From: Sasha Levin Date: Mon, 2 Jan 2023 03:25:58 +0000 (-0500) Subject: Fixes for 5.10 X-Git-Tag: v6.0.17~32 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f7496282da6475ec614f6c9967657d1ed5a9ef54;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/ata-ahci-fix-pcs-quirk-application-for-suspend.patch b/queue-5.10/ata-ahci-fix-pcs-quirk-application-for-suspend.patch new file mode 100644 index 00000000000..b01ce69415f --- /dev/null +++ b/queue-5.10/ata-ahci-fix-pcs-quirk-application-for-suspend.patch @@ -0,0 +1,148 @@ +From 9b00b60f257b666728b426f5bcc01b1372af03e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Dec 2022 09:26:34 +0000 +Subject: ata: ahci: Fix PCS quirk application for suspend + +From: Adam Vodopjan + +[ Upstream commit 37e14e4f3715428b809e4df9a9958baa64c77d51 ] + +Since kernel 5.3.4 my laptop (ICH8M controller) does not see Kingston +SV300S37A60G SSD disk connected into a SATA connector on wake from +suspend. The problem was introduced in c312ef176399 ("libata/ahci: Drop +PCS quirk for Denverton and beyond"): the quirk is not applied on wake +from suspend as it originally was. + +It is worth to mention the commit contained another bug: the quirk is +not applied at all to controllers which require it. The fix commit +09d6ac8dc51a ("libata/ahci: Fix PCS quirk application") landed in 5.3.8. +So testing my patch anywhere between commits c312ef176399 and +09d6ac8dc51a is pointless. + +Not all disks trigger the problem. For example nothing bad happens with +Western Digital WD5000LPCX HDD. + +Test hardware: +- Acer 5920G with ICH8M SATA controller +- sda: some SATA HDD connnected into the DVD drive IDE port with a + SATA-IDE caddy. It is a boot disk +- sdb: Kingston SV300S37A60G SSD connected into the only SATA port + +Sample "dmesg --notime | grep -E '^(sd |ata)'" output on wake: + +sd 0:0:0:0: [sda] Starting disk +sd 2:0:0:0: [sdb] Starting disk +ata4: SATA link down (SStatus 4 SControl 300) +ata3: SATA link down (SStatus 4 SControl 300) +ata1.00: ACPI cmd ef/03:0c:00:00:00:a0 (SET FEATURES) filtered out +ata1.00: ACPI cmd ef/03:42:00:00:00:a0 (SET FEATURES) filtered out +ata1: FORCE: cable set to 80c +ata5: SATA link down (SStatus 0 SControl 300) +ata3: SATA link down (SStatus 4 SControl 300) +ata3: SATA link down (SStatus 4 SControl 300) +ata3.00: disabled +sd 2:0:0:0: rejecting I/O to offline device +ata3.00: detaching (SCSI 2:0:0:0) +sd 2:0:0:0: [sdb] Start/Stop Unit failed: Result: hostbyte=DID_NO_CONNECT + driverbyte=DRIVER_OK +sd 2:0:0:0: [sdb] Synchronizing SCSI cache +sd 2:0:0:0: [sdb] Synchronize Cache(10) failed: Result: + hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK +sd 2:0:0:0: [sdb] Stopping disk +sd 2:0:0:0: [sdb] Start/Stop Unit failed: Result: hostbyte=DID_BAD_TARGET + driverbyte=DRIVER_OK + +Commit c312ef176399 dropped ahci_pci_reset_controller() which internally +calls ahci_reset_controller() and applies the PCS quirk if needed after +that. It was called each time a reset was required instead of just +ahci_reset_controller(). This patch puts the function back in place. + +Fixes: c312ef176399 ("libata/ahci: Drop PCS quirk for Denverton and beyond") +Signed-off-by: Adam Vodopjan +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/ahci.c | 32 +++++++++++++++++++++++--------- + 1 file changed, 23 insertions(+), 9 deletions(-) + +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index ff2add0101fe..7ca9fa9a75e2 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -83,6 +83,7 @@ enum board_ids { + static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent); + static void ahci_remove_one(struct pci_dev *dev); + static void ahci_shutdown_one(struct pci_dev *dev); ++static void ahci_intel_pcs_quirk(struct pci_dev *pdev, struct ahci_host_priv *hpriv); + static int ahci_vt8251_hardreset(struct ata_link *link, unsigned int *class, + unsigned long deadline); + static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class, +@@ -664,6 +665,25 @@ static void ahci_pci_save_initial_config(struct pci_dev *pdev, + ahci_save_initial_config(&pdev->dev, hpriv); + } + ++static int ahci_pci_reset_controller(struct ata_host *host) ++{ ++ struct pci_dev *pdev = to_pci_dev(host->dev); ++ struct ahci_host_priv *hpriv = host->private_data; ++ int rc; ++ ++ rc = ahci_reset_controller(host); ++ if (rc) ++ return rc; ++ ++ /* ++ * If platform firmware failed to enable ports, try to enable ++ * them here. ++ */ ++ ahci_intel_pcs_quirk(pdev, hpriv); ++ ++ return 0; ++} ++ + static void ahci_pci_init_controller(struct ata_host *host) + { + struct ahci_host_priv *hpriv = host->private_data; +@@ -865,7 +885,7 @@ static int ahci_pci_device_runtime_resume(struct device *dev) + struct ata_host *host = pci_get_drvdata(pdev); + int rc; + +- rc = ahci_reset_controller(host); ++ rc = ahci_pci_reset_controller(host); + if (rc) + return rc; + ahci_pci_init_controller(host); +@@ -900,7 +920,7 @@ static int ahci_pci_device_resume(struct device *dev) + ahci_mcp89_apple_enable(pdev); + + if (pdev->dev.power.power_state.event == PM_EVENT_SUSPEND) { +- rc = ahci_reset_controller(host); ++ rc = ahci_pci_reset_controller(host); + if (rc) + return rc; + +@@ -1785,12 +1805,6 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + /* save initial config */ + ahci_pci_save_initial_config(pdev, hpriv); + +- /* +- * If platform firmware failed to enable ports, try to enable +- * them here. +- */ +- ahci_intel_pcs_quirk(pdev, hpriv); +- + /* prepare host */ + if (hpriv->cap & HOST_CAP_NCQ) { + pi.flags |= ATA_FLAG_NCQ; +@@ -1900,7 +1914,7 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + if (rc) + return rc; + +- rc = ahci_reset_controller(host); ++ rc = ahci_pci_reset_controller(host); + if (rc) + return rc; + +-- +2.35.1 + diff --git a/queue-5.10/hid-multitouch-fix-asus-expertbook-p2-p2451fa-trackp.patch b/queue-5.10/hid-multitouch-fix-asus-expertbook-p2-p2451fa-trackp.patch new file mode 100644 index 00000000000..ed37733483f --- /dev/null +++ b/queue-5.10/hid-multitouch-fix-asus-expertbook-p2-p2451fa-trackp.patch @@ -0,0 +1,53 @@ +From 82b3559014711add7b354fa1e476352dbc21e244 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Nov 2022 17:57:05 +0100 +Subject: HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: José Expósito + +[ Upstream commit 4eab1c2fe06c98a4dff258dd64800b6986c101e9 ] + +The HID descriptor of this device contains two mouse collections, one +for mouse emulation and the other for the trackpoint. + +Both collections get merged and, because the first one defines X and Y, +the movemenent events reported by the trackpoint collection are +ignored. + +Set the MT_CLS_WIN_8_FORCE_MULTI_INPUT class for this device to be able +to receive its reports. + +This fix is similar to/based on commit 40d5bb87377a ("HID: multitouch: +enable multi-input as a quirk for some devices"). + +Link: https://gitlab.freedesktop.org/libinput/libinput/-/issues/825 +Reported-by: Akito +Tested-by: Akito +Signed-off-by: José Expósito +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-multitouch.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index a78ce16d4782..ea8c52f0aa78 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -1912,6 +1912,10 @@ static const struct hid_device_id mt_devices[] = { + HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, + USB_VENDOR_ID_ELAN, 0x313a) }, + ++ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT, ++ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, ++ USB_VENDOR_ID_ELAN, 0x3148) }, ++ + /* Elitegroup panel */ + { .driver_data = MT_CLS_SERIAL, + MT_USB_DEVICE(USB_VENDOR_ID_ELITEGROUP, +-- +2.35.1 + diff --git a/queue-5.10/hid-plantronics-additional-pids-for-double-volume-ke.patch b/queue-5.10/hid-plantronics-additional-pids-for-double-volume-ke.patch new file mode 100644 index 00000000000..f3597e71ea8 --- /dev/null +++ b/queue-5.10/hid-plantronics-additional-pids-for-double-volume-ke.patch @@ -0,0 +1,81 @@ +From fc820ab593886b0000d517fbb59c2e68167c11cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 15:05:06 -0800 +Subject: HID: plantronics: Additional PIDs for double volume key presses quirk + +From: Terry Junge + +[ Upstream commit 3d57f36c89d8ba32b2c312f397a37fd1a2dc7cfc ] + +I no longer work for Plantronics (aka Poly, aka HP) and do not have +access to the headsets in order to test. However, as noted by Maxim, +the other 32xx models that share the same base code set as the 3220 +would need the same quirk. This patch adds the PIDs for the rest of +the Blackwire 32XX product family that require the quirk. + +Plantronics Blackwire 3210 Series (047f:c055) +Plantronics Blackwire 3215 Series (047f:c057) +Plantronics Blackwire 3225 Series (047f:c058) + +Quote from previous patch by Maxim Mikityanskiy +Plantronics Blackwire 3220 Series (047f:c056) sends HID reports twice +for each volume key press. This patch adds a quirk to hid-plantronics +for this product ID, which will ignore the second volume key press if +it happens within 5 ms from the last one that was handled. + +The patch was tested on the mentioned model only, it shouldn't affect +other models, however, this quirk might be needed for them too. +Auto-repeat (when a key is held pressed) is not affected, because the +rate is about 3 times per second, which is far less frequent than once +in 5 ms. +End quote + +Signed-off-by: Terry Junge +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/hid-plantronics.c | 9 +++++++++ + 2 files changed, 12 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 2001566be3f5..09c3f30f10d3 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -948,7 +948,10 @@ + #define USB_DEVICE_ID_ORTEK_IHOME_IMAC_A210S 0x8003 + + #define USB_VENDOR_ID_PLANTRONICS 0x047f ++#define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3210_SERIES 0xc055 + #define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES 0xc056 ++#define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3215_SERIES 0xc057 ++#define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3225_SERIES 0xc058 + + #define USB_VENDOR_ID_PANASONIC 0x04da + #define USB_DEVICE_ID_PANABOARD_UBT780 0x1044 +diff --git a/drivers/hid/hid-plantronics.c b/drivers/hid/hid-plantronics.c +index e81b7cec2d12..3d414ae194ac 100644 +--- a/drivers/hid/hid-plantronics.c ++++ b/drivers/hid/hid-plantronics.c +@@ -198,9 +198,18 @@ static int plantronics_probe(struct hid_device *hdev, + } + + static const struct hid_device_id plantronics_devices[] = { ++ { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, ++ USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3210_SERIES), ++ .driver_data = PLT_QUIRK_DOUBLE_VOLUME_KEYS }, + { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, + USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES), + .driver_data = PLT_QUIRK_DOUBLE_VOLUME_KEYS }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, ++ USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3215_SERIES), ++ .driver_data = PLT_QUIRK_DOUBLE_VOLUME_KEYS }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, ++ USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3225_SERIES), ++ .driver_data = PLT_QUIRK_DOUBLE_VOLUME_KEYS }, + { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, HID_ANY_ID) }, + { } + }; +-- +2.35.1 + diff --git a/queue-5.10/nvme-fix-the-nvme_cmd_effects_cse_mask-definition.patch b/queue-5.10/nvme-fix-the-nvme_cmd_effects_cse_mask-definition.patch new file mode 100644 index 00000000000..1b467e94569 --- /dev/null +++ b/queue-5.10/nvme-fix-the-nvme_cmd_effects_cse_mask-definition.patch @@ -0,0 +1,46 @@ +From e168603c59bb353d090e07cbb397334d49f6abc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Dec 2022 10:30:45 +0100 +Subject: nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition + +From: Christoph Hellwig + +[ Upstream commit 685e6311637e46f3212439ce2789f8a300e5050f ] + +3 << 16 does not generate the correct mask for bits 16, 17 and 18. +Use the GENMASK macro to generate the correct mask instead. + +Fixes: 84fef62d135b ("nvme: check admin passthru command effects") +Signed-off-by: Christoph Hellwig +Reviewed-by: Keith Busch +Reviewed-by: Sagi Grimberg +Reviewed-by: Kanchan Joshi +Signed-off-by: Sasha Levin +--- + include/linux/nvme.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/linux/nvme.h b/include/linux/nvme.h +index bfed36e342cc..fe39ed9e9303 100644 +--- a/include/linux/nvme.h ++++ b/include/linux/nvme.h +@@ -7,6 +7,7 @@ + #ifndef _LINUX_NVME_H + #define _LINUX_NVME_H + ++#include + #include + #include + +@@ -528,7 +529,7 @@ enum { + NVME_CMD_EFFECTS_NCC = 1 << 2, + NVME_CMD_EFFECTS_NIC = 1 << 3, + NVME_CMD_EFFECTS_CCC = 1 << 4, +- NVME_CMD_EFFECTS_CSE_MASK = 3 << 16, ++ NVME_CMD_EFFECTS_CSE_MASK = GENMASK(18, 16), + NVME_CMD_EFFECTS_UUID_SEL = 1 << 19, + }; + +-- +2.35.1 + diff --git a/queue-5.10/nvme-pci-fix-doorbell-buffer-value-endianness.patch b/queue-5.10/nvme-pci-fix-doorbell-buffer-value-endianness.patch new file mode 100644 index 00000000000..9e8b8ac7752 --- /dev/null +++ b/queue-5.10/nvme-pci-fix-doorbell-buffer-value-endianness.patch @@ -0,0 +1,100 @@ +From 12bba944ad8f1c4aaea8d6302485945b1e5bfe7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Dec 2022 09:58:07 +0100 +Subject: nvme-pci: fix doorbell buffer value endianness + +From: Klaus Jensen + +[ Upstream commit b5f96cb719d8ba220b565ddd3ba4ac0d8bcfb130 ] + +When using shadow doorbells, the event index and the doorbell values are +written to host memory. Prior to this patch, the values written would +erroneously be written in host endianness. This causes trouble on +big-endian platforms. Fix this by adding missing endian conversions. + +This issue was noticed by Guenter while testing various big-endian +platforms under QEMU[1]. A similar fix required for hw/nvme in QEMU is +up for review as well[2]. + + [1]: https://lore.kernel.org/qemu-devel/20221209110022.GA3396194@roeck-us.net/ + [2]: https://lore.kernel.org/qemu-devel/20221212114409.34972-4-its@irrelevant.dk/ + +Fixes: f9f38e33389c ("nvme: improve performance for virtual NVMe devices") +Reported-by: Guenter Roeck +Signed-off-by: Klaus Jensen +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 25 +++++++++++++------------ + 1 file changed, 13 insertions(+), 12 deletions(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index c222d7bf6ce1..948b027a75d3 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -139,9 +139,9 @@ struct nvme_dev { + mempool_t *iod_mempool; + + /* shadow doorbell buffer support: */ +- u32 *dbbuf_dbs; ++ __le32 *dbbuf_dbs; + dma_addr_t dbbuf_dbs_dma_addr; +- u32 *dbbuf_eis; ++ __le32 *dbbuf_eis; + dma_addr_t dbbuf_eis_dma_addr; + + /* host memory buffer support: */ +@@ -209,10 +209,10 @@ struct nvme_queue { + #define NVMEQ_SQ_CMB 1 + #define NVMEQ_DELETE_ERROR 2 + #define NVMEQ_POLLED 3 +- u32 *dbbuf_sq_db; +- u32 *dbbuf_cq_db; +- u32 *dbbuf_sq_ei; +- u32 *dbbuf_cq_ei; ++ __le32 *dbbuf_sq_db; ++ __le32 *dbbuf_cq_db; ++ __le32 *dbbuf_sq_ei; ++ __le32 *dbbuf_cq_ei; + struct completion delete_done; + }; + +@@ -334,11 +334,11 @@ static inline int nvme_dbbuf_need_event(u16 event_idx, u16 new_idx, u16 old) + } + + /* Update dbbuf and return true if an MMIO is required */ +-static bool nvme_dbbuf_update_and_check_event(u16 value, u32 *dbbuf_db, +- volatile u32 *dbbuf_ei) ++static bool nvme_dbbuf_update_and_check_event(u16 value, __le32 *dbbuf_db, ++ volatile __le32 *dbbuf_ei) + { + if (dbbuf_db) { +- u16 old_value; ++ u16 old_value, event_idx; + + /* + * Ensure that the queue is written before updating +@@ -346,8 +346,8 @@ static bool nvme_dbbuf_update_and_check_event(u16 value, u32 *dbbuf_db, + */ + wmb(); + +- old_value = *dbbuf_db; +- *dbbuf_db = value; ++ old_value = le32_to_cpu(*dbbuf_db); ++ *dbbuf_db = cpu_to_le32(value); + + /* + * Ensure that the doorbell is updated before reading the event +@@ -357,7 +357,8 @@ static bool nvme_dbbuf_update_and_check_event(u16 value, u32 *dbbuf_db, + */ + mb(); + +- if (!nvme_dbbuf_need_event(*dbbuf_ei, value, old_value)) ++ event_idx = le32_to_cpu(*dbbuf_ei); ++ if (!nvme_dbbuf_need_event(event_idx, value, old_value)) + return false; + } + +-- +2.35.1 + diff --git a/queue-5.10/nvme-pci-fix-mempool-alloc-size.patch b/queue-5.10/nvme-pci-fix-mempool-alloc-size.patch new file mode 100644 index 00000000000..da772c5ee59 --- /dev/null +++ b/queue-5.10/nvme-pci-fix-mempool-alloc-size.patch @@ -0,0 +1,51 @@ +From 8e74933922f67a099abb3e5dea64c7c6ae7b3e19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Dec 2022 10:59:06 -0800 +Subject: nvme-pci: fix mempool alloc size + +From: Keith Busch + +[ Upstream commit c89a529e823d51dd23c7ec0c047c7a454a428541 ] + +Convert the max size to bytes to match the units of the divisor that +calculates the worst-case number of PRP entries. + +The result is used to determine how many PRP Lists are required. The +code was previously rounding this to 1 list, but we can require 2 in the +worst case. In that scenario, the driver would corrupt memory beyond the +size provided by the mempool. + +While unlikely to occur (you'd need a 4MB in exactly 127 phys segments +on a queue that doesn't support SGLs), this memory corruption has been +observed by kfence. + +Cc: Jens Axboe +Fixes: 943e942e6266f ("nvme-pci: limit max IO size and segments to avoid high order allocations") +Signed-off-by: Keith Busch +Reviewed-by: Jens Axboe +Reviewed-by: Kanchan Joshi +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 948b027a75d3..0452fb96df69 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -372,8 +372,8 @@ static bool nvme_dbbuf_update_and_check_event(u16 value, __le32 *dbbuf_db, + */ + static int nvme_pci_npages_prp(void) + { +- unsigned nprps = DIV_ROUND_UP(NVME_MAX_KB_SZ + NVME_CTRL_PAGE_SIZE, +- NVME_CTRL_PAGE_SIZE); ++ unsigned max_bytes = (NVME_MAX_KB_SZ * 1024) + NVME_CTRL_PAGE_SIZE; ++ unsigned nprps = DIV_ROUND_UP(max_bytes, NVME_CTRL_PAGE_SIZE); + return DIV_ROUND_UP(8 * nprps, PAGE_SIZE - 8); + } + +-- +2.35.1 + diff --git a/queue-5.10/nvme-pci-fix-page-size-checks.patch b/queue-5.10/nvme-pci-fix-page-size-checks.patch new file mode 100644 index 00000000000..0e0d1ed44c4 --- /dev/null +++ b/queue-5.10/nvme-pci-fix-page-size-checks.patch @@ -0,0 +1,63 @@ +From b15f192b13249b684d48590f4898bbb16199b956 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Dec 2022 13:54:55 -0800 +Subject: nvme-pci: fix page size checks + +From: Keith Busch + +[ Upstream commit 841734234a28fd5cd0889b84bd4d93a0988fa11e ] + +The size allocated out of the dma pool is at most NVME_CTRL_PAGE_SIZE, +which may be smaller than the PAGE_SIZE. + +Fixes: c61b82c7b7134 ("nvme-pci: fix PRP pool size") +Signed-off-by: Keith Busch +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 0452fb96df69..67dd68462b81 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -33,7 +33,7 @@ + #define SQ_SIZE(q) ((q)->q_depth << (q)->sqes) + #define CQ_SIZE(q) ((q)->q_depth * sizeof(struct nvme_completion)) + +-#define SGES_PER_PAGE (PAGE_SIZE / sizeof(struct nvme_sgl_desc)) ++#define SGES_PER_PAGE (NVME_CTRL_PAGE_SIZE / sizeof(struct nvme_sgl_desc)) + + /* + * These can be higher, but we need to ensure that any command doesn't +@@ -374,7 +374,7 @@ static int nvme_pci_npages_prp(void) + { + unsigned max_bytes = (NVME_MAX_KB_SZ * 1024) + NVME_CTRL_PAGE_SIZE; + unsigned nprps = DIV_ROUND_UP(max_bytes, NVME_CTRL_PAGE_SIZE); +- return DIV_ROUND_UP(8 * nprps, PAGE_SIZE - 8); ++ return DIV_ROUND_UP(8 * nprps, NVME_CTRL_PAGE_SIZE - 8); + } + + /* +@@ -384,7 +384,7 @@ static int nvme_pci_npages_prp(void) + static int nvme_pci_npages_sgl(void) + { + return DIV_ROUND_UP(NVME_MAX_SEGS * sizeof(struct nvme_sgl_desc), +- PAGE_SIZE); ++ NVME_CTRL_PAGE_SIZE); + } + + static size_t nvme_pci_iod_alloc_size(void) +@@ -735,7 +735,7 @@ static void nvme_pci_sgl_set_seg(struct nvme_sgl_desc *sge, + sge->length = cpu_to_le32(entries * sizeof(*sge)); + sge->type = NVME_SGL_FMT_LAST_SEG_DESC << 4; + } else { +- sge->length = cpu_to_le32(PAGE_SIZE); ++ sge->length = cpu_to_le32(NVME_CTRL_PAGE_SIZE); + sge->type = NVME_SGL_FMT_SEG_DESC << 4; + } + } +-- +2.35.1 + diff --git a/queue-5.10/nvmet-don-t-defer-passthrough-commands-with-trivial-.patch b/queue-5.10/nvmet-don-t-defer-passthrough-commands-with-trivial-.patch new file mode 100644 index 00000000000..de0fbbc1d58 --- /dev/null +++ b/queue-5.10/nvmet-don-t-defer-passthrough-commands-with-trivial-.patch @@ -0,0 +1,55 @@ +From b420a85418fc5c9b9f37006bce942036f83b0cc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Dec 2022 09:51:19 +0100 +Subject: nvmet: don't defer passthrough commands with trivial effects to the + workqueue + +From: Christoph Hellwig + +[ Upstream commit 2a459f6933e1c459bffb7cc73fd6c900edc714bd ] + +Mask out the "Command Supported" and "Logical Block Content Change" bits +and only defer execution of commands that have non-trivial effects to +the workqueue for synchronous execution. This allows to execute admin +commands asynchronously on controllers that provide a Command Supported +and Effects log page, and will keep allowing to execute Write commands +asynchronously once command effects on I/O commands are taken into +account. + +Fixes: c1fef73f793b ("nvmet: add passthru code to process commands") +Signed-off-by: Christoph Hellwig +Reviewed-by: Keith Busch +Reviewed-by: Sagi Grimberg +Reviewed-by: Kanchan Joshi +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/passthru.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/nvme/target/passthru.c b/drivers/nvme/target/passthru.c +index d24251ece502..f76d01028df0 100644 +--- a/drivers/nvme/target/passthru.c ++++ b/drivers/nvme/target/passthru.c +@@ -259,14 +259,13 @@ static void nvmet_passthru_execute_cmd(struct nvmet_req *req) + } + + /* +- * If there are effects for the command we are about to execute, or +- * an end_req function we need to use nvme_execute_passthru_rq() +- * synchronously in a work item seeing the end_req function and +- * nvme_passthru_end() can't be called in the request done callback +- * which is typically in interrupt context. ++ * If a command needs post-execution fixups, or there are any ++ * non-trivial effects, make sure to execute the command synchronously ++ * in a workqueue so that nvme_passthru_end gets called. + */ + effects = nvme_command_effects(ctrl, ns, req->cmd->common.opcode); +- if (req->p.use_workqueue || effects) { ++ if (req->p.use_workqueue || ++ (effects & ~(NVME_CMD_EFFECTS_CSUPP | NVME_CMD_EFFECTS_LBCC))) { + INIT_WORK(&req->p.work, nvmet_passthru_execute_cmd_work); + req->p.rq = rq; + schedule_work(&req->p.work); +-- +2.35.1 + diff --git a/queue-5.10/objtool-fix-segfault.patch b/queue-5.10/objtool-fix-segfault.patch new file mode 100644 index 00000000000..6a28f288e8d --- /dev/null +++ b/queue-5.10/objtool-fix-segfault.patch @@ -0,0 +1,40 @@ +From 4c78d92b372348b1920d74035237dd831df3c296 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 23:27:46 +0530 +Subject: objtool: Fix SEGFAULT + +From: Christophe Leroy + +[ Upstream commit efb11fdb3e1a9f694fa12b70b21e69e55ec59c36 ] + +find_insn() will return NULL in case of failure. Check insn in order +to avoid a kernel Oops for NULL pointer dereference. + +Tested-by: Naveen N. Rao +Reviewed-by: Naveen N. Rao +Acked-by: Josh Poimboeuf +Acked-by: Peter Zijlstra (Intel) +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20221114175754.1131267-9-sv@linux.ibm.com +Signed-off-by: Sasha Levin +--- + tools/objtool/check.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index 5d64b673da2d..700984e7f5ba 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -196,7 +196,7 @@ static bool __dead_end_function(struct objtool_file *file, struct symbol *func, + return false; + + insn = find_insn(file, func->sec, func->offset); +- if (!insn->func) ++ if (!insn || !insn->func) + return false; + + func_for_each_insn(file, func, insn) { +-- +2.35.1 + diff --git a/queue-5.10/powerpc-msi-fix-deassociation-of-msi-descriptors.patch b/queue-5.10/powerpc-msi-fix-deassociation-of-msi-descriptors.patch new file mode 100644 index 00000000000..82f48f1ced0 --- /dev/null +++ b/queue-5.10/powerpc-msi-fix-deassociation-of-msi-descriptors.patch @@ -0,0 +1,100 @@ +From b92d6857500c31e9e6cc68bff1aaf6ade894c00b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Dec 2022 10:46:44 +0000 +Subject: powerpc/msi: Fix deassociation of MSI descriptors + +From: Marc Zyngier + +[ Upstream commit 4545c6a3d6ba71747eaa984c338ddd745e56e23f ] + +Since 2f2940d16823 ("genirq/msi: Remove filter from +msi_free_descs_free_range()"), the core MSI code relies on the +msi_desc->irq field to have been cleared before the descriptor +can be freed, as it indicates that there is no association with +a device anymore. + +The irq domain code provides this guarantee, and so does s390, +which is one of the two architectures not using irq domains for +MSIs. + +Powerpc, however, is missing this particular requirements, +leading in a splat and leaked MSI descriptors. + +Adding the now required irq reset to the handful of powerpc backends +that implement MSIs fixes that particular problem. + +Reported-by: Guenter Roeck +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/70dab88e-6119-0c12-7c6a-61bcbe239f66@roeck-us.net +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/4xx/hsta_msi.c | 1 + + arch/powerpc/platforms/cell/axon_msi.c | 1 + + arch/powerpc/platforms/pasemi/msi.c | 1 + + arch/powerpc/sysdev/fsl_msi.c | 1 + + arch/powerpc/sysdev/mpic_u3msi.c | 1 + + 5 files changed, 5 insertions(+) + +diff --git a/arch/powerpc/platforms/4xx/hsta_msi.c b/arch/powerpc/platforms/4xx/hsta_msi.c +index c950fed43b32..4f65bd0cf111 100644 +--- a/arch/powerpc/platforms/4xx/hsta_msi.c ++++ b/arch/powerpc/platforms/4xx/hsta_msi.c +@@ -117,6 +117,7 @@ static void hsta_teardown_msi_irqs(struct pci_dev *dev) + msi_bitmap_free_hwirqs(&ppc4xx_hsta_msi.bmp, irq, 1); + pr_debug("%s: Teardown IRQ %u (index %u)\n", __func__, + entry->irq, irq); ++ entry->irq = 0; + } + } + +diff --git a/arch/powerpc/platforms/cell/axon_msi.c b/arch/powerpc/platforms/cell/axon_msi.c +index ffbc7d2e9464..9f77dde61f31 100644 +--- a/arch/powerpc/platforms/cell/axon_msi.c ++++ b/arch/powerpc/platforms/cell/axon_msi.c +@@ -295,6 +295,7 @@ static void axon_msi_teardown_msi_irqs(struct pci_dev *dev) + + irq_set_msi_desc(entry->irq, NULL); + irq_dispose_mapping(entry->irq); ++ entry->irq = 0; + } + } + +diff --git a/arch/powerpc/platforms/pasemi/msi.c b/arch/powerpc/platforms/pasemi/msi.c +index d38944a1e258..76393c158ada 100644 +--- a/arch/powerpc/platforms/pasemi/msi.c ++++ b/arch/powerpc/platforms/pasemi/msi.c +@@ -69,6 +69,7 @@ static void pasemi_msi_teardown_msi_irqs(struct pci_dev *pdev) + hwirq = virq_to_hw(entry->irq); + irq_set_msi_desc(entry->irq, NULL); + irq_dispose_mapping(entry->irq); ++ entry->irq = 0; + msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap, hwirq, ALLOC_CHUNK); + } + +diff --git a/arch/powerpc/sysdev/fsl_msi.c b/arch/powerpc/sysdev/fsl_msi.c +index d276c5e96445..5c3f3173638e 100644 +--- a/arch/powerpc/sysdev/fsl_msi.c ++++ b/arch/powerpc/sysdev/fsl_msi.c +@@ -132,6 +132,7 @@ static void fsl_teardown_msi_irqs(struct pci_dev *pdev) + msi_data = irq_get_chip_data(entry->irq); + irq_set_msi_desc(entry->irq, NULL); + irq_dispose_mapping(entry->irq); ++ entry->irq = 0; + msi_bitmap_free_hwirqs(&msi_data->bitmap, hwirq, 1); + } + +diff --git a/arch/powerpc/sysdev/mpic_u3msi.c b/arch/powerpc/sysdev/mpic_u3msi.c +index 3861023d378a..43686c82e483 100644 +--- a/arch/powerpc/sysdev/mpic_u3msi.c ++++ b/arch/powerpc/sysdev/mpic_u3msi.c +@@ -111,6 +111,7 @@ static void u3msi_teardown_msi_irqs(struct pci_dev *pdev) + hwirq = virq_to_hw(entry->irq); + irq_set_msi_desc(entry->irq, NULL); + irq_dispose_mapping(entry->irq); ++ entry->irq = 0; + msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap, hwirq, 1); + } + +-- +2.35.1 + diff --git a/queue-5.10/powerpc-rtas-avoid-device-tree-lookups-in-rtas_os_te.patch b/queue-5.10/powerpc-rtas-avoid-device-tree-lookups-in-rtas_os_te.patch new file mode 100644 index 00000000000..9cac949c085 --- /dev/null +++ b/queue-5.10/powerpc-rtas-avoid-device-tree-lookups-in-rtas_os_te.patch @@ -0,0 +1,77 @@ +From ee915def9daaff7a5c93f6adb25cb1d59dde3ab2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Nov 2022 09:07:41 -0600 +Subject: powerpc/rtas: avoid device tree lookups in rtas_os_term() + +From: Nathan Lynch + +[ Upstream commit ed2213bfb192ab51f09f12e9b49b5d482c6493f3 ] + +rtas_os_term() is called during panic. Its behavior depends on a couple +of conditions in the /rtas node of the device tree, the traversal of +which entails locking and local IRQ state changes. If the kernel panics +while devtree_lock is held, rtas_os_term() as currently written could +hang. + +Instead of discovering the relevant characteristics at panic time, +cache them in file-static variables at boot. Note the lookup for +"ibm,extended-os-term" is converted to of_property_read_bool() since it +is a boolean property, not an RTAS function token. + +Signed-off-by: Nathan Lynch +Reviewed-by: Nicholas Piggin +Reviewed-by: Andrew Donnellan +[mpe: Incorporate suggested change from Nick] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20221118150751.469393-4-nathanl@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/rtas.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c +index bf962051af0a..aa66317a9a49 100644 +--- a/arch/powerpc/kernel/rtas.c ++++ b/arch/powerpc/kernel/rtas.c +@@ -715,6 +715,7 @@ void __noreturn rtas_halt(void) + + /* Must be in the RMO region, so we place it here */ + static char rtas_os_term_buf[2048]; ++static s32 ibm_os_term_token = RTAS_UNKNOWN_SERVICE; + + void rtas_os_term(char *str) + { +@@ -726,14 +727,13 @@ void rtas_os_term(char *str) + * this property may terminate the partition which we want to avoid + * since it interferes with panic_timeout. + */ +- if (RTAS_UNKNOWN_SERVICE == rtas_token("ibm,os-term") || +- RTAS_UNKNOWN_SERVICE == rtas_token("ibm,extended-os-term")) ++ if (ibm_os_term_token == RTAS_UNKNOWN_SERVICE) + return; + + snprintf(rtas_os_term_buf, 2048, "OS panic: %s", str); + + do { +- status = rtas_call(rtas_token("ibm,os-term"), 1, 1, NULL, ++ status = rtas_call(ibm_os_term_token, 1, 1, NULL, + __pa(rtas_os_term_buf)); + } while (rtas_busy_delay(status)); + +@@ -1267,6 +1267,13 @@ void __init rtas_initialize(void) + no_entry = of_property_read_u32(rtas.dev, "linux,rtas-entry", &entry); + rtas.entry = no_entry ? rtas.base : entry; + ++ /* ++ * Discover these now to avoid device tree lookups in the ++ * panic path. ++ */ ++ if (of_property_read_bool(rtas.dev, "ibm,extended-os-term")) ++ ibm_os_term_token = rtas_token("ibm,os-term"); ++ + /* If RTAS was found, allocate the RMO buffer for it and look for + * the stop-self token if any + */ +-- +2.35.1 + diff --git a/queue-5.10/powerpc-rtas-avoid-scheduling-in-rtas_os_term.patch b/queue-5.10/powerpc-rtas-avoid-scheduling-in-rtas_os_term.patch new file mode 100644 index 00000000000..715098bb708 --- /dev/null +++ b/queue-5.10/powerpc-rtas-avoid-scheduling-in-rtas_os_term.patch @@ -0,0 +1,67 @@ +From 008462932acd9216a923f9b27218a9b65f53e81f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Nov 2022 09:07:42 -0600 +Subject: powerpc/rtas: avoid scheduling in rtas_os_term() + +From: Nathan Lynch + +[ Upstream commit 6c606e57eecc37d6b36d732b1ff7e55b7dc32dd4 ] + +It's unsafe to use rtas_busy_delay() to handle a busy status from +the ibm,os-term RTAS function in rtas_os_term(): + +Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b +BUG: sleeping function called from invalid context at arch/powerpc/kernel/rtas.c:618 +in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1, name: swapper/0 +preempt_count: 2, expected: 0 +CPU: 7 PID: 1 Comm: swapper/0 Tainted: G D 6.0.0-rc5-02182-gf8553a572277-dirty #9 +Call Trace: +[c000000007b8f000] [c000000001337110] dump_stack_lvl+0xb4/0x110 (unreliable) +[c000000007b8f040] [c0000000002440e4] __might_resched+0x394/0x3c0 +[c000000007b8f0e0] [c00000000004f680] rtas_busy_delay+0x120/0x1b0 +[c000000007b8f100] [c000000000052d04] rtas_os_term+0xb8/0xf4 +[c000000007b8f180] [c0000000001150fc] pseries_panic+0x50/0x68 +[c000000007b8f1f0] [c000000000036354] ppc_panic_platform_handler+0x34/0x50 +[c000000007b8f210] [c0000000002303c4] notifier_call_chain+0xd4/0x1c0 +[c000000007b8f2b0] [c0000000002306cc] atomic_notifier_call_chain+0xac/0x1c0 +[c000000007b8f2f0] [c0000000001d62b8] panic+0x228/0x4d0 +[c000000007b8f390] [c0000000001e573c] do_exit+0x140c/0x1420 +[c000000007b8f480] [c0000000001e586c] make_task_dead+0xdc/0x200 + +Use rtas_busy_delay_time() instead, which signals without side effects +whether to attempt the ibm,os-term RTAS call again. + +Signed-off-by: Nathan Lynch +Reviewed-by: Nicholas Piggin +Reviewed-by: Andrew Donnellan +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20221118150751.469393-5-nathanl@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/rtas.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c +index aa66317a9a49..014229c40435 100644 +--- a/arch/powerpc/kernel/rtas.c ++++ b/arch/powerpc/kernel/rtas.c +@@ -732,10 +732,15 @@ void rtas_os_term(char *str) + + snprintf(rtas_os_term_buf, 2048, "OS panic: %s", str); + ++ /* ++ * Keep calling as long as RTAS returns a "try again" status, ++ * but don't use rtas_busy_delay(), which potentially ++ * schedules. ++ */ + do { + status = rtas_call(ibm_os_term_token, 1, 1, NULL, + __pa(rtas_os_term_buf)); +- } while (rtas_busy_delay(status)); ++ } while (rtas_busy_delay_time(status)); + + if (status != 0) + printk(KERN_EMERG "ibm,os-term call failed %d\n", status); +-- +2.35.1 + diff --git a/queue-5.10/series b/queue-5.10/series index c590f71d946..44b56f97065 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -571,3 +571,15 @@ media-dvbdev-fix-refcnt-bug.patch pwm-tegra-fix-32-bit-build.patch usb-dwc3-qcom-fix-memory-leak-in-dwc3_qcom_interconn.patch cifs-fix-oops-during-encryption.patch +nvme-pci-fix-doorbell-buffer-value-endianness.patch +nvme-pci-fix-mempool-alloc-size.patch +nvme-pci-fix-page-size-checks.patch +ata-ahci-fix-pcs-quirk-application-for-suspend.patch +nvme-fix-the-nvme_cmd_effects_cse_mask-definition.patch +nvmet-don-t-defer-passthrough-commands-with-trivial-.patch +objtool-fix-segfault.patch +powerpc-rtas-avoid-device-tree-lookups-in-rtas_os_te.patch +powerpc-rtas-avoid-scheduling-in-rtas_os_term.patch +powerpc-msi-fix-deassociation-of-msi-descriptors.patch +hid-multitouch-fix-asus-expertbook-p2-p2451fa-trackp.patch +hid-plantronics-additional-pids-for-double-volume-ke.patch