From: Sasha Levin Date: Fri, 28 Feb 2025 04:41:22 +0000 (-0500) Subject: Fixes for 6.6 X-Git-Tag: v6.6.81~52 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7f037fc246a60428d072b0420576eb1da9385978;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.6 Signed-off-by: Sasha Levin --- diff --git a/queue-6.6/ib-core-add-support-for-xdr-link-speed.patch b/queue-6.6/ib-core-add-support-for-xdr-link-speed.patch new file mode 100644 index 0000000000..7a78240dc7 --- /dev/null +++ b/queue-6.6/ib-core-add-support-for-xdr-link-speed.patch @@ -0,0 +1,131 @@ +From 9a9d002710f11a1192ad20ed9dbef1b2337bf45e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Sep 2023 13:07:40 +0300 +Subject: IB/core: Add support for XDR link speed + +From: Or Har-Toov + +[ Upstream commit 703289ce43f740b0096724300107df82d008552f ] + +Add new IBTA speed XDR, the new rate that was added to Infiniband spec +as part of XDR and supporting signaling rate of 200Gb. + +In order to report that value to rdma-core, add new u32 field to +query_port response. + +Signed-off-by: Or Har-Toov +Reviewed-by: Mark Zhang +Link: https://lore.kernel.org/r/9d235fc600a999e8274010f0e18b40fa60540e6c.1695204156.git.leon@kernel.org +Reviewed-by: Jacob Keller +Signed-off-by: Leon Romanovsky +Stable-dep-of: c534ffda781f ("RDMA/mlx5: Fix AH static rate parsing") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/sysfs.c | 4 ++++ + drivers/infiniband/core/uverbs_std_types_device.c | 3 ++- + drivers/infiniband/core/verbs.c | 3 +++ + include/rdma/ib_verbs.h | 2 ++ + include/uapi/rdma/ib_user_ioctl_verbs.h | 3 ++- + 5 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c +index ec5efdc166601..9f97bef021497 100644 +--- a/drivers/infiniband/core/sysfs.c ++++ b/drivers/infiniband/core/sysfs.c +@@ -342,6 +342,10 @@ static ssize_t rate_show(struct ib_device *ibdev, u32 port_num, + speed = " NDR"; + rate = 1000; + break; ++ case IB_SPEED_XDR: ++ speed = " XDR"; ++ rate = 2000; ++ break; + case IB_SPEED_SDR: + default: /* default to SDR for invalid rates */ + speed = " SDR"; +diff --git a/drivers/infiniband/core/uverbs_std_types_device.c b/drivers/infiniband/core/uverbs_std_types_device.c +index 049684880ae03..fb0555647336f 100644 +--- a/drivers/infiniband/core/uverbs_std_types_device.c ++++ b/drivers/infiniband/core/uverbs_std_types_device.c +@@ -203,6 +203,7 @@ static int UVERBS_HANDLER(UVERBS_METHOD_QUERY_PORT)( + + copy_port_attr_to_resp(&attr, &resp.legacy_resp, ib_dev, port_num); + resp.port_cap_flags2 = attr.port_cap_flags2; ++ resp.active_speed_ex = attr.active_speed; + + return uverbs_copy_to_struct_or_zero(attrs, UVERBS_ATTR_QUERY_PORT_RESP, + &resp, sizeof(resp)); +@@ -461,7 +462,7 @@ DECLARE_UVERBS_NAMED_METHOD( + UVERBS_ATTR_PTR_OUT( + UVERBS_ATTR_QUERY_PORT_RESP, + UVERBS_ATTR_STRUCT(struct ib_uverbs_query_port_resp_ex, +- reserved), ++ active_speed_ex), + UA_MANDATORY)); + + DECLARE_UVERBS_NAMED_METHOD( +diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c +index 186ed3c22ec9e..ba05de0380e96 100644 +--- a/drivers/infiniband/core/verbs.c ++++ b/drivers/infiniband/core/verbs.c +@@ -147,6 +147,7 @@ __attribute_const__ int ib_rate_to_mult(enum ib_rate rate) + case IB_RATE_50_GBPS: return 20; + case IB_RATE_400_GBPS: return 160; + case IB_RATE_600_GBPS: return 240; ++ case IB_RATE_800_GBPS: return 320; + default: return -1; + } + } +@@ -176,6 +177,7 @@ __attribute_const__ enum ib_rate mult_to_ib_rate(int mult) + case 20: return IB_RATE_50_GBPS; + case 160: return IB_RATE_400_GBPS; + case 240: return IB_RATE_600_GBPS; ++ case 320: return IB_RATE_800_GBPS; + default: return IB_RATE_PORT_CURRENT; + } + } +@@ -205,6 +207,7 @@ __attribute_const__ int ib_rate_to_mbps(enum ib_rate rate) + case IB_RATE_50_GBPS: return 53125; + case IB_RATE_400_GBPS: return 425000; + case IB_RATE_600_GBPS: return 637500; ++ case IB_RATE_800_GBPS: return 850000; + default: return -1; + } + } +diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h +index 62f9d126a71ad..bc459d0616297 100644 +--- a/include/rdma/ib_verbs.h ++++ b/include/rdma/ib_verbs.h +@@ -561,6 +561,7 @@ enum ib_port_speed { + IB_SPEED_EDR = 32, + IB_SPEED_HDR = 64, + IB_SPEED_NDR = 128, ++ IB_SPEED_XDR = 256, + }; + + enum ib_stat_flag { +@@ -840,6 +841,7 @@ enum ib_rate { + IB_RATE_50_GBPS = 20, + IB_RATE_400_GBPS = 21, + IB_RATE_600_GBPS = 22, ++ IB_RATE_800_GBPS = 23, + }; + + /** +diff --git a/include/uapi/rdma/ib_user_ioctl_verbs.h b/include/uapi/rdma/ib_user_ioctl_verbs.h +index d7c5aaa327445..fe15bc7e9f707 100644 +--- a/include/uapi/rdma/ib_user_ioctl_verbs.h ++++ b/include/uapi/rdma/ib_user_ioctl_verbs.h +@@ -220,7 +220,8 @@ enum ib_uverbs_advise_mr_flag { + struct ib_uverbs_query_port_resp_ex { + struct ib_uverbs_query_port_resp legacy_resp; + __u16 port_cap_flags2; +- __u8 reserved[6]; ++ __u8 reserved[2]; ++ __u32 active_speed_ex; + }; + + struct ib_uverbs_qp_cap { +-- +2.39.5 + diff --git a/queue-6.6/ib-mlx5-set-and-get-correct-qp_num-for-a-dct-qp.patch b/queue-6.6/ib-mlx5-set-and-get-correct-qp_num-for-a-dct-qp.patch new file mode 100644 index 0000000000..c3f34aea58 --- /dev/null +++ b/queue-6.6/ib-mlx5-set-and-get-correct-qp_num-for-a-dct-qp.patch @@ -0,0 +1,50 @@ +From 63ea28b00d285bffd5735c1a75e470408ed6a1e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Jan 2025 14:39:46 +0200 +Subject: IB/mlx5: Set and get correct qp_num for a DCT QP + +From: Mark Zhang + +[ Upstream commit 12d044770e12c4205fa69535b4fa8a9981fea98f ] + +When a DCT QP is created on an active lag, it's dctc.port is assigned +in a round-robin way, which is from 1 to dev->lag_port. In this case +when querying this QP, we may get qp_attr.port_num > 2. +Fix this by setting qp->port when modifying a DCT QP, and read port_num +from qp->port instead of dctc.port when querying it. + +Fixes: 7c4b1ab9f167 ("IB/mlx5: Add DCT RoCE LAG support") +Signed-off-by: Mark Zhang +Reviewed-by: Maher Sanalla +Link: https://patch.msgid.link/94c76bf0adbea997f87ffa27674e0a7118ad92a9.1737290358.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/qp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c +index 71a856409cee2..3df863c88b31d 100644 +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -4555,6 +4555,8 @@ static int mlx5_ib_modify_dct(struct ib_qp *ibqp, struct ib_qp_attr *attr, + + set_id = mlx5_ib_get_counters_id(dev, attr->port_num - 1); + MLX5_SET(dctc, dctc, counter_set_id, set_id); ++ ++ qp->port = attr->port_num; + } else if (cur_state == IB_QPS_INIT && new_state == IB_QPS_RTR) { + struct mlx5_ib_modify_qp_resp resp = {}; + u32 out[MLX5_ST_SZ_DW(create_dct_out)] = {}; +@@ -5045,7 +5047,7 @@ static int mlx5_ib_dct_query_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *mqp, + } + + if (qp_attr_mask & IB_QP_PORT) +- qp_attr->port_num = MLX5_GET(dctc, dctc, port); ++ qp_attr->port_num = mqp->port; + if (qp_attr_mask & IB_QP_MIN_RNR_TIMER) + qp_attr->min_rnr_timer = MLX5_GET(dctc, dctc, min_rnr_nak); + if (qp_attr_mask & IB_QP_AV) { +-- +2.39.5 + diff --git a/queue-6.6/ovl-fix-uaf-in-ovl_dentry_update_reval-by-moving-dpu.patch b/queue-6.6/ovl-fix-uaf-in-ovl_dentry_update_reval-by-moving-dpu.patch new file mode 100644 index 0000000000..04074419e5 --- /dev/null +++ b/queue-6.6/ovl-fix-uaf-in-ovl_dentry_update_reval-by-moving-dpu.patch @@ -0,0 +1,71 @@ +From c1de40d5096cd8662ecbbcf1c88e4e750a0cb732 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Feb 2025 00:51:48 +0300 +Subject: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in + ovl_link_up + +From: Vasiliy Kovalev + +[ Upstream commit c84e125fff2615b4d9c259e762596134eddd2f27 ] + +The issue was caused by dput(upper) being called before +ovl_dentry_update_reval(), while upper->d_flags was still +accessed in ovl_dentry_remote(). + +Move dput(upper) after its last use to prevent use-after-free. + +BUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline] +BUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167 + +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 + print_address_description mm/kasan/report.c:377 [inline] + print_report+0xc3/0x620 mm/kasan/report.c:488 + kasan_report+0xd9/0x110 mm/kasan/report.c:601 + ovl_dentry_remote fs/overlayfs/util.c:162 [inline] + ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167 + ovl_link_up fs/overlayfs/copy_up.c:610 [inline] + ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170 + ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223 + ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136 + vfs_rename+0xf84/0x20a0 fs/namei.c:4893 +... + + +Fixes: b07d5cc93e1b ("ovl: update of dentry revalidate flags after copy up") +Reported-by: syzbot+316db8a1191938280eb6@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=316db8a1191938280eb6 +Signed-off-by: Vasiliy Kovalev +Link: https://lore.kernel.org/r/20250214215148.761147-1-kovalev@altlinux.org +Reviewed-by: Amir Goldstein +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/overlayfs/copy_up.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c +index 18e018cb18117..dbf7b3cd70ca5 100644 +--- a/fs/overlayfs/copy_up.c ++++ b/fs/overlayfs/copy_up.c +@@ -570,7 +570,6 @@ static int ovl_link_up(struct ovl_copy_up_ctx *c) + err = PTR_ERR(upper); + if (!IS_ERR(upper)) { + err = ovl_do_link(ofs, ovl_dentry_upper(c->dentry), udir, upper); +- dput(upper); + + if (!err) { + /* Restore timestamps on parent (best effort) */ +@@ -578,6 +577,7 @@ static int ovl_link_up(struct ovl_copy_up_ctx *c) + ovl_dentry_set_upper_alias(c->dentry); + ovl_dentry_update_reval(c->dentry, upper); + } ++ dput(upper); + } + inode_unlock(udir); + if (err) +-- +2.39.5 + diff --git a/queue-6.6/rdma-mana_ib-allocate-page-aligned-doorbell-index.patch b/queue-6.6/rdma-mana_ib-allocate-page-aligned-doorbell-index.patch new file mode 100644 index 0000000000..fe4aee96b5 --- /dev/null +++ b/queue-6.6/rdma-mana_ib-allocate-page-aligned-doorbell-index.patch @@ -0,0 +1,39 @@ +From ae031e3f5557cd9ad4493fdb764b1c89f7cd549f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Feb 2025 02:30:05 -0800 +Subject: RDMA/mana_ib: Allocate PAGE aligned doorbell index + +From: Konstantin Taranov + +[ Upstream commit 29b7bb98234cc287cebef9bccf638c2e3f39be71 ] + +Allocate a PAGE aligned doorbell index to ensure each process gets a +separate PAGE sized doorbell area space remapped to it in mana_ib_mmap + +Fixes: 0266a177631d ("RDMA/mana_ib: Add a driver for Microsoft Azure Network Adapter") +Signed-off-by: Shiraz Saleem +Signed-off-by: Konstantin Taranov +Link: https://patch.msgid.link/1738751405-15041-1-git-send-email-kotaranov@linux.microsoft.com +Reviewed-by: Long Li +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mana/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mana/main.c b/drivers/infiniband/hw/mana/main.c +index 85717482a616e..6fa9b12532997 100644 +--- a/drivers/infiniband/hw/mana/main.c ++++ b/drivers/infiniband/hw/mana/main.c +@@ -180,7 +180,7 @@ static int mana_gd_allocate_doorbell_page(struct gdma_context *gc, + + req.resource_type = GDMA_RESOURCE_DOORBELL_PAGE; + req.num_resources = 1; +- req.alignment = 1; ++ req.alignment = PAGE_SIZE / MANA_PAGE_SIZE; + + /* Have GDMA start searching from 0 */ + req.allocated_resources = 0; +-- +2.39.5 + diff --git a/queue-6.6/rdma-mlx5-fix-ah-static-rate-parsing.patch b/queue-6.6/rdma-mlx5-fix-ah-static-rate-parsing.patch new file mode 100644 index 0000000000..7c4b874b16 --- /dev/null +++ b/queue-6.6/rdma-mlx5-fix-ah-static-rate-parsing.patch @@ -0,0 +1,84 @@ +From ad9d32dba1ff5ad90643de3226d89631afb61153 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Feb 2025 13:32:39 +0200 +Subject: RDMA/mlx5: Fix AH static rate parsing + +From: Patrisious Haddad + +[ Upstream commit c534ffda781f44a1c6ac25ef6e0e444da38ca8af ] + +Previously static rate wasn't translated according to our PRM but simply +used the 4 lower bytes. + +Correctly translate static rate value passed in AH creation attribute +according to our PRM expected values. + +In addition change 800GB mapping to zero, which is the PRM +specified value. + +Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters") +Signed-off-by: Patrisious Haddad +Reviewed-by: Maor Gottlieb +Link: https://patch.msgid.link/18ef4cc5396caf80728341eb74738cd777596f60.1739187089.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/ah.c | 3 ++- + drivers/infiniband/hw/mlx5/qp.c | 6 +++--- + drivers/infiniband/hw/mlx5/qp.h | 1 + + 3 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/ah.c b/drivers/infiniband/hw/mlx5/ah.c +index 505bc47fd575d..99036afb3aef0 100644 +--- a/drivers/infiniband/hw/mlx5/ah.c ++++ b/drivers/infiniband/hw/mlx5/ah.c +@@ -67,7 +67,8 @@ static void create_ib_ah(struct mlx5_ib_dev *dev, struct mlx5_ib_ah *ah, + ah->av.tclass = grh->traffic_class; + } + +- ah->av.stat_rate_sl = (rdma_ah_get_static_rate(ah_attr) << 4); ++ ah->av.stat_rate_sl = ++ (mlx5r_ib_rate(dev, rdma_ah_get_static_rate(ah_attr)) << 4); + + if (ah_attr->type == RDMA_AH_ATTR_TYPE_ROCE) { + if (init_attr->xmit_slave) +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c +index 3df863c88b31d..0a9ae84600b20 100644 +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -3433,11 +3433,11 @@ static int ib_to_mlx5_rate_map(u8 rate) + return 0; + } + +-static int ib_rate_to_mlx5(struct mlx5_ib_dev *dev, u8 rate) ++int mlx5r_ib_rate(struct mlx5_ib_dev *dev, u8 rate) + { + u32 stat_rate_support; + +- if (rate == IB_RATE_PORT_CURRENT) ++ if (rate == IB_RATE_PORT_CURRENT || rate == IB_RATE_800_GBPS) + return 0; + + if (rate < IB_RATE_2_5_GBPS || rate > IB_RATE_600_GBPS) +@@ -3582,7 +3582,7 @@ static int mlx5_set_path(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp, + sizeof(grh->dgid.raw)); + } + +- err = ib_rate_to_mlx5(dev, rdma_ah_get_static_rate(ah)); ++ err = mlx5r_ib_rate(dev, rdma_ah_get_static_rate(ah)); + if (err < 0) + return err; + MLX5_SET(ads, path, stat_rate, err); +diff --git a/drivers/infiniband/hw/mlx5/qp.h b/drivers/infiniband/hw/mlx5/qp.h +index b6ee7c3ee1ca1..2530e7730635f 100644 +--- a/drivers/infiniband/hw/mlx5/qp.h ++++ b/drivers/infiniband/hw/mlx5/qp.h +@@ -56,4 +56,5 @@ int mlx5_core_xrcd_dealloc(struct mlx5_ib_dev *dev, u32 xrcdn); + int mlx5_ib_qp_set_counter(struct ib_qp *qp, struct rdma_counter *counter); + int mlx5_ib_qp_event_init(void); + void mlx5_ib_qp_event_cleanup(void); ++int mlx5r_ib_rate(struct mlx5_ib_dev *dev, u8 rate); + #endif /* _MLX5_IB_QP_H */ +-- +2.39.5 + diff --git a/queue-6.6/rdma-mlx5-fix-bind-qp-error-cleanup-flow.patch b/queue-6.6/rdma-mlx5-fix-bind-qp-error-cleanup-flow.patch new file mode 100644 index 0000000000..0450a844db --- /dev/null +++ b/queue-6.6/rdma-mlx5-fix-bind-qp-error-cleanup-flow.patch @@ -0,0 +1,63 @@ +From 3a23d071bffa15bbea51dcafd5a7bf285dd73f2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Feb 2025 08:47:10 +0200 +Subject: RDMA/mlx5: Fix bind QP error cleanup flow + +From: Patrisious Haddad + +[ Upstream commit e1a0bdbdfdf08428f0ede5ae49c7f4139ac73ef5 ] + +When there is a failure during bind QP, the cleanup flow destroys the +counter regardless if it is the one that created it or not, which is +problematic since if it isn't the one that created it, that counter could +still be in use. + +Fix that by destroying the counter only if it was created during this call. + +Fixes: 45842fc627c7 ("IB/mlx5: Support statistic q counter configuration") +Signed-off-by: Patrisious Haddad +Reviewed-by: Mark Zhang +Link: https://patch.msgid.link/25dfefddb0ebefa668c32e06a94d84e3216257cf.1740033937.git.leon@kernel.org +Reviewed-by: Zhu Yanjun +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/counters.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/counters.c b/drivers/infiniband/hw/mlx5/counters.c +index 8300ce6228350..b049bba215790 100644 +--- a/drivers/infiniband/hw/mlx5/counters.c ++++ b/drivers/infiniband/hw/mlx5/counters.c +@@ -542,6 +542,7 @@ static int mlx5_ib_counter_bind_qp(struct rdma_counter *counter, + struct ib_qp *qp) + { + struct mlx5_ib_dev *dev = to_mdev(qp->device); ++ bool new = false; + int err; + + if (!counter->id) { +@@ -556,6 +557,7 @@ static int mlx5_ib_counter_bind_qp(struct rdma_counter *counter, + return err; + counter->id = + MLX5_GET(alloc_q_counter_out, out, counter_set_id); ++ new = true; + } + + err = mlx5_ib_qp_set_counter(qp, counter); +@@ -565,8 +567,10 @@ static int mlx5_ib_counter_bind_qp(struct rdma_counter *counter, + return 0; + + fail_set_counter: +- mlx5_ib_counter_dealloc(counter); +- counter->id = 0; ++ if (new) { ++ mlx5_ib_counter_dealloc(counter); ++ counter->id = 0; ++ } + + return err; + } +-- +2.39.5 + diff --git a/queue-6.6/scsi-core-clear-driver-private-data-when-retrying-re.patch b/queue-6.6/scsi-core-clear-driver-private-data-when-retrying-re.patch new file mode 100644 index 0000000000..12ceb281cd --- /dev/null +++ b/queue-6.6/scsi-core-clear-driver-private-data-when-retrying-re.patch @@ -0,0 +1,68 @@ +From 86f0afa91bcd6b4efaa171fad6e2cbc78f383c1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Feb 2025 10:16:28 +0800 +Subject: scsi: core: Clear driver private data when retrying request + +From: Ye Bin + +[ Upstream commit dce5c4afd035e8090a26e5d776b1682c0e649683 ] + +After commit 1bad6c4a57ef ("scsi: zero per-cmd private driver data for each +MQ I/O"), the xen-scsifront/virtio_scsi/snic drivers all removed code that +explicitly zeroed driver-private command data. + +In combination with commit 464a00c9e0ad ("scsi: core: Kill DRIVER_SENSE"), +after virtio_scsi performs a capacity expansion, the first request will +return a unit attention to indicate that the capacity has changed. And then +the original command is retried. As driver-private command data was not +cleared, the request would return UA again and eventually time out and fail. + +Zero driver-private command data when a request is retried. + +Fixes: f7de50da1479 ("scsi: xen-scsifront: Remove code that zeroes driver-private command data") +Fixes: c2bb87318baa ("scsi: virtio_scsi: Remove code that zeroes driver-private command data") +Fixes: c3006a926468 ("scsi: snic: Remove code that zeroes driver-private command data") +Signed-off-by: Ye Bin +Reviewed-by: Bart Van Assche +Link: https://lore.kernel.org/r/20250217021628.2929248-1-yebin@huaweicloud.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_lib.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index f026377f1cf1c..e6dc2c556fde9 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -1570,13 +1570,6 @@ static blk_status_t scsi_prepare_cmd(struct request *req) + if (in_flight) + __set_bit(SCMD_STATE_INFLIGHT, &cmd->state); + +- /* +- * Only clear the driver-private command data if the LLD does not supply +- * a function to initialize that data. +- */ +- if (!shost->hostt->init_cmd_priv) +- memset(cmd + 1, 0, shost->hostt->cmd_size); +- + cmd->prot_op = SCSI_PROT_NORMAL; + if (blk_rq_bytes(req)) + cmd->sc_data_direction = rq_dma_dir(req); +@@ -1743,6 +1736,13 @@ static blk_status_t scsi_queue_rq(struct blk_mq_hw_ctx *hctx, + if (!scsi_host_queue_ready(q, shost, sdev, cmd)) + goto out_dec_target_busy; + ++ /* ++ * Only clear the driver-private command data if the LLD does not supply ++ * a function to initialize that data. ++ */ ++ if (shost->hostt->cmd_size && !shost->hostt->init_cmd_priv) ++ memset(cmd + 1, 0, shost->hostt->cmd_size); ++ + if (!(req->rq_flags & RQF_DONTPREP)) { + ret = scsi_prepare_cmd(req); + if (ret != BLK_STS_OK) +-- +2.39.5 + diff --git a/queue-6.6/scsi-ufs-core-add-ufs-rtc-support.patch b/queue-6.6/scsi-ufs-core-add-ufs-rtc-support.patch new file mode 100644 index 0000000000..9b466c4dec --- /dev/null +++ b/queue-6.6/scsi-ufs-core-add-ufs-rtc-support.patch @@ -0,0 +1,256 @@ +From aff15bd554846f183dff53af717bb983bb841afc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Dec 2023 23:08:24 +0100 +Subject: scsi: ufs: core: Add UFS RTC support +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bean Huo + +[ Upstream commit 6bf999e0eb41850d5c857102535d5c53b2ede224 ] + +Add Real Time Clock (RTC) support for UFS device. This enhancement is +crucial for the internal maintenance operations of the UFS device. The +patch enables the device to handle both absolute and relative time +information. Furthermore, it includes periodic task to update the RTC in +accordance with the UFS Spec, ensuring the accuracy of RTC information for +the device's internal processes. + +RTC and qTimestamp serve distinct purposes. The RTC provides a coarse level +of granularity with, at best, approximate single-second resolution. This +makes the RTC well-suited for the device to determine the approximate age +of programmed blocks after being updated by the host. On the other hand, +qTimestamp offers nanosecond granularity and is specifically designed for +synchronizing Device Error Log entries with corresponding host-side logs. + +Given that the RTC has been a standard feature since UFS Spec 2.0, and +qTimestamp was introduced in UFS Spec 4.0, the majority of UFS devices +currently on the market rely on RTC. Therefore, it is advisable to continue +supporting RTC in the Linux kernel. This ensures compatibility with the +prevailing UFS device implementations and facilitates seamless integration +with existing hardware. By maintaining support for RTC, we ensure broad +compatibility and avoid potential issues arising from deviations in device +specifications across different UFS versions. + +Signed-off-by: Bean Huo +Signed-off-by: Mike Bi +Signed-off-by: Luca Porzio +Link: https://lore.kernel.org/r/20231212220825.85255-3-beanhuo@iokpp.de +Acked-by: Avri Altman +Reviewed-by: Thomas Weißschuh +Signed-off-by: Martin K. Petersen +Stable-dep-of: 4fa382be4304 ("scsi: ufs: core: Fix ufshcd_is_ufs_dev_busy() and ufshcd_eh_timed_out()") +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 83 ++++++++++++++++++++++++++++++++++++++- + include/ufs/ufs.h | 13 ++++++ + include/ufs/ufshcd.h | 4 ++ + 3 files changed, 98 insertions(+), 2 deletions(-) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index fe1c56bc0a127..a9a7a84e6cbbc 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -98,6 +98,9 @@ + /* Polling time to wait for fDeviceInit */ + #define FDEVICEINIT_COMPL_TIMEOUT 1500 /* millisecs */ + ++/* Default RTC update every 10 seconds */ ++#define UFS_RTC_UPDATE_INTERVAL_MS (10 * MSEC_PER_SEC) ++ + /* UFSHC 4.0 compliant HC support this mode. */ + static bool use_mcq_mode = true; + +@@ -682,6 +685,8 @@ static void ufshcd_device_reset(struct ufs_hba *hba) + hba->dev_info.wb_enabled = false; + hba->dev_info.wb_buf_flush_enabled = false; + } ++ if (hba->dev_info.rtc_type == UFS_RTC_RELATIVE) ++ hba->dev_info.rtc_time_baseline = 0; + } + if (err != -EOPNOTSUPP) + ufshcd_update_evt_hist(hba, UFS_EVT_DEV_RESET, err); +@@ -8149,6 +8154,72 @@ static void ufs_fixup_device_setup(struct ufs_hba *hba) + ufshcd_vops_fixup_dev_quirks(hba); + } + ++static void ufshcd_update_rtc(struct ufs_hba *hba) ++{ ++ struct timespec64 ts64; ++ int err; ++ u32 val; ++ ++ ktime_get_real_ts64(&ts64); ++ ++ if (ts64.tv_sec < hba->dev_info.rtc_time_baseline) { ++ dev_warn_once(hba->dev, "%s: Current time precedes previous setting!\n", __func__); ++ return; ++ } ++ ++ /* ++ * The Absolute RTC mode has a 136-year limit, spanning from 2010 to 2146. If a time beyond ++ * 2146 is required, it is recommended to choose the relative RTC mode. ++ */ ++ val = ts64.tv_sec - hba->dev_info.rtc_time_baseline; ++ ++ ufshcd_rpm_get_sync(hba); ++ err = ufshcd_query_attr(hba, UPIU_QUERY_OPCODE_WRITE_ATTR, QUERY_ATTR_IDN_SECONDS_PASSED, ++ 0, 0, &val); ++ ufshcd_rpm_put_sync(hba); ++ ++ if (err) ++ dev_err(hba->dev, "%s: Failed to update rtc %d\n", __func__, err); ++ else if (hba->dev_info.rtc_type == UFS_RTC_RELATIVE) ++ hba->dev_info.rtc_time_baseline = ts64.tv_sec; ++} ++ ++static void ufshcd_rtc_work(struct work_struct *work) ++{ ++ struct ufs_hba *hba; ++ ++ hba = container_of(to_delayed_work(work), struct ufs_hba, ufs_rtc_update_work); ++ ++ /* Update RTC only when there are no requests in progress and UFSHCI is operational */ ++ if (!ufshcd_is_ufs_dev_busy(hba) && hba->ufshcd_state == UFSHCD_STATE_OPERATIONAL) ++ ufshcd_update_rtc(hba); ++ ++ if (ufshcd_is_ufs_dev_active(hba)) ++ schedule_delayed_work(&hba->ufs_rtc_update_work, ++ msecs_to_jiffies(UFS_RTC_UPDATE_INTERVAL_MS)); ++} ++ ++static void ufs_init_rtc(struct ufs_hba *hba, u8 *desc_buf) ++{ ++ u16 periodic_rtc_update = get_unaligned_be16(&desc_buf[DEVICE_DESC_PARAM_FRQ_RTC]); ++ struct ufs_dev_info *dev_info = &hba->dev_info; ++ ++ if (periodic_rtc_update & UFS_RTC_TIME_BASELINE) { ++ dev_info->rtc_type = UFS_RTC_ABSOLUTE; ++ ++ /* ++ * The concept of measuring time in Linux as the number of seconds elapsed since ++ * 00:00:00 UTC on January 1, 1970, and UFS ABS RTC is elapsed from January 1st ++ * 2010 00:00, here we need to adjust ABS baseline. ++ */ ++ dev_info->rtc_time_baseline = mktime64(2010, 1, 1, 0, 0, 0) - ++ mktime64(1970, 1, 1, 0, 0, 0); ++ } else { ++ dev_info->rtc_type = UFS_RTC_RELATIVE; ++ dev_info->rtc_time_baseline = 0; ++ } ++} ++ + static int ufs_get_device_desc(struct ufs_hba *hba) + { + int err; +@@ -8201,6 +8272,8 @@ static int ufs_get_device_desc(struct ufs_hba *hba) + + ufshcd_temp_notif_probe(hba, desc_buf); + ++ ufs_init_rtc(hba, desc_buf); ++ + if (hba->ext_iid_sup) + ufshcd_ext_iid_probe(hba, desc_buf); + +@@ -8753,6 +8826,8 @@ static int ufshcd_device_init(struct ufs_hba *hba, bool init_dev_params) + ufshcd_force_reset_auto_bkops(hba); + + ufshcd_set_timestamp_attr(hba); ++ schedule_delayed_work(&hba->ufs_rtc_update_work, ++ msecs_to_jiffies(UFS_RTC_UPDATE_INTERVAL_MS)); + + /* Gear up to HS gear if supported */ + if (hba->max_pwr_info.is_valid) { +@@ -9698,6 +9773,8 @@ static int __ufshcd_wl_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op) + ret = ufshcd_vops_suspend(hba, pm_op, POST_CHANGE); + if (ret) + goto set_link_active; ++ ++ cancel_delayed_work_sync(&hba->ufs_rtc_update_work); + goto out; + + set_link_active: +@@ -9792,6 +9869,8 @@ static int __ufshcd_wl_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op) + if (ret) + goto set_old_link_state; + ufshcd_set_timestamp_attr(hba); ++ schedule_delayed_work(&hba->ufs_rtc_update_work, ++ msecs_to_jiffies(UFS_RTC_UPDATE_INTERVAL_MS)); + } + + if (ufshcd_keep_autobkops_enabled_except_suspend(hba)) +@@ -10500,8 +10579,8 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) + UFS_SLEEP_PWR_MODE, + UIC_LINK_HIBERN8_STATE); + +- INIT_DELAYED_WORK(&hba->rpm_dev_flush_recheck_work, +- ufshcd_rpm_dev_flush_recheck_work); ++ INIT_DELAYED_WORK(&hba->rpm_dev_flush_recheck_work, ufshcd_rpm_dev_flush_recheck_work); ++ INIT_DELAYED_WORK(&hba->ufs_rtc_update_work, ufshcd_rtc_work); + + /* Set the default auto-hiberate idle timer value to 150 ms */ + if (ufshcd_is_auto_hibern8_supported(hba) && !hba->ahit) { +diff --git a/include/ufs/ufs.h b/include/ufs/ufs.h +index 49c90795a2a67..571a08ce91242 100644 +--- a/include/ufs/ufs.h ++++ b/include/ufs/ufs.h +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + + /* + * Using static_assert() is not allowed in UAPI header files. Hence the check +@@ -550,6 +551,14 @@ struct ufs_vreg_info { + struct ufs_vreg *vdd_hba; + }; + ++/* UFS device descriptor wPeriodicRTCUpdate bit9 defines RTC time baseline */ ++#define UFS_RTC_TIME_BASELINE BIT(9) ++ ++enum ufs_rtc_time { ++ UFS_RTC_RELATIVE, ++ UFS_RTC_ABSOLUTE ++}; ++ + struct ufs_dev_info { + bool f_power_on_wp_en; + /* Keeps information if any of the LU is power on write protected */ +@@ -577,6 +586,10 @@ struct ufs_dev_info { + + /* UFS EXT_IID Enable */ + bool b_ext_iid_en; ++ ++ /* UFS RTC */ ++ enum ufs_rtc_time rtc_type; ++ time64_t rtc_time_baseline; + }; + + /* +diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h +index 20d129914121d..d5aa832f8dba3 100644 +--- a/include/ufs/ufshcd.h ++++ b/include/ufs/ufshcd.h +@@ -908,6 +908,8 @@ enum ufshcd_mcq_opr { + * @mcq_base: Multi circular queue registers base address + * @uhq: array of supported hardware queues + * @dev_cmd_queue: Queue for issuing device management commands ++ * @mcq_opr: MCQ operation and runtime registers ++ * @ufs_rtc_update_work: A work for UFS RTC periodic update + */ + struct ufs_hba { + void __iomem *mmio_base; +@@ -1068,6 +1070,8 @@ struct ufs_hba { + struct ufs_hw_queue *uhq; + struct ufs_hw_queue *dev_cmd_queue; + struct ufshcd_mcq_opr_info_t mcq_opr[OPR_MAX]; ++ ++ struct delayed_work ufs_rtc_update_work; + }; + + /** +-- +2.39.5 + diff --git a/queue-6.6/scsi-ufs-core-add-ufshcd_is_ufs_dev_busy.patch b/queue-6.6/scsi-ufs-core-add-ufshcd_is_ufs_dev_busy.patch new file mode 100644 index 0000000000..57a7038e8f --- /dev/null +++ b/queue-6.6/scsi-ufs-core-add-ufshcd_is_ufs_dev_busy.patch @@ -0,0 +1,57 @@ +From bda613d03e3d3117bd4c6599e86c6a503efd1686 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Dec 2023 23:08:23 +0100 +Subject: scsi: ufs: core: Add ufshcd_is_ufs_dev_busy() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bean Huo + +[ Upstream commit 9fa268875ca4ff5cad0c1b957388a0aef39920c3 ] + +Add helper inline for retrieving whether UFS device is busy or not. + +Signed-off-by: Bean Huo +Link: https://lore.kernel.org/r/20231212220825.85255-2-beanhuo@iokpp.de +Reviewed-by: Avri Altman +Reviewed-by: Thomas Weißschuh +Signed-off-by: Martin K. Petersen +Stable-dep-of: 4fa382be4304 ("scsi: ufs: core: Fix ufshcd_is_ufs_dev_busy() and ufshcd_eh_timed_out()") +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index 0ac0b6aaf9c62..fe1c56bc0a127 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -234,6 +234,12 @@ ufs_get_desired_pm_lvl_for_dev_link_state(enum ufs_dev_pwr_mode dev_state, + return UFS_PM_LVL_0; + } + ++static bool ufshcd_is_ufs_dev_busy(struct ufs_hba *hba) ++{ ++ return (hba->clk_gating.active_reqs || hba->outstanding_reqs || hba->outstanding_tasks || ++ hba->active_uic_cmd || hba->uic_async_done); ++} ++ + static const struct ufs_dev_quirk ufs_fixups[] = { + /* UFS cards deviations table */ + { .wmanufacturerid = UFS_VENDOR_MICRON, +@@ -1816,10 +1822,7 @@ static void ufshcd_gate_work(struct work_struct *work) + goto rel_lock; + } + +- if (hba->clk_gating.active_reqs +- || hba->ufshcd_state != UFSHCD_STATE_OPERATIONAL +- || hba->outstanding_reqs || hba->outstanding_tasks +- || hba->active_uic_cmd || hba->uic_async_done) ++ if (ufshcd_is_ufs_dev_busy(hba) || hba->ufshcd_state != UFSHCD_STATE_OPERATIONAL) + goto rel_lock; + + spin_unlock_irqrestore(hba->host->host_lock, flags); +-- +2.39.5 + diff --git a/queue-6.6/scsi-ufs-core-fix-ufshcd_is_ufs_dev_busy-and-ufshcd_.patch b/queue-6.6/scsi-ufs-core-fix-ufshcd_is_ufs_dev_busy-and-ufshcd_.patch new file mode 100644 index 0000000000..cc246a170c --- /dev/null +++ b/queue-6.6/scsi-ufs-core-fix-ufshcd_is_ufs_dev_busy-and-ufshcd_.patch @@ -0,0 +1,62 @@ +From 6b61df6739d51cfb8cc7e8dc1a3066b91de5c30f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Feb 2025 14:43:44 -0800 +Subject: scsi: ufs: core: Fix ufshcd_is_ufs_dev_busy() and + ufshcd_eh_timed_out() + +From: Bart Van Assche + +[ Upstream commit 4fa382be430421e1445f9c95c4dc9b7e0949ae8a ] + +ufshcd_is_ufs_dev_busy(), ufshcd_print_host_state() and +ufshcd_eh_timed_out() are used in both modes (legacy mode and MCQ mode). +hba->outstanding_reqs only represents the outstanding requests in legacy +mode. Hence, change hba->outstanding_reqs into scsi_host_busy(hba->host) in +these functions. + +Fixes: eacb139b77ff ("scsi: ufs: core: mcq: Enable multi-circular queue") +Signed-off-by: Bart Van Assche +Link: https://lore.kernel.org/r/20250214224352.3025151-1-bvanassche@acm.org +Reviewed-by: Peter Wang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index 24f8b74e166de..3412ac717807d 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -245,7 +245,7 @@ static bool ufshcd_has_pending_tasks(struct ufs_hba *hba) + + static bool ufshcd_is_ufs_dev_busy(struct ufs_hba *hba) + { +- return hba->outstanding_reqs || ufshcd_has_pending_tasks(hba); ++ return scsi_host_busy(hba->host) || ufshcd_has_pending_tasks(hba); + } + + static const struct ufs_dev_quirk ufs_fixups[] = { +@@ -616,8 +616,8 @@ static void ufshcd_print_host_state(struct ufs_hba *hba) + const struct scsi_device *sdev_ufs = hba->ufs_device_wlun; + + dev_err(hba->dev, "UFS Host state=%d\n", hba->ufshcd_state); +- dev_err(hba->dev, "outstanding reqs=0x%lx tasks=0x%lx\n", +- hba->outstanding_reqs, hba->outstanding_tasks); ++ dev_err(hba->dev, "%d outstanding reqs, tasks=0x%lx\n", ++ scsi_host_busy(hba->host), hba->outstanding_tasks); + dev_err(hba->dev, "saved_err=0x%x, saved_uic_err=0x%x\n", + hba->saved_err, hba->saved_uic_err); + dev_err(hba->dev, "Device power mode=%d, UIC link state=%d\n", +@@ -8973,7 +8973,7 @@ static enum scsi_timeout_action ufshcd_eh_timed_out(struct scsi_cmnd *scmd) + dev_info(hba->dev, "%s() finished; outstanding_tasks = %#lx.\n", + __func__, hba->outstanding_tasks); + +- return hba->outstanding_reqs ? SCSI_EH_RESET_TIMER : SCSI_EH_DONE; ++ return scsi_host_busy(hba->host) ? SCSI_EH_RESET_TIMER : SCSI_EH_DONE; + } + + static const struct attribute_group *ufshcd_driver_groups[] = { +-- +2.39.5 + diff --git a/queue-6.6/scsi-ufs-core-introduce-ufshcd_has_pending_tasks.patch b/queue-6.6/scsi-ufs-core-introduce-ufshcd_has_pending_tasks.patch new file mode 100644 index 0000000000..c747413493 --- /dev/null +++ b/queue-6.6/scsi-ufs-core-introduce-ufshcd_has_pending_tasks.patch @@ -0,0 +1,58 @@ +From 3208008ac379d372443a6fc517467767a7ae25bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Nov 2024 09:08:05 +0200 +Subject: scsi: ufs: core: Introduce ufshcd_has_pending_tasks() + +From: Avri Altman + +[ Upstream commit e738ba458e7539be1757dcdf85835a5c7b11fad4 ] + +Prepare to remove hba->clk_gating.active_reqs check from +ufshcd_is_ufs_dev_busy(). + +Signed-off-by: Avri Altman +Link: https://lore.kernel.org/r/20241124070808.194860-2-avri.altman@wdc.com +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Stable-dep-of: 4fa382be4304 ("scsi: ufs: core: Fix ufshcd_is_ufs_dev_busy() and ufshcd_eh_timed_out()") +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index a9a7a84e6cbbc..83d69e0564f2d 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -237,10 +237,16 @@ ufs_get_desired_pm_lvl_for_dev_link_state(enum ufs_dev_pwr_mode dev_state, + return UFS_PM_LVL_0; + } + ++static bool ufshcd_has_pending_tasks(struct ufs_hba *hba) ++{ ++ return hba->outstanding_tasks || hba->active_uic_cmd || ++ hba->uic_async_done; ++} ++ + static bool ufshcd_is_ufs_dev_busy(struct ufs_hba *hba) + { +- return (hba->clk_gating.active_reqs || hba->outstanding_reqs || hba->outstanding_tasks || +- hba->active_uic_cmd || hba->uic_async_done); ++ return hba->clk_gating.active_reqs || hba->outstanding_reqs || ++ ufshcd_has_pending_tasks(hba); + } + + static const struct ufs_dev_quirk ufs_fixups[] = { +@@ -1883,8 +1889,7 @@ static void __ufshcd_release(struct ufs_hba *hba) + + if (hba->clk_gating.active_reqs || hba->clk_gating.is_suspended || + hba->ufshcd_state != UFSHCD_STATE_OPERATIONAL || +- hba->outstanding_tasks || !hba->clk_gating.is_initialized || +- hba->active_uic_cmd || hba->uic_async_done || ++ ufshcd_has_pending_tasks(hba) || !hba->clk_gating.is_initialized || + hba->clk_gating.state == CLKS_OFF) + return; + +-- +2.39.5 + diff --git a/queue-6.6/scsi-ufs-core-prepare-to-introduce-a-new-clock_gatin.patch b/queue-6.6/scsi-ufs-core-prepare-to-introduce-a-new-clock_gatin.patch new file mode 100644 index 0000000000..49c401103d --- /dev/null +++ b/queue-6.6/scsi-ufs-core-prepare-to-introduce-a-new-clock_gatin.patch @@ -0,0 +1,61 @@ +From b29e2a451e62a1b3bd34f0898e80db79a2ab784e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Nov 2024 09:08:06 +0200 +Subject: scsi: ufs: core: Prepare to introduce a new clock_gating lock + +From: Avri Altman + +[ Upstream commit 7869c6521f5715688b3d1f1c897374a68544eef0 ] + +Remove hba->clk_gating.active_reqs check from ufshcd_is_ufs_dev_busy() +function to separate clock gating logic from general device busy checks. + +Signed-off-by: Avri Altman +Link: https://lore.kernel.org/r/20241124070808.194860-3-avri.altman@wdc.com +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Stable-dep-of: 4fa382be4304 ("scsi: ufs: core: Fix ufshcd_is_ufs_dev_busy() and ufshcd_eh_timed_out()") +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index 83d69e0564f2d..24f8b74e166de 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -245,8 +245,7 @@ static bool ufshcd_has_pending_tasks(struct ufs_hba *hba) + + static bool ufshcd_is_ufs_dev_busy(struct ufs_hba *hba) + { +- return hba->clk_gating.active_reqs || hba->outstanding_reqs || +- ufshcd_has_pending_tasks(hba); ++ return hba->outstanding_reqs || ufshcd_has_pending_tasks(hba); + } + + static const struct ufs_dev_quirk ufs_fixups[] = { +@@ -1833,7 +1832,9 @@ static void ufshcd_gate_work(struct work_struct *work) + goto rel_lock; + } + +- if (ufshcd_is_ufs_dev_busy(hba) || hba->ufshcd_state != UFSHCD_STATE_OPERATIONAL) ++ if (ufshcd_is_ufs_dev_busy(hba) || ++ hba->ufshcd_state != UFSHCD_STATE_OPERATIONAL || ++ hba->clk_gating.active_reqs) + goto rel_lock; + + spin_unlock_irqrestore(hba->host->host_lock, flags); +@@ -8196,7 +8197,9 @@ static void ufshcd_rtc_work(struct work_struct *work) + hba = container_of(to_delayed_work(work), struct ufs_hba, ufs_rtc_update_work); + + /* Update RTC only when there are no requests in progress and UFSHCI is operational */ +- if (!ufshcd_is_ufs_dev_busy(hba) && hba->ufshcd_state == UFSHCD_STATE_OPERATIONAL) ++ if (!ufshcd_is_ufs_dev_busy(hba) && ++ hba->ufshcd_state == UFSHCD_STATE_OPERATIONAL && ++ !hba->clk_gating.active_reqs) + ufshcd_update_rtc(hba); + + if (ufshcd_is_ufs_dev_active(hba)) +-- +2.39.5 + diff --git a/queue-6.6/series b/queue-6.6/series new file mode 100644 index 0000000000..fa905ef9b9 --- /dev/null +++ b/queue-6.6/series @@ -0,0 +1,16 @@ +ib-mlx5-set-and-get-correct-qp_num-for-a-dct-qp.patch +rdma-mana_ib-allocate-page-aligned-doorbell-index.patch +scsi-ufs-core-add-ufshcd_is_ufs_dev_busy.patch +scsi-ufs-core-add-ufs-rtc-support.patch +scsi-ufs-core-introduce-ufshcd_has_pending_tasks.patch +scsi-ufs-core-prepare-to-introduce-a-new-clock_gatin.patch +scsi-ufs-core-fix-ufshcd_is_ufs_dev_busy-and-ufshcd_.patch +ovl-fix-uaf-in-ovl_dentry_update_reval-by-moving-dpu.patch +sunrpc-convert-rpc_task_-constants-to-enum.patch +sunrpc-prevent-looping-due-to-rpc_signal_task-races.patch +sunrpc-handle-etimedout-return-from-tlshd.patch +ib-core-add-support-for-xdr-link-speed.patch +rdma-mlx5-fix-ah-static-rate-parsing.patch +scsi-core-clear-driver-private-data-when-retrying-re.patch +rdma-mlx5-fix-bind-qp-error-cleanup-flow.patch +sunrpc-suppress-warnings-for-unused-procfs-functions.patch diff --git a/queue-6.6/sunrpc-convert-rpc_task_-constants-to-enum.patch b/queue-6.6/sunrpc-convert-rpc_task_-constants-to-enum.patch new file mode 100644 index 0000000000..0a120dc563 --- /dev/null +++ b/queue-6.6/sunrpc-convert-rpc_task_-constants-to-enum.patch @@ -0,0 +1,54 @@ +From 7d7359cdae85a50f91d9335d68dd7e081a266356 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Aug 2024 08:58:59 -0700 +Subject: SUNRPC: convert RPC_TASK_* constants to enum + +From: Stephen Brennan + +[ Upstream commit 0b108e83795c9c23101f584ef7e3ab4f1f120ef0 ] + +The RPC_TASK_* constants are defined as macros, which means that most +kernel builds will not contain their definitions in the debuginfo. +However, it's quite useful for debuggers to be able to view the task +state constant and interpret it correctly. Conversion to an enum will +ensure the constants are present in debuginfo and can be interpreted by +debuggers without needing to hard-code them and track their changes. + +Signed-off-by: Stephen Brennan +Signed-off-by: Anna Schumaker +Stable-dep-of: 5bbd6e863b15 ("SUNRPC: Prevent looping due to rpc_signal_task() races") +Signed-off-by: Sasha Levin +--- + include/linux/sunrpc/sched.h | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h +index 8f9bee0e21c3b..f80b90aca380a 100644 +--- a/include/linux/sunrpc/sched.h ++++ b/include/linux/sunrpc/sched.h +@@ -140,13 +140,15 @@ struct rpc_task_setup { + #define RPC_WAS_SENT(t) ((t)->tk_flags & RPC_TASK_SENT) + #define RPC_IS_MOVEABLE(t) ((t)->tk_flags & RPC_TASK_MOVEABLE) + +-#define RPC_TASK_RUNNING 0 +-#define RPC_TASK_QUEUED 1 +-#define RPC_TASK_ACTIVE 2 +-#define RPC_TASK_NEED_XMIT 3 +-#define RPC_TASK_NEED_RECV 4 +-#define RPC_TASK_MSG_PIN_WAIT 5 +-#define RPC_TASK_SIGNALLED 6 ++enum { ++ RPC_TASK_RUNNING, ++ RPC_TASK_QUEUED, ++ RPC_TASK_ACTIVE, ++ RPC_TASK_NEED_XMIT, ++ RPC_TASK_NEED_RECV, ++ RPC_TASK_MSG_PIN_WAIT, ++ RPC_TASK_SIGNALLED, ++}; + + #define rpc_test_and_set_running(t) \ + test_and_set_bit(RPC_TASK_RUNNING, &(t)->tk_runstate) +-- +2.39.5 + diff --git a/queue-6.6/sunrpc-handle-etimedout-return-from-tlshd.patch b/queue-6.6/sunrpc-handle-etimedout-return-from-tlshd.patch new file mode 100644 index 0000000000..dc5056c3bc --- /dev/null +++ b/queue-6.6/sunrpc-handle-etimedout-return-from-tlshd.patch @@ -0,0 +1,48 @@ +From 9b058f54c6f1663c02f25eff0820eb787a1b0646 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Feb 2025 12:31:57 -0500 +Subject: SUNRPC: Handle -ETIMEDOUT return from tlshd + +From: Benjamin Coddington + +[ Upstream commit 7a2f6f7687c5f7083a35317cddec5ad9fa491443 ] + +If the TLS handshake attempt returns -ETIMEDOUT, we currently translate +that error into -EACCES. This becomes problematic for cases where the RPC +layer is attempting to re-connect in paths that don't resonably handle +-EACCES, for example: writeback. The RPC layer can handle -ETIMEDOUT quite +well, however - so if the handshake returns this error let's just pass it +along. + +Fixes: 75eb6af7acdf ("SUNRPC: Add a TCP-with-TLS RPC transport class") +Signed-off-by: Benjamin Coddington +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + net/sunrpc/xprtsock.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index 1c4bc8234ea87..29df05879c8e9 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -2561,7 +2561,15 @@ static void xs_tls_handshake_done(void *data, int status, key_serial_t peerid) + struct sock_xprt *lower_transport = + container_of(lower_xprt, struct sock_xprt, xprt); + +- lower_transport->xprt_err = status ? -EACCES : 0; ++ switch (status) { ++ case 0: ++ case -EACCES: ++ case -ETIMEDOUT: ++ lower_transport->xprt_err = status; ++ break; ++ default: ++ lower_transport->xprt_err = -EACCES; ++ } + complete(&lower_transport->handshake_done); + xprt_put(lower_xprt); + } +-- +2.39.5 + diff --git a/queue-6.6/sunrpc-prevent-looping-due-to-rpc_signal_task-races.patch b/queue-6.6/sunrpc-prevent-looping-due-to-rpc_signal_task-races.patch new file mode 100644 index 0000000000..71232d0b8b --- /dev/null +++ b/queue-6.6/sunrpc-prevent-looping-due-to-rpc_signal_task-races.patch @@ -0,0 +1,79 @@ +From c40968f6bd6d6456dd39d0b6d03b981adae0e910 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Feb 2025 15:00:02 -0500 +Subject: SUNRPC: Prevent looping due to rpc_signal_task() races + +From: Trond Myklebust + +[ Upstream commit 5bbd6e863b15a85221e49b9bdb2d5d8f0bb91f3d ] + +If rpc_signal_task() is called while a task is in an rpc_call_done() +callback function, and the latter calls rpc_restart_call(), the task can +end up looping due to the RPC_TASK_SIGNALLED flag being set without the +tk_rpc_status being set. +Removing the redundant mechanism for signalling the task fixes the +looping behaviour. + +Reported-by: Li Lingfeng +Fixes: 39494194f93b ("SUNRPC: Fix races with rpc_killall_tasks()") +Signed-off-by: Trond Myklebust +Reviewed-by: Jeff Layton +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + include/linux/sunrpc/sched.h | 3 +-- + include/trace/events/sunrpc.h | 3 +-- + net/sunrpc/sched.c | 2 -- + 3 files changed, 2 insertions(+), 6 deletions(-) + +diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h +index f80b90aca380a..a220b28904ca5 100644 +--- a/include/linux/sunrpc/sched.h ++++ b/include/linux/sunrpc/sched.h +@@ -147,7 +147,6 @@ enum { + RPC_TASK_NEED_XMIT, + RPC_TASK_NEED_RECV, + RPC_TASK_MSG_PIN_WAIT, +- RPC_TASK_SIGNALLED, + }; + + #define rpc_test_and_set_running(t) \ +@@ -160,7 +159,7 @@ enum { + + #define RPC_IS_ACTIVATED(t) test_bit(RPC_TASK_ACTIVE, &(t)->tk_runstate) + +-#define RPC_SIGNALLED(t) test_bit(RPC_TASK_SIGNALLED, &(t)->tk_runstate) ++#define RPC_SIGNALLED(t) (READ_ONCE(task->tk_rpc_status) == -ERESTARTSYS) + + /* + * Task priorities. +diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h +index 6beb38c1dcb5e..9eba2ca0a6ff8 100644 +--- a/include/trace/events/sunrpc.h ++++ b/include/trace/events/sunrpc.h +@@ -360,8 +360,7 @@ TRACE_EVENT(rpc_request, + { (1UL << RPC_TASK_ACTIVE), "ACTIVE" }, \ + { (1UL << RPC_TASK_NEED_XMIT), "NEED_XMIT" }, \ + { (1UL << RPC_TASK_NEED_RECV), "NEED_RECV" }, \ +- { (1UL << RPC_TASK_MSG_PIN_WAIT), "MSG_PIN_WAIT" }, \ +- { (1UL << RPC_TASK_SIGNALLED), "SIGNALLED" }) ++ { (1UL << RPC_TASK_MSG_PIN_WAIT), "MSG_PIN_WAIT" }) + + DECLARE_EVENT_CLASS(rpc_task_running, + +diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c +index cef623ea15060..9b45fbdc90cab 100644 +--- a/net/sunrpc/sched.c ++++ b/net/sunrpc/sched.c +@@ -864,8 +864,6 @@ void rpc_signal_task(struct rpc_task *task) + if (!rpc_task_set_rpc_status(task, -ERESTARTSYS)) + return; + trace_rpc_task_signalled(task, task->tk_action); +- set_bit(RPC_TASK_SIGNALLED, &task->tk_runstate); +- smp_mb__after_atomic(); + queue = READ_ONCE(task->tk_waitqueue); + if (queue) + rpc_wake_up_queued_task(queue, task); +-- +2.39.5 + diff --git a/queue-6.6/sunrpc-suppress-warnings-for-unused-procfs-functions.patch b/queue-6.6/sunrpc-suppress-warnings-for-unused-procfs-functions.patch new file mode 100644 index 0000000000..07324a1279 --- /dev/null +++ b/queue-6.6/sunrpc-suppress-warnings-for-unused-procfs-functions.patch @@ -0,0 +1,71 @@ +From 2a3265eed67c2128d75141b7fd4da086c9b9052c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Feb 2025 15:52:21 +0100 +Subject: sunrpc: suppress warnings for unused procfs functions + +From: Arnd Bergmann + +[ Upstream commit 1f7a4f98c11fbeb18ed21f3b3a497e90a50ad2e0 ] + +There is a warning about unused variables when building with W=1 and no procfs: + +net/sunrpc/cache.c:1660:30: error: 'cache_flush_proc_ops' defined but not used [-Werror=unused-const-variable=] + 1660 | static const struct proc_ops cache_flush_proc_ops = { + | ^~~~~~~~~~~~~~~~~~~~ +net/sunrpc/cache.c:1622:30: error: 'content_proc_ops' defined but not used [-Werror=unused-const-variable=] + 1622 | static const struct proc_ops content_proc_ops = { + | ^~~~~~~~~~~~~~~~ +net/sunrpc/cache.c:1598:30: error: 'cache_channel_proc_ops' defined but not used [-Werror=unused-const-variable=] + 1598 | static const struct proc_ops cache_channel_proc_ops = { + | ^~~~~~~~~~~~~~~~~~~~~~ + +These are used inside of an #ifdef, so replacing that with an +IS_ENABLED() check lets the compiler see how they are used while +still dropping them during dead code elimination. + +Fixes: dbf847ecb631 ("knfsd: allow cache_register to return error on failure") +Reviewed-by: Jeff Layton +Acked-by: Chuck Lever +Signed-off-by: Arnd Bergmann +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + net/sunrpc/cache.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c +index 3298da2e37e43..cb6a6bc9fea77 100644 +--- a/net/sunrpc/cache.c ++++ b/net/sunrpc/cache.c +@@ -1675,12 +1675,14 @@ static void remove_cache_proc_entries(struct cache_detail *cd) + } + } + +-#ifdef CONFIG_PROC_FS + static int create_cache_proc_entries(struct cache_detail *cd, struct net *net) + { + struct proc_dir_entry *p; + struct sunrpc_net *sn; + ++ if (!IS_ENABLED(CONFIG_PROC_FS)) ++ return 0; ++ + sn = net_generic(net, sunrpc_net_id); + cd->procfs = proc_mkdir(cd->name, sn->proc_net_rpc); + if (cd->procfs == NULL) +@@ -1708,12 +1710,6 @@ static int create_cache_proc_entries(struct cache_detail *cd, struct net *net) + remove_cache_proc_entries(cd); + return -ENOMEM; + } +-#else /* CONFIG_PROC_FS */ +-static int create_cache_proc_entries(struct cache_detail *cd, struct net *net) +-{ +- return 0; +-} +-#endif + + void __init cache_initialize(void) + { +-- +2.39.5 +