5.15-stable patches

added patches:
	iommu-iova-fix-alloc-iova-overflows-issue.patch
	iommu-mediatek-v1-fix-an-error-handling-path-in-mtk_iommu_v1_probe.patch

diff --git a/queue-5.15/iommu-iova-fix-alloc-iova-overflows-issue.patch b/queue-5.15/iommu-iova-fix-alloc-iova-overflows-issue.patch
new file mode 100644 (file)
index 0000000..6e78c9e
--- /dev/null
+++ b/queue-5.15/iommu-iova-fix-alloc-iova-overflows-issue.patch
@@ -0,0 +1,70 @@
+From dcdb3ba7e2a8caae7bfefd603bc22fd0ce9a389c Mon Sep 17 00:00:00 2001
+From: Yunfei Wang <yf.wang@mediatek.com>
+Date: Wed, 11 Jan 2023 14:38:00 +0800
+Subject: iommu/iova: Fix alloc iova overflows issue
+
+From: Yunfei Wang <yf.wang@mediatek.com>
+
+commit dcdb3ba7e2a8caae7bfefd603bc22fd0ce9a389c upstream.
+
+In __alloc_and_insert_iova_range, there is an issue that retry_pfn
+overflows. The value of iovad->anchor.pfn_hi is ~0UL, then when
+iovad->cached_node is iovad->anchor, curr_iova->pfn_hi + 1 will
+overflow. As a result, if the retry logic is executed, low_pfn is
+updated to 0, and then new_pfn < low_pfn returns false to make the
+allocation successful.
+
+This issue occurs in the following two situations:
+1. The first iova size exceeds the domain size. When initializing
+iova domain, iovad->cached_node is assigned as iovad->anchor. For
+example, the iova domain size is 10M, start_pfn is 0x1_F000_0000,
+and the iova size allocated for the first time is 11M. The
+following is the log information, new->pfn_lo is smaller than
+iovad->cached_node.
+
+Example log as follows:
+[  223.798112][T1705487] sh: [name:iova&]__alloc_and_insert_iova_range
+start_pfn:0x1f0000,retry_pfn:0x0,size:0xb00,limit_pfn:0x1f0a00
+[  223.799590][T1705487] sh: [name:iova&]__alloc_and_insert_iova_range
+success start_pfn:0x1f0000,new->pfn_lo:0x1efe00,new->pfn_hi:0x1f08ff
+
+2. The node with the largest iova->pfn_lo value in the iova domain
+is deleted, iovad->cached_node will be updated to iovad->anchor,
+and then the alloc iova size exceeds the maximum iova size that can
+be allocated in the domain.
+
+After judging that retry_pfn is less than limit_pfn, call retry_pfn+1
+to fix the overflow issue.
+
+Signed-off-by: jianjiao zeng <jianjiao.zeng@mediatek.com>
+Signed-off-by: Yunfei Wang <yf.wang@mediatek.com>
+Cc: <stable@vger.kernel.org> # 5.15.*
+Fixes: 4e89dce72521 ("iommu/iova: Retry from last rb tree node if iova search fails")
+Acked-by: Robin Murphy <robin.murphy@arm.com>
+Link: https://lore.kernel.org/r/20230111063801.25107-1-yf.wang@mediatek.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/iova.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/iommu/iova.c
++++ b/drivers/iommu/iova.c
+@@ -252,7 +252,7 @@ static int __alloc_and_insert_iova_range
+ 
+       curr = __get_cached_rbnode(iovad, limit_pfn);
+       curr_iova = to_iova(curr);
+-      retry_pfn = curr_iova->pfn_hi + 1;
++      retry_pfn = curr_iova->pfn_hi;
+ 
+ retry:
+       do {
+@@ -266,7 +266,7 @@ retry:
+       if (high_pfn < size || new_pfn < low_pfn) {
+               if (low_pfn == iovad->start_pfn && retry_pfn < limit_pfn) {
+                       high_pfn = limit_pfn;
+-                      low_pfn = retry_pfn;
++                      low_pfn = retry_pfn + 1;
+                       curr = iova_find_limit(iovad, limit_pfn);
+                       curr_iova = to_iova(curr);
+                       goto retry;

diff --git a/queue-5.15/iommu-mediatek-v1-fix-an-error-handling-path-in-mtk_iommu_v1_probe.patch b/queue-5.15/iommu-mediatek-v1-fix-an-error-handling-path-in-mtk_iommu_v1_probe.patch
new file mode 100644 (file)
index 0000000..ea41096
--- /dev/null
+++ b/queue-5.15/iommu-mediatek-v1-fix-an-error-handling-path-in-mtk_iommu_v1_probe.patch
@@ -0,0 +1,47 @@
+From 142e821f68cf5da79ce722cb9c1323afae30e185 Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Mon, 19 Dec 2022 19:06:22 +0100
+Subject: iommu/mediatek-v1: Fix an error handling path in mtk_iommu_v1_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+commit 142e821f68cf5da79ce722cb9c1323afae30e185 upstream.
+
+A clk, prepared and enabled in mtk_iommu_v1_hw_init(), is not released in
+the error handling path of mtk_iommu_v1_probe().
+
+Add the corresponding clk_disable_unprepare(), as already done in the
+remove function.
+
+Fixes: b17336c55d89 ("iommu/mediatek: add support for mtk iommu generation one HW")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Yong Wu <yong.wu@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Link: https://lore.kernel.org/r/593e7b7d97c6e064b29716b091a9d4fd122241fb.1671473163.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/mtk_iommu_v1.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/iommu/mtk_iommu_v1.c
++++ b/drivers/iommu/mtk_iommu_v1.c
+@@ -655,7 +655,7 @@ static int mtk_iommu_probe(struct platfo
+       ret = iommu_device_sysfs_add(&data->iommu, &pdev->dev, NULL,
+                                    dev_name(&pdev->dev));
+       if (ret)
+-              return ret;
++              goto out_clk_unprepare;
+ 
+       ret = iommu_device_register(&data->iommu, &mtk_iommu_ops, dev);
+       if (ret)
+@@ -678,6 +678,8 @@ out_dev_unreg:
+       iommu_device_unregister(&data->iommu);
+ out_sysfs_remove:
+       iommu_device_sysfs_remove(&data->iommu);
++out_clk_unprepare:
++      clk_disable_unprepare(data->bclk);
+       return ret;
+ }
+ 

diff --git a/queue-5.15/series b/queue-5.15/series
index 1f92db23370eb2057ecaa9dafbd5a8d9a0c95b98..585f4c5304648dfae86e2107bc6057cd4d66e788 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -34,3 +34,5 @@ ixgbe-fix-pci-device-refcount-leak.patch
 ipv6-raw-deduct-extension-header-length-in-rawv6_push_pending_frames.patch
 bus-mhi-host-fix-race-between-channel-preparation-an.patch
 usb-ulpi-defer-ulpi_register-on-ulpi_read_id-timeout.patch
+iommu-iova-fix-alloc-iova-overflows-issue.patch
+iommu-mediatek-v1-fix-an-error-handling-path-in-mtk_iommu_v1_probe.patch