From: Sasha Levin Date: Thu, 19 Sep 2024 19:36:31 +0000 (-0400) Subject: Fixes for 4.19 X-Git-Tag: v6.1.112~40 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8ce8b1c9dcf3f5625be3a6a4afd5815c55c0ea49;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/asoc-allow-module-autoloading-for-table-db1200_pids.patch b/queue-4.19/asoc-allow-module-autoloading-for-table-db1200_pids.patch new file mode 100644 index 00000000000..54a445bb2f3 --- /dev/null +++ b/queue-4.19/asoc-allow-module-autoloading-for-table-db1200_pids.patch @@ -0,0 +1,35 @@ +From 2c5d73255987a6d42a52735a8bfbe2e3390ae2aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Aug 2024 14:19:54 +0800 +Subject: ASoC: allow module autoloading for table db1200_pids + +From: Hongbo Li + +[ Upstream commit 0e9fdab1e8df490354562187cdbb8dec643eae2c ] + +Add MODULE_DEVICE_TABLE(), so modules could be properly +autoloaded based on the alias from platform_device_id table. + +Signed-off-by: Hongbo Li +Link: https://patch.msgid.link/20240821061955.2273782-2-lihongbo22@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/au1x/db1200.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/au1x/db1200.c b/sound/soc/au1x/db1200.c +index 301e1fc9a3773..24d16e6bf7501 100644 +--- a/sound/soc/au1x/db1200.c ++++ b/sound/soc/au1x/db1200.c +@@ -43,6 +43,7 @@ static const struct platform_device_id db1200_pids[] = { + }, + {}, + }; ++MODULE_DEVICE_TABLE(platform, db1200_pids); + + /*------------------------- AC97 PART ---------------------------*/ + +-- +2.43.0 + diff --git a/queue-4.19/asoc-allow-module-autoloading-for-table-db1200_pids.patch-4910 b/queue-4.19/asoc-allow-module-autoloading-for-table-db1200_pids.patch-4910 new file mode 100644 index 00000000000..54a445bb2f3 --- /dev/null +++ b/queue-4.19/asoc-allow-module-autoloading-for-table-db1200_pids.patch-4910 @@ -0,0 +1,35 @@ +From 2c5d73255987a6d42a52735a8bfbe2e3390ae2aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Aug 2024 14:19:54 +0800 +Subject: ASoC: allow module autoloading for table db1200_pids + +From: Hongbo Li + +[ Upstream commit 0e9fdab1e8df490354562187cdbb8dec643eae2c ] + +Add MODULE_DEVICE_TABLE(), so modules could be properly +autoloaded based on the alias from platform_device_id table. + +Signed-off-by: Hongbo Li +Link: https://patch.msgid.link/20240821061955.2273782-2-lihongbo22@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/au1x/db1200.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/au1x/db1200.c b/sound/soc/au1x/db1200.c +index 301e1fc9a3773..24d16e6bf7501 100644 +--- a/sound/soc/au1x/db1200.c ++++ b/sound/soc/au1x/db1200.c +@@ -43,6 +43,7 @@ static const struct platform_device_id db1200_pids[] = { + }, + {}, + }; ++MODULE_DEVICE_TABLE(platform, db1200_pids); + + /*------------------------- AC97 PART ---------------------------*/ + +-- +2.43.0 + diff --git a/queue-4.19/asoc-tda7419-fix-module-autoloading.patch b/queue-4.19/asoc-tda7419-fix-module-autoloading.patch new file mode 100644 index 00000000000..eeecc1c9eff --- /dev/null +++ b/queue-4.19/asoc-tda7419-fix-module-autoloading.patch @@ -0,0 +1,35 @@ +From 1770abf5e9451abe3f80799c20ca27c4909c8cef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Aug 2024 08:49:23 +0000 +Subject: ASoC: tda7419: fix module autoloading + +From: Liao Chen + +[ Upstream commit 934b44589da9aa300201a00fe139c5c54f421563 ] + +Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded +based on the alias from of_device_id table. + +Signed-off-by: Liao Chen +Link: https://patch.msgid.link/20240826084924.368387-4-liaochen4@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tda7419.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/tda7419.c b/sound/soc/codecs/tda7419.c +index 7f3b79c5a5638..a3fc9b7fefd81 100644 +--- a/sound/soc/codecs/tda7419.c ++++ b/sound/soc/codecs/tda7419.c +@@ -637,6 +637,7 @@ static const struct of_device_id tda7419_of_match[] = { + { .compatible = "st,tda7419" }, + { }, + }; ++MODULE_DEVICE_TABLE(of, tda7419_of_match); + + static struct i2c_driver tda7419_driver = { + .driver = { +-- +2.43.0 + diff --git a/queue-4.19/asoc-tda7419-fix-module-autoloading.patch-3325 b/queue-4.19/asoc-tda7419-fix-module-autoloading.patch-3325 new file mode 100644 index 00000000000..eeecc1c9eff --- /dev/null +++ b/queue-4.19/asoc-tda7419-fix-module-autoloading.patch-3325 @@ -0,0 +1,35 @@ +From 1770abf5e9451abe3f80799c20ca27c4909c8cef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Aug 2024 08:49:23 +0000 +Subject: ASoC: tda7419: fix module autoloading + +From: Liao Chen + +[ Upstream commit 934b44589da9aa300201a00fe139c5c54f421563 ] + +Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded +based on the alias from of_device_id table. + +Signed-off-by: Liao Chen +Link: https://patch.msgid.link/20240826084924.368387-4-liaochen4@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tda7419.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/tda7419.c b/sound/soc/codecs/tda7419.c +index 7f3b79c5a5638..a3fc9b7fefd81 100644 +--- a/sound/soc/codecs/tda7419.c ++++ b/sound/soc/codecs/tda7419.c +@@ -637,6 +637,7 @@ static const struct of_device_id tda7419_of_match[] = { + { .compatible = "st,tda7419" }, + { }, + }; ++MODULE_DEVICE_TABLE(of, tda7419_of_match); + + static struct i2c_driver tda7419_driver = { + .driver = { +-- +2.43.0 + diff --git a/queue-4.19/microblaze-don-t-treat-zero-reserved-memory-regions-.patch b/queue-4.19/microblaze-don-t-treat-zero-reserved-memory-regions-.patch new file mode 100644 index 00000000000..2488ddb733a --- /dev/null +++ b/queue-4.19/microblaze-don-t-treat-zero-reserved-memory-regions-.patch @@ -0,0 +1,51 @@ +From dfc65ed8469bc167c0ddfc718a4d420864e516e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jul 2024 08:33:27 +0300 +Subject: microblaze: don't treat zero reserved memory regions as error + +From: Mike Rapoport + +[ Upstream commit 0075df288dd8a7abfe03b3766176c393063591dd ] + +Before commit 721f4a6526da ("mm/memblock: remove empty dummy entry") the +check for non-zero of memblock.reserved.cnt in mmu_init() would always +be true either because memblock.reserved.cnt is initialized to 1 or +because there were memory reservations earlier. + +The removal of dummy empty entry in memblock caused this check to fail +because now memblock.reserved.cnt is initialized to 0. + +Remove the check for non-zero of memblock.reserved.cnt because it's +perfectly fine to have an empty memblock.reserved array that early in +boot. + +Reported-by: Guenter Roeck +Signed-off-by: Mike Rapoport +Reviewed-by: Wei Yang +Tested-by: Guenter Roeck +Link: https://lore.kernel.org/r/20240729053327.4091459-1-rppt@kernel.org +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + arch/microblaze/mm/init.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/arch/microblaze/mm/init.c b/arch/microblaze/mm/init.c +index df6de7ccdc2eb..ecad6d8b9154b 100644 +--- a/arch/microblaze/mm/init.c ++++ b/arch/microblaze/mm/init.c +@@ -289,11 +289,6 @@ asmlinkage void __init mmu_init(void) + { + unsigned int kstart, ksize; + +- if (!memblock.reserved.cnt) { +- pr_emerg("Error memory count\n"); +- machine_restart(NULL); +- } +- + if ((u32) memblock.memory.regions[0].size < 0x400000) { + pr_emerg("Memory must be greater than 4MB\n"); + machine_restart(NULL); +-- +2.43.0 + diff --git a/queue-4.19/microblaze-don-t-treat-zero-reserved-memory-regions-.patch-7358 b/queue-4.19/microblaze-don-t-treat-zero-reserved-memory-regions-.patch-7358 new file mode 100644 index 00000000000..2488ddb733a --- /dev/null +++ b/queue-4.19/microblaze-don-t-treat-zero-reserved-memory-regions-.patch-7358 @@ -0,0 +1,51 @@ +From dfc65ed8469bc167c0ddfc718a4d420864e516e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jul 2024 08:33:27 +0300 +Subject: microblaze: don't treat zero reserved memory regions as error + +From: Mike Rapoport + +[ Upstream commit 0075df288dd8a7abfe03b3766176c393063591dd ] + +Before commit 721f4a6526da ("mm/memblock: remove empty dummy entry") the +check for non-zero of memblock.reserved.cnt in mmu_init() would always +be true either because memblock.reserved.cnt is initialized to 1 or +because there were memory reservations earlier. + +The removal of dummy empty entry in memblock caused this check to fail +because now memblock.reserved.cnt is initialized to 0. + +Remove the check for non-zero of memblock.reserved.cnt because it's +perfectly fine to have an empty memblock.reserved array that early in +boot. + +Reported-by: Guenter Roeck +Signed-off-by: Mike Rapoport +Reviewed-by: Wei Yang +Tested-by: Guenter Roeck +Link: https://lore.kernel.org/r/20240729053327.4091459-1-rppt@kernel.org +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + arch/microblaze/mm/init.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/arch/microblaze/mm/init.c b/arch/microblaze/mm/init.c +index df6de7ccdc2eb..ecad6d8b9154b 100644 +--- a/arch/microblaze/mm/init.c ++++ b/arch/microblaze/mm/init.c +@@ -289,11 +289,6 @@ asmlinkage void __init mmu_init(void) + { + unsigned int kstart, ksize; + +- if (!memblock.reserved.cnt) { +- pr_emerg("Error memory count\n"); +- machine_restart(NULL); +- } +- + if ((u32) memblock.memory.regions[0].size < 0x400000) { + pr_emerg("Memory must be greater than 4MB\n"); + machine_restart(NULL); +-- +2.43.0 + diff --git a/queue-4.19/net-ftgmac100-ensure-tx-descriptor-updates-are-visib.patch b/queue-4.19/net-ftgmac100-ensure-tx-descriptor-updates-are-visib.patch new file mode 100644 index 00000000000..3ba946f90c1 --- /dev/null +++ b/queue-4.19/net-ftgmac100-ensure-tx-descriptor-updates-are-visib.patch @@ -0,0 +1,109 @@ +From b2ee7f437da10883fdb857fe2e4482977019c105 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Aug 2024 15:30:06 +0800 +Subject: net: ftgmac100: Ensure tx descriptor updates are visible + +From: Jacky Chou + +[ Upstream commit 4186c8d9e6af57bab0687b299df10ebd47534a0a ] + +The driver must ensure TX descriptor updates are visible +before updating TX pointer and TX clear pointer. + +This resolves TX hangs observed on AST2600 when running +iperf3. + +Signed-off-by: Jacky Chou +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/faraday/ftgmac100.c | 26 ++++++++++++++++-------- + 1 file changed, 18 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c +index 23c019d1278cd..f6ed8d167d53c 100644 +--- a/drivers/net/ethernet/faraday/ftgmac100.c ++++ b/drivers/net/ethernet/faraday/ftgmac100.c +@@ -579,7 +579,7 @@ static bool ftgmac100_rx_packet(struct ftgmac100 *priv, int *processed) + (*processed)++; + return true; + +- drop: ++drop: + /* Clean rxdes0 (which resets own bit) */ + rxdes->rxdes0 = cpu_to_le32(status & priv->rxdes0_edorr_mask); + priv->rx_pointer = ftgmac100_next_rx_pointer(priv, pointer); +@@ -663,6 +663,11 @@ static bool ftgmac100_tx_complete_packet(struct ftgmac100 *priv) + ftgmac100_free_tx_packet(priv, pointer, skb, txdes, ctl_stat); + txdes->txdes0 = cpu_to_le32(ctl_stat & priv->txdes0_edotr_mask); + ++ /* Ensure the descriptor config is visible before setting the tx ++ * pointer. ++ */ ++ smp_wmb(); ++ + priv->tx_clean_pointer = ftgmac100_next_tx_pointer(priv, pointer); + + return true; +@@ -816,6 +821,11 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb, + dma_wmb(); + first->txdes0 = cpu_to_le32(f_ctl_stat); + ++ /* Ensure the descriptor config is visible before setting the tx ++ * pointer. ++ */ ++ smp_wmb(); ++ + /* Update next TX pointer */ + priv->tx_pointer = pointer; + +@@ -836,7 +846,7 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb, + + return NETDEV_TX_OK; + +- dma_err: ++dma_err: + if (net_ratelimit()) + netdev_err(netdev, "map tx fragment failed\n"); + +@@ -858,7 +868,7 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb, + * last fragment, so we know ftgmac100_free_tx_packet() + * hasn't freed the skb yet. + */ +- drop: ++drop: + /* Drop the packet */ + dev_kfree_skb_any(skb); + netdev->stats.tx_dropped++; +@@ -1444,7 +1454,7 @@ static void ftgmac100_reset_task(struct work_struct *work) + ftgmac100_init_all(priv, true); + + netdev_dbg(netdev, "Reset done !\n"); +- bail: ++bail: + if (priv->mii_bus) + mutex_unlock(&priv->mii_bus->mdio_lock); + if (netdev->phydev) +@@ -1515,15 +1525,15 @@ static int ftgmac100_open(struct net_device *netdev) + + return 0; + +- err_ncsi: ++err_ncsi: + napi_disable(&priv->napi); + netif_stop_queue(netdev); +- err_alloc: ++err_alloc: + ftgmac100_free_buffers(priv); + free_irq(netdev->irq, netdev); +- err_irq: ++err_irq: + netif_napi_del(&priv->napi); +- err_hw: ++err_hw: + iowrite32(0, priv->base + FTGMAC100_OFFSET_IER); + ftgmac100_free_rings(priv); + return err; +-- +2.43.0 + diff --git a/queue-4.19/net-ftgmac100-ensure-tx-descriptor-updates-are-visib.patch-24437 b/queue-4.19/net-ftgmac100-ensure-tx-descriptor-updates-are-visib.patch-24437 new file mode 100644 index 00000000000..3ba946f90c1 --- /dev/null +++ b/queue-4.19/net-ftgmac100-ensure-tx-descriptor-updates-are-visib.patch-24437 @@ -0,0 +1,109 @@ +From b2ee7f437da10883fdb857fe2e4482977019c105 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Aug 2024 15:30:06 +0800 +Subject: net: ftgmac100: Ensure tx descriptor updates are visible + +From: Jacky Chou + +[ Upstream commit 4186c8d9e6af57bab0687b299df10ebd47534a0a ] + +The driver must ensure TX descriptor updates are visible +before updating TX pointer and TX clear pointer. + +This resolves TX hangs observed on AST2600 when running +iperf3. + +Signed-off-by: Jacky Chou +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/faraday/ftgmac100.c | 26 ++++++++++++++++-------- + 1 file changed, 18 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c +index 23c019d1278cd..f6ed8d167d53c 100644 +--- a/drivers/net/ethernet/faraday/ftgmac100.c ++++ b/drivers/net/ethernet/faraday/ftgmac100.c +@@ -579,7 +579,7 @@ static bool ftgmac100_rx_packet(struct ftgmac100 *priv, int *processed) + (*processed)++; + return true; + +- drop: ++drop: + /* Clean rxdes0 (which resets own bit) */ + rxdes->rxdes0 = cpu_to_le32(status & priv->rxdes0_edorr_mask); + priv->rx_pointer = ftgmac100_next_rx_pointer(priv, pointer); +@@ -663,6 +663,11 @@ static bool ftgmac100_tx_complete_packet(struct ftgmac100 *priv) + ftgmac100_free_tx_packet(priv, pointer, skb, txdes, ctl_stat); + txdes->txdes0 = cpu_to_le32(ctl_stat & priv->txdes0_edotr_mask); + ++ /* Ensure the descriptor config is visible before setting the tx ++ * pointer. ++ */ ++ smp_wmb(); ++ + priv->tx_clean_pointer = ftgmac100_next_tx_pointer(priv, pointer); + + return true; +@@ -816,6 +821,11 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb, + dma_wmb(); + first->txdes0 = cpu_to_le32(f_ctl_stat); + ++ /* Ensure the descriptor config is visible before setting the tx ++ * pointer. ++ */ ++ smp_wmb(); ++ + /* Update next TX pointer */ + priv->tx_pointer = pointer; + +@@ -836,7 +846,7 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb, + + return NETDEV_TX_OK; + +- dma_err: ++dma_err: + if (net_ratelimit()) + netdev_err(netdev, "map tx fragment failed\n"); + +@@ -858,7 +868,7 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb, + * last fragment, so we know ftgmac100_free_tx_packet() + * hasn't freed the skb yet. + */ +- drop: ++drop: + /* Drop the packet */ + dev_kfree_skb_any(skb); + netdev->stats.tx_dropped++; +@@ -1444,7 +1454,7 @@ static void ftgmac100_reset_task(struct work_struct *work) + ftgmac100_init_all(priv, true); + + netdev_dbg(netdev, "Reset done !\n"); +- bail: ++bail: + if (priv->mii_bus) + mutex_unlock(&priv->mii_bus->mdio_lock); + if (netdev->phydev) +@@ -1515,15 +1525,15 @@ static int ftgmac100_open(struct net_device *netdev) + + return 0; + +- err_ncsi: ++err_ncsi: + napi_disable(&priv->napi); + netif_stop_queue(netdev); +- err_alloc: ++err_alloc: + ftgmac100_free_buffers(priv); + free_irq(netdev->irq, netdev); +- err_irq: ++err_irq: + netif_napi_del(&priv->napi); +- err_hw: ++err_hw: + iowrite32(0, priv->base + FTGMAC100_OFFSET_IER); + ftgmac100_free_rings(priv); + return err; +-- +2.43.0 + diff --git a/queue-4.19/ocfs2-add-bounds-checking-to-ocfs2_xattr_find_entry.patch b/queue-4.19/ocfs2-add-bounds-checking-to-ocfs2_xattr_find_entry.patch new file mode 100644 index 00000000000..829fd202c9c --- /dev/null +++ b/queue-4.19/ocfs2-add-bounds-checking-to-ocfs2_xattr_find_entry.patch @@ -0,0 +1,85 @@ +From ec099dd5027d22c1c5286343756db11fdef46abd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 10:40:23 +0800 +Subject: ocfs2: add bounds checking to ocfs2_xattr_find_entry() + +From: Ferry Meng + +[ Upstream commit 9e3041fecdc8f78a5900c3aa51d3d756e73264d6 ] + +Add a paranoia check to make sure it doesn't stray beyond valid memory +region containing ocfs2 xattr entries when scanning for a match. It will +prevent out-of-bound access in case of crafted images. + +Link: https://lkml.kernel.org/r/20240520024024.1976129-1-joseph.qi@linux.alibaba.com +Signed-off-by: Ferry Meng +Signed-off-by: Joseph Qi +Reported-by: lei lu +Reviewed-by: Joseph Qi +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Gang He +Cc: Jun Piao +Signed-off-by: Andrew Morton +Stable-dep-of: af77c4fc1871 ("ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()") +Signed-off-by: Sasha Levin +--- + fs/ocfs2/xattr.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c +index 54d881c9ac81e..8ec85c2503f23 100644 +--- a/fs/ocfs2/xattr.c ++++ b/fs/ocfs2/xattr.c +@@ -1076,7 +1076,7 @@ ssize_t ocfs2_listxattr(struct dentry *dentry, + return i_ret + b_ret; + } + +-static int ocfs2_xattr_find_entry(int name_index, ++static int ocfs2_xattr_find_entry(struct inode *inode, int name_index, + const char *name, + struct ocfs2_xattr_search *xs) + { +@@ -1090,6 +1090,10 @@ static int ocfs2_xattr_find_entry(int name_index, + name_len = strlen(name); + entry = xs->here; + for (i = 0; i < le16_to_cpu(xs->header->xh_count); i++) { ++ if ((void *)entry >= xs->end) { ++ ocfs2_error(inode->i_sb, "corrupted xattr entries"); ++ return -EFSCORRUPTED; ++ } + cmp = name_index - ocfs2_xattr_get_type(entry); + if (!cmp) + cmp = name_len - entry->xe_name_len; +@@ -1180,7 +1184,7 @@ static int ocfs2_xattr_ibody_get(struct inode *inode, + xs->base = (void *)xs->header; + xs->here = xs->header->xh_entries; + +- ret = ocfs2_xattr_find_entry(name_index, name, xs); ++ ret = ocfs2_xattr_find_entry(inode, name_index, name, xs); + if (ret) + return ret; + size = le64_to_cpu(xs->here->xe_value_size); +@@ -2712,7 +2716,7 @@ static int ocfs2_xattr_ibody_find(struct inode *inode, + + /* Find the named attribute. */ + if (oi->ip_dyn_features & OCFS2_INLINE_XATTR_FL) { +- ret = ocfs2_xattr_find_entry(name_index, name, xs); ++ ret = ocfs2_xattr_find_entry(inode, name_index, name, xs); + if (ret && ret != -ENODATA) + return ret; + xs->not_found = ret; +@@ -2847,7 +2851,7 @@ static int ocfs2_xattr_block_find(struct inode *inode, + xs->end = (void *)(blk_bh->b_data) + blk_bh->b_size; + xs->here = xs->header->xh_entries; + +- ret = ocfs2_xattr_find_entry(name_index, name, xs); ++ ret = ocfs2_xattr_find_entry(inode, name_index, name, xs); + } else + ret = ocfs2_xattr_index_block_find(inode, blk_bh, + name_index, +-- +2.43.0 + diff --git a/queue-4.19/ocfs2-add-bounds-checking-to-ocfs2_xattr_find_entry.patch-26800 b/queue-4.19/ocfs2-add-bounds-checking-to-ocfs2_xattr_find_entry.patch-26800 new file mode 100644 index 00000000000..829fd202c9c --- /dev/null +++ b/queue-4.19/ocfs2-add-bounds-checking-to-ocfs2_xattr_find_entry.patch-26800 @@ -0,0 +1,85 @@ +From ec099dd5027d22c1c5286343756db11fdef46abd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 10:40:23 +0800 +Subject: ocfs2: add bounds checking to ocfs2_xattr_find_entry() + +From: Ferry Meng + +[ Upstream commit 9e3041fecdc8f78a5900c3aa51d3d756e73264d6 ] + +Add a paranoia check to make sure it doesn't stray beyond valid memory +region containing ocfs2 xattr entries when scanning for a match. It will +prevent out-of-bound access in case of crafted images. + +Link: https://lkml.kernel.org/r/20240520024024.1976129-1-joseph.qi@linux.alibaba.com +Signed-off-by: Ferry Meng +Signed-off-by: Joseph Qi +Reported-by: lei lu +Reviewed-by: Joseph Qi +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Gang He +Cc: Jun Piao +Signed-off-by: Andrew Morton +Stable-dep-of: af77c4fc1871 ("ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()") +Signed-off-by: Sasha Levin +--- + fs/ocfs2/xattr.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c +index 54d881c9ac81e..8ec85c2503f23 100644 +--- a/fs/ocfs2/xattr.c ++++ b/fs/ocfs2/xattr.c +@@ -1076,7 +1076,7 @@ ssize_t ocfs2_listxattr(struct dentry *dentry, + return i_ret + b_ret; + } + +-static int ocfs2_xattr_find_entry(int name_index, ++static int ocfs2_xattr_find_entry(struct inode *inode, int name_index, + const char *name, + struct ocfs2_xattr_search *xs) + { +@@ -1090,6 +1090,10 @@ static int ocfs2_xattr_find_entry(int name_index, + name_len = strlen(name); + entry = xs->here; + for (i = 0; i < le16_to_cpu(xs->header->xh_count); i++) { ++ if ((void *)entry >= xs->end) { ++ ocfs2_error(inode->i_sb, "corrupted xattr entries"); ++ return -EFSCORRUPTED; ++ } + cmp = name_index - ocfs2_xattr_get_type(entry); + if (!cmp) + cmp = name_len - entry->xe_name_len; +@@ -1180,7 +1184,7 @@ static int ocfs2_xattr_ibody_get(struct inode *inode, + xs->base = (void *)xs->header; + xs->here = xs->header->xh_entries; + +- ret = ocfs2_xattr_find_entry(name_index, name, xs); ++ ret = ocfs2_xattr_find_entry(inode, name_index, name, xs); + if (ret) + return ret; + size = le64_to_cpu(xs->here->xe_value_size); +@@ -2712,7 +2716,7 @@ static int ocfs2_xattr_ibody_find(struct inode *inode, + + /* Find the named attribute. */ + if (oi->ip_dyn_features & OCFS2_INLINE_XATTR_FL) { +- ret = ocfs2_xattr_find_entry(name_index, name, xs); ++ ret = ocfs2_xattr_find_entry(inode, name_index, name, xs); + if (ret && ret != -ENODATA) + return ret; + xs->not_found = ret; +@@ -2847,7 +2851,7 @@ static int ocfs2_xattr_block_find(struct inode *inode, + xs->end = (void *)(blk_bh->b_data) + blk_bh->b_size; + xs->here = xs->header->xh_entries; + +- ret = ocfs2_xattr_find_entry(name_index, name, xs); ++ ret = ocfs2_xattr_find_entry(inode, name_index, name, xs); + } else + ret = ocfs2_xattr_index_block_find(inode, blk_bh, + name_index, +-- +2.43.0 + diff --git a/queue-4.19/ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xatt.patch b/queue-4.19/ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xatt.patch new file mode 100644 index 00000000000..ca62ac3af11 --- /dev/null +++ b/queue-4.19/ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xatt.patch @@ -0,0 +1,67 @@ +From c0545f60f2ab1c42136f3113ea2db727c9f463c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 10:40:24 +0800 +Subject: ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() + +From: Ferry Meng + +[ Upstream commit af77c4fc1871847b528d58b7fdafb4aa1f6a9262 ] + +xattr in ocfs2 maybe 'non-indexed', which saved with additional space +requested. It's better to check if the memory is out of bound before +memcmp, although this possibility mainly comes from crafted poisonous +images. + +Link: https://lkml.kernel.org/r/20240520024024.1976129-2-joseph.qi@linux.alibaba.com +Signed-off-by: Ferry Meng +Signed-off-by: Joseph Qi +Reported-by: lei lu +Reviewed-by: Joseph Qi +Cc: Changwei Ge +Cc: Gang He +Cc: Joel Becker +Cc: Jun Piao +Cc: Junxiao Bi +Cc: Mark Fasheh +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/ocfs2/xattr.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c +index 8ec85c2503f23..bf00c7d4282b2 100644 +--- a/fs/ocfs2/xattr.c ++++ b/fs/ocfs2/xattr.c +@@ -1082,7 +1082,7 @@ static int ocfs2_xattr_find_entry(struct inode *inode, int name_index, + { + struct ocfs2_xattr_entry *entry; + size_t name_len; +- int i, cmp = 1; ++ int i, name_offset, cmp = 1; + + if (name == NULL) + return -EINVAL; +@@ -1097,10 +1097,15 @@ static int ocfs2_xattr_find_entry(struct inode *inode, int name_index, + cmp = name_index - ocfs2_xattr_get_type(entry); + if (!cmp) + cmp = name_len - entry->xe_name_len; +- if (!cmp) +- cmp = memcmp(name, (xs->base + +- le16_to_cpu(entry->xe_name_offset)), +- name_len); ++ if (!cmp) { ++ name_offset = le16_to_cpu(entry->xe_name_offset); ++ if ((xs->base + name_offset + name_len) > xs->end) { ++ ocfs2_error(inode->i_sb, ++ "corrupted xattr entries"); ++ return -EFSCORRUPTED; ++ } ++ cmp = memcmp(name, (xs->base + name_offset), name_len); ++ } + if (cmp == 0) + break; + entry += 1; +-- +2.43.0 + diff --git a/queue-4.19/ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xatt.patch-12318 b/queue-4.19/ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xatt.patch-12318 new file mode 100644 index 00000000000..ca62ac3af11 --- /dev/null +++ b/queue-4.19/ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xatt.patch-12318 @@ -0,0 +1,67 @@ +From c0545f60f2ab1c42136f3113ea2db727c9f463c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 10:40:24 +0800 +Subject: ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() + +From: Ferry Meng + +[ Upstream commit af77c4fc1871847b528d58b7fdafb4aa1f6a9262 ] + +xattr in ocfs2 maybe 'non-indexed', which saved with additional space +requested. It's better to check if the memory is out of bound before +memcmp, although this possibility mainly comes from crafted poisonous +images. + +Link: https://lkml.kernel.org/r/20240520024024.1976129-2-joseph.qi@linux.alibaba.com +Signed-off-by: Ferry Meng +Signed-off-by: Joseph Qi +Reported-by: lei lu +Reviewed-by: Joseph Qi +Cc: Changwei Ge +Cc: Gang He +Cc: Joel Becker +Cc: Jun Piao +Cc: Junxiao Bi +Cc: Mark Fasheh +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/ocfs2/xattr.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c +index 8ec85c2503f23..bf00c7d4282b2 100644 +--- a/fs/ocfs2/xattr.c ++++ b/fs/ocfs2/xattr.c +@@ -1082,7 +1082,7 @@ static int ocfs2_xattr_find_entry(struct inode *inode, int name_index, + { + struct ocfs2_xattr_entry *entry; + size_t name_len; +- int i, cmp = 1; ++ int i, name_offset, cmp = 1; + + if (name == NULL) + return -EINVAL; +@@ -1097,10 +1097,15 @@ static int ocfs2_xattr_find_entry(struct inode *inode, int name_index, + cmp = name_index - ocfs2_xattr_get_type(entry); + if (!cmp) + cmp = name_len - entry->xe_name_len; +- if (!cmp) +- cmp = memcmp(name, (xs->base + +- le16_to_cpu(entry->xe_name_offset)), +- name_len); ++ if (!cmp) { ++ name_offset = le16_to_cpu(entry->xe_name_offset); ++ if ((xs->base + name_offset + name_len) > xs->end) { ++ ocfs2_error(inode->i_sb, ++ "corrupted xattr entries"); ++ return -EFSCORRUPTED; ++ } ++ cmp = memcmp(name, (xs->base + name_offset), name_len); ++ } + if (cmp == 0) + break; + entry += 1; +-- +2.43.0 + diff --git a/queue-4.19/pinctrl-at91-make-it-work-with-current-gpiolib.patch b/queue-4.19/pinctrl-at91-make-it-work-with-current-gpiolib.patch new file mode 100644 index 00000000000..b7ebefbf0e4 --- /dev/null +++ b/queue-4.19/pinctrl-at91-make-it-work-with-current-gpiolib.patch @@ -0,0 +1,51 @@ +From 0ab6e75966cb53e3d8d527ad607c22312a8c49d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jul 2024 01:16:26 +0200 +Subject: pinctrl: at91: make it work with current gpiolib + +From: Thomas Blocher + +[ Upstream commit 752f387faaae0ae2e84d3f496922524785e77d60 ] + +pinctrl-at91 currently does not support the gpio-groups devicetree +property and has no pin-range. +Because of this at91 gpios stopped working since patch +commit 2ab73c6d8323fa1e ("gpio: Support GPIO controllers without pin-ranges") +This was discussed in the patches +commit fc328a7d1fcce263 ("gpio: Revert regression in sysfs-gpio (gpiolib.c)") +commit 56e337f2cf132632 ("Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)"") + +As a workaround manually set pin-range via gpiochip_add_pin_range() until +a) pinctrl-at91 is reworked to support devicetree gpio-groups +b) another solution as mentioned in +commit 56e337f2cf132632 ("Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)"") +is found + +Signed-off-by: Thomas Blocher +Link: https://lore.kernel.org/5b992862-355d-f0de-cd3d-ff99e67a4ff1@ek-dev.de +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-at91.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c +index ad01cc5798232..48374945b2d7b 100644 +--- a/drivers/pinctrl/pinctrl-at91.c ++++ b/drivers/pinctrl/pinctrl-at91.c +@@ -1290,8 +1290,11 @@ static int at91_pinctrl_probe(struct platform_device *pdev) + + /* We will handle a range of GPIO pins */ + for (i = 0; i < gpio_banks; i++) +- if (gpio_chips[i]) ++ if (gpio_chips[i]) { + pinctrl_add_gpio_range(info->pctl, &gpio_chips[i]->range); ++ gpiochip_add_pin_range(&gpio_chips[i]->chip, dev_name(info->pctl->dev), 0, ++ gpio_chips[i]->range.pin_base, gpio_chips[i]->range.npins); ++ } + + dev_info(&pdev->dev, "initialized AT91 pinctrl driver\n"); + +-- +2.43.0 + diff --git a/queue-4.19/pinctrl-at91-make-it-work-with-current-gpiolib.patch-17804 b/queue-4.19/pinctrl-at91-make-it-work-with-current-gpiolib.patch-17804 new file mode 100644 index 00000000000..b7ebefbf0e4 --- /dev/null +++ b/queue-4.19/pinctrl-at91-make-it-work-with-current-gpiolib.patch-17804 @@ -0,0 +1,51 @@ +From 0ab6e75966cb53e3d8d527ad607c22312a8c49d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jul 2024 01:16:26 +0200 +Subject: pinctrl: at91: make it work with current gpiolib + +From: Thomas Blocher + +[ Upstream commit 752f387faaae0ae2e84d3f496922524785e77d60 ] + +pinctrl-at91 currently does not support the gpio-groups devicetree +property and has no pin-range. +Because of this at91 gpios stopped working since patch +commit 2ab73c6d8323fa1e ("gpio: Support GPIO controllers without pin-ranges") +This was discussed in the patches +commit fc328a7d1fcce263 ("gpio: Revert regression in sysfs-gpio (gpiolib.c)") +commit 56e337f2cf132632 ("Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)"") + +As a workaround manually set pin-range via gpiochip_add_pin_range() until +a) pinctrl-at91 is reworked to support devicetree gpio-groups +b) another solution as mentioned in +commit 56e337f2cf132632 ("Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)"") +is found + +Signed-off-by: Thomas Blocher +Link: https://lore.kernel.org/5b992862-355d-f0de-cd3d-ff99e67a4ff1@ek-dev.de +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-at91.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c +index ad01cc5798232..48374945b2d7b 100644 +--- a/drivers/pinctrl/pinctrl-at91.c ++++ b/drivers/pinctrl/pinctrl-at91.c +@@ -1290,8 +1290,11 @@ static int at91_pinctrl_probe(struct platform_device *pdev) + + /* We will handle a range of GPIO pins */ + for (i = 0; i < gpio_banks; i++) +- if (gpio_chips[i]) ++ if (gpio_chips[i]) { + pinctrl_add_gpio_range(info->pctl, &gpio_chips[i]->range); ++ gpiochip_add_pin_range(&gpio_chips[i]->chip, dev_name(info->pctl->dev), 0, ++ gpio_chips[i]->range.pin_base, gpio_chips[i]->range.npins); ++ } + + dev_info(&pdev->dev, "initialized AT91 pinctrl driver\n"); + +-- +2.43.0 + diff --git a/queue-4.19/series b/queue-4.19/series index 9ccee0e6e49..719ff979fb3 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -12,3 +12,25 @@ net-dpaa-pad-packets-to-eth_zlen.patch soundwire-stream-revert-soundwire-stream-fix-programming-slave-ports-for-non-continous-port-maps.patch selftests-vm-remove-call-to-ksft_set_plan.patch selftests-kcmp-remove-call-to-ksft_set_plan.patch +asoc-allow-module-autoloading-for-table-db1200_pids.patch +pinctrl-at91-make-it-work-with-current-gpiolib.patch +microblaze-don-t-treat-zero-reserved-memory-regions-.patch +net-ftgmac100-ensure-tx-descriptor-updates-are-visib.patch +wifi-iwlwifi-mvm-fix-iwl_mvm_max_scan_ie_fw_cmd_room.patch +wifi-iwlwifi-mvm-don-t-wait-for-tx-queues-if-firmwar.patch +asoc-tda7419-fix-module-autoloading.patch +spi-bcm63xx-enable-module-autoloading.patch +x86-hyperv-set-x86_feature_tsc_known_freq-when-hyper.patch +ocfs2-add-bounds-checking-to-ocfs2_xattr_find_entry.patch +ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xatt.patch +asoc-allow-module-autoloading-for-table-db1200_pids.patch-4910 +pinctrl-at91-make-it-work-with-current-gpiolib.patch-17804 +microblaze-don-t-treat-zero-reserved-memory-regions-.patch-7358 +net-ftgmac100-ensure-tx-descriptor-updates-are-visib.patch-24437 +wifi-iwlwifi-mvm-fix-iwl_mvm_max_scan_ie_fw_cmd_room.patch-8949 +wifi-iwlwifi-mvm-don-t-wait-for-tx-queues-if-firmwar.patch-20118 +asoc-tda7419-fix-module-autoloading.patch-3325 +spi-bcm63xx-enable-module-autoloading.patch-20682 +x86-hyperv-set-x86_feature_tsc_known_freq-when-hyper.patch-22412 +ocfs2-add-bounds-checking-to-ocfs2_xattr_find_entry.patch-26800 +ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xatt.patch-12318 diff --git a/queue-4.19/spi-bcm63xx-enable-module-autoloading.patch b/queue-4.19/spi-bcm63xx-enable-module-autoloading.patch new file mode 100644 index 00000000000..928ff5827b3 --- /dev/null +++ b/queue-4.19/spi-bcm63xx-enable-module-autoloading.patch @@ -0,0 +1,35 @@ +From 15d305f37267e10daba1a986360a386b06e1e960 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Aug 2024 09:42:31 +0000 +Subject: spi: bcm63xx: Enable module autoloading + +From: Liao Chen + +[ Upstream commit 709df70a20e990d262c473ad9899314039e8ec82 ] + +Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based +on the alias from of_device_id table. + +Signed-off-by: Liao Chen +Link: https://patch.msgid.link/20240831094231.795024-1-liaochen4@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bcm63xx.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c +index cc6ec3fb5bfdf..d57a75a5ab372 100644 +--- a/drivers/spi/spi-bcm63xx.c ++++ b/drivers/spi/spi-bcm63xx.c +@@ -490,6 +490,7 @@ static const struct of_device_id bcm63xx_spi_of_match[] = { + { .compatible = "brcm,bcm6358-spi", .data = &bcm6358_spi_reg_offsets }, + { }, + }; ++MODULE_DEVICE_TABLE(of, bcm63xx_spi_of_match); + + static int bcm63xx_spi_probe(struct platform_device *pdev) + { +-- +2.43.0 + diff --git a/queue-4.19/spi-bcm63xx-enable-module-autoloading.patch-20682 b/queue-4.19/spi-bcm63xx-enable-module-autoloading.patch-20682 new file mode 100644 index 00000000000..928ff5827b3 --- /dev/null +++ b/queue-4.19/spi-bcm63xx-enable-module-autoloading.patch-20682 @@ -0,0 +1,35 @@ +From 15d305f37267e10daba1a986360a386b06e1e960 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Aug 2024 09:42:31 +0000 +Subject: spi: bcm63xx: Enable module autoloading + +From: Liao Chen + +[ Upstream commit 709df70a20e990d262c473ad9899314039e8ec82 ] + +Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based +on the alias from of_device_id table. + +Signed-off-by: Liao Chen +Link: https://patch.msgid.link/20240831094231.795024-1-liaochen4@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bcm63xx.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c +index cc6ec3fb5bfdf..d57a75a5ab372 100644 +--- a/drivers/spi/spi-bcm63xx.c ++++ b/drivers/spi/spi-bcm63xx.c +@@ -490,6 +490,7 @@ static const struct of_device_id bcm63xx_spi_of_match[] = { + { .compatible = "brcm,bcm6358-spi", .data = &bcm6358_spi_reg_offsets }, + { }, + }; ++MODULE_DEVICE_TABLE(of, bcm63xx_spi_of_match); + + static int bcm63xx_spi_probe(struct platform_device *pdev) + { +-- +2.43.0 + diff --git a/queue-4.19/wifi-iwlwifi-mvm-don-t-wait-for-tx-queues-if-firmwar.patch b/queue-4.19/wifi-iwlwifi-mvm-don-t-wait-for-tx-queues-if-firmwar.patch new file mode 100644 index 00000000000..35ff52db201 --- /dev/null +++ b/queue-4.19/wifi-iwlwifi-mvm-don-t-wait-for-tx-queues-if-firmwar.patch @@ -0,0 +1,60 @@ +From be860584321ada13ec6519fd46b14a5ec2992979 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Aug 2024 19:17:04 +0300 +Subject: wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead + +From: Emmanuel Grumbach + +[ Upstream commit 3a84454f5204718ca5b4ad2c1f0bf2031e2403d1 ] + +There is a WARNING in iwl_trans_wait_tx_queues_empty() (that was +recently converted from just a message), that can be hit if we +wait for TX queues to become empty after firmware died. Clearly, +we can't expect anything from the firmware after it's declared dead. + +Don't call iwl_trans_wait_tx_queues_empty() in this case. While it could +be a good idea to stop the flow earlier, the flush functions do some +maintenance work that is not related to the firmware, so keep that part +of the code running even when the firmware is not running. + +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20240825191257.a7cbd794cee9.I44a739fbd4ffcc46b83844dd1c7b2eb0c7b270f6@changeid +[edit commit message] +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index 3f37fb64e71c2..3c00a737c4b34 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -4326,6 +4326,10 @@ static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop) + int i; + + if (!iwl_mvm_has_new_tx_api(mvm)) { ++ /* we can't ask the firmware anything if it is dead */ ++ if (test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, ++ &mvm->status)) ++ return; + if (drop) { + mutex_lock(&mvm->mutex); + iwl_mvm_flush_tx_path(mvm, +@@ -4407,8 +4411,11 @@ static void iwl_mvm_mac_flush(struct ieee80211_hw *hw, + + /* this can take a while, and we may need/want other operations + * to succeed while doing this, so do it without the mutex held ++ * If the firmware is dead, this can't work... + */ +- if (!drop && !iwl_mvm_has_new_tx_api(mvm)) ++ if (!drop && !iwl_mvm_has_new_tx_api(mvm) && ++ !test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, ++ &mvm->status)) + iwl_trans_wait_tx_queues_empty(mvm->trans, msk); + } + +-- +2.43.0 + diff --git a/queue-4.19/wifi-iwlwifi-mvm-don-t-wait-for-tx-queues-if-firmwar.patch-20118 b/queue-4.19/wifi-iwlwifi-mvm-don-t-wait-for-tx-queues-if-firmwar.patch-20118 new file mode 100644 index 00000000000..35ff52db201 --- /dev/null +++ b/queue-4.19/wifi-iwlwifi-mvm-don-t-wait-for-tx-queues-if-firmwar.patch-20118 @@ -0,0 +1,60 @@ +From be860584321ada13ec6519fd46b14a5ec2992979 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Aug 2024 19:17:04 +0300 +Subject: wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead + +From: Emmanuel Grumbach + +[ Upstream commit 3a84454f5204718ca5b4ad2c1f0bf2031e2403d1 ] + +There is a WARNING in iwl_trans_wait_tx_queues_empty() (that was +recently converted from just a message), that can be hit if we +wait for TX queues to become empty after firmware died. Clearly, +we can't expect anything from the firmware after it's declared dead. + +Don't call iwl_trans_wait_tx_queues_empty() in this case. While it could +be a good idea to stop the flow earlier, the flush functions do some +maintenance work that is not related to the firmware, so keep that part +of the code running even when the firmware is not running. + +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20240825191257.a7cbd794cee9.I44a739fbd4ffcc46b83844dd1c7b2eb0c7b270f6@changeid +[edit commit message] +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index 3f37fb64e71c2..3c00a737c4b34 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -4326,6 +4326,10 @@ static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop) + int i; + + if (!iwl_mvm_has_new_tx_api(mvm)) { ++ /* we can't ask the firmware anything if it is dead */ ++ if (test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, ++ &mvm->status)) ++ return; + if (drop) { + mutex_lock(&mvm->mutex); + iwl_mvm_flush_tx_path(mvm, +@@ -4407,8 +4411,11 @@ static void iwl_mvm_mac_flush(struct ieee80211_hw *hw, + + /* this can take a while, and we may need/want other operations + * to succeed while doing this, so do it without the mutex held ++ * If the firmware is dead, this can't work... + */ +- if (!drop && !iwl_mvm_has_new_tx_api(mvm)) ++ if (!drop && !iwl_mvm_has_new_tx_api(mvm) && ++ !test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, ++ &mvm->status)) + iwl_trans_wait_tx_queues_empty(mvm->trans, msk); + } + +-- +2.43.0 + diff --git a/queue-4.19/wifi-iwlwifi-mvm-fix-iwl_mvm_max_scan_ie_fw_cmd_room.patch b/queue-4.19/wifi-iwlwifi-mvm-fix-iwl_mvm_max_scan_ie_fw_cmd_room.patch new file mode 100644 index 00000000000..157274903d5 --- /dev/null +++ b/queue-4.19/wifi-iwlwifi-mvm-fix-iwl_mvm_max_scan_ie_fw_cmd_room.patch @@ -0,0 +1,58 @@ +From 63044834ab2a18f4db95eed8b5acf132d95f2e2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Aug 2024 19:17:06 +0300 +Subject: wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room() + +From: Daniel Gabay + +[ Upstream commit 916a5d9c5354c426220a0a6533a5e8ea1287d6ea ] + +Driver creates also the WFA TPC element, consider that in the +calculation. + +Signed-off-by: Daniel Gabay +Reviewed-by: Ilan Peer +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20240825191257.e710ce446b7f.I2715c6742e9c3d160e2ba41bc4b35de370d2ce34@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +index eb2d235e9dc59..7f9eeef17f231 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +@@ -91,6 +91,8 @@ + /* adaptive dwell default APs number in social channels (1, 6, 11) */ + #define IWL_SCAN_ADWELL_DEFAULT_N_APS_SOCIAL 10 + ++#define WFA_TPC_IE_LEN 9 ++ + struct iwl_mvm_scan_timing_params { + u32 suspend_time; + u32 max_out_time; +@@ -328,8 +330,8 @@ static int iwl_mvm_max_scan_ie_fw_cmd_room(struct iwl_mvm *mvm) + + max_probe_len = SCAN_OFFLOAD_PROBE_REQ_SIZE; + +- /* we create the 802.11 header and SSID element */ +- max_probe_len -= 24 + 2; ++ /* we create the 802.11 header SSID element and WFA TPC element */ ++ max_probe_len -= 24 + 2 + WFA_TPC_IE_LEN; + + /* DS parameter set element is added on 2.4GHZ band if required */ + if (iwl_mvm_rrm_scan_needed(mvm)) +@@ -727,8 +729,6 @@ static u8 *iwl_mvm_copy_and_insert_ds_elem(struct iwl_mvm *mvm, const u8 *ies, + return newpos; + } + +-#define WFA_TPC_IE_LEN 9 +- + static void iwl_mvm_add_tpc_report_ie(u8 *pos) + { + pos[0] = WLAN_EID_VENDOR_SPECIFIC; +-- +2.43.0 + diff --git a/queue-4.19/wifi-iwlwifi-mvm-fix-iwl_mvm_max_scan_ie_fw_cmd_room.patch-8949 b/queue-4.19/wifi-iwlwifi-mvm-fix-iwl_mvm_max_scan_ie_fw_cmd_room.patch-8949 new file mode 100644 index 00000000000..157274903d5 --- /dev/null +++ b/queue-4.19/wifi-iwlwifi-mvm-fix-iwl_mvm_max_scan_ie_fw_cmd_room.patch-8949 @@ -0,0 +1,58 @@ +From 63044834ab2a18f4db95eed8b5acf132d95f2e2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Aug 2024 19:17:06 +0300 +Subject: wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room() + +From: Daniel Gabay + +[ Upstream commit 916a5d9c5354c426220a0a6533a5e8ea1287d6ea ] + +Driver creates also the WFA TPC element, consider that in the +calculation. + +Signed-off-by: Daniel Gabay +Reviewed-by: Ilan Peer +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20240825191257.e710ce446b7f.I2715c6742e9c3d160e2ba41bc4b35de370d2ce34@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +index eb2d235e9dc59..7f9eeef17f231 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +@@ -91,6 +91,8 @@ + /* adaptive dwell default APs number in social channels (1, 6, 11) */ + #define IWL_SCAN_ADWELL_DEFAULT_N_APS_SOCIAL 10 + ++#define WFA_TPC_IE_LEN 9 ++ + struct iwl_mvm_scan_timing_params { + u32 suspend_time; + u32 max_out_time; +@@ -328,8 +330,8 @@ static int iwl_mvm_max_scan_ie_fw_cmd_room(struct iwl_mvm *mvm) + + max_probe_len = SCAN_OFFLOAD_PROBE_REQ_SIZE; + +- /* we create the 802.11 header and SSID element */ +- max_probe_len -= 24 + 2; ++ /* we create the 802.11 header SSID element and WFA TPC element */ ++ max_probe_len -= 24 + 2 + WFA_TPC_IE_LEN; + + /* DS parameter set element is added on 2.4GHZ band if required */ + if (iwl_mvm_rrm_scan_needed(mvm)) +@@ -727,8 +729,6 @@ static u8 *iwl_mvm_copy_and_insert_ds_elem(struct iwl_mvm *mvm, const u8 *ies, + return newpos; + } + +-#define WFA_TPC_IE_LEN 9 +- + static void iwl_mvm_add_tpc_report_ie(u8 *pos) + { + pos[0] = WLAN_EID_VENDOR_SPECIFIC; +-- +2.43.0 + diff --git a/queue-4.19/x86-hyperv-set-x86_feature_tsc_known_freq-when-hyper.patch b/queue-4.19/x86-hyperv-set-x86_feature_tsc_known_freq-when-hyper.patch new file mode 100644 index 00000000000..023f854bf00 --- /dev/null +++ b/queue-4.19/x86-hyperv-set-x86_feature_tsc_known_freq-when-hyper.patch @@ -0,0 +1,49 @@ +From 9a2470548bfca6528d3fbee4cf29967c20fc120b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jun 2024 19:55:59 -0700 +Subject: x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides + frequency + +From: Michael Kelley + +[ Upstream commit 8fcc514809de41153b43ccbe1a0cdf7f72b78e7e ] + +A Linux guest on Hyper-V gets the TSC frequency from a synthetic MSR, if +available. In this case, set X86_FEATURE_TSC_KNOWN_FREQ so that Linux +doesn't unnecessarily do refined TSC calibration when setting up the TSC +clocksource. + +With this change, a message such as this is no longer output during boot +when the TSC is used as the clocksource: + +[ 1.115141] tsc: Refined TSC clocksource calibration: 2918.408 MHz + +Furthermore, the guest and host will have exactly the same view of the +TSC frequency, which is important for features such as the TSC deadline +timer that are emulated by the Hyper-V host. + +Signed-off-by: Michael Kelley +Reviewed-by: Roman Kisel +Link: https://lore.kernel.org/r/20240606025559.1631-1-mhklinux@outlook.com +Signed-off-by: Wei Liu +Message-ID: <20240606025559.1631-1-mhklinux@outlook.com> +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/mshyperv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c +index f8b0fa2dbe374..b43f25b3c99d3 100644 +--- a/arch/x86/kernel/cpu/mshyperv.c ++++ b/arch/x86/kernel/cpu/mshyperv.c +@@ -243,6 +243,7 @@ static void __init ms_hyperv_init_platform(void) + ms_hyperv.misc_features & HV_FEATURE_FREQUENCY_MSRS_AVAILABLE) { + x86_platform.calibrate_tsc = hv_get_tsc_khz; + x86_platform.calibrate_cpu = hv_get_tsc_khz; ++ setup_force_cpu_cap(X86_FEATURE_TSC_KNOWN_FREQ); + } + + if (ms_hyperv.hints & HV_X64_ENLIGHTENED_VMCS_RECOMMENDED) { +-- +2.43.0 + diff --git a/queue-4.19/x86-hyperv-set-x86_feature_tsc_known_freq-when-hyper.patch-22412 b/queue-4.19/x86-hyperv-set-x86_feature_tsc_known_freq-when-hyper.patch-22412 new file mode 100644 index 00000000000..023f854bf00 --- /dev/null +++ b/queue-4.19/x86-hyperv-set-x86_feature_tsc_known_freq-when-hyper.patch-22412 @@ -0,0 +1,49 @@ +From 9a2470548bfca6528d3fbee4cf29967c20fc120b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jun 2024 19:55:59 -0700 +Subject: x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides + frequency + +From: Michael Kelley + +[ Upstream commit 8fcc514809de41153b43ccbe1a0cdf7f72b78e7e ] + +A Linux guest on Hyper-V gets the TSC frequency from a synthetic MSR, if +available. In this case, set X86_FEATURE_TSC_KNOWN_FREQ so that Linux +doesn't unnecessarily do refined TSC calibration when setting up the TSC +clocksource. + +With this change, a message such as this is no longer output during boot +when the TSC is used as the clocksource: + +[ 1.115141] tsc: Refined TSC clocksource calibration: 2918.408 MHz + +Furthermore, the guest and host will have exactly the same view of the +TSC frequency, which is important for features such as the TSC deadline +timer that are emulated by the Hyper-V host. + +Signed-off-by: Michael Kelley +Reviewed-by: Roman Kisel +Link: https://lore.kernel.org/r/20240606025559.1631-1-mhklinux@outlook.com +Signed-off-by: Wei Liu +Message-ID: <20240606025559.1631-1-mhklinux@outlook.com> +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/mshyperv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c +index f8b0fa2dbe374..b43f25b3c99d3 100644 +--- a/arch/x86/kernel/cpu/mshyperv.c ++++ b/arch/x86/kernel/cpu/mshyperv.c +@@ -243,6 +243,7 @@ static void __init ms_hyperv_init_platform(void) + ms_hyperv.misc_features & HV_FEATURE_FREQUENCY_MSRS_AVAILABLE) { + x86_platform.calibrate_tsc = hv_get_tsc_khz; + x86_platform.calibrate_cpu = hv_get_tsc_khz; ++ setup_force_cpu_cap(X86_FEATURE_TSC_KNOWN_FREQ); + } + + if (ms_hyperv.hints & HV_X64_ENLIGHTENED_VMCS_RECOMMENDED) { +-- +2.43.0 +