From: Greg Kroah-Hartman Date: Mon, 6 Mar 2023 07:30:37 +0000 (+0100) Subject: 6.1-stable patches X-Git-Tag: v6.2.3~112 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=aee80e252b5a10853a08d3ca20cf8ff2ebecbb25;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: block-be-a-bit-more-careful-in-checking-for-null-bdev-while-polling.patch block-clear-bio-bi_bdev-when-putting-a-bio-back-in-the-cache.patch block-don-t-allow-multiple-bios-for-iocb_nowait-issue.patch firmware-coreboot-framebuffer-ignore-reserved-pixel-color-bits.patch ipmi-ipmb-fix-the-module_parm_desc-associated-to-retry_time_ms.patch ipmi-ssif-resend_msg-cannot-fail.patch ipmi_ssif-rename-idle-state-and-check.patch rtc-pm8xxx-fix-set-alarm-race.patch scsi-mpt3sas-remove-usage-of-dma_get_required_mask-api.patch wifi-rtl8xxxu-fixing-transmisison-failure-for-rtl8192eu.patch --- diff --git a/queue-6.1/block-be-a-bit-more-careful-in-checking-for-null-bdev-while-polling.patch b/queue-6.1/block-be-a-bit-more-careful-in-checking-for-null-bdev-while-polling.patch new file mode 100644 index 00000000000..82533012312 --- /dev/null +++ b/queue-6.1/block-be-a-bit-more-careful-in-checking-for-null-bdev-while-polling.patch @@ -0,0 +1,92 @@ +From 310726c33ad76cebdee312dbfafc12c1b44bf977 Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Fri, 24 Feb 2023 10:01:19 -0700 +Subject: block: be a bit more careful in checking for NULL bdev while polling + +From: Jens Axboe + +commit 310726c33ad76cebdee312dbfafc12c1b44bf977 upstream. + +Wei reports a crash with an application using polled IO: + +PGD 14265e067 P4D 14265e067 PUD 47ec50067 PMD 0 +Oops: 0000 [#1] SMP +CPU: 0 PID: 21915 Comm: iocore_0 Kdump: loaded Tainted: G S 5.12.0-0_fbk12_clang_7346_g1bb6f2e7058f #1 +Hardware name: Wiwynn Delta Lake MP T8/Delta Lake-Class2, BIOS Y3DLM08 04/10/2022 +RIP: 0010:bio_poll+0x25/0x200 +Code: 0f 1f 44 00 00 0f 1f 44 00 00 55 41 57 41 56 41 55 41 54 53 48 83 ec 28 65 48 8b 04 25 28 00 00 00 48 89 44 24 20 48 8b 47 08 <48> 8b 80 70 02 00 00 4c 8b 70 50 8b 6f 34 31 db 83 fd ff 75 25 65 +RSP: 0018:ffffc90005fafdf8 EFLAGS: 00010292 +RAX: 0000000000000000 RBX: 0000000000000000 RCX: 74b43cd65dd66600 +RDX: 0000000000000003 RSI: ffffc90005fafe78 RDI: ffff8884b614e140 +RBP: ffff88849964df78 R08: 0000000000000000 R09: 0000000000000008 +R10: 0000000000000000 R11: 0000000000000000 R12: ffff88849964df00 +R13: ffffc90005fafe78 R14: ffff888137d3c378 R15: 0000000000000001 +FS: 00007fd195000640(0000) GS:ffff88903f400000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000000000270 CR3: 0000000466121001 CR4: 00000000007706f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +PKRU: 55555554 +Call Trace: + iocb_bio_iopoll+0x1d/0x30 + io_do_iopoll+0xac/0x250 + __se_sys_io_uring_enter+0x3c5/0x5a0 + ? __x64_sys_write+0x89/0xd0 + do_syscall_64+0x2d/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xae +RIP: 0033:0x94f225d +Code: 24 cc 00 00 00 41 8b 84 24 d0 00 00 00 c1 e0 04 83 e0 10 41 09 c2 8b 33 8b 53 04 4c 8b 43 18 4c 63 4b 0c b8 aa 01 00 00 0f 05 <85> c0 0f 88 85 00 00 00 29 03 45 84 f6 0f 84 88 00 00 00 41 f6 c7 +RSP: 002b:00007fd194ffcd88 EFLAGS: 00000202 ORIG_RAX: 00000000000001aa +RAX: ffffffffffffffda RBX: 00007fd194ffcdc0 RCX: 00000000094f225d +RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000007 +RBP: 00007fd194ffcdb0 R08: 0000000000000000 R09: 0000000000000008 +R10: 0000000000000001 R11: 0000000000000202 R12: 00007fd269d68030 +R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 + +which is due to bio->bi_bdev being NULL. This can happen if we have two +tasks doing polled IO, and task B ends up completing IO from task A if +they are sharing a poll queue. If task B completes the IO and puts the +bio into our cache, then it can allocate that bio again before task A +is done polling for it. As that would necessitate a preempt between the +two tasks, it's enough to just be a bit more careful in checking for +whether or not bio->bi_bdev is NULL. + +Reported-and-tested-by: Wei Zhang +Cc: stable@vger.kernel.org +Fixes: be4d234d7aeb ("bio: add allocation cache abstraction") +Reviewed-by: Keith Busch +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + block/blk-core.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -842,10 +842,16 @@ EXPORT_SYMBOL(submit_bio); + */ + int bio_poll(struct bio *bio, struct io_comp_batch *iob, unsigned int flags) + { +- struct request_queue *q = bdev_get_queue(bio->bi_bdev); + blk_qc_t cookie = READ_ONCE(bio->bi_cookie); ++ struct block_device *bdev; ++ struct request_queue *q; + int ret = 0; + ++ bdev = READ_ONCE(bio->bi_bdev); ++ if (!bdev) ++ return 0; ++ ++ q = bdev_get_queue(bdev); + if (cookie == BLK_QC_T_NONE || + !test_bit(QUEUE_FLAG_POLL, &q->queue_flags)) + return 0; +@@ -905,7 +911,7 @@ int iocb_bio_iopoll(struct kiocb *kiocb, + */ + rcu_read_lock(); + bio = READ_ONCE(kiocb->private); +- if (bio && bio->bi_bdev) ++ if (bio) + ret = bio_poll(bio, iob, flags); + rcu_read_unlock(); + diff --git a/queue-6.1/block-clear-bio-bi_bdev-when-putting-a-bio-back-in-the-cache.patch b/queue-6.1/block-clear-bio-bi_bdev-when-putting-a-bio-back-in-the-cache.patch new file mode 100644 index 00000000000..17ff5d44cbd --- /dev/null +++ b/queue-6.1/block-clear-bio-bi_bdev-when-putting-a-bio-back-in-the-cache.patch @@ -0,0 +1,32 @@ +From 11eb695feb636fa5211067189cad25ac073e7fe5 Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Fri, 24 Feb 2023 09:59:44 -0700 +Subject: block: clear bio->bi_bdev when putting a bio back in the cache + +From: Jens Axboe + +commit 11eb695feb636fa5211067189cad25ac073e7fe5 upstream. + +This isn't strictly needed in terms of correctness, but it does allow +polling to know if the bio has been put already by a different task +and hence avoid polling something that we don't need to. + +Cc: stable@vger.kernel.org +Fixes: be4d234d7aeb ("bio: add allocation cache abstraction") +Reviewed-by: Keith Busch +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + block/bio.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/block/bio.c ++++ b/block/bio.c +@@ -747,6 +747,7 @@ void bio_put(struct bio *bio) + bio_uninit(bio); + cache = per_cpu_ptr(bio->bi_pool->cache, get_cpu()); + bio->bi_next = cache->free_list; ++ bio->bi_bdev = NULL; + cache->free_list = bio; + if (++cache->nr > ALLOC_CACHE_MAX + ALLOC_CACHE_SLACK) + bio_alloc_cache_prune(cache, ALLOC_CACHE_SLACK); diff --git a/queue-6.1/block-don-t-allow-multiple-bios-for-iocb_nowait-issue.patch b/queue-6.1/block-don-t-allow-multiple-bios-for-iocb_nowait-issue.patch new file mode 100644 index 00000000000..c9f7c6a4026 --- /dev/null +++ b/queue-6.1/block-don-t-allow-multiple-bios-for-iocb_nowait-issue.patch @@ -0,0 +1,70 @@ +From 67d59247d4b52c917e373f05a807027756ab216f Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Mon, 16 Jan 2023 08:55:53 -0700 +Subject: block: don't allow multiple bios for IOCB_NOWAIT issue + +From: Jens Axboe + +commit 67d59247d4b52c917e373f05a807027756ab216f upstream. + +If we're doing a large IO request which needs to be split into multiple +bios for issue, then we can run into the same situation as the below +marked commit fixes - parts will complete just fine, one or more parts +will fail to allocate a request. This will result in a partially +completed read or write request, where the caller gets EAGAIN even though +parts of the IO completed just fine. + +Do the same for large bios as we do for splits - fail a NOWAIT request +with EAGAIN. This isn't technically fixing an issue in the below marked +patch, but for stable purposes, we should have either none of them or +both. + +This depends on: 613b14884b85 ("block: handle bio_split_to_limits() NULL return") + +Cc: stable@vger.kernel.org # 5.15+ +Fixes: 9cea62b2cbab ("block: don't allow splitting of a REQ_NOWAIT bio") +Link: https://github.com/axboe/liburing/issues/766 +Reported-and-tested-by: Michael Kelley +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + block/fops.c | 21 ++++++++++++++++++--- + 1 file changed, 18 insertions(+), 3 deletions(-) + +--- a/block/fops.c ++++ b/block/fops.c +@@ -221,6 +221,24 @@ static ssize_t __blkdev_direct_IO(struct + bio_endio(bio); + break; + } ++ if (iocb->ki_flags & IOCB_NOWAIT) { ++ /* ++ * This is nonblocking IO, and we need to allocate ++ * another bio if we have data left to map. As we ++ * cannot guarantee that one of the sub bios will not ++ * fail getting issued FOR NOWAIT and as error results ++ * are coalesced across all of them, be safe and ask for ++ * a retry of this from blocking context. ++ */ ++ if (unlikely(iov_iter_count(iter))) { ++ bio_release_pages(bio, false); ++ bio_clear_flag(bio, BIO_REFFED); ++ bio_put(bio); ++ blk_finish_plug(&plug); ++ return -EAGAIN; ++ } ++ bio->bi_opf |= REQ_NOWAIT; ++ } + + if (is_read) { + if (dio->flags & DIO_SHOULD_DIRTY) +@@ -228,9 +246,6 @@ static ssize_t __blkdev_direct_IO(struct + } else { + task_io_account_write(bio->bi_iter.bi_size); + } +- if (iocb->ki_flags & IOCB_NOWAIT) +- bio->bi_opf |= REQ_NOWAIT; +- + dio->size += bio->bi_iter.bi_size; + pos += bio->bi_iter.bi_size; + diff --git a/queue-6.1/firmware-coreboot-framebuffer-ignore-reserved-pixel-color-bits.patch b/queue-6.1/firmware-coreboot-framebuffer-ignore-reserved-pixel-color-bits.patch new file mode 100644 index 00000000000..13e37d61542 --- /dev/null +++ b/queue-6.1/firmware-coreboot-framebuffer-ignore-reserved-pixel-color-bits.patch @@ -0,0 +1,52 @@ +From e6acaf25cba14661211bb72181c35dd13b24f5b3 Mon Sep 17 00:00:00 2001 +From: Alper Nebi Yasak +Date: Sun, 22 Jan 2023 22:04:31 +0300 +Subject: firmware: coreboot: framebuffer: Ignore reserved pixel color bits + +From: Alper Nebi Yasak + +commit e6acaf25cba14661211bb72181c35dd13b24f5b3 upstream. + +The coreboot framebuffer doesn't support transparency, its 'reserved' +bit field is merely padding for byte/word alignment of pixel colors [1]. +When trying to match the framebuffer to a simplefb format, the kernel +driver unnecessarily requires the format's transparency bit field to +exactly match this padding, even if the former is zero-width. + +Due to a coreboot bug [2] (fixed upstream), some boards misreport the +reserved field's size as equal to its position (0x18 for both on a +'Lick' Chromebook), and the driver fails to probe where it would have +otherwise worked fine with e.g. the a8r8g8b8 or x8r8g8b8 formats. + +Remove the transparency comparison with reserved bits. When the +bits-per-pixel and other color components match, transparency will +already be in a subset of the reserved field. Not forcing it to match +reserved bits allows the driver to work on the boards which misreport +the reserved field. It also enables using simplefb formats that don't +have transparency bits, although this doesn't currently happen due to +format support and ordering in linux/platform_data/simplefb.h. + +[1] https://review.coreboot.org/plugins/gitiles/coreboot/+/4.19/src/commonlib/include/commonlib/coreboot_tables.h#255 +[2] https://review.coreboot.org/plugins/gitiles/coreboot/+/4.13/src/drivers/intel/fsp2_0/graphics.c#82 + +Signed-off-by: Alper Nebi Yasak +Link: https://lore.kernel.org/r/20230122190433.195941-1-alpernebiyasak@gmail.com +Cc: Salvatore Bonaccorso +Signed-off-by: Greg Kroah-Hartman +--- + drivers/firmware/google/framebuffer-coreboot.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/firmware/google/framebuffer-coreboot.c ++++ b/drivers/firmware/google/framebuffer-coreboot.c +@@ -43,9 +43,7 @@ static int framebuffer_probe(struct core + fb->green_mask_pos == formats[i].green.offset && + fb->green_mask_size == formats[i].green.length && + fb->blue_mask_pos == formats[i].blue.offset && +- fb->blue_mask_size == formats[i].blue.length && +- fb->reserved_mask_pos == formats[i].transp.offset && +- fb->reserved_mask_size == formats[i].transp.length) ++ fb->blue_mask_size == formats[i].blue.length) + pdata.format = formats[i].name; + } + if (!pdata.format) diff --git a/queue-6.1/ipmi-ipmb-fix-the-module_parm_desc-associated-to-retry_time_ms.patch b/queue-6.1/ipmi-ipmb-fix-the-module_parm_desc-associated-to-retry_time_ms.patch new file mode 100644 index 00000000000..2917aa723cc --- /dev/null +++ b/queue-6.1/ipmi-ipmb-fix-the-module_parm_desc-associated-to-retry_time_ms.patch @@ -0,0 +1,32 @@ +From befb28f2676a65a5a4cc4626ae224461d8785af6 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sun, 5 Feb 2023 11:04:01 +0100 +Subject: ipmi: ipmb: Fix the MODULE_PARM_DESC associated to 'retry_time_ms' + +From: Christophe JAILLET + +commit befb28f2676a65a5a4cc4626ae224461d8785af6 upstream. + +'This should be 'retry_time_ms' instead of 'max_retries'. + +Fixes: 63c4eb347164 ("ipmi:ipmb: Add initial support for IPMI over IPMB") +Signed-off-by: Christophe JAILLET +Message-Id: <0d8670cff2c656e99a832a249e77dc90578f67de.1675591429.git.christophe.jaillet@wanadoo.fr> +Cc: stable@vger.kernel.org +Signed-off-by: Corey Minyard +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/ipmi/ipmi_ipmb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/char/ipmi/ipmi_ipmb.c ++++ b/drivers/char/ipmi/ipmi_ipmb.c +@@ -27,7 +27,7 @@ MODULE_PARM_DESC(bmcaddr, "Address to us + + static unsigned int retry_time_ms = 250; + module_param(retry_time_ms, uint, 0644); +-MODULE_PARM_DESC(max_retries, "Timeout time between retries, in milliseconds."); ++MODULE_PARM_DESC(retry_time_ms, "Timeout time between retries, in milliseconds."); + + static unsigned int max_retries = 1; + module_param(max_retries, uint, 0644); diff --git a/queue-6.1/ipmi-ssif-resend_msg-cannot-fail.patch b/queue-6.1/ipmi-ssif-resend_msg-cannot-fail.patch new file mode 100644 index 00000000000..dc0824e19f2 --- /dev/null +++ b/queue-6.1/ipmi-ssif-resend_msg-cannot-fail.patch @@ -0,0 +1,93 @@ +From 95767ed78a181d5404202627499f9cde56053b96 Mon Sep 17 00:00:00 2001 +From: Corey Minyard +Date: Wed, 25 Jan 2023 10:11:06 -0600 +Subject: ipmi:ssif: resend_msg() cannot fail + +From: Corey Minyard + +commit 95767ed78a181d5404202627499f9cde56053b96 upstream. + +The resend_msg() function cannot fail, but there was error handling +around using it. Rework the handling of the error, and fix the out of +retries debug reporting that was wrong around this, too. + +Cc: stable@vger.kernel.org +Signed-off-by: Corey Minyard +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/ipmi/ipmi_ssif.c | 28 +++++++--------------------- + 1 file changed, 7 insertions(+), 21 deletions(-) + +--- a/drivers/char/ipmi/ipmi_ssif.c ++++ b/drivers/char/ipmi/ipmi_ssif.c +@@ -602,7 +602,7 @@ static void ssif_alert(struct i2c_client + start_get(ssif_info); + } + +-static int start_resend(struct ssif_info *ssif_info); ++static void start_resend(struct ssif_info *ssif_info); + + static void msg_done_handler(struct ssif_info *ssif_info, int result, + unsigned char *data, unsigned int len) +@@ -909,31 +909,17 @@ static void msg_written_handler(struct s + if (result < 0) { + ssif_info->retries_left--; + if (ssif_info->retries_left > 0) { +- if (!start_resend(ssif_info)) { +- ssif_inc_stat(ssif_info, send_retries); +- return; +- } +- /* request failed, just return the error. */ +- ssif_inc_stat(ssif_info, send_errors); +- +- if (ssif_info->ssif_debug & SSIF_DEBUG_MSG) +- dev_dbg(&ssif_info->client->dev, +- "%s: Out of retries\n", __func__); +- msg_done_handler(ssif_info, -EIO, NULL, 0); ++ start_resend(ssif_info); + return; + } + + ssif_inc_stat(ssif_info, send_errors); + +- /* +- * Got an error on transmit, let the done routine +- * handle it. +- */ + if (ssif_info->ssif_debug & SSIF_DEBUG_MSG) + dev_dbg(&ssif_info->client->dev, +- "%s: Error %d\n", __func__, result); ++ "%s: Out of retries\n", __func__); + +- msg_done_handler(ssif_info, result, NULL, 0); ++ msg_done_handler(ssif_info, -EIO, NULL, 0); + return; + } + +@@ -996,7 +982,7 @@ static void msg_written_handler(struct s + } + } + +-static int start_resend(struct ssif_info *ssif_info) ++static void start_resend(struct ssif_info *ssif_info) + { + int command; + +@@ -1021,7 +1007,6 @@ static int start_resend(struct ssif_info + + ssif_i2c_send(ssif_info, msg_written_handler, I2C_SMBUS_WRITE, + command, ssif_info->data, I2C_SMBUS_BLOCK_DATA); +- return 0; + } + + static int start_send(struct ssif_info *ssif_info, +@@ -1036,7 +1021,8 @@ static int start_send(struct ssif_info * + ssif_info->retries_left = SSIF_SEND_RETRIES; + memcpy(ssif_info->data + 1, data, len); + ssif_info->data_len = len; +- return start_resend(ssif_info); ++ start_resend(ssif_info); ++ return 0; + } + + /* Must be called with the message lock held. */ diff --git a/queue-6.1/ipmi_ssif-rename-idle-state-and-check.patch b/queue-6.1/ipmi_ssif-rename-idle-state-and-check.patch new file mode 100644 index 00000000000..95443ba59f6 --- /dev/null +++ b/queue-6.1/ipmi_ssif-rename-idle-state-and-check.patch @@ -0,0 +1,193 @@ +From 8230831c43a328c2be6d28c65d3f77e14c59986b Mon Sep 17 00:00:00 2001 +From: Corey Minyard +Date: Wed, 25 Jan 2023 10:13:13 -0600 +Subject: ipmi_ssif: Rename idle state and check + +From: Corey Minyard + +commit 8230831c43a328c2be6d28c65d3f77e14c59986b upstream. + +Rename the SSIF_IDLE() to IS_SSIF_IDLE(), since that is more clear, and +rename SSIF_NORMAL to SSIF_IDLE, since that's more accurate. + +Cc: stable@vger.kernel.org +Signed-off-by: Corey Minyard +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/ipmi/ipmi_ssif.c | 46 +++++++++++++++++++++--------------------- + 1 file changed, 23 insertions(+), 23 deletions(-) + +--- a/drivers/char/ipmi/ipmi_ssif.c ++++ b/drivers/char/ipmi/ipmi_ssif.c +@@ -92,7 +92,7 @@ + #define SSIF_WATCH_WATCHDOG_TIMEOUT msecs_to_jiffies(250) + + enum ssif_intf_state { +- SSIF_NORMAL, ++ SSIF_IDLE, + SSIF_GETTING_FLAGS, + SSIF_GETTING_EVENTS, + SSIF_CLEARING_FLAGS, +@@ -100,8 +100,8 @@ enum ssif_intf_state { + /* FIXME - add watchdog stuff. */ + }; + +-#define SSIF_IDLE(ssif) ((ssif)->ssif_state == SSIF_NORMAL \ +- && (ssif)->curr_msg == NULL) ++#define IS_SSIF_IDLE(ssif) ((ssif)->ssif_state == SSIF_IDLE \ ++ && (ssif)->curr_msg == NULL) + + /* + * Indexes into stats[] in ssif_info below. +@@ -348,9 +348,9 @@ static void return_hosed_msg(struct ssif + + /* + * Must be called with the message lock held. This will release the +- * message lock. Note that the caller will check SSIF_IDLE and start a +- * new operation, so there is no need to check for new messages to +- * start in here. ++ * message lock. Note that the caller will check IS_SSIF_IDLE and ++ * start a new operation, so there is no need to check for new ++ * messages to start in here. + */ + static void start_clear_flags(struct ssif_info *ssif_info, unsigned long *flags) + { +@@ -367,7 +367,7 @@ static void start_clear_flags(struct ssi + + if (start_send(ssif_info, msg, 3) != 0) { + /* Error, just go to normal state. */ +- ssif_info->ssif_state = SSIF_NORMAL; ++ ssif_info->ssif_state = SSIF_IDLE; + } + } + +@@ -382,7 +382,7 @@ static void start_flag_fetch(struct ssif + mb[0] = (IPMI_NETFN_APP_REQUEST << 2); + mb[1] = IPMI_GET_MSG_FLAGS_CMD; + if (start_send(ssif_info, mb, 2) != 0) +- ssif_info->ssif_state = SSIF_NORMAL; ++ ssif_info->ssif_state = SSIF_IDLE; + } + + static void check_start_send(struct ssif_info *ssif_info, unsigned long *flags, +@@ -393,7 +393,7 @@ static void check_start_send(struct ssif + + flags = ipmi_ssif_lock_cond(ssif_info, &oflags); + ssif_info->curr_msg = NULL; +- ssif_info->ssif_state = SSIF_NORMAL; ++ ssif_info->ssif_state = SSIF_IDLE; + ipmi_ssif_unlock_cond(ssif_info, flags); + ipmi_free_smi_msg(msg); + } +@@ -407,7 +407,7 @@ static void start_event_fetch(struct ssi + + msg = ipmi_alloc_smi_msg(); + if (!msg) { +- ssif_info->ssif_state = SSIF_NORMAL; ++ ssif_info->ssif_state = SSIF_IDLE; + ipmi_ssif_unlock_cond(ssif_info, flags); + return; + } +@@ -430,7 +430,7 @@ static void start_recv_msg_fetch(struct + + msg = ipmi_alloc_smi_msg(); + if (!msg) { +- ssif_info->ssif_state = SSIF_NORMAL; ++ ssif_info->ssif_state = SSIF_IDLE; + ipmi_ssif_unlock_cond(ssif_info, flags); + return; + } +@@ -448,9 +448,9 @@ static void start_recv_msg_fetch(struct + + /* + * Must be called with the message lock held. This will release the +- * message lock. Note that the caller will check SSIF_IDLE and start a +- * new operation, so there is no need to check for new messages to +- * start in here. ++ * message lock. Note that the caller will check IS_SSIF_IDLE and ++ * start a new operation, so there is no need to check for new ++ * messages to start in here. + */ + static void handle_flags(struct ssif_info *ssif_info, unsigned long *flags) + { +@@ -466,7 +466,7 @@ static void handle_flags(struct ssif_inf + /* Events available. */ + start_event_fetch(ssif_info, flags); + else { +- ssif_info->ssif_state = SSIF_NORMAL; ++ ssif_info->ssif_state = SSIF_IDLE; + ipmi_ssif_unlock_cond(ssif_info, flags); + } + } +@@ -568,7 +568,7 @@ static void watch_timeout(struct timer_l + if (ssif_info->watch_timeout) { + mod_timer(&ssif_info->watch_timer, + jiffies + ssif_info->watch_timeout); +- if (SSIF_IDLE(ssif_info)) { ++ if (IS_SSIF_IDLE(ssif_info)) { + start_flag_fetch(ssif_info, flags); /* Releases lock */ + return; + } +@@ -756,7 +756,7 @@ static void msg_done_handler(struct ssif + } + + switch (ssif_info->ssif_state) { +- case SSIF_NORMAL: ++ case SSIF_IDLE: + ipmi_ssif_unlock_cond(ssif_info, flags); + if (!msg) + break; +@@ -774,7 +774,7 @@ static void msg_done_handler(struct ssif + * Error fetching flags, or invalid length, + * just give up for now. + */ +- ssif_info->ssif_state = SSIF_NORMAL; ++ ssif_info->ssif_state = SSIF_IDLE; + ipmi_ssif_unlock_cond(ssif_info, flags); + dev_warn(&ssif_info->client->dev, + "Error getting flags: %d %d, %x\n", +@@ -809,7 +809,7 @@ static void msg_done_handler(struct ssif + "Invalid response clearing flags: %x %x\n", + data[0], data[1]); + } +- ssif_info->ssif_state = SSIF_NORMAL; ++ ssif_info->ssif_state = SSIF_IDLE; + ipmi_ssif_unlock_cond(ssif_info, flags); + break; + +@@ -887,7 +887,7 @@ static void msg_done_handler(struct ssif + } + + flags = ipmi_ssif_lock_cond(ssif_info, &oflags); +- if (SSIF_IDLE(ssif_info) && !ssif_info->stopping) { ++ if (IS_SSIF_IDLE(ssif_info) && !ssif_info->stopping) { + if (ssif_info->req_events) + start_event_fetch(ssif_info, flags); + else if (ssif_info->req_flags) +@@ -1032,7 +1032,7 @@ static void start_next_msg(struct ssif_i + unsigned long oflags; + + restart: +- if (!SSIF_IDLE(ssif_info)) { ++ if (!IS_SSIF_IDLE(ssif_info)) { + ipmi_ssif_unlock_cond(ssif_info, flags); + return; + } +@@ -1255,7 +1255,7 @@ static void shutdown_ssif(void *send_inf + dev_set_drvdata(&ssif_info->client->dev, NULL); + + /* make sure the driver is not looking for flags any more. */ +- while (ssif_info->ssif_state != SSIF_NORMAL) ++ while (ssif_info->ssif_state != SSIF_IDLE) + schedule_timeout(1); + + ssif_info->stopping = true; +@@ -1825,7 +1825,7 @@ static int ssif_probe(struct i2c_client + } + + spin_lock_init(&ssif_info->lock); +- ssif_info->ssif_state = SSIF_NORMAL; ++ ssif_info->ssif_state = SSIF_IDLE; + timer_setup(&ssif_info->retry_timer, retry_timeout, 0); + timer_setup(&ssif_info->watch_timer, watch_timeout, 0); + diff --git a/queue-6.1/rtc-pm8xxx-fix-set-alarm-race.patch b/queue-6.1/rtc-pm8xxx-fix-set-alarm-race.patch new file mode 100644 index 00000000000..a0904d25c08 --- /dev/null +++ b/queue-6.1/rtc-pm8xxx-fix-set-alarm-race.patch @@ -0,0 +1,74 @@ +From c88db0eff9722fc2b6c4d172a50471d20e08ecc6 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 2 Feb 2023 16:54:27 +0100 +Subject: rtc: pm8xxx: fix set-alarm race + +From: Johan Hovold + +commit c88db0eff9722fc2b6c4d172a50471d20e08ecc6 upstream. + +Make sure to disable the alarm before updating the four alarm time +registers to avoid spurious alarms during the update. + +Note that the disable needs to be done outside of the ctrl_reg_lock +section to prevent a racing alarm interrupt from disabling the newly set +alarm when the lock is released. + +Fixes: 9a9a54ad7aa2 ("drivers/rtc: add support for Qualcomm PMIC8xxx RTC") +Cc: stable@vger.kernel.org # 3.1 +Signed-off-by: Johan Hovold +Reviewed-by: David Collins +Link: https://lore.kernel.org/r/20230202155448.6715-2-johan+linaro@kernel.org +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rtc/rtc-pm8xxx.c | 24 ++++++++++-------------- + 1 file changed, 10 insertions(+), 14 deletions(-) + +--- a/drivers/rtc/rtc-pm8xxx.c ++++ b/drivers/rtc/rtc-pm8xxx.c +@@ -221,7 +221,6 @@ static int pm8xxx_rtc_set_alarm(struct d + { + int rc, i; + u8 value[NUM_8_BIT_RTC_REGS]; +- unsigned int ctrl_reg; + unsigned long secs, irq_flags; + struct pm8xxx_rtc *rtc_dd = dev_get_drvdata(dev); + const struct pm8xxx_rtc_regs *regs = rtc_dd->regs; +@@ -233,6 +232,11 @@ static int pm8xxx_rtc_set_alarm(struct d + secs >>= 8; + } + ++ rc = regmap_update_bits(rtc_dd->regmap, regs->alarm_ctrl, ++ regs->alarm_en, 0); ++ if (rc) ++ return rc; ++ + spin_lock_irqsave(&rtc_dd->ctrl_reg_lock, irq_flags); + + rc = regmap_bulk_write(rtc_dd->regmap, regs->alarm_rw, value, +@@ -242,19 +246,11 @@ static int pm8xxx_rtc_set_alarm(struct d + goto rtc_rw_fail; + } + +- rc = regmap_read(rtc_dd->regmap, regs->alarm_ctrl, &ctrl_reg); +- if (rc) +- goto rtc_rw_fail; +- +- if (alarm->enabled) +- ctrl_reg |= regs->alarm_en; +- else +- ctrl_reg &= ~regs->alarm_en; +- +- rc = regmap_write(rtc_dd->regmap, regs->alarm_ctrl, ctrl_reg); +- if (rc) { +- dev_err(dev, "Write to RTC alarm control register failed\n"); +- goto rtc_rw_fail; ++ if (alarm->enabled) { ++ rc = regmap_update_bits(rtc_dd->regmap, regs->alarm_ctrl, ++ regs->alarm_en, regs->alarm_en); ++ if (rc) ++ goto rtc_rw_fail; + } + + dev_dbg(dev, "Alarm Set for h:m:s=%ptRt, y-m-d=%ptRdr\n", diff --git a/queue-6.1/scsi-mpt3sas-remove-usage-of-dma_get_required_mask-api.patch b/queue-6.1/scsi-mpt3sas-remove-usage-of-dma_get_required_mask-api.patch new file mode 100644 index 00000000000..f462b43bea2 --- /dev/null +++ b/queue-6.1/scsi-mpt3sas-remove-usage-of-dma_get_required_mask-api.patch @@ -0,0 +1,34 @@ +From 06e472acf964649a58b7de35fc9cdc3151acb970 Mon Sep 17 00:00:00 2001 +From: Sreekanth Reddy +Date: Fri, 28 Oct 2022 14:46:55 +0530 +Subject: scsi: mpt3sas: Remove usage of dma_get_required_mask() API + +From: Sreekanth Reddy + +commit 06e472acf964649a58b7de35fc9cdc3151acb970 upstream. + +Remove the usage of dma_get_required_mask() API. Directly set the DMA mask +to 63/64 if the system is a 64bit machine. + +Signed-off-by: Sreekanth Reddy +Link: https://lore.kernel.org/r/20221028091655.17741-2-sreekanth.reddy@broadcom.com +Reviewed-by: Christoph Hellwig +Signed-off-by: Martin K. Petersen +Cc: Salvatore Bonaccorso +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -2992,8 +2992,7 @@ _base_config_dma_addressing(struct MPT3S + struct sysinfo s; + u64 coherent_dma_mask, dma_mask; + +- if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 || +- dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) { ++ if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4) { + ioc->dma_mask = 32; + coherent_dma_mask = dma_mask = DMA_BIT_MASK(32); + /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */ diff --git a/queue-6.1/series b/queue-6.1/series index a5a739ec84a..0a5ef020239 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -648,3 +648,13 @@ nfsd-don-t-hand-out-delegation-on-setuid-files-being.patch cifs-prevent-data-race-in-smb2_reconnect.patch drm-shmem-helper-revert-accidental-non-gpl-export.patch driver-core-fw_devlink-avoid-spurious-error-message.patch +wifi-rtl8xxxu-fixing-transmisison-failure-for-rtl8192eu.patch +scsi-mpt3sas-remove-usage-of-dma_get_required_mask-api.patch +firmware-coreboot-framebuffer-ignore-reserved-pixel-color-bits.patch +block-don-t-allow-multiple-bios-for-iocb_nowait-issue.patch +block-clear-bio-bi_bdev-when-putting-a-bio-back-in-the-cache.patch +block-be-a-bit-more-careful-in-checking-for-null-bdev-while-polling.patch +rtc-pm8xxx-fix-set-alarm-race.patch +ipmi-ipmb-fix-the-module_parm_desc-associated-to-retry_time_ms.patch +ipmi-ssif-resend_msg-cannot-fail.patch +ipmi_ssif-rename-idle-state-and-check.patch diff --git a/queue-6.1/wifi-rtl8xxxu-fixing-transmisison-failure-for-rtl8192eu.patch b/queue-6.1/wifi-rtl8xxxu-fixing-transmisison-failure-for-rtl8192eu.patch new file mode 100644 index 00000000000..d3d846f5a69 --- /dev/null +++ b/queue-6.1/wifi-rtl8xxxu-fixing-transmisison-failure-for-rtl8192eu.patch @@ -0,0 +1,36 @@ +From c6015bf3ff1ffb3caa27eb913797438a0fc634a0 Mon Sep 17 00:00:00 2001 +From: Jun ASAKA +Date: Sat, 17 Dec 2022 11:06:59 +0800 +Subject: wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu + +From: Jun ASAKA + +commit c6015bf3ff1ffb3caa27eb913797438a0fc634a0 upstream. + +Fixing transmission failure which results in +"authentication with ... timed out". This can be +fixed by disable the REG_TXPAUSE. + +Signed-off-by: Jun ASAKA +Reviewed-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221217030659.12577-1-JunASAKA@zzy040330.moe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c +@@ -1669,6 +1669,11 @@ static void rtl8192e_enable_rf(struct rt + val8 = rtl8xxxu_read8(priv, REG_PAD_CTRL1); + val8 &= ~BIT(0); + rtl8xxxu_write8(priv, REG_PAD_CTRL1, val8); ++ ++ /* ++ * Fix transmission failure of rtl8192e. ++ */ ++ rtl8xxxu_write8(priv, REG_TXPAUSE, 0x00); + } + + struct rtl8xxxu_fileops rtl8192eu_fops = {