommu->ecap)) { ++ clflush_cache_range(entries, VTD_PAGE_SIZE); ++ clflush_cache_range(&dir[dir_index].val, sizeof(*dir)); ++ } + } + spin_unlock(&pasid_lock); + +-- +2.39.2 + diff --git a/queue-5.4/ipmi-ssif-add-a-timer-between-request-retries.patch b/queue-5.4/ipmi-ssif-add-a-timer-between-request-retries.patch new file mode 100644 index 00000000000..db2d98c9026 --- /dev/null +++ b/queue-5.4/ipmi-ssif-add-a-timer-between-request-retries.patch @@ -0,0 +1,135 @@ +From 2550ab266e28222fc0c651888be20f19d3b56ebf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jan 2023 10:34:47 -0600 +Subject: ipmi:ssif: Add a timer between request retries + +From: Corey Minyard + +[ Upstream commit 00bb7e763ec9f384cb382455cb6ba5588b5375cf ] + +The IPMI spec has a time (T6) specified between request retries. Add +the handling for that. + +Reported by: Tony Camuso +Cc: stable@vger.kernel.org +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_ssif.c | 34 +++++++++++++++++++++++++++------- + 1 file changed, 27 insertions(+), 7 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c +index 02ca0d9a0d8cb..d5f068a10a5a0 100644 +--- a/drivers/char/ipmi/ipmi_ssif.c ++++ b/drivers/char/ipmi/ipmi_ssif.c +@@ -79,7 +79,8 @@ + /* + * Timer values + */ +-#define SSIF_MSG_USEC 60000 /* 60ms between message tries. */ ++#define SSIF_MSG_USEC 60000 /* 60ms between message tries (T3). */ ++#define SSIF_REQ_RETRY_USEC 60000 /* 60ms between send retries (T6). */ + #define SSIF_MSG_PART_USEC 5000 /* 5ms for a message part */ + + /* How many times to we retry sending/receiving the message. */ +@@ -87,7 +88,9 @@ + #define SSIF_RECV_RETRIES 250 + + #define SSIF_MSG_MSEC (SSIF_MSG_USEC / 1000) ++#define SSIF_REQ_RETRY_MSEC (SSIF_REQ_RETRY_USEC / 1000) + #define SSIF_MSG_JIFFIES ((SSIF_MSG_USEC * 1000) / TICK_NSEC) ++#define SSIF_REQ_RETRY_JIFFIES ((SSIF_REQ_RETRY_USEC * 1000) / TICK_NSEC) + #define SSIF_MSG_PART_JIFFIES ((SSIF_MSG_PART_USEC * 1000) / TICK_NSEC) + + /* +@@ -236,6 +239,9 @@ struct ssif_info { + bool got_alert; + bool waiting_alert; + ++ /* Used to inform the timeout that it should do a resend. */ ++ bool do_resend; ++ + /* + * If set to true, this will request events the next time the + * state machine is idle. +@@ -536,22 +542,28 @@ static void start_get(struct ssif_info *ssif_info) + ssif_info->recv, I2C_SMBUS_BLOCK_DATA); + } + ++static void start_resend(struct ssif_info *ssif_info); ++ + static void retry_timeout(struct timer_list *t) + { + struct ssif_info *ssif_info = from_timer(ssif_info, t, retry_timer); + unsigned long oflags, *flags; +- bool waiting; ++ bool waiting, resend; + + if (ssif_info->stopping) + return; + + flags = ipmi_ssif_lock_cond(ssif_info, &oflags); ++ resend = ssif_info->do_resend; ++ ssif_info->do_resend = false; + waiting = ssif_info->waiting_alert; + ssif_info->waiting_alert = false; + ipmi_ssif_unlock_cond(ssif_info, flags); + + if (waiting) + start_get(ssif_info); ++ if (resend) ++ start_resend(ssif_info); + } + + static void watch_timeout(struct timer_list *t) +@@ -600,8 +612,6 @@ static void ssif_alert(struct i2c_client *client, enum i2c_alert_protocol type, + start_get(ssif_info); + } + +-static void start_resend(struct ssif_info *ssif_info); +- + static void msg_done_handler(struct ssif_info *ssif_info, int result, + unsigned char *data, unsigned int len) + { +@@ -906,7 +916,13 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, + if (result < 0) { + ssif_info->retries_left--; + if (ssif_info->retries_left > 0) { +- start_resend(ssif_info); ++ /* ++ * Wait the retry timeout time per the spec, ++ * then redo the send. ++ */ ++ ssif_info->do_resend = true; ++ mod_timer(&ssif_info->retry_timer, ++ jiffies + SSIF_REQ_RETRY_JIFFIES); + return; + } + +@@ -1318,8 +1334,10 @@ static int do_cmd(struct i2c_client *client, int len, unsigned char *msg, + ret = i2c_smbus_write_block_data(client, SSIF_IPMI_REQUEST, len, msg); + if (ret) { + retry_cnt--; +- if (retry_cnt > 0) ++ if (retry_cnt > 0) { ++ msleep(SSIF_REQ_RETRY_MSEC); + goto retry1; ++ } + return -ENODEV; + } + +@@ -1459,8 +1477,10 @@ static int start_multipart_test(struct i2c_client *client, + 32, msg); + if (ret) { + retry_cnt--; +- if (retry_cnt > 0) ++ if (retry_cnt > 0) { ++ msleep(SSIF_REQ_RETRY_MSEC); + goto retry_write; ++ } + dev_err(&client->dev, "Could not write multi-part start, though the BMC said it could handle it. Just limit sends to one part.\n"); + return ret; + } +-- +2.39.2 + diff --git a/queue-5.4/ipmi-ssif-increase-the-message-retry-time.patch b/queue-5.4/ipmi-ssif-increase-the-message-retry-time.patch new file mode 100644 index 00000000000..c648666532e --- /dev/null +++ b/queue-5.4/ipmi-ssif-increase-the-message-retry-time.patch @@ -0,0 +1,36 @@ +From 0f5062c13ad9df5d62066017015185f66d5fa611 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Nov 2022 15:03:11 -0500 +Subject: ipmi:ssif: Increase the message retry time + +From: Corey Minyard + +[ Upstream commit 39721d62bbc16ebc9bb2bdc2c163658f33da3b0b ] + +The spec states that the minimum message retry time is 60ms, but it was +set to 20ms. Correct it. + +Reported by: Tony Camuso +Signed-off-by: Corey Minyard +Stable-dep-of: 00bb7e763ec9 ("ipmi:ssif: Add a timer between request retries") +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_ssif.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c +index 9f1fb8a30a823..02ca0d9a0d8cb 100644 +--- a/drivers/char/ipmi/ipmi_ssif.c ++++ b/drivers/char/ipmi/ipmi_ssif.c +@@ -79,7 +79,7 @@ + /* + * Timer values + */ +-#define SSIF_MSG_USEC 20000 /* 20ms between message tries. */ ++#define SSIF_MSG_USEC 60000 /* 60ms between message tries. */ + #define SSIF_MSG_PART_USEC 5000 /* 5ms for a message part */ + + /* How many times to we retry sending/receiving the message. */ +-- +2.39.2 + diff --git a/queue-5.4/ipmi-ssif-make-ssif_i2c_send-void.patch b/queue-5.4/ipmi-ssif-make-ssif_i2c_send-void.patch new file mode 100644 index 00000000000..87d62d2e667 --- /dev/null +++ b/queue-5.4/ipmi-ssif-make-ssif_i2c_send-void.patch @@ -0,0 +1,182 @@ +From 1468c1898370ccd7811acfdef46fdedb8ce30e90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Mar 2021 22:05:15 +0800 +Subject: ipmi:ssif: make ssif_i2c_send() void + +From: Liguang Zhang + +[ Upstream commit dcd10526ac5a0d6cc94ce60b9acfca458163277b ] + +This function actually needs no return value. So remove the unneeded +check and make it void. + +Signed-off-by: Liguang Zhang +Message-Id: <20210301140515.18951-1-zhangliguang@linux.alibaba.com> +Signed-off-by: Corey Minyard +Stable-dep-of: 95767ed78a18 ("ipmi:ssif: resend_msg() cannot fail") +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_ssif.c | 81 +++++++++-------------------------- + 1 file changed, 20 insertions(+), 61 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c +index d6b69e19f78a7..5ead5e7f0ce16 100644 +--- a/drivers/char/ipmi/ipmi_ssif.c ++++ b/drivers/char/ipmi/ipmi_ssif.c +@@ -515,7 +515,7 @@ static int ipmi_ssif_thread(void *data) + return 0; + } + +-static int ssif_i2c_send(struct ssif_info *ssif_info, ++static void ssif_i2c_send(struct ssif_info *ssif_info, + ssif_i2c_done handler, + int read_write, int command, + unsigned char *data, unsigned int size) +@@ -527,7 +527,6 @@ static int ssif_i2c_send(struct ssif_info *ssif_info, + ssif_info->i2c_data = data; + ssif_info->i2c_size = size; + complete(&ssif_info->wake_thread); +- return 0; + } + + +@@ -536,22 +535,12 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, + + static void start_get(struct ssif_info *ssif_info) + { +- int rv; +- + ssif_info->rtc_us_timer = 0; + ssif_info->multi_pos = 0; + +- rv = ssif_i2c_send(ssif_info, msg_done_handler, I2C_SMBUS_READ, +- SSIF_IPMI_RESPONSE, +- ssif_info->recv, I2C_SMBUS_BLOCK_DATA); +- if (rv < 0) { +- /* request failed, just return the error. */ +- if (ssif_info->ssif_debug & SSIF_DEBUG_MSG) +- dev_dbg(&ssif_info->client->dev, +- "Error from i2c_non_blocking_op(5)\n"); +- +- msg_done_handler(ssif_info, -EIO, NULL, 0); +- } ++ ssif_i2c_send(ssif_info, msg_done_handler, I2C_SMBUS_READ, ++ SSIF_IPMI_RESPONSE, ++ ssif_info->recv, I2C_SMBUS_BLOCK_DATA); + } + + static void retry_timeout(struct timer_list *t) +@@ -625,7 +614,6 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, + { + struct ipmi_smi_msg *msg; + unsigned long oflags, *flags; +- int rv; + + /* + * We are single-threaded here, so no need for a lock until we +@@ -671,17 +659,10 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, + ssif_info->multi_len = len; + ssif_info->multi_pos = 1; + +- rv = ssif_i2c_send(ssif_info, msg_done_handler, I2C_SMBUS_READ, +- SSIF_IPMI_MULTI_PART_RESPONSE_MIDDLE, +- ssif_info->recv, I2C_SMBUS_BLOCK_DATA); +- if (rv < 0) { +- if (ssif_info->ssif_debug & SSIF_DEBUG_MSG) +- dev_dbg(&ssif_info->client->dev, +- "Error from i2c_non_blocking_op(1)\n"); +- +- result = -EIO; +- } else +- return; ++ ssif_i2c_send(ssif_info, msg_done_handler, I2C_SMBUS_READ, ++ SSIF_IPMI_MULTI_PART_RESPONSE_MIDDLE, ++ ssif_info->recv, I2C_SMBUS_BLOCK_DATA); ++ return; + } else if (ssif_info->multi_pos) { + /* Middle of multi-part read. Start the next transaction. */ + int i; +@@ -743,19 +724,12 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, + + ssif_info->multi_pos++; + +- rv = ssif_i2c_send(ssif_info, msg_done_handler, +- I2C_SMBUS_READ, +- SSIF_IPMI_MULTI_PART_RESPONSE_MIDDLE, +- ssif_info->recv, +- I2C_SMBUS_BLOCK_DATA); +- if (rv < 0) { +- if (ssif_info->ssif_debug & SSIF_DEBUG_MSG) +- dev_dbg(&ssif_info->client->dev, +- "Error from ssif_i2c_send\n"); +- +- result = -EIO; +- } else +- return; ++ ssif_i2c_send(ssif_info, msg_done_handler, ++ I2C_SMBUS_READ, ++ SSIF_IPMI_MULTI_PART_RESPONSE_MIDDLE, ++ ssif_info->recv, ++ I2C_SMBUS_BLOCK_DATA); ++ return; + } + } + +@@ -936,8 +910,6 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, + static void msg_written_handler(struct ssif_info *ssif_info, int result, + unsigned char *data, unsigned int len) + { +- int rv; +- + /* We are single-threaded here, so no need for a lock. */ + if (result < 0) { + ssif_info->retries_left--; +@@ -1000,18 +972,9 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, + ssif_info->multi_data = NULL; + } + +- rv = ssif_i2c_send(ssif_info, msg_written_handler, +- I2C_SMBUS_WRITE, cmd, +- data_to_send, I2C_SMBUS_BLOCK_DATA); +- if (rv < 0) { +- /* request failed, just return the error. */ +- ssif_inc_stat(ssif_info, send_errors); +- +- if (ssif_info->ssif_debug & SSIF_DEBUG_MSG) +- dev_dbg(&ssif_info->client->dev, +- "Error from i2c_non_blocking_op(3)\n"); +- msg_done_handler(ssif_info, -EIO, NULL, 0); +- } ++ ssif_i2c_send(ssif_info, msg_written_handler, ++ I2C_SMBUS_WRITE, cmd, ++ data_to_send, I2C_SMBUS_BLOCK_DATA); + } else { + /* Ready to request the result. */ + unsigned long oflags, *flags; +@@ -1040,7 +1003,6 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, + + static int start_resend(struct ssif_info *ssif_info) + { +- int rv; + int command; + + ssif_info->got_alert = false; +@@ -1062,12 +1024,9 @@ static int start_resend(struct ssif_info *ssif_info) + ssif_info->data[0] = ssif_info->data_len; + } + +- rv = ssif_i2c_send(ssif_info, msg_written_handler, I2C_SMBUS_WRITE, +- command, ssif_info->data, I2C_SMBUS_BLOCK_DATA); +- if (rv && (ssif_info->ssif_debug & SSIF_DEBUG_MSG)) +- dev_dbg(&ssif_info->client->dev, +- "Error from i2c_non_blocking_op(4)\n"); +- return rv; ++ ssif_i2c_send(ssif_info, msg_written_handler, I2C_SMBUS_WRITE, ++ command, ssif_info->data, I2C_SMBUS_BLOCK_DATA); ++ return 0; + } + + static int start_send(struct ssif_info *ssif_info, +-- +2.39.2 + diff --git a/queue-5.4/ipmi-ssif-remove-rtc_us_timer.patch b/queue-5.4/ipmi-ssif-remove-rtc_us_timer.patch new file mode 100644 index 00000000000..2d9de38637e --- /dev/null +++ b/queue-5.4/ipmi-ssif-remove-rtc_us_timer.patch @@ -0,0 +1,62 @@ +From a16cd86ec926988d1549eff3e15669fcb5a0959f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jan 2023 10:41:48 -0600 +Subject: ipmi:ssif: Remove rtc_us_timer + +From: Corey Minyard + +[ Upstream commit 9e8b89926fb87e5625bdde6fd5de2c31fb1d83bf ] + +It was cruft left over from older handling of run to completion. + +Cc: stable@vger.kernel.org +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_ssif.c | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c +index ff93009583ab1..9f1fb8a30a823 100644 +--- a/drivers/char/ipmi/ipmi_ssif.c ++++ b/drivers/char/ipmi/ipmi_ssif.c +@@ -248,12 +248,6 @@ struct ssif_info { + */ + bool req_flags; + +- /* +- * Used to perform timer operations when run-to-completion +- * mode is on. This is a countdown timer. +- */ +- int rtc_us_timer; +- + /* Used for sending/receiving data. +1 for the length. */ + unsigned char data[IPMI_MAX_MSG_LENGTH + 1]; + unsigned int data_len; +@@ -535,7 +529,6 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, + + static void start_get(struct ssif_info *ssif_info) + { +- ssif_info->rtc_us_timer = 0; + ssif_info->multi_pos = 0; + + ssif_i2c_send(ssif_info, msg_done_handler, I2C_SMBUS_READ, +@@ -627,7 +620,6 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, + + flags = ipmi_ssif_lock_cond(ssif_info, &oflags); + ssif_info->waiting_alert = true; +- ssif_info->rtc_us_timer = SSIF_MSG_USEC; + if (!ssif_info->stopping) + mod_timer(&ssif_info->retry_timer, + jiffies + SSIF_MSG_JIFFIES); +@@ -978,7 +970,6 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, + /* Wait a jiffie then request the next message */ + ssif_info->waiting_alert = true; + ssif_info->retries_left = SSIF_RECV_RETRIES; +- ssif_info->rtc_us_timer = SSIF_MSG_PART_USEC; + if (!ssif_info->stopping) + mod_timer(&ssif_info->retry_timer, + jiffies + SSIF_MSG_PART_JIFFIES); +-- +2.39.2 + diff --git a/queue-5.4/ipmi-ssif-resend_msg-cannot-fail.patch b/queue-5.4/ipmi-ssif-resend_msg-cannot-fail.patch new file mode 100644 index 00000000000..0c0f2fcc14b --- /dev/null +++ b/queue-5.4/ipmi-ssif-resend_msg-cannot-fail.patch @@ -0,0 +1,98 @@ +From 24909db90a448ff7d0fd69496a7f4db57bab891d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jan 2023 10:11:06 -0600 +Subject: ipmi:ssif: resend_msg() cannot fail + +From: Corey Minyard + +[ Upstream commit 95767ed78a181d5404202627499f9cde56053b96 ] + +The resend_msg() function cannot fail, but there was error handling +around using it. Rework the handling of the error, and fix the out of +retries debug reporting that was wrong around this, too. + +Cc: stable@vger.kernel.org +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_ssif.c | 28 +++++++--------------------- + 1 file changed, 7 insertions(+), 21 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c +index 5ead5e7f0ce16..ff93009583ab1 100644 +--- a/drivers/char/ipmi/ipmi_ssif.c ++++ b/drivers/char/ipmi/ipmi_ssif.c +@@ -607,7 +607,7 @@ static void ssif_alert(struct i2c_client *client, enum i2c_alert_protocol type, + start_get(ssif_info); + } + +-static int start_resend(struct ssif_info *ssif_info); ++static void start_resend(struct ssif_info *ssif_info); + + static void msg_done_handler(struct ssif_info *ssif_info, int result, + unsigned char *data, unsigned int len) +@@ -914,31 +914,17 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, + if (result < 0) { + ssif_info->retries_left--; + if (ssif_info->retries_left > 0) { +- if (!start_resend(ssif_info)) { +- ssif_inc_stat(ssif_info, send_retries); +- return; +- } +- /* request failed, just return the error. */ +- ssif_inc_stat(ssif_info, send_errors); +- +- if (ssif_info->ssif_debug & SSIF_DEBUG_MSG) +- dev_dbg(&ssif_info->client->dev, +- "%s: Out of retries\n", __func__); +- msg_done_handler(ssif_info, -EIO, NULL, 0); ++ start_resend(ssif_info); + return; + } + + ssif_inc_stat(ssif_info, send_errors); + +- /* +- * Got an error on transmit, let the done routine +- * handle it. +- */ + if (ssif_info->ssif_debug & SSIF_DEBUG_MSG) + dev_dbg(&ssif_info->client->dev, +- "%s: Error %d\n", __func__, result); ++ "%s: Out of retries\n", __func__); + +- msg_done_handler(ssif_info, result, NULL, 0); ++ msg_done_handler(ssif_info, -EIO, NULL, 0); + return; + } + +@@ -1001,7 +987,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, + } + } + +-static int start_resend(struct ssif_info *ssif_info) ++static void start_resend(struct ssif_info *ssif_info) + { + int command; + +@@ -1026,7 +1012,6 @@ static int start_resend(struct ssif_info *ssif_info) + + ssif_i2c_send(ssif_info, msg_written_handler, I2C_SMBUS_WRITE, + command, ssif_info->data, I2C_SMBUS_BLOCK_DATA); +- return 0; + } + + static int start_send(struct ssif_info *ssif_info, +@@ -1041,7 +1026,8 @@ static int start_send(struct ssif_info *ssif_info, + ssif_info->retries_left = SSIF_SEND_RETRIES; + memcpy(ssif_info->data + 1, data, len); + ssif_info->data_len = len; +- return start_resend(ssif_info); ++ start_resend(ssif_info); ++ return 0; + } + + /* Must be called with the message lock held. */ +-- +2.39.2 + diff --git a/queue-5.4/irqdomain-change-the-type-of-size-in-__irq_domain_ad.patch b/queue-5.4/irqdomain-change-the-type-of-size-in-__irq_domain_ad.patch new file mode 100644 index 00000000000..e192dbd595c --- /dev/null +++ b/queue-5.4/irqdomain-change-the-type-of-size-in-__irq_domain_ad.patch @@ -0,0 +1,53 @@ +From 441953ac47b95d7eb4ec77ae95f96b1b175b659f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Sep 2021 10:52:03 +0800 +Subject: irqdomain: Change the type of 'size' in __irq_domain_add() to be + consistent + +From: Bixuan Cui + +[ Upstream commit 20c36ce2164f1774b487d443ece99b754bc6ad43 ] + +The 'size' is used in struct_size(domain, revmap, size) and its input +parameter type is 'size_t'(unsigned int). +Changing the size to 'unsigned int' to make the type consistent. + +Signed-off-by: Bixuan Cui +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20210916025203.44841-1-cuibixuan@huawei.com +Stable-dep-of: 8932c32c3053 ("irqdomain: Fix domain registration race") +Signed-off-by: Sasha Levin +--- + include/linux/irqdomain.h | 2 +- + kernel/irq/irqdomain.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/linux/irqdomain.h b/include/linux/irqdomain.h +index 824d7a19dd66e..2552f66a7a891 100644 +--- a/include/linux/irqdomain.h ++++ b/include/linux/irqdomain.h +@@ -254,7 +254,7 @@ static inline struct fwnode_handle *irq_domain_alloc_fwnode(phys_addr_t *pa) + } + + void irq_domain_free_fwnode(struct fwnode_handle *fwnode); +-struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, int size, ++struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, unsigned int size, + irq_hw_number_t hwirq_max, int direct_max, + const struct irq_domain_ops *ops, + void *host_data); +diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c +index 3d1b570a1dadd..cfb5a96f023f7 100644 +--- a/kernel/irq/irqdomain.c ++++ b/kernel/irq/irqdomain.c +@@ -127,7 +127,7 @@ EXPORT_SYMBOL_GPL(irq_domain_free_fwnode); + * Allocates and initializes an irq_domain structure. + * Returns pointer to IRQ domain, or NULL on failure. + */ +-struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, int size, ++struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, unsigned int size, + irq_hw_number_t hwirq_max, int direct_max, + const struct irq_domain_ops *ops, + void *host_data) +-- +2.39.2 + diff --git a/queue-5.4/irqdomain-fix-domain-registration-race.patch b/queue-5.4/irqdomain-fix-domain-registration-race.patch new file mode 100644 index 00000000000..e412ee52a02 --- /dev/null +++ b/queue-5.4/irqdomain-fix-domain-registration-race.patch @@ -0,0 +1,134 @@ +From f74ad37d428499ea196d0a5d8a58daf8d3384944 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Feb 2023 11:42:49 +0100 +Subject: irqdomain: Fix domain registration race + +From: Marc Zyngier + +[ Upstream commit 8932c32c3053accd50702b36e944ac2016cd103c ] + +Hierarchical domains created using irq_domain_create_hierarchy() are +currently added to the domain list before having been fully initialised. + +This specifically means that a racing allocation request might fail to +allocate irq data for the inner domains of a hierarchy in case the +parent domain pointer has not yet been set up. + +Note that this is not really any issue for irqchip drivers that are +registered early (e.g. via IRQCHIP_DECLARE() or IRQCHIP_ACPI_DECLARE()) +but could potentially cause trouble with drivers that are registered +later (e.g. modular drivers using IRQCHIP_PLATFORM_DRIVER_BEGIN(), +gpiochip drivers, etc.). + +Fixes: afb7da83b9f4 ("irqdomain: Introduce helper function irq_domain_add_hierarchy()") +Cc: stable@vger.kernel.org # 3.19 +Signed-off-by: Marc Zyngier +[ johan: add commit message ] +Signed-off-by: Johan Hovold +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230213104302.17307-8-johan+linaro@kernel.org +Signed-off-by: Sasha Levin +--- + kernel/irq/irqdomain.c | 62 +++++++++++++++++++++++++++++------------- + 1 file changed, 43 insertions(+), 19 deletions(-) + +diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c +index cfb5a96f023f7..d40ae18fe6617 100644 +--- a/kernel/irq/irqdomain.c ++++ b/kernel/irq/irqdomain.c +@@ -114,23 +114,12 @@ void irq_domain_free_fwnode(struct fwnode_handle *fwnode) + } + EXPORT_SYMBOL_GPL(irq_domain_free_fwnode); + +-/** +- * __irq_domain_add() - Allocate a new irq_domain data structure +- * @fwnode: firmware node for the interrupt controller +- * @size: Size of linear map; 0 for radix mapping only +- * @hwirq_max: Maximum number of interrupts supported by controller +- * @direct_max: Maximum value of direct maps; Use ~0 for no limit; 0 for no +- * direct mapping +- * @ops: domain callbacks +- * @host_data: Controller private data pointer +- * +- * Allocates and initializes an irq_domain structure. +- * Returns pointer to IRQ domain, or NULL on failure. +- */ +-struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, unsigned int size, +- irq_hw_number_t hwirq_max, int direct_max, +- const struct irq_domain_ops *ops, +- void *host_data) ++static struct irq_domain *__irq_domain_create(struct fwnode_handle *fwnode, ++ unsigned int size, ++ irq_hw_number_t hwirq_max, ++ int direct_max, ++ const struct irq_domain_ops *ops, ++ void *host_data) + { + struct device_node *of_node = to_of_node(fwnode); + struct irqchip_fwid *fwid; +@@ -222,12 +211,44 @@ struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, unsigned int s + domain->revmap_direct_max_irq = direct_max; + irq_domain_check_hierarchy(domain); + ++ return domain; ++} ++ ++static void __irq_domain_publish(struct irq_domain *domain) ++{ + mutex_lock(&irq_domain_mutex); + debugfs_add_domain_dir(domain); + list_add(&domain->link, &irq_domain_list); + mutex_unlock(&irq_domain_mutex); + + pr_debug("Added domain %s\n", domain->name); ++} ++ ++/** ++ * __irq_domain_add() - Allocate a new irq_domain data structure ++ * @fwnode: firmware node for the interrupt controller ++ * @size: Size of linear map; 0 for radix mapping only ++ * @hwirq_max: Maximum number of interrupts supported by controller ++ * @direct_max: Maximum value of direct maps; Use ~0 for no limit; 0 for no ++ * direct mapping ++ * @ops: domain callbacks ++ * @host_data: Controller private data pointer ++ * ++ * Allocates and initializes an irq_domain structure. ++ * Returns pointer to IRQ domain, or NULL on failure. ++ */ ++struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, unsigned int size, ++ irq_hw_number_t hwirq_max, int direct_max, ++ const struct irq_domain_ops *ops, ++ void *host_data) ++{ ++ struct irq_domain *domain; ++ ++ domain = __irq_domain_create(fwnode, size, hwirq_max, direct_max, ++ ops, host_data); ++ if (domain) ++ __irq_domain_publish(domain); ++ + return domain; + } + EXPORT_SYMBOL_GPL(__irq_domain_add); +@@ -1068,12 +1089,15 @@ struct irq_domain *irq_domain_create_hierarchy(struct irq_domain *parent, + struct irq_domain *domain; + + if (size) +- domain = irq_domain_create_linear(fwnode, size, ops, host_data); ++ domain = __irq_domain_create(fwnode, size, size, 0, ops, host_data); + else +- domain = irq_domain_create_tree(fwnode, ops, host_data); ++ domain = __irq_domain_create(fwnode, 0, ~0, 0, ops, host_data); ++ + if (domain) { + domain->parent = parent; + domain->flags |= flags; ++ ++ __irq_domain_publish(domain); + } + + return domain; +-- +2.39.2 + diff --git a/queue-5.4/net-caif-fix-use-after-free-in-cfusbl_device_notify.patch b/queue-5.4/net-caif-fix-use-after-free-in-cfusbl_device_notify.patch new file mode 100644 index 00000000000..55791668f11 --- /dev/null +++ b/queue-5.4/net-caif-fix-use-after-free-in-cfusbl_device_notify.patch @@ -0,0 +1,86 @@ +From 99a26fa975ffdce2a07db079f0a7900ba940e232 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Mar 2023 01:39:13 +0900 +Subject: net: caif: Fix use-after-free in cfusbl_device_notify() + +From: Shigeru Yoshida + +[ Upstream commit 9781e98a97110f5e76999058368b4be76a788484 ] + +syzbot reported use-after-free in cfusbl_device_notify() [1]. This +causes a stack trace like below: + +BUG: KASAN: use-after-free in cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138 +Read of size 8 at addr ffff88807ac4e6f0 by task kworker/u4:6/1214 + +CPU: 0 PID: 1214 Comm: kworker/u4:6 Not tainted 5.19.0-rc3-syzkaller-00146-g92f20ff72066 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Workqueue: netns cleanup_net +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 + print_address_description.constprop.0.cold+0xeb/0x467 mm/kasan/report.c:313 + print_report mm/kasan/report.c:429 [inline] + kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491 + cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138 + notifier_call_chain+0xb5/0x200 kernel/notifier.c:87 + call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1945 + call_netdevice_notifiers_extack net/core/dev.c:1983 [inline] + call_netdevice_notifiers net/core/dev.c:1997 [inline] + netdev_wait_allrefs_any net/core/dev.c:10227 [inline] + netdev_run_todo+0xbc0/0x10f0 net/core/dev.c:10341 + default_device_exit_batch+0x44e/0x590 net/core/dev.c:11334 + ops_exit_list+0x125/0x170 net/core/net_namespace.c:167 + cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594 + process_one_work+0x996/0x1610 kernel/workqueue.c:2289 + worker_thread+0x665/0x1080 kernel/workqueue.c:2436 + kthread+0x2e9/0x3a0 kernel/kthread.c:376 + ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 + + +When unregistering a net device, unregister_netdevice_many_notify() +sets the device's reg_state to NETREG_UNREGISTERING, calls notifiers +with NETDEV_UNREGISTER, and adds the device to the todo list. + +Later on, devices in the todo list are processed by netdev_run_todo(). +netdev_run_todo() waits devices' reference count become 1 while +rebdoadcasting NETDEV_UNREGISTER notification. + +When cfusbl_device_notify() is called with NETDEV_UNREGISTER multiple +times, the parent device might be freed. This could cause UAF. +Processing NETDEV_UNREGISTER multiple times also causes inbalance of +reference count for the module. + +This patch fixes the issue by accepting only first NETDEV_UNREGISTER +notification. + +Fixes: 7ad65bf68d70 ("caif: Add support for CAIF over CDC NCM USB interface") +CC: sjur.brandeland@stericsson.com +Reported-by: syzbot+b563d33852b893653a9e@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?id=c3bfd8e2450adab3bffe4d80821fbbced600407f [1] +Signed-off-by: Shigeru Yoshida +Link: https://lore.kernel.org/r/20230301163913.391304-1-syoshida@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/caif/caif_usb.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/caif/caif_usb.c b/net/caif/caif_usb.c +index 46c62dd1479b8..862226be22868 100644 +--- a/net/caif/caif_usb.c ++++ b/net/caif/caif_usb.c +@@ -134,6 +134,9 @@ static int cfusbl_device_notify(struct notifier_block *me, unsigned long what, + struct usb_device *usbdev; + int res; + ++ if (what == NETDEV_UNREGISTER && dev->reg_state >= NETREG_UNREGISTERED) ++ return 0; ++ + /* Check whether we have a NCM device, and find its VID/PID. */ + if (!(dev->dev.parent && dev->dev.parent->driver && + strcmp(dev->dev.parent->driver->name, "cdc_ncm") == 0)) +-- +2.39.2 + diff --git a/queue-5.4/net-lan78xx-fix-accessing-the-lan7800-s-internal-phy.patch b/queue-5.4/net-lan78xx-fix-accessing-the-lan7800-s-internal-phy.patch new file mode 100644 index 00000000000..8ffd0027e71 --- /dev/null +++ b/queue-5.4/net-lan78xx-fix-accessing-the-lan7800-s-internal-phy.patch @@ -0,0 +1,126 @@ +From fa9655a5eb449eb369573ec1f90ac53d6f671c1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Mar 2023 08:43:07 -0700 +Subject: net: lan78xx: fix accessing the LAN7800's internal phy specific + registers from the MAC driver + +From: Yuiko Oshino + +[ Upstream commit e57cf3639c323eeed05d3725fd82f91b349adca8 ] + +Move the LAN7800 internal phy (phy ID 0x0007c132) specific register +accesses to the phy driver (microchip.c). + +Fix the error reported by Enguerrand de Ribaucourt in December 2022, +"Some operations during the cable switch workaround modify the register +LAN88XX_INT_MASK of the PHY. However, this register is specific to the +LAN8835 PHY. For instance, if a DP8322I PHY is connected to the LAN7801, +that register (0x19), corresponds to the LED and MAC address +configuration, resulting in unapropriate behavior." + +I did not test with the DP8322I PHY, but I tested with an EVB-LAN7800 +with the internal PHY. + +Fixes: 14437e3fa284 ("lan78xx: workaround of forced 100 Full/Half duplex mode error") +Signed-off-by: Yuiko Oshino +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20230301154307.30438-1-yuiko.oshino@microchip.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/microchip.c | 32 ++++++++++++++++++++++++++++++++ + drivers/net/usb/lan78xx.c | 27 +-------------------------- + 2 files changed, 33 insertions(+), 26 deletions(-) + +diff --git a/drivers/net/phy/microchip.c b/drivers/net/phy/microchip.c +index a644e8e5071c3..375bbd60b38af 100644 +--- a/drivers/net/phy/microchip.c ++++ b/drivers/net/phy/microchip.c +@@ -326,6 +326,37 @@ static int lan88xx_config_aneg(struct phy_device *phydev) + return genphy_config_aneg(phydev); + } + ++static void lan88xx_link_change_notify(struct phy_device *phydev) ++{ ++ int temp; ++ ++ /* At forced 100 F/H mode, chip may fail to set mode correctly ++ * when cable is switched between long(~50+m) and short one. ++ * As workaround, set to 10 before setting to 100 ++ * at forced 100 F/H mode. ++ */ ++ if (!phydev->autoneg && phydev->speed == 100) { ++ /* disable phy interrupt */ ++ temp = phy_read(phydev, LAN88XX_INT_MASK); ++ temp &= ~LAN88XX_INT_MASK_MDINTPIN_EN_; ++ phy_write(phydev, LAN88XX_INT_MASK, temp); ++ ++ temp = phy_read(phydev, MII_BMCR); ++ temp &= ~(BMCR_SPEED100 | BMCR_SPEED1000); ++ phy_write(phydev, MII_BMCR, temp); /* set to 10 first */ ++ temp |= BMCR_SPEED100; ++ phy_write(phydev, MII_BMCR, temp); /* set to 100 later */ ++ ++ /* clear pending interrupt generated while workaround */ ++ temp = phy_read(phydev, LAN88XX_INT_STS); ++ ++ /* enable phy interrupt back */ ++ temp = phy_read(phydev, LAN88XX_INT_MASK); ++ temp |= LAN88XX_INT_MASK_MDINTPIN_EN_; ++ phy_write(phydev, LAN88XX_INT_MASK, temp); ++ } ++} ++ + static struct phy_driver microchip_phy_driver[] = { + { + .phy_id = 0x0007c130, +@@ -339,6 +370,7 @@ static struct phy_driver microchip_phy_driver[] = { + + .config_init = lan88xx_config_init, + .config_aneg = lan88xx_config_aneg, ++ .link_change_notify = lan88xx_link_change_notify, + + .ack_interrupt = lan88xx_phy_ack_interrupt, + .config_intr = lan88xx_phy_config_intr, +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 5454a20384284..b51017966bb37 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -1851,33 +1851,8 @@ static void lan78xx_remove_mdio(struct lan78xx_net *dev) + static void lan78xx_link_status_change(struct net_device *net) + { + struct phy_device *phydev = net->phydev; +- int temp; +- +- /* At forced 100 F/H mode, chip may fail to set mode correctly +- * when cable is switched between long(~50+m) and short one. +- * As workaround, set to 10 before setting to 100 +- * at forced 100 F/H mode. +- */ +- if (!phydev->autoneg && (phydev->speed == 100)) { +- /* disable phy interrupt */ +- temp = phy_read(phydev, LAN88XX_INT_MASK); +- temp &= ~LAN88XX_INT_MASK_MDINTPIN_EN_; +- phy_write(phydev, LAN88XX_INT_MASK, temp); + +- temp = phy_read(phydev, MII_BMCR); +- temp &= ~(BMCR_SPEED100 | BMCR_SPEED1000); +- phy_write(phydev, MII_BMCR, temp); /* set to 10 first */ +- temp |= BMCR_SPEED100; +- phy_write(phydev, MII_BMCR, temp); /* set to 100 later */ +- +- /* clear pending interrupt generated while workaround */ +- temp = phy_read(phydev, LAN88XX_INT_STS); +- +- /* enable phy interrupt back */ +- temp = phy_read(phydev, LAN88XX_INT_MASK); +- temp |= LAN88XX_INT_MASK_MDINTPIN_EN_; +- phy_write(phydev, LAN88XX_INT_MASK, temp); +- } ++ phy_print_status(phydev); + } + + static int irq_map(struct irq_domain *d, unsigned int irq, +-- +2.39.2 + diff --git a/queue-5.4/net-smc-fix-fallback-failed-while-sendmsg-with-fasto.patch b/queue-5.4/net-smc-fix-fallback-failed-while-sendmsg-with-fasto.patch new file mode 100644 index 00000000000..7c98efba6d5 --- /dev/null +++ b/queue-5.4/net-smc-fix-fallback-failed-while-sendmsg-with-fasto.patch @@ -0,0 +1,74 @@ +From a3f763d342f8bf0cecebf73d7102e86eb4536413 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 11:23:46 +0800 +Subject: net/smc: fix fallback failed while sendmsg with fastopen + +From: D. Wythe + +[ Upstream commit ce7ca794712f186da99719e8b4e97bd5ddbb04c3 ] + +Before determining whether the msg has unsupported options, it has been +prematurely terminated by the wrong status check. + +For the application, the general usages of MSG_FASTOPEN likes + +fd = socket(...) +/* rather than connect */ +sendto(fd, data, len, MSG_FASTOPEN) + +Hence, We need to check the flag before state check, because the sock +state here is always SMC_INIT when applications tries MSG_FASTOPEN. +Once we found unsupported options, fallback it to TCP. + +Fixes: ee9dfbef02d1 ("net/smc: handle sockopts forcing fallback") +Signed-off-by: D. Wythe +Signed-off-by: Simon Horman + +v2 -> v1: Optimize code style +Reviewed-by: Tony Lu + +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/af_smc.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index 5d696b7fb47e1..b398d72a7bc39 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -1542,16 +1542,14 @@ static int smc_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + { + struct sock *sk = sock->sk; + struct smc_sock *smc; +- int rc = -EPIPE; ++ int rc; + + smc = smc_sk(sk); + lock_sock(sk); +- if ((sk->sk_state != SMC_ACTIVE) && +- (sk->sk_state != SMC_APPCLOSEWAIT1) && +- (sk->sk_state != SMC_INIT)) +- goto out; + ++ /* SMC does not support connect with fastopen */ + if (msg->msg_flags & MSG_FASTOPEN) { ++ /* not connected yet, fallback */ + if (sk->sk_state == SMC_INIT && !smc->connect_nonblock) { + smc_switch_to_fallback(smc); + smc->fallback_rsn = SMC_CLC_DECL_OPTUNSUPP; +@@ -1559,6 +1557,11 @@ static int smc_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + rc = -EINVAL; + goto out; + } ++ } else if ((sk->sk_state != SMC_ACTIVE) && ++ (sk->sk_state != SMC_APPCLOSEWAIT1) && ++ (sk->sk_state != SMC_INIT)) { ++ rc = -EPIPE; ++ goto out; + } + + if (smc->use_fallback) +-- +2.39.2 + diff --git a/queue-5.4/net-usb-lan78xx-remove-lots-of-set-but-unused-ret-va.patch b/queue-5.4/net-usb-lan78xx-remove-lots-of-set-but-unused-ret-va.patch new file mode 100644 index 00000000000..82c6df9027b --- /dev/null +++ b/queue-5.4/net-usb-lan78xx-remove-lots-of-set-but-unused-ret-va.patch @@ -0,0 +1,540 @@ +From 6304ebb3bb776dc69dc82b7978aa4726893d8637 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Nov 2020 11:45:06 +0000 +Subject: net: usb: lan78xx: Remove lots of set but unused 'ret' variables +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lee Jones + +[ Upstream commit 06cd7c46b3ab3f2252c61bf85b191236cf0254e1 ] + +Fixes the following W=1 kernel build warning(s): + + drivers/net/usb/lan78xx.c: In function ‘lan78xx_read_raw_otp’: + drivers/net/usb/lan78xx.c:825:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable] + drivers/net/usb/lan78xx.c: In function ‘lan78xx_write_raw_otp’: + drivers/net/usb/lan78xx.c:879:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable] + drivers/net/usb/lan78xx.c: In function ‘lan78xx_deferred_multicast_write’: + drivers/net/usb/lan78xx.c:1041:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable] + drivers/net/usb/lan78xx.c: In function ‘lan78xx_update_flowcontrol’: + drivers/net/usb/lan78xx.c:1127:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable] + drivers/net/usb/lan78xx.c: In function ‘lan78xx_init_mac_address’: + drivers/net/usb/lan78xx.c:1666:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable] + drivers/net/usb/lan78xx.c: In function ‘lan78xx_link_status_change’: + drivers/net/usb/lan78xx.c:1841:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable] + drivers/net/usb/lan78xx.c: In function ‘lan78xx_irq_bus_sync_unlock’: + drivers/net/usb/lan78xx.c:1920:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable] + drivers/net/usb/lan78xx.c: In function ‘lan8835_fixup’: + drivers/net/usb/lan78xx.c:1994:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable] + drivers/net/usb/lan78xx.c: In function ‘lan78xx_set_rx_max_frame_length’: + drivers/net/usb/lan78xx.c:2192:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable] + drivers/net/usb/lan78xx.c: In function ‘lan78xx_change_mtu’: + drivers/net/usb/lan78xx.c:2270:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable] + drivers/net/usb/lan78xx.c: In function ‘lan78xx_set_mac_addr’: + drivers/net/usb/lan78xx.c:2299:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable] + drivers/net/usb/lan78xx.c: In function ‘lan78xx_set_features’: + drivers/net/usb/lan78xx.c:2333:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable] + drivers/net/usb/lan78xx.c: In function ‘lan78xx_set_suspend’: + drivers/net/usb/lan78xx.c:3807:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable] + +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20201102114512.1062724-25-lee.jones@linaro.org +Signed-off-by: Jakub Kicinski +Stable-dep-of: e57cf3639c32 ("net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver") +Signed-off-by: Sasha Levin +--- + drivers/net/usb/lan78xx.c | 168 ++++++++++++++++++-------------------- + 1 file changed, 78 insertions(+), 90 deletions(-) + +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index ce3c8f476d75c..5454a20384284 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -824,20 +824,19 @@ static int lan78xx_read_raw_otp(struct lan78xx_net *dev, u32 offset, + u32 length, u8 *data) + { + int i; +- int ret; + u32 buf; + unsigned long timeout; + +- ret = lan78xx_read_reg(dev, OTP_PWR_DN, &buf); ++ lan78xx_read_reg(dev, OTP_PWR_DN, &buf); + + if (buf & OTP_PWR_DN_PWRDN_N_) { + /* clear it and wait to be cleared */ +- ret = lan78xx_write_reg(dev, OTP_PWR_DN, 0); ++ lan78xx_write_reg(dev, OTP_PWR_DN, 0); + + timeout = jiffies + HZ; + do { + usleep_range(1, 10); +- ret = lan78xx_read_reg(dev, OTP_PWR_DN, &buf); ++ lan78xx_read_reg(dev, OTP_PWR_DN, &buf); + if (time_after(jiffies, timeout)) { + netdev_warn(dev->net, + "timeout on OTP_PWR_DN"); +@@ -847,18 +846,18 @@ static int lan78xx_read_raw_otp(struct lan78xx_net *dev, u32 offset, + } + + for (i = 0; i < length; i++) { +- ret = lan78xx_write_reg(dev, OTP_ADDR1, ++ lan78xx_write_reg(dev, OTP_ADDR1, + ((offset + i) >> 8) & OTP_ADDR1_15_11); +- ret = lan78xx_write_reg(dev, OTP_ADDR2, ++ lan78xx_write_reg(dev, OTP_ADDR2, + ((offset + i) & OTP_ADDR2_10_3)); + +- ret = lan78xx_write_reg(dev, OTP_FUNC_CMD, OTP_FUNC_CMD_READ_); +- ret = lan78xx_write_reg(dev, OTP_CMD_GO, OTP_CMD_GO_GO_); ++ lan78xx_write_reg(dev, OTP_FUNC_CMD, OTP_FUNC_CMD_READ_); ++ lan78xx_write_reg(dev, OTP_CMD_GO, OTP_CMD_GO_GO_); + + timeout = jiffies + HZ; + do { + udelay(1); +- ret = lan78xx_read_reg(dev, OTP_STATUS, &buf); ++ lan78xx_read_reg(dev, OTP_STATUS, &buf); + if (time_after(jiffies, timeout)) { + netdev_warn(dev->net, + "timeout on OTP_STATUS"); +@@ -866,7 +865,7 @@ static int lan78xx_read_raw_otp(struct lan78xx_net *dev, u32 offset, + } + } while (buf & OTP_STATUS_BUSY_); + +- ret = lan78xx_read_reg(dev, OTP_RD_DATA, &buf); ++ lan78xx_read_reg(dev, OTP_RD_DATA, &buf); + + data[i] = (u8)(buf & 0xFF); + } +@@ -878,20 +877,19 @@ static int lan78xx_write_raw_otp(struct lan78xx_net *dev, u32 offset, + u32 length, u8 *data) + { + int i; +- int ret; + u32 buf; + unsigned long timeout; + +- ret = lan78xx_read_reg(dev, OTP_PWR_DN, &buf); ++ lan78xx_read_reg(dev, OTP_PWR_DN, &buf); + + if (buf & OTP_PWR_DN_PWRDN_N_) { + /* clear it and wait to be cleared */ +- ret = lan78xx_write_reg(dev, OTP_PWR_DN, 0); ++ lan78xx_write_reg(dev, OTP_PWR_DN, 0); + + timeout = jiffies + HZ; + do { + udelay(1); +- ret = lan78xx_read_reg(dev, OTP_PWR_DN, &buf); ++ lan78xx_read_reg(dev, OTP_PWR_DN, &buf); + if (time_after(jiffies, timeout)) { + netdev_warn(dev->net, + "timeout on OTP_PWR_DN completion"); +@@ -901,21 +899,21 @@ static int lan78xx_write_raw_otp(struct lan78xx_net *dev, u32 offset, + } + + /* set to BYTE program mode */ +- ret = lan78xx_write_reg(dev, OTP_PRGM_MODE, OTP_PRGM_MODE_BYTE_); ++ lan78xx_write_reg(dev, OTP_PRGM_MODE, OTP_PRGM_MODE_BYTE_); + + for (i = 0; i < length; i++) { +- ret = lan78xx_write_reg(dev, OTP_ADDR1, ++ lan78xx_write_reg(dev, OTP_ADDR1, + ((offset + i) >> 8) & OTP_ADDR1_15_11); +- ret = lan78xx_write_reg(dev, OTP_ADDR2, ++ lan78xx_write_reg(dev, OTP_ADDR2, + ((offset + i) & OTP_ADDR2_10_3)); +- ret = lan78xx_write_reg(dev, OTP_PRGM_DATA, data[i]); +- ret = lan78xx_write_reg(dev, OTP_TST_CMD, OTP_TST_CMD_PRGVRFY_); +- ret = lan78xx_write_reg(dev, OTP_CMD_GO, OTP_CMD_GO_GO_); ++ lan78xx_write_reg(dev, OTP_PRGM_DATA, data[i]); ++ lan78xx_write_reg(dev, OTP_TST_CMD, OTP_TST_CMD_PRGVRFY_); ++ lan78xx_write_reg(dev, OTP_CMD_GO, OTP_CMD_GO_GO_); + + timeout = jiffies + HZ; + do { + udelay(1); +- ret = lan78xx_read_reg(dev, OTP_STATUS, &buf); ++ lan78xx_read_reg(dev, OTP_STATUS, &buf); + if (time_after(jiffies, timeout)) { + netdev_warn(dev->net, + "Timeout on OTP_STATUS completion"); +@@ -1040,7 +1038,6 @@ static void lan78xx_deferred_multicast_write(struct work_struct *param) + container_of(param, struct lan78xx_priv, set_multicast); + struct lan78xx_net *dev = pdata->dev; + int i; +- int ret; + + netif_dbg(dev, drv, dev->net, "deferred multicast write 0x%08x\n", + pdata->rfe_ctl); +@@ -1049,14 +1046,14 @@ static void lan78xx_deferred_multicast_write(struct work_struct *param) + DP_SEL_VHF_HASH_LEN, pdata->mchash_table); + + for (i = 1; i < NUM_OF_MAF; i++) { +- ret = lan78xx_write_reg(dev, MAF_HI(i), 0); +- ret = lan78xx_write_reg(dev, MAF_LO(i), ++ lan78xx_write_reg(dev, MAF_HI(i), 0); ++ lan78xx_write_reg(dev, MAF_LO(i), + pdata->pfilter_table[i][1]); +- ret = lan78xx_write_reg(dev, MAF_HI(i), ++ lan78xx_write_reg(dev, MAF_HI(i), + pdata->pfilter_table[i][0]); + } + +- ret = lan78xx_write_reg(dev, RFE_CTL, pdata->rfe_ctl); ++ lan78xx_write_reg(dev, RFE_CTL, pdata->rfe_ctl); + } + + static void lan78xx_set_multicast(struct net_device *netdev) +@@ -1126,7 +1123,6 @@ static int lan78xx_update_flowcontrol(struct lan78xx_net *dev, u8 duplex, + u16 lcladv, u16 rmtadv) + { + u32 flow = 0, fct_flow = 0; +- int ret; + u8 cap; + + if (dev->fc_autoneg) +@@ -1149,10 +1145,10 @@ static int lan78xx_update_flowcontrol(struct lan78xx_net *dev, u8 duplex, + (cap & FLOW_CTRL_RX ? "enabled" : "disabled"), + (cap & FLOW_CTRL_TX ? "enabled" : "disabled")); + +- ret = lan78xx_write_reg(dev, FCT_FLOW, fct_flow); ++ lan78xx_write_reg(dev, FCT_FLOW, fct_flow); + + /* threshold value should be set before enabling flow */ +- ret = lan78xx_write_reg(dev, FLOW, flow); ++ lan78xx_write_reg(dev, FLOW, flow); + + return 0; + } +@@ -1681,11 +1677,10 @@ static int lan78xx_ioctl(struct net_device *netdev, struct ifreq *rq, int cmd) + static void lan78xx_init_mac_address(struct lan78xx_net *dev) + { + u32 addr_lo, addr_hi; +- int ret; + u8 addr[6]; + +- ret = lan78xx_read_reg(dev, RX_ADDRL, &addr_lo); +- ret = lan78xx_read_reg(dev, RX_ADDRH, &addr_hi); ++ lan78xx_read_reg(dev, RX_ADDRL, &addr_lo); ++ lan78xx_read_reg(dev, RX_ADDRH, &addr_hi); + + addr[0] = addr_lo & 0xFF; + addr[1] = (addr_lo >> 8) & 0xFF; +@@ -1718,12 +1713,12 @@ static void lan78xx_init_mac_address(struct lan78xx_net *dev) + (addr[2] << 16) | (addr[3] << 24); + addr_hi = addr[4] | (addr[5] << 8); + +- ret = lan78xx_write_reg(dev, RX_ADDRL, addr_lo); +- ret = lan78xx_write_reg(dev, RX_ADDRH, addr_hi); ++ lan78xx_write_reg(dev, RX_ADDRL, addr_lo); ++ lan78xx_write_reg(dev, RX_ADDRH, addr_hi); + } + +- ret = lan78xx_write_reg(dev, MAF_LO(0), addr_lo); +- ret = lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_); ++ lan78xx_write_reg(dev, MAF_LO(0), addr_lo); ++ lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_); + + ether_addr_copy(dev->net->dev_addr, addr); + } +@@ -1856,7 +1851,7 @@ static void lan78xx_remove_mdio(struct lan78xx_net *dev) + static void lan78xx_link_status_change(struct net_device *net) + { + struct phy_device *phydev = net->phydev; +- int ret, temp; ++ int temp; + + /* At forced 100 F/H mode, chip may fail to set mode correctly + * when cable is switched between long(~50+m) and short one. +@@ -1867,7 +1862,7 @@ static void lan78xx_link_status_change(struct net_device *net) + /* disable phy interrupt */ + temp = phy_read(phydev, LAN88XX_INT_MASK); + temp &= ~LAN88XX_INT_MASK_MDINTPIN_EN_; +- ret = phy_write(phydev, LAN88XX_INT_MASK, temp); ++ phy_write(phydev, LAN88XX_INT_MASK, temp); + + temp = phy_read(phydev, MII_BMCR); + temp &= ~(BMCR_SPEED100 | BMCR_SPEED1000); +@@ -1881,7 +1876,7 @@ static void lan78xx_link_status_change(struct net_device *net) + /* enable phy interrupt back */ + temp = phy_read(phydev, LAN88XX_INT_MASK); + temp |= LAN88XX_INT_MASK_MDINTPIN_EN_; +- ret = phy_write(phydev, LAN88XX_INT_MASK, temp); ++ phy_write(phydev, LAN88XX_INT_MASK, temp); + } + } + +@@ -1935,14 +1930,13 @@ static void lan78xx_irq_bus_sync_unlock(struct irq_data *irqd) + struct lan78xx_net *dev = + container_of(data, struct lan78xx_net, domain_data); + u32 buf; +- int ret; + + /* call register access here because irq_bus_lock & irq_bus_sync_unlock + * are only two callbacks executed in non-atomic contex. + */ +- ret = lan78xx_read_reg(dev, INT_EP_CTL, &buf); ++ lan78xx_read_reg(dev, INT_EP_CTL, &buf); + if (buf != data->irqenable) +- ret = lan78xx_write_reg(dev, INT_EP_CTL, data->irqenable); ++ lan78xx_write_reg(dev, INT_EP_CTL, data->irqenable); + + mutex_unlock(&data->irq_lock); + } +@@ -2009,7 +2003,6 @@ static void lan78xx_remove_irq_domain(struct lan78xx_net *dev) + static int lan8835_fixup(struct phy_device *phydev) + { + int buf; +- int ret; + struct lan78xx_net *dev = netdev_priv(phydev->attached_dev); + + /* LED2/PME_N/IRQ_N/RGMII_ID pin to IRQ_N mode */ +@@ -2019,11 +2012,11 @@ static int lan8835_fixup(struct phy_device *phydev) + phy_write_mmd(phydev, MDIO_MMD_PCS, 0x8010, buf); + + /* RGMII MAC TXC Delay Enable */ +- ret = lan78xx_write_reg(dev, MAC_RGMII_ID, ++ lan78xx_write_reg(dev, MAC_RGMII_ID, + MAC_RGMII_ID_TXC_DELAY_EN_); + + /* RGMII TX DLL Tune Adjust */ +- ret = lan78xx_write_reg(dev, RGMII_TX_BYP_DLL, 0x3D00); ++ lan78xx_write_reg(dev, RGMII_TX_BYP_DLL, 0x3D00); + + dev->interface = PHY_INTERFACE_MODE_RGMII_TXID; + +@@ -2207,28 +2200,27 @@ static int lan78xx_phy_init(struct lan78xx_net *dev) + + static int lan78xx_set_rx_max_frame_length(struct lan78xx_net *dev, int size) + { +- int ret = 0; + u32 buf; + bool rxenabled; + +- ret = lan78xx_read_reg(dev, MAC_RX, &buf); ++ lan78xx_read_reg(dev, MAC_RX, &buf); + + rxenabled = ((buf & MAC_RX_RXEN_) != 0); + + if (rxenabled) { + buf &= ~MAC_RX_RXEN_; +- ret = lan78xx_write_reg(dev, MAC_RX, buf); ++ lan78xx_write_reg(dev, MAC_RX, buf); + } + + /* add 4 to size for FCS */ + buf &= ~MAC_RX_MAX_SIZE_MASK_; + buf |= (((size + 4) << MAC_RX_MAX_SIZE_SHIFT_) & MAC_RX_MAX_SIZE_MASK_); + +- ret = lan78xx_write_reg(dev, MAC_RX, buf); ++ lan78xx_write_reg(dev, MAC_RX, buf); + + if (rxenabled) { + buf |= MAC_RX_RXEN_; +- ret = lan78xx_write_reg(dev, MAC_RX, buf); ++ lan78xx_write_reg(dev, MAC_RX, buf); + } + + return 0; +@@ -2285,13 +2277,12 @@ static int lan78xx_change_mtu(struct net_device *netdev, int new_mtu) + int ll_mtu = new_mtu + netdev->hard_header_len; + int old_hard_mtu = dev->hard_mtu; + int old_rx_urb_size = dev->rx_urb_size; +- int ret; + + /* no second zero-length packet read wanted after mtu-sized packets */ + if ((ll_mtu % dev->maxpacket) == 0) + return -EDOM; + +- ret = lan78xx_set_rx_max_frame_length(dev, new_mtu + VLAN_ETH_HLEN); ++ lan78xx_set_rx_max_frame_length(dev, new_mtu + VLAN_ETH_HLEN); + + netdev->mtu = new_mtu; + +@@ -2314,7 +2305,6 @@ static int lan78xx_set_mac_addr(struct net_device *netdev, void *p) + struct lan78xx_net *dev = netdev_priv(netdev); + struct sockaddr *addr = p; + u32 addr_lo, addr_hi; +- int ret; + + if (netif_running(netdev)) + return -EBUSY; +@@ -2331,12 +2321,12 @@ static int lan78xx_set_mac_addr(struct net_device *netdev, void *p) + addr_hi = netdev->dev_addr[4] | + netdev->dev_addr[5] << 8; + +- ret = lan78xx_write_reg(dev, RX_ADDRL, addr_lo); +- ret = lan78xx_write_reg(dev, RX_ADDRH, addr_hi); ++ lan78xx_write_reg(dev, RX_ADDRL, addr_lo); ++ lan78xx_write_reg(dev, RX_ADDRH, addr_hi); + + /* Added to support MAC address changes */ +- ret = lan78xx_write_reg(dev, MAF_LO(0), addr_lo); +- ret = lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_); ++ lan78xx_write_reg(dev, MAF_LO(0), addr_lo); ++ lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_); + + return 0; + } +@@ -2348,7 +2338,6 @@ static int lan78xx_set_features(struct net_device *netdev, + struct lan78xx_net *dev = netdev_priv(netdev); + struct lan78xx_priv *pdata = (struct lan78xx_priv *)(dev->data[0]); + unsigned long flags; +- int ret; + + spin_lock_irqsave(&pdata->rfe_ctl_lock, flags); + +@@ -2372,7 +2361,7 @@ static int lan78xx_set_features(struct net_device *netdev, + + spin_unlock_irqrestore(&pdata->rfe_ctl_lock, flags); + +- ret = lan78xx_write_reg(dev, RFE_CTL, pdata->rfe_ctl); ++ lan78xx_write_reg(dev, RFE_CTL, pdata->rfe_ctl); + + return 0; + } +@@ -3828,7 +3817,6 @@ static u16 lan78xx_wakeframe_crc16(const u8 *buf, int len) + static int lan78xx_set_suspend(struct lan78xx_net *dev, u32 wol) + { + u32 buf; +- int ret; + int mask_index; + u16 crc; + u32 temp_wucsr; +@@ -3837,26 +3825,26 @@ static int lan78xx_set_suspend(struct lan78xx_net *dev, u32 wol) + const u8 ipv6_multicast[3] = { 0x33, 0x33 }; + const u8 arp_type[2] = { 0x08, 0x06 }; + +- ret = lan78xx_read_reg(dev, MAC_TX, &buf); ++ lan78xx_read_reg(dev, MAC_TX, &buf); + buf &= ~MAC_TX_TXEN_; +- ret = lan78xx_write_reg(dev, MAC_TX, buf); +- ret = lan78xx_read_reg(dev, MAC_RX, &buf); ++ lan78xx_write_reg(dev, MAC_TX, buf); ++ lan78xx_read_reg(dev, MAC_RX, &buf); + buf &= ~MAC_RX_RXEN_; +- ret = lan78xx_write_reg(dev, MAC_RX, buf); ++ lan78xx_write_reg(dev, MAC_RX, buf); + +- ret = lan78xx_write_reg(dev, WUCSR, 0); +- ret = lan78xx_write_reg(dev, WUCSR2, 0); +- ret = lan78xx_write_reg(dev, WK_SRC, 0xFFF1FF1FUL); ++ lan78xx_write_reg(dev, WUCSR, 0); ++ lan78xx_write_reg(dev, WUCSR2, 0); ++ lan78xx_write_reg(dev, WK_SRC, 0xFFF1FF1FUL); + + temp_wucsr = 0; + + temp_pmt_ctl = 0; +- ret = lan78xx_read_reg(dev, PMT_CTL, &temp_pmt_ctl); ++ lan78xx_read_reg(dev, PMT_CTL, &temp_pmt_ctl); + temp_pmt_ctl &= ~PMT_CTL_RES_CLR_WKP_EN_; + temp_pmt_ctl |= PMT_CTL_RES_CLR_WKP_STS_; + + for (mask_index = 0; mask_index < NUM_OF_WUF_CFG; mask_index++) +- ret = lan78xx_write_reg(dev, WUF_CFG(mask_index), 0); ++ lan78xx_write_reg(dev, WUF_CFG(mask_index), 0); + + mask_index = 0; + if (wol & WAKE_PHY) { +@@ -3885,30 +3873,30 @@ static int lan78xx_set_suspend(struct lan78xx_net *dev, u32 wol) + + /* set WUF_CFG & WUF_MASK for IPv4 Multicast */ + crc = lan78xx_wakeframe_crc16(ipv4_multicast, 3); +- ret = lan78xx_write_reg(dev, WUF_CFG(mask_index), ++ lan78xx_write_reg(dev, WUF_CFG(mask_index), + WUF_CFGX_EN_ | + WUF_CFGX_TYPE_MCAST_ | + (0 << WUF_CFGX_OFFSET_SHIFT_) | + (crc & WUF_CFGX_CRC16_MASK_)); + +- ret = lan78xx_write_reg(dev, WUF_MASK0(mask_index), 7); +- ret = lan78xx_write_reg(dev, WUF_MASK1(mask_index), 0); +- ret = lan78xx_write_reg(dev, WUF_MASK2(mask_index), 0); +- ret = lan78xx_write_reg(dev, WUF_MASK3(mask_index), 0); ++ lan78xx_write_reg(dev, WUF_MASK0(mask_index), 7); ++ lan78xx_write_reg(dev, WUF_MASK1(mask_index), 0); ++ lan78xx_write_reg(dev, WUF_MASK2(mask_index), 0); ++ lan78xx_write_reg(dev, WUF_MASK3(mask_index), 0); + mask_index++; + + /* for IPv6 Multicast */ + crc = lan78xx_wakeframe_crc16(ipv6_multicast, 2); +- ret = lan78xx_write_reg(dev, WUF_CFG(mask_index), ++ lan78xx_write_reg(dev, WUF_CFG(mask_index), + WUF_CFGX_EN_ | + WUF_CFGX_TYPE_MCAST_ | + (0 << WUF_CFGX_OFFSET_SHIFT_) | + (crc & WUF_CFGX_CRC16_MASK_)); + +- ret = lan78xx_write_reg(dev, WUF_MASK0(mask_index), 3); +- ret = lan78xx_write_reg(dev, WUF_MASK1(mask_index), 0); +- ret = lan78xx_write_reg(dev, WUF_MASK2(mask_index), 0); +- ret = lan78xx_write_reg(dev, WUF_MASK3(mask_index), 0); ++ lan78xx_write_reg(dev, WUF_MASK0(mask_index), 3); ++ lan78xx_write_reg(dev, WUF_MASK1(mask_index), 0); ++ lan78xx_write_reg(dev, WUF_MASK2(mask_index), 0); ++ lan78xx_write_reg(dev, WUF_MASK3(mask_index), 0); + mask_index++; + + temp_pmt_ctl |= PMT_CTL_WOL_EN_; +@@ -3929,16 +3917,16 @@ static int lan78xx_set_suspend(struct lan78xx_net *dev, u32 wol) + * for packettype (offset 12,13) = ARP (0x0806) + */ + crc = lan78xx_wakeframe_crc16(arp_type, 2); +- ret = lan78xx_write_reg(dev, WUF_CFG(mask_index), ++ lan78xx_write_reg(dev, WUF_CFG(mask_index), + WUF_CFGX_EN_ | + WUF_CFGX_TYPE_ALL_ | + (0 << WUF_CFGX_OFFSET_SHIFT_) | + (crc & WUF_CFGX_CRC16_MASK_)); + +- ret = lan78xx_write_reg(dev, WUF_MASK0(mask_index), 0x3000); +- ret = lan78xx_write_reg(dev, WUF_MASK1(mask_index), 0); +- ret = lan78xx_write_reg(dev, WUF_MASK2(mask_index), 0); +- ret = lan78xx_write_reg(dev, WUF_MASK3(mask_index), 0); ++ lan78xx_write_reg(dev, WUF_MASK0(mask_index), 0x3000); ++ lan78xx_write_reg(dev, WUF_MASK1(mask_index), 0); ++ lan78xx_write_reg(dev, WUF_MASK2(mask_index), 0); ++ lan78xx_write_reg(dev, WUF_MASK3(mask_index), 0); + mask_index++; + + temp_pmt_ctl |= PMT_CTL_WOL_EN_; +@@ -3946,7 +3934,7 @@ static int lan78xx_set_suspend(struct lan78xx_net *dev, u32 wol) + temp_pmt_ctl |= PMT_CTL_SUS_MODE_0_; + } + +- ret = lan78xx_write_reg(dev, WUCSR, temp_wucsr); ++ lan78xx_write_reg(dev, WUCSR, temp_wucsr); + + /* when multiple WOL bits are set */ + if (hweight_long((unsigned long)wol) > 1) { +@@ -3954,16 +3942,16 @@ static int lan78xx_set_suspend(struct lan78xx_net *dev, u32 wol) + temp_pmt_ctl &= ~PMT_CTL_SUS_MODE_MASK_; + temp_pmt_ctl |= PMT_CTL_SUS_MODE_0_; + } +- ret = lan78xx_write_reg(dev, PMT_CTL, temp_pmt_ctl); ++ lan78xx_write_reg(dev, PMT_CTL, temp_pmt_ctl); + + /* clear WUPS */ +- ret = lan78xx_read_reg(dev, PMT_CTL, &buf); ++ lan78xx_read_reg(dev, PMT_CTL, &buf); + buf |= PMT_CTL_WUPS_MASK_; +- ret = lan78xx_write_reg(dev, PMT_CTL, buf); ++ lan78xx_write_reg(dev, PMT_CTL, buf); + +- ret = lan78xx_read_reg(dev, MAC_RX, &buf); ++ lan78xx_read_reg(dev, MAC_RX, &buf); + buf |= MAC_RX_RXEN_; +- ret = lan78xx_write_reg(dev, MAC_RX, buf); ++ lan78xx_write_reg(dev, MAC_RX, buf); + + return 0; + } +-- +2.39.2 + diff --git a/queue-5.4/netfilter-tproxy-fix-deadlock-due-to-missing-bh-disa.patch b/queue-5.4/netfilter-tproxy-fix-deadlock-due-to-missing-bh-disa.patch new file mode 100644 index 00000000000..f6ac400c3cc --- /dev/null +++ b/queue-5.4/netfilter-tproxy-fix-deadlock-due-to-missing-bh-disa.patch @@ -0,0 +1,83 @@ +From 6e472a7a1a037504449aff9daf24b7bfbf8630ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 10:58:56 +0100 +Subject: netfilter: tproxy: fix deadlock due to missing BH disable +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Florian Westphal + +[ Upstream commit 4a02426787bf024dafdb79b362285ee325de3f5e ] + +The xtables packet traverser performs an unconditional local_bh_disable(), +but the nf_tables evaluation loop does not. + +Functions that are called from either xtables or nftables must assume +that they can be called in process context. + +inet_twsk_deschedule_put() assumes that no softirq interrupt can occur. +If tproxy is used from nf_tables its possible that we'll deadlock +trying to aquire a lock already held in process context. + +Add a small helper that takes care of this and use it. + +Link: https://lore.kernel.org/netfilter-devel/401bd6ed-314a-a196-1cdc-e13c720cc8f2@balasys.hu/ +Fixes: 4ed8eb6570a4 ("netfilter: nf_tables: Add native tproxy support") +Reported-and-tested-by: Major Dávid +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_tproxy.h | 7 +++++++ + net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 +- + net/ipv6/netfilter/nf_tproxy_ipv6.c | 2 +- + 3 files changed, 9 insertions(+), 2 deletions(-) + +diff --git a/include/net/netfilter/nf_tproxy.h b/include/net/netfilter/nf_tproxy.h +index 82d0e41b76f22..faa108b1ba675 100644 +--- a/include/net/netfilter/nf_tproxy.h ++++ b/include/net/netfilter/nf_tproxy.h +@@ -17,6 +17,13 @@ static inline bool nf_tproxy_sk_is_transparent(struct sock *sk) + return false; + } + ++static inline void nf_tproxy_twsk_deschedule_put(struct inet_timewait_sock *tw) ++{ ++ local_bh_disable(); ++ inet_twsk_deschedule_put(tw); ++ local_bh_enable(); ++} ++ + /* assign a socket to the skb -- consumes sk */ + static inline void nf_tproxy_assign_sock(struct sk_buff *skb, struct sock *sk) + { +diff --git a/net/ipv4/netfilter/nf_tproxy_ipv4.c b/net/ipv4/netfilter/nf_tproxy_ipv4.c +index b2bae0b0e42a1..61cb2341f50fe 100644 +--- a/net/ipv4/netfilter/nf_tproxy_ipv4.c ++++ b/net/ipv4/netfilter/nf_tproxy_ipv4.c +@@ -38,7 +38,7 @@ nf_tproxy_handle_time_wait4(struct net *net, struct sk_buff *skb, + hp->source, lport ? lport : hp->dest, + skb->dev, NF_TPROXY_LOOKUP_LISTENER); + if (sk2) { +- inet_twsk_deschedule_put(inet_twsk(sk)); ++ nf_tproxy_twsk_deschedule_put(inet_twsk(sk)); + sk = sk2; + } + } +diff --git a/net/ipv6/netfilter/nf_tproxy_ipv6.c b/net/ipv6/netfilter/nf_tproxy_ipv6.c +index 34d51cd426b0c..00761924f2766 100644 +--- a/net/ipv6/netfilter/nf_tproxy_ipv6.c ++++ b/net/ipv6/netfilter/nf_tproxy_ipv6.c +@@ -63,7 +63,7 @@ nf_tproxy_handle_time_wait6(struct sk_buff *skb, int tproto, int thoff, + lport ? lport : hp->dest, + skb->dev, NF_TPROXY_LOOKUP_LISTENER); + if (sk2) { +- inet_twsk_deschedule_put(inet_twsk(sk)); ++ nf_tproxy_twsk_deschedule_put(inet_twsk(sk)); + sk = sk2; + } + } +-- +2.39.2 + diff --git a/queue-5.4/nfc-fdp-add-null-check-of-devm_kmalloc_array-in-fdp_.patch b/queue-5.4/nfc-fdp-add-null-check-of-devm_kmalloc_array-in-fdp_.patch new file mode 100644 index 00000000000..851fcb587e7 --- /dev/null +++ b/queue-5.4/nfc-fdp-add-null-check-of-devm_kmalloc_array-in-fdp_.patch @@ -0,0 +1,49 @@ +From f906d734248db2a2f88807176f746a433e8cdda8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 17:30:37 +0800 +Subject: nfc: fdp: add null check of devm_kmalloc_array in + fdp_nci_i2c_read_device_properties + +From: Kang Chen + +[ Upstream commit 11f180a5d62a51b484e9648f9b310e1bd50b1a57 ] + +devm_kmalloc_array may fails, *fw_vsc_cfg might be null and cause +out-of-bounds write in device_property_read_u8_array later. + +Fixes: a06347c04c13 ("NFC: Add Intel Fields Peak NFC solution driver") +Signed-off-by: Kang Chen +Reviewed-by: Krzysztof Kozlowski +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230227093037.907654-1-void0red@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/nfc/fdp/i2c.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/nfc/fdp/i2c.c b/drivers/nfc/fdp/i2c.c +index ad0abb1f0bae9..7305f1a06e97c 100644 +--- a/drivers/nfc/fdp/i2c.c ++++ b/drivers/nfc/fdp/i2c.c +@@ -255,6 +255,9 @@ static void fdp_nci_i2c_read_device_properties(struct device *dev, + len, sizeof(**fw_vsc_cfg), + GFP_KERNEL); + ++ if (!*fw_vsc_cfg) ++ goto alloc_err; ++ + r = device_property_read_u8_array(dev, FDP_DP_FW_VSC_CFG_NAME, + *fw_vsc_cfg, len); + +@@ -268,6 +271,7 @@ static void fdp_nci_i2c_read_device_properties(struct device *dev, + *fw_vsc_cfg = NULL; + } + ++alloc_err: + dev_dbg(dev, "Clock type: %d, clock frequency: %d, VSC: %s", + *clock_type, *clock_freq, *fw_vsc_cfg != NULL ? "yes" : "no"); + } +-- +2.39.2 + diff --git a/queue-5.4/risc-v-avoid-dereferening-null-regs-in-die.patch b/queue-5.4/risc-v-avoid-dereferening-null-regs-in-die.patch new file mode 100644 index 00000000000..88b17f4d55a --- /dev/null +++ b/queue-5.4/risc-v-avoid-dereferening-null-regs-in-die.patch @@ -0,0 +1,57 @@ +From bf37e6388dc21d42ea1cdca38b9ac990b4042fed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Sep 2022 13:00:37 -0700 +Subject: RISC-V: Avoid dereferening NULL regs in die() + +From: Palmer Dabbelt + +[ Upstream commit f2913d006fcdb61719635e093d1b5dd0dafecac7 ] + +I don't think we can actually die() without a regs pointer, but the +compiler was warning about a NULL check after a dereference. It seems +prudent to just avoid the possibly-NULL dereference, given that when +die()ing the system is already toast so who knows how we got there. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Reviewed-by: Conor Dooley +Link: https://lore.kernel.org/r/20220920200037.6727-1-palmer@rivosinc.com +Signed-off-by: Palmer Dabbelt +Stable-dep-of: 130aee3fd998 ("riscv: Avoid enabling interrupts in die()") +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/traps.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c +index 030094ac71902..5ca5a04258d0d 100644 +--- a/arch/riscv/kernel/traps.c ++++ b/arch/riscv/kernel/traps.c +@@ -31,6 +31,7 @@ void die(struct pt_regs *regs, const char *str) + { + static int die_counter; + int ret; ++ long cause; + + oops_enter(); + +@@ -40,11 +41,13 @@ void die(struct pt_regs *regs, const char *str) + + pr_emerg("%s [#%d]\n", str, ++die_counter); + print_modules(); +- show_regs(regs); ++ if (regs) ++ show_regs(regs); + +- ret = notify_die(DIE_OOPS, str, regs, 0, regs->cause, SIGSEGV); ++ cause = regs ? regs->cause : -1; ++ ret = notify_die(DIE_OOPS, str, regs, 0, cause, SIGSEGV); + +- if (regs && kexec_should_crash(current)) ++ if (kexec_should_crash(current)) + crash_kexec(regs); + + bust_spinlocks(0); +-- +2.39.2 + diff --git a/queue-5.4/riscv-abstract-out-csr-names-for-supervisor-vs-machi.patch b/queue-5.4/riscv-abstract-out-csr-names-for-supervisor-vs-machi.patch new file mode 100644 index 00000000000..91a51270e07 --- /dev/null +++ b/queue-5.4/riscv-abstract-out-csr-names-for-supervisor-vs-machi.patch @@ -0,0 +1,1043 @@ +From 3ef295cec87891ddcce650d9aea368d2179be8c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Oct 2019 13:10:32 +0100 +Subject: riscv: abstract out CSR names for supervisor vs machine mode + +From: Christoph Hellwig + +[ Upstream commit a4c3733d32a72f11dee86d0731d7565aa6ebe22d ] + +Many of the privileged CSRs exist in a supervisor and machine version +that are used very similarly. Provide versions of the CSR names and +fields that map to either the S-mode or M-mode variant depending on +a new CONFIG_RISCV_M_MODE kconfig symbol. + +Contains contributions from Damien Le Moal +and Paul Walmsley . + +Signed-off-by: Christoph Hellwig +Acked-by: Thomas Gleixner # for drivers/clocksource, drivers/irqchip +[paul.walmsley@sifive.com: updated to apply] +Signed-off-by: Paul Walmsley +Stable-dep-of: 130aee3fd998 ("riscv: Avoid enabling interrupts in die()") +Signed-off-by: Sasha Levin +--- + arch/riscv/Kconfig | 4 ++ + arch/riscv/include/asm/csr.h | 72 +++++++++++++++++++++++++---- + arch/riscv/include/asm/irqflags.h | 12 ++--- + arch/riscv/include/asm/processor.h | 2 +- + arch/riscv/include/asm/ptrace.h | 16 +++---- + arch/riscv/include/asm/switch_to.h | 10 ++-- + arch/riscv/kernel/asm-offsets.c | 8 ++-- + arch/riscv/kernel/entry.S | 74 +++++++++++++++++------------- + arch/riscv/kernel/fpu.S | 8 ++-- + arch/riscv/kernel/head.S | 12 ++--- + arch/riscv/kernel/irq.c | 17 ++----- + arch/riscv/kernel/perf_callchain.c | 2 +- + arch/riscv/kernel/process.c | 17 +++---- + arch/riscv/kernel/signal.c | 21 ++++----- + arch/riscv/kernel/smp.c | 2 +- + arch/riscv/kernel/traps.c | 16 +++---- + arch/riscv/lib/uaccess.S | 12 ++--- + arch/riscv/mm/extable.c | 4 +- + arch/riscv/mm/fault.c | 6 +-- + drivers/clocksource/timer-riscv.c | 8 ++-- + drivers/irqchip/irq-sifive-plic.c | 11 +++-- + 21 files changed, 199 insertions(+), 135 deletions(-) + +diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig +index e0a77af5c130c..c21ebdb969570 100644 +--- a/arch/riscv/Kconfig ++++ b/arch/riscv/Kconfig +@@ -72,6 +72,10 @@ config ARCH_MMAP_RND_BITS_MAX + default 24 if 64BIT # SV39 based + default 17 + ++# set if we run in machine mode, cleared if we run in supervisor mode ++config RISCV_M_MODE ++ bool ++ + config MMU + def_bool y + +diff --git a/arch/riscv/include/asm/csr.h b/arch/riscv/include/asm/csr.h +index a18923fa23c80..0ab6428110280 100644 +--- a/arch/riscv/include/asm/csr.h ++++ b/arch/riscv/include/asm/csr.h +@@ -11,8 +11,11 @@ + + /* Status register flags */ + #define SR_SIE _AC(0x00000002, UL) /* Supervisor Interrupt Enable */ ++#define SR_MIE _AC(0x00000008, UL) /* Machine Interrupt Enable */ + #define SR_SPIE _AC(0x00000020, UL) /* Previous Supervisor IE */ ++#define SR_MPIE _AC(0x00000080, UL) /* Previous Machine IE */ + #define SR_SPP _AC(0x00000100, UL) /* Previously Supervisor */ ++#define SR_MPP _AC(0x00001800, UL) /* Previously Machine */ + #define SR_SUM _AC(0x00040000, UL) /* Supervisor User Memory Access */ + + #define SR_FS _AC(0x00006000, UL) /* Floating-point Status */ +@@ -44,9 +47,10 @@ + #define SATP_MODE SATP_MODE_39 + #endif + +-/* SCAUSE */ +-#define SCAUSE_IRQ_FLAG (_AC(1, UL) << (__riscv_xlen - 1)) ++/* Exception cause high bit - is an interrupt if set */ ++#define CAUSE_IRQ_FLAG (_AC(1, UL) << (__riscv_xlen - 1)) + ++/* Interrupt causes (minus the high bit) */ + #define IRQ_U_SOFT 0 + #define IRQ_S_SOFT 1 + #define IRQ_M_SOFT 3 +@@ -57,6 +61,7 @@ + #define IRQ_S_EXT 9 + #define IRQ_M_EXT 11 + ++/* Exception causes */ + #define EXC_INST_MISALIGNED 0 + #define EXC_INST_ACCESS 1 + #define EXC_BREAKPOINT 3 +@@ -67,14 +72,14 @@ + #define EXC_LOAD_PAGE_FAULT 13 + #define EXC_STORE_PAGE_FAULT 15 + +-/* SIE (Interrupt Enable) and SIP (Interrupt Pending) flags */ +-#define SIE_SSIE (_AC(0x1, UL) << IRQ_S_SOFT) +-#define SIE_STIE (_AC(0x1, UL) << IRQ_S_TIMER) +-#define SIE_SEIE (_AC(0x1, UL) << IRQ_S_EXT) +- ++/* symbolic CSR names: */ + #define CSR_CYCLE 0xc00 + #define CSR_TIME 0xc01 + #define CSR_INSTRET 0xc02 ++#define CSR_CYCLEH 0xc80 ++#define CSR_TIMEH 0xc81 ++#define CSR_INSTRETH 0xc82 ++ + #define CSR_SSTATUS 0x100 + #define CSR_SIE 0x104 + #define CSR_STVEC 0x105 +@@ -85,9 +90,56 @@ + #define CSR_STVAL 0x143 + #define CSR_SIP 0x144 + #define CSR_SATP 0x180 +-#define CSR_CYCLEH 0xc80 +-#define CSR_TIMEH 0xc81 +-#define CSR_INSTRETH 0xc82 ++ ++#define CSR_MSTATUS 0x300 ++#define CSR_MIE 0x304 ++#define CSR_MTVEC 0x305 ++#define CSR_MSCRATCH 0x340 ++#define CSR_MEPC 0x341 ++#define CSR_MCAUSE 0x342 ++#define CSR_MTVAL 0x343 ++#define CSR_MIP 0x344 ++ ++#ifdef CONFIG_RISCV_M_MODE ++# define CSR_STATUS CSR_MSTATUS ++# define CSR_IE CSR_MIE ++# define CSR_TVEC CSR_MTVEC ++# define CSR_SCRATCH CSR_MSCRATCH ++# define CSR_EPC CSR_MEPC ++# define CSR_CAUSE CSR_MCAUSE ++# define CSR_TVAL CSR_MTVAL ++# define CSR_IP CSR_MIP ++ ++# define SR_IE SR_MIE ++# define SR_PIE SR_MPIE ++# define SR_PP SR_MPP ++ ++# define IRQ_SOFT IRQ_M_SOFT ++# define IRQ_TIMER IRQ_M_TIMER ++# define IRQ_EXT IRQ_M_EXT ++#else /* CONFIG_RISCV_M_MODE */ ++# define CSR_STATUS CSR_SSTATUS ++# define CSR_IE CSR_SIE ++# define CSR_TVEC CSR_STVEC ++# define CSR_SCRATCH CSR_SSCRATCH ++# define CSR_EPC CSR_SEPC ++# define CSR_CAUSE CSR_SCAUSE ++# define CSR_TVAL CSR_STVAL ++# define CSR_IP CSR_SIP ++ ++# define SR_IE SR_SIE ++# define SR_PIE SR_SPIE ++# define SR_PP SR_SPP ++ ++# define IRQ_SOFT IRQ_S_SOFT ++# define IRQ_TIMER IRQ_S_TIMER ++# define IRQ_EXT IRQ_S_EXT ++#endif /* CONFIG_RISCV_M_MODE */ ++ ++/* IE/IP (Supervisor/Machine Interrupt Enable/Pending) flags */ ++#define IE_SIE (_AC(0x1, UL) << IRQ_SOFT) ++#define IE_TIE (_AC(0x1, UL) << IRQ_TIMER) ++#define IE_EIE (_AC(0x1, UL) << IRQ_EXT) + + #ifndef __ASSEMBLY__ + +diff --git a/arch/riscv/include/asm/irqflags.h b/arch/riscv/include/asm/irqflags.h +index e70f647ce3b76..08d4d6a5b7e95 100644 +--- a/arch/riscv/include/asm/irqflags.h ++++ b/arch/riscv/include/asm/irqflags.h +@@ -13,31 +13,31 @@ + /* read interrupt enabled status */ + static inline unsigned long arch_local_save_flags(void) + { +- return csr_read(CSR_SSTATUS); ++ return csr_read(CSR_STATUS); + } + + /* unconditionally enable interrupts */ + static inline void arch_local_irq_enable(void) + { +- csr_set(CSR_SSTATUS, SR_SIE); ++ csr_set(CSR_STATUS, SR_IE); + } + + /* unconditionally disable interrupts */ + static inline void arch_local_irq_disable(void) + { +- csr_clear(CSR_SSTATUS, SR_SIE); ++ csr_clear(CSR_STATUS, SR_IE); + } + + /* get status and disable interrupts */ + static inline unsigned long arch_local_irq_save(void) + { +- return csr_read_clear(CSR_SSTATUS, SR_SIE); ++ return csr_read_clear(CSR_STATUS, SR_IE); + } + + /* test flags */ + static inline int arch_irqs_disabled_flags(unsigned long flags) + { +- return !(flags & SR_SIE); ++ return !(flags & SR_IE); + } + + /* test hardware interrupt enable bit */ +@@ -49,7 +49,7 @@ static inline int arch_irqs_disabled(void) + /* set interrupt enabled status */ + static inline void arch_local_irq_restore(unsigned long flags) + { +- csr_set(CSR_SSTATUS, flags & SR_SIE); ++ csr_set(CSR_STATUS, flags & SR_IE); + } + + #endif /* _ASM_RISCV_IRQFLAGS_H */ +diff --git a/arch/riscv/include/asm/processor.h b/arch/riscv/include/asm/processor.h +index 8c5b11a640dd3..60fd02698b770 100644 +--- a/arch/riscv/include/asm/processor.h ++++ b/arch/riscv/include/asm/processor.h +@@ -44,7 +44,7 @@ struct thread_struct { + ((struct pt_regs *)(task_stack_page(tsk) + THREAD_SIZE \ + - ALIGN(sizeof(struct pt_regs), STACK_ALIGN))) + +-#define KSTK_EIP(tsk) (task_pt_regs(tsk)->sepc) ++#define KSTK_EIP(tsk) (task_pt_regs(tsk)->epc) + #define KSTK_ESP(tsk) (task_pt_regs(tsk)->sp) + + +diff --git a/arch/riscv/include/asm/ptrace.h b/arch/riscv/include/asm/ptrace.h +index d48d1e13973ce..ee49f80c95337 100644 +--- a/arch/riscv/include/asm/ptrace.h ++++ b/arch/riscv/include/asm/ptrace.h +@@ -12,7 +12,7 @@ + #ifndef __ASSEMBLY__ + + struct pt_regs { +- unsigned long sepc; ++ unsigned long epc; + unsigned long ra; + unsigned long sp; + unsigned long gp; +@@ -44,10 +44,10 @@ struct pt_regs { + unsigned long t4; + unsigned long t5; + unsigned long t6; +- /* Supervisor CSRs */ +- unsigned long sstatus; +- unsigned long sbadaddr; +- unsigned long scause; ++ /* Supervisor/Machine CSRs */ ++ unsigned long status; ++ unsigned long badaddr; ++ unsigned long cause; + /* a0 value before the syscall */ + unsigned long orig_a0; + }; +@@ -58,18 +58,18 @@ struct pt_regs { + #define REG_FMT "%08lx" + #endif + +-#define user_mode(regs) (((regs)->sstatus & SR_SPP) == 0) ++#define user_mode(regs) (((regs)->status & SR_PP) == 0) + + + /* Helpers for working with the instruction pointer */ + static inline unsigned long instruction_pointer(struct pt_regs *regs) + { +- return regs->sepc; ++ return regs->epc; + } + static inline void instruction_pointer_set(struct pt_regs *regs, + unsigned long val) + { +- regs->sepc = val; ++ regs->epc = val; + } + + #define profile_pc(regs) instruction_pointer(regs) +diff --git a/arch/riscv/include/asm/switch_to.h b/arch/riscv/include/asm/switch_to.h +index ee4f0ac62c9d7..407bcc96a7109 100644 +--- a/arch/riscv/include/asm/switch_to.h ++++ b/arch/riscv/include/asm/switch_to.h +@@ -17,19 +17,19 @@ extern void __fstate_restore(struct task_struct *restore_from); + + static inline void __fstate_clean(struct pt_regs *regs) + { +- regs->sstatus = (regs->sstatus & ~SR_FS) | SR_FS_CLEAN; ++ regs->status = (regs->status & ~SR_FS) | SR_FS_CLEAN; + } + + static inline void fstate_off(struct task_struct *task, + struct pt_regs *regs) + { +- regs->sstatus = (regs->sstatus & ~SR_FS) | SR_FS_OFF; ++ regs->status = (regs->status & ~SR_FS) | SR_FS_OFF; + } + + static inline void fstate_save(struct task_struct *task, + struct pt_regs *regs) + { +- if ((regs->sstatus & SR_FS) == SR_FS_DIRTY) { ++ if ((regs->status & SR_FS) == SR_FS_DIRTY) { + __fstate_save(task); + __fstate_clean(regs); + } +@@ -38,7 +38,7 @@ static inline void fstate_save(struct task_struct *task, + static inline void fstate_restore(struct task_struct *task, + struct pt_regs *regs) + { +- if ((regs->sstatus & SR_FS) != SR_FS_OFF) { ++ if ((regs->status & SR_FS) != SR_FS_OFF) { + __fstate_restore(task); + __fstate_clean(regs); + } +@@ -50,7 +50,7 @@ static inline void __switch_to_aux(struct task_struct *prev, + struct pt_regs *regs; + + regs = task_pt_regs(prev); +- if (unlikely(regs->sstatus & SR_SD)) ++ if (unlikely(regs->status & SR_SD)) + fstate_save(prev, regs); + fstate_restore(next, task_pt_regs(next)); + } +diff --git a/arch/riscv/kernel/asm-offsets.c b/arch/riscv/kernel/asm-offsets.c +index 9f5628c38ac9f..07cb9c10de4ec 100644 +--- a/arch/riscv/kernel/asm-offsets.c ++++ b/arch/riscv/kernel/asm-offsets.c +@@ -71,7 +71,7 @@ void asm_offsets(void) + OFFSET(TASK_THREAD_FCSR, task_struct, thread.fstate.fcsr); + + DEFINE(PT_SIZE, sizeof(struct pt_regs)); +- OFFSET(PT_SEPC, pt_regs, sepc); ++ OFFSET(PT_EPC, pt_regs, epc); + OFFSET(PT_RA, pt_regs, ra); + OFFSET(PT_FP, pt_regs, s0); + OFFSET(PT_S0, pt_regs, s0); +@@ -105,9 +105,9 @@ void asm_offsets(void) + OFFSET(PT_T6, pt_regs, t6); + OFFSET(PT_GP, pt_regs, gp); + OFFSET(PT_ORIG_A0, pt_regs, orig_a0); +- OFFSET(PT_SSTATUS, pt_regs, sstatus); +- OFFSET(PT_SBADADDR, pt_regs, sbadaddr); +- OFFSET(PT_SCAUSE, pt_regs, scause); ++ OFFSET(PT_STATUS, pt_regs, status); ++ OFFSET(PT_BADADDR, pt_regs, badaddr); ++ OFFSET(PT_CAUSE, pt_regs, cause); + + /* + * THREAD_{F,X}* might be larger than a S-type offset can handle, but +diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S +index 9c87ae77ad5d3..57b27b8278b1e 100644 +--- a/arch/riscv/kernel/entry.S ++++ b/arch/riscv/kernel/entry.S +@@ -26,14 +26,14 @@ + + /* + * If coming from userspace, preserve the user thread pointer and load +- * the kernel thread pointer. If we came from the kernel, sscratch +- * will contain 0, and we should continue on the current TP. ++ * the kernel thread pointer. If we came from the kernel, the scratch ++ * register will contain 0, and we should continue on the current TP. + */ +- csrrw tp, CSR_SSCRATCH, tp ++ csrrw tp, CSR_SCRATCH, tp + bnez tp, _save_context + + _restore_kernel_tpsp: +- csrr tp, CSR_SSCRATCH ++ csrr tp, CSR_SCRATCH + REG_S sp, TASK_TI_KERNEL_SP(tp) + _save_context: + REG_S sp, TASK_TI_USER_SP(tp) +@@ -79,16 +79,16 @@ _save_context: + li t0, SR_SUM | SR_FS + + REG_L s0, TASK_TI_USER_SP(tp) +- csrrc s1, CSR_SSTATUS, t0 +- csrr s2, CSR_SEPC +- csrr s3, CSR_STVAL +- csrr s4, CSR_SCAUSE +- csrr s5, CSR_SSCRATCH ++ csrrc s1, CSR_STATUS, t0 ++ csrr s2, CSR_EPC ++ csrr s3, CSR_TVAL ++ csrr s4, CSR_CAUSE ++ csrr s5, CSR_SCRATCH + REG_S s0, PT_SP(sp) +- REG_S s1, PT_SSTATUS(sp) +- REG_S s2, PT_SEPC(sp) +- REG_S s3, PT_SBADADDR(sp) +- REG_S s4, PT_SCAUSE(sp) ++ REG_S s1, PT_STATUS(sp) ++ REG_S s2, PT_EPC(sp) ++ REG_S s3, PT_BADADDR(sp) ++ REG_S s4, PT_CAUSE(sp) + REG_S s5, PT_TP(sp) + .endm + +@@ -97,7 +97,7 @@ _save_context: + * registers from the stack. + */ + .macro RESTORE_ALL +- REG_L a0, PT_SSTATUS(sp) ++ REG_L a0, PT_STATUS(sp) + /* + * The current load reservation is effectively part of the processor's + * state, in the sense that load reservations cannot be shared between +@@ -115,11 +115,11 @@ _save_context: + * completes, implementations are allowed to expand reservations to be + * arbitrarily large. + */ +- REG_L a2, PT_SEPC(sp) +- REG_SC x0, a2, PT_SEPC(sp) ++ REG_L a2, PT_EPC(sp) ++ REG_SC x0, a2, PT_EPC(sp) + +- csrw CSR_SSTATUS, a0 +- csrw CSR_SEPC, a2 ++ csrw CSR_STATUS, a0 ++ csrw CSR_EPC, a2 + + REG_L x1, PT_RA(sp) + REG_L x3, PT_GP(sp) +@@ -163,10 +163,10 @@ ENTRY(handle_exception) + SAVE_ALL + + /* +- * Set sscratch register to 0, so that if a recursive exception ++ * Set the scratch register to 0, so that if a recursive exception + * occurs, the exception vector knows it came from the kernel + */ +- csrw CSR_SSCRATCH, x0 ++ csrw CSR_SCRATCH, x0 + + /* Load the global pointer */ + .option push +@@ -185,11 +185,13 @@ ENTRY(handle_exception) + move a0, sp /* pt_regs */ + tail do_IRQ + 1: +- /* Exceptions run with interrupts enabled or disabled +- depending on the state of sstatus.SR_SPIE */ +- andi t0, s1, SR_SPIE ++ /* ++ * Exceptions run with interrupts enabled or disabled depending on the ++ * state of SR_PIE in m/sstatus. ++ */ ++ andi t0, s1, SR_PIE + beqz t0, 1f +- csrs CSR_SSTATUS, SR_SIE ++ csrs CSR_STATUS, SR_IE + + 1: + /* Handle syscalls */ +@@ -217,7 +219,7 @@ handle_syscall: + * scall instruction on sret + */ + addi s2, s2, 0x4 +- REG_S s2, PT_SEPC(sp) ++ REG_S s2, PT_EPC(sp) + /* Trace syscalls, but only if requested by the user. */ + REG_L t0, TASK_TI_FLAGS(tp) + andi t0, t0, _TIF_SYSCALL_WORK +@@ -244,9 +246,15 @@ ret_from_syscall: + bnez t0, handle_syscall_trace_exit + + ret_from_exception: +- REG_L s0, PT_SSTATUS(sp) +- csrc CSR_SSTATUS, SR_SIE ++ REG_L s0, PT_STATUS(sp) ++ csrc CSR_STATUS, SR_IE ++#ifdef CONFIG_RISCV_M_MODE ++ /* the MPP value is too large to be used as an immediate arg for addi */ ++ li t0, SR_MPP ++ and s0, s0, t0 ++#else + andi s0, s0, SR_SPP ++#endif + bnez s0, resume_kernel + + resume_userspace: +@@ -260,14 +268,18 @@ resume_userspace: + REG_S s0, TASK_TI_KERNEL_SP(tp) + + /* +- * Save TP into sscratch, so we can find the kernel data structures +- * again. ++ * Save TP into the scratch register , so we can find the kernel data ++ * structures again. + */ +- csrw CSR_SSCRATCH, tp ++ csrw CSR_SCRATCH, tp + + restore_all: + RESTORE_ALL ++#ifdef CONFIG_RISCV_M_MODE ++ mret ++#else + sret ++#endif + + #if IS_ENABLED(CONFIG_PREEMPT) + resume_kernel: +@@ -287,7 +299,7 @@ work_pending: + bnez s1, work_resched + work_notifysig: + /* Handle pending signals and notify-resume requests */ +- csrs CSR_SSTATUS, SR_SIE /* Enable interrupts for do_notify_resume() */ ++ csrs CSR_STATUS, SR_IE /* Enable interrupts for do_notify_resume() */ + move a0, sp /* pt_regs */ + move a1, s0 /* current_thread_info->flags */ + tail do_notify_resume +diff --git a/arch/riscv/kernel/fpu.S b/arch/riscv/kernel/fpu.S +index 631d31540660e..dd2205473de78 100644 +--- a/arch/riscv/kernel/fpu.S ++++ b/arch/riscv/kernel/fpu.S +@@ -23,7 +23,7 @@ ENTRY(__fstate_save) + li a2, TASK_THREAD_F0 + add a0, a0, a2 + li t1, SR_FS +- csrs CSR_SSTATUS, t1 ++ csrs CSR_STATUS, t1 + frcsr t0 + fsd f0, TASK_THREAD_F0_F0(a0) + fsd f1, TASK_THREAD_F1_F0(a0) +@@ -58,7 +58,7 @@ ENTRY(__fstate_save) + fsd f30, TASK_THREAD_F30_F0(a0) + fsd f31, TASK_THREAD_F31_F0(a0) + sw t0, TASK_THREAD_FCSR_F0(a0) +- csrc CSR_SSTATUS, t1 ++ csrc CSR_STATUS, t1 + ret + ENDPROC(__fstate_save) + +@@ -67,7 +67,7 @@ ENTRY(__fstate_restore) + add a0, a0, a2 + li t1, SR_FS + lw t0, TASK_THREAD_FCSR_F0(a0) +- csrs CSR_SSTATUS, t1 ++ csrs CSR_STATUS, t1 + fld f0, TASK_THREAD_F0_F0(a0) + fld f1, TASK_THREAD_F1_F0(a0) + fld f2, TASK_THREAD_F2_F0(a0) +@@ -101,6 +101,6 @@ ENTRY(__fstate_restore) + fld f30, TASK_THREAD_F30_F0(a0) + fld f31, TASK_THREAD_F31_F0(a0) + fscsr t0 +- csrc CSR_SSTATUS, t1 ++ csrc CSR_STATUS, t1 + ret + ENDPROC(__fstate_restore) +diff --git a/arch/riscv/kernel/head.S b/arch/riscv/kernel/head.S +index 344793159b97d..57817c1987743 100644 +--- a/arch/riscv/kernel/head.S ++++ b/arch/riscv/kernel/head.S +@@ -52,8 +52,8 @@ ENTRY(_start) + .global _start_kernel + _start_kernel: + /* Mask all interrupts */ +- csrw CSR_SIE, zero +- csrw CSR_SIP, zero ++ csrw CSR_IE, zero ++ csrw CSR_IP, zero + + /* Load the global pointer */ + .option push +@@ -66,7 +66,7 @@ _start_kernel: + * floating point in kernel space + */ + li t0, SR_FS +- csrc CSR_SSTATUS, t0 ++ csrc CSR_STATUS, t0 + + #ifdef CONFIG_SMP + li t0, CONFIG_NR_CPUS +@@ -121,7 +121,7 @@ relocate: + /* Point stvec to virtual address of intruction after satp write */ + la a2, 1f + add a2, a2, a1 +- csrw CSR_STVEC, a2 ++ csrw CSR_TVEC, a2 + + /* Compute satp for kernel page tables, but don't load it yet */ + srl a2, a0, PAGE_SHIFT +@@ -143,7 +143,7 @@ relocate: + 1: + /* Set trap vector to spin forever to help debug */ + la a0, .Lsecondary_park +- csrw CSR_STVEC, a0 ++ csrw CSR_TVEC, a0 + + /* Reload the global pointer */ + .option push +@@ -166,7 +166,7 @@ relocate: + #ifdef CONFIG_SMP + /* Set trap vector to spin forever to help debug */ + la a3, .Lsecondary_park +- csrw CSR_STVEC, a3 ++ csrw CSR_TVEC, a3 + + slli a3, a0, LGREG + la a1, __cpu_up_stack_pointer +diff --git a/arch/riscv/kernel/irq.c b/arch/riscv/kernel/irq.c +index fffac6ddb0e00..3f07a91d5afb4 100644 +--- a/arch/riscv/kernel/irq.c ++++ b/arch/riscv/kernel/irq.c +@@ -11,13 +11,6 @@ + #include + #include + +-/* +- * Possible interrupt causes: +- */ +-#define INTERRUPT_CAUSE_SOFTWARE IRQ_S_SOFT +-#define INTERRUPT_CAUSE_TIMER IRQ_S_TIMER +-#define INTERRUPT_CAUSE_EXTERNAL IRQ_S_EXT +- + int arch_show_interrupts(struct seq_file *p, int prec) + { + show_ipi_stats(p, prec); +@@ -29,12 +22,12 @@ asmlinkage __visible void __irq_entry do_IRQ(struct pt_regs *regs) + struct pt_regs *old_regs = set_irq_regs(regs); + + irq_enter(); +- switch (regs->scause & ~SCAUSE_IRQ_FLAG) { +- case INTERRUPT_CAUSE_TIMER: ++ switch (regs->cause & ~CAUSE_IRQ_FLAG) { ++ case IRQ_TIMER: + riscv_timer_interrupt(); + break; + #ifdef CONFIG_SMP +- case INTERRUPT_CAUSE_SOFTWARE: ++ case IRQ_SOFT: + /* + * We only use software interrupts to pass IPIs, so if a non-SMP + * system gets one, then we don't know what to do. +@@ -42,11 +35,11 @@ asmlinkage __visible void __irq_entry do_IRQ(struct pt_regs *regs) + riscv_software_interrupt(); + break; + #endif +- case INTERRUPT_CAUSE_EXTERNAL: ++ case IRQ_EXT: + handle_arch_irq(regs); + break; + default: +- pr_alert("unexpected interrupt cause 0x%lx", regs->scause); ++ pr_alert("unexpected interrupt cause 0x%lx", regs->cause); + BUG(); + } + irq_exit(); +diff --git a/arch/riscv/kernel/perf_callchain.c b/arch/riscv/kernel/perf_callchain.c +index 1de5991916eb9..20af8ecbb7e41 100644 +--- a/arch/riscv/kernel/perf_callchain.c ++++ b/arch/riscv/kernel/perf_callchain.c +@@ -68,7 +68,7 @@ void perf_callchain_user(struct perf_callchain_entry_ctx *entry, + return; + + fp = regs->s0; +- perf_callchain_store(entry, regs->sepc); ++ perf_callchain_store(entry, regs->epc); + + fp = user_backtrace(entry, fp, regs->ra); + while (fp && !(fp & 0x3) && entry->nr < entry->max_stack) +diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c +index 9d4b4098874bb..f17e7f4ad3e7a 100644 +--- a/arch/riscv/kernel/process.c ++++ b/arch/riscv/kernel/process.c +@@ -35,8 +35,8 @@ void show_regs(struct pt_regs *regs) + { + show_regs_print_info(KERN_DEFAULT); + +- pr_cont("sepc: " REG_FMT " ra : " REG_FMT " sp : " REG_FMT "\n", +- regs->sepc, regs->ra, regs->sp); ++ pr_cont("epc: " REG_FMT " ra : " REG_FMT " sp : " REG_FMT "\n", ++ regs->epc, regs->ra, regs->sp); + pr_cont(" gp : " REG_FMT " tp : " REG_FMT " t0 : " REG_FMT "\n", + regs->gp, regs->tp, regs->t0); + pr_cont(" t1 : " REG_FMT " t2 : " REG_FMT " s0 : " REG_FMT "\n", +@@ -58,23 +58,23 @@ void show_regs(struct pt_regs *regs) + pr_cont(" t5 : " REG_FMT " t6 : " REG_FMT "\n", + regs->t5, regs->t6); + +- pr_cont("sstatus: " REG_FMT " sbadaddr: " REG_FMT " scause: " REG_FMT "\n", +- regs->sstatus, regs->sbadaddr, regs->scause); ++ pr_cont("status: " REG_FMT " badaddr: " REG_FMT " cause: " REG_FMT "\n", ++ regs->status, regs->badaddr, regs->cause); + } + + void start_thread(struct pt_regs *regs, unsigned long pc, + unsigned long sp) + { +- regs->sstatus = SR_SPIE; ++ regs->status = SR_PIE; + if (has_fpu) { +- regs->sstatus |= SR_FS_INITIAL; ++ regs->status |= SR_FS_INITIAL; + /* + * Restore the initial value to the FP register + * before starting the user program. + */ + fstate_restore(current, regs); + } +- regs->sepc = pc; ++ regs->epc = pc; + regs->sp = sp; + set_fs(USER_DS); + } +@@ -112,7 +112,8 @@ int copy_thread_tls(unsigned long clone_flags, unsigned long usp, + const register unsigned long gp __asm__ ("gp"); + memset(childregs, 0, sizeof(struct pt_regs)); + childregs->gp = gp; +- childregs->sstatus = SR_SPP | SR_SPIE; /* Supervisor, irqs on */ ++ /* Supervisor/Machine, irqs on: */ ++ childregs->status = SR_PP | SR_PIE; + + p->thread.ra = (unsigned long)ret_from_kernel_thread; + p->thread.s[0] = usp; /* fn */ +diff --git a/arch/riscv/kernel/signal.c b/arch/riscv/kernel/signal.c +index d0f6f212f5dfd..b7f9a5565c4bf 100644 +--- a/arch/riscv/kernel/signal.c ++++ b/arch/riscv/kernel/signal.c +@@ -124,7 +124,7 @@ SYSCALL_DEFINE0(rt_sigreturn) + pr_info_ratelimited( + "%s[%d]: bad frame in %s: frame=%p pc=%p sp=%p\n", + task->comm, task_pid_nr(task), __func__, +- frame, (void *)regs->sepc, (void *)regs->sp); ++ frame, (void *)regs->epc, (void *)regs->sp); + } + force_sig(SIGSEGV); + return 0; +@@ -199,7 +199,7 @@ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set, + * We always pass siginfo and mcontext, regardless of SA_SIGINFO, + * since some things rely on this (e.g. glibc's debug/segfault.c). + */ +- regs->sepc = (unsigned long)ksig->ka.sa.sa_handler; ++ regs->epc = (unsigned long)ksig->ka.sa.sa_handler; + regs->sp = (unsigned long)frame; + regs->a0 = ksig->sig; /* a0: signal number */ + regs->a1 = (unsigned long)(&frame->info); /* a1: siginfo pointer */ +@@ -208,7 +208,7 @@ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set, + #if DEBUG_SIG + pr_info("SIG deliver (%s:%d): sig=%d pc=%p ra=%p sp=%p\n", + current->comm, task_pid_nr(current), ksig->sig, +- (void *)regs->sepc, (void *)regs->ra, frame); ++ (void *)regs->epc, (void *)regs->ra, frame); + #endif + + return 0; +@@ -220,10 +220,9 @@ static void handle_signal(struct ksignal *ksig, struct pt_regs *regs) + int ret; + + /* Are we from a system call? */ +- if (regs->scause == EXC_SYSCALL) { ++ if (regs->cause == EXC_SYSCALL) { + /* Avoid additional syscall restarting via ret_from_exception */ +- regs->scause = -1UL; +- ++ regs->cause = -1UL; + /* If so, check system call restarting.. */ + switch (regs->a0) { + case -ERESTART_RESTARTBLOCK: +@@ -239,7 +238,7 @@ static void handle_signal(struct ksignal *ksig, struct pt_regs *regs) + /* fallthrough */ + case -ERESTARTNOINTR: + regs->a0 = regs->orig_a0; +- regs->sepc -= 0x4; ++ regs->epc -= 0x4; + break; + } + } +@@ -261,9 +260,9 @@ static void do_signal(struct pt_regs *regs) + } + + /* Did we come from a system call? */ +- if (regs->scause == EXC_SYSCALL) { ++ if (regs->cause == EXC_SYSCALL) { + /* Avoid additional syscall restarting via ret_from_exception */ +- regs->scause = -1UL; ++ regs->cause = -1UL; + + /* Restart the system call - no handlers present */ + switch (regs->a0) { +@@ -271,12 +270,12 @@ static void do_signal(struct pt_regs *regs) + case -ERESTARTSYS: + case -ERESTARTNOINTR: + regs->a0 = regs->orig_a0; +- regs->sepc -= 0x4; ++ regs->epc -= 0x4; + break; + case -ERESTART_RESTARTBLOCK: + regs->a0 = regs->orig_a0; + regs->a7 = __NR_restart_syscall; +- regs->sepc -= 0x4; ++ regs->epc -= 0x4; + break; + } + } +diff --git a/arch/riscv/kernel/smp.c b/arch/riscv/kernel/smp.c +index 098c04adbaaf6..d724a7e6f4eb8 100644 +--- a/arch/riscv/kernel/smp.c ++++ b/arch/riscv/kernel/smp.c +@@ -108,7 +108,7 @@ static void send_ipi_single(int cpu, enum ipi_message_type op) + + static inline void clear_ipi(void) + { +- csr_clear(CSR_SIP, SIE_SSIE); ++ csr_clear(CSR_IP, IE_SIE); + } + + void riscv_software_interrupt(void) +diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c +index c28d4debf5926..030094ac71902 100644 +--- a/arch/riscv/kernel/traps.c ++++ b/arch/riscv/kernel/traps.c +@@ -42,7 +42,7 @@ void die(struct pt_regs *regs, const char *str) + print_modules(); + show_regs(regs); + +- ret = notify_die(DIE_OOPS, str, regs, 0, regs->scause, SIGSEGV); ++ ret = notify_die(DIE_OOPS, str, regs, 0, regs->cause, SIGSEGV); + + if (regs && kexec_should_crash(current)) + crash_kexec(regs); +@@ -90,7 +90,7 @@ static void do_trap_error(struct pt_regs *regs, int signo, int code, + #define DO_ERROR_INFO(name, signo, code, str) \ + asmlinkage __visible void name(struct pt_regs *regs) \ + { \ +- do_trap_error(regs, signo, code, regs->sepc, "Oops - " str); \ ++ do_trap_error(regs, signo, code, regs->epc, "Oops - " str); \ + } + + DO_ERROR_INFO(do_trap_unknown, +@@ -128,9 +128,9 @@ static inline unsigned long get_break_insn_length(unsigned long pc) + asmlinkage __visible void do_trap_break(struct pt_regs *regs) + { + if (user_mode(regs)) +- force_sig_fault(SIGTRAP, TRAP_BRKPT, (void __user *)regs->sepc); +- else if (report_bug(regs->sepc, regs) == BUG_TRAP_TYPE_WARN) +- regs->sepc += get_break_insn_length(regs->sepc); ++ force_sig_fault(SIGTRAP, TRAP_BRKPT, (void __user *)regs->epc); ++ else if (report_bug(regs->epc, regs) == BUG_TRAP_TYPE_WARN) ++ regs->epc += get_break_insn_length(regs->epc); + else + die(regs, "Kernel BUG"); + } +@@ -157,9 +157,9 @@ void __init trap_init(void) + * Set sup0 scratch register to 0, indicating to exception vector + * that we are presently executing in the kernel + */ +- csr_write(CSR_SSCRATCH, 0); ++ csr_write(CSR_SCRATCH, 0); + /* Set the exception vector address */ +- csr_write(CSR_STVEC, &handle_exception); ++ csr_write(CSR_TVEC, &handle_exception); + /* Enable all interrupts */ +- csr_write(CSR_SIE, -1); ++ csr_write(CSR_IE, -1); + } +diff --git a/arch/riscv/lib/uaccess.S b/arch/riscv/lib/uaccess.S +index ed2696c0143d5..fecd65657a6fc 100644 +--- a/arch/riscv/lib/uaccess.S ++++ b/arch/riscv/lib/uaccess.S +@@ -18,7 +18,7 @@ ENTRY(__asm_copy_from_user) + + /* Enable access to user memory */ + li t6, SR_SUM +- csrs CSR_SSTATUS, t6 ++ csrs CSR_STATUS, t6 + + add a3, a1, a2 + /* Use word-oriented copy only if low-order bits match */ +@@ -47,7 +47,7 @@ ENTRY(__asm_copy_from_user) + + 3: + /* Disable access to user memory */ +- csrc CSR_SSTATUS, t6 ++ csrc CSR_STATUS, t6 + li a0, 0 + ret + 4: /* Edge case: unalignment */ +@@ -72,7 +72,7 @@ ENTRY(__clear_user) + + /* Enable access to user memory */ + li t6, SR_SUM +- csrs CSR_SSTATUS, t6 ++ csrs CSR_STATUS, t6 + + add a3, a0, a1 + addi t0, a0, SZREG-1 +@@ -94,7 +94,7 @@ ENTRY(__clear_user) + + 3: + /* Disable access to user memory */ +- csrc CSR_SSTATUS, t6 ++ csrc CSR_STATUS, t6 + li a0, 0 + ret + 4: /* Edge case: unalignment */ +@@ -114,11 +114,11 @@ ENDPROC(__clear_user) + /* Fixup code for __copy_user(10) and __clear_user(11) */ + 10: + /* Disable access to user memory */ +- csrs CSR_SSTATUS, t6 ++ csrs CSR_STATUS, t6 + mv a0, a2 + ret + 11: +- csrs CSR_SSTATUS, t6 ++ csrs CSR_STATUS, t6 + mv a0, a1 + ret + .previous +diff --git a/arch/riscv/mm/extable.c b/arch/riscv/mm/extable.c +index 7aed9178d365d..2fc7294221515 100644 +--- a/arch/riscv/mm/extable.c ++++ b/arch/riscv/mm/extable.c +@@ -15,9 +15,9 @@ int fixup_exception(struct pt_regs *regs) + { + const struct exception_table_entry *fixup; + +- fixup = search_exception_tables(regs->sepc); ++ fixup = search_exception_tables(regs->epc); + if (fixup) { +- regs->sepc = fixup->fixup; ++ regs->epc = fixup->fixup; + return 1; + } + return 0; +diff --git a/arch/riscv/mm/fault.c b/arch/riscv/mm/fault.c +index 1cfce62caa119..55ac8b7bb432d 100644 +--- a/arch/riscv/mm/fault.c ++++ b/arch/riscv/mm/fault.c +@@ -34,8 +34,8 @@ asmlinkage void do_page_fault(struct pt_regs *regs) + int code = SEGV_MAPERR; + vm_fault_t fault; + +- cause = regs->scause; +- addr = regs->sbadaddr; ++ cause = regs->cause; ++ addr = regs->badaddr; + + tsk = current; + mm = tsk->mm; +@@ -53,7 +53,7 @@ asmlinkage void do_page_fault(struct pt_regs *regs) + goto vmalloc_fault; + + /* Enable interrupts if they were enabled in the parent context. */ +- if (likely(regs->sstatus & SR_SPIE)) ++ if (likely(regs->status & SR_PIE)) + local_irq_enable(); + + /* +diff --git a/drivers/clocksource/timer-riscv.c b/drivers/clocksource/timer-riscv.c +index 4b04ffbe5e7e9..cd83951718494 100644 +--- a/drivers/clocksource/timer-riscv.c ++++ b/drivers/clocksource/timer-riscv.c +@@ -19,7 +19,7 @@ + static int riscv_clock_next_event(unsigned long delta, + struct clock_event_device *ce) + { +- csr_set(sie, SIE_STIE); ++ csr_set(CSR_IE, IE_TIE); + sbi_set_timer(get_cycles64() + delta); + return 0; + } +@@ -61,13 +61,13 @@ static int riscv_timer_starting_cpu(unsigned int cpu) + ce->cpumask = cpumask_of(cpu); + clockevents_config_and_register(ce, riscv_timebase, 100, 0x7fffffff); + +- csr_set(sie, SIE_STIE); ++ csr_set(CSR_IE, IE_TIE); + return 0; + } + + static int riscv_timer_dying_cpu(unsigned int cpu) + { +- csr_clear(sie, SIE_STIE); ++ csr_clear(CSR_IE, IE_TIE); + return 0; + } + +@@ -76,7 +76,7 @@ void riscv_timer_interrupt(void) + { + struct clock_event_device *evdev = this_cpu_ptr(&riscv_clock_event); + +- csr_clear(sie, SIE_STIE); ++ csr_clear(CSR_IE, IE_TIE); + evdev->event_handler(evdev); + } + +diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c +index 9dad45d928bfe..2dca689a5cbc6 100644 +--- a/drivers/irqchip/irq-sifive-plic.c ++++ b/drivers/irqchip/irq-sifive-plic.c +@@ -187,7 +187,7 @@ static void plic_handle_irq(struct pt_regs *regs) + + WARN_ON_ONCE(!handler->present); + +- csr_clear(sie, SIE_SEIE); ++ csr_clear(CSR_IE, IE_EIE); + while ((hwirq = readl(claim))) { + int irq = irq_find_mapping(plic_irqdomain, hwirq); + +@@ -197,7 +197,7 @@ static void plic_handle_irq(struct pt_regs *regs) + else + generic_handle_irq(irq); + } +- csr_set(sie, SIE_SEIE); ++ csr_set(CSR_IE, IE_EIE); + } + + /* +@@ -258,8 +258,11 @@ static int __init plic_init(struct device_node *node, + continue; + } + +- /* skip contexts other than supervisor external interrupt */ +- if (parent.args[0] != IRQ_S_EXT) ++ /* ++ * Skip contexts other than external interrupts for our ++ * privilege level. ++ */ ++ if (parent.args[0] != IRQ_EXT) + continue; + + hartid = plic_find_hart_id(parent.np); +-- +2.39.2 + diff --git a/queue-5.4/riscv-avoid-enabling-interrupts-in-die.patch b/queue-5.4/riscv-avoid-enabling-interrupts-in-die.patch new file mode 100644 index 00000000000..1dc6f843f5a --- /dev/null +++ b/queue-5.4/riscv-avoid-enabling-interrupts-in-die.patch @@ -0,0 +1,60 @@ +From d52b7f5ca92c5ccfd25076035a3bc1d329e7d83b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Feb 2023 14:48:28 +0000 +Subject: riscv: Avoid enabling interrupts in die() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mattias Nissler + +[ Upstream commit 130aee3fd9981297ff9354e5d5609cd59aafbbea ] + +While working on something else, I noticed that the kernel would start +accepting interrupts again after crashing in an interrupt handler. Since +the kernel is already in inconsistent state, enabling interrupts is +dangerous and opens up risk of kernel state deteriorating further. +Interrupts do get enabled via what looks like an unintended side effect of +spin_unlock_irq, so switch to the more cautious +spin_lock_irqsave/spin_unlock_irqrestore instead. + +Fixes: 76d2a0493a17 ("RISC-V: Init and Halt Code") +Signed-off-by: Mattias Nissler +Reviewed-by: Björn Töpel +Link: https://lore.kernel.org/r/20230215144828.3370316-1-mnissler@rivosinc.com +Cc: stable@vger.kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/traps.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c +index 5ca5a04258d0d..312da504b0162 100644 +--- a/arch/riscv/kernel/traps.c ++++ b/arch/riscv/kernel/traps.c +@@ -32,10 +32,11 @@ void die(struct pt_regs *regs, const char *str) + static int die_counter; + int ret; + long cause; ++ unsigned long flags; + + oops_enter(); + +- spin_lock_irq(&die_lock); ++ spin_lock_irqsave(&die_lock, flags); + console_verbose(); + bust_spinlocks(1); + +@@ -52,7 +53,7 @@ void die(struct pt_regs *regs, const char *str) + + bust_spinlocks(0); + add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE); +- spin_unlock_irq(&die_lock); ++ spin_unlock_irqrestore(&die_lock, flags); + oops_exit(); + + if (in_interrupt()) +-- +2.39.2 + diff --git a/queue-5.4/riscv-ftrace-remove-wasted-nops-for-riscv_isa_c.patch b/queue-5.4/riscv-ftrace-remove-wasted-nops-for-riscv_isa_c.patch new file mode 100644 index 00000000000..122defca3b5 --- /dev/null +++ b/queue-5.4/riscv-ftrace-remove-wasted-nops-for-riscv_isa_c.patch @@ -0,0 +1,60 @@ +From 90d2039dfb03cdc912ca5b796940853ee5c978ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 04:05:58 -0500 +Subject: riscv: ftrace: Remove wasted nops for !RISCV_ISA_C + +From: Guo Ren + +[ Upstream commit 409c8fb20c66df7150e592747412438c04aeb11f ] + +When CONFIG_RISCV_ISA_C=n, -fpatchable-function-entry=8 would generate +more nops than we expect. Because it treat nop opcode as 0x00000013 +instead of 0x0001. + +Dump of assembler code for function dw_pcie_free_msi: + 0xffffffff806fce94 <+0>: sd ra,-8(sp) + 0xffffffff806fce98 <+4>: auipc ra,0xff90f + 0xffffffff806fce9c <+8>: jalr -684(ra) # 0xffffffff8000bbec + + 0xffffffff806fcea0 <+12>: ld ra,-8(sp) + 0xffffffff806fcea4 <+16>: nop /* wasted */ + 0xffffffff806fcea8 <+20>: nop /* wasted */ + 0xffffffff806fceac <+24>: nop /* wasted */ + 0xffffffff806fceb0 <+28>: nop /* wasted */ + 0xffffffff806fceb4 <+0>: addi sp,sp,-48 + 0xffffffff806fceb8 <+4>: sd s0,32(sp) + 0xffffffff806fcebc <+8>: sd s1,24(sp) + 0xffffffff806fcec0 <+12>: sd s2,16(sp) + 0xffffffff806fcec4 <+16>: sd s3,8(sp) + 0xffffffff806fcec8 <+20>: sd ra,40(sp) + 0xffffffff806fcecc <+24>: addi s0,sp,48 + +Signed-off-by: Guo Ren +Signed-off-by: Guo Ren +Link: https://lore.kernel.org/r/20230112090603.1295340-3-guoren@kernel.org +Cc: stable@vger.kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/Makefile | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile +index 16dc4a7e9b379..26ffd9e6a2818 100644 +--- a/arch/riscv/Makefile ++++ b/arch/riscv/Makefile +@@ -13,7 +13,11 @@ LDFLAGS_vmlinux := + ifeq ($(CONFIG_DYNAMIC_FTRACE),y) + LDFLAGS_vmlinux := --no-relax + KBUILD_CPPFLAGS += -DCC_USING_PATCHABLE_FUNCTION_ENTRY ++ifeq ($(CONFIG_RISCV_ISA_C),y) + CC_FLAGS_FTRACE := -fpatchable-function-entry=8 ++else ++ CC_FLAGS_FTRACE := -fpatchable-function-entry=4 ++endif + endif + KBUILD_AFLAGS_MODULE += -fPIC + KBUILD_CFLAGS_MODULE += -fPIC +-- +2.39.2 + diff --git a/queue-5.4/riscv-use-read_once_nocheck-in-imprecise-unwinding-s.patch b/queue-5.4/riscv-use-read_once_nocheck-in-imprecise-unwinding-s.patch new file mode 100644 index 00000000000..931ec1aa665 --- /dev/null +++ b/queue-5.4/riscv-use-read_once_nocheck-in-imprecise-unwinding-s.patch @@ -0,0 +1,99 @@ +From b7a09cc15da6829a604960438ec9a668b2401c18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Mar 2023 10:16:39 +0100 +Subject: riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode + +From: Alexandre Ghiti + +[ Upstream commit 76950340cf03b149412fe0d5f0810e52ac1df8cb ] + +When CONFIG_FRAME_POINTER is unset, the stack unwinding function +walk_stackframe randomly reads the stack and then, when KASAN is enabled, +it can lead to the following backtrace: + +[ 0.000000] ================================================================== +[ 0.000000] BUG: KASAN: stack-out-of-bounds in walk_stackframe+0xa6/0x11a +[ 0.000000] Read of size 8 at addr ffffffff81807c40 by task swapper/0 +[ 0.000000] +[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.2.0-12919-g24203e6db61f #43 +[ 0.000000] Hardware name: riscv-virtio,qemu (DT) +[ 0.000000] Call Trace: +[ 0.000000] [] walk_stackframe+0x0/0x11a +[ 0.000000] [] init_param_lock+0x26/0x2a +[ 0.000000] [] walk_stackframe+0xa2/0x11a +[ 0.000000] [] dump_stack_lvl+0x22/0x36 +[ 0.000000] [] print_report+0x198/0x4a8 +[ 0.000000] [] init_param_lock+0x26/0x2a +[ 0.000000] [] walk_stackframe+0xa2/0x11a +[ 0.000000] [] kasan_report+0x9a/0xc8 +[ 0.000000] [] walk_stackframe+0xa2/0x11a +[ 0.000000] [] walk_stackframe+0xa2/0x11a +[ 0.000000] [] desc_make_final+0x80/0x84 +[ 0.000000] [] stack_trace_save+0x88/0xa6 +[ 0.000000] [] filter_irq_stacks+0x72/0x76 +[ 0.000000] [] devkmsg_read+0x32a/0x32e +[ 0.000000] [] kasan_save_stack+0x28/0x52 +[ 0.000000] [] desc_make_final+0x7c/0x84 +[ 0.000000] [] stack_trace_save+0x84/0xa6 +[ 0.000000] [] kasan_set_track+0x12/0x20 +[ 0.000000] [] __kasan_slab_alloc+0x58/0x5e +[ 0.000000] [] __kmem_cache_create+0x21e/0x39a +[ 0.000000] [] create_boot_cache+0x70/0x9c +[ 0.000000] [] kmem_cache_init+0x6c/0x11e +[ 0.000000] [] mm_init+0xd8/0xfe +[ 0.000000] [] start_kernel+0x190/0x3ca +[ 0.000000] +[ 0.000000] The buggy address belongs to stack of task swapper/0 +[ 0.000000] and is located at offset 0 in frame: +[ 0.000000] stack_trace_save+0x0/0xa6 +[ 0.000000] +[ 0.000000] This frame has 1 object: +[ 0.000000] [32, 56) 'c' +[ 0.000000] +[ 0.000000] The buggy address belongs to the physical page: +[ 0.000000] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x81a07 +[ 0.000000] flags: 0x1000(reserved|zone=0) +[ 0.000000] raw: 0000000000001000 ff600003f1e3d150 ff600003f1e3d150 0000000000000000 +[ 0.000000] raw: 0000000000000000 0000000000000000 00000001ffffffff +[ 0.000000] page dumped because: kasan: bad access detected +[ 0.000000] +[ 0.000000] Memory state around the buggy address: +[ 0.000000] ffffffff81807b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 0.000000] ffffffff81807b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 0.000000] >ffffffff81807c00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 f3 +[ 0.000000] ^ +[ 0.000000] ffffffff81807c80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 +[ 0.000000] ffffffff81807d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 0.000000] ================================================================== + +Fix that by using READ_ONCE_NOCHECK when reading the stack in imprecise +mode. + +Fixes: 5d8544e2d007 ("RISC-V: Generic library routines and assembly") +Reported-by: Chathura Rajapaksha +Link: https://lore.kernel.org/all/CAD7mqryDQCYyJ1gAmtMm8SASMWAQ4i103ptTb0f6Oda=tPY2=A@mail.gmail.com/ +Suggested-by: Dmitry Vyukov +Signed-off-by: Alexandre Ghiti +Link: https://lore.kernel.org/r/20230308091639.602024-1-alexghiti@rivosinc.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/stacktrace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/riscv/kernel/stacktrace.c b/arch/riscv/kernel/stacktrace.c +index 19e46f4160cc3..5ba4d23971fdb 100644 +--- a/arch/riscv/kernel/stacktrace.c ++++ b/arch/riscv/kernel/stacktrace.c +@@ -89,7 +89,7 @@ void notrace walk_stackframe(struct task_struct *task, + while (!kstack_end(ksp)) { + if (__kernel_text_address(pc) && unlikely(fn(pc, arg))) + break; +- pc = (*ksp++) - 0x4; ++ pc = READ_ONCE_NOCHECK(*ksp++) - 0x4; + } + } + +-- +2.39.2 + diff --git a/queue-5.4/riscv-using-patchable_function_entry-instead-of-mcou.patch b/queue-5.4/riscv-using-patchable_function_entry-instead-of-mcou.patch new file mode 100644 index 00000000000..77528335361 --- /dev/null +++ b/queue-5.4/riscv-using-patchable_function_entry-instead-of-mcou.patch @@ -0,0 +1,600 @@ +From 90df613c317f4d768516001b773fde681377bc27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Dec 2020 16:01:41 +0000 +Subject: riscv: Using PATCHABLE_FUNCTION_ENTRY instead of MCOUNT + +From: Guo Ren + +[ Upstream commit afc76b8b80112189b6f11e67e19cf58301944814 ] + +This patch changes the current detour mechanism of dynamic ftrace +which has been discussed during LPC 2020 RISCV-MC [1]. + +Before the patch, we used mcount for detour: +: + addi sp,sp,-16 + sd ra,8(sp) + sd s0,0(sp) + addi s0,sp,16 + mv a5,ra + mv a0,a5 + auipc ra,0x0 -> nop + jalr -296(ra) <_mcount@plt> ->nop + ... + +After the patch, we use nop call site area for detour: +: + nop -> REG_S ra, -SZREG(sp) + nop -> auipc ra, 0x? + nop -> jalr ?(ra) + nop -> REG_L ra, -SZREG(sp) + ... + +The mcount mechanism is mixed with gcc function prologue which is +not very clear. The patchable function entry just put 16 bytes nop +before the front of the function prologue which could be filled +with a separated detour mechanism. + +[1] https://www.linuxplumbersconf.org/event/7/contributions/807/ + +Signed-off-by: Guo Ren +Signed-off-by: Palmer Dabbelt +Stable-dep-of: 409c8fb20c66 ("riscv: ftrace: Remove wasted nops for !RISCV_ISA_C") +Signed-off-by: Sasha Levin +--- + arch/riscv/Makefile | 2 + + arch/riscv/kernel/ftrace.c | 95 ++++----- + arch/riscv/kernel/mcount-dyn.S | 342 +++++++++++++++------------------ + 3 files changed, 204 insertions(+), 235 deletions(-) + +diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile +index 1641d82014127..16dc4a7e9b379 100644 +--- a/arch/riscv/Makefile ++++ b/arch/riscv/Makefile +@@ -12,6 +12,8 @@ OBJCOPYFLAGS := -O binary + LDFLAGS_vmlinux := + ifeq ($(CONFIG_DYNAMIC_FTRACE),y) + LDFLAGS_vmlinux := --no-relax ++ KBUILD_CPPFLAGS += -DCC_USING_PATCHABLE_FUNCTION_ENTRY ++ CC_FLAGS_FTRACE := -fpatchable-function-entry=8 + endif + KBUILD_AFLAGS_MODULE += -fPIC + KBUILD_CFLAGS_MODULE += -fPIC +diff --git a/arch/riscv/kernel/ftrace.c b/arch/riscv/kernel/ftrace.c +index 291c579e12457..d42df2d561ddd 100644 +--- a/arch/riscv/kernel/ftrace.c ++++ b/arch/riscv/kernel/ftrace.c +@@ -63,29 +63,56 @@ static int __ftrace_modify_call(unsigned long hook_pos, unsigned long target, + return 0; + } + ++/* ++ * Put 5 instructions with 16 bytes at the front of function within ++ * patchable function entry nops' area. ++ * ++ * 0: REG_S ra, -SZREG(sp) ++ * 1: auipc ra, 0x? ++ * 2: jalr -?(ra) ++ * 3: REG_L ra, -SZREG(sp) ++ * ++ * So the opcodes is: ++ * 0: 0xfe113c23 (sd)/0xfe112e23 (sw) ++ * 1: 0x???????? -> auipc ++ * 2: 0x???????? -> jalr ++ * 3: 0xff813083 (ld)/0xffc12083 (lw) ++ */ ++#if __riscv_xlen == 64 ++#define INSN0 0xfe113c23 ++#define INSN3 0xff813083 ++#elif __riscv_xlen == 32 ++#define INSN0 0xfe112e23 ++#define INSN3 0xffc12083 ++#endif ++ ++#define FUNC_ENTRY_SIZE 16 ++#define FUNC_ENTRY_JMP 4 ++ + int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr) + { +- int ret = ftrace_check_current_call(rec->ip, NULL); ++ unsigned int call[4] = {INSN0, 0, 0, INSN3}; ++ unsigned long target = addr; ++ unsigned long caller = rec->ip + FUNC_ENTRY_JMP; + +- if (ret) +- return ret; ++ call[1] = to_auipc_insn((unsigned int)(target - caller)); ++ call[2] = to_jalr_insn((unsigned int)(target - caller)); + +- return __ftrace_modify_call(rec->ip, addr, true); ++ if (patch_text_nosync((void *)rec->ip, call, FUNC_ENTRY_SIZE)) ++ return -EPERM; ++ ++ return 0; + } + + int ftrace_make_nop(struct module *mod, struct dyn_ftrace *rec, + unsigned long addr) + { +- unsigned int call[2]; +- int ret; ++ unsigned int nops[4] = {NOP4, NOP4, NOP4, NOP4}; + +- make_call(rec->ip, addr, call); +- ret = ftrace_check_current_call(rec->ip, call); +- +- if (ret) +- return ret; ++ if (patch_text_nosync((void *)rec->ip, nops, FUNC_ENTRY_SIZE)) ++ return -EPERM; + +- return __ftrace_modify_call(rec->ip, addr, false); ++ return 0; + } + + +@@ -130,15 +157,16 @@ int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr, + unsigned long addr) + { + unsigned int call[2]; ++ unsigned long caller = rec->ip + FUNC_ENTRY_JMP; + int ret; + +- make_call(rec->ip, old_addr, call); +- ret = ftrace_check_current_call(rec->ip, call); ++ make_call(caller, old_addr, call); ++ ret = ftrace_check_current_call(caller, call); + + if (ret) + return ret; + +- return __ftrace_modify_call(rec->ip, addr, true); ++ return __ftrace_modify_call(caller, addr, true); + } + #endif + +@@ -167,53 +195,30 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr, + + #ifdef CONFIG_DYNAMIC_FTRACE + extern void ftrace_graph_call(void); ++extern void ftrace_graph_regs_call(void); + int ftrace_enable_ftrace_graph_caller(void) + { +- unsigned int call[2]; +- static int init_graph = 1; + int ret; + +- make_call(&ftrace_graph_call, &ftrace_stub, call); +- +- /* +- * When enabling graph tracer for the first time, ftrace_graph_call +- * should contains a call to ftrace_stub. Once it has been disabled, +- * the 8-bytes at the position becomes NOPs. +- */ +- if (init_graph) { +- ret = ftrace_check_current_call((unsigned long)&ftrace_graph_call, +- call); +- init_graph = 0; +- } else { +- ret = ftrace_check_current_call((unsigned long)&ftrace_graph_call, +- NULL); +- } +- ++ ret = __ftrace_modify_call((unsigned long)&ftrace_graph_call, ++ (unsigned long)&prepare_ftrace_return, true); + if (ret) + return ret; + +- return __ftrace_modify_call((unsigned long)&ftrace_graph_call, ++ return __ftrace_modify_call((unsigned long)&ftrace_graph_regs_call, + (unsigned long)&prepare_ftrace_return, true); + } + + int ftrace_disable_ftrace_graph_caller(void) + { +- unsigned int call[2]; + int ret; + +- make_call(&ftrace_graph_call, &prepare_ftrace_return, call); +- +- /* +- * This is to make sure that ftrace_enable_ftrace_graph_caller +- * did the right thing. +- */ +- ret = ftrace_check_current_call((unsigned long)&ftrace_graph_call, +- call); +- ++ ret = __ftrace_modify_call((unsigned long)&ftrace_graph_call, ++ (unsigned long)&prepare_ftrace_return, false); + if (ret) + return ret; + +- return __ftrace_modify_call((unsigned long)&ftrace_graph_call, ++ return __ftrace_modify_call((unsigned long)&ftrace_graph_regs_call, + (unsigned long)&prepare_ftrace_return, false); + } + #endif /* CONFIG_DYNAMIC_FTRACE */ +diff --git a/arch/riscv/kernel/mcount-dyn.S b/arch/riscv/kernel/mcount-dyn.S +index 35a6ed76cb8b7..d171eca623b6f 100644 +--- a/arch/riscv/kernel/mcount-dyn.S ++++ b/arch/riscv/kernel/mcount-dyn.S +@@ -13,224 +13,186 @@ + + .text + +- .macro SAVE_ABI_STATE +-#ifdef CONFIG_FUNCTION_GRAPH_TRACER +- addi sp, sp, -48 +- sd s0, 32(sp) +- sd ra, 40(sp) +- addi s0, sp, 48 +- sd t0, 24(sp) +- sd t1, 16(sp) +-#ifdef HAVE_FUNCTION_GRAPH_FP_TEST +- sd t2, 8(sp) +-#endif +-#else +- addi sp, sp, -16 +- sd s0, 0(sp) +- sd ra, 8(sp) +- addi s0, sp, 16 +-#endif ++#define FENTRY_RA_OFFSET 12 ++#define ABI_SIZE_ON_STACK 72 ++#define ABI_A0 0 ++#define ABI_A1 8 ++#define ABI_A2 16 ++#define ABI_A3 24 ++#define ABI_A4 32 ++#define ABI_A5 40 ++#define ABI_A6 48 ++#define ABI_A7 56 ++#define ABI_RA 64 ++ ++ .macro SAVE_ABI ++ addi sp, sp, -SZREG ++ addi sp, sp, -ABI_SIZE_ON_STACK ++ ++ REG_S a0, ABI_A0(sp) ++ REG_S a1, ABI_A1(sp) ++ REG_S a2, ABI_A2(sp) ++ REG_S a3, ABI_A3(sp) ++ REG_S a4, ABI_A4(sp) ++ REG_S a5, ABI_A5(sp) ++ REG_S a6, ABI_A6(sp) ++ REG_S a7, ABI_A7(sp) ++ REG_S ra, ABI_RA(sp) + .endm + +- .macro RESTORE_ABI_STATE +-#ifdef CONFIG_FUNCTION_GRAPH_TRACER +- ld s0, 32(sp) +- ld ra, 40(sp) +- addi sp, sp, 48 +-#else +- ld ra, 8(sp) +- ld s0, 0(sp) +- addi sp, sp, 16 +-#endif ++ .macro RESTORE_ABI ++ REG_L a0, ABI_A0(sp) ++ REG_L a1, ABI_A1(sp) ++ REG_L a2, ABI_A2(sp) ++ REG_L a3, ABI_A3(sp) ++ REG_L a4, ABI_A4(sp) ++ REG_L a5, ABI_A5(sp) ++ REG_L a6, ABI_A6(sp) ++ REG_L a7, ABI_A7(sp) ++ REG_L ra, ABI_RA(sp) ++ ++ addi sp, sp, ABI_SIZE_ON_STACK ++ addi sp, sp, SZREG + .endm + +- .macro RESTORE_GRAPH_ARGS +- ld a0, 24(sp) +- ld a1, 16(sp) +-#ifdef HAVE_FUNCTION_GRAPH_FP_TEST +- ld a2, 8(sp) +-#endif ++#ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS ++ .macro SAVE_ALL ++ addi sp, sp, -SZREG ++ addi sp, sp, -PT_SIZE_ON_STACK ++ ++ REG_S x1, PT_EPC(sp) ++ addi sp, sp, PT_SIZE_ON_STACK ++ REG_L x1, (sp) ++ addi sp, sp, -PT_SIZE_ON_STACK ++ REG_S x1, PT_RA(sp) ++ REG_L x1, PT_EPC(sp) ++ ++ REG_S x2, PT_SP(sp) ++ REG_S x3, PT_GP(sp) ++ REG_S x4, PT_TP(sp) ++ REG_S x5, PT_T0(sp) ++ REG_S x6, PT_T1(sp) ++ REG_S x7, PT_T2(sp) ++ REG_S x8, PT_S0(sp) ++ REG_S x9, PT_S1(sp) ++ REG_S x10, PT_A0(sp) ++ REG_S x11, PT_A1(sp) ++ REG_S x12, PT_A2(sp) ++ REG_S x13, PT_A3(sp) ++ REG_S x14, PT_A4(sp) ++ REG_S x15, PT_A5(sp) ++ REG_S x16, PT_A6(sp) ++ REG_S x17, PT_A7(sp) ++ REG_S x18, PT_S2(sp) ++ REG_S x19, PT_S3(sp) ++ REG_S x20, PT_S4(sp) ++ REG_S x21, PT_S5(sp) ++ REG_S x22, PT_S6(sp) ++ REG_S x23, PT_S7(sp) ++ REG_S x24, PT_S8(sp) ++ REG_S x25, PT_S9(sp) ++ REG_S x26, PT_S10(sp) ++ REG_S x27, PT_S11(sp) ++ REG_S x28, PT_T3(sp) ++ REG_S x29, PT_T4(sp) ++ REG_S x30, PT_T5(sp) ++ REG_S x31, PT_T6(sp) + .endm + +-ENTRY(ftrace_graph_caller) +- addi sp, sp, -16 +- sd s0, 0(sp) +- sd ra, 8(sp) +- addi s0, sp, 16 +-ftrace_graph_call: +- .global ftrace_graph_call +- /* +- * Calling ftrace_enable/disable_ftrace_graph_caller would overwrite the +- * call below. Check ftrace_modify_all_code for details. +- */ +- call ftrace_stub +- ld ra, 8(sp) +- ld s0, 0(sp) +- addi sp, sp, 16 +- ret +-ENDPROC(ftrace_graph_caller) ++ .macro RESTORE_ALL ++ REG_L x1, PT_RA(sp) ++ addi sp, sp, PT_SIZE_ON_STACK ++ REG_S x1, (sp) ++ addi sp, sp, -PT_SIZE_ON_STACK ++ REG_L x1, PT_EPC(sp) ++ REG_L x2, PT_SP(sp) ++ REG_L x3, PT_GP(sp) ++ REG_L x4, PT_TP(sp) ++ REG_L x5, PT_T0(sp) ++ REG_L x6, PT_T1(sp) ++ REG_L x7, PT_T2(sp) ++ REG_L x8, PT_S0(sp) ++ REG_L x9, PT_S1(sp) ++ REG_L x10, PT_A0(sp) ++ REG_L x11, PT_A1(sp) ++ REG_L x12, PT_A2(sp) ++ REG_L x13, PT_A3(sp) ++ REG_L x14, PT_A4(sp) ++ REG_L x15, PT_A5(sp) ++ REG_L x16, PT_A6(sp) ++ REG_L x17, PT_A7(sp) ++ REG_L x18, PT_S2(sp) ++ REG_L x19, PT_S3(sp) ++ REG_L x20, PT_S4(sp) ++ REG_L x21, PT_S5(sp) ++ REG_L x22, PT_S6(sp) ++ REG_L x23, PT_S7(sp) ++ REG_L x24, PT_S8(sp) ++ REG_L x25, PT_S9(sp) ++ REG_L x26, PT_S10(sp) ++ REG_L x27, PT_S11(sp) ++ REG_L x28, PT_T3(sp) ++ REG_L x29, PT_T4(sp) ++ REG_L x30, PT_T5(sp) ++ REG_L x31, PT_T6(sp) ++ ++ addi sp, sp, PT_SIZE_ON_STACK ++ addi sp, sp, SZREG ++ .endm ++#endif /* CONFIG_DYNAMIC_FTRACE_WITH_REGS */ + + ENTRY(ftrace_caller) +- /* +- * a0: the address in the caller when calling ftrace_caller +- * a1: the caller's return address +- * a2: the address of global variable function_trace_op +- */ +- ld a1, -8(s0) +- addi a0, ra, -MCOUNT_INSN_SIZE +- la t5, function_trace_op +- ld a2, 0(t5) ++ SAVE_ABI + +-#ifdef CONFIG_FUNCTION_GRAPH_TRACER +- /* +- * the graph tracer (specifically, prepare_ftrace_return) needs these +- * arguments but for now the function tracer occupies the regs, so we +- * save them in temporary regs to recover later. +- */ +- addi t0, s0, -8 +- mv t1, a0 +-#ifdef HAVE_FUNCTION_GRAPH_FP_TEST +- ld t2, -16(s0) +-#endif +-#endif ++ addi a0, ra, -FENTRY_RA_OFFSET ++ la a1, function_trace_op ++ REG_L a2, 0(a1) ++ REG_L a1, ABI_SIZE_ON_STACK(sp) ++ mv a3, sp + +- SAVE_ABI_STATE + ftrace_call: + .global ftrace_call +- /* +- * For the dynamic ftrace to work, here we should reserve at least +- * 8 bytes for a functional auipc-jalr pair. The following call +- * serves this purpose. +- * +- * Calling ftrace_update_ftrace_func would overwrite the nops below. +- * Check ftrace_modify_all_code for details. +- */ + call ftrace_stub + + #ifdef CONFIG_FUNCTION_GRAPH_TRACER +- RESTORE_GRAPH_ARGS +- call ftrace_graph_caller ++ addi a0, sp, ABI_SIZE_ON_STACK ++ REG_L a1, ABI_RA(sp) ++ addi a1, a1, -FENTRY_RA_OFFSET ++#ifdef HAVE_FUNCTION_GRAPH_FP_TEST ++ mv a2, s0 + #endif +- +- RESTORE_ABI_STATE ++ftrace_graph_call: ++ .global ftrace_graph_call ++ call ftrace_stub ++#endif ++ RESTORE_ABI + ret + ENDPROC(ftrace_caller) + + #ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS +- .macro SAVE_ALL +- addi sp, sp, -(PT_SIZE_ON_STACK+16) +- sd s0, (PT_SIZE_ON_STACK)(sp) +- sd ra, (PT_SIZE_ON_STACK+8)(sp) +- addi s0, sp, (PT_SIZE_ON_STACK+16) +- +- sd x1, PT_RA(sp) +- sd x2, PT_SP(sp) +- sd x3, PT_GP(sp) +- sd x4, PT_TP(sp) +- sd x5, PT_T0(sp) +- sd x6, PT_T1(sp) +- sd x7, PT_T2(sp) +- sd x8, PT_S0(sp) +- sd x9, PT_S1(sp) +- sd x10, PT_A0(sp) +- sd x11, PT_A1(sp) +- sd x12, PT_A2(sp) +- sd x13, PT_A3(sp) +- sd x14, PT_A4(sp) +- sd x15, PT_A5(sp) +- sd x16, PT_A6(sp) +- sd x17, PT_A7(sp) +- sd x18, PT_S2(sp) +- sd x19, PT_S3(sp) +- sd x20, PT_S4(sp) +- sd x21, PT_S5(sp) +- sd x22, PT_S6(sp) +- sd x23, PT_S7(sp) +- sd x24, PT_S8(sp) +- sd x25, PT_S9(sp) +- sd x26, PT_S10(sp) +- sd x27, PT_S11(sp) +- sd x28, PT_T3(sp) +- sd x29, PT_T4(sp) +- sd x30, PT_T5(sp) +- sd x31, PT_T6(sp) +- .endm +- +- .macro RESTORE_ALL +- ld x1, PT_RA(sp) +- ld x2, PT_SP(sp) +- ld x3, PT_GP(sp) +- ld x4, PT_TP(sp) +- ld x5, PT_T0(sp) +- ld x6, PT_T1(sp) +- ld x7, PT_T2(sp) +- ld x8, PT_S0(sp) +- ld x9, PT_S1(sp) +- ld x10, PT_A0(sp) +- ld x11, PT_A1(sp) +- ld x12, PT_A2(sp) +- ld x13, PT_A3(sp) +- ld x14, PT_A4(sp) +- ld x15, PT_A5(sp) +- ld x16, PT_A6(sp) +- ld x17, PT_A7(sp) +- ld x18, PT_S2(sp) +- ld x19, PT_S3(sp) +- ld x20, PT_S4(sp) +- ld x21, PT_S5(sp) +- ld x22, PT_S6(sp) +- ld x23, PT_S7(sp) +- ld x24, PT_S8(sp) +- ld x25, PT_S9(sp) +- ld x26, PT_S10(sp) +- ld x27, PT_S11(sp) +- ld x28, PT_T3(sp) +- ld x29, PT_T4(sp) +- ld x30, PT_T5(sp) +- ld x31, PT_T6(sp) +- +- ld s0, (PT_SIZE_ON_STACK)(sp) +- ld ra, (PT_SIZE_ON_STACK+8)(sp) +- addi sp, sp, (PT_SIZE_ON_STACK+16) +- .endm +- +- .macro RESTORE_GRAPH_REG_ARGS +- ld a0, PT_T0(sp) +- ld a1, PT_T1(sp) +-#ifdef HAVE_FUNCTION_GRAPH_FP_TEST +- ld a2, PT_T2(sp) +-#endif +- .endm +- +-/* +- * Most of the contents are the same as ftrace_caller. +- */ + ENTRY(ftrace_regs_caller) +- /* +- * a3: the address of all registers in the stack +- */ +- ld a1, -8(s0) +- addi a0, ra, -MCOUNT_INSN_SIZE +- la t5, function_trace_op +- ld a2, 0(t5) +- addi a3, sp, -(PT_SIZE_ON_STACK+16) +- +-#ifdef CONFIG_FUNCTION_GRAPH_TRACER +- addi t0, s0, -8 +- mv t1, a0 +-#ifdef HAVE_FUNCTION_GRAPH_FP_TEST +- ld t2, -16(s0) +-#endif +-#endif + SAVE_ALL + ++ addi a0, ra, -FENTRY_RA_OFFSET ++ la a1, function_trace_op ++ REG_L a2, 0(a1) ++ REG_L a1, PT_SIZE_ON_STACK(sp) ++ mv a3, sp ++ + ftrace_regs_call: + .global ftrace_regs_call + call ftrace_stub + + #ifdef CONFIG_FUNCTION_GRAPH_TRACER +- RESTORE_GRAPH_REG_ARGS +- call ftrace_graph_caller ++ addi a0, sp, PT_RA ++ REG_L a1, PT_EPC(sp) ++ addi a1, a1, -FENTRY_RA_OFFSET ++#ifdef HAVE_FUNCTION_GRAPH_FP_TEST ++ mv a2, s0 ++#endif ++ftrace_graph_regs_call: ++ .global ftrace_graph_regs_call ++ call ftrace_stub + #endif + + RESTORE_ALL +-- +2.39.2 + diff --git a/queue-5.4/scsi-core-remove-the-proc-scsi-proc_name-directory-e.patch b/queue-5.4/scsi-core-remove-the-proc-scsi-proc_name-directory-e.patch new file mode 100644 index 00000000000..371d3e36402 --- /dev/null +++ b/queue-5.4/scsi-core-remove-the-proc-scsi-proc_name-directory-e.patch @@ -0,0 +1,79 @@ +From 8c210f7136602b369661a70ca9af3fbabeb81c45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Feb 2023 12:52:00 -0800 +Subject: scsi: core: Remove the /proc/scsi/${proc_name} directory earlier + +From: Bart Van Assche + +[ Upstream commit fc663711b94468f4e1427ebe289c9f05669699c9 ] + +Remove the /proc/scsi/${proc_name} directory earlier to fix a race +condition between unloading and reloading kernel modules. This fixes a bug +introduced in 2009 by commit 77c019768f06 ("[SCSI] fix /proc memory leak in +the SCSI core"). + +Fix the following kernel warning: + +proc_dir_entry 'scsi/scsi_debug' already registered +WARNING: CPU: 19 PID: 27986 at fs/proc/generic.c:376 proc_register+0x27d/0x2e0 +Call Trace: + proc_mkdir+0xb5/0xe0 + scsi_proc_hostdir_add+0xb5/0x170 + scsi_host_alloc+0x683/0x6c0 + sdebug_driver_probe+0x6b/0x2d0 [scsi_debug] + really_probe+0x159/0x540 + __driver_probe_device+0xdc/0x230 + driver_probe_device+0x4f/0x120 + __device_attach_driver+0xef/0x180 + bus_for_each_drv+0xe5/0x130 + __device_attach+0x127/0x290 + device_initial_probe+0x17/0x20 + bus_probe_device+0x110/0x130 + device_add+0x673/0xc80 + device_register+0x1e/0x30 + sdebug_add_host_helper+0x1a7/0x3b0 [scsi_debug] + scsi_debug_init+0x64f/0x1000 [scsi_debug] + do_one_initcall+0xd7/0x470 + do_init_module+0xe7/0x330 + load_module+0x122a/0x12c0 + __do_sys_finit_module+0x124/0x1a0 + __x64_sys_finit_module+0x46/0x50 + do_syscall_64+0x38/0x80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Link: https://lore.kernel.org/r/20230210205200.36973-3-bvanassche@acm.org +Cc: Alan Stern +Cc: Yi Zhang +Cc: stable@vger.kernel.org +Fixes: 77c019768f06 ("[SCSI] fix /proc memory leak in the SCSI core") +Reported-by: Yi Zhang +Signed-off-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hosts.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c +index 45885e80992fb..b08d963013db6 100644 +--- a/drivers/scsi/hosts.c ++++ b/drivers/scsi/hosts.c +@@ -179,6 +179,7 @@ void scsi_remove_host(struct Scsi_Host *shost) + scsi_forget_host(shost); + mutex_unlock(&shost->scan_mutex); + scsi_proc_host_rm(shost); ++ scsi_proc_hostdir_rm(shost->hostt); + + spin_lock_irqsave(shost->host_lock, flags); + if (scsi_host_set_state(shost, SHOST_DEL)) +@@ -318,6 +319,7 @@ static void scsi_host_dev_release(struct device *dev) + struct Scsi_Host *shost = dev_to_shost(dev); + struct device *parent = dev->parent; + ++ /* In case scsi_remove_host() has not been called. */ + scsi_proc_hostdir_rm(shost->hostt); + + /* Wait for functions invoked through call_rcu(&shost->rcu, ...) */ +-- +2.39.2 + diff --git a/queue-5.4/scsi-megaraid_sas-update-max-supported-ld-ids-to-240.patch b/queue-5.4/scsi-megaraid_sas-update-max-supported-ld-ids-to-240.patch new file mode 100644 index 00000000000..1c6884d8cd5 --- /dev/null +++ b/queue-5.4/scsi-megaraid_sas-update-max-supported-ld-ids-to-240.patch @@ -0,0 +1,60 @@ +From 39dd02b07349b6215838f5cc035b29d014bab994 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Mar 2023 16:23:40 +0530 +Subject: scsi: megaraid_sas: Update max supported LD IDs to 240 + +From: Chandrakanth Patil + +[ Upstream commit bfa659177dcba48cf13f2bd88c1972f12a60bf1c ] + +The firmware only supports Logical Disk IDs up to 240 and LD ID 255 (0xFF) +is reserved for deleted LDs. However, in some cases, firmware was assigning +LD ID 254 (0xFE) to deleted LDs and this was causing the driver to mark the +wrong disk as deleted. This in turn caused the wrong disk device to be +taken offline by the SCSI midlayer. + +To address this issue, limit the LD ID range from 255 to 240. This ensures +the deleted LD ID is properly identified and removed by the driver without +accidently deleting any valid LDs. + +Fixes: ae6874ba4b43 ("scsi: megaraid_sas: Early detection of VD deletion through RaidMap update") +Reported-by: Martin K. Petersen +Signed-off-by: Chandrakanth Patil +Signed-off-by: Sumit Saxena +Link: https://lore.kernel.org/r/20230302105342.34933-2-chandrakanth.patil@broadcom.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/megaraid/megaraid_sas.h | 2 ++ + drivers/scsi/megaraid/megaraid_sas_fp.c | 2 +- + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h +index aa62cc8ffd0af..ce0c36fa26bf7 100644 +--- a/drivers/scsi/megaraid/megaraid_sas.h ++++ b/drivers/scsi/megaraid/megaraid_sas.h +@@ -1515,6 +1515,8 @@ struct megasas_ctrl_info { + #define MEGASAS_MAX_LD_IDS (MEGASAS_MAX_LD_CHANNELS * \ + MEGASAS_MAX_DEV_PER_CHANNEL) + ++#define MEGASAS_MAX_SUPPORTED_LD_IDS 240 ++ + #define MEGASAS_MAX_SECTORS (2*1024) + #define MEGASAS_MAX_SECTORS_IEEE (2*128) + #define MEGASAS_DBG_LVL 1 +diff --git a/drivers/scsi/megaraid/megaraid_sas_fp.c b/drivers/scsi/megaraid/megaraid_sas_fp.c +index 8bfb46dbbed3a..ff20f47090810 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fp.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fp.c +@@ -359,7 +359,7 @@ u8 MR_ValidateMapInfo(struct megasas_instance *instance, u64 map_id) + ld = MR_TargetIdToLdGet(i, drv_map); + + /* For non existing VDs, iterate to next VD*/ +- if (ld >= (MAX_LOGICAL_DRIVES_EXT - 1)) ++ if (ld >= MEGASAS_MAX_SUPPORTED_LD_IDS) + continue; + + raid = MR_LdRaidGet(ld, drv_map); +-- +2.39.2 + diff --git a/queue-5.4/selftests-nft_nat-ensuring-the-listening-side-is-up-.patch b/queue-5.4/selftests-nft_nat-ensuring-the-listening-side-is-up-.patch new file mode 100644 index 00000000000..acbe5cd5a8e --- /dev/null +++ b/queue-5.4/selftests-nft_nat-ensuring-the-listening-side-is-up-.patch @@ -0,0 +1,58 @@ +From 128c9acd2c3ed9356a117e15ccbb3d92a677d481 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 17:36:46 +0800 +Subject: selftests: nft_nat: ensuring the listening side is up before starting + the client + +From: Hangbin Liu + +[ Upstream commit 2067e7a00aa604b94de31d64f29b8893b1696f26 ] + +The test_local_dnat_portonly() function initiates the client-side as +soon as it sets the listening side to the background. This could lead to +a race condition where the server may not be ready to listen. To ensure +that the server-side is up and running before initiating the +client-side, a delay is introduced to the test_local_dnat_portonly() +function. + +Before the fix: + # ./nft_nat.sh + PASS: netns routing/connectivity: ns0-rthlYrBU can reach ns1-rthlYrBU and ns2-rthlYrBU + PASS: ping to ns1-rthlYrBU was ip NATted to ns2-rthlYrBU + PASS: ping to ns1-rthlYrBU OK after ip nat output chain flush + PASS: ipv6 ping to ns1-rthlYrBU was ip6 NATted to ns2-rthlYrBU + 2023/02/27 04:11:03 socat[6055] E connect(5, AF=2 10.0.1.99:2000, 16): Connection refused + ERROR: inet port rewrite + +After the fix: + # ./nft_nat.sh + PASS: netns routing/connectivity: ns0-9sPJV6JJ can reach ns1-9sPJV6JJ and ns2-9sPJV6JJ + PASS: ping to ns1-9sPJV6JJ was ip NATted to ns2-9sPJV6JJ + PASS: ping to ns1-9sPJV6JJ OK after ip nat output chain flush + PASS: ipv6 ping to ns1-9sPJV6JJ was ip6 NATted to ns2-9sPJV6JJ + PASS: inet port rewrite without l3 address + +Fixes: 282e5f8fe907 ("netfilter: nat: really support inet nat without l3 address") +Signed-off-by: Hangbin Liu +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/netfilter/nft_nat.sh | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/testing/selftests/netfilter/nft_nat.sh b/tools/testing/selftests/netfilter/nft_nat.sh +index 4e15e81673104..67697d8ea59a5 100755 +--- a/tools/testing/selftests/netfilter/nft_nat.sh ++++ b/tools/testing/selftests/netfilter/nft_nat.sh +@@ -404,6 +404,8 @@ EOF + echo SERVER-$family | ip netns exec "$ns1" timeout 5 socat -u STDIN TCP-LISTEN:2000 & + sc_s=$! + ++ sleep 1 ++ + result=$(ip netns exec "$ns0" timeout 1 socat TCP:$daddr:2000 STDOUT) + + if [ "$result" = "SERVER-inet" ];then +-- +2.39.2 + diff --git a/queue-5.4/series b/queue-5.4/series index 8e1a541f9fe..53aa07766f8 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -7,3 +7,53 @@ ext4-move-where-set-the-may_inline_data-flag-is-set.patch ext4-fix-warning-in-ext4_update_inline_data.patch ext4-zero-i_disksize-when-initializing-the-bootloader-inode.patch nfc-change-order-inside-nfc_se_io-error-path.patch +drm-edid-extract-drm_mode_cea_vic.patch +drm-edid-fix-hdmi-vic-handling.patch +drm-edid-add-aspect-ratios-to-hdmi-4k-modes.patch +drm-edid-fix-avi-infoframe-aspect-ratio-handling.patch +iommu-amd-add-pci-segment-support-for-ivrs_-ioapic-h.patch +iommu-amd-fix-ill-formed-ivrs_ioapic-ivrs_hpet-and-i.patch +iommu-amd-add-a-length-limitation-for-the-ivrs_acpih.patch +ipmi-ssif-make-ssif_i2c_send-void.patch +ipmi-ssif-resend_msg-cannot-fail.patch +ipmi-ssif-remove-rtc_us_timer.patch +ipmi-ssif-increase-the-message-retry-time.patch +ipmi-ssif-add-a-timer-between-request-retries.patch +irqdomain-change-the-type-of-size-in-__irq_domain_ad.patch +irqdomain-fix-domain-registration-race.patch +software-node-introduce-device_add_software_node.patch +usb-dwc3-pci-register-a-software-node-for-the-dwc3-p.patch +usb-dwc3-pci-id-for-tiger-lake-cpu.patch +usb-dwc3-pci-add-support-for-the-intel-raptor-lake-s.patch +usb-dwc3-pci-add-support-for-the-intel-meteor-lake-p.patch +usb-dwc3-pci-add-support-for-the-intel-meteor-lake-m.patch +riscv-using-patchable_function_entry-instead-of-mcou.patch +riscv-ftrace-remove-wasted-nops-for-riscv_isa_c.patch +iommu-vt-d-fix-pasid-directory-pointer-coherency.patch +arm-dts-exynos-override-thermal-by-label-in-exynos42.patch +arm-dts-exynos-correct-tmu-phandle-in-exynos4210.patch +arm-dts-exynos-override-thermal-by-label-in-exynos52.patch +arm-dts-exynos-correct-tmu-phandle-in-exynos5250.patch +arm-dts-exynos-add-gpu-thermal-zone-cooling-maps-for.patch +arm-dts-exynos-correct-tmu-phandle-in-odroid-hc1.patch +arm-dts-exynos-correct-tmu-phandle-in-odroid-xu3-fam.patch +smb3-backup-intent-flag-missing-from-some-more-ops.patch +cifs-fix-uninitialized-memory-read-in-smb3_qfs_tcon.patch +riscv-abstract-out-csr-names-for-supervisor-vs-machi.patch +risc-v-avoid-dereferening-null-regs-in-die.patch +riscv-avoid-enabling-interrupts-in-die.patch +scsi-core-remove-the-proc-scsi-proc_name-directory-e.patch +ext4-fix-possible-corruption-when-moving-a-directory.patch +drm-msm-a5xx-fix-setting-of-the-cp_preempt_enable_lo.patch +nfc-fdp-add-null-check-of-devm_kmalloc_array-in-fdp_.patch +ila-do-not-generate-empty-messages-in-ila_xlat_nl_cm.patch +selftests-nft_nat-ensuring-the-listening-side-is-up-.patch +net-usb-lan78xx-remove-lots-of-set-but-unused-ret-va.patch +net-lan78xx-fix-accessing-the-lan7800-s-internal-phy.patch +net-caif-fix-use-after-free-in-cfusbl_device_notify.patch +bnxt_en-avoid-order-5-memory-allocation-for-tpa-data.patch +netfilter-tproxy-fix-deadlock-due-to-missing-bh-disa.patch +btf-fix-resolving-btf_kind_var-after-array-struct-un.patch +scsi-megaraid_sas-update-max-supported-ld-ids-to-240.patch +net-smc-fix-fallback-failed-while-sendmsg-with-fasto.patch +riscv-use-read_once_nocheck-in-imprecise-unwinding-s.patch diff --git a/queue-5.4/smb3-backup-intent-flag-missing-from-some-more-ops.patch b/queue-5.4/smb3-backup-intent-flag-missing-from-some-more-ops.patch new file mode 100644 index 00000000000..9e374389aa7 --- /dev/null +++ b/queue-5.4/smb3-backup-intent-flag-missing-from-some-more-ops.patch @@ -0,0 +1,731 @@ +From 03ac637f11a5b6f4029588387a5b284e8e5da448 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Feb 2020 21:46:43 +0200 +Subject: SMB3: Backup intent flag missing from some more ops + +From: Amir Goldstein + +[ Upstream commit 0f060936e490c6279dfe773d75d526d3d3d77111 ] + +When "backup intent" is requested on the mount (e.g. backupuid or +backupgid mount options), the corresponding flag was missing from +some of the operations. + +Change all operations to use the macro cifs_create_options() to +set the backup intent flag if needed. + +Signed-off-by: Amir Goldstein +Signed-off-by: Steve French +Stable-dep-of: d447e794a372 ("cifs: Fix uninitialized memory read in smb3_qfs_tcon()") +Signed-off-by: Sasha Levin +--- + fs/cifs/cifsacl.c | 14 +++----- + fs/cifs/cifsfs.c | 2 +- + fs/cifs/cifsglob.h | 6 ++-- + fs/cifs/cifsproto.h | 8 +++++ + fs/cifs/connect.c | 2 +- + fs/cifs/dir.c | 5 +-- + fs/cifs/file.c | 10 ++---- + fs/cifs/inode.c | 8 ++--- + fs/cifs/ioctl.c | 2 +- + fs/cifs/link.c | 18 +++------- + fs/cifs/smb1ops.c | 19 +++++------ + fs/cifs/smb2inode.c | 9 ++--- + fs/cifs/smb2ops.c | 81 +++++++++++++++------------------------------ + fs/cifs/smb2proto.h | 2 +- + 14 files changed, 68 insertions(+), 118 deletions(-) + +diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c +index 1f55072aa3023..1766d6d077f26 100644 +--- a/fs/cifs/cifsacl.c ++++ b/fs/cifs/cifsacl.c +@@ -1056,7 +1056,7 @@ static struct cifs_ntsd *get_cifs_acl_by_path(struct cifs_sb_info *cifs_sb, + struct cifs_ntsd *pntsd = NULL; + int oplock = 0; + unsigned int xid; +- int rc, create_options = 0; ++ int rc; + struct cifs_tcon *tcon; + struct tcon_link *tlink = cifs_sb_tlink(cifs_sb); + struct cifs_fid fid; +@@ -1068,13 +1068,10 @@ static struct cifs_ntsd *get_cifs_acl_by_path(struct cifs_sb_info *cifs_sb, + tcon = tlink_tcon(tlink); + xid = get_xid(); + +- if (backup_cred(cifs_sb)) +- create_options |= CREATE_OPEN_BACKUP_INTENT; +- + oparms.tcon = tcon; + oparms.cifs_sb = cifs_sb; + oparms.desired_access = READ_CONTROL; +- oparms.create_options = create_options; ++ oparms.create_options = cifs_create_options(cifs_sb, 0); + oparms.disposition = FILE_OPEN; + oparms.path = path; + oparms.fid = &fid; +@@ -1119,7 +1116,7 @@ int set_cifs_acl(struct cifs_ntsd *pnntsd, __u32 acllen, + { + int oplock = 0; + unsigned int xid; +- int rc, access_flags, create_options = 0; ++ int rc, access_flags; + struct cifs_tcon *tcon; + struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb); + struct tcon_link *tlink = cifs_sb_tlink(cifs_sb); +@@ -1132,9 +1129,6 @@ int set_cifs_acl(struct cifs_ntsd *pnntsd, __u32 acllen, + tcon = tlink_tcon(tlink); + xid = get_xid(); + +- if (backup_cred(cifs_sb)) +- create_options |= CREATE_OPEN_BACKUP_INTENT; +- + if (aclflag == CIFS_ACL_OWNER || aclflag == CIFS_ACL_GROUP) + access_flags = WRITE_OWNER; + else +@@ -1143,7 +1137,7 @@ int set_cifs_acl(struct cifs_ntsd *pnntsd, __u32 acllen, + oparms.tcon = tcon; + oparms.cifs_sb = cifs_sb; + oparms.desired_access = access_flags; +- oparms.create_options = create_options; ++ oparms.create_options = cifs_create_options(cifs_sb, 0); + oparms.disposition = FILE_OPEN; + oparms.path = path; + oparms.fid = &fid; +diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c +index aa7827da7b178..871a7b044c1b8 100644 +--- a/fs/cifs/cifsfs.c ++++ b/fs/cifs/cifsfs.c +@@ -275,7 +275,7 @@ cifs_statfs(struct dentry *dentry, struct kstatfs *buf) + buf->f_ffree = 0; /* unlimited */ + + if (server->ops->queryfs) +- rc = server->ops->queryfs(xid, tcon, buf); ++ rc = server->ops->queryfs(xid, tcon, cifs_sb, buf); + + free_xid(xid); + return rc; +diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h +index 7c0eb110e2630..253321adc2664 100644 +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -300,7 +300,8 @@ struct smb_version_operations { + const char *, struct dfs_info3_param **, + unsigned int *, const struct nls_table *, int); + /* informational QFS call */ +- void (*qfs_tcon)(const unsigned int, struct cifs_tcon *); ++ void (*qfs_tcon)(const unsigned int, struct cifs_tcon *, ++ struct cifs_sb_info *); + /* check if a path is accessible or not */ + int (*is_path_accessible)(const unsigned int, struct cifs_tcon *, + struct cifs_sb_info *, const char *); +@@ -408,7 +409,7 @@ struct smb_version_operations { + struct cifsInodeInfo *); + /* query remote filesystem */ + int (*queryfs)(const unsigned int, struct cifs_tcon *, +- struct kstatfs *); ++ struct cifs_sb_info *, struct kstatfs *); + /* send mandatory brlock to the server */ + int (*mand_lock)(const unsigned int, struct cifsFileInfo *, __u64, + __u64, __u32, int, int, bool); +@@ -489,6 +490,7 @@ struct smb_version_operations { + /* ioctl passthrough for query_info */ + int (*ioctl_query_info)(const unsigned int xid, + struct cifs_tcon *tcon, ++ struct cifs_sb_info *cifs_sb, + __le16 *path, int is_dir, + unsigned long p); + /* make unix special files (block, char, fifo, socket) */ +diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h +index 56a4740ae93ab..a5fab9afd699f 100644 +--- a/fs/cifs/cifsproto.h ++++ b/fs/cifs/cifsproto.h +@@ -600,4 +600,12 @@ static inline int get_dfs_path(const unsigned int xid, struct cifs_ses *ses, + } + #endif + ++static inline int cifs_create_options(struct cifs_sb_info *cifs_sb, int options) ++{ ++ if (backup_cred(cifs_sb)) ++ return options | CREATE_OPEN_BACKUP_INTENT; ++ else ++ return options; ++} ++ + #endif /* _CIFSPROTO_H */ +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 25a2a98ebda8d..6c8dd7c0b83a2 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -4319,7 +4319,7 @@ static int mount_get_conns(struct smb_vol *vol, struct cifs_sb_info *cifs_sb, + + /* do not care if a following call succeed - informational */ + if (!tcon->pipe && server->ops->qfs_tcon) { +- server->ops->qfs_tcon(*xid, tcon); ++ server->ops->qfs_tcon(*xid, tcon, cifs_sb); + if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_RO_CACHE) { + if (tcon->fsDevInfo.DeviceCharacteristics & + cpu_to_le32(FILE_READ_ONLY_DEVICE)) +diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c +index 9ae9a514676c3..548047a709bfc 100644 +--- a/fs/cifs/dir.c ++++ b/fs/cifs/dir.c +@@ -357,13 +357,10 @@ cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned int xid, + if (!tcon->unix_ext && (mode & S_IWUGO) == 0) + create_options |= CREATE_OPTION_READONLY; + +- if (backup_cred(cifs_sb)) +- create_options |= CREATE_OPEN_BACKUP_INTENT; +- + oparms.tcon = tcon; + oparms.cifs_sb = cifs_sb; + oparms.desired_access = desired_access; +- oparms.create_options = create_options; ++ oparms.create_options = cifs_create_options(cifs_sb, create_options); + oparms.disposition = disposition; + oparms.path = full_path; + oparms.fid = fid; +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index eb9b34442b1d3..86924831fd4ba 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -223,9 +223,6 @@ cifs_nt_open(char *full_path, struct inode *inode, struct cifs_sb_info *cifs_sb, + if (!buf) + return -ENOMEM; + +- if (backup_cred(cifs_sb)) +- create_options |= CREATE_OPEN_BACKUP_INTENT; +- + /* O_SYNC also has bit for O_DSYNC so following check picks up either */ + if (f_flags & O_SYNC) + create_options |= CREATE_WRITE_THROUGH; +@@ -236,7 +233,7 @@ cifs_nt_open(char *full_path, struct inode *inode, struct cifs_sb_info *cifs_sb, + oparms.tcon = tcon; + oparms.cifs_sb = cifs_sb; + oparms.desired_access = desired_access; +- oparms.create_options = create_options; ++ oparms.create_options = cifs_create_options(cifs_sb, create_options); + oparms.disposition = disposition; + oparms.path = full_path; + oparms.fid = fid; +@@ -751,9 +748,6 @@ cifs_reopen_file(struct cifsFileInfo *cfile, bool can_flush) + + desired_access = cifs_convert_flags(cfile->f_flags); + +- if (backup_cred(cifs_sb)) +- create_options |= CREATE_OPEN_BACKUP_INTENT; +- + /* O_SYNC also has bit for O_DSYNC so following check picks up either */ + if (cfile->f_flags & O_SYNC) + create_options |= CREATE_WRITE_THROUGH; +@@ -767,7 +761,7 @@ cifs_reopen_file(struct cifsFileInfo *cfile, bool can_flush) + oparms.tcon = tcon; + oparms.cifs_sb = cifs_sb; + oparms.desired_access = desired_access; +- oparms.create_options = create_options; ++ oparms.create_options = cifs_create_options(cifs_sb, create_options); + oparms.disposition = disposition; + oparms.path = full_path; + oparms.fid = &cfile->fid; +diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c +index fd9e289f3e72a..af0980c720c78 100644 +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -472,9 +472,7 @@ cifs_sfu_type(struct cifs_fattr *fattr, const char *path, + oparms.tcon = tcon; + oparms.cifs_sb = cifs_sb; + oparms.desired_access = GENERIC_READ; +- oparms.create_options = CREATE_NOT_DIR; +- if (backup_cred(cifs_sb)) +- oparms.create_options |= CREATE_OPEN_BACKUP_INTENT; ++ oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); + oparms.disposition = FILE_OPEN; + oparms.path = path; + oparms.fid = &fid; +@@ -1225,7 +1223,7 @@ cifs_rename_pending_delete(const char *full_path, struct dentry *dentry, + oparms.tcon = tcon; + oparms.cifs_sb = cifs_sb; + oparms.desired_access = DELETE | FILE_WRITE_ATTRIBUTES; +- oparms.create_options = CREATE_NOT_DIR; ++ oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); + oparms.disposition = FILE_OPEN; + oparms.path = full_path; + oparms.fid = &fid; +@@ -1763,7 +1761,7 @@ cifs_do_rename(const unsigned int xid, struct dentry *from_dentry, + oparms.cifs_sb = cifs_sb; + /* open the file to be renamed -- we need DELETE perms */ + oparms.desired_access = DELETE; +- oparms.create_options = CREATE_NOT_DIR; ++ oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); + oparms.disposition = FILE_OPEN; + oparms.path = from_path; + oparms.fid = &fid; +diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c +index 9266dddd4b1eb..bc08d856ee05f 100644 +--- a/fs/cifs/ioctl.c ++++ b/fs/cifs/ioctl.c +@@ -65,7 +65,7 @@ static long cifs_ioctl_query_info(unsigned int xid, struct file *filep, + + if (tcon->ses->server->ops->ioctl_query_info) + rc = tcon->ses->server->ops->ioctl_query_info( +- xid, tcon, utf16_path, ++ xid, tcon, cifs_sb, utf16_path, + filep->private_data ? 0 : 1, p); + else + rc = -EOPNOTSUPP; +diff --git a/fs/cifs/link.c b/fs/cifs/link.c +index b4b15d611deda..02949a2f28608 100644 +--- a/fs/cifs/link.c ++++ b/fs/cifs/link.c +@@ -318,7 +318,7 @@ cifs_query_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, + oparms.tcon = tcon; + oparms.cifs_sb = cifs_sb; + oparms.desired_access = GENERIC_READ; +- oparms.create_options = CREATE_NOT_DIR; ++ oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); + oparms.disposition = FILE_OPEN; + oparms.path = path; + oparms.fid = &fid; +@@ -356,15 +356,11 @@ cifs_create_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, + struct cifs_fid fid; + struct cifs_open_parms oparms; + struct cifs_io_parms io_parms; +- int create_options = CREATE_NOT_DIR; +- +- if (backup_cred(cifs_sb)) +- create_options |= CREATE_OPEN_BACKUP_INTENT; + + oparms.tcon = tcon; + oparms.cifs_sb = cifs_sb; + oparms.desired_access = GENERIC_WRITE; +- oparms.create_options = create_options; ++ oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); + oparms.disposition = FILE_CREATE; + oparms.path = path; + oparms.fid = &fid; +@@ -405,9 +401,7 @@ smb3_query_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, + oparms.tcon = tcon; + oparms.cifs_sb = cifs_sb; + oparms.desired_access = GENERIC_READ; +- oparms.create_options = CREATE_NOT_DIR; +- if (backup_cred(cifs_sb)) +- oparms.create_options |= CREATE_OPEN_BACKUP_INTENT; ++ oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); + oparms.disposition = FILE_OPEN; + oparms.fid = &fid; + oparms.reconnect = false; +@@ -460,14 +454,10 @@ smb3_create_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, + struct cifs_fid fid; + struct cifs_open_parms oparms; + struct cifs_io_parms io_parms; +- int create_options = CREATE_NOT_DIR; + __le16 *utf16_path; + __u8 oplock = SMB2_OPLOCK_LEVEL_NONE; + struct kvec iov[2]; + +- if (backup_cred(cifs_sb)) +- create_options |= CREATE_OPEN_BACKUP_INTENT; +- + cifs_dbg(FYI, "%s: path: %s\n", __func__, path); + + utf16_path = cifs_convert_path_to_utf16(path, cifs_sb); +@@ -477,7 +467,7 @@ smb3_create_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, + oparms.tcon = tcon; + oparms.cifs_sb = cifs_sb; + oparms.desired_access = GENERIC_WRITE; +- oparms.create_options = create_options; ++ oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); + oparms.disposition = FILE_CREATE; + oparms.fid = &fid; + oparms.reconnect = false; +diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c +index e523c05a44876..b130efaf8feb2 100644 +--- a/fs/cifs/smb1ops.c ++++ b/fs/cifs/smb1ops.c +@@ -504,7 +504,8 @@ cifs_negotiate_rsize(struct cifs_tcon *tcon, struct smb_vol *volume_info) + } + + static void +-cifs_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon) ++cifs_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon, ++ struct cifs_sb_info *cifs_sb) + { + CIFSSMBQFSDeviceInfo(xid, tcon); + CIFSSMBQFSAttributeInfo(xid, tcon); +@@ -565,7 +566,7 @@ cifs_query_path_info(const unsigned int xid, struct cifs_tcon *tcon, + oparms.tcon = tcon; + oparms.cifs_sb = cifs_sb; + oparms.desired_access = FILE_READ_ATTRIBUTES; +- oparms.create_options = 0; ++ oparms.create_options = cifs_create_options(cifs_sb, 0); + oparms.disposition = FILE_OPEN; + oparms.path = full_path; + oparms.fid = &fid; +@@ -793,7 +794,7 @@ smb_set_file_info(struct inode *inode, const char *full_path, + oparms.tcon = tcon; + oparms.cifs_sb = cifs_sb; + oparms.desired_access = SYNCHRONIZE | FILE_WRITE_ATTRIBUTES; +- oparms.create_options = CREATE_NOT_DIR; ++ oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); + oparms.disposition = FILE_OPEN; + oparms.path = full_path; + oparms.fid = &fid; +@@ -872,7 +873,7 @@ cifs_oplock_response(struct cifs_tcon *tcon, struct cifs_fid *fid, + + static int + cifs_queryfs(const unsigned int xid, struct cifs_tcon *tcon, +- struct kstatfs *buf) ++ struct cifs_sb_info *cifs_sb, struct kstatfs *buf) + { + int rc = -EOPNOTSUPP; + +@@ -970,7 +971,8 @@ cifs_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, + oparms.tcon = tcon; + oparms.cifs_sb = cifs_sb; + oparms.desired_access = FILE_READ_ATTRIBUTES; +- oparms.create_options = OPEN_REPARSE_POINT; ++ oparms.create_options = cifs_create_options(cifs_sb, ++ OPEN_REPARSE_POINT); + oparms.disposition = FILE_OPEN; + oparms.path = full_path; + oparms.fid = &fid; +@@ -1029,7 +1031,6 @@ cifs_make_node(unsigned int xid, struct inode *inode, + struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb); + struct inode *newinode = NULL; + int rc = -EPERM; +- int create_options = CREATE_NOT_DIR | CREATE_OPTION_SPECIAL; + FILE_ALL_INFO *buf = NULL; + struct cifs_io_parms io_parms; + __u32 oplock = 0; +@@ -1090,13 +1091,11 @@ cifs_make_node(unsigned int xid, struct inode *inode, + goto out; + } + +- if (backup_cred(cifs_sb)) +- create_options |= CREATE_OPEN_BACKUP_INTENT; +- + oparms.tcon = tcon; + oparms.cifs_sb = cifs_sb; + oparms.desired_access = GENERIC_WRITE; +- oparms.create_options = create_options; ++ oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR | ++ CREATE_OPTION_SPECIAL); + oparms.disposition = FILE_CREATE; + oparms.path = full_path; + oparms.fid = &fid; +diff --git a/fs/cifs/smb2inode.c b/fs/cifs/smb2inode.c +index f2a6f7f28340d..c9abda93d65b4 100644 +--- a/fs/cifs/smb2inode.c ++++ b/fs/cifs/smb2inode.c +@@ -98,9 +98,7 @@ smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, + oparms.tcon = tcon; + oparms.desired_access = desired_access; + oparms.disposition = create_disposition; +- oparms.create_options = create_options; +- if (backup_cred(cifs_sb)) +- oparms.create_options |= CREATE_OPEN_BACKUP_INTENT; ++ oparms.create_options = cifs_create_options(cifs_sb, create_options); + oparms.fid = &fid; + oparms.reconnect = false; + oparms.mode = mode; +@@ -456,7 +454,7 @@ smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon, + + /* If it is a root and its handle is cached then use it */ + if (!strlen(full_path) && !no_cached_open) { +- rc = open_shroot(xid, tcon, &fid); ++ rc = open_shroot(xid, tcon, cifs_sb, &fid); + if (rc) + goto out; + +@@ -473,9 +471,6 @@ smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon, + goto out; + } + +- if (backup_cred(cifs_sb)) +- create_options |= CREATE_OPEN_BACKUP_INTENT; +- + cifs_get_readable_path(tcon, full_path, &cfile); + rc = smb2_compound_op(xid, tcon, cifs_sb, full_path, + FILE_READ_ATTRIBUTES, FILE_OPEN, create_options, +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 944c575a4a705..a3bb2c7468c75 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -644,7 +644,8 @@ smb2_cached_lease_break(struct work_struct *work) + /* + * Open the directory at the root of a share + */ +-int open_shroot(unsigned int xid, struct cifs_tcon *tcon, struct cifs_fid *pfid) ++int open_shroot(unsigned int xid, struct cifs_tcon *tcon, ++ struct cifs_sb_info *cifs_sb, struct cifs_fid *pfid) + { + struct cifs_ses *ses = tcon->ses; + struct TCP_Server_Info *server = ses->server; +@@ -696,7 +697,7 @@ int open_shroot(unsigned int xid, struct cifs_tcon *tcon, struct cifs_fid *pfid) + rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE; + + oparms.tcon = tcon; +- oparms.create_options = 0; ++ oparms.create_options = cifs_create_options(cifs_sb, 0); + oparms.desired_access = FILE_READ_ATTRIBUTES; + oparms.disposition = FILE_OPEN; + oparms.fid = pfid; +@@ -812,7 +813,8 @@ int open_shroot(unsigned int xid, struct cifs_tcon *tcon, struct cifs_fid *pfid) + } + + static void +-smb3_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon) ++smb3_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon, ++ struct cifs_sb_info *cifs_sb) + { + int rc; + __le16 srch_path = 0; /* Null - open root of share */ +@@ -824,7 +826,7 @@ smb3_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon) + oparms.tcon = tcon; + oparms.desired_access = FILE_READ_ATTRIBUTES; + oparms.disposition = FILE_OPEN; +- oparms.create_options = 0; ++ oparms.create_options = cifs_create_options(cifs_sb, 0); + oparms.fid = &fid; + oparms.reconnect = false; + +@@ -832,7 +834,7 @@ smb3_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon) + rc = SMB2_open(xid, &oparms, &srch_path, &oplock, NULL, NULL, + NULL); + else +- rc = open_shroot(xid, tcon, &fid); ++ rc = open_shroot(xid, tcon, cifs_sb, &fid); + + if (rc) + return; +@@ -854,7 +856,8 @@ smb3_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon) + } + + static void +-smb2_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon) ++smb2_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon, ++ struct cifs_sb_info *cifs_sb) + { + int rc; + __le16 srch_path = 0; /* Null - open root of share */ +@@ -865,7 +868,7 @@ smb2_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon) + oparms.tcon = tcon; + oparms.desired_access = FILE_READ_ATTRIBUTES; + oparms.disposition = FILE_OPEN; +- oparms.create_options = 0; ++ oparms.create_options = cifs_create_options(cifs_sb, 0); + oparms.fid = &fid; + oparms.reconnect = false; + +@@ -900,10 +903,7 @@ smb2_is_path_accessible(const unsigned int xid, struct cifs_tcon *tcon, + oparms.tcon = tcon; + oparms.desired_access = FILE_READ_ATTRIBUTES; + oparms.disposition = FILE_OPEN; +- if (backup_cred(cifs_sb)) +- oparms.create_options = CREATE_OPEN_BACKUP_INTENT; +- else +- oparms.create_options = 0; ++ oparms.create_options = cifs_create_options(cifs_sb, 0); + oparms.fid = &fid; + oparms.reconnect = false; + +@@ -1179,10 +1179,7 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, + oparms.tcon = tcon; + oparms.desired_access = FILE_WRITE_EA; + oparms.disposition = FILE_OPEN; +- if (backup_cred(cifs_sb)) +- oparms.create_options = CREATE_OPEN_BACKUP_INTENT; +- else +- oparms.create_options = 0; ++ oparms.create_options = cifs_create_options(cifs_sb, 0); + oparms.fid = &fid; + oparms.reconnect = false; + +@@ -1414,6 +1411,7 @@ SMB2_request_res_key(const unsigned int xid, struct cifs_tcon *tcon, + static int + smb2_ioctl_query_info(const unsigned int xid, + struct cifs_tcon *tcon, ++ struct cifs_sb_info *cifs_sb, + __le16 *path, int is_dir, + unsigned long p) + { +@@ -1439,6 +1437,7 @@ smb2_ioctl_query_info(const unsigned int xid, + struct kvec close_iov[1]; + unsigned int size[2]; + void *data[2]; ++ int create_options = is_dir ? CREATE_NOT_FILE : CREATE_NOT_DIR; + + memset(rqst, 0, sizeof(rqst)); + resp_buftype[0] = resp_buftype[1] = resp_buftype[2] = CIFS_NO_BUFFER; +@@ -1474,10 +1473,7 @@ smb2_ioctl_query_info(const unsigned int xid, + memset(&oparms, 0, sizeof(oparms)); + oparms.tcon = tcon; + oparms.disposition = FILE_OPEN; +- if (is_dir) +- oparms.create_options = CREATE_NOT_FILE; +- else +- oparms.create_options = CREATE_NOT_DIR; ++ oparms.create_options = cifs_create_options(cifs_sb, create_options); + oparms.fid = &fid; + oparms.reconnect = false; + +@@ -2074,10 +2070,7 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon, + oparms.tcon = tcon; + oparms.desired_access = FILE_READ_ATTRIBUTES | FILE_READ_DATA; + oparms.disposition = FILE_OPEN; +- if (backup_cred(cifs_sb)) +- oparms.create_options = CREATE_OPEN_BACKUP_INTENT; +- else +- oparms.create_options = 0; ++ oparms.create_options = cifs_create_options(cifs_sb, 0); + oparms.fid = fid; + oparms.reconnect = false; + +@@ -2278,10 +2271,7 @@ smb2_query_info_compound(const unsigned int xid, struct cifs_tcon *tcon, + oparms.tcon = tcon; + oparms.desired_access = desired_access; + oparms.disposition = FILE_OPEN; +- if (cifs_sb && backup_cred(cifs_sb)) +- oparms.create_options = CREATE_OPEN_BACKUP_INTENT; +- else +- oparms.create_options = 0; ++ oparms.create_options = cifs_create_options(cifs_sb, 0); + oparms.fid = &fid; + oparms.reconnect = false; + +@@ -2337,7 +2327,7 @@ smb2_query_info_compound(const unsigned int xid, struct cifs_tcon *tcon, + + static int + smb2_queryfs(const unsigned int xid, struct cifs_tcon *tcon, +- struct kstatfs *buf) ++ struct cifs_sb_info *cifs_sb, struct kstatfs *buf) + { + struct smb2_query_info_rsp *rsp; + struct smb2_fs_full_size_info *info = NULL; +@@ -2374,7 +2364,7 @@ smb2_queryfs(const unsigned int xid, struct cifs_tcon *tcon, + + static int + smb311_queryfs(const unsigned int xid, struct cifs_tcon *tcon, +- struct kstatfs *buf) ++ struct cifs_sb_info *cifs_sb, struct kstatfs *buf) + { + int rc; + __le16 srch_path = 0; /* Null - open root of share */ +@@ -2383,12 +2373,12 @@ smb311_queryfs(const unsigned int xid, struct cifs_tcon *tcon, + struct cifs_fid fid; + + if (!tcon->posix_extensions) +- return smb2_queryfs(xid, tcon, buf); ++ return smb2_queryfs(xid, tcon, cifs_sb, buf); + + oparms.tcon = tcon; + oparms.desired_access = FILE_READ_ATTRIBUTES; + oparms.disposition = FILE_OPEN; +- oparms.create_options = 0; ++ oparms.create_options = cifs_create_options(cifs_sb, 0); + oparms.fid = &fid; + oparms.reconnect = false; + +@@ -2657,6 +2647,7 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, + struct smb2_create_rsp *create_rsp; + struct smb2_ioctl_rsp *ioctl_rsp; + struct reparse_data_buffer *reparse_buf; ++ int create_options = is_reparse_point ? OPEN_REPARSE_POINT : 0; + u32 plen; + + cifs_dbg(FYI, "%s: path: %s\n", __func__, full_path); +@@ -2683,14 +2674,7 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, + oparms.tcon = tcon; + oparms.desired_access = FILE_READ_ATTRIBUTES; + oparms.disposition = FILE_OPEN; +- +- if (backup_cred(cifs_sb)) +- oparms.create_options = CREATE_OPEN_BACKUP_INTENT; +- else +- oparms.create_options = 0; +- if (is_reparse_point) +- oparms.create_options = OPEN_REPARSE_POINT; +- ++ oparms.create_options = cifs_create_options(cifs_sb, create_options); + oparms.fid = &fid; + oparms.reconnect = false; + +@@ -2869,11 +2853,6 @@ get_smb2_acl_by_path(struct cifs_sb_info *cifs_sb, + tcon = tlink_tcon(tlink); + xid = get_xid(); + +- if (backup_cred(cifs_sb)) +- oparms.create_options = CREATE_OPEN_BACKUP_INTENT; +- else +- oparms.create_options = 0; +- + utf16_path = cifs_convert_path_to_utf16(path, cifs_sb); + if (!utf16_path) { + rc = -ENOMEM; +@@ -2884,6 +2863,7 @@ get_smb2_acl_by_path(struct cifs_sb_info *cifs_sb, + oparms.tcon = tcon; + oparms.desired_access = READ_CONTROL; + oparms.disposition = FILE_OPEN; ++ oparms.create_options = cifs_create_options(cifs_sb, 0); + oparms.fid = &fid; + oparms.reconnect = false; + +@@ -2925,11 +2905,6 @@ set_smb2_acl(struct cifs_ntsd *pnntsd, __u32 acllen, + tcon = tlink_tcon(tlink); + xid = get_xid(); + +- if (backup_cred(cifs_sb)) +- oparms.create_options = CREATE_OPEN_BACKUP_INTENT; +- else +- oparms.create_options = 0; +- + if (aclflag == CIFS_ACL_OWNER || aclflag == CIFS_ACL_GROUP) + access_flags = WRITE_OWNER; + else +@@ -2944,6 +2919,7 @@ set_smb2_acl(struct cifs_ntsd *pnntsd, __u32 acllen, + + oparms.tcon = tcon; + oparms.desired_access = access_flags; ++ oparms.create_options = cifs_create_options(cifs_sb, 0); + oparms.disposition = FILE_OPEN; + oparms.path = path; + oparms.fid = &fid; +@@ -4481,7 +4457,6 @@ smb2_make_node(unsigned int xid, struct inode *inode, + { + struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb); + int rc = -EPERM; +- int create_options = CREATE_NOT_DIR | CREATE_OPTION_SPECIAL; + FILE_ALL_INFO *buf = NULL; + struct cifs_io_parms io_parms; + __u32 oplock = 0; +@@ -4517,13 +4492,11 @@ smb2_make_node(unsigned int xid, struct inode *inode, + goto out; + } + +- if (backup_cred(cifs_sb)) +- create_options |= CREATE_OPEN_BACKUP_INTENT; +- + oparms.tcon = tcon; + oparms.cifs_sb = cifs_sb; + oparms.desired_access = GENERIC_WRITE; +- oparms.create_options = create_options; ++ oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR | ++ CREATE_OPTION_SPECIAL); + oparms.disposition = FILE_CREATE; + oparms.path = full_path; + oparms.fid = &fid; +diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h +index 57f7075a35871..4d4c0faa3d8a3 100644 +--- a/fs/cifs/smb2proto.h ++++ b/fs/cifs/smb2proto.h +@@ -67,7 +67,7 @@ extern int smb3_handle_read_data(struct TCP_Server_Info *server, + struct mid_q_entry *mid); + + extern int open_shroot(unsigned int xid, struct cifs_tcon *tcon, +- struct cifs_fid *pfid); ++ struct cifs_sb_info *cifs_sb, struct cifs_fid *pfid); + extern void close_shroot(struct cached_fid *cfid); + extern void move_smb2_info_to_cifs(FILE_ALL_INFO *dst, + struct smb2_file_all_info *src); +-- +2.39.2 + diff --git a/queue-5.4/software-node-introduce-device_add_software_node.patch b/queue-5.4/software-node-introduce-device_add_software_node.patch new file mode 100644 index 00000000000..fa2690e236e --- /dev/null +++ b/queue-5.4/software-node-introduce-device_add_software_node.patch @@ -0,0 +1,135 @@ +From 6c614a4240ce1d54d7630d8256d6f010f03dc925 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jan 2021 12:49:11 +0300 +Subject: software node: Introduce device_add_software_node() + +From: Heikki Krogerus + +[ Upstream commit e68d0119e3284334de5650a1ac42ef4e179f895e ] + +This helper will register a software node and then assign +it to device at the same time. The function will also make +sure that the device can't have more than one software node. + +Acked-by: Felipe Balbi +Signed-off-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20210115094914.88401-2-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 8e5248c3a877 ("usb: dwc3: pci: add support for the Intel Meteor Lake-M") +Signed-off-by: Sasha Levin +--- + drivers/base/swnode.c | 71 +++++++++++++++++++++++++++++++++++----- + include/linux/property.h | 3 ++ + 2 files changed, 65 insertions(+), 9 deletions(-) + +diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c +index 4c3b9813b2843..4f9c6898e86e8 100644 +--- a/drivers/base/swnode.c ++++ b/drivers/base/swnode.c +@@ -48,6 +48,19 @@ EXPORT_SYMBOL_GPL(is_software_node); + struct swnode, fwnode) : NULL; \ + }) + ++static inline struct swnode *dev_to_swnode(struct device *dev) ++{ ++ struct fwnode_handle *fwnode = dev_fwnode(dev); ++ ++ if (!fwnode) ++ return NULL; ++ ++ if (!is_software_node(fwnode)) ++ fwnode = fwnode->secondary; ++ ++ return to_swnode(fwnode); ++} ++ + static struct swnode * + software_node_to_swnode(const struct software_node *node) + { +@@ -862,22 +875,62 @@ void fwnode_remove_software_node(struct fwnode_handle *fwnode) + } + EXPORT_SYMBOL_GPL(fwnode_remove_software_node); + ++/** ++ * device_add_software_node - Assign software node to a device ++ * @dev: The device the software node is meant for. ++ * @swnode: The software node. ++ * ++ * This function will register @swnode and make it the secondary firmware node ++ * pointer of @dev. If @dev has no primary node, then @swnode will become the primary ++ * node. ++ */ ++int device_add_software_node(struct device *dev, const struct software_node *swnode) ++{ ++ int ret; ++ ++ /* Only one software node per device. */ ++ if (dev_to_swnode(dev)) ++ return -EBUSY; ++ ++ ret = software_node_register(swnode); ++ if (ret) ++ return ret; ++ ++ set_secondary_fwnode(dev, software_node_fwnode(swnode)); ++ ++ return 0; ++} ++EXPORT_SYMBOL_GPL(device_add_software_node); ++ ++/** ++ * device_remove_software_node - Remove device's software node ++ * @dev: The device with the software node. ++ * ++ * This function will unregister the software node of @dev. ++ */ ++void device_remove_software_node(struct device *dev) ++{ ++ struct swnode *swnode; ++ ++ swnode = dev_to_swnode(dev); ++ if (!swnode) ++ return; ++ ++ software_node_notify(dev, KOBJ_REMOVE); ++ set_secondary_fwnode(dev, NULL); ++ kobject_put(&swnode->kobj); ++} ++EXPORT_SYMBOL_GPL(device_remove_software_node); ++ + int software_node_notify(struct device *dev, unsigned long action) + { +- struct fwnode_handle *fwnode = dev_fwnode(dev); + struct swnode *swnode; + int ret; + +- if (!fwnode) +- return 0; +- +- if (!is_software_node(fwnode)) +- fwnode = fwnode->secondary; +- if (!is_software_node(fwnode)) ++ swnode = dev_to_swnode(dev); ++ if (!swnode) + return 0; + +- swnode = to_swnode(fwnode); +- + switch (action) { + case KOBJ_ADD: + ret = sysfs_create_link(&dev->kobj, &swnode->kobj, +diff --git a/include/linux/property.h b/include/linux/property.h +index 9b3d4ca3a73a9..99fdafa20cd1d 100644 +--- a/include/linux/property.h ++++ b/include/linux/property.h +@@ -437,4 +437,7 @@ fwnode_create_software_node(const struct property_entry *properties, + const struct fwnode_handle *parent); + void fwnode_remove_software_node(struct fwnode_handle *fwnode); + ++int device_add_software_node(struct device *dev, const struct software_node *swnode); ++void device_remove_software_node(struct device *dev); ++ + #endif /* _LINUX_PROPERTY_H_ */ +-- +2.39.2 + diff --git a/queue-5.4/usb-dwc3-pci-add-support-for-the-intel-meteor-lake-m.patch b/queue-5.4/usb-dwc3-pci-add-support-for-the-intel-meteor-lake-m.patch new file mode 100644 index 00000000000..49dcd6d043c --- /dev/null +++ b/queue-5.4/usb-dwc3-pci-add-support-for-the-intel-meteor-lake-m.patch @@ -0,0 +1,46 @@ +From c38ecec7686b355a0a47e3d7dd7572130eaa98ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Feb 2023 15:27:11 +0200 +Subject: usb: dwc3: pci: add support for the Intel Meteor Lake-M + +From: Heikki Krogerus + +[ Upstream commit 8e5248c3a8778f3e394e9a19195bc7a48f567ca2 ] + +This patch adds the necessary PCI IDs for Intel Meteor Lake-M +devices. + +Signed-off-by: Heikki Krogerus +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230215132711.35668-1-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-pci.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index 46d7c3904fe08..6eb39631a9e2e 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -42,6 +42,7 @@ + #define PCI_DEVICE_ID_INTEL_JSP 0x4dee + #define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1 + #define PCI_DEVICE_ID_INTEL_RPLS 0x7a61 ++#define PCI_DEVICE_ID_INTEL_MTLM 0x7eb1 + #define PCI_DEVICE_ID_INTEL_MTLP 0x7ec1 + #define PCI_DEVICE_ID_INTEL_MTL 0x7e7e + #define PCI_DEVICE_ID_INTEL_TGL 0x9a15 +@@ -392,6 +393,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = { + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_RPLS), + (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTLM), ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, ++ + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTLP), + (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + +-- +2.39.2 + diff --git a/queue-5.4/usb-dwc3-pci-add-support-for-the-intel-meteor-lake-p.patch b/queue-5.4/usb-dwc3-pci-add-support-for-the-intel-meteor-lake-p.patch new file mode 100644 index 00000000000..15e7de58469 --- /dev/null +++ b/queue-5.4/usb-dwc3-pci-add-support-for-the-intel-meteor-lake-p.patch @@ -0,0 +1,51 @@ +From cd015705af78189bf5efa666c6694f55f83efbb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Apr 2022 13:35:18 +0300 +Subject: usb: dwc3: pci: add support for the Intel Meteor Lake-P + +From: Heikki Krogerus + +[ Upstream commit 973e0f7a847ef13ade840d4c30729ce329a66895 ] + +This patch adds the necessary PCI IDs for Intel Meteor Lake-P +devices. + +Signed-off-by: Heikki Krogerus +Cc: stable +Link: https://lore.kernel.org/r/20220425103518.44028-1-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 8e5248c3a877 ("usb: dwc3: pci: add support for the Intel Meteor Lake-M") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-pci.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index 291f73fdd4be0..46d7c3904fe08 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -42,6 +42,8 @@ + #define PCI_DEVICE_ID_INTEL_JSP 0x4dee + #define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1 + #define PCI_DEVICE_ID_INTEL_RPLS 0x7a61 ++#define PCI_DEVICE_ID_INTEL_MTLP 0x7ec1 ++#define PCI_DEVICE_ID_INTEL_MTL 0x7e7e + #define PCI_DEVICE_ID_INTEL_TGL 0x9a15 + + #define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511" +@@ -390,6 +392,12 @@ static const struct pci_device_id dwc3_pci_id_table[] = { + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_RPLS), + (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTLP), ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, ++ ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTL), ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, ++ + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGL), + (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + +-- +2.39.2 + diff --git a/queue-5.4/usb-dwc3-pci-add-support-for-the-intel-raptor-lake-s.patch b/queue-5.4/usb-dwc3-pci-add-support-for-the-intel-raptor-lake-s.patch new file mode 100644 index 00000000000..f497c4b3a42 --- /dev/null +++ b/queue-5.4/usb-dwc3-pci-add-support-for-the-intel-raptor-lake-s.patch @@ -0,0 +1,46 @@ +From ca22d3b19801363a988d2a3d34e808d6bbab9baf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Feb 2022 17:19:48 +0300 +Subject: usb: dwc3: pci: add support for the Intel Raptor Lake-S + +From: Heikki Krogerus + +[ Upstream commit 038438a25c45d5ac996e95a22fa9e76ff3d1f8c7 ] + +This patch adds the necessary PCI ID for Intel Raptor Lake-S +devices. + +Signed-off-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20220214141948.18637-1-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 8e5248c3a877 ("usb: dwc3: pci: add support for the Intel Meteor Lake-M") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-pci.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index a1b135153137a..291f73fdd4be0 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -41,6 +41,7 @@ + #define PCI_DEVICE_ID_INTEL_TGPH 0x43ee + #define PCI_DEVICE_ID_INTEL_JSP 0x4dee + #define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1 ++#define PCI_DEVICE_ID_INTEL_RPLS 0x7a61 + #define PCI_DEVICE_ID_INTEL_TGL 0x9a15 + + #define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511" +@@ -386,6 +387,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = { + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ADLS), + (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_RPLS), ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, ++ + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGL), + (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + +-- +2.39.2 + diff --git a/queue-5.4/usb-dwc3-pci-id-for-tiger-lake-cpu.patch b/queue-5.4/usb-dwc3-pci-id-for-tiger-lake-cpu.patch new file mode 100644 index 00000000000..7c546099307 --- /dev/null +++ b/queue-5.4/usb-dwc3-pci-id-for-tiger-lake-cpu.patch @@ -0,0 +1,57 @@ +From 342b88e45896b874876d56581839f4ebb3ae1cfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jan 2021 12:49:13 +0300 +Subject: usb: dwc3: pci: ID for Tiger Lake CPU + +From: Heikki Krogerus + +[ Upstream commit 73203bde3a95a48f27b2454dc6b955280c641afe ] + +Tiger Lake SOC (the versions of it that have integrated USB4 +controller) may have two DWC3 controllers. One is part of +the PCH (Platform Controller Hub, i.e. the chipset) as +usual, and the other is inside the actual CPU block. + +On all Intel platforms that have the two separate DWC3 +controllers, the one inside the CPU handles USB3 and only +USB3 traffic, while the PCH version handles USB2 and USB2 +alone. The reason for splitting the two busses like this is +to allow easy USB3 tunneling over USB4 connections. As USB2 +is not tunneled over USB4, it has dedicated USB controllers +(both xHCI and DWC3). + +Acked-by: Felipe Balbi +Signed-off-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20210115094914.88401-4-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 8e5248c3a877 ("usb: dwc3: pci: add support for the Intel Meteor Lake-M") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-pci.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index a4439ea3cebaf..a1b135153137a 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -41,6 +41,7 @@ + #define PCI_DEVICE_ID_INTEL_TGPH 0x43ee + #define PCI_DEVICE_ID_INTEL_JSP 0x4dee + #define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1 ++#define PCI_DEVICE_ID_INTEL_TGL 0x9a15 + + #define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511" + #define PCI_INTEL_BXT_FUNC_PMU_PWR 4 +@@ -385,6 +386,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = { + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ADLS), + (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGL), ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, ++ + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_NL_USB), + (kernel_ulong_t) &dwc3_pci_amd_swnode, }, + { } /* Terminating Entry */ +-- +2.39.2 + diff --git a/queue-5.4/usb-dwc3-pci-register-a-software-node-for-the-dwc3-p.patch b/queue-5.4/usb-dwc3-pci-register-a-software-node-for-the-dwc3-p.patch new file mode 100644 index 00000000000..1820cc48dcf --- /dev/null +++ b/queue-5.4/usb-dwc3-pci-register-a-software-node-for-the-dwc3-p.patch @@ -0,0 +1,173 @@ +From 6b165f987752cbde325d799327a98f6b3c150ced Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jan 2021 12:49:12 +0300 +Subject: usb: dwc3: pci: Register a software node for the dwc3 platform device + +From: Heikki Krogerus + +[ Upstream commit e492ce9bcaa1c9661cd3dd6cff0eedf2fa640f31 ] + +By registering the software node directly instead of just +the properties in it, the driver can take advantage of also +the other features the software nodes have. + +Acked-by: Felipe Balbi +Signed-off-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20210115094914.88401-3-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 8e5248c3a877 ("usb: dwc3: pci: add support for the Intel Meteor Lake-M") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-pci.c | 61 ++++++++++++++++++++++--------------- + 1 file changed, 37 insertions(+), 24 deletions(-) + +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index 955bf820f4102..a4439ea3cebaf 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -143,6 +143,18 @@ static const struct property_entry dwc3_pci_amd_properties[] = { + {} + }; + ++static const struct software_node dwc3_pci_intel_swnode = { ++ .properties = dwc3_pci_intel_properties, ++}; ++ ++static const struct software_node dwc3_pci_intel_mrfld_swnode = { ++ .properties = dwc3_pci_mrfld_properties, ++}; ++ ++static const struct software_node dwc3_pci_amd_swnode = { ++ .properties = dwc3_pci_amd_properties, ++}; ++ + static int dwc3_pci_quirks(struct dwc3_pci *dwc) + { + struct pci_dev *pdev = dwc->pci; +@@ -223,7 +235,6 @@ static void dwc3_pci_resume_work(struct work_struct *work) + + static int dwc3_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) + { +- struct property_entry *p = (struct property_entry *)id->driver_data; + struct dwc3_pci *dwc; + struct resource res[2]; + int ret; +@@ -266,7 +277,7 @@ static int dwc3_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) + dwc->dwc3->dev.parent = dev; + ACPI_COMPANION_SET(&dwc->dwc3->dev, ACPI_COMPANION(dev)); + +- ret = platform_device_add_properties(dwc->dwc3, p); ++ ret = device_add_software_node(&dwc->dwc3->dev, (void *)id->driver_data); + if (ret < 0) + goto err; + +@@ -289,6 +300,7 @@ static int dwc3_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) + + return 0; + err: ++ device_remove_software_node(&dwc->dwc3->dev); + platform_device_put(dwc->dwc3); + return ret; + } +@@ -305,75 +317,76 @@ static void dwc3_pci_remove(struct pci_dev *pci) + #endif + device_init_wakeup(&pci->dev, false); + pm_runtime_get(&pci->dev); ++ device_remove_software_node(&dwc->dwc3->dev); + platform_device_unregister(dwc->dwc3); + } + + static const struct pci_device_id dwc3_pci_id_table[] = { + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BSW), +- (kernel_ulong_t) &dwc3_pci_intel_properties }, ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BYT), +- (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MRFLD), +- (kernel_ulong_t) &dwc3_pci_mrfld_properties, }, ++ (kernel_ulong_t) &dwc3_pci_intel_mrfld_swnode, }, + + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_CMLLP), +- (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_CMLH), +- (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_SPTLP), +- (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_SPTH), +- (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BXT), +- (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BXT_M), +- (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_APL), +- (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_KBP), +- (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_GLK), +- (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_CNPLP), +- (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_CNPH), +- (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_CNPV), +- (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ICLLP), +- (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_EHLLP), +- (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ (kernel_ulong_t) &dwc3_pci_intel_swnode }, + + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGPLP), +- (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGPH), +- (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_JSP), +- (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ADLS), +- (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_NL_USB), +- (kernel_ulong_t) &dwc3_pci_amd_properties, }, ++ (kernel_ulong_t) &dwc3_pci_amd_swnode, }, + { } /* Terminating Entry */ + }; + MODULE_DEVICE_TABLE(pci, dwc3_pci_id_table); +-- +2.39.2 +