From: Sasha Levin Date: Mon, 4 Mar 2024 12:22:13 +0000 (-0500) Subject: Fixes for 6.6 X-Git-Tag: v4.19.309~29 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e7cc39ced8df6b940c01c51f26b5311876b83627;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.6 Signed-off-by: Sasha Levin --- diff --git a/queue-6.6/block-define-bvec_iter-as-__packed-__aligned-4.patch b/queue-6.6/block-define-bvec_iter-as-__packed-__aligned-4.patch new file mode 100644 index 00000000000..d0e0b44a022 --- /dev/null +++ b/queue-6.6/block-define-bvec_iter-as-__packed-__aligned-4.patch @@ -0,0 +1,44 @@ +From 5e40ef2c37cfe391545a36998bca655b24a69a3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Feb 2024 11:01:41 +0800 +Subject: block: define bvec_iter as __packed __aligned(4) + +From: Ming Lei + +[ Upstream commit 7838b4656110d950afdd92a081cc0f33e23e0ea8 ] + +In commit 19416123ab3e ("block: define 'struct bvec_iter' as packed"), +what we need is to save the 4byte padding, and avoid `bio` to spread on +one extra cache line. + +It is enough to define it as '__packed __aligned(4)', as '__packed' +alone means byte aligned, and can cause compiler to generate horrible +code on architectures that don't support unaligned access in case that +bvec_iter is embedded in other structures. + +Cc: Mikulas Patocka +Suggested-by: Linus Torvalds +Fixes: 19416123ab3e ("block: define 'struct bvec_iter' as packed") +Signed-off-by: Ming Lei +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/linux/bvec.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/bvec.h b/include/linux/bvec.h +index 555aae5448ae4..bd1e361b351c5 100644 +--- a/include/linux/bvec.h ++++ b/include/linux/bvec.h +@@ -83,7 +83,7 @@ struct bvec_iter { + + unsigned int bi_bvec_done; /* number of bytes completed in + current bvec */ +-} __packed; ++} __packed __aligned(4); + + struct bvec_iter_all { + struct bio_vec bv; +-- +2.43.0 + diff --git a/queue-6.6/dmaengine-dw-edma-add-hdma-remote-interrupt-configur.patch b/queue-6.6/dmaengine-dw-edma-add-hdma-remote-interrupt-configur.patch new file mode 100644 index 00000000000..0d385b27fea --- /dev/null +++ b/queue-6.6/dmaengine-dw-edma-add-hdma-remote-interrupt-configur.patch @@ -0,0 +1,40 @@ +From f303594e83a7c5c3beb2fc9c90e0bfb27842f9e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jan 2024 17:26:00 +0100 +Subject: dmaengine: dw-edma: Add HDMA remote interrupt configuration + +From: Kory Maincent + +[ Upstream commit e2f6a5789051ee9c632f27a12d0f01f0cbf78aac ] + +Only the local interruption was configured, remote interrupt was left +behind. This patch fix it by setting stop and abort remote interrupts when +the DW_EDMA_CHIP_LOCAL flag is not set. + +Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA") +Signed-off-by: Kory Maincent +Reviewed-by: Serge Semin +Acked-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20240129-b4-feature_hdma_mainline-v7-4-8e8c1acb7a46@bootlin.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw-edma/dw-hdma-v0-core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/dma/dw-edma/dw-hdma-v0-core.c b/drivers/dma/dw-edma/dw-hdma-v0-core.c +index 108f9127aaaaf..04b0bcb6ded97 100644 +--- a/drivers/dma/dw-edma/dw-hdma-v0-core.c ++++ b/drivers/dma/dw-edma/dw-hdma-v0-core.c +@@ -237,6 +237,8 @@ static void dw_hdma_v0_core_start(struct dw_edma_chunk *chunk, bool first) + tmp = GET_CH_32(dw, chan->dir, chan->id, int_setup) | + HDMA_V0_STOP_INT_MASK | HDMA_V0_ABORT_INT_MASK | + HDMA_V0_LOCAL_STOP_INT_EN | HDMA_V0_LOCAL_ABORT_INT_EN; ++ if (!(dw->chip->flags & DW_EDMA_CHIP_LOCAL)) ++ tmp |= HDMA_V0_REMOTE_STOP_INT_EN | HDMA_V0_REMOTE_ABORT_INT_EN; + SET_CH_32(dw, chan->dir, chan->id, int_setup, tmp); + /* Channel control */ + SET_CH_32(dw, chan->dir, chan->id, control1, HDMA_V0_LINKLIST_EN); +-- +2.43.0 + diff --git a/queue-6.6/dmaengine-dw-edma-edma-add-sync-read-before-starting.patch b/queue-6.6/dmaengine-dw-edma-edma-add-sync-read-before-starting.patch new file mode 100644 index 00000000000..4de94da1374 --- /dev/null +++ b/queue-6.6/dmaengine-dw-edma-edma-add-sync-read-before-starting.patch @@ -0,0 +1,65 @@ +From fcc7b40366319dc1145c78674aa398b5042c7207 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jan 2024 17:26:02 +0100 +Subject: dmaengine: dw-edma: eDMA: Add sync read before starting the DMA + transfer in remote setup + +From: Kory Maincent + +[ Upstream commit bbcc1c83f343e580c3aa1f2a8593343bf7b55bba ] + +The Linked list element and pointer are not stored in the same memory as +the eDMA controller register. If the doorbell register is toggled before +the full write of the linked list a race condition error will occur. +In remote setup we can only use a readl to the memory to assure the full +write has occurred. + +Fixes: 7e4b8a4fbe2c ("dmaengine: Add Synopsys eDMA IP version 0 support") +Reviewed-by: Serge Semin +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Kory Maincent +Link: https://lore.kernel.org/r/20240129-b4-feature_hdma_mainline-v7-6-8e8c1acb7a46@bootlin.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw-edma/dw-edma-v0-core.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/dma/dw-edma/dw-edma-v0-core.c b/drivers/dma/dw-edma/dw-edma-v0-core.c +index b38786f0ad799..b75fdaffad9a4 100644 +--- a/drivers/dma/dw-edma/dw-edma-v0-core.c ++++ b/drivers/dma/dw-edma/dw-edma-v0-core.c +@@ -346,6 +346,20 @@ static void dw_edma_v0_core_write_chunk(struct dw_edma_chunk *chunk) + dw_edma_v0_write_ll_link(chunk, i, control, chunk->ll_region.paddr); + } + ++static void dw_edma_v0_sync_ll_data(struct dw_edma_chunk *chunk) ++{ ++ /* ++ * In case of remote eDMA engine setup, the DW PCIe RP/EP internal ++ * configuration registers and application memory are normally accessed ++ * over different buses. Ensure LL-data reaches the memory before the ++ * doorbell register is toggled by issuing the dummy-read from the remote ++ * LL memory in a hope that the MRd TLP will return only after the ++ * last MWr TLP is completed ++ */ ++ if (!(chunk->chan->dw->chip->flags & DW_EDMA_CHIP_LOCAL)) ++ readl(chunk->ll_region.vaddr.io); ++} ++ + static void dw_edma_v0_core_start(struct dw_edma_chunk *chunk, bool first) + { + struct dw_edma_chan *chan = chunk->chan; +@@ -412,6 +426,9 @@ static void dw_edma_v0_core_start(struct dw_edma_chunk *chunk, bool first) + SET_CH_32(dw, chan->dir, chan->id, llp.msb, + upper_32_bits(chunk->ll_region.paddr)); + } ++ ++ dw_edma_v0_sync_ll_data(chunk); ++ + /* Doorbell */ + SET_RW_32(dw, chan->dir, doorbell, + FIELD_PREP(EDMA_V0_DOORBELL_CH_MASK, chan->id)); +-- +2.43.0 + diff --git a/queue-6.6/dmaengine-dw-edma-fix-the-ch_count-hdma-callback.patch b/queue-6.6/dmaengine-dw-edma-fix-the-ch_count-hdma-callback.patch new file mode 100644 index 00000000000..7abbe76698c --- /dev/null +++ b/queue-6.6/dmaengine-dw-edma-fix-the-ch_count-hdma-callback.patch @@ -0,0 +1,61 @@ +From 5106c7f75c03874dee012877fac3220959a49042 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jan 2024 17:25:57 +0100 +Subject: dmaengine: dw-edma: Fix the ch_count hdma callback + +From: Kory Maincent + +[ Upstream commit cd665bfc757c71e9b7e0abff0f362d8abd38a805 ] + +The current check of ch_en enabled to know the maximum number of available +hardware channels is wrong as it check the number of ch_en register set +but all of them are unset at probe. This register is set at the +dw_hdma_v0_core_start function which is run lately before a DMA transfer. + +The HDMA IP have no way to know the number of hardware channels available +like the eDMA IP, then let set it to maximum channels and let the platform +set the right number of channels. + +Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA") +Acked-by: Manivannan Sadhasivam +Reviewed-by: Serge Semin +Signed-off-by: Kory Maincent +Link: https://lore.kernel.org/r/20240129-b4-feature_hdma_mainline-v7-1-8e8c1acb7a46@bootlin.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw-edma/dw-hdma-v0-core.c | 18 ++++++------------ + 1 file changed, 6 insertions(+), 12 deletions(-) + +diff --git a/drivers/dma/dw-edma/dw-hdma-v0-core.c b/drivers/dma/dw-edma/dw-hdma-v0-core.c +index 00b735a0202ab..1f4cb7db54756 100644 +--- a/drivers/dma/dw-edma/dw-hdma-v0-core.c ++++ b/drivers/dma/dw-edma/dw-hdma-v0-core.c +@@ -65,18 +65,12 @@ static void dw_hdma_v0_core_off(struct dw_edma *dw) + + static u16 dw_hdma_v0_core_ch_count(struct dw_edma *dw, enum dw_edma_dir dir) + { +- u32 num_ch = 0; +- int id; +- +- for (id = 0; id < HDMA_V0_MAX_NR_CH; id++) { +- if (GET_CH_32(dw, id, dir, ch_en) & BIT(0)) +- num_ch++; +- } +- +- if (num_ch > HDMA_V0_MAX_NR_CH) +- num_ch = HDMA_V0_MAX_NR_CH; +- +- return (u16)num_ch; ++ /* ++ * The HDMA IP have no way to know the number of hardware channels ++ * available, we set it to maximum channels and let the platform ++ * set the right number of channels. ++ */ ++ return HDMA_V0_MAX_NR_CH; + } + + static enum dma_status dw_hdma_v0_core_ch_status(struct dw_edma_chan *chan) +-- +2.43.0 + diff --git a/queue-6.6/dmaengine-dw-edma-fix-wrong-interrupt-bit-set-for-hd.patch b/queue-6.6/dmaengine-dw-edma-fix-wrong-interrupt-bit-set-for-hd.patch new file mode 100644 index 00000000000..c6854bb6192 --- /dev/null +++ b/queue-6.6/dmaengine-dw-edma-fix-wrong-interrupt-bit-set-for-hd.patch @@ -0,0 +1,40 @@ +From 8450975a1de5f4b791a7022a2b0d0bb8ddff333c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jan 2024 17:25:58 +0100 +Subject: dmaengine: dw-edma: Fix wrong interrupt bit set for HDMA + +From: Kory Maincent + +[ Upstream commit 7b52ba8616e978bf4f38f207f11a8176517244d0 ] + +Instead of setting HDMA_V0_LOCAL_ABORT_INT_EN bit, HDMA_V0_LOCAL_STOP_INT_EN +bit got set twice, due to which the abort interrupt is not getting generated for +HDMA. Fix it by setting the correct interrupt enable bit. + +Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA") +Reviewed-by: Serge Semin +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Kory Maincent +Link: https://lore.kernel.org/r/20240129-b4-feature_hdma_mainline-v7-2-8e8c1acb7a46@bootlin.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw-edma/dw-hdma-v0-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/dw-edma/dw-hdma-v0-core.c b/drivers/dma/dw-edma/dw-hdma-v0-core.c +index 1f4cb7db54756..108f9127aaaaf 100644 +--- a/drivers/dma/dw-edma/dw-hdma-v0-core.c ++++ b/drivers/dma/dw-edma/dw-hdma-v0-core.c +@@ -236,7 +236,7 @@ static void dw_hdma_v0_core_start(struct dw_edma_chunk *chunk, bool first) + /* Interrupt enable&unmask - done, abort */ + tmp = GET_CH_32(dw, chan->dir, chan->id, int_setup) | + HDMA_V0_STOP_INT_MASK | HDMA_V0_ABORT_INT_MASK | +- HDMA_V0_LOCAL_STOP_INT_EN | HDMA_V0_LOCAL_STOP_INT_EN; ++ HDMA_V0_LOCAL_STOP_INT_EN | HDMA_V0_LOCAL_ABORT_INT_EN; + SET_CH_32(dw, chan->dir, chan->id, int_setup, tmp); + /* Channel control */ + SET_CH_32(dw, chan->dir, chan->id, control1, HDMA_V0_LINKLIST_EN); +-- +2.43.0 + diff --git a/queue-6.6/dmaengine-dw-edma-hdma-add-sync-read-before-starting.patch b/queue-6.6/dmaengine-dw-edma-hdma-add-sync-read-before-starting.patch new file mode 100644 index 00000000000..faf653caa44 --- /dev/null +++ b/queue-6.6/dmaengine-dw-edma-hdma-add-sync-read-before-starting.patch @@ -0,0 +1,65 @@ +From 385df4f2a0a36f210f77139bf5599b80259dc786 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jan 2024 17:26:01 +0100 +Subject: dmaengine: dw-edma: HDMA: Add sync read before starting the DMA + transfer in remote setup + +From: Kory Maincent + +[ Upstream commit 712a92a48158e02155b4b6b21e03a817f78c9b7e ] + +The Linked list element and pointer are not stored in the same memory as +the HDMA controller register. If the doorbell register is toggled before +the full write of the linked list a race condition error will occur. +In remote setup we can only use a readl to the memory to assure the full +write has occurred. + +Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA") +Reviewed-by: Serge Semin +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Kory Maincent +Link: https://lore.kernel.org/r/20240129-b4-feature_hdma_mainline-v7-5-8e8c1acb7a46@bootlin.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw-edma/dw-hdma-v0-core.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/dma/dw-edma/dw-hdma-v0-core.c b/drivers/dma/dw-edma/dw-hdma-v0-core.c +index 04b0bcb6ded97..10e8f0715114f 100644 +--- a/drivers/dma/dw-edma/dw-hdma-v0-core.c ++++ b/drivers/dma/dw-edma/dw-hdma-v0-core.c +@@ -222,6 +222,20 @@ static void dw_hdma_v0_core_write_chunk(struct dw_edma_chunk *chunk) + dw_hdma_v0_write_ll_link(chunk, i, control, chunk->ll_region.paddr); + } + ++static void dw_hdma_v0_sync_ll_data(struct dw_edma_chunk *chunk) ++{ ++ /* ++ * In case of remote HDMA engine setup, the DW PCIe RP/EP internal ++ * configuration registers and application memory are normally accessed ++ * over different buses. Ensure LL-data reaches the memory before the ++ * doorbell register is toggled by issuing the dummy-read from the remote ++ * LL memory in a hope that the MRd TLP will return only after the ++ * last MWr TLP is completed ++ */ ++ if (!(chunk->chan->dw->chip->flags & DW_EDMA_CHIP_LOCAL)) ++ readl(chunk->ll_region.vaddr.io); ++} ++ + static void dw_hdma_v0_core_start(struct dw_edma_chunk *chunk, bool first) + { + struct dw_edma_chan *chan = chunk->chan; +@@ -252,6 +266,9 @@ static void dw_hdma_v0_core_start(struct dw_edma_chunk *chunk, bool first) + /* Set consumer cycle */ + SET_CH_32(dw, chan->dir, chan->id, cycle_sync, + HDMA_V0_CONSUMER_CYCLE_STAT | HDMA_V0_CONSUMER_CYCLE_BIT); ++ ++ dw_hdma_v0_sync_ll_data(chunk); ++ + /* Doorbell */ + SET_CH_32(dw, chan->dir, chan->id, doorbell, HDMA_V0_DOORBELL_START); + } +-- +2.43.0 + diff --git a/queue-6.6/dmaengine-dw-edma-hdma_v0_remotel_stop_int_en-typo-f.patch b/queue-6.6/dmaengine-dw-edma-hdma_v0_remotel_stop_int_en-typo-f.patch new file mode 100644 index 00000000000..aff67d3ac38 --- /dev/null +++ b/queue-6.6/dmaengine-dw-edma-hdma_v0_remotel_stop_int_en-typo-f.patch @@ -0,0 +1,38 @@ +From 97c86c99273e40ea6864de478a9ad26883515f7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jan 2024 17:25:59 +0100 +Subject: dmaengine: dw-edma: HDMA_V0_REMOTEL_STOP_INT_EN typo fix + +From: Kory Maincent + +[ Upstream commit 930a8a015dcfde4b8906351ff081066dc277748c ] + +Fix "HDMA_V0_REMOTEL_STOP_INT_EN" typo error + +Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA") +Reviewed-by: Serge Semin +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Kory Maincent +Link: https://lore.kernel.org/r/20240129-b4-feature_hdma_mainline-v7-3-8e8c1acb7a46@bootlin.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw-edma/dw-hdma-v0-regs.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/dw-edma/dw-hdma-v0-regs.h b/drivers/dma/dw-edma/dw-hdma-v0-regs.h +index a974abdf8aaf5..eab5fd7177e54 100644 +--- a/drivers/dma/dw-edma/dw-hdma-v0-regs.h ++++ b/drivers/dma/dw-edma/dw-hdma-v0-regs.h +@@ -15,7 +15,7 @@ + #define HDMA_V0_LOCAL_ABORT_INT_EN BIT(6) + #define HDMA_V0_REMOTE_ABORT_INT_EN BIT(5) + #define HDMA_V0_LOCAL_STOP_INT_EN BIT(4) +-#define HDMA_V0_REMOTEL_STOP_INT_EN BIT(3) ++#define HDMA_V0_REMOTE_STOP_INT_EN BIT(3) + #define HDMA_V0_ABORT_INT_MASK BIT(2) + #define HDMA_V0_STOP_INT_MASK BIT(0) + #define HDMA_V0_LINKLIST_EN BIT(0) +-- +2.43.0 + diff --git a/queue-6.6/dmaengine-idxd-ensure-safe-user-copy-of-completion-r.patch b/queue-6.6/dmaengine-idxd-ensure-safe-user-copy-of-completion-r.patch new file mode 100644 index 00000000000..13430b0f98c --- /dev/null +++ b/queue-6.6/dmaengine-idxd-ensure-safe-user-copy-of-completion-r.patch @@ -0,0 +1,116 @@ +From 46d60fa73b68dec4492bbbf1def33f3bf01bfc9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Feb 2024 11:14:12 -0800 +Subject: dmaengine: idxd: Ensure safe user copy of completion record + +From: Fenghua Yu + +[ Upstream commit d3ea125df37dc37972d581b74a5d3785c3f283ab ] + +If CONFIG_HARDENED_USERCOPY is enabled, copying completion record from +event log cache to user triggers a kernel bug. + +[ 1987.159822] usercopy: Kernel memory exposure attempt detected from SLUB object 'dsa0' (offset 74, size 31)! +[ 1987.170845] ------------[ cut here ]------------ +[ 1987.176086] kernel BUG at mm/usercopy.c:102! +[ 1987.180946] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI +[ 1987.186866] CPU: 17 PID: 528 Comm: kworker/17:1 Not tainted 6.8.0-rc2+ #5 +[ 1987.194537] Hardware name: Intel Corporation AvenueCity/AvenueCity, BIOS BHSDCRB1.86B.2492.D03.2307181620 07/18/2023 +[ 1987.206405] Workqueue: wq0.0 idxd_evl_fault_work [idxd] +[ 1987.212338] RIP: 0010:usercopy_abort+0x72/0x90 +[ 1987.217381] Code: 58 65 9c 50 48 c7 c2 17 85 61 9c 57 48 c7 c7 98 fd 6b 9c 48 0f 44 d6 48 c7 c6 b3 08 62 9c 4c 89 d1 49 0f 44 f3 e8 1e 2e d5 ff <0f> 0b 49 c7 c1 9e 42 61 9c 4c 89 cf 4d 89 c8 eb a9 66 66 2e 0f 1f +[ 1987.238505] RSP: 0018:ff62f5cf20607d60 EFLAGS: 00010246 +[ 1987.244423] RAX: 000000000000005f RBX: 000000000000001f RCX: 0000000000000000 +[ 1987.252480] RDX: 0000000000000000 RSI: ffffffff9c61429e RDI: 00000000ffffffff +[ 1987.260538] RBP: ff62f5cf20607d78 R08: ff2a6a89ef3fffe8 R09: 00000000fffeffff +[ 1987.268595] R10: ff2a6a89eed00000 R11: 0000000000000003 R12: ff2a66934849c89a +[ 1987.276652] R13: 0000000000000001 R14: ff2a66934849c8b9 R15: ff2a66934849c899 +[ 1987.284710] FS: 0000000000000000(0000) GS:ff2a66b22fe40000(0000) knlGS:0000000000000000 +[ 1987.293850] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 1987.300355] CR2: 00007fe291a37000 CR3: 000000010fbd4005 CR4: 0000000000f71ef0 +[ 1987.308413] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 1987.316470] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 +[ 1987.324527] PKRU: 55555554 +[ 1987.327622] Call Trace: +[ 1987.330424] +[ 1987.332826] ? show_regs+0x6e/0x80 +[ 1987.336703] ? die+0x3c/0xa0 +[ 1987.339988] ? do_trap+0xd4/0xf0 +[ 1987.343662] ? do_error_trap+0x75/0xa0 +[ 1987.347922] ? usercopy_abort+0x72/0x90 +[ 1987.352277] ? exc_invalid_op+0x57/0x80 +[ 1987.356634] ? usercopy_abort+0x72/0x90 +[ 1987.360988] ? asm_exc_invalid_op+0x1f/0x30 +[ 1987.365734] ? usercopy_abort+0x72/0x90 +[ 1987.370088] __check_heap_object+0xb7/0xd0 +[ 1987.374739] __check_object_size+0x175/0x2d0 +[ 1987.379588] idxd_copy_cr+0xa9/0x130 [idxd] +[ 1987.384341] idxd_evl_fault_work+0x127/0x390 [idxd] +[ 1987.389878] process_one_work+0x13e/0x300 +[ 1987.394435] ? __pfx_worker_thread+0x10/0x10 +[ 1987.399284] worker_thread+0x2f7/0x420 +[ 1987.403544] ? _raw_spin_unlock_irqrestore+0x2b/0x50 +[ 1987.409171] ? __pfx_worker_thread+0x10/0x10 +[ 1987.414019] kthread+0x107/0x140 +[ 1987.417693] ? __pfx_kthread+0x10/0x10 +[ 1987.421954] ret_from_fork+0x3d/0x60 +[ 1987.426019] ? __pfx_kthread+0x10/0x10 +[ 1987.430281] ret_from_fork_asm+0x1b/0x30 +[ 1987.434744] + +The issue arises because event log cache is created using +kmem_cache_create() which is not suitable for user copy. + +Fix the issue by creating event log cache with +kmem_cache_create_usercopy(), ensuring safe user copy. + +Fixes: c2f156bf168f ("dmaengine: idxd: create kmem cache for event log fault items") +Reported-by: Tony Zhu +Tested-by: Tony Zhu +Signed-off-by: Fenghua Yu +Reviewed-by: Lijun Pan +Reviewed-by: Dave Jiang +Link: https://lore.kernel.org/r/20240209191412.1050270-1-fenghua.yu@intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/idxd/init.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c +index 0eb1c827a215f..d09a8553ea71d 100644 +--- a/drivers/dma/idxd/init.c ++++ b/drivers/dma/idxd/init.c +@@ -342,7 +342,9 @@ static void idxd_cleanup_internals(struct idxd_device *idxd) + static int idxd_init_evl(struct idxd_device *idxd) + { + struct device *dev = &idxd->pdev->dev; ++ unsigned int evl_cache_size; + struct idxd_evl *evl; ++ const char *idxd_name; + + if (idxd->hw.gen_cap.evl_support == 0) + return 0; +@@ -354,9 +356,16 @@ static int idxd_init_evl(struct idxd_device *idxd) + spin_lock_init(&evl->lock); + evl->size = IDXD_EVL_SIZE_MIN; + +- idxd->evl_cache = kmem_cache_create(dev_name(idxd_confdev(idxd)), +- sizeof(struct idxd_evl_fault) + evl_ent_size(idxd), +- 0, 0, NULL); ++ idxd_name = dev_name(idxd_confdev(idxd)); ++ evl_cache_size = sizeof(struct idxd_evl_fault) + evl_ent_size(idxd); ++ /* ++ * Since completion record in evl_cache will be copied to user ++ * when handling completion record page fault, need to create ++ * the cache suitable for user copy. ++ */ ++ idxd->evl_cache = kmem_cache_create_usercopy(idxd_name, evl_cache_size, ++ 0, 0, 0, evl_cache_size, ++ NULL); + if (!idxd->evl_cache) { + kfree(evl); + return -ENOMEM; +-- +2.43.0 + diff --git a/queue-6.6/dmaengine-idxd-remove-shadow-event-log-head-stored-i.patch b/queue-6.6/dmaengine-idxd-remove-shadow-event-log-head-stored-i.patch new file mode 100644 index 00000000000..f292a319aa5 --- /dev/null +++ b/queue-6.6/dmaengine-idxd-remove-shadow-event-log-head-stored-i.patch @@ -0,0 +1,108 @@ +From 672e0d5f5d65ae0c75946c160d5928dccc6f9fa9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 18:49:31 -0800 +Subject: dmaengine: idxd: Remove shadow Event Log head stored in idxd + +From: Fenghua Yu + +[ Upstream commit ecec7c9f29a7114a3e23a14020b1149ea7dffb4f ] + +head is defined in idxd->evl as a shadow of head in the EVLSTATUS register. +There are two issues related to the shadow head: + +1. Mismatch between the shadow head and the state of the EVLSTATUS + register: + If Event Log is supported, upon completion of the Enable Device command, + the Event Log head in the variable idxd->evl->head should be cleared to + match the state of the EVLSTATUS register. But the variable is not reset + currently, leading mismatch between the variable and the register state. + The mismatch causes incorrect processing of Event Log entries. + +2. Unnecessary shadow head definition: + The shadow head is unnecessary as head can be read directly from the + EVLSTATUS register. Reading head from the register incurs no additional + cost because event log head and tail are always read together and + tail is already read directly from the register as required by hardware. + +Remove the shadow Event Log head stored in idxd->evl to address the +mentioned issues. + +Fixes: 244da66cda35 ("dmaengine: idxd: setup event log configuration") +Signed-off-by: Fenghua Yu +Reviewed-by: Dave Jiang +Link: https://lore.kernel.org/r/20240215024931.1739621-1-fenghua.yu@intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/idxd/cdev.c | 2 +- + drivers/dma/idxd/debugfs.c | 2 +- + drivers/dma/idxd/idxd.h | 1 - + drivers/dma/idxd/irq.c | 3 +-- + 4 files changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c +index d32deb9b4e3de..4eeec95a66751 100644 +--- a/drivers/dma/idxd/cdev.c ++++ b/drivers/dma/idxd/cdev.c +@@ -345,7 +345,7 @@ static void idxd_cdev_evl_drain_pasid(struct idxd_wq *wq, u32 pasid) + spin_lock(&evl->lock); + status.bits = ioread64(idxd->reg_base + IDXD_EVLSTATUS_OFFSET); + t = status.tail; +- h = evl->head; ++ h = status.head; + size = evl->size; + + while (h != t) { +diff --git a/drivers/dma/idxd/debugfs.c b/drivers/dma/idxd/debugfs.c +index 9cfbd9b14c4c4..f3f25ee676f30 100644 +--- a/drivers/dma/idxd/debugfs.c ++++ b/drivers/dma/idxd/debugfs.c +@@ -68,9 +68,9 @@ static int debugfs_evl_show(struct seq_file *s, void *d) + + spin_lock(&evl->lock); + +- h = evl->head; + evl_status.bits = ioread64(idxd->reg_base + IDXD_EVLSTATUS_OFFSET); + t = evl_status.tail; ++ h = evl_status.head; + evl_size = evl->size; + + seq_printf(s, "Event Log head %u tail %u interrupt pending %u\n\n", +diff --git a/drivers/dma/idxd/idxd.h b/drivers/dma/idxd/idxd.h +index e269ca1f48625..6fc79deb99bfd 100644 +--- a/drivers/dma/idxd/idxd.h ++++ b/drivers/dma/idxd/idxd.h +@@ -286,7 +286,6 @@ struct idxd_evl { + unsigned int log_size; + /* The number of entries in the event log. */ + u16 size; +- u16 head; + unsigned long *bmap; + bool batch_fail[IDXD_MAX_BATCH_IDENT]; + }; +diff --git a/drivers/dma/idxd/irq.c b/drivers/dma/idxd/irq.c +index b501320a9c7ad..0bbc6bdc6145e 100644 +--- a/drivers/dma/idxd/irq.c ++++ b/drivers/dma/idxd/irq.c +@@ -367,9 +367,9 @@ static void process_evl_entries(struct idxd_device *idxd) + /* Clear interrupt pending bit */ + iowrite32(evl_status.bits_upper32, + idxd->reg_base + IDXD_EVLSTATUS_OFFSET + sizeof(u32)); +- h = evl->head; + evl_status.bits = ioread64(idxd->reg_base + IDXD_EVLSTATUS_OFFSET); + t = evl_status.tail; ++ h = evl_status.head; + size = idxd->evl->size; + + while (h != t) { +@@ -378,7 +378,6 @@ static void process_evl_entries(struct idxd_device *idxd) + h = (h + 1) % size; + } + +- evl->head = h; + evl_status.head = h; + iowrite32(evl_status.bits_lower32, idxd->reg_base + IDXD_EVLSTATUS_OFFSET); + spin_unlock(&evl->lock); +-- +2.43.0 + diff --git a/queue-6.6/gpio-74x164-enable-output-pins-after-registers-are-r.patch b/queue-6.6/gpio-74x164-enable-output-pins-after-registers-are-r.patch new file mode 100644 index 00000000000..31e3325c8ac --- /dev/null +++ b/queue-6.6/gpio-74x164-enable-output-pins-after-registers-are-r.patch @@ -0,0 +1,57 @@ +From 69c30043bbadfea4ef1c7201c39961923c50c375 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 09:12:04 +0200 +Subject: gpio: 74x164: Enable output pins after registers are reset + +From: Arturas Moskvinas + +[ Upstream commit 530b1dbd97846b110ea8a94c7cc903eca21786e5 ] + +Chip outputs are enabled[1] before actual reset is performed[2] which might +cause pin output value to flip flop if previous pin value was set to 1. +Fix that behavior by making sure chip is fully reset before all outputs are +enabled. + +Flip-flop can be noticed when module is removed and inserted again and one of +the pins was changed to 1 before removal. 100 microsecond flipping is +noticeable on oscilloscope (100khz SPI bus). + +For a properly reset chip - output is enabled around 100 microseconds (on 100khz +SPI bus) later during probing process hence should be irrelevant behavioral +change. + +Fixes: 7ebc194d0fd4 (gpio: 74x164: Introduce 'enable-gpios' property) +Link: https://elixir.bootlin.com/linux/v6.7.4/source/drivers/gpio/gpio-74x164.c#L130 [1] +Link: https://elixir.bootlin.com/linux/v6.7.4/source/drivers/gpio/gpio-74x164.c#L150 [2] +Signed-off-by: Arturas Moskvinas +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-74x164.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpio/gpio-74x164.c b/drivers/gpio/gpio-74x164.c +index e00c333105170..753e7be039e4d 100644 +--- a/drivers/gpio/gpio-74x164.c ++++ b/drivers/gpio/gpio-74x164.c +@@ -127,8 +127,6 @@ static int gen_74x164_probe(struct spi_device *spi) + if (IS_ERR(chip->gpiod_oe)) + return PTR_ERR(chip->gpiod_oe); + +- gpiod_set_value_cansleep(chip->gpiod_oe, 1); +- + spi_set_drvdata(spi, chip); + + chip->gpio_chip.label = spi->modalias; +@@ -153,6 +151,8 @@ static int gen_74x164_probe(struct spi_device *spi) + goto exit_destroy; + } + ++ gpiod_set_value_cansleep(chip->gpiod_oe, 1); ++ + ret = gpiochip_add_data(&chip->gpio_chip, chip); + if (!ret) + return 0; +-- +2.43.0 + diff --git a/queue-6.6/gpio-fix-resource-unwinding-order-in-error-path.patch b/queue-6.6/gpio-fix-resource-unwinding-order-in-error-path.patch new file mode 100644 index 00000000000..4db3c00ec5a --- /dev/null +++ b/queue-6.6/gpio-fix-resource-unwinding-order-in-error-path.patch @@ -0,0 +1,54 @@ +From 47bd018448b7c31813df065e7bcfa4ec3b9edc7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 18:25:49 +0100 +Subject: gpio: fix resource unwinding order in error path + +From: Bartosz Golaszewski + +[ Upstream commit ec5c54a9d3c4f9c15e647b049fea401ee5258696 ] + +Hogs are added *after* ACPI so should be removed *before* in error path. + +Fixes: a411e81e61df ("gpiolib: add hogs support for machine code") +Signed-off-by: Bartosz Golaszewski +Reviewed-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index 53ab4e62503fd..deca1d43de9ca 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -894,11 +894,11 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data, + + ret = gpiochip_irqchip_init_valid_mask(gc); + if (ret) +- goto err_remove_acpi_chip; ++ goto err_free_hogs; + + ret = gpiochip_irqchip_init_hw(gc); + if (ret) +- goto err_remove_acpi_chip; ++ goto err_remove_irqchip_mask; + + ret = gpiochip_add_irqchip(gc, lock_key, request_key); + if (ret) +@@ -923,11 +923,11 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data, + gpiochip_irqchip_remove(gc); + err_remove_irqchip_mask: + gpiochip_irqchip_free_valid_mask(gc); +-err_remove_acpi_chip: ++err_free_hogs: ++ gpiochip_free_hogs(gc); + acpi_gpiochip_remove(gc); + gpiochip_remove_pin_ranges(gc); + err_remove_of_chip: +- gpiochip_free_hogs(gc); + of_gpiochip_remove(gc); + err_free_gpiochip_mask: + gpiochip_free_valid_mask(gc); +-- +2.43.0 + diff --git a/queue-6.6/gpiolib-fix-the-error-path-order-in-gpiochip_add_dat.patch b/queue-6.6/gpiolib-fix-the-error-path-order-in-gpiochip_add_dat.patch new file mode 100644 index 00000000000..b7edaca78de --- /dev/null +++ b/queue-6.6/gpiolib-fix-the-error-path-order-in-gpiochip_add_dat.patch @@ -0,0 +1,40 @@ +From 8c339845b54aff3b39bef0271f464fdd8d8fc999 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Feb 2024 21:28:46 +0200 +Subject: gpiolib: Fix the error path order in gpiochip_add_data_with_key() + +From: Andy Shevchenko + +[ Upstream commit e4aec4daa8c009057b5e063db1b7322252c92dc8 ] + +After shuffling the code, error path wasn't updated correctly. +Fix it here. + +Fixes: 2f4133bb5f14 ("gpiolib: No need to call gpiochip_remove_pin_ranges() twice") +Signed-off-by: Andy Shevchenko +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index 71492d213ef4d..53ab4e62503fd 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -925,11 +925,11 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data, + gpiochip_irqchip_free_valid_mask(gc); + err_remove_acpi_chip: + acpi_gpiochip_remove(gc); ++ gpiochip_remove_pin_ranges(gc); + err_remove_of_chip: + gpiochip_free_hogs(gc); + of_gpiochip_remove(gc); + err_free_gpiochip_mask: +- gpiochip_remove_pin_ranges(gc); + gpiochip_free_valid_mask(gc); + if (gdev->dev.release) { + /* release() has been registered by gpiochip_setup_dev() */ +-- +2.43.0 + diff --git a/queue-6.6/phy-freescale-phy-fsl-imx8-mipi-dphy-fix-alias-name-.patch b/queue-6.6/phy-freescale-phy-fsl-imx8-mipi-dphy-fix-alias-name-.patch new file mode 100644 index 00000000000..61e5799394b --- /dev/null +++ b/queue-6.6/phy-freescale-phy-fsl-imx8-mipi-dphy-fix-alias-name-.patch @@ -0,0 +1,38 @@ +From 298907cf7cbdf4cf0d3232f00ad3baf6d3102797 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jan 2024 10:33:43 +0100 +Subject: phy: freescale: phy-fsl-imx8-mipi-dphy: Fix alias name to use dashes + +From: Alexander Stein + +[ Upstream commit 7936378cb6d87073163130e1e1fc1e5f76a597cf ] + +Devicetree spec lists only dashes as valid characters for alias names. +Table 3.2: Valid characters for alias names, Devicee Specification, +Release v0.4 + +Signed-off-by: Alexander Stein +Fixes: 3fbae284887de ("phy: freescale: phy-fsl-imx8-mipi-dphy: Add i.MX8qxp LVDS PHY mode support") +Link: https://lore.kernel.org/r/20240110093343.468810-1-alexander.stein@ew.tq-group.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/freescale/phy-fsl-imx8-mipi-dphy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/phy/freescale/phy-fsl-imx8-mipi-dphy.c b/drivers/phy/freescale/phy-fsl-imx8-mipi-dphy.c +index e625b32889bfc..0928a526e2ab3 100644 +--- a/drivers/phy/freescale/phy-fsl-imx8-mipi-dphy.c ++++ b/drivers/phy/freescale/phy-fsl-imx8-mipi-dphy.c +@@ -706,7 +706,7 @@ static int mixel_dphy_probe(struct platform_device *pdev) + return ret; + } + +- priv->id = of_alias_get_id(np, "mipi_dphy"); ++ priv->id = of_alias_get_id(np, "mipi-dphy"); + if (priv->id < 0) { + dev_err(dev, "Failed to get phy node alias id: %d\n", + priv->id); +-- +2.43.0 + diff --git a/queue-6.6/powerpc-pseries-iommu-iommu-table-is-not-initialized.patch b/queue-6.6/powerpc-pseries-iommu-iommu-table-is-not-initialized.patch new file mode 100644 index 00000000000..6a998098c0f --- /dev/null +++ b/queue-6.6/powerpc-pseries-iommu-iommu-table-is-not-initialized.patch @@ -0,0 +1,334 @@ +From 688b3020e17504b91307b29a7c0311f66c3a60d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jan 2024 14:30:17 -0600 +Subject: powerpc/pseries/iommu: IOMMU table is not initialized for kdump over + SR-IOV + +From: Gaurav Batra + +[ Upstream commit 09a3c1e46142199adcee372a420b024b4fc61051 ] + +When kdump kernel tries to copy dump data over SR-IOV, LPAR panics due +to NULL pointer exception: + + Kernel attempted to read user page (0) - exploit attempt? (uid: 0) + BUG: Kernel NULL pointer dereference on read at 0x00000000 + Faulting instruction address: 0xc000000020847ad4 + Oops: Kernel access of bad area, sig: 11 [#1] + LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries + Modules linked in: mlx5_core(+) vmx_crypto pseries_wdt papr_scm libnvdimm mlxfw tls psample sunrpc fuse overlay squashfs loop + CPU: 12 PID: 315 Comm: systemd-udevd Not tainted 6.4.0-Test102+ #12 + Hardware name: IBM,9080-HEX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_008) hv:phyp pSeries + NIP: c000000020847ad4 LR: c00000002083b2dc CTR: 00000000006cd18c + REGS: c000000029162ca0 TRAP: 0300 Not tainted (6.4.0-Test102+) + MSR: 800000000280b033 CR: 48288244 XER: 00000008 + CFAR: c00000002083b2d8 DAR: 0000000000000000 DSISR: 40000000 IRQMASK: 1 + ... + NIP _find_next_zero_bit+0x24/0x110 + LR bitmap_find_next_zero_area_off+0x5c/0xe0 + Call Trace: + dev_printk_emit+0x38/0x48 (unreliable) + iommu_area_alloc+0xc4/0x180 + iommu_range_alloc+0x1e8/0x580 + iommu_alloc+0x60/0x130 + iommu_alloc_coherent+0x158/0x2b0 + dma_iommu_alloc_coherent+0x3c/0x50 + dma_alloc_attrs+0x170/0x1f0 + mlx5_cmd_init+0xc0/0x760 [mlx5_core] + mlx5_function_setup+0xf0/0x510 [mlx5_core] + mlx5_init_one+0x84/0x210 [mlx5_core] + probe_one+0x118/0x2c0 [mlx5_core] + local_pci_probe+0x68/0x110 + pci_call_probe+0x68/0x200 + pci_device_probe+0xbc/0x1a0 + really_probe+0x104/0x540 + __driver_probe_device+0xb4/0x230 + driver_probe_device+0x54/0x130 + __driver_attach+0x158/0x2b0 + bus_for_each_dev+0xa8/0x130 + driver_attach+0x34/0x50 + bus_add_driver+0x16c/0x300 + driver_register+0xa4/0x1b0 + __pci_register_driver+0x68/0x80 + mlx5_init+0xb8/0x100 [mlx5_core] + do_one_initcall+0x60/0x300 + do_init_module+0x7c/0x2b0 + +At the time of LPAR dump, before kexec hands over control to kdump +kernel, DDWs (Dynamic DMA Windows) are scanned and added to the FDT. +For the SR-IOV case, default DMA window "ibm,dma-window" is removed from +the FDT and DDW added, for the device. + +Now, kexec hands over control to the kdump kernel. + +When the kdump kernel initializes, PCI busses are scanned and IOMMU +group/tables created, in pci_dma_bus_setup_pSeriesLP(). For the SR-IOV +case, there is no "ibm,dma-window". The original commit: b1fc44eaa9ba, +fixes the path where memory is pre-mapped (direct mapped) to the DDW. +When TCEs are direct mapped, there is no need to initialize IOMMU +tables. + +iommu_table_setparms_lpar() only considers "ibm,dma-window" property +when initiallizing IOMMU table. In the scenario where TCEs are +dynamically allocated for SR-IOV, newly created IOMMU table is not +initialized. Later, when the device driver tries to enter TCEs for the +SR-IOV device, NULL pointer execption is thrown from iommu_area_alloc(). + +The fix is to initialize the IOMMU table with DDW property stored in the +FDT. There are 2 points to remember: + + 1. For the dedicated adapter, kdump kernel would encounter both + default and DDW in FDT. In this case, DDW property is used to + initialize the IOMMU table. + + 2. A DDW could be direct or dynamic mapped. kdump kernel would + initialize IOMMU table and mark the existing DDW as + "dynamic". This works fine since, at the time of table + initialization, iommu_table_clear() makes some space in the + DDW, for some predefined number of TCEs which are needed for + kdump to succeed. + +Fixes: b1fc44eaa9ba ("pseries/iommu/ddw: Fix kdump to work in absence of ibm,dma-window") +Signed-off-by: Gaurav Batra +Reviewed-by: Brian King +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240125203017.61014-1-gbatra@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/iommu.c | 156 +++++++++++++++++-------- + 1 file changed, 105 insertions(+), 51 deletions(-) + +diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c +index 496e16c588aaa..e8c4129697b14 100644 +--- a/arch/powerpc/platforms/pseries/iommu.c ++++ b/arch/powerpc/platforms/pseries/iommu.c +@@ -574,29 +574,6 @@ static void iommu_table_setparms(struct pci_controller *phb, + + struct iommu_table_ops iommu_table_lpar_multi_ops; + +-/* +- * iommu_table_setparms_lpar +- * +- * Function: On pSeries LPAR systems, return TCE table info, given a pci bus. +- */ +-static void iommu_table_setparms_lpar(struct pci_controller *phb, +- struct device_node *dn, +- struct iommu_table *tbl, +- struct iommu_table_group *table_group, +- const __be32 *dma_window) +-{ +- unsigned long offset, size, liobn; +- +- of_parse_dma_window(dn, dma_window, &liobn, &offset, &size); +- +- iommu_table_setparms_common(tbl, phb->bus->number, liobn, offset, size, IOMMU_PAGE_SHIFT_4K, NULL, +- &iommu_table_lpar_multi_ops); +- +- +- table_group->tce32_start = offset; +- table_group->tce32_size = size; +-} +- + struct iommu_table_ops iommu_table_pseries_ops = { + .set = tce_build_pSeries, + .clear = tce_free_pSeries, +@@ -724,26 +701,71 @@ struct iommu_table_ops iommu_table_lpar_multi_ops = { + * dynamic 64bit DMA window, walking up the device tree. + */ + static struct device_node *pci_dma_find(struct device_node *dn, +- const __be32 **dma_window) ++ struct dynamic_dma_window_prop *prop) + { +- const __be32 *dw = NULL; ++ const __be32 *default_prop = NULL; ++ const __be32 *ddw_prop = NULL; ++ struct device_node *rdn = NULL; ++ bool default_win = false, ddw_win = false; + + for ( ; dn && PCI_DN(dn); dn = dn->parent) { +- dw = of_get_property(dn, "ibm,dma-window", NULL); +- if (dw) { +- if (dma_window) +- *dma_window = dw; +- return dn; ++ default_prop = of_get_property(dn, "ibm,dma-window", NULL); ++ if (default_prop) { ++ rdn = dn; ++ default_win = true; ++ } ++ ddw_prop = of_get_property(dn, DIRECT64_PROPNAME, NULL); ++ if (ddw_prop) { ++ rdn = dn; ++ ddw_win = true; ++ break; ++ } ++ ddw_prop = of_get_property(dn, DMA64_PROPNAME, NULL); ++ if (ddw_prop) { ++ rdn = dn; ++ ddw_win = true; ++ break; + } +- dw = of_get_property(dn, DIRECT64_PROPNAME, NULL); +- if (dw) +- return dn; +- dw = of_get_property(dn, DMA64_PROPNAME, NULL); +- if (dw) +- return dn; ++ ++ /* At least found default window, which is the case for normal boot */ ++ if (default_win) ++ break; + } + +- return NULL; ++ /* For PCI devices there will always be a DMA window, either on the device ++ * or parent bus ++ */ ++ WARN_ON(!(default_win | ddw_win)); ++ ++ /* caller doesn't want to get DMA window property */ ++ if (!prop) ++ return rdn; ++ ++ /* parse DMA window property. During normal system boot, only default ++ * DMA window is passed in OF. But, for kdump, a dedicated adapter might ++ * have both default and DDW in FDT. In this scenario, DDW takes precedence ++ * over default window. ++ */ ++ if (ddw_win) { ++ struct dynamic_dma_window_prop *p; ++ ++ p = (struct dynamic_dma_window_prop *)ddw_prop; ++ prop->liobn = p->liobn; ++ prop->dma_base = p->dma_base; ++ prop->tce_shift = p->tce_shift; ++ prop->window_shift = p->window_shift; ++ } else if (default_win) { ++ unsigned long offset, size, liobn; ++ ++ of_parse_dma_window(rdn, default_prop, &liobn, &offset, &size); ++ ++ prop->liobn = cpu_to_be32((u32)liobn); ++ prop->dma_base = cpu_to_be64(offset); ++ prop->tce_shift = cpu_to_be32(IOMMU_PAGE_SHIFT_4K); ++ prop->window_shift = cpu_to_be32(order_base_2(size)); ++ } ++ ++ return rdn; + } + + static void pci_dma_bus_setup_pSeriesLP(struct pci_bus *bus) +@@ -751,17 +773,20 @@ static void pci_dma_bus_setup_pSeriesLP(struct pci_bus *bus) + struct iommu_table *tbl; + struct device_node *dn, *pdn; + struct pci_dn *ppci; +- const __be32 *dma_window = NULL; ++ struct dynamic_dma_window_prop prop; + + dn = pci_bus_to_OF_node(bus); + + pr_debug("pci_dma_bus_setup_pSeriesLP: setting up bus %pOF\n", + dn); + +- pdn = pci_dma_find(dn, &dma_window); ++ pdn = pci_dma_find(dn, &prop); + +- if (dma_window == NULL) +- pr_debug(" no ibm,dma-window property !\n"); ++ /* In PPC architecture, there will always be DMA window on bus or one of the ++ * parent bus. During reboot, there will be ibm,dma-window property to ++ * define DMA window. For kdump, there will at least be default window or DDW ++ * or both. ++ */ + + ppci = PCI_DN(pdn); + +@@ -771,13 +796,24 @@ static void pci_dma_bus_setup_pSeriesLP(struct pci_bus *bus) + if (!ppci->table_group) { + ppci->table_group = iommu_pseries_alloc_group(ppci->phb->node); + tbl = ppci->table_group->tables[0]; +- if (dma_window) { +- iommu_table_setparms_lpar(ppci->phb, pdn, tbl, +- ppci->table_group, dma_window); + +- if (!iommu_init_table(tbl, ppci->phb->node, 0, 0)) +- panic("Failed to initialize iommu table"); +- } ++ iommu_table_setparms_common(tbl, ppci->phb->bus->number, ++ be32_to_cpu(prop.liobn), ++ be64_to_cpu(prop.dma_base), ++ 1ULL << be32_to_cpu(prop.window_shift), ++ be32_to_cpu(prop.tce_shift), NULL, ++ &iommu_table_lpar_multi_ops); ++ ++ /* Only for normal boot with default window. Doesn't matter even ++ * if we set these with DDW which is 64bit during kdump, since ++ * these will not be used during kdump. ++ */ ++ ppci->table_group->tce32_start = be64_to_cpu(prop.dma_base); ++ ppci->table_group->tce32_size = 1 << be32_to_cpu(prop.window_shift); ++ ++ if (!iommu_init_table(tbl, ppci->phb->node, 0, 0)) ++ panic("Failed to initialize iommu table"); ++ + iommu_register_group(ppci->table_group, + pci_domain_nr(bus), 0); + pr_debug(" created table: %p\n", ppci->table_group); +@@ -968,6 +1004,12 @@ static void find_existing_ddw_windows_named(const char *name) + continue; + } + ++ /* If at the time of system initialization, there are DDWs in OF, ++ * it means this is during kexec. DDW could be direct or dynamic. ++ * We will just mark DDWs as "dynamic" since this is kdump path, ++ * no need to worry about perforance. ddw_list_new_entry() will ++ * set window->direct = false. ++ */ + window = ddw_list_new_entry(pdn, dma64); + if (!window) { + of_node_put(pdn); +@@ -1524,8 +1566,8 @@ static void pci_dma_dev_setup_pSeriesLP(struct pci_dev *dev) + { + struct device_node *pdn, *dn; + struct iommu_table *tbl; +- const __be32 *dma_window = NULL; + struct pci_dn *pci; ++ struct dynamic_dma_window_prop prop; + + pr_debug("pci_dma_dev_setup_pSeriesLP: %s\n", pci_name(dev)); + +@@ -1538,7 +1580,7 @@ static void pci_dma_dev_setup_pSeriesLP(struct pci_dev *dev) + dn = pci_device_to_OF_node(dev); + pr_debug(" node is %pOF\n", dn); + +- pdn = pci_dma_find(dn, &dma_window); ++ pdn = pci_dma_find(dn, &prop); + if (!pdn || !PCI_DN(pdn)) { + printk(KERN_WARNING "pci_dma_dev_setup_pSeriesLP: " + "no DMA window found for pci dev=%s dn=%pOF\n", +@@ -1551,8 +1593,20 @@ static void pci_dma_dev_setup_pSeriesLP(struct pci_dev *dev) + if (!pci->table_group) { + pci->table_group = iommu_pseries_alloc_group(pci->phb->node); + tbl = pci->table_group->tables[0]; +- iommu_table_setparms_lpar(pci->phb, pdn, tbl, +- pci->table_group, dma_window); ++ ++ iommu_table_setparms_common(tbl, pci->phb->bus->number, ++ be32_to_cpu(prop.liobn), ++ be64_to_cpu(prop.dma_base), ++ 1ULL << be32_to_cpu(prop.window_shift), ++ be32_to_cpu(prop.tce_shift), NULL, ++ &iommu_table_lpar_multi_ops); ++ ++ /* Only for normal boot with default window. Doesn't matter even ++ * if we set these with DDW which is 64bit during kdump, since ++ * these will not be used during kdump. ++ */ ++ pci->table_group->tce32_start = be64_to_cpu(prop.dma_base); ++ pci->table_group->tce32_size = 1 << be32_to_cpu(prop.window_shift); + + iommu_init_table(tbl, pci->phb->node, 0, 0); + iommu_register_group(pci->table_group, +-- +2.43.0 + diff --git a/queue-6.6/powerpc-rtas-use-correct-function-name-for-resetting.patch b/queue-6.6/powerpc-rtas-use-correct-function-name-for-resetting.patch new file mode 100644 index 00000000000..2a469072dcc --- /dev/null +++ b/queue-6.6/powerpc-rtas-use-correct-function-name-for-resetting.patch @@ -0,0 +1,116 @@ +From 96906373590f175fe535edef374d4baf96391de3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 16:19:14 -0600 +Subject: powerpc/rtas: use correct function name for resetting TCE tables + +From: Nathan Lynch + +[ Upstream commit fad87dbd48156ab940538f052f1820f4b6ed2819 ] + +The PAPR spec spells the function name as + + "ibm,reset-pe-dma-windows" + +but in practice firmware uses the singular form: + + "ibm,reset-pe-dma-window" + +in the device tree. Since we have the wrong spelling in the RTAS +function table, reverse lookups (token -> name) fail and warn: + + unexpected failed lookup for token 86 + WARNING: CPU: 1 PID: 545 at arch/powerpc/kernel/rtas.c:659 __do_enter_rtas_trace+0x2a4/0x2b4 + CPU: 1 PID: 545 Comm: systemd-udevd Not tainted 6.8.0-rc4 #30 + Hardware name: IBM,9105-22A POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NL1060_028) hv:phyp pSeries + NIP [c0000000000417f0] __do_enter_rtas_trace+0x2a4/0x2b4 + LR [c0000000000417ec] __do_enter_rtas_trace+0x2a0/0x2b4 + Call Trace: + __do_enter_rtas_trace+0x2a0/0x2b4 (unreliable) + rtas_call+0x1f8/0x3e0 + enable_ddw.constprop.0+0x4d0/0xc84 + dma_iommu_dma_supported+0xe8/0x24c + dma_set_mask+0x5c/0xd8 + mlx5_pci_init.constprop.0+0xf0/0x46c [mlx5_core] + probe_one+0xfc/0x32c [mlx5_core] + local_pci_probe+0x68/0x12c + pci_call_probe+0x68/0x1ec + pci_device_probe+0xbc/0x1a8 + really_probe+0x104/0x570 + __driver_probe_device+0xb8/0x224 + driver_probe_device+0x54/0x130 + __driver_attach+0x158/0x2b0 + bus_for_each_dev+0xa8/0x120 + driver_attach+0x34/0x48 + bus_add_driver+0x174/0x304 + driver_register+0x8c/0x1c4 + __pci_register_driver+0x68/0x7c + mlx5_init+0xb8/0x118 [mlx5_core] + do_one_initcall+0x60/0x388 + do_init_module+0x7c/0x2a4 + init_module_from_file+0xb4/0x108 + idempotent_init_module+0x184/0x34c + sys_finit_module+0x90/0x114 + +And oopses are possible when lockdep is enabled or the RTAS +tracepoints are active, since those paths dereference the result of +the lookup. + +Use the correct spelling to match firmware's behavior, adjusting the +related constants to match. + +Signed-off-by: Nathan Lynch +Fixes: 8252b88294d2 ("powerpc/rtas: improve function information lookups") +Reported-by: Gaurav Batra +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240222-rtas-fix-ibm-reset-pe-dma-window-v1-1-7aaf235ac63c@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/rtas.h | 4 ++-- + arch/powerpc/kernel/rtas.c | 9 +++++++-- + 2 files changed, 9 insertions(+), 4 deletions(-) + +diff --git a/arch/powerpc/include/asm/rtas.h b/arch/powerpc/include/asm/rtas.h +index c697c3c746946..33024a2874a69 100644 +--- a/arch/powerpc/include/asm/rtas.h ++++ b/arch/powerpc/include/asm/rtas.h +@@ -68,7 +68,7 @@ enum rtas_function_index { + RTAS_FNIDX__IBM_READ_SLOT_RESET_STATE, + RTAS_FNIDX__IBM_READ_SLOT_RESET_STATE2, + RTAS_FNIDX__IBM_REMOVE_PE_DMA_WINDOW, +- RTAS_FNIDX__IBM_RESET_PE_DMA_WINDOWS, ++ RTAS_FNIDX__IBM_RESET_PE_DMA_WINDOW, + RTAS_FNIDX__IBM_SCAN_LOG_DUMP, + RTAS_FNIDX__IBM_SET_DYNAMIC_INDICATOR, + RTAS_FNIDX__IBM_SET_EEH_OPTION, +@@ -163,7 +163,7 @@ typedef struct { + #define RTAS_FN_IBM_READ_SLOT_RESET_STATE rtas_fn_handle(RTAS_FNIDX__IBM_READ_SLOT_RESET_STATE) + #define RTAS_FN_IBM_READ_SLOT_RESET_STATE2 rtas_fn_handle(RTAS_FNIDX__IBM_READ_SLOT_RESET_STATE2) + #define RTAS_FN_IBM_REMOVE_PE_DMA_WINDOW rtas_fn_handle(RTAS_FNIDX__IBM_REMOVE_PE_DMA_WINDOW) +-#define RTAS_FN_IBM_RESET_PE_DMA_WINDOWS rtas_fn_handle(RTAS_FNIDX__IBM_RESET_PE_DMA_WINDOWS) ++#define RTAS_FN_IBM_RESET_PE_DMA_WINDOW rtas_fn_handle(RTAS_FNIDX__IBM_RESET_PE_DMA_WINDOW) + #define RTAS_FN_IBM_SCAN_LOG_DUMP rtas_fn_handle(RTAS_FNIDX__IBM_SCAN_LOG_DUMP) + #define RTAS_FN_IBM_SET_DYNAMIC_INDICATOR rtas_fn_handle(RTAS_FNIDX__IBM_SET_DYNAMIC_INDICATOR) + #define RTAS_FN_IBM_SET_EEH_OPTION rtas_fn_handle(RTAS_FNIDX__IBM_SET_EEH_OPTION) +diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c +index 87d65bdd3ecae..46b9476d75824 100644 +--- a/arch/powerpc/kernel/rtas.c ++++ b/arch/powerpc/kernel/rtas.c +@@ -310,8 +310,13 @@ static struct rtas_function rtas_function_table[] __ro_after_init = { + [RTAS_FNIDX__IBM_REMOVE_PE_DMA_WINDOW] = { + .name = "ibm,remove-pe-dma-window", + }, +- [RTAS_FNIDX__IBM_RESET_PE_DMA_WINDOWS] = { +- .name = "ibm,reset-pe-dma-windows", ++ [RTAS_FNIDX__IBM_RESET_PE_DMA_WINDOW] = { ++ /* ++ * Note: PAPR+ v2.13 7.3.31.4.1 spells this as ++ * "ibm,reset-pe-dma-windows" (plural), but RTAS ++ * implementations use the singular form in practice. ++ */ ++ .name = "ibm,reset-pe-dma-window", + }, + [RTAS_FNIDX__IBM_SCAN_LOG_DUMP] = { + .name = "ibm,scan-log-dump", +-- +2.43.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 6f2ee21caf5..9d311e484a0 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -116,3 +116,18 @@ nfs-fix-data-corruption-caused-by-congestion.patch af_unix-fix-task-hung-while-purging-oob_skb-in-gc.patch af_unix-drop-oob_skb-ref-before-purging-queue-in-gc.patch asoc-cs35l56-fix-reversed-if-statement-in-cs35l56_dspwait_asp1tx_put.patch +dmaengine-dw-edma-fix-the-ch_count-hdma-callback.patch +dmaengine-dw-edma-fix-wrong-interrupt-bit-set-for-hd.patch +dmaengine-dw-edma-hdma_v0_remotel_stop_int_en-typo-f.patch +dmaengine-dw-edma-add-hdma-remote-interrupt-configur.patch +dmaengine-dw-edma-hdma-add-sync-read-before-starting.patch +dmaengine-dw-edma-edma-add-sync-read-before-starting.patch +phy-freescale-phy-fsl-imx8-mipi-dphy-fix-alias-name-.patch +dmaengine-idxd-remove-shadow-event-log-head-stored-i.patch +dmaengine-idxd-ensure-safe-user-copy-of-completion-r.patch +powerpc-pseries-iommu-iommu-table-is-not-initialized.patch +powerpc-rtas-use-correct-function-name-for-resetting.patch +gpio-74x164-enable-output-pins-after-registers-are-r.patch +gpiolib-fix-the-error-path-order-in-gpiochip_add_dat.patch +gpio-fix-resource-unwinding-order-in-error-path.patch +block-define-bvec_iter-as-__packed-__aligned-4.patch