From: Sasha Levin Date: Sun, 2 Apr 2023 13:40:18 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v4.14.312~48 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a4da44bbbc571270a2367024c7032832df2a3a62;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/bnxt_en-fix-typo-in-pci-id-to-device-description-str.patch b/queue-5.4/bnxt_en-fix-typo-in-pci-id-to-device-description-str.patch new file mode 100644 index 00000000000..d4f2a1b7ec0 --- /dev/null +++ b/queue-5.4/bnxt_en-fix-typo-in-pci-id-to-device-description-str.patch @@ -0,0 +1,47 @@ +From e19bb0c445d6d7171d87a8b3924495f5f6ad6529 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 18:30:20 -0700 +Subject: bnxt_en: Fix typo in PCI id to device description string mapping + +From: Kalesh AP + +[ Upstream commit 62aad36ed31abc80f35db11e187e690448a79f7d ] + +Fix 57502 and 57508 NPAR description string entries. The typos +caused these devices to not match up with lspci output. + +Fixes: 49c98421e6ab ("bnxt_en: Add PCI IDs for 57500 series NPAR devices.") +Reviewed-by: Pavan Chebbi +Signed-off-by: Kalesh AP +Signed-off-by: Michael Chan +Reviewed-by: Simon Horman +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 9fb1da36e9eb8..2c71e838fa3d8 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -221,12 +221,12 @@ static const struct pci_device_id bnxt_pci_tbl[] = { + { PCI_VDEVICE(BROADCOM, 0x1750), .driver_data = BCM57508 }, + { PCI_VDEVICE(BROADCOM, 0x1751), .driver_data = BCM57504 }, + { PCI_VDEVICE(BROADCOM, 0x1752), .driver_data = BCM57502 }, +- { PCI_VDEVICE(BROADCOM, 0x1800), .driver_data = BCM57508_NPAR }, ++ { PCI_VDEVICE(BROADCOM, 0x1800), .driver_data = BCM57502_NPAR }, + { PCI_VDEVICE(BROADCOM, 0x1801), .driver_data = BCM57504_NPAR }, +- { PCI_VDEVICE(BROADCOM, 0x1802), .driver_data = BCM57502_NPAR }, +- { PCI_VDEVICE(BROADCOM, 0x1803), .driver_data = BCM57508_NPAR }, ++ { PCI_VDEVICE(BROADCOM, 0x1802), .driver_data = BCM57508_NPAR }, ++ { PCI_VDEVICE(BROADCOM, 0x1803), .driver_data = BCM57502_NPAR }, + { PCI_VDEVICE(BROADCOM, 0x1804), .driver_data = BCM57504_NPAR }, +- { PCI_VDEVICE(BROADCOM, 0x1805), .driver_data = BCM57502_NPAR }, ++ { PCI_VDEVICE(BROADCOM, 0x1805), .driver_data = BCM57508_NPAR }, + { PCI_VDEVICE(BROADCOM, 0xd802), .driver_data = BCM58802 }, + { PCI_VDEVICE(BROADCOM, 0xd804), .driver_data = BCM58804 }, + #ifdef CONFIG_BNXT_SRIOV +-- +2.39.2 + diff --git a/queue-5.4/ca8210-fix-unsigned-mac_len-comparison-with-zero-in-.patch b/queue-5.4/ca8210-fix-unsigned-mac_len-comparison-with-zero-in-.patch new file mode 100644 index 00000000000..219cc1899c9 --- /dev/null +++ b/queue-5.4/ca8210-fix-unsigned-mac_len-comparison-with-zero-in-.patch @@ -0,0 +1,48 @@ +From 6ccd488b14f50040b62b925af0b2f8c165e882e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 11:18:24 -0800 +Subject: ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx() + +From: Harshit Mogalapalli + +[ Upstream commit 748b2f5e82d17480404b3e2895388fc2925f7caf ] + +mac_len is of type unsigned, which can never be less than zero. + + mac_len = ieee802154_hdr_peek_addrs(skb, &header); + if (mac_len < 0) + return mac_len; + +Change this to type int as ieee802154_hdr_peek_addrs() can return negative +integers, this is found by static analysis with smatch. + +Fixes: 6c993779ea1d ("ca8210: fix mac_len negative array access") +Signed-off-by: Harshit Mogalapalli +Acked-by: Alexander Aring +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230306191824.4115839-1-harshit.m.mogalapalli@oracle.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +--- + drivers/net/ieee802154/ca8210.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c +index 498a82ab4eaf4..fb57e561d3e61 100644 +--- a/drivers/net/ieee802154/ca8210.c ++++ b/drivers/net/ieee802154/ca8210.c +@@ -1944,10 +1944,9 @@ static int ca8210_skb_tx( + struct ca8210_priv *priv + ) + { +- int status; + struct ieee802154_hdr header = { }; + struct secspec secspec; +- unsigned int mac_len; ++ int mac_len, status; + + dev_dbg(&priv->spi->dev, "%s called\n", __func__); + +-- +2.39.2 + diff --git a/queue-5.4/can-bcm-bcm_tx_setup-fix-kmsan-uninit-value-in-vfs_w.patch b/queue-5.4/can-bcm-bcm_tx_setup-fix-kmsan-uninit-value-in-vfs_w.patch new file mode 100644 index 00000000000..dfae816fb43 --- /dev/null +++ b/queue-5.4/can-bcm-bcm_tx_setup-fix-kmsan-uninit-value-in-vfs_w.patch @@ -0,0 +1,118 @@ +From cb321a72724ee5bf250d4282fff4ab39bacddebd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Mar 2023 16:04:45 +0400 +Subject: can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write + +From: Ivan Orlov + +[ Upstream commit 2b4c99f7d9a57ecd644eda9b1fb0a1072414959f ] + +Syzkaller reported the following issue: + +===================================================== +BUG: KMSAN: uninit-value in aio_rw_done fs/aio.c:1520 [inline] +BUG: KMSAN: uninit-value in aio_write+0x899/0x950 fs/aio.c:1600 + aio_rw_done fs/aio.c:1520 [inline] + aio_write+0x899/0x950 fs/aio.c:1600 + io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019 + __do_sys_io_submit fs/aio.c:2078 [inline] + __se_sys_io_submit+0x293/0x770 fs/aio.c:2048 + __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Uninit was created at: + slab_post_alloc_hook mm/slab.h:766 [inline] + slab_alloc_node mm/slub.c:3452 [inline] + __kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491 + __do_kmalloc_node mm/slab_common.c:967 [inline] + __kmalloc+0x11d/0x3b0 mm/slab_common.c:981 + kmalloc_array include/linux/slab.h:636 [inline] + bcm_tx_setup+0x80e/0x29d0 net/can/bcm.c:930 + bcm_sendmsg+0x3a2/0xce0 net/can/bcm.c:1351 + sock_sendmsg_nosec net/socket.c:714 [inline] + sock_sendmsg net/socket.c:734 [inline] + sock_write_iter+0x495/0x5e0 net/socket.c:1108 + call_write_iter include/linux/fs.h:2189 [inline] + aio_write+0x63a/0x950 fs/aio.c:1600 + io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019 + __do_sys_io_submit fs/aio.c:2078 [inline] + __se_sys_io_submit+0x293/0x770 fs/aio.c:2048 + __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +CPU: 1 PID: 5034 Comm: syz-executor350 Not tainted 6.2.0-rc6-syzkaller-80422-geda666ff2276 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 +===================================================== + +We can follow the call chain and find that 'bcm_tx_setup' function +calls 'memcpy_from_msg' to copy some content to the newly allocated +frame of 'op->frames'. After that the 'len' field of copied structure +being compared with some constant value (64 or 8). However, if +'memcpy_from_msg' returns an error, we will compare some uninitialized +memory. This triggers 'uninit-value' issue. + +This patch will add 'memcpy_from_msg' possible errors processing to +avoid uninit-value issue. + +Tested via syzkaller + +Reported-by: syzbot+c9bfd85eca611ebf5db1@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?id=47f897f8ad958bbde5790ebf389b5e7e0a345089 +Signed-off-by: Ivan Orlov +Fixes: 6f3b911d5f29b ("can: bcm: add support for CAN FD frames") +Acked-by: Oliver Hartkopp +Link: https://lore.kernel.org/all/20230314120445.12407-1-ivan.orlov0322@gmail.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + net/can/bcm.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/net/can/bcm.c b/net/can/bcm.c +index fbf1143a56e13..23c7d5f896bd2 100644 +--- a/net/can/bcm.c ++++ b/net/can/bcm.c +@@ -938,6 +938,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, + + cf = op->frames + op->cfsiz * i; + err = memcpy_from_msg((u8 *)cf, msg, op->cfsiz); ++ if (err < 0) ++ goto free_op; + + if (op->flags & CAN_FD_FRAME) { + if (cf->len > 64) +@@ -947,12 +949,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, + err = -EINVAL; + } + +- if (err < 0) { +- if (op->frames != &op->sframe) +- kfree(op->frames); +- kfree(op); +- return err; +- } ++ if (err < 0) ++ goto free_op; + + if (msg_head->flags & TX_CP_CAN_ID) { + /* copy can_id into frame */ +@@ -1023,6 +1021,12 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, + bcm_tx_start_timer(op); + + return msg_head->nframes * op->cfsiz + MHSIZ; ++ ++free_op: ++ if (op->frames != &op->sframe) ++ kfree(op->frames); ++ kfree(op); ++ return err; + } + + /* +-- +2.39.2 + diff --git a/queue-5.4/dma-mapping-drop-the-dev-argument-to-arch_sync_dma_f.patch b/queue-5.4/dma-mapping-drop-the-dev-argument-to-arch_sync_dma_f.patch new file mode 100644 index 00000000000..a9212472260 --- /dev/null +++ b/queue-5.4/dma-mapping-drop-the-dev-argument-to-arch_sync_dma_f.patch @@ -0,0 +1,803 @@ +From ab4147841fa53d42510d4a04e8546df491354c2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2019 18:03:11 +0100 +Subject: dma-mapping: drop the dev argument to arch_sync_dma_for_* + +From: Christoph Hellwig + +[ Upstream commit 56e35f9c5b87ec1ae93e483284e189c84388de16 ] + +These are pure cache maintainance routines, so drop the unused +struct device argument. + +Signed-off-by: Christoph Hellwig +Suggested-by: Daniel Vetter +Stable-dep-of: ab327f8acdf8 ("mips: bmips: BCM6358: disable RAC flush for TP1") +Signed-off-by: Sasha Levin +--- + arch/arc/mm/dma.c | 8 ++++---- + arch/arm/mm/dma-mapping.c | 8 ++++---- + arch/arm/xen/mm.c | 12 ++++++------ + arch/arm64/mm/dma-mapping.c | 8 ++++---- + arch/c6x/mm/dma-coherent.c | 14 +++++++------- + arch/csky/mm/dma-mapping.c | 8 ++++---- + arch/hexagon/kernel/dma.c | 4 ++-- + arch/ia64/mm/init.c | 4 ++-- + arch/m68k/kernel/dma.c | 4 ++-- + arch/microblaze/kernel/dma.c | 14 +++++++------- + arch/mips/bmips/dma.c | 2 +- + arch/mips/jazz/jazzdma.c | 17 ++++++++--------- + arch/mips/mm/dma-noncoherent.c | 12 ++++++------ + arch/nds32/kernel/dma.c | 8 ++++---- + arch/nios2/mm/dma-mapping.c | 8 ++++---- + arch/openrisc/kernel/dma.c | 2 +- + arch/parisc/kernel/pci-dma.c | 8 ++++---- + arch/powerpc/mm/dma-noncoherent.c | 8 ++++---- + arch/sh/kernel/dma-coherent.c | 6 +++--- + arch/sparc/kernel/ioport.c | 4 ++-- + arch/xtensa/kernel/pci-dma.c | 8 ++++---- + drivers/iommu/dma-iommu.c | 10 +++++----- + drivers/xen/swiotlb-xen.c | 8 ++++---- + include/linux/dma-noncoherent.h | 20 ++++++++++---------- + include/xen/swiotlb-xen.h | 8 ++++---- + kernel/dma/direct.c | 14 +++++++------- + 26 files changed, 113 insertions(+), 114 deletions(-) + +diff --git a/arch/arc/mm/dma.c b/arch/arc/mm/dma.c +index 73a7e88a1e926..e947572a521ec 100644 +--- a/arch/arc/mm/dma.c ++++ b/arch/arc/mm/dma.c +@@ -48,8 +48,8 @@ void arch_dma_prep_coherent(struct page *page, size_t size) + * upper layer functions (in include/linux/dma-mapping.h) + */ + +-void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_device(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + switch (dir) { + case DMA_TO_DEVICE: +@@ -69,8 +69,8 @@ void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr, + } + } + +-void arch_sync_dma_for_cpu(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_cpu(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + switch (dir) { + case DMA_TO_DEVICE: +diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c +index 27576c7b836ee..fbfb9250e743a 100644 +--- a/arch/arm/mm/dma-mapping.c ++++ b/arch/arm/mm/dma-mapping.c +@@ -2332,15 +2332,15 @@ void arch_teardown_dma_ops(struct device *dev) + } + + #ifdef CONFIG_SWIOTLB +-void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_device(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + __dma_page_cpu_to_dev(phys_to_page(paddr), paddr & (PAGE_SIZE - 1), + size, dir); + } + +-void arch_sync_dma_for_cpu(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_cpu(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + __dma_page_dev_to_cpu(phys_to_page(paddr), paddr & (PAGE_SIZE - 1), + size, dir); +diff --git a/arch/arm/xen/mm.c b/arch/arm/xen/mm.c +index 38fa917c8585c..a6a2514e5fe8f 100644 +--- a/arch/arm/xen/mm.c ++++ b/arch/arm/xen/mm.c +@@ -70,20 +70,20 @@ static void dma_cache_maint(dma_addr_t handle, size_t size, u32 op) + * pfn_valid returns true the pages is local and we can use the native + * dma-direct functions, otherwise we call the Xen specific version. + */ +-void xen_dma_sync_for_cpu(struct device *dev, dma_addr_t handle, +- phys_addr_t paddr, size_t size, enum dma_data_direction dir) ++void xen_dma_sync_for_cpu(dma_addr_t handle, phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + if (pfn_valid(PFN_DOWN(handle))) +- arch_sync_dma_for_cpu(dev, paddr, size, dir); ++ arch_sync_dma_for_cpu(paddr, size, dir); + else if (dir != DMA_TO_DEVICE) + dma_cache_maint(handle, size, GNTTAB_CACHE_INVAL); + } + +-void xen_dma_sync_for_device(struct device *dev, dma_addr_t handle, +- phys_addr_t paddr, size_t size, enum dma_data_direction dir) ++void xen_dma_sync_for_device(dma_addr_t handle, phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + if (pfn_valid(PFN_DOWN(handle))) +- arch_sync_dma_for_device(dev, paddr, size, dir); ++ arch_sync_dma_for_device(paddr, size, dir); + else if (dir == DMA_FROM_DEVICE) + dma_cache_maint(handle, size, GNTTAB_CACHE_INVAL); + else +diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c +index 9239416e93d4e..6c45350e33aa5 100644 +--- a/arch/arm64/mm/dma-mapping.c ++++ b/arch/arm64/mm/dma-mapping.c +@@ -13,14 +13,14 @@ + + #include + +-void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_device(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + __dma_map_area(phys_to_virt(paddr), size, dir); + } + +-void arch_sync_dma_for_cpu(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_cpu(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + __dma_unmap_area(phys_to_virt(paddr), size, dir); + } +diff --git a/arch/c6x/mm/dma-coherent.c b/arch/c6x/mm/dma-coherent.c +index b319808e8f6bd..a5909091cb142 100644 +--- a/arch/c6x/mm/dma-coherent.c ++++ b/arch/c6x/mm/dma-coherent.c +@@ -140,7 +140,7 @@ void __init coherent_mem_init(phys_addr_t start, u32 size) + sizeof(long)); + } + +-static void c6x_dma_sync(struct device *dev, phys_addr_t paddr, size_t size, ++static void c6x_dma_sync(phys_addr_t paddr, size_t size, + enum dma_data_direction dir) + { + BUG_ON(!valid_dma_direction(dir)); +@@ -160,14 +160,14 @@ static void c6x_dma_sync(struct device *dev, phys_addr_t paddr, size_t size, + } + } + +-void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_device(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { +- return c6x_dma_sync(dev, paddr, size, dir); ++ return c6x_dma_sync(paddr, size, dir); + } + +-void arch_sync_dma_for_cpu(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_cpu(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { +- return c6x_dma_sync(dev, paddr, size, dir); ++ return c6x_dma_sync(paddr, size, dir); + } +diff --git a/arch/csky/mm/dma-mapping.c b/arch/csky/mm/dma-mapping.c +index 06e85b5654542..8f6571ae27c86 100644 +--- a/arch/csky/mm/dma-mapping.c ++++ b/arch/csky/mm/dma-mapping.c +@@ -58,8 +58,8 @@ void arch_dma_prep_coherent(struct page *page, size_t size) + cache_op(page_to_phys(page), size, dma_wbinv_set_zero_range); + } + +-void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_device(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + switch (dir) { + case DMA_TO_DEVICE: +@@ -74,8 +74,8 @@ void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr, + } + } + +-void arch_sync_dma_for_cpu(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_cpu(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + switch (dir) { + case DMA_TO_DEVICE: +diff --git a/arch/hexagon/kernel/dma.c b/arch/hexagon/kernel/dma.c +index f561b127c4b43..25f388d9cfcc3 100644 +--- a/arch/hexagon/kernel/dma.c ++++ b/arch/hexagon/kernel/dma.c +@@ -55,8 +55,8 @@ void arch_dma_free(struct device *dev, size_t size, void *vaddr, + gen_pool_free(coherent_pool, (unsigned long) vaddr, size); + } + +-void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_device(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + void *addr = phys_to_virt(paddr); + +diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c +index ee50506d86f42..df6d3dfa9d820 100644 +--- a/arch/ia64/mm/init.c ++++ b/arch/ia64/mm/init.c +@@ -73,8 +73,8 @@ __ia64_sync_icache_dcache (pte_t pte) + * DMA can be marked as "clean" so that lazy_mmu_prot_update() doesn't have to + * flush them when they get mapped into an executable vm-area. + */ +-void arch_sync_dma_for_cpu(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_cpu(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + unsigned long pfn = PHYS_PFN(paddr); + +diff --git a/arch/m68k/kernel/dma.c b/arch/m68k/kernel/dma.c +index 3fab684cc0db0..871a0e11da341 100644 +--- a/arch/m68k/kernel/dma.c ++++ b/arch/m68k/kernel/dma.c +@@ -61,8 +61,8 @@ void arch_dma_free(struct device *dev, size_t size, void *vaddr, + + #endif /* CONFIG_MMU && !CONFIG_COLDFIRE */ + +-void arch_sync_dma_for_device(struct device *dev, phys_addr_t handle, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_device(phys_addr_t handle, size_t size, ++ enum dma_data_direction dir) + { + switch (dir) { + case DMA_BIDIRECTIONAL: +diff --git a/arch/microblaze/kernel/dma.c b/arch/microblaze/kernel/dma.c +index a89c2d4ed5ffc..d7bebd04247b7 100644 +--- a/arch/microblaze/kernel/dma.c ++++ b/arch/microblaze/kernel/dma.c +@@ -15,7 +15,7 @@ + #include + #include + +-static void __dma_sync(struct device *dev, phys_addr_t paddr, size_t size, ++static void __dma_sync(phys_addr_t paddr, size_t size, + enum dma_data_direction direction) + { + switch (direction) { +@@ -31,14 +31,14 @@ static void __dma_sync(struct device *dev, phys_addr_t paddr, size_t size, + } + } + +-void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_device(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { +- __dma_sync(dev, paddr, size, dir); ++ __dma_sync(paddr, size, dir); + } + +-void arch_sync_dma_for_cpu(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_cpu(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { +- __dma_sync(dev, paddr, size, dir); ++ __dma_sync(paddr, size, dir); + } +diff --git a/arch/mips/bmips/dma.c b/arch/mips/bmips/dma.c +index 3d13c77c125f4..df56bf4179e34 100644 +--- a/arch/mips/bmips/dma.c ++++ b/arch/mips/bmips/dma.c +@@ -64,7 +64,7 @@ phys_addr_t __dma_to_phys(struct device *dev, dma_addr_t dma_addr) + return dma_addr; + } + +-void arch_sync_dma_for_cpu_all(struct device *dev) ++void arch_sync_dma_for_cpu_all(void) + { + void __iomem *cbr = BMIPS_GET_CBR(); + u32 cfg; +diff --git a/arch/mips/jazz/jazzdma.c b/arch/mips/jazz/jazzdma.c +index a01e14955187e..c64a297e82b3c 100644 +--- a/arch/mips/jazz/jazzdma.c ++++ b/arch/mips/jazz/jazzdma.c +@@ -592,7 +592,7 @@ static dma_addr_t jazz_dma_map_page(struct device *dev, struct page *page, + phys_addr_t phys = page_to_phys(page) + offset; + + if (!(attrs & DMA_ATTR_SKIP_CPU_SYNC)) +- arch_sync_dma_for_device(dev, phys, size, dir); ++ arch_sync_dma_for_device(phys, size, dir); + return vdma_alloc(phys, size); + } + +@@ -600,7 +600,7 @@ static void jazz_dma_unmap_page(struct device *dev, dma_addr_t dma_addr, + size_t size, enum dma_data_direction dir, unsigned long attrs) + { + if (!(attrs & DMA_ATTR_SKIP_CPU_SYNC)) +- arch_sync_dma_for_cpu(dev, vdma_log2phys(dma_addr), size, dir); ++ arch_sync_dma_for_cpu(vdma_log2phys(dma_addr), size, dir); + vdma_free(dma_addr); + } + +@@ -612,7 +612,7 @@ static int jazz_dma_map_sg(struct device *dev, struct scatterlist *sglist, + + for_each_sg(sglist, sg, nents, i) { + if (!(attrs & DMA_ATTR_SKIP_CPU_SYNC)) +- arch_sync_dma_for_device(dev, sg_phys(sg), sg->length, ++ arch_sync_dma_for_device(sg_phys(sg), sg->length, + dir); + sg->dma_address = vdma_alloc(sg_phys(sg), sg->length); + if (sg->dma_address == DMA_MAPPING_ERROR) +@@ -631,8 +631,7 @@ static void jazz_dma_unmap_sg(struct device *dev, struct scatterlist *sglist, + + for_each_sg(sglist, sg, nents, i) { + if (!(attrs & DMA_ATTR_SKIP_CPU_SYNC)) +- arch_sync_dma_for_cpu(dev, sg_phys(sg), sg->length, +- dir); ++ arch_sync_dma_for_cpu(sg_phys(sg), sg->length, dir); + vdma_free(sg->dma_address); + } + } +@@ -640,13 +639,13 @@ static void jazz_dma_unmap_sg(struct device *dev, struct scatterlist *sglist, + static void jazz_dma_sync_single_for_device(struct device *dev, + dma_addr_t addr, size_t size, enum dma_data_direction dir) + { +- arch_sync_dma_for_device(dev, vdma_log2phys(addr), size, dir); ++ arch_sync_dma_for_device(vdma_log2phys(addr), size, dir); + } + + static void jazz_dma_sync_single_for_cpu(struct device *dev, + dma_addr_t addr, size_t size, enum dma_data_direction dir) + { +- arch_sync_dma_for_cpu(dev, vdma_log2phys(addr), size, dir); ++ arch_sync_dma_for_cpu(vdma_log2phys(addr), size, dir); + } + + static void jazz_dma_sync_sg_for_device(struct device *dev, +@@ -656,7 +655,7 @@ static void jazz_dma_sync_sg_for_device(struct device *dev, + int i; + + for_each_sg(sgl, sg, nents, i) +- arch_sync_dma_for_device(dev, sg_phys(sg), sg->length, dir); ++ arch_sync_dma_for_device(sg_phys(sg), sg->length, dir); + } + + static void jazz_dma_sync_sg_for_cpu(struct device *dev, +@@ -666,7 +665,7 @@ static void jazz_dma_sync_sg_for_cpu(struct device *dev, + int i; + + for_each_sg(sgl, sg, nents, i) +- arch_sync_dma_for_cpu(dev, sg_phys(sg), sg->length, dir); ++ arch_sync_dma_for_cpu(sg_phys(sg), sg->length, dir); + } + + const struct dma_map_ops jazz_dma_ops = { +diff --git a/arch/mips/mm/dma-noncoherent.c b/arch/mips/mm/dma-noncoherent.c +index 1d4d57dd9acf8..6cfacb04865fd 100644 +--- a/arch/mips/mm/dma-noncoherent.c ++++ b/arch/mips/mm/dma-noncoherent.c +@@ -27,7 +27,7 @@ + * R10000 and R12000 are used in such systems, the SGI IP28 Indigo² rsp. + * SGI IP32 aka O2. + */ +-static inline bool cpu_needs_post_dma_flush(struct device *dev) ++static inline bool cpu_needs_post_dma_flush(void) + { + switch (boot_cpu_type()) { + case CPU_R10000: +@@ -118,17 +118,17 @@ static inline void dma_sync_phys(phys_addr_t paddr, size_t size, + } while (left); + } + +-void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_device(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + dma_sync_phys(paddr, size, dir); + } + + #ifdef CONFIG_ARCH_HAS_SYNC_DMA_FOR_CPU +-void arch_sync_dma_for_cpu(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_cpu(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { +- if (cpu_needs_post_dma_flush(dev)) ++ if (cpu_needs_post_dma_flush()) + dma_sync_phys(paddr, size, dir); + } + #endif +diff --git a/arch/nds32/kernel/dma.c b/arch/nds32/kernel/dma.c +index 4206d4b6c8cef..69d762182d49b 100644 +--- a/arch/nds32/kernel/dma.c ++++ b/arch/nds32/kernel/dma.c +@@ -46,8 +46,8 @@ static inline void cache_op(phys_addr_t paddr, size_t size, + } while (left); + } + +-void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_device(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + switch (dir) { + case DMA_FROM_DEVICE: +@@ -61,8 +61,8 @@ void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr, + } + } + +-void arch_sync_dma_for_cpu(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_cpu(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + switch (dir) { + case DMA_TO_DEVICE: +diff --git a/arch/nios2/mm/dma-mapping.c b/arch/nios2/mm/dma-mapping.c +index 9cb238664584c..0ed711e379020 100644 +--- a/arch/nios2/mm/dma-mapping.c ++++ b/arch/nios2/mm/dma-mapping.c +@@ -18,8 +18,8 @@ + #include + #include + +-void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_device(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + void *vaddr = phys_to_virt(paddr); + +@@ -42,8 +42,8 @@ void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr, + } + } + +-void arch_sync_dma_for_cpu(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_cpu(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + void *vaddr = phys_to_virt(paddr); + +diff --git a/arch/openrisc/kernel/dma.c b/arch/openrisc/kernel/dma.c +index 4d5b8bd1d7956..adec711ad39d5 100644 +--- a/arch/openrisc/kernel/dma.c ++++ b/arch/openrisc/kernel/dma.c +@@ -125,7 +125,7 @@ arch_dma_free(struct device *dev, size_t size, void *vaddr, + free_pages_exact(vaddr, size); + } + +-void arch_sync_dma_for_device(struct device *dev, phys_addr_t addr, size_t size, ++void arch_sync_dma_for_device(phys_addr_t addr, size_t size, + enum dma_data_direction dir) + { + unsigned long cl; +diff --git a/arch/parisc/kernel/pci-dma.c b/arch/parisc/kernel/pci-dma.c +index ca35d9a76e506..a60d47fd4d55f 100644 +--- a/arch/parisc/kernel/pci-dma.c ++++ b/arch/parisc/kernel/pci-dma.c +@@ -439,14 +439,14 @@ void arch_dma_free(struct device *dev, size_t size, void *vaddr, + free_pages((unsigned long)__va(dma_handle), order); + } + +-void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_device(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + flush_kernel_dcache_range((unsigned long)phys_to_virt(paddr), size); + } + +-void arch_sync_dma_for_cpu(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_cpu(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + flush_kernel_dcache_range((unsigned long)phys_to_virt(paddr), size); + } +diff --git a/arch/powerpc/mm/dma-noncoherent.c b/arch/powerpc/mm/dma-noncoherent.c +index 2a82984356f81..5ab4f868e919b 100644 +--- a/arch/powerpc/mm/dma-noncoherent.c ++++ b/arch/powerpc/mm/dma-noncoherent.c +@@ -104,14 +104,14 @@ static void __dma_sync_page(phys_addr_t paddr, size_t size, int dir) + #endif + } + +-void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_device(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + __dma_sync_page(paddr, size, dir); + } + +-void arch_sync_dma_for_cpu(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_cpu(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + __dma_sync_page(paddr, size, dir); + } +diff --git a/arch/sh/kernel/dma-coherent.c b/arch/sh/kernel/dma-coherent.c +index b17514619b7e1..eeb25a4fa55f2 100644 +--- a/arch/sh/kernel/dma-coherent.c ++++ b/arch/sh/kernel/dma-coherent.c +@@ -25,7 +25,7 @@ void *arch_dma_alloc(struct device *dev, size_t size, dma_addr_t *dma_handle, + * Pages from the page allocator may have data present in + * cache. So flush the cache before using uncached memory. + */ +- arch_sync_dma_for_device(dev, virt_to_phys(ret), size, ++ arch_sync_dma_for_device(virt_to_phys(ret), size, + DMA_BIDIRECTIONAL); + + ret_nocache = (void __force *)ioremap_nocache(virt_to_phys(ret), size); +@@ -59,8 +59,8 @@ void arch_dma_free(struct device *dev, size_t size, void *vaddr, + iounmap(vaddr); + } + +-void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_device(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + void *addr = sh_cacheop_vaddr(phys_to_virt(paddr)); + +diff --git a/arch/sparc/kernel/ioport.c b/arch/sparc/kernel/ioport.c +index b87e0002131dd..9d723c58557b2 100644 +--- a/arch/sparc/kernel/ioport.c ++++ b/arch/sparc/kernel/ioport.c +@@ -368,8 +368,8 @@ void arch_dma_free(struct device *dev, size_t size, void *cpu_addr, + + /* IIep is write-through, not flushing on cpu to device transfer. */ + +-void arch_sync_dma_for_cpu(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_cpu(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + if (dir != PCI_DMA_TODEVICE) + dma_make_coherent(paddr, PAGE_ALIGN(size)); +diff --git a/arch/xtensa/kernel/pci-dma.c b/arch/xtensa/kernel/pci-dma.c +index 154979d62b73c..2b86a2a042368 100644 +--- a/arch/xtensa/kernel/pci-dma.c ++++ b/arch/xtensa/kernel/pci-dma.c +@@ -44,8 +44,8 @@ static void do_cache_op(phys_addr_t paddr, size_t size, + } + } + +-void arch_sync_dma_for_cpu(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_cpu(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + switch (dir) { + case DMA_BIDIRECTIONAL: +@@ -62,8 +62,8 @@ void arch_sync_dma_for_cpu(struct device *dev, phys_addr_t paddr, + } + } + +-void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir) ++void arch_sync_dma_for_device(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + switch (dir) { + case DMA_BIDIRECTIONAL: +diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c +index 4fc8fb92d45ef..651054aa87103 100644 +--- a/drivers/iommu/dma-iommu.c ++++ b/drivers/iommu/dma-iommu.c +@@ -660,7 +660,7 @@ static void iommu_dma_sync_single_for_cpu(struct device *dev, + return; + + phys = iommu_iova_to_phys(iommu_get_dma_domain(dev), dma_handle); +- arch_sync_dma_for_cpu(dev, phys, size, dir); ++ arch_sync_dma_for_cpu(phys, size, dir); + } + + static void iommu_dma_sync_single_for_device(struct device *dev, +@@ -672,7 +672,7 @@ static void iommu_dma_sync_single_for_device(struct device *dev, + return; + + phys = iommu_iova_to_phys(iommu_get_dma_domain(dev), dma_handle); +- arch_sync_dma_for_device(dev, phys, size, dir); ++ arch_sync_dma_for_device(phys, size, dir); + } + + static void iommu_dma_sync_sg_for_cpu(struct device *dev, +@@ -686,7 +686,7 @@ static void iommu_dma_sync_sg_for_cpu(struct device *dev, + return; + + for_each_sg(sgl, sg, nelems, i) +- arch_sync_dma_for_cpu(dev, sg_phys(sg), sg->length, dir); ++ arch_sync_dma_for_cpu(sg_phys(sg), sg->length, dir); + } + + static void iommu_dma_sync_sg_for_device(struct device *dev, +@@ -700,7 +700,7 @@ static void iommu_dma_sync_sg_for_device(struct device *dev, + return; + + for_each_sg(sgl, sg, nelems, i) +- arch_sync_dma_for_device(dev, sg_phys(sg), sg->length, dir); ++ arch_sync_dma_for_device(sg_phys(sg), sg->length, dir); + } + + static dma_addr_t iommu_dma_map_page(struct device *dev, struct page *page, +@@ -715,7 +715,7 @@ static dma_addr_t iommu_dma_map_page(struct device *dev, struct page *page, + dma_handle =__iommu_dma_map(dev, phys, size, prot); + if (!coherent && !(attrs & DMA_ATTR_SKIP_CPU_SYNC) && + dma_handle != DMA_MAPPING_ERROR) +- arch_sync_dma_for_device(dev, phys, size, dir); ++ arch_sync_dma_for_device(phys, size, dir); + return dma_handle; + } + +diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c +index 06346422f7432..486d7978ea970 100644 +--- a/drivers/xen/swiotlb-xen.c ++++ b/drivers/xen/swiotlb-xen.c +@@ -411,7 +411,7 @@ static dma_addr_t xen_swiotlb_map_page(struct device *dev, struct page *page, + + done: + if (!dev_is_dma_coherent(dev) && !(attrs & DMA_ATTR_SKIP_CPU_SYNC)) +- xen_dma_sync_for_device(dev, dev_addr, phys, size, dir); ++ xen_dma_sync_for_device(dev_addr, phys, size, dir); + return dev_addr; + } + +@@ -431,7 +431,7 @@ static void xen_swiotlb_unmap_page(struct device *hwdev, dma_addr_t dev_addr, + BUG_ON(dir == DMA_NONE); + + if (!dev_is_dma_coherent(hwdev) && !(attrs & DMA_ATTR_SKIP_CPU_SYNC)) +- xen_dma_sync_for_cpu(hwdev, dev_addr, paddr, size, dir); ++ xen_dma_sync_for_cpu(dev_addr, paddr, size, dir); + + /* NOTE: We use dev_addr here, not paddr! */ + if (is_xen_swiotlb_buffer(dev_addr)) +@@ -445,7 +445,7 @@ xen_swiotlb_sync_single_for_cpu(struct device *dev, dma_addr_t dma_addr, + phys_addr_t paddr = xen_bus_to_phys(dma_addr); + + if (!dev_is_dma_coherent(dev)) +- xen_dma_sync_for_cpu(dev, dma_addr, paddr, size, dir); ++ xen_dma_sync_for_cpu(dma_addr, paddr, size, dir); + + if (is_xen_swiotlb_buffer(dma_addr)) + swiotlb_tbl_sync_single(dev, paddr, size, dir, SYNC_FOR_CPU); +@@ -461,7 +461,7 @@ xen_swiotlb_sync_single_for_device(struct device *dev, dma_addr_t dma_addr, + swiotlb_tbl_sync_single(dev, paddr, size, dir, SYNC_FOR_DEVICE); + + if (!dev_is_dma_coherent(dev)) +- xen_dma_sync_for_device(dev, dma_addr, paddr, size, dir); ++ xen_dma_sync_for_device(dma_addr, paddr, size, dir); + } + + /* +diff --git a/include/linux/dma-noncoherent.h b/include/linux/dma-noncoherent.h +index dd3de6d88fc08..47d4830636627 100644 +--- a/include/linux/dma-noncoherent.h ++++ b/include/linux/dma-noncoherent.h +@@ -75,29 +75,29 @@ static inline void arch_dma_cache_sync(struct device *dev, void *vaddr, + #endif /* CONFIG_DMA_NONCOHERENT_CACHE_SYNC */ + + #ifdef CONFIG_ARCH_HAS_SYNC_DMA_FOR_DEVICE +-void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir); ++void arch_sync_dma_for_device(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir); + #else +-static inline void arch_sync_dma_for_device(struct device *dev, +- phys_addr_t paddr, size_t size, enum dma_data_direction dir) ++static inline void arch_sync_dma_for_device(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + } + #endif /* ARCH_HAS_SYNC_DMA_FOR_DEVICE */ + + #ifdef CONFIG_ARCH_HAS_SYNC_DMA_FOR_CPU +-void arch_sync_dma_for_cpu(struct device *dev, phys_addr_t paddr, +- size_t size, enum dma_data_direction dir); ++void arch_sync_dma_for_cpu(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir); + #else +-static inline void arch_sync_dma_for_cpu(struct device *dev, +- phys_addr_t paddr, size_t size, enum dma_data_direction dir) ++static inline void arch_sync_dma_for_cpu(phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir) + { + } + #endif /* ARCH_HAS_SYNC_DMA_FOR_CPU */ + + #ifdef CONFIG_ARCH_HAS_SYNC_DMA_FOR_CPU_ALL +-void arch_sync_dma_for_cpu_all(struct device *dev); ++void arch_sync_dma_for_cpu_all(void); + #else +-static inline void arch_sync_dma_for_cpu_all(struct device *dev) ++static inline void arch_sync_dma_for_cpu_all(void) + { + } + #endif /* CONFIG_ARCH_HAS_SYNC_DMA_FOR_CPU_ALL */ +diff --git a/include/xen/swiotlb-xen.h b/include/xen/swiotlb-xen.h +index d71380f6ed0b2..ffc0d3902b717 100644 +--- a/include/xen/swiotlb-xen.h ++++ b/include/xen/swiotlb-xen.h +@@ -4,10 +4,10 @@ + + #include + +-void xen_dma_sync_for_cpu(struct device *dev, dma_addr_t handle, +- phys_addr_t paddr, size_t size, enum dma_data_direction dir); +-void xen_dma_sync_for_device(struct device *dev, dma_addr_t handle, +- phys_addr_t paddr, size_t size, enum dma_data_direction dir); ++void xen_dma_sync_for_cpu(dma_addr_t handle, phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir); ++void xen_dma_sync_for_device(dma_addr_t handle, phys_addr_t paddr, size_t size, ++ enum dma_data_direction dir); + + extern int xen_swiotlb_init(int verbose, bool early); + extern const struct dma_map_ops xen_swiotlb_dma_ops; +diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c +index f04cfc2e9e01a..4c21cdc15d1b8 100644 +--- a/kernel/dma/direct.c ++++ b/kernel/dma/direct.c +@@ -232,7 +232,7 @@ void dma_direct_sync_single_for_device(struct device *dev, + swiotlb_tbl_sync_single(dev, paddr, size, dir, SYNC_FOR_DEVICE); + + if (!dev_is_dma_coherent(dev)) +- arch_sync_dma_for_device(dev, paddr, size, dir); ++ arch_sync_dma_for_device(paddr, size, dir); + } + EXPORT_SYMBOL(dma_direct_sync_single_for_device); + +@@ -250,7 +250,7 @@ void dma_direct_sync_sg_for_device(struct device *dev, + dir, SYNC_FOR_DEVICE); + + if (!dev_is_dma_coherent(dev)) +- arch_sync_dma_for_device(dev, paddr, sg->length, ++ arch_sync_dma_for_device(paddr, sg->length, + dir); + } + } +@@ -266,8 +266,8 @@ void dma_direct_sync_single_for_cpu(struct device *dev, + phys_addr_t paddr = dma_to_phys(dev, addr); + + if (!dev_is_dma_coherent(dev)) { +- arch_sync_dma_for_cpu(dev, paddr, size, dir); +- arch_sync_dma_for_cpu_all(dev); ++ arch_sync_dma_for_cpu(paddr, size, dir); ++ arch_sync_dma_for_cpu_all(); + } + + if (unlikely(is_swiotlb_buffer(paddr))) +@@ -285,7 +285,7 @@ void dma_direct_sync_sg_for_cpu(struct device *dev, + phys_addr_t paddr = dma_to_phys(dev, sg_dma_address(sg)); + + if (!dev_is_dma_coherent(dev)) +- arch_sync_dma_for_cpu(dev, paddr, sg->length, dir); ++ arch_sync_dma_for_cpu(paddr, sg->length, dir); + + if (unlikely(is_swiotlb_buffer(paddr))) + swiotlb_tbl_sync_single(dev, paddr, sg->length, dir, +@@ -293,7 +293,7 @@ void dma_direct_sync_sg_for_cpu(struct device *dev, + } + + if (!dev_is_dma_coherent(dev)) +- arch_sync_dma_for_cpu_all(dev); ++ arch_sync_dma_for_cpu_all(); + } + EXPORT_SYMBOL(dma_direct_sync_sg_for_cpu); + +@@ -345,7 +345,7 @@ dma_addr_t dma_direct_map_page(struct device *dev, struct page *page, + } + + if (!dev_is_dma_coherent(dev) && !(attrs & DMA_ATTR_SKIP_CPU_SYNC)) +- arch_sync_dma_for_device(dev, phys, size, dir); ++ arch_sync_dma_for_device(phys, size, dir); + return dma_addr; + } + EXPORT_SYMBOL(dma_direct_map_page); +-- +2.39.2 + diff --git a/queue-5.4/i40e-fix-registers-dump-after-run-ethtool-adapter-se.patch b/queue-5.4/i40e-fix-registers-dump-after-run-ethtool-adapter-se.patch new file mode 100644 index 00000000000..d71c17aca00 --- /dev/null +++ b/queue-5.4/i40e-fix-registers-dump-after-run-ethtool-adapter-se.patch @@ -0,0 +1,91 @@ +From deea664b0ed22c7296b3d07719fcdfc4966abbf8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 10:26:59 -0700 +Subject: i40e: fix registers dump after run ethtool adapter self test + +From: Radoslaw Tyl + +[ Upstream commit c5cff16f461a4a434a9915a7be7ac9ced861a8a4 ] + +Fix invalid registers dump from ethtool -d ethX after adapter self test +by ethtool -t ethY. It causes invalid data display. + +The problem was caused by overwriting i40e_reg_list[].elements +which is common for ethtool self test and dump. + +Fixes: 22dd9ae8afcc ("i40e: Rework register diagnostic") +Signed-off-by: Radoslaw Tyl +Reviewed-by: Michal Swiatkowski +Tested-by: Arpana Arland (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Reviewed-by: Leon Romanovsky +Link: https://lore.kernel.org/r/20230328172659.3906413-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_diag.c | 11 ++++++----- + drivers/net/ethernet/intel/i40e/i40e_diag.h | 2 +- + 2 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_diag.c b/drivers/net/ethernet/intel/i40e/i40e_diag.c +index ef4d3762bf371..ca229b0efeb65 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_diag.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_diag.c +@@ -44,7 +44,7 @@ static i40e_status i40e_diag_reg_pattern_test(struct i40e_hw *hw, + return 0; + } + +-struct i40e_diag_reg_test_info i40e_reg_list[] = { ++const struct i40e_diag_reg_test_info i40e_reg_list[] = { + /* offset mask elements stride */ + {I40E_QTX_CTL(0), 0x0000FFBF, 1, + I40E_QTX_CTL(1) - I40E_QTX_CTL(0)}, +@@ -78,27 +78,28 @@ i40e_status i40e_diag_reg_test(struct i40e_hw *hw) + { + i40e_status ret_code = 0; + u32 reg, mask; ++ u32 elements; + u32 i, j; + + for (i = 0; i40e_reg_list[i].offset != 0 && + !ret_code; i++) { + ++ elements = i40e_reg_list[i].elements; + /* set actual reg range for dynamically allocated resources */ + if (i40e_reg_list[i].offset == I40E_QTX_CTL(0) && + hw->func_caps.num_tx_qp != 0) +- i40e_reg_list[i].elements = hw->func_caps.num_tx_qp; ++ elements = hw->func_caps.num_tx_qp; + if ((i40e_reg_list[i].offset == I40E_PFINT_ITRN(0, 0) || + i40e_reg_list[i].offset == I40E_PFINT_ITRN(1, 0) || + i40e_reg_list[i].offset == I40E_PFINT_ITRN(2, 0) || + i40e_reg_list[i].offset == I40E_QINT_TQCTL(0) || + i40e_reg_list[i].offset == I40E_QINT_RQCTL(0)) && + hw->func_caps.num_msix_vectors != 0) +- i40e_reg_list[i].elements = +- hw->func_caps.num_msix_vectors - 1; ++ elements = hw->func_caps.num_msix_vectors - 1; + + /* test register access */ + mask = i40e_reg_list[i].mask; +- for (j = 0; j < i40e_reg_list[i].elements && !ret_code; j++) { ++ for (j = 0; j < elements && !ret_code; j++) { + reg = i40e_reg_list[i].offset + + (j * i40e_reg_list[i].stride); + ret_code = i40e_diag_reg_pattern_test(hw, reg, mask); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_diag.h b/drivers/net/ethernet/intel/i40e/i40e_diag.h +index c3340f320a18c..1db7c6d572311 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_diag.h ++++ b/drivers/net/ethernet/intel/i40e/i40e_diag.h +@@ -20,7 +20,7 @@ struct i40e_diag_reg_test_info { + u32 stride; /* bytes between each element */ + }; + +-extern struct i40e_diag_reg_test_info i40e_reg_list[]; ++extern const struct i40e_diag_reg_test_info i40e_reg_list[]; + + i40e_status i40e_diag_reg_test(struct i40e_hw *hw); + i40e_status i40e_diag_eeprom_test(struct i40e_hw *hw); +-- +2.39.2 + diff --git a/queue-5.4/mips-bmips-bcm6358-disable-rac-flush-for-tp1.patch b/queue-5.4/mips-bmips-bcm6358-disable-rac-flush-for-tp1.patch new file mode 100644 index 00000000000..58971218908 --- /dev/null +++ b/queue-5.4/mips-bmips-bcm6358-disable-rac-flush-for-tp1.patch @@ -0,0 +1,117 @@ +From a2f7eaf832fcbf45622d1a380d4b134ecd9227ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 11:20:04 +0100 +Subject: mips: bmips: BCM6358: disable RAC flush for TP1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Álvaro Fernández Rojas + +[ Upstream commit ab327f8acdf8d06601fbf058859a539a9422afff ] + +RAC flush causes kernel panics on BCM6358 with EHCI/OHCI when booting from TP1: +[ 3.881739] usb 1-1: new high-speed USB device number 2 using ehci-platform +[ 3.895011] Reserved instruction in kernel code[#1]: +[ 3.900113] CPU: 0 PID: 1 Comm: init Not tainted 5.10.16 #0 +[ 3.905829] $ 0 : 00000000 10008700 00000000 77d94060 +[ 3.911238] $ 4 : 7fd1f088 00000000 81431cac 81431ca0 +[ 3.916641] $ 8 : 00000000 ffffefff 8075cd34 00000000 +[ 3.922043] $12 : 806f8d40 f3e812b7 00000000 000d9aaa +[ 3.927446] $16 : 7fd1f068 7fd1f080 7ff559b8 81428470 +[ 3.932848] $20 : 00000000 00000000 55590000 77d70000 +[ 3.938251] $24 : 00000018 00000010 +[ 3.943655] $28 : 81430000 81431e60 81431f28 800157fc +[ 3.949058] Hi : 00000000 +[ 3.952013] Lo : 00000000 +[ 3.955019] epc : 80015808 setup_sigcontext+0x54/0x24c +[ 3.960464] ra : 800157fc setup_sigcontext+0x48/0x24c +[ 3.965913] Status: 10008703 KERNEL EXL IE +[ 3.970216] Cause : 00800028 (ExcCode 0a) +[ 3.974340] PrId : 0002a010 (Broadcom BMIPS4350) +[ 3.979170] Modules linked in: ohci_platform ohci_hcd fsl_mph_dr_of ehci_platform ehci_fsl ehci_hcd gpio_button_hotplug usbcore nls_base usb_common +[ 3.992907] Process init (pid: 1, threadinfo=(ptrval), task=(ptrval), tls=77e22ec8) +[ 4.000776] Stack : 81431ef4 7fd1f080 81431f28 81428470 7fd1f068 81431edc 7ff559b8 81428470 +[ 4.009467] 81431f28 7fd1f080 55590000 77d70000 77d5498c 80015c70 806f0000 8063ae74 +[ 4.018149] 08100002 81431f28 0000000a 08100002 81431f28 0000000a 77d6b418 00000003 +[ 4.026831] ffffffff 80016414 80080734 81431ecc 81431ecc 00000001 00000000 04000000 +[ 4.035512] 77d54874 00000000 00000000 00000000 00000000 00000012 00000002 00000000 +[ 4.044196] ... +[ 4.046706] Call Trace: +[ 4.049238] [<80015808>] setup_sigcontext+0x54/0x24c +[ 4.054356] [<80015c70>] setup_frame+0xdc/0x124 +[ 4.059015] [<80016414>] do_notify_resume+0x1dc/0x288 +[ 4.064207] [<80011b50>] work_notifysig+0x10/0x18 +[ 4.069036] +[ 4.070538] Code: 8fc300b4 00001025 26240008 ac830004 3c048063 0c0228aa 24846a00 26240010 +[ 4.080686] +[ 4.082517] ---[ end trace 22a8edb41f5f983b ]--- +[ 4.087374] Kernel panic - not syncing: Fatal exception +[ 4.092753] Rebooting in 1 seconds.. + +Because the bootloader (CFE) is not initializing the Read-ahead cache properly +on the second thread (TP1). Since the RAC was not initialized properly, we +should avoid flushing it at the risk of corrupting the instruction stream as +seen in the trace above. + +Fixes: d59098a0e9cb ("MIPS: bmips: use generic dma noncoherent ops") +Signed-off-by: Álvaro Fernández Rojas +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/bmips/dma.c | 5 +++++ + arch/mips/bmips/setup.c | 8 ++++++++ + 2 files changed, 13 insertions(+) + +diff --git a/arch/mips/bmips/dma.c b/arch/mips/bmips/dma.c +index df56bf4179e34..98d39585c80ff 100644 +--- a/arch/mips/bmips/dma.c ++++ b/arch/mips/bmips/dma.c +@@ -64,6 +64,8 @@ phys_addr_t __dma_to_phys(struct device *dev, dma_addr_t dma_addr) + return dma_addr; + } + ++bool bmips_rac_flush_disable; ++ + void arch_sync_dma_for_cpu_all(void) + { + void __iomem *cbr = BMIPS_GET_CBR(); +@@ -74,6 +76,9 @@ void arch_sync_dma_for_cpu_all(void) + boot_cpu_type() != CPU_BMIPS4380) + return; + ++ if (unlikely(bmips_rac_flush_disable)) ++ return; ++ + /* Flush stale data out of the readahead cache */ + cfg = __raw_readl(cbr + BMIPS_RAC_CONFIG); + __raw_writel(cfg | 0x100, cbr + BMIPS_RAC_CONFIG); +diff --git a/arch/mips/bmips/setup.c b/arch/mips/bmips/setup.c +index 7aee9ff19c1a6..36fbedcbd518d 100644 +--- a/arch/mips/bmips/setup.c ++++ b/arch/mips/bmips/setup.c +@@ -34,6 +34,8 @@ + #define REG_BCM6328_OTP ((void __iomem *)CKSEG1ADDR(0x1000062c)) + #define BCM6328_TP1_DISABLED BIT(9) + ++extern bool bmips_rac_flush_disable; ++ + static const unsigned long kbase = VMLINUX_LOAD_ADDRESS & 0xfff00000; + + struct bmips_quirk { +@@ -103,6 +105,12 @@ static void bcm6358_quirks(void) + * disable SMP for now + */ + bmips_smp_enabled = 0; ++ ++ /* ++ * RAC flush causes kernel panics on BCM6358 when booting from TP1 ++ * because the bootloader is not initializing it properly. ++ */ ++ bmips_rac_flush_disable = !!(read_c0_brcm_cmt_local() & (1 << 31)); + } + + static void bcm6368_quirks(void) +-- +2.39.2 + diff --git a/queue-5.4/mtd-rawnand-meson-invalidate-cache-on-polling-ecc-bi.patch b/queue-5.4/mtd-rawnand-meson-invalidate-cache-on-polling-ecc-bi.patch new file mode 100644 index 00000000000..28fa66de159 --- /dev/null +++ b/queue-5.4/mtd-rawnand-meson-invalidate-cache-on-polling-ecc-bi.patch @@ -0,0 +1,68 @@ +From 255b7920d4c826c6b33be0397fd97d0ddb8a1d45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 10:32:44 +0300 +Subject: mtd: rawnand: meson: invalidate cache on polling ECC bit + +From: Arseniy Krasnov + +[ Upstream commit e732e39ed9929c05fd219035bc9653ba4100d4fa ] + +'info_buf' memory is cached and driver polls ECC bit in it. This bit +is set by the NAND controller. If 'usleep_range()' returns before device +sets this bit, 'info_buf' will be cached and driver won't see update of +this bit and will loop forever. + +Fixes: 8fae856c5350 ("mtd: rawnand: meson: add support for Amlogic NAND flash controller") +Signed-off-by: Arseniy Krasnov +Reviewed-by: Neil Armstrong +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/d4ef0bd6-816e-f6fa-9385-f05f775f0ae2@sberdevices.ru +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/meson_nand.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/meson_nand.c b/drivers/mtd/nand/raw/meson_nand.c +index a65aadb54af68..240b493abb86f 100644 +--- a/drivers/mtd/nand/raw/meson_nand.c ++++ b/drivers/mtd/nand/raw/meson_nand.c +@@ -172,6 +172,7 @@ struct meson_nfc { + + dma_addr_t daddr; + dma_addr_t iaddr; ++ u32 info_bytes; + + unsigned long assigned_cs; + }; +@@ -499,6 +500,7 @@ static int meson_nfc_dma_buffer_setup(struct nand_chip *nand, void *databuf, + nfc->daddr, datalen, dir); + return ret; + } ++ nfc->info_bytes = infolen; + cmd = GENCMDIADDRL(NFC_CMD_AIL, nfc->iaddr); + writel(cmd, nfc->reg_base + NFC_REG_CMD); + +@@ -516,8 +518,10 @@ static void meson_nfc_dma_buffer_release(struct nand_chip *nand, + struct meson_nfc *nfc = nand_get_controller_data(nand); + + dma_unmap_single(nfc->dev, nfc->daddr, datalen, dir); +- if (infolen) ++ if (infolen) { + dma_unmap_single(nfc->dev, nfc->iaddr, infolen, dir); ++ nfc->info_bytes = 0; ++ } + } + + static int meson_nfc_read_buf(struct nand_chip *nand, u8 *buf, int len) +@@ -706,6 +710,8 @@ static void meson_nfc_check_ecc_pages_valid(struct meson_nfc *nfc, + usleep_range(10, 15); + /* info is updated by nfc dma engine*/ + smp_rmb(); ++ dma_sync_single_for_cpu(nfc->dev, nfc->iaddr, nfc->info_bytes, ++ DMA_FROM_DEVICE); + ret = *info & ECC_COMPLETE; + } while (!ret); + } +-- +2.39.2 + diff --git a/queue-5.4/net-dsa-mv88e6xxx-enable-igmp-snooping-on-user-ports.patch b/queue-5.4/net-dsa-mv88e6xxx-enable-igmp-snooping-on-user-ports.patch new file mode 100644 index 00000000000..bfbe59fc725 --- /dev/null +++ b/queue-5.4/net-dsa-mv88e6xxx-enable-igmp-snooping-on-user-ports.patch @@ -0,0 +1,55 @@ +From 510fa56a8aecd6352a748b393d4b34b7e4a9e40e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Mar 2023 12:01:40 -0300 +Subject: net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Steffen Bätz + +[ Upstream commit 7bcad0f0e6fbc1d613e49e0ee35c8e5f2e685bb0 ] + +Do not set the MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP bit on CPU or DSA ports. + +This allows the host CPU port to be a regular IGMP listener by sending out +IGMP Membership Reports, which would otherwise not be forwarded by the +mv88exxx chip, but directly looped back to the CPU port itself. + +Fixes: 54d792f257c6 ("net: dsa: Centralise global and port setup code into mv88e6xxx.") +Signed-off-by: Steffen Bätz +Signed-off-by: Fabio Estevam +Reviewed-by: Andrew Lunn +Reviewed-by: Vladimir Oltean +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20230329150140.701559-1-festevam@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index b336ed071fa89..ea32be579e7b1 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -2433,9 +2433,14 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port) + * If this is the upstream port for this switch, enable + * forwarding of unknown unicasts and multicasts. + */ +- reg = MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP | +- MV88E6185_PORT_CTL0_USE_TAG | MV88E6185_PORT_CTL0_USE_IP | ++ reg = MV88E6185_PORT_CTL0_USE_TAG | MV88E6185_PORT_CTL0_USE_IP | + MV88E6XXX_PORT_CTL0_STATE_FORWARDING; ++ /* Forward any IPv4 IGMP or IPv6 MLD frames received ++ * by a USER port to the CPU port to allow snooping. ++ */ ++ if (dsa_is_user_port(ds, port)) ++ reg |= MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP; ++ + err = mv88e6xxx_port_write(chip, port, MV88E6XXX_PORT_CTL0, reg); + if (err) + return err; +-- +2.39.2 + diff --git a/queue-5.4/net-mvneta-make-tx-buffer-array-agnostic.patch b/queue-5.4/net-mvneta-make-tx-buffer-array-agnostic.patch new file mode 100644 index 00000000000..cdce9c23f5d --- /dev/null +++ b/queue-5.4/net-mvneta-make-tx-buffer-array-agnostic.patch @@ -0,0 +1,221 @@ +From b2c818682cb6e0ec6ccbe6e6c7a89f1ea07d0083 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Oct 2019 10:13:26 +0200 +Subject: net: mvneta: make tx buffer array agnostic + +From: Lorenzo Bianconi + +[ Upstream commit 9e58c8b410650b5a6eb5b8fad8474bd8425a4023 ] + +Allow tx buffer array to contain both skb and xdp buffers in order to +enable xdp frame recycling adding XDP_TX verdict support + +Signed-off-by: Lorenzo Bianconi +Signed-off-by: David S. Miller +Stable-dep-of: 2960a2d33b02 ("net: mvneta: fix potential double-frees in mvneta_txq_sw_deinit()") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/mvneta.c | 66 +++++++++++++++++---------- + 1 file changed, 43 insertions(+), 23 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index 2c1ee32684988..977c2961aa2c2 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -549,6 +549,20 @@ struct mvneta_rx_desc { + }; + #endif + ++enum mvneta_tx_buf_type { ++ MVNETA_TYPE_SKB, ++ MVNETA_TYPE_XDP_TX, ++ MVNETA_TYPE_XDP_NDO, ++}; ++ ++struct mvneta_tx_buf { ++ enum mvneta_tx_buf_type type; ++ union { ++ struct xdp_frame *xdpf; ++ struct sk_buff *skb; ++ }; ++}; ++ + struct mvneta_tx_queue { + /* Number of this TX queue, in the range 0-7 */ + u8 id; +@@ -564,8 +578,8 @@ struct mvneta_tx_queue { + int tx_stop_threshold; + int tx_wake_threshold; + +- /* Array of transmitted skb */ +- struct sk_buff **tx_skb; ++ /* Array of transmitted buffers */ ++ struct mvneta_tx_buf *buf; + + /* Index of last TX DMA descriptor that was inserted */ + int txq_put_index; +@@ -1774,14 +1788,9 @@ static void mvneta_txq_bufs_free(struct mvneta_port *pp, + int i; + + for (i = 0; i < num; i++) { ++ struct mvneta_tx_buf *buf = &txq->buf[txq->txq_get_index]; + struct mvneta_tx_desc *tx_desc = txq->descs + + txq->txq_get_index; +- struct sk_buff *skb = txq->tx_skb[txq->txq_get_index]; +- +- if (skb) { +- bytes_compl += skb->len; +- pkts_compl++; +- } + + mvneta_txq_inc_get(txq); + +@@ -1789,9 +1798,12 @@ static void mvneta_txq_bufs_free(struct mvneta_port *pp, + dma_unmap_single(pp->dev->dev.parent, + tx_desc->buf_phys_addr, + tx_desc->data_size, DMA_TO_DEVICE); +- if (!skb) ++ if (!buf->skb) + continue; +- dev_kfree_skb_any(skb); ++ ++ bytes_compl += buf->skb->len; ++ pkts_compl++; ++ dev_kfree_skb_any(buf->skb); + } + + netdev_tx_completed_queue(nq, pkts_compl, bytes_compl); +@@ -2242,16 +2254,19 @@ static inline void + mvneta_tso_put_hdr(struct sk_buff *skb, + struct mvneta_port *pp, struct mvneta_tx_queue *txq) + { +- struct mvneta_tx_desc *tx_desc; + int hdr_len = skb_transport_offset(skb) + tcp_hdrlen(skb); ++ struct mvneta_tx_buf *buf = &txq->buf[txq->txq_put_index]; ++ struct mvneta_tx_desc *tx_desc; + +- txq->tx_skb[txq->txq_put_index] = NULL; + tx_desc = mvneta_txq_next_desc_get(txq); + tx_desc->data_size = hdr_len; + tx_desc->command = mvneta_skb_tx_csum(pp, skb); + tx_desc->command |= MVNETA_TXD_F_DESC; + tx_desc->buf_phys_addr = txq->tso_hdrs_phys + + txq->txq_put_index * TSO_HEADER_SIZE; ++ buf->type = MVNETA_TYPE_SKB; ++ buf->skb = NULL; ++ + mvneta_txq_inc_put(txq); + } + +@@ -2260,6 +2275,7 @@ mvneta_tso_put_data(struct net_device *dev, struct mvneta_tx_queue *txq, + struct sk_buff *skb, char *data, int size, + bool last_tcp, bool is_last) + { ++ struct mvneta_tx_buf *buf = &txq->buf[txq->txq_put_index]; + struct mvneta_tx_desc *tx_desc; + + tx_desc = mvneta_txq_next_desc_get(txq); +@@ -2273,7 +2289,8 @@ mvneta_tso_put_data(struct net_device *dev, struct mvneta_tx_queue *txq, + } + + tx_desc->command = 0; +- txq->tx_skb[txq->txq_put_index] = NULL; ++ buf->type = MVNETA_TYPE_SKB; ++ buf->skb = NULL; + + if (last_tcp) { + /* last descriptor in the TCP packet */ +@@ -2281,7 +2298,7 @@ mvneta_tso_put_data(struct net_device *dev, struct mvneta_tx_queue *txq, + + /* last descriptor in SKB */ + if (is_last) +- txq->tx_skb[txq->txq_put_index] = skb; ++ buf->skb = skb; + } + mvneta_txq_inc_put(txq); + return 0; +@@ -2366,6 +2383,7 @@ static int mvneta_tx_frag_process(struct mvneta_port *pp, struct sk_buff *skb, + int i, nr_frags = skb_shinfo(skb)->nr_frags; + + for (i = 0; i < nr_frags; i++) { ++ struct mvneta_tx_buf *buf = &txq->buf[txq->txq_put_index]; + skb_frag_t *frag = &skb_shinfo(skb)->frags[i]; + void *addr = skb_frag_address(frag); + +@@ -2385,12 +2403,13 @@ static int mvneta_tx_frag_process(struct mvneta_port *pp, struct sk_buff *skb, + if (i == nr_frags - 1) { + /* Last descriptor */ + tx_desc->command = MVNETA_TXD_L_DESC | MVNETA_TXD_Z_PAD; +- txq->tx_skb[txq->txq_put_index] = skb; ++ buf->skb = skb; + } else { + /* Descriptor in the middle: Not First, Not Last */ + tx_desc->command = 0; +- txq->tx_skb[txq->txq_put_index] = NULL; ++ buf->skb = NULL; + } ++ buf->type = MVNETA_TYPE_SKB; + mvneta_txq_inc_put(txq); + } + +@@ -2418,6 +2437,7 @@ static netdev_tx_t mvneta_tx(struct sk_buff *skb, struct net_device *dev) + struct mvneta_port *pp = netdev_priv(dev); + u16 txq_id = skb_get_queue_mapping(skb); + struct mvneta_tx_queue *txq = &pp->txqs[txq_id]; ++ struct mvneta_tx_buf *buf = &txq->buf[txq->txq_put_index]; + struct mvneta_tx_desc *tx_desc; + int len = skb->len; + int frags = 0; +@@ -2450,16 +2470,17 @@ static netdev_tx_t mvneta_tx(struct sk_buff *skb, struct net_device *dev) + goto out; + } + ++ buf->type = MVNETA_TYPE_SKB; + if (frags == 1) { + /* First and Last descriptor */ + tx_cmd |= MVNETA_TXD_FLZ_DESC; + tx_desc->command = tx_cmd; +- txq->tx_skb[txq->txq_put_index] = skb; ++ buf->skb = skb; + mvneta_txq_inc_put(txq); + } else { + /* First but not Last */ + tx_cmd |= MVNETA_TXD_F_DESC; +- txq->tx_skb[txq->txq_put_index] = NULL; ++ buf->skb = NULL; + mvneta_txq_inc_put(txq); + tx_desc->command = tx_cmd; + /* Continue with other skb fragments */ +@@ -3005,9 +3026,8 @@ static int mvneta_txq_sw_init(struct mvneta_port *pp, + + txq->last_desc = txq->size - 1; + +- txq->tx_skb = kmalloc_array(txq->size, sizeof(*txq->tx_skb), +- GFP_KERNEL); +- if (!txq->tx_skb) { ++ txq->buf = kmalloc_array(txq->size, sizeof(*txq->buf), GFP_KERNEL); ++ if (!txq->buf) { + dma_free_coherent(pp->dev->dev.parent, + txq->size * MVNETA_DESC_ALIGNED_SIZE, + txq->descs, txq->descs_phys); +@@ -3019,7 +3039,7 @@ static int mvneta_txq_sw_init(struct mvneta_port *pp, + txq->size * TSO_HEADER_SIZE, + &txq->tso_hdrs_phys, GFP_KERNEL); + if (!txq->tso_hdrs) { +- kfree(txq->tx_skb); ++ kfree(txq->buf); + dma_free_coherent(pp->dev->dev.parent, + txq->size * MVNETA_DESC_ALIGNED_SIZE, + txq->descs, txq->descs_phys); +@@ -3074,7 +3094,7 @@ static void mvneta_txq_sw_deinit(struct mvneta_port *pp, + { + struct netdev_queue *nq = netdev_get_tx_queue(pp->dev, txq->id); + +- kfree(txq->tx_skb); ++ kfree(txq->buf); + + if (txq->tso_hdrs) + dma_free_coherent(pp->dev->dev.parent, +-- +2.39.2 + diff --git a/queue-5.4/net-net_failover-fix-txq-exceeding-warning.patch b/queue-5.4/net-net_failover-fix-txq-exceeding-warning.patch new file mode 100644 index 00000000000..c2400631443 --- /dev/null +++ b/queue-5.4/net-net_failover-fix-txq-exceeding-warning.patch @@ -0,0 +1,90 @@ +From 15338a1ad63a46b73e214d963f8d14ad1784b194 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 17:19:54 +0800 +Subject: net/net_failover: fix txq exceeding warning + +From: Faicker Mo + +[ Upstream commit e3cbdcb0fbb61045ef3ce0e072927cc41737f787 ] + +The failover txq is inited as 16 queues. +when a packet is transmitted from the failover device firstly, +the failover device will select the queue which is returned from +the primary device if the primary device is UP and running. +If the primary device txq is bigger than the default 16, +it can lead to the following warning: +eth0 selects TX queue 18, but real number of TX queues is 16 + +The warning backtrace is: +[ 32.146376] CPU: 18 PID: 9134 Comm: chronyd Tainted: G E 6.2.8-1.el7.centos.x86_64 #1 +[ 32.147175] Hardware name: Red Hat KVM, BIOS 1.10.2-3.el7_4.1 04/01/2014 +[ 32.147730] Call Trace: +[ 32.147971] +[ 32.148183] dump_stack_lvl+0x48/0x70 +[ 32.148514] dump_stack+0x10/0x20 +[ 32.148820] netdev_core_pick_tx+0xb1/0xe0 +[ 32.149180] __dev_queue_xmit+0x529/0xcf0 +[ 32.149533] ? __check_object_size.part.0+0x21c/0x2c0 +[ 32.149967] ip_finish_output2+0x278/0x560 +[ 32.150327] __ip_finish_output+0x1fe/0x2f0 +[ 32.150690] ip_finish_output+0x2a/0xd0 +[ 32.151032] ip_output+0x7a/0x110 +[ 32.151337] ? __pfx_ip_finish_output+0x10/0x10 +[ 32.151733] ip_local_out+0x5e/0x70 +[ 32.152054] ip_send_skb+0x19/0x50 +[ 32.152366] udp_send_skb.isra.0+0x163/0x3a0 +[ 32.152736] udp_sendmsg+0xba8/0xec0 +[ 32.153060] ? __folio_memcg_unlock+0x25/0x60 +[ 32.153445] ? __pfx_ip_generic_getfrag+0x10/0x10 +[ 32.153854] ? sock_has_perm+0x85/0xa0 +[ 32.154190] inet_sendmsg+0x6d/0x80 +[ 32.154508] ? inet_sendmsg+0x6d/0x80 +[ 32.154838] sock_sendmsg+0x62/0x70 +[ 32.155152] ____sys_sendmsg+0x134/0x290 +[ 32.155499] ___sys_sendmsg+0x81/0xc0 +[ 32.155828] ? _get_random_bytes.part.0+0x79/0x1a0 +[ 32.156240] ? ip4_datagram_release_cb+0x5f/0x1e0 +[ 32.156649] ? get_random_u16+0x69/0xf0 +[ 32.156989] ? __fget_light+0xcf/0x110 +[ 32.157326] __sys_sendmmsg+0xc4/0x210 +[ 32.157657] ? __sys_connect+0xb7/0xe0 +[ 32.157995] ? __audit_syscall_entry+0xce/0x140 +[ 32.158388] ? syscall_trace_enter.isra.0+0x12c/0x1a0 +[ 32.158820] __x64_sys_sendmmsg+0x24/0x30 +[ 32.159171] do_syscall_64+0x38/0x90 +[ 32.159493] entry_SYSCALL_64_after_hwframe+0x72/0xdc + +Fix that by reducing txq number as the non-existent primary-dev does. + +Fixes: cfc80d9a1163 ("net: Introduce net_failover driver") +Signed-off-by: Faicker Mo +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/net_failover.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/net_failover.c b/drivers/net/net_failover.c +index fb182bec8f062..6b7bba720d8c7 100644 +--- a/drivers/net/net_failover.c ++++ b/drivers/net/net_failover.c +@@ -130,14 +130,10 @@ static u16 net_failover_select_queue(struct net_device *dev, + txq = ops->ndo_select_queue(primary_dev, skb, sb_dev); + else + txq = netdev_pick_tx(primary_dev, skb, NULL); +- +- qdisc_skb_cb(skb)->slave_dev_queue_mapping = skb->queue_mapping; +- +- return txq; ++ } else { ++ txq = skb_rx_queue_recorded(skb) ? skb_get_rx_queue(skb) : 0; + } + +- txq = skb_rx_queue_recorded(skb) ? skb_get_rx_queue(skb) : 0; +- + /* Save the original txq to restore before passing to the driver */ + qdisc_skb_cb(skb)->slave_dev_queue_mapping = skb->queue_mapping; + +-- +2.39.2 + diff --git a/queue-5.4/ptp_qoriq-fix-memory-leak-in-probe.patch b/queue-5.4/ptp_qoriq-fix-memory-leak-in-probe.patch new file mode 100644 index 00000000000..e5801f04b20 --- /dev/null +++ b/queue-5.4/ptp_qoriq-fix-memory-leak-in-probe.patch @@ -0,0 +1,46 @@ +From 2be49d50334cc1d48b92f23e57ec8eec468f31e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 11:14:06 +0800 +Subject: ptp_qoriq: fix memory leak in probe() + +From: SongJingyi + +[ Upstream commit f33642224e38d7e0d59336e10e7b4e370b1c4506 ] + +Smatch complains that: +drivers/ptp/ptp_qoriq.c ptp_qoriq_probe() +warn: 'base' from ioremap() not released. + +Fix this by revising the parameter from 'ptp_qoriq->base' to 'base'. +This is only a bug if ptp_qoriq_init() returns on the +first -ENODEV error path. +For other error paths ptp_qoriq->base and base are the same. +And this change makes the code more readable. + +Fixes: 7f4399ba405b ("ptp_qoriq: fix NULL access if ptp dt node missing") +Signed-off-by: SongJingyi +Reviewed-by: Dan Carpenter +Reviewed-by: Dongliang Mu +Link: https://lore.kernel.org/r/20230324031406.1895159-1-u201912584@hust.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/ptp/ptp_qoriq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/ptp/ptp_qoriq.c b/drivers/ptp/ptp_qoriq.c +index a577218d1ab71..ca211feadb383 100644 +--- a/drivers/ptp/ptp_qoriq.c ++++ b/drivers/ptp/ptp_qoriq.c +@@ -604,7 +604,7 @@ static int ptp_qoriq_probe(struct platform_device *dev) + return 0; + + no_clock: +- iounmap(ptp_qoriq->base); ++ iounmap(base); + no_ioremap: + release_resource(ptp_qoriq->rsrc); + no_resource: +-- +2.39.2 + diff --git a/queue-5.4/regulator-fix-spelling-mistake-cant-can-t.patch b/queue-5.4/regulator-fix-spelling-mistake-cant-can-t.patch new file mode 100644 index 00000000000..48c08184e97 --- /dev/null +++ b/queue-5.4/regulator-fix-spelling-mistake-cant-can-t.patch @@ -0,0 +1,36 @@ +From f14f581fe0ded77d10872c6c94491479c0b43507 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 10:39:31 +0100 +Subject: regulator: fix spelling mistake "Cant" -> "Can't" + +From: Colin Ian King + +[ Upstream commit 09dad81e0f1701ea26babe2442a1478d6ad447d3 ] + +There is a spelling mistake in a dev_err message. Fix it. + +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20200810093931.50624-1-colin.king@canonical.com +Signed-off-by: Mark Brown +Stable-dep-of: 02bcba0b9f9d ("regulator: Handle deferred clk") +Signed-off-by: Sasha Levin +--- + drivers/regulator/fixed.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/regulator/fixed.c b/drivers/regulator/fixed.c +index f81533070058e..145402cc9ef26 100644 +--- a/drivers/regulator/fixed.c ++++ b/drivers/regulator/fixed.c +@@ -181,7 +181,7 @@ static int reg_fixed_voltage_probe(struct platform_device *pdev) + + drvdata->enable_clock = devm_clk_get(dev, NULL); + if (IS_ERR(drvdata->enable_clock)) { +- dev_err(dev, "Cant get enable-clock from devicetree\n"); ++ dev_err(dev, "Can't get enable-clock from devicetree\n"); + return -ENOENT; + } + } else { +-- +2.39.2 + diff --git a/queue-5.4/regulator-handle-deferred-clk.patch b/queue-5.4/regulator-handle-deferred-clk.patch new file mode 100644 index 00000000000..2b8f4a3773d --- /dev/null +++ b/queue-5.4/regulator-handle-deferred-clk.patch @@ -0,0 +1,39 @@ +From 8809a8462d3e6a8897a5ae0631bb86f7bf1677a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Mar 2023 10:29:33 +0200 +Subject: regulator: Handle deferred clk + +From: Christophe JAILLET + +[ Upstream commit 02bcba0b9f9da706d5bd1e8cbeb83493863e17b5 ] + +devm_clk_get() can return -EPROBE_DEFER. So it is better to return the +error code from devm_clk_get(), instead of a hard coded -ENOENT. + +This gives more opportunities to successfully probe the driver. + +Fixes: 8959e5324485 ("regulator: fixed: add possibility to enable by clock") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/18459fae3d017a66313699c7c8456b28158b2dd0.1679819354.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/fixed.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/regulator/fixed.c b/drivers/regulator/fixed.c +index 145402cc9ef26..2f0bed86467f9 100644 +--- a/drivers/regulator/fixed.c ++++ b/drivers/regulator/fixed.c +@@ -182,7 +182,7 @@ static int reg_fixed_voltage_probe(struct platform_device *pdev) + drvdata->enable_clock = devm_clk_get(dev, NULL); + if (IS_ERR(drvdata->enable_clock)) { + dev_err(dev, "Can't get enable-clock from devicetree\n"); +- return -ENOENT; ++ return PTR_ERR(drvdata->enable_clock); + } + } else { + drvdata->desc.ops = &fixed_voltage_ops; +-- +2.39.2 + diff --git a/queue-5.4/s390-vfio-ap-fix-memory-leak-in-vfio_ap-device-drive.patch b/queue-5.4/s390-vfio-ap-fix-memory-leak-in-vfio_ap-device-drive.patch new file mode 100644 index 00000000000..c767a9e7794 --- /dev/null +++ b/queue-5.4/s390-vfio-ap-fix-memory-leak-in-vfio_ap-device-drive.patch @@ -0,0 +1,48 @@ +From e089fe2a118baf09c060f85a10c8b1dd82e6ad5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 11:04:47 -0400 +Subject: s390/vfio-ap: fix memory leak in vfio_ap device driver + +From: Tony Krowiak + +[ Upstream commit 8f8cf767589f2131ae5d40f3758429095c701c84 ] + +The device release callback function invoked to release the matrix device +uses the dev_get_drvdata(device *dev) function to retrieve the +pointer to the vfio_matrix_dev object in order to free its storage. The +problem is, this object is not stored as drvdata with the device; since the +kfree function will accept a NULL pointer, the memory for the +vfio_matrix_dev object is never freed. + +Since the device being released is contained within the vfio_matrix_dev +object, the container_of macro will be used to retrieve its pointer. + +Fixes: 1fde573413b5 ("s390: vfio-ap: base implementation of VFIO AP device driver") +Signed-off-by: Tony Krowiak +Reviewed-by: Harald Freudenberger +Link: https://lore.kernel.org/r/20230320150447.34557-1-akrowiak@linux.ibm.com +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + drivers/s390/crypto/vfio_ap_drv.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/s390/crypto/vfio_ap_drv.c b/drivers/s390/crypto/vfio_ap_drv.c +index 7dc72cb718b0e..22128eb44f7fa 100644 +--- a/drivers/s390/crypto/vfio_ap_drv.c ++++ b/drivers/s390/crypto/vfio_ap_drv.c +@@ -82,8 +82,9 @@ static void vfio_ap_queue_dev_remove(struct ap_device *apdev) + + static void vfio_ap_matrix_dev_release(struct device *dev) + { +- struct ap_matrix_dev *matrix_dev = dev_get_drvdata(dev); ++ struct ap_matrix_dev *matrix_dev; + ++ matrix_dev = container_of(dev, struct ap_matrix_dev, device); + kfree(matrix_dev); + } + +-- +2.39.2 + diff --git a/queue-5.4/scsi-megaraid_sas-fix-crash-after-a-double-completio.patch b/queue-5.4/scsi-megaraid_sas-fix-crash-after-a-double-completio.patch new file mode 100644 index 00000000000..804af3d0ff5 --- /dev/null +++ b/queue-5.4/scsi-megaraid_sas-fix-crash-after-a-double-completio.patch @@ -0,0 +1,47 @@ +From 14ef34cccac0d8fa3050a52049b22266a18189a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 16:01:34 +0100 +Subject: scsi: megaraid_sas: Fix crash after a double completion + +From: Tomas Henzl + +[ Upstream commit 2309df27111a51734cb9240b4d3c25f2f3c6ab06 ] + +When a physical disk is attached directly "without JBOD MAP support" (see +megasas_get_tm_devhandle()) then there is no real error handling in the +driver. Return FAILED instead of SUCCESS. + +Fixes: 18365b138508 ("megaraid_sas: Task management support") +Signed-off-by: Tomas Henzl +Link: https://lore.kernel.org/r/20230324150134.14696-1-thenzl@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/megaraid/megaraid_sas_fusion.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c +index 944273f60d224..890002688bd40 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -4659,7 +4659,7 @@ int megasas_task_abort_fusion(struct scsi_cmnd *scmd) + devhandle = megasas_get_tm_devhandle(scmd->device); + + if (devhandle == (u16)ULONG_MAX) { +- ret = SUCCESS; ++ ret = FAILED; + sdev_printk(KERN_INFO, scmd->device, + "task abort issued for invalid devhandle\n"); + mutex_unlock(&instance->reset_mutex); +@@ -4729,7 +4729,7 @@ int megasas_reset_target_fusion(struct scsi_cmnd *scmd) + devhandle = megasas_get_tm_devhandle(scmd->device); + + if (devhandle == (u16)ULONG_MAX) { +- ret = SUCCESS; ++ ret = FAILED; + sdev_printk(KERN_INFO, scmd->device, + "target reset issued for invalid devhandle\n"); + mutex_unlock(&instance->reset_mutex); +-- +2.39.2 + diff --git a/queue-5.4/series b/queue-5.4/series index d0c03cf535e..0043160eb58 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -70,3 +70,18 @@ fbdev-nvidia-fix-potential-divide-by-zero.patch fbdev-intelfb-fix-potential-divide-by-zero.patch fbdev-lxfb-fix-potential-divide-by-zero.patch fbdev-au1200fb-fix-potential-divide-by-zero.patch +ca8210-fix-unsigned-mac_len-comparison-with-zero-in-.patch +dma-mapping-drop-the-dev-argument-to-arch_sync_dma_f.patch +mips-bmips-bcm6358-disable-rac-flush-for-tp1.patch +mtd-rawnand-meson-invalidate-cache-on-polling-ecc-bi.patch +scsi-megaraid_sas-fix-crash-after-a-double-completio.patch +ptp_qoriq-fix-memory-leak-in-probe.patch +regulator-fix-spelling-mistake-cant-can-t.patch +regulator-handle-deferred-clk.patch +net-net_failover-fix-txq-exceeding-warning.patch +can-bcm-bcm_tx_setup-fix-kmsan-uninit-value-in-vfs_w.patch +s390-vfio-ap-fix-memory-leak-in-vfio_ap-device-drive.patch +i40e-fix-registers-dump-after-run-ethtool-adapter-se.patch +bnxt_en-fix-typo-in-pci-id-to-device-description-str.patch +net-dsa-mv88e6xxx-enable-igmp-snooping-on-user-ports.patch +net-mvneta-make-tx-buffer-array-agnostic.patch