From: Sasha Levin Date: Sun, 21 Apr 2024 17:10:11 +0000 (-0400) Subject: Fixes for 6.6 X-Git-Tag: v5.15.157~57 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e036f6039c4643f4926fc43fb19119a37f3f43a8;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.6 Signed-off-by: Sasha Levin --- diff --git a/queue-6.6/drm-i915-mst-limit-mst-dsc-to-tgl.patch b/queue-6.6/drm-i915-mst-limit-mst-dsc-to-tgl.patch new file mode 100644 index 00000000000..2ebd71b0d2a --- /dev/null +++ b/queue-6.6/drm-i915-mst-limit-mst-dsc-to-tgl.patch @@ -0,0 +1,61 @@ +From bab406ea08418bb337bda3536337d3664893071b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Apr 2024 16:51:46 +0300 +Subject: drm/i915/mst: Limit MST+DSC to TGL+ +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +[ Upstream commit 51bc63392e96ca45d7be98bc43c180b174ffca09 ] + +The MST code currently assumes that glk+ already supports MST+DSC, +which is incorrect. We need to check for TGL+ actually. ICL does +support SST+DSC, but supposedly it can't do MST+FEC which will +also rule out MST+DSC. + +Note that a straight TGL+ check doesn't work here because DSC +support can get fused out, so we do need to also check 'has_dsc'. + +Cc: stable@vger.kernel.org +Fixes: d51f25eb479a ("drm/i915: Add DSC support to MST path") +Reviewed-by: Uma Shankar +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20240402135148.23011-6-ville.syrjala@linux.intel.com +(cherry picked from commit c9c92f286dbdf872390ef3e74dbe5f0641e46f55) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_display_device.h | 1 + + drivers/gpu/drm/i915/display/intel_dp_mst.c | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_display_device.h b/drivers/gpu/drm/i915/display/intel_display_device.h +index 215e682bd8b7a..5fd07c1817766 100644 +--- a/drivers/gpu/drm/i915/display/intel_display_device.h ++++ b/drivers/gpu/drm/i915/display/intel_display_device.h +@@ -46,6 +46,7 @@ struct drm_printer; + #define HAS_DPT(i915) (DISPLAY_VER(i915) >= 13) + #define HAS_DSB(i915) (DISPLAY_INFO(i915)->has_dsb) + #define HAS_DSC(__i915) (DISPLAY_RUNTIME_INFO(__i915)->has_dsc) ++#define HAS_DSC_MST(__i915) (DISPLAY_VER(__i915) >= 12 && HAS_DSC(__i915)) + #define HAS_FBC(i915) (DISPLAY_RUNTIME_INFO(i915)->fbc_mask != 0) + #define HAS_FPGA_DBG_UNCLAIMED(i915) (DISPLAY_INFO(i915)->has_fpga_dbg) + #define HAS_FW_BLC(i915) (DISPLAY_VER(i915) > 2) +diff --git a/drivers/gpu/drm/i915/display/intel_dp_mst.c b/drivers/gpu/drm/i915/display/intel_dp_mst.c +index f104bd7f8c2a6..d2f8f20722d92 100644 +--- a/drivers/gpu/drm/i915/display/intel_dp_mst.c ++++ b/drivers/gpu/drm/i915/display/intel_dp_mst.c +@@ -964,7 +964,7 @@ intel_dp_mst_mode_valid_ctx(struct drm_connector *connector, + return 0; + } + +- if (DISPLAY_VER(dev_priv) >= 10 && ++ if (HAS_DSC_MST(dev_priv) && + drm_dp_sink_supports_dsc(intel_dp->dsc_dpcd)) { + /* + * TBD pass the connector BPC, +-- +2.43.0 + diff --git a/queue-6.6/drm-nv04-fix-out-of-bounds-access.patch b/queue-6.6/drm-nv04-fix-out-of-bounds-access.patch new file mode 100644 index 00000000000..372b9cd9443 --- /dev/null +++ b/queue-6.6/drm-nv04-fix-out-of-bounds-access.patch @@ -0,0 +1,86 @@ +From 5def9fc81b92df048e51783fcdfbb6c50e312924 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Apr 2024 14:08:52 +0300 +Subject: drm: nv04: Fix out of bounds access + +From: Mikhail Kobuk + +[ Upstream commit cf92bb778eda7830e79452c6917efa8474a30c1e ] + +When Output Resource (dcb->or) value is assigned in +fabricate_dcb_output(), there may be out of bounds access to +dac_users array in case dcb->or is zero because ffs(dcb->or) is +used as index there. +The 'or' argument of fabricate_dcb_output() must be interpreted as a +number of bit to set, not value. + +Utilize macros from 'enum nouveau_or' in calls instead of hardcoding. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 2e5702aff395 ("drm/nouveau: fabricate DCB encoder table for iMac G4") +Fixes: 670820c0e6a9 ("drm/nouveau: Workaround incorrect DCB entry on a GeForce3 Ti 200.") +Signed-off-by: Mikhail Kobuk +Signed-off-by: Danilo Krummrich +Link: https://patchwork.freedesktop.org/patch/msgid/20240411110854.16701-1-m.kobuk@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nouveau_bios.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c +index 189903b65edc9..48cf593383b34 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_bios.c ++++ b/drivers/gpu/drm/nouveau/nouveau_bios.c +@@ -23,6 +23,7 @@ + */ + + #include "nouveau_drv.h" ++#include "nouveau_bios.h" + #include "nouveau_reg.h" + #include "dispnv04/hw.h" + #include "nouveau_encoder.h" +@@ -1675,7 +1676,7 @@ apply_dcb_encoder_quirks(struct drm_device *dev, int idx, u32 *conn, u32 *conf) + */ + if (nv_match_device(dev, 0x0201, 0x1462, 0x8851)) { + if (*conn == 0xf2005014 && *conf == 0xffffffff) { +- fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 1, 1, 1); ++ fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 1, 1, DCB_OUTPUT_B); + return false; + } + } +@@ -1761,26 +1762,26 @@ fabricate_dcb_encoder_table(struct drm_device *dev, struct nvbios *bios) + #ifdef __powerpc__ + /* Apple iMac G4 NV17 */ + if (of_machine_is_compatible("PowerMac4,5")) { +- fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 0, all_heads, 1); +- fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, 1, all_heads, 2); ++ fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 0, all_heads, DCB_OUTPUT_B); ++ fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, 1, all_heads, DCB_OUTPUT_C); + return; + } + #endif + + /* Make up some sane defaults */ + fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, +- bios->legacy.i2c_indices.crt, 1, 1); ++ bios->legacy.i2c_indices.crt, 1, DCB_OUTPUT_B); + + if (nv04_tv_identify(dev, bios->legacy.i2c_indices.tv) >= 0) + fabricate_dcb_output(dcb, DCB_OUTPUT_TV, + bios->legacy.i2c_indices.tv, +- all_heads, 0); ++ all_heads, DCB_OUTPUT_A); + + else if (bios->tmds.output0_script_ptr || + bios->tmds.output1_script_ptr) + fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, + bios->legacy.i2c_indices.panel, +- all_heads, 1); ++ all_heads, DCB_OUTPUT_B); + } + + static int +-- +2.43.0 + diff --git a/queue-6.6/drm-panel-visionox-rm69299-don-t-unregister-dsi-devi.patch b/queue-6.6/drm-panel-visionox-rm69299-don-t-unregister-dsi-devi.patch new file mode 100644 index 00000000000..bf838498db9 --- /dev/null +++ b/queue-6.6/drm-panel-visionox-rm69299-don-t-unregister-dsi-devi.patch @@ -0,0 +1,38 @@ +From 2096c9d2c4a40675fd496bfdd0b4a31719a99f18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Apr 2024 13:07:59 +0300 +Subject: drm/panel: visionox-rm69299: don't unregister DSI device + +From: Dmitry Baryshkov + +[ Upstream commit 9e4d3f4f34455abbaa9930bf6b7575a5cd081496 ] + +The DSI device for the panel was registered by the DSI host, so it is an +error to unregister it from the panel driver. Drop the call to +mipi_dsi_device_unregister(). + +Fixes: c7f66d32dd43 ("drm/panel: add support for rm69299 visionox panel") +Reviewed-by: Jessica Zhang +Signed-off-by: Dmitry Baryshkov +Link: https://patchwork.freedesktop.org/patch/msgid/20240404-drop-panel-unregister-v1-1-9f56953c5fb9@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-visionox-rm69299.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/panel/panel-visionox-rm69299.c b/drivers/gpu/drm/panel/panel-visionox-rm69299.c +index c2806e4fd553b..6e946e5a036ee 100644 +--- a/drivers/gpu/drm/panel/panel-visionox-rm69299.c ++++ b/drivers/gpu/drm/panel/panel-visionox-rm69299.c +@@ -261,8 +261,6 @@ static void visionox_rm69299_remove(struct mipi_dsi_device *dsi) + struct visionox_rm69299 *ctx = mipi_dsi_get_drvdata(dsi); + + mipi_dsi_detach(ctx->dsi); +- mipi_dsi_device_unregister(ctx->dsi); +- + drm_panel_remove(&ctx->panel); + } + +-- +2.43.0 + diff --git a/queue-6.6/drm-radeon-make-fstrict-flex-arrays-3-happy.patch b/queue-6.6/drm-radeon-make-fstrict-flex-arrays-3-happy.patch new file mode 100644 index 00000000000..a0ad5f46bf1 --- /dev/null +++ b/queue-6.6/drm-radeon-make-fstrict-flex-arrays-3-happy.patch @@ -0,0 +1,50 @@ +From 80987753e51509771ef069b99ab80e3176fe894e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Apr 2024 22:06:08 -0400 +Subject: drm/radeon: make -fstrict-flex-arrays=3 happy +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +[ Upstream commit 0ba753bc7e79e49556e81b0d09b2de1aa558553b ] + +The driver parses a union where the layout up through the first +array is the same, however, the array has different sizes +depending on the elements in the union. Be explicit to +fix the UBSAN checker. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3323 +Fixes: df8fc4e934c1 ("kbuild: Enable -fstrict-flex-arrays=3") +Acked-by: Christian König +Reviewed-by: Kees Cook +Signed-off-by: Alex Deucher +Cc: Kees Cook +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/radeon_atombios.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c +index 85c4bb186203c..061396e7fa0f9 100644 +--- a/drivers/gpu/drm/radeon/radeon_atombios.c ++++ b/drivers/gpu/drm/radeon/radeon_atombios.c +@@ -922,8 +922,12 @@ bool radeon_get_atom_connector_info_from_supported_devices_table(struct + max_device = ATOM_MAX_SUPPORTED_DEVICE_INFO; + + for (i = 0; i < max_device; i++) { +- ATOM_CONNECTOR_INFO_I2C ci = +- supported_devices->info.asConnInfo[i]; ++ ATOM_CONNECTOR_INFO_I2C ci; ++ ++ if (frev > 1) ++ ci = supported_devices->info_2d1.asConnInfo[i]; ++ else ++ ci = supported_devices->info.asConnInfo[i]; + + bios_connectors[i].valid = false; + +-- +2.43.0 + diff --git a/queue-6.6/perf-lock-contention-add-a-missing-null-check.patch b/queue-6.6/perf-lock-contention-add-a-missing-null-check.patch new file mode 100644 index 00000000000..66212f7bf6c --- /dev/null +++ b/queue-6.6/perf-lock-contention-add-a-missing-null-check.patch @@ -0,0 +1,66 @@ +From cfb4ae6f584aef4be02e0e78b439cdb042f963fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Apr 2024 15:55:42 -0700 +Subject: perf lock contention: Add a missing NULL check + +From: Namhyung Kim + +[ Upstream commit f3408580bac8ce5cd76e7391e529c0a22e7c7eb2 ] + +I got a report for a failure in BPF verifier on a recent kernel with +perf lock contention command. It checks task->sighand->siglock without +checking if sighand is NULL or not. Let's add one. + + ; if (&curr->sighand->siglock == (void *)lock) + 265: (79) r1 = *(u64 *)(r0 +2624) ; frame1: R0_w=trusted_ptr_task_struct(off=0,imm=0) + ; R1_w=rcu_ptr_or_null_sighand_struct(off=0,imm=0) + 266: (b7) r2 = 0 ; frame1: R2_w=0 + 267: (0f) r1 += r2 + R1 pointer arithmetic on rcu_ptr_or_null_ prohibited, null-check it first + processed 164 insns (limit 1000000) max_states_per_insn 1 total_states 15 peak_states 15 mark_read 5 + -- END PROG LOAD LOG -- + libbpf: prog 'contention_end': failed to load: -13 + libbpf: failed to load object 'lock_contention_bpf' + libbpf: failed to load BPF skeleton 'lock_contention_bpf': -13 + Failed to load lock-contention BPF skeleton + lock contention BPF setup failed + lock contention did not detect any lock contention + +Fixes: 1811e82767dcc ("perf lock contention: Track and show siglock with address") +Reviewed-by: Ian Rogers +Acked-by: Arnaldo Carvalho de Melo +Cc: Song Liu +Cc: bpf@vger.kernel.org +Signed-off-by: Namhyung Kim +Link: https://lore.kernel.org/r/20240409225542.1870999-1-namhyung@kernel.org +Signed-off-by: Sasha Levin +--- + tools/perf/util/bpf_skel/lock_contention.bpf.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/bpf_skel/lock_contention.bpf.c b/tools/perf/util/bpf_skel/lock_contention.bpf.c +index 8d3cfbb3cc65b..473106c72c695 100644 +--- a/tools/perf/util/bpf_skel/lock_contention.bpf.c ++++ b/tools/perf/util/bpf_skel/lock_contention.bpf.c +@@ -238,6 +238,7 @@ static inline __u32 check_lock_type(__u64 lock, __u32 flags) + struct task_struct *curr; + struct mm_struct___old *mm_old; + struct mm_struct___new *mm_new; ++ struct sighand_struct *sighand; + + switch (flags) { + case LCB_F_READ: /* rwsem */ +@@ -259,7 +260,9 @@ static inline __u32 check_lock_type(__u64 lock, __u32 flags) + break; + case LCB_F_SPIN: /* spinlock */ + curr = bpf_get_current_task_btf(); +- if (&curr->sighand->siglock == (void *)lock) ++ sighand = curr->sighand; ++ ++ if (sighand && &sighand->siglock == (void *)lock) + return LCD_F_SIGHAND_LOCK; + break; + default: +-- +2.43.0 + diff --git a/queue-6.6/rdma-cm-print-the-old-state-when-cm_destroy_id-gets-.patch b/queue-6.6/rdma-cm-print-the-old-state-when-cm_destroy_id-gets-.patch new file mode 100644 index 00000000000..4dc6ef23434 --- /dev/null +++ b/queue-6.6/rdma-cm-print-the-old-state-when-cm_destroy_id-gets-.patch @@ -0,0 +1,67 @@ +From d2448b8a5eb6ad0d99c7d24bb8258d67b0d75592 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Mar 2024 13:20:49 +0200 +Subject: RDMA/cm: Print the old state when cm_destroy_id gets timeout + +From: Mark Zhang + +[ Upstream commit b68e1acb5834ed1a2ad42d9d002815a8bae7c0b6 ] + +The old state is helpful for debugging, as the current state is always +IB_CM_IDLE when timeout happens. + +Fixes: 96d9cbe2f2ff ("RDMA/cm: add timeout to cm_destroy_id wait") +Signed-off-by: Mark Zhang +Link: https://lore.kernel.org/r/20240322112049.2022994-1-markzhang@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cm.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index bf0df6ee4f785..07fb8d3c037f0 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -1026,23 +1026,26 @@ static void cm_reset_to_idle(struct cm_id_private *cm_id_priv) + } + } + +-static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id) ++static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id, ++ enum ib_cm_state old_state) + { + struct cm_id_private *cm_id_priv; + + cm_id_priv = container_of(cm_id, struct cm_id_private, id); +- pr_err("%s: cm_id=%p timed out. state=%d refcnt=%d\n", __func__, +- cm_id, cm_id->state, refcount_read(&cm_id_priv->refcount)); ++ pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__, ++ cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount)); + } + + static void cm_destroy_id(struct ib_cm_id *cm_id, int err) + { + struct cm_id_private *cm_id_priv; ++ enum ib_cm_state old_state; + struct cm_work *work; + int ret; + + cm_id_priv = container_of(cm_id, struct cm_id_private, id); + spin_lock_irq(&cm_id_priv->lock); ++ old_state = cm_id->state; + retest: + switch (cm_id->state) { + case IB_CM_LISTEN: +@@ -1151,7 +1154,7 @@ static void cm_destroy_id(struct ib_cm_id *cm_id, int err) + msecs_to_jiffies( + CM_DESTROY_ID_WAIT_TIMEOUT)); + if (!ret) /* timeout happened */ +- cm_destroy_id_wait_timeout(cm_id); ++ cm_destroy_id_wait_timeout(cm_id, old_state); + } while (!ret); + + while ((work = cm_dequeue_work(cm_id_priv)) != NULL) +-- +2.43.0 + diff --git a/queue-6.6/rdma-mlx5-fix-port-number-for-counter-query-in-multi.patch b/queue-6.6/rdma-mlx5-fix-port-number-for-counter-query-in-multi.patch new file mode 100644 index 00000000000..e540600e75b --- /dev/null +++ b/queue-6.6/rdma-mlx5-fix-port-number-for-counter-query-in-multi.patch @@ -0,0 +1,41 @@ +From 04fbbb180d28ada935412f7f25dcf705b04592b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 12:03:46 +0300 +Subject: RDMA/mlx5: Fix port number for counter query in multi-port + configuration + +From: Michael Guralnik + +[ Upstream commit be121ffb384f53e966ee7299ffccc6eeb61bc73d ] + +Set the correct port when querying PPCNT in multi-port configuration. +Distinguish between cases where switchdev mode was enabled to multi-port +configuration and don't overwrite the queried port to 1 in multi-port +case. + +Fixes: 74b30b3ad5ce ("RDMA/mlx5: Set local port to one when accessing counters") +Signed-off-by: Michael Guralnik +Link: https://lore.kernel.org/r/9bfcc8ade958b760a51408c3ad654a01b11f7d76.1712134988.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/mad.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/mad.c b/drivers/infiniband/hw/mlx5/mad.c +index 8102ef113b7e0..64dae68c43e62 100644 +--- a/drivers/infiniband/hw/mlx5/mad.c ++++ b/drivers/infiniband/hw/mlx5/mad.c +@@ -188,7 +188,8 @@ static int process_pma_cmd(struct mlx5_ib_dev *dev, u32 port_num, + mdev = dev->mdev; + mdev_port_num = 1; + } +- if (MLX5_CAP_GEN(dev->mdev, num_ports) == 1) { ++ if (MLX5_CAP_GEN(dev->mdev, num_ports) == 1 && ++ !mlx5_core_mp_enabled(mdev)) { + /* set local port to one for Function-Per-Port HCA. */ + mdev = dev->mdev; + mdev_port_num = 1; +-- +2.43.0 + diff --git a/queue-6.6/rdma-rxe-fix-the-problem-mutex_destroy-missing.patch b/queue-6.6/rdma-rxe-fix-the-problem-mutex_destroy-missing.patch new file mode 100644 index 00000000000..40b1acf45cc --- /dev/null +++ b/queue-6.6/rdma-rxe-fix-the-problem-mutex_destroy-missing.patch @@ -0,0 +1,38 @@ +From 5474aa3f575eefb0c81a7aba05222d72b4b2cf1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 07:51:40 +0100 +Subject: RDMA/rxe: Fix the problem "mutex_destroy missing" + +From: Yanjun.Zhu + +[ Upstream commit 481047d7e8391d3842ae59025806531cdad710d9 ] + +When a mutex lock is not used any more, the function mutex_destroy +should be called to mark the mutex lock uninitialized. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Signed-off-by: Yanjun.Zhu +Link: https://lore.kernel.org/r/20240314065140.27468-1-yanjun.zhu@linux.dev +Reviewed-by: Daisuke Matsuda +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c +index 54c723a6eddac..6f9ec8db014c7 100644 +--- a/drivers/infiniband/sw/rxe/rxe.c ++++ b/drivers/infiniband/sw/rxe/rxe.c +@@ -33,6 +33,8 @@ void rxe_dealloc(struct ib_device *ib_dev) + + if (rxe->tfm) + crypto_free_shash(rxe->tfm); ++ ++ mutex_destroy(&rxe->usdev_lock); + } + + /* initialize rxe device parameters */ +-- +2.43.0 + diff --git a/queue-6.6/s390-cio-fix-race-condition-during-online-processing.patch b/queue-6.6/s390-cio-fix-race-condition-during-online-processing.patch new file mode 100644 index 00000000000..18f701fced4 --- /dev/null +++ b/queue-6.6/s390-cio-fix-race-condition-during-online-processing.patch @@ -0,0 +1,72 @@ +From 57ffb8b547770a10e9f06dcc5e6ca80f163cf326 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 11:46:19 +0200 +Subject: s390/cio: fix race condition during online processing + +From: Peter Oberparleiter + +[ Upstream commit 2d8527f2f911fab84aec04df4788c0c23af3df48 ] + +A race condition exists in ccw_device_set_online() that can cause the +online process to fail, leaving the affected device in an inconsistent +state. As a result, subsequent attempts to set that device online fail +with return code ENODEV. + +The problem occurs when a path verification request arrives after +a wait for final device state completed, but before the result state +is evaluated. + +Fix this by ensuring that the CCW-device lock is held between +determining final state and checking result state. + +Note that since: + +commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers") + +path verification requests are much more likely to occur during boot, +resulting in an increased chance of this race condition occurring. + +Fixes: 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers") +Reviewed-by: Alexandra Winter +Reviewed-by: Vineeth Vijayan +Signed-off-by: Peter Oberparleiter +Signed-off-by: Alexander Gordeev +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/device.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c +index 4ca5adce91079..57e0050dbaa53 100644 +--- a/drivers/s390/cio/device.c ++++ b/drivers/s390/cio/device.c +@@ -363,10 +363,8 @@ int ccw_device_set_online(struct ccw_device *cdev) + + spin_lock_irq(cdev->ccwlock); + ret = ccw_device_online(cdev); +- spin_unlock_irq(cdev->ccwlock); +- if (ret == 0) +- wait_event(cdev->private->wait_q, dev_fsm_final_state(cdev)); +- else { ++ if (ret) { ++ spin_unlock_irq(cdev->ccwlock); + CIO_MSG_EVENT(0, "ccw_device_online returned %d, " + "device 0.%x.%04x\n", + ret, cdev->private->dev_id.ssid, +@@ -375,7 +373,12 @@ int ccw_device_set_online(struct ccw_device *cdev) + put_device(&cdev->dev); + return ret; + } +- spin_lock_irq(cdev->ccwlock); ++ /* Wait until a final state is reached */ ++ while (!dev_fsm_final_state(cdev)) { ++ spin_unlock_irq(cdev->ccwlock); ++ wait_event(cdev->private->wait_q, dev_fsm_final_state(cdev)); ++ spin_lock_irq(cdev->ccwlock); ++ } + /* Check if online processing was successful */ + if ((cdev->private->state != DEV_STATE_ONLINE) && + (cdev->private->state != DEV_STATE_W4SENSE)) { +-- +2.43.0 + diff --git a/queue-6.6/s390-qdio-handle-deferred-cc1.patch b/queue-6.6/s390-qdio-handle-deferred-cc1.patch new file mode 100644 index 00000000000..6cd1886e77a --- /dev/null +++ b/queue-6.6/s390-qdio-handle-deferred-cc1.patch @@ -0,0 +1,121 @@ +From a79b341b0bc5fcc5c5ae186659c1466ed360f8fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 11:46:18 +0200 +Subject: s390/qdio: handle deferred cc1 + +From: Peter Oberparleiter + +[ Upstream commit 607638faf2ff1cede37458111496e7cc6c977f6f ] + +A deferred condition code 1 response indicates that I/O was not started +and should be retried. The current QDIO implementation handles a cc1 +response as I/O error, resulting in a failed QDIO setup. This can happen +for example when a path verification request arrives at the same time +as QDIO setup I/O is started. + +Fix this by retrying the QDIO setup I/O when a cc1 response is received. + +Note that since + +commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers") +commit 5ef1dc40ffa6 ("s390/cio: fix invalid -EBUSY on ccw_device_start") + +deferred cc1 responses are much more likely to occur. See the commit +message of the latter for more background information. + +Fixes: 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers") +Reviewed-by: Alexandra Winter +Signed-off-by: Peter Oberparleiter +Signed-off-by: Alexander Gordeev +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/qdio_main.c | 28 +++++++++++++++++++++++----- + 1 file changed, 23 insertions(+), 5 deletions(-) + +diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c +index 9cde55730b65a..ebcb535809882 100644 +--- a/drivers/s390/cio/qdio_main.c ++++ b/drivers/s390/cio/qdio_main.c +@@ -722,8 +722,8 @@ static void qdio_handle_activate_check(struct qdio_irq *irq_ptr, + lgr_info_log(); + } + +-static void qdio_establish_handle_irq(struct qdio_irq *irq_ptr, int cstat, +- int dstat) ++static int qdio_establish_handle_irq(struct qdio_irq *irq_ptr, int cstat, ++ int dstat, int dcc) + { + DBF_DEV_EVENT(DBF_INFO, irq_ptr, "qest irq"); + +@@ -731,15 +731,18 @@ static void qdio_establish_handle_irq(struct qdio_irq *irq_ptr, int cstat, + goto error; + if (dstat & ~(DEV_STAT_DEV_END | DEV_STAT_CHN_END)) + goto error; ++ if (dcc == 1) ++ return -EAGAIN; + if (!(dstat & DEV_STAT_DEV_END)) + goto error; + qdio_set_state(irq_ptr, QDIO_IRQ_STATE_ESTABLISHED); +- return; ++ return 0; + + error: + DBF_ERROR("%4x EQ:error", irq_ptr->schid.sch_no); + DBF_ERROR("ds: %2x cs:%2x", dstat, cstat); + qdio_set_state(irq_ptr, QDIO_IRQ_STATE_ERR); ++ return -EIO; + } + + /* qdio interrupt handler */ +@@ -748,7 +751,7 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm, + { + struct qdio_irq *irq_ptr = cdev->private->qdio_data; + struct subchannel_id schid; +- int cstat, dstat; ++ int cstat, dstat, rc, dcc; + + if (!intparm || !irq_ptr) { + ccw_device_get_schid(cdev, &schid); +@@ -768,10 +771,12 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm, + qdio_irq_check_sense(irq_ptr, irb); + cstat = irb->scsw.cmd.cstat; + dstat = irb->scsw.cmd.dstat; ++ dcc = scsw_cmd_is_valid_cc(&irb->scsw) ? irb->scsw.cmd.cc : 0; ++ rc = 0; + + switch (irq_ptr->state) { + case QDIO_IRQ_STATE_INACTIVE: +- qdio_establish_handle_irq(irq_ptr, cstat, dstat); ++ rc = qdio_establish_handle_irq(irq_ptr, cstat, dstat, dcc); + break; + case QDIO_IRQ_STATE_CLEANUP: + qdio_set_state(irq_ptr, QDIO_IRQ_STATE_INACTIVE); +@@ -785,12 +790,25 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm, + if (cstat || dstat) + qdio_handle_activate_check(irq_ptr, intparm, cstat, + dstat); ++ else if (dcc == 1) ++ rc = -EAGAIN; + break; + case QDIO_IRQ_STATE_STOPPED: + break; + default: + WARN_ON_ONCE(1); + } ++ ++ if (rc == -EAGAIN) { ++ DBF_DEV_EVENT(DBF_INFO, irq_ptr, "qint retry"); ++ rc = ccw_device_start(cdev, irq_ptr->ccw, intparm, 0, 0); ++ if (!rc) ++ return; ++ DBF_ERROR("%4x RETRY ERR", irq_ptr->schid.sch_no); ++ DBF_ERROR("rc:%4x", rc); ++ qdio_set_state(irq_ptr, QDIO_IRQ_STATE_ERR); ++ } ++ + wake_up(&cdev->private->wait_q); + } + +-- +2.43.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 75585c15b23..14801d820de 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -56,3 +56,13 @@ s390-ism-properly-fix-receive-message-buffer-allocat.patch gpiolib-swnode-remove-wrong-header-inclusion.patch net-ethernet-mtk_eth_soc-fix-wed-wifi-reset.patch net-ethernet-ti-am65-cpsw-nuss-cleanup-dma-channels-.patch +drm-i915-mst-limit-mst-dsc-to-tgl.patch +rdma-rxe-fix-the-problem-mutex_destroy-missing.patch +rdma-cm-print-the-old-state-when-cm_destroy_id-gets-.patch +rdma-mlx5-fix-port-number-for-counter-query-in-multi.patch +perf-lock-contention-add-a-missing-null-check.patch +s390-qdio-handle-deferred-cc1.patch +s390-cio-fix-race-condition-during-online-processing.patch +drm-nv04-fix-out-of-bounds-access.patch +drm-panel-visionox-rm69299-don-t-unregister-dsi-devi.patch +drm-radeon-make-fstrict-flex-arrays-3-happy.patch