From 1eee284e0eec90e0ac29f890b0c7e83408082fb8 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 13 Oct 2022 15:23:51 +0200 Subject: [PATCH] 6.0-stable patches added patches: alsa-hda-fix-position-reporting-on-poulsbo.patch alsa-hda-realtek-add-quirk-for-hp-zbook-firefly-14-g9-model.patch efi-correct-macmini-dmi-match-in-uefi-cert-quirk.patch random-clamp-credited-irq-bits-to-maximum-mixed.patch random-restore-o_nonblock-support.patch revert-crypto-qat-reduce-size-of-mapped-region.patch revert-powerpc-rtas-implement-reentrant-rtas-call.patch revert-usb-dwc3-don-t-switch-otg-peripheral-if-extcon-is-present.patch revert-usb-fixup-for-merge-issue-with-usb-dwc3-don-t-switch-otg-peripheral-if-extcon-is-present.patch scsi-qla2xxx-fix-response-queue-handler-reading-stale-packets.patch scsi-qla2xxx-revert-scsi-qla2xxx-fix-response-queue-handler-reading-stale-packets.patch scsi-stex-properly-zero-out-the-passthrough-command-structure.patch usb-serial-qcserial-add-new-usb-id-for-dell-branded-em7455.patch --- ...da-fix-position-reporting-on-poulsbo.patch | 40 +++ ...irk-for-hp-zbook-firefly-14-g9-model.patch | 69 +++++ ...macmini-dmi-match-in-uefi-cert-quirk.patch | 55 ++++ ...p-credited-irq-bits-to-maximum-mixed.patch | 31 ++ .../random-restore-o_nonblock-support.patch | 65 ++++ ...pto-qat-reduce-size-of-mapped-region.patch | 98 ++++++ ...c-rtas-implement-reentrant-rtas-call.patch | 279 ++++++++++++++++++ ...-otg-peripheral-if-extcon-is-present.patch | 185 ++++++++++++ ...-otg-peripheral-if-extcon-is-present.patch | 43 +++ ...-queue-handler-reading-stale-packets.patch | 65 ++++ ...-queue-handler-reading-stale-packets.patch | 107 +++++++ ...ut-the-passthrough-command-structure.patch | 68 +++++ queue-6.0/series | 13 + ...d-new-usb-id-for-dell-branded-em7455.patch | 29 ++ 14 files changed, 1147 insertions(+) create mode 100644 queue-6.0/alsa-hda-fix-position-reporting-on-poulsbo.patch create mode 100644 queue-6.0/alsa-hda-realtek-add-quirk-for-hp-zbook-firefly-14-g9-model.patch create mode 100644 queue-6.0/efi-correct-macmini-dmi-match-in-uefi-cert-quirk.patch create mode 100644 queue-6.0/random-clamp-credited-irq-bits-to-maximum-mixed.patch create mode 100644 queue-6.0/random-restore-o_nonblock-support.patch create mode 100644 queue-6.0/revert-crypto-qat-reduce-size-of-mapped-region.patch create mode 100644 queue-6.0/revert-powerpc-rtas-implement-reentrant-rtas-call.patch create mode 100644 queue-6.0/revert-usb-dwc3-don-t-switch-otg-peripheral-if-extcon-is-present.patch create mode 100644 queue-6.0/revert-usb-fixup-for-merge-issue-with-usb-dwc3-don-t-switch-otg-peripheral-if-extcon-is-present.patch create mode 100644 queue-6.0/scsi-qla2xxx-fix-response-queue-handler-reading-stale-packets.patch create mode 100644 queue-6.0/scsi-qla2xxx-revert-scsi-qla2xxx-fix-response-queue-handler-reading-stale-packets.patch create mode 100644 queue-6.0/scsi-stex-properly-zero-out-the-passthrough-command-structure.patch create mode 100644 queue-6.0/usb-serial-qcserial-add-new-usb-id-for-dell-branded-em7455.patch diff --git a/queue-6.0/alsa-hda-fix-position-reporting-on-poulsbo.patch b/queue-6.0/alsa-hda-fix-position-reporting-on-poulsbo.patch new file mode 100644 index 00000000000..859270d0980 --- /dev/null +++ b/queue-6.0/alsa-hda-fix-position-reporting-on-poulsbo.patch @@ -0,0 +1,40 @@ +From 56e696c0f0c71b77fff921fc94b58a02f0445b2c Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sat, 1 Oct 2022 16:21:24 +0200 +Subject: ALSA: hda: Fix position reporting on Poulsbo + +From: Takashi Iwai + +commit 56e696c0f0c71b77fff921fc94b58a02f0445b2c upstream. + +Hans reported that his Sony VAIO VPX11S1E showed the broken sound +behavior at the start of the stream for a couple of seconds, and it +turned out that the position_fix=1 option fixes the issue. It implies +that the position reporting is inaccurate, and very likely hitting on +all Poulsbo devices. + +The patch applies the workaround for Poulsbo generically to switch to +LPIB mode instead of the default position buffer. + +Reported-and-tested-by: Hans de Goede +Cc: +Link: https://lore.kernel.org/r/3e8697e1-87c6-7a7b-d2e8-b21f1d2f181b@redhat.com +Link: https://lore.kernel.org/r/20221001142124.7241-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/hda_intel.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2554,7 +2554,8 @@ static const struct pci_device_id azx_id + .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_NOPM }, + /* Poulsbo */ + { PCI_DEVICE(0x8086, 0x811b), +- .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_BASE }, ++ .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_BASE | ++ AZX_DCAPS_POSFIX_LPIB }, + /* Oaktrail */ + { PCI_DEVICE(0x8086, 0x080a), + .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_BASE }, diff --git a/queue-6.0/alsa-hda-realtek-add-quirk-for-hp-zbook-firefly-14-g9-model.patch b/queue-6.0/alsa-hda-realtek-add-quirk-for-hp-zbook-firefly-14-g9-model.patch new file mode 100644 index 00000000000..3e63c675dc3 --- /dev/null +++ b/queue-6.0/alsa-hda-realtek-add-quirk-for-hp-zbook-firefly-14-g9-model.patch @@ -0,0 +1,69 @@ +From 225f6e1bc151978041595c7d2acaded3aac41f54 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 29 Sep 2022 08:14:55 +0200 +Subject: ALSA: hda/realtek: Add quirk for HP Zbook Firefly 14 G9 model + +From: Takashi Iwai + +commit 225f6e1bc151978041595c7d2acaded3aac41f54 upstream. + +HP Zbook Firefly 14 G9 model (103c:8abb) requires yet another binding +with CS35L41 codec, but with a slightly different configuration. It's +over spi1 instead of spi0. Create a new fixup entry for that. + +Cc: +Link: https://lore.kernel.org/r/20220929061455.13355-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6741,6 +6741,11 @@ static void cs35l41_fixup_spi_two(struct + cs35l41_generic_fixup(codec, action, "spi0", "CSC3551", 2); + } + ++static void cs35l41_fixup_spi1_two(struct hda_codec *codec, const struct hda_fixup *fix, int action) ++{ ++ cs35l41_generic_fixup(codec, action, "spi1", "CSC3551", 2); ++} ++ + static void cs35l41_fixup_spi_four(struct hda_codec *codec, const struct hda_fixup *fix, int action) + { + cs35l41_generic_fixup(codec, action, "spi0", "CSC3551", 4); +@@ -7132,6 +7137,8 @@ enum { + ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED, + ALC245_FIXUP_CS35L41_SPI_2, + ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED, ++ ALC245_FIXUP_CS35L41_SPI1_2, ++ ALC245_FIXUP_CS35L41_SPI1_2_HP_GPIO_LED, + ALC245_FIXUP_CS35L41_SPI_4, + ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED, + ALC285_FIXUP_HP_SPEAKERS_MICMUTE_LED, +@@ -8979,6 +8986,16 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC285_FIXUP_HP_GPIO_LED, + }, ++ [ALC245_FIXUP_CS35L41_SPI1_2] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = cs35l41_fixup_spi1_two, ++ }, ++ [ALC245_FIXUP_CS35L41_SPI1_2_HP_GPIO_LED] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = cs35l41_fixup_spi1_two, ++ .chained = true, ++ .chain_id = ALC285_FIXUP_HP_GPIO_LED, ++ }, + [ALC245_FIXUP_CS35L41_SPI_4] = { + .type = HDA_FIXUP_FUNC, + .v.func = cs35l41_fixup_spi_four, +@@ -9341,6 +9358,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x103c, 0x8aa3, "HP ProBook 450 G9 (MB 8AA1)", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8aa8, "HP EliteBook 640 G9 (MB 8AA6)", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8aab, "HP EliteBook 650 G9 (MB 8AA9)", ALC236_FIXUP_HP_GPIO_LED), ++ SND_PCI_QUIRK(0x103c, 0x8abb, "HP ZBook Firefly 14 G9", ALC245_FIXUP_CS35L41_SPI1_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8ad1, "HP EliteBook 840 14 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8ad2, "HP EliteBook 860 16 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), diff --git a/queue-6.0/efi-correct-macmini-dmi-match-in-uefi-cert-quirk.patch b/queue-6.0/efi-correct-macmini-dmi-match-in-uefi-cert-quirk.patch new file mode 100644 index 00000000000..d6f91362117 --- /dev/null +++ b/queue-6.0/efi-correct-macmini-dmi-match-in-uefi-cert-quirk.patch @@ -0,0 +1,55 @@ +From bab715bdaa9ebf28d99a6d1efb2704a30125e96d Mon Sep 17 00:00:00 2001 +From: Orlando Chamberlain +Date: Thu, 29 Sep 2022 11:49:56 +0000 +Subject: efi: Correct Macmini DMI match in uefi cert quirk + +From: Orlando Chamberlain + +commit bab715bdaa9ebf28d99a6d1efb2704a30125e96d upstream. + +It turns out Apple doesn't capitalise the "mini" in "Macmini" in DMI, which +is inconsistent with other model line names. + +Correct the capitalisation of Macmini in the quirk for skipping loading +platform certs on T2 Macs. + +Currently users get: + +------------[ cut here ]------------ +[Firmware Bug]: Page fault caused by firmware at PA: 0xffffa30640054000 +WARNING: CPU: 1 PID: 8 at arch/x86/platform/efi/quirks.c:735 efi_crash_gracefully_on_page_fault+0x55/0xe0 +Modules linked in: +CPU: 1 PID: 8 Comm: kworker/u12:0 Not tainted 5.18.14-arch1-2-t2 #1 4535eb3fc40fd08edab32a509fbf4c9bc52d111e +Hardware name: Apple Inc. Macmini8,1/Mac-7BA5B2DFE22DDD8C, BIOS 1731.120.10.0.0 (iBridge: 19.16.15071.0.0,0) 04/24/2022 +Workqueue: efi_rts_wq efi_call_rts +... +---[ end trace 0000000000000000 ]--- +efi: Froze efi_rts_wq and disabled EFI Runtime Services +integrity: Couldn't get size: 0x8000000000000015 +integrity: MODSIGN: Couldn't get UEFI db list +efi: EFI Runtime Services are disabled! +integrity: Couldn't get size: 0x8000000000000015 +integrity: Couldn't get UEFI dbx list + +Fixes: 155ca952c7ca ("efi: Do not import certificates from UEFI Secure Boot for T2 Macs") +Cc: stable@vger.kernel.org +Cc: Aditya Garg +Tested-by: Samuel Jiang +Signed-off-by: Orlando Chamberlain +Signed-off-by: Mimi Zohar +Signed-off-by: Greg Kroah-Hartman +--- + security/integrity/platform_certs/load_uefi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/security/integrity/platform_certs/load_uefi.c ++++ b/security/integrity/platform_certs/load_uefi.c +@@ -31,7 +31,7 @@ static const struct dmi_system_id uefi_s + { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,1") }, + { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,2") }, + { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir9,1") }, +- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacMini8,1") }, ++ { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "Macmini8,1") }, + { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacPro7,1") }, + { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,1") }, + { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,2") }, diff --git a/queue-6.0/random-clamp-credited-irq-bits-to-maximum-mixed.patch b/queue-6.0/random-clamp-credited-irq-bits-to-maximum-mixed.patch new file mode 100644 index 00000000000..8addae5d5a4 --- /dev/null +++ b/queue-6.0/random-clamp-credited-irq-bits-to-maximum-mixed.patch @@ -0,0 +1,31 @@ +From e78a802a7b4febf53f2a92842f494b01062d85a8 Mon Sep 17 00:00:00 2001 +From: "Jason A. Donenfeld" +Date: Fri, 23 Sep 2022 02:42:51 +0200 +Subject: random: clamp credited irq bits to maximum mixed + +From: Jason A. Donenfeld + +commit e78a802a7b4febf53f2a92842f494b01062d85a8 upstream. + +Since the most that's mixed into the pool is sizeof(long)*2, don't +credit more than that many bytes of entropy. + +Fixes: e3e33fc2ea7f ("random: do not use input pool from hard IRQs") +Cc: stable@vger.kernel.org +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -1006,7 +1006,7 @@ static void mix_interrupt_randomness(str + local_irq_enable(); + + mix_pool_bytes(pool, sizeof(pool)); +- credit_init_bits(max(1u, (count & U16_MAX) / 64)); ++ credit_init_bits(clamp_t(unsigned int, (count & U16_MAX) / 64, 1, sizeof(pool) * 8)); + + memzero_explicit(pool, sizeof(pool)); + } diff --git a/queue-6.0/random-restore-o_nonblock-support.patch b/queue-6.0/random-restore-o_nonblock-support.patch new file mode 100644 index 00000000000..3321b18b92a --- /dev/null +++ b/queue-6.0/random-restore-o_nonblock-support.patch @@ -0,0 +1,65 @@ +From cd4f24ae9404fd31fc461066e57889be3b68641b Mon Sep 17 00:00:00 2001 +From: "Jason A. Donenfeld" +Date: Thu, 8 Sep 2022 16:14:00 +0200 +Subject: random: restore O_NONBLOCK support + +From: Jason A. Donenfeld + +commit cd4f24ae9404fd31fc461066e57889be3b68641b upstream. + +Prior to 5.6, when /dev/random was opened with O_NONBLOCK, it would +return -EAGAIN if there was no entropy. When the pools were unified in +5.6, this was lost. The post 5.6 behavior of blocking until the pool is +initialized, and ignoring O_NONBLOCK in the process, went unnoticed, +with no reports about the regression received for two and a half years. +However, eventually this indeed did break somebody's userspace. + +So we restore the old behavior, by returning -EAGAIN if the pool is not +initialized. Unlike the old /dev/random, this can only occur during +early boot, after which it never blocks again. + +In order to make this O_NONBLOCK behavior consistent with other +expectations, also respect users reading with preadv2(RWF_NOWAIT) and +similar. + +Fixes: 30c08efec888 ("random: make /dev/random be almost like /dev/urandom") +Reported-by: Guozihua +Reported-by: Zhongguohua +Cc: Al Viro +Cc: Theodore Ts'o +Cc: Andrew Lutomirski +Cc: stable@vger.kernel.org +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/mem.c | 4 ++-- + drivers/char/random.c | 5 +++++ + 2 files changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/char/mem.c ++++ b/drivers/char/mem.c +@@ -712,8 +712,8 @@ static const struct memdev { + #endif + [5] = { "zero", 0666, &zero_fops, FMODE_NOWAIT }, + [7] = { "full", 0666, &full_fops, 0 }, +- [8] = { "random", 0666, &random_fops, 0 }, +- [9] = { "urandom", 0666, &urandom_fops, 0 }, ++ [8] = { "random", 0666, &random_fops, FMODE_NOWAIT }, ++ [9] = { "urandom", 0666, &urandom_fops, FMODE_NOWAIT }, + #ifdef CONFIG_PRINTK + [11] = { "kmsg", 0644, &kmsg_fops, 0 }, + #endif +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -1347,6 +1347,11 @@ static ssize_t random_read_iter(struct k + { + int ret; + ++ if (!crng_ready() && ++ ((kiocb->ki_flags & (IOCB_NOWAIT | IOCB_NOIO)) || ++ (kiocb->ki_filp->f_flags & O_NONBLOCK))) ++ return -EAGAIN; ++ + ret = wait_for_random_bytes(); + if (ret != 0) + return ret; diff --git a/queue-6.0/revert-crypto-qat-reduce-size-of-mapped-region.patch b/queue-6.0/revert-crypto-qat-reduce-size-of-mapped-region.patch new file mode 100644 index 00000000000..14450f67929 --- /dev/null +++ b/queue-6.0/revert-crypto-qat-reduce-size-of-mapped-region.patch @@ -0,0 +1,98 @@ +From 9c5f21b198d259bfe1191b1fedf08e2eab15b33b Mon Sep 17 00:00:00 2001 +From: Giovanni Cabiddu +Date: Fri, 9 Sep 2022 11:49:13 +0100 +Subject: Revert "crypto: qat - reduce size of mapped region" + +From: Giovanni Cabiddu + +commit 9c5f21b198d259bfe1191b1fedf08e2eab15b33b upstream. + +This reverts commit e48767c17718067ba21fb2ef461779ec2506f845. + +In an attempt to resolve a set of warnings reported by the static +analyzer Smatch, the reverted commit improperly reduced the sizes of the +DMA mappings used for the input and output parameters for both RSA and +DH creating a mismatch (map size=8 bytes, unmap size=64 bytes). + +This issue is reported when CONFIG_DMA_API_DEBUG is selected, when the +crypto self test is run. The function dma_unmap_single() reports a +warning similar to the one below, saying that the `device driver frees +DMA memory with different size`. + + DMA-API: 4xxx 0000:06:00.0: device driver frees DMA memory with different size [device address=0x0000000123206c80] [map size=8 bytes] [unmap size=64 bytes] + WARNING: CPU: 0 PID: 0 at kernel/dma/debug.c:973 check_unmap+0x3d0/0x8c0\ + ... + Call Trace: + + debug_dma_unmap_page+0x5c/0x60 + qat_dh_cb+0xd7/0x110 [intel_qat] + qat_alg_asym_callback+0x1a/0x30 [intel_qat] + adf_response_handler+0xbd/0x1a0 [intel_qat] + tasklet_action_common.constprop.0+0xcd/0xe0 + __do_softirq+0xf8/0x30c + __irq_exit_rcu+0xbf/0x140 + common_interrupt+0xb9/0xd0 + + + +The original commit was correct. + +Cc: +Reported-by: Herbert Xu +Signed-off-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/qat/qat_common/qat_asym_algs.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/crypto/qat/qat_common/qat_asym_algs.c ++++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c +@@ -333,13 +333,13 @@ static int qat_dh_compute_value(struct k + qat_req->out.dh.out_tab[1] = 0; + /* Mapping in.in.b or in.in_g2.xa is the same */ + qat_req->phy_in = dma_map_single(dev, &qat_req->in.dh.in.b, +- sizeof(qat_req->in.dh.in.b), ++ sizeof(struct qat_dh_input_params), + DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(dev, qat_req->phy_in))) + goto unmap_dst; + + qat_req->phy_out = dma_map_single(dev, &qat_req->out.dh.r, +- sizeof(qat_req->out.dh.r), ++ sizeof(struct qat_dh_output_params), + DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(dev, qat_req->phy_out))) + goto unmap_in_params; +@@ -730,13 +730,13 @@ static int qat_rsa_enc(struct akcipher_r + qat_req->in.rsa.in_tab[3] = 0; + qat_req->out.rsa.out_tab[1] = 0; + qat_req->phy_in = dma_map_single(dev, &qat_req->in.rsa.enc.m, +- sizeof(qat_req->in.rsa.enc.m), ++ sizeof(struct qat_rsa_input_params), + DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(dev, qat_req->phy_in))) + goto unmap_dst; + + qat_req->phy_out = dma_map_single(dev, &qat_req->out.rsa.enc.c, +- sizeof(qat_req->out.rsa.enc.c), ++ sizeof(struct qat_rsa_output_params), + DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(dev, qat_req->phy_out))) + goto unmap_in_params; +@@ -876,13 +876,13 @@ static int qat_rsa_dec(struct akcipher_r + qat_req->in.rsa.in_tab[3] = 0; + qat_req->out.rsa.out_tab[1] = 0; + qat_req->phy_in = dma_map_single(dev, &qat_req->in.rsa.dec.c, +- sizeof(qat_req->in.rsa.dec.c), ++ sizeof(struct qat_rsa_input_params), + DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(dev, qat_req->phy_in))) + goto unmap_dst; + + qat_req->phy_out = dma_map_single(dev, &qat_req->out.rsa.dec.m, +- sizeof(qat_req->out.rsa.dec.m), ++ sizeof(struct qat_rsa_output_params), + DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(dev, qat_req->phy_out))) + goto unmap_in_params; diff --git a/queue-6.0/revert-powerpc-rtas-implement-reentrant-rtas-call.patch b/queue-6.0/revert-powerpc-rtas-implement-reentrant-rtas-call.patch new file mode 100644 index 00000000000..b8f9a3430fe --- /dev/null +++ b/queue-6.0/revert-powerpc-rtas-implement-reentrant-rtas-call.patch @@ -0,0 +1,279 @@ +From f88aabad33ea22be2ce1c60d8901942e4e2a9edb Mon Sep 17 00:00:00 2001 +From: Nathan Lynch +Date: Wed, 7 Sep 2022 17:01:11 -0500 +Subject: Revert "powerpc/rtas: Implement reentrant rtas call" + +From: Nathan Lynch + +commit f88aabad33ea22be2ce1c60d8901942e4e2a9edb upstream. + +At the time this was submitted by Leonardo, I confirmed -- or thought +I had confirmed -- with PowerVM partition firmware development that +the following RTAS functions: + +- ibm,get-xive +- ibm,int-off +- ibm,int-on +- ibm,set-xive + +were safe to call on multiple CPUs simultaneously, not only with +respect to themselves as indicated by PAPR, but with arbitrary other +RTAS calls: + +https://lore.kernel.org/linuxppc-dev/875zcy2v8o.fsf@linux.ibm.com/ + +Recent discussion with firmware development makes it clear that this +is not true, and that the code in commit b664db8e3f97 ("powerpc/rtas: +Implement reentrant rtas call") is unsafe, likely explaining several +strange bugs we've seen in internal testing involving DLPAR and +LPM. These scenarios use ibm,configure-connector, whose internal state +can be corrupted by the concurrent use of the "reentrant" functions, +leading to symptoms like endless busy statuses from RTAS. + +Fixes: b664db8e3f97 ("powerpc/rtas: Implement reentrant rtas call") +Cc: stable@vger.kernel.org # v5.8+ +Signed-off-by: Nathan Lynch +Reviewed-by: Laurent Dufour +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220907220111.223267-1-nathanl@linux.ibm.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/include/asm/paca.h | 1 + arch/powerpc/include/asm/rtas.h | 1 + arch/powerpc/kernel/paca.c | 32 --------------------- + arch/powerpc/kernel/rtas.c | 54 ------------------------------------ + arch/powerpc/sysdev/xics/ics-rtas.c | 22 +++++++------- + 5 files changed, 11 insertions(+), 99 deletions(-) + +--- a/arch/powerpc/include/asm/paca.h ++++ b/arch/powerpc/include/asm/paca.h +@@ -263,7 +263,6 @@ struct paca_struct { + u64 l1d_flush_size; + #endif + #ifdef CONFIG_PPC_PSERIES +- struct rtas_args *rtas_args_reentrant; + u8 *mce_data_buf; /* buffer to hold per cpu rtas errlog */ + #endif /* CONFIG_PPC_PSERIES */ + +--- a/arch/powerpc/include/asm/rtas.h ++++ b/arch/powerpc/include/asm/rtas.h +@@ -240,7 +240,6 @@ extern struct rtas_t rtas; + extern int rtas_token(const char *service); + extern int rtas_service_present(const char *service); + extern int rtas_call(int token, int, int, int *, ...); +-int rtas_call_reentrant(int token, int nargs, int nret, int *outputs, ...); + void rtas_call_unlocked(struct rtas_args *args, int token, int nargs, + int nret, ...); + extern void __noreturn rtas_restart(char *cmd); +--- a/arch/powerpc/kernel/paca.c ++++ b/arch/powerpc/kernel/paca.c +@@ -16,7 +16,6 @@ + #include + #include + #include +-#include + + #include "setup.h" + +@@ -170,30 +169,6 @@ static struct slb_shadow * __init new_sl + } + #endif /* CONFIG_PPC_64S_HASH_MMU */ + +-#ifdef CONFIG_PPC_PSERIES +-/** +- * new_rtas_args() - Allocates rtas args +- * @cpu: CPU number +- * @limit: Memory limit for this allocation +- * +- * Allocates a struct rtas_args and return it's pointer, +- * if not in Hypervisor mode +- * +- * Return: Pointer to allocated rtas_args +- * NULL if CPU in Hypervisor Mode +- */ +-static struct rtas_args * __init new_rtas_args(int cpu, unsigned long limit) +-{ +- limit = min_t(unsigned long, limit, RTAS_INSTANTIATE_MAX); +- +- if (early_cpu_has_feature(CPU_FTR_HVMODE)) +- return NULL; +- +- return alloc_paca_data(sizeof(struct rtas_args), L1_CACHE_BYTES, +- limit, cpu); +-} +-#endif /* CONFIG_PPC_PSERIES */ +- + /* The Paca is an array with one entry per processor. Each contains an + * lppaca, which contains the information shared between the + * hypervisor and Linux. +@@ -232,10 +207,6 @@ void __init initialise_paca(struct paca_ + /* For now -- if we have threads this will be adjusted later */ + new_paca->tcd_ptr = &new_paca->tcd; + #endif +- +-#ifdef CONFIG_PPC_PSERIES +- new_paca->rtas_args_reentrant = NULL; +-#endif + } + + /* Put the paca pointer into r13 and SPRG_PACA */ +@@ -308,9 +279,6 @@ void __init allocate_paca(int cpu) + #ifdef CONFIG_PPC_64S_HASH_MMU + paca->slb_shadow_ptr = new_slb_shadow(cpu, limit); + #endif +-#ifdef CONFIG_PPC_PSERIES +- paca->rtas_args_reentrant = new_rtas_args(cpu, limit); +-#endif + paca_struct_size += sizeof(struct paca_struct); + } + +--- a/arch/powerpc/kernel/rtas.c ++++ b/arch/powerpc/kernel/rtas.c +@@ -43,7 +43,6 @@ + #include + #include + #include +-#include + + /* This is here deliberately so it's only used in this file */ + void enter_rtas(unsigned long); +@@ -932,59 +931,6 @@ void rtas_activate_firmware(void) + pr_err("ibm,activate-firmware failed (%i)\n", fwrc); + } + +-#ifdef CONFIG_PPC_PSERIES +-/** +- * rtas_call_reentrant() - Used for reentrant rtas calls +- * @token: Token for desired reentrant RTAS call +- * @nargs: Number of Input Parameters +- * @nret: Number of Output Parameters +- * @outputs: Array of outputs +- * @...: Inputs for desired RTAS call +- * +- * According to LoPAR documentation, only "ibm,int-on", "ibm,int-off", +- * "ibm,get-xive" and "ibm,set-xive" are currently reentrant. +- * Reentrant calls need their own rtas_args buffer, so not using rtas.args, but +- * PACA one instead. +- * +- * Return: -1 on error, +- * First output value of RTAS call if (nret > 0), +- * 0 otherwise, +- */ +-int rtas_call_reentrant(int token, int nargs, int nret, int *outputs, ...) +-{ +- va_list list; +- struct rtas_args *args; +- unsigned long flags; +- int i, ret = 0; +- +- if (!rtas.entry || token == RTAS_UNKNOWN_SERVICE) +- return -1; +- +- local_irq_save(flags); +- preempt_disable(); +- +- /* We use the per-cpu (PACA) rtas args buffer */ +- args = local_paca->rtas_args_reentrant; +- +- va_start(list, outputs); +- va_rtas_call_unlocked(args, token, nargs, nret, list); +- va_end(list); +- +- if (nret > 1 && outputs) +- for (i = 0; i < nret - 1; ++i) +- outputs[i] = be32_to_cpu(args->rets[i + 1]); +- +- if (nret > 0) +- ret = be32_to_cpu(args->rets[0]); +- +- local_irq_restore(flags); +- preempt_enable(); +- +- return ret; +-} +- +-#endif /* CONFIG_PPC_PSERIES */ +- + /** + * get_pseries_errorlog() - Find a specific pseries error log in an RTAS + * extended event log. +--- a/arch/powerpc/sysdev/xics/ics-rtas.c ++++ b/arch/powerpc/sysdev/xics/ics-rtas.c +@@ -36,8 +36,8 @@ static void ics_rtas_unmask_irq(struct i + + server = xics_get_irq_server(d->irq, irq_data_get_affinity_mask(d), 0); + +- call_status = rtas_call_reentrant(ibm_set_xive, 3, 1, NULL, hw_irq, +- server, DEFAULT_PRIORITY); ++ call_status = rtas_call(ibm_set_xive, 3, 1, NULL, hw_irq, server, ++ DEFAULT_PRIORITY); + if (call_status != 0) { + printk(KERN_ERR + "%s: ibm_set_xive irq %u server %x returned %d\n", +@@ -46,7 +46,7 @@ static void ics_rtas_unmask_irq(struct i + } + + /* Now unmask the interrupt (often a no-op) */ +- call_status = rtas_call_reentrant(ibm_int_on, 1, 1, NULL, hw_irq); ++ call_status = rtas_call(ibm_int_on, 1, 1, NULL, hw_irq); + if (call_status != 0) { + printk(KERN_ERR "%s: ibm_int_on irq=%u returned %d\n", + __func__, hw_irq, call_status); +@@ -68,7 +68,7 @@ static void ics_rtas_mask_real_irq(unsig + if (hw_irq == XICS_IPI) + return; + +- call_status = rtas_call_reentrant(ibm_int_off, 1, 1, NULL, hw_irq); ++ call_status = rtas_call(ibm_int_off, 1, 1, NULL, hw_irq); + if (call_status != 0) { + printk(KERN_ERR "%s: ibm_int_off irq=%u returned %d\n", + __func__, hw_irq, call_status); +@@ -76,8 +76,8 @@ static void ics_rtas_mask_real_irq(unsig + } + + /* Have to set XIVE to 0xff to be able to remove a slot */ +- call_status = rtas_call_reentrant(ibm_set_xive, 3, 1, NULL, hw_irq, +- xics_default_server, 0xff); ++ call_status = rtas_call(ibm_set_xive, 3, 1, NULL, hw_irq, ++ xics_default_server, 0xff); + if (call_status != 0) { + printk(KERN_ERR "%s: ibm_set_xive(0xff) irq=%u returned %d\n", + __func__, hw_irq, call_status); +@@ -108,7 +108,7 @@ static int ics_rtas_set_affinity(struct + if (hw_irq == XICS_IPI || hw_irq == XICS_IRQ_SPURIOUS) + return -1; + +- status = rtas_call_reentrant(ibm_get_xive, 1, 3, xics_status, hw_irq); ++ status = rtas_call(ibm_get_xive, 1, 3, xics_status, hw_irq); + + if (status) { + printk(KERN_ERR "%s: ibm,get-xive irq=%u returns %d\n", +@@ -126,8 +126,8 @@ static int ics_rtas_set_affinity(struct + pr_debug("%s: irq %d [hw 0x%x] server: 0x%x\n", __func__, d->irq, + hw_irq, irq_server); + +- status = rtas_call_reentrant(ibm_set_xive, 3, 1, NULL, +- hw_irq, irq_server, xics_status[1]); ++ status = rtas_call(ibm_set_xive, 3, 1, NULL, ++ hw_irq, irq_server, xics_status[1]); + + if (status) { + printk(KERN_ERR "%s: ibm,set-xive irq=%u returns %d\n", +@@ -158,7 +158,7 @@ static int ics_rtas_check(struct ics *ic + return -EINVAL; + + /* Check if RTAS knows about this interrupt */ +- rc = rtas_call_reentrant(ibm_get_xive, 1, 3, status, hw_irq); ++ rc = rtas_call(ibm_get_xive, 1, 3, status, hw_irq); + if (rc) + return -ENXIO; + +@@ -174,7 +174,7 @@ static long ics_rtas_get_server(struct i + { + int rc, status[2]; + +- rc = rtas_call_reentrant(ibm_get_xive, 1, 3, status, vec); ++ rc = rtas_call(ibm_get_xive, 1, 3, status, vec); + if (rc) + return -1; + return status[0]; diff --git a/queue-6.0/revert-usb-dwc3-don-t-switch-otg-peripheral-if-extcon-is-present.patch b/queue-6.0/revert-usb-dwc3-don-t-switch-otg-peripheral-if-extcon-is-present.patch new file mode 100644 index 00000000000..48d1c4ac546 --- /dev/null +++ b/queue-6.0/revert-usb-dwc3-don-t-switch-otg-peripheral-if-extcon-is-present.patch @@ -0,0 +1,185 @@ +From 7a84e7353e23202d4f82b05093af4db2b26e6768 Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Tue, 27 Sep 2022 18:53:32 +0300 +Subject: Revert "usb: dwc3: Don't switch OTG -> peripheral if extcon is present" + +From: Andy Shevchenko + +commit 7a84e7353e23202d4f82b05093af4db2b26e6768 upstream. + +This reverts commit 0f01017191384e3962fa31520a9fd9846c3d352f. + +As pointed out by Ferry this breaks Dual Role support on +Intel Merrifield platforms. + +Fixes: 0f0101719138 ("usb: dwc3: Don't switch OTG -> peripheral if extcon is present") +Reported-by: Ferry Toth +Cc: stable@vger.kernel.org +Signed-off-by: Andy Shevchenko +Tested-by: Ferry Toth # for Merrifield +Reviewed-by: Sven Peter +Link: https://lore.kernel.org/r/20220927155332.10762-3-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.c | 55 ------------------------------------------------ + drivers/usb/dwc3/drd.c | 50 +++++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 51 insertions(+), 54 deletions(-) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -23,7 +23,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -86,7 +85,7 @@ static int dwc3_get_dr_mode(struct dwc3 + * mode. If the controller supports DRD but the dr_mode is not + * specified or set to OTG, then set the mode to peripheral. + */ +- if (mode == USB_DR_MODE_OTG && !dwc->edev && ++ if (mode == USB_DR_MODE_OTG && + (!IS_ENABLED(CONFIG_USB_ROLE_SWITCH) || + !device_property_read_bool(dwc->dev, "usb-role-switch")) && + !DWC3_VER_IS_PRIOR(DWC3, 330A)) +@@ -1668,51 +1667,6 @@ static void dwc3_check_params(struct dwc + } + } + +-static struct extcon_dev *dwc3_get_extcon(struct dwc3 *dwc) +-{ +- struct device *dev = dwc->dev; +- struct device_node *np_phy; +- struct extcon_dev *edev = NULL; +- const char *name; +- +- if (device_property_read_bool(dev, "extcon")) +- return extcon_get_edev_by_phandle(dev, 0); +- +- /* +- * Device tree platforms should get extcon via phandle. +- * On ACPI platforms, we get the name from a device property. +- * This device property is for kernel internal use only and +- * is expected to be set by the glue code. +- */ +- if (device_property_read_string(dev, "linux,extcon-name", &name) == 0) { +- edev = extcon_get_extcon_dev(name); +- if (!edev) +- return ERR_PTR(-EPROBE_DEFER); +- +- return edev; +- } +- +- /* +- * Try to get an extcon device from the USB PHY controller's "port" +- * node. Check if it has the "port" node first, to avoid printing the +- * error message from underlying code, as it's a valid case: extcon +- * device (and "port" node) may be missing in case of "usb-role-switch" +- * or OTG mode. +- */ +- np_phy = of_parse_phandle(dev->of_node, "phys", 0); +- if (of_graph_is_present(np_phy)) { +- struct device_node *np_conn; +- +- np_conn = of_graph_get_remote_node(np_phy, -1, -1); +- if (np_conn) +- edev = extcon_find_edev_by_node(np_conn); +- of_node_put(np_conn); +- } +- of_node_put(np_phy); +- +- return edev; +-} +- + static int dwc3_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; +@@ -1849,13 +1803,6 @@ static int dwc3_probe(struct platform_de + goto err2; + } + +- dwc->edev = dwc3_get_extcon(dwc); +- if (IS_ERR(dwc->edev)) { +- ret = PTR_ERR(dwc->edev); +- dev_err_probe(dwc->dev, ret, "failed to get extcon\n"); +- goto err3; +- } +- + ret = dwc3_get_dr_mode(dwc); + if (ret) + goto err3; +--- a/drivers/usb/dwc3/drd.c ++++ b/drivers/usb/dwc3/drd.c +@@ -8,6 +8,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -438,6 +439,51 @@ static int dwc3_drd_notifier(struct noti + return NOTIFY_DONE; + } + ++static struct extcon_dev *dwc3_get_extcon(struct dwc3 *dwc) ++{ ++ struct device *dev = dwc->dev; ++ struct device_node *np_phy; ++ struct extcon_dev *edev = NULL; ++ const char *name; ++ ++ if (device_property_read_bool(dev, "extcon")) ++ return extcon_get_edev_by_phandle(dev, 0); ++ ++ /* ++ * Device tree platforms should get extcon via phandle. ++ * On ACPI platforms, we get the name from a device property. ++ * This device property is for kernel internal use only and ++ * is expected to be set by the glue code. ++ */ ++ if (device_property_read_string(dev, "linux,extcon-name", &name) == 0) { ++ edev = extcon_get_extcon_dev(name); ++ if (!edev) ++ return ERR_PTR(-EPROBE_DEFER); ++ ++ return edev; ++ } ++ ++ /* ++ * Try to get an extcon device from the USB PHY controller's "port" ++ * node. Check if it has the "port" node first, to avoid printing the ++ * error message from underlying code, as it's a valid case: extcon ++ * device (and "port" node) may be missing in case of "usb-role-switch" ++ * or OTG mode. ++ */ ++ np_phy = of_parse_phandle(dev->of_node, "phys", 0); ++ if (of_graph_is_present(np_phy)) { ++ struct device_node *np_conn; ++ ++ np_conn = of_graph_get_remote_node(np_phy, -1, -1); ++ if (np_conn) ++ edev = extcon_find_edev_by_node(np_conn); ++ of_node_put(np_conn); ++ } ++ of_node_put(np_phy); ++ ++ return edev; ++} ++ + #if IS_ENABLED(CONFIG_USB_ROLE_SWITCH) + #define ROLE_SWITCH 1 + static int dwc3_usb_role_switch_set(struct usb_role_switch *sw, +@@ -542,6 +588,10 @@ int dwc3_drd_init(struct dwc3 *dwc) + device_property_read_bool(dwc->dev, "usb-role-switch")) + return dwc3_setup_role_switch(dwc); + ++ dwc->edev = dwc3_get_extcon(dwc); ++ if (IS_ERR(dwc->edev)) ++ return PTR_ERR(dwc->edev); ++ + if (dwc->edev) { + dwc->edev_nb.notifier_call = dwc3_drd_notifier; + ret = extcon_register_notifier(dwc->edev, EXTCON_USB_HOST, diff --git a/queue-6.0/revert-usb-fixup-for-merge-issue-with-usb-dwc3-don-t-switch-otg-peripheral-if-extcon-is-present.patch b/queue-6.0/revert-usb-fixup-for-merge-issue-with-usb-dwc3-don-t-switch-otg-peripheral-if-extcon-is-present.patch new file mode 100644 index 00000000000..4359f4f6697 --- /dev/null +++ b/queue-6.0/revert-usb-fixup-for-merge-issue-with-usb-dwc3-don-t-switch-otg-peripheral-if-extcon-is-present.patch @@ -0,0 +1,43 @@ +From 2adc960ce79d3231b02f820daeee434542fe2911 Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Tue, 27 Sep 2022 18:53:31 +0300 +Subject: Revert "USB: fixup for merge issue with "usb: dwc3: Don't switch OTG -> peripheral if extcon is present"" + +From: Andy Shevchenko + +commit 2adc960ce79d3231b02f820daeee434542fe2911 upstream. + +This reverts commit 8bd6b8c4b1009d7d2662138d6bdc6fe58a9274c5. + +Prerequisite revert for the reverting of the original commit 0f0101719138. + +Fixes: 8bd6b8c4b100 ("USB: fixup for merge issue with "usb: dwc3: Don't switch OTG -> peripheral if extcon is present"") +Fixes: 0f0101719138 ("usb: dwc3: Don't switch OTG -> peripheral if extcon is present") +Reported-by: Ferry Toth +Cc: stable@vger.kernel.org +Signed-off-by: Andy Shevchenko +Tested-by: Ferry Toth # for Merrifield +Link: https://lore.kernel.org/r/20220927155332.10762-2-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -1684,8 +1684,13 @@ static struct extcon_dev *dwc3_get_extco + * This device property is for kernel internal use only and + * is expected to be set by the glue code. + */ +- if (device_property_read_string(dev, "linux,extcon-name", &name) == 0) +- return extcon_get_extcon_dev(name); ++ if (device_property_read_string(dev, "linux,extcon-name", &name) == 0) { ++ edev = extcon_get_extcon_dev(name); ++ if (!edev) ++ return ERR_PTR(-EPROBE_DEFER); ++ ++ return edev; ++ } + + /* + * Try to get an extcon device from the USB PHY controller's "port" diff --git a/queue-6.0/scsi-qla2xxx-fix-response-queue-handler-reading-stale-packets.patch b/queue-6.0/scsi-qla2xxx-fix-response-queue-handler-reading-stale-packets.patch new file mode 100644 index 00000000000..01a1c6074e9 --- /dev/null +++ b/queue-6.0/scsi-qla2xxx-fix-response-queue-handler-reading-stale-packets.patch @@ -0,0 +1,65 @@ +From e4f8a29deb3ba30e414dfb6b09e3ae3bf6dbe74a Mon Sep 17 00:00:00 2001 +From: Arun Easi +Date: Fri, 26 Aug 2022 03:25:54 -0700 +Subject: scsi: qla2xxx: Fix response queue handler reading stale packets + +From: Arun Easi + +commit e4f8a29deb3ba30e414dfb6b09e3ae3bf6dbe74a upstream. + +On some platforms, the current logic of relying on finding new packet +solely based on signature pattern can lead to driver reading stale +packets. Though this is a bug in those platforms, reduce such exposures by +limiting reading packets until the IN pointer. + +Link: https://lore.kernel.org/r/20220826102559.17474-3-njavali@marvell.com +Cc: stable@vger.kernel.org +Reviewed-by: Himanshu Madhani +Signed-off-by: Arun Easi +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/qla2xxx/qla_isr.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -3763,7 +3763,8 @@ void qla24xx_process_response_queue(stru + struct qla_hw_data *ha = vha->hw; + struct purex_entry_24xx *purex_entry; + struct purex_item *pure_item; +- u16 cur_ring_index; ++ u16 rsp_in = 0, cur_ring_index; ++ int is_shadow_hba; + + if (!ha->flags.fw_started) + return; +@@ -3773,7 +3774,18 @@ void qla24xx_process_response_queue(stru + qla_cpu_update(rsp->qpair, smp_processor_id()); + } + +- while (rsp->ring_ptr->signature != RESPONSE_PROCESSED) { ++#define __update_rsp_in(_is_shadow_hba, _rsp, _rsp_in) \ ++ do { \ ++ _rsp_in = _is_shadow_hba ? *(_rsp)->in_ptr : \ ++ rd_reg_dword_relaxed((_rsp)->rsp_q_in); \ ++ } while (0) ++ ++ is_shadow_hba = IS_SHADOW_REG_CAPABLE(ha); ++ ++ __update_rsp_in(is_shadow_hba, rsp, rsp_in); ++ ++ while (rsp->ring_index != rsp_in && ++ rsp->ring_ptr->signature != RESPONSE_PROCESSED) { + pkt = (struct sts_entry_24xx *)rsp->ring_ptr; + cur_ring_index = rsp->ring_index; + +@@ -3887,6 +3899,7 @@ process_err: + } + pure_item = qla27xx_copy_fpin_pkt(vha, + (void **)&pkt, &rsp); ++ __update_rsp_in(is_shadow_hba, rsp, rsp_in); + if (!pure_item) + break; + qla24xx_queue_purex_item(vha, pure_item, diff --git a/queue-6.0/scsi-qla2xxx-revert-scsi-qla2xxx-fix-response-queue-handler-reading-stale-packets.patch b/queue-6.0/scsi-qla2xxx-revert-scsi-qla2xxx-fix-response-queue-handler-reading-stale-packets.patch new file mode 100644 index 00000000000..755af6ed6f9 --- /dev/null +++ b/queue-6.0/scsi-qla2xxx-revert-scsi-qla2xxx-fix-response-queue-handler-reading-stale-packets.patch @@ -0,0 +1,107 @@ +From 6dc45a7322cb9db48a5b6696597a00ef7c778ef9 Mon Sep 17 00:00:00 2001 +From: Arun Easi +Date: Fri, 26 Aug 2022 03:25:53 -0700 +Subject: scsi: qla2xxx: Revert "scsi: qla2xxx: Fix response queue handler reading stale packets" + +From: Arun Easi + +commit 6dc45a7322cb9db48a5b6696597a00ef7c778ef9 upstream. + +Reverting this commit so that a fixed up patch, without adding new module +parameters, can be submitted. + + Link: https://lore.kernel.org/stable/166039743723771@kroah.com/ + +This reverts commit b1f707146923335849fb70237eec27d4d1ae7d62. + +Link: https://lore.kernel.org/r/20220826102559.17474-2-njavali@marvell.com +Cc: stable@vger.kernel.org +Reviewed-by: Himanshu Madhani +Signed-off-by: Arun Easi +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/qla2xxx/qla_gbl.h | 2 -- + drivers/scsi/qla2xxx/qla_isr.c | 25 ++----------------------- + drivers/scsi/qla2xxx/qla_os.c | 10 ---------- + 3 files changed, 2 insertions(+), 35 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_gbl.h ++++ b/drivers/scsi/qla2xxx/qla_gbl.h +@@ -193,8 +193,6 @@ extern int ql2xsecenable; + extern int ql2xenforce_iocb_limit; + extern int ql2xabts_wait_nvme; + extern u32 ql2xnvme_queues; +-extern int ql2xrspq_follow_inptr; +-extern int ql2xrspq_follow_inptr_legacy; + + extern int qla2x00_loop_reset(scsi_qla_host_t *); + extern void qla2x00_abort_all_cmds(scsi_qla_host_t *, int); +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -3763,8 +3763,7 @@ void qla24xx_process_response_queue(stru + struct qla_hw_data *ha = vha->hw; + struct purex_entry_24xx *purex_entry; + struct purex_item *pure_item; +- u16 rsp_in = 0, cur_ring_index; +- int follow_inptr, is_shadow_hba; ++ u16 cur_ring_index; + + if (!ha->flags.fw_started) + return; +@@ -3774,25 +3773,7 @@ void qla24xx_process_response_queue(stru + qla_cpu_update(rsp->qpair, smp_processor_id()); + } + +-#define __update_rsp_in(_update, _is_shadow_hba, _rsp, _rsp_in) \ +- do { \ +- if (_update) { \ +- _rsp_in = _is_shadow_hba ? *(_rsp)->in_ptr : \ +- rd_reg_dword_relaxed((_rsp)->rsp_q_in); \ +- } \ +- } while (0) +- +- is_shadow_hba = IS_SHADOW_REG_CAPABLE(ha); +- follow_inptr = is_shadow_hba ? ql2xrspq_follow_inptr : +- ql2xrspq_follow_inptr_legacy; +- +- __update_rsp_in(follow_inptr, is_shadow_hba, rsp, rsp_in); +- +- while ((likely(follow_inptr && +- rsp->ring_index != rsp_in && +- rsp->ring_ptr->signature != RESPONSE_PROCESSED)) || +- (!follow_inptr && +- rsp->ring_ptr->signature != RESPONSE_PROCESSED)) { ++ while (rsp->ring_ptr->signature != RESPONSE_PROCESSED) { + pkt = (struct sts_entry_24xx *)rsp->ring_ptr; + cur_ring_index = rsp->ring_index; + +@@ -3906,8 +3887,6 @@ process_err: + } + pure_item = qla27xx_copy_fpin_pkt(vha, + (void **)&pkt, &rsp); +- __update_rsp_in(follow_inptr, is_shadow_hba, +- rsp, rsp_in); + if (!pure_item) + break; + qla24xx_queue_purex_item(vha, pure_item, +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -338,16 +338,6 @@ module_param(ql2xdelay_before_pci_error_ + MODULE_PARM_DESC(ql2xdelay_before_pci_error_handling, + "Number of seconds delayed before qla begin PCI error self-handling (default: 5).\n"); + +-int ql2xrspq_follow_inptr = 1; +-module_param(ql2xrspq_follow_inptr, int, 0644); +-MODULE_PARM_DESC(ql2xrspq_follow_inptr, +- "Follow RSP IN pointer for RSP updates for HBAs 27xx and newer (default: 1)."); +- +-int ql2xrspq_follow_inptr_legacy = 1; +-module_param(ql2xrspq_follow_inptr_legacy, int, 0644); +-MODULE_PARM_DESC(ql2xrspq_follow_inptr_legacy, +- "Follow RSP IN pointer for RSP updates for HBAs older than 27XX. (default: 1)."); +- + static void qla2x00_clear_drv_active(struct qla_hw_data *); + static void qla2x00_free_device(scsi_qla_host_t *); + static int qla2xxx_map_queues(struct Scsi_Host *shost); diff --git a/queue-6.0/scsi-stex-properly-zero-out-the-passthrough-command-structure.patch b/queue-6.0/scsi-stex-properly-zero-out-the-passthrough-command-structure.patch new file mode 100644 index 00000000000..80beb749378 --- /dev/null +++ b/queue-6.0/scsi-stex-properly-zero-out-the-passthrough-command-structure.patch @@ -0,0 +1,68 @@ +From 6022f210461fef67e6e676fd8544ca02d1bcfa7a Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Fri, 9 Sep 2022 08:54:47 +0200 +Subject: scsi: stex: Properly zero out the passthrough command structure + +From: Linus Torvalds + +commit 6022f210461fef67e6e676fd8544ca02d1bcfa7a upstream. + +The passthrough structure is declared off of the stack, so it needs to be +set to zero before copied back to userspace to prevent any unintentional +data leakage. Switch things to be statically allocated which will fill the +unused fields with 0 automatically. + +Link: https://lore.kernel.org/r/YxrjN3OOw2HHl9tx@kroah.com +Cc: stable@kernel.org +Cc: "James E.J. Bottomley" +Cc: "Martin K. Petersen" +Cc: Dan Carpenter +Reported-by: hdthky +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/stex.c | 17 +++++++++-------- + include/scsi/scsi_cmnd.h | 2 +- + 2 files changed, 10 insertions(+), 9 deletions(-) + +--- a/drivers/scsi/stex.c ++++ b/drivers/scsi/stex.c +@@ -665,16 +665,17 @@ static int stex_queuecommand_lck(struct + return 0; + case PASSTHRU_CMD: + if (cmd->cmnd[1] == PASSTHRU_GET_DRVVER) { +- struct st_drvver ver; ++ const struct st_drvver ver = { ++ .major = ST_VER_MAJOR, ++ .minor = ST_VER_MINOR, ++ .oem = ST_OEM, ++ .build = ST_BUILD_VER, ++ .signature[0] = PASSTHRU_SIGNATURE, ++ .console_id = host->max_id - 1, ++ .host_no = hba->host->host_no, ++ }; + size_t cp_len = sizeof(ver); + +- ver.major = ST_VER_MAJOR; +- ver.minor = ST_VER_MINOR; +- ver.oem = ST_OEM; +- ver.build = ST_BUILD_VER; +- ver.signature[0] = PASSTHRU_SIGNATURE; +- ver.console_id = host->max_id - 1; +- ver.host_no = hba->host->host_no; + cp_len = scsi_sg_copy_from_buffer(cmd, &ver, cp_len); + if (sizeof(ver) == cp_len) + cmd->result = DID_OK << 16; +--- a/include/scsi/scsi_cmnd.h ++++ b/include/scsi/scsi_cmnd.h +@@ -201,7 +201,7 @@ static inline unsigned int scsi_get_resi + for_each_sg(scsi_sglist(cmd), sg, nseg, __i) + + static inline int scsi_sg_copy_from_buffer(struct scsi_cmnd *cmd, +- void *buf, int buflen) ++ const void *buf, int buflen) + { + return sg_copy_from_buffer(scsi_sglist(cmd), scsi_sg_count(cmd), + buf, buflen); diff --git a/queue-6.0/series b/queue-6.0/series index 0b34584171e..da9275614c9 100644 --- a/queue-6.0/series +++ b/queue-6.0/series @@ -3,3 +3,16 @@ nilfs2-fix-use-after-free-bug-of-struct-nilfs_root.patch nilfs2-fix-leak-of-nilfs_root-in-case-of-writer-thread-creation-failure.patch nilfs2-replace-warn_ons-by-nilfs_error-for-checkpoint-acquisition-failure.patch nvme-pci-set-min_align_mask-before-calculating-max_hw_sectors.patch +random-restore-o_nonblock-support.patch +random-clamp-credited-irq-bits-to-maximum-mixed.patch +alsa-hda-fix-position-reporting-on-poulsbo.patch +alsa-hda-realtek-add-quirk-for-hp-zbook-firefly-14-g9-model.patch +efi-correct-macmini-dmi-match-in-uefi-cert-quirk.patch +scsi-qla2xxx-revert-scsi-qla2xxx-fix-response-queue-handler-reading-stale-packets.patch +scsi-qla2xxx-fix-response-queue-handler-reading-stale-packets.patch +scsi-stex-properly-zero-out-the-passthrough-command-structure.patch +usb-serial-qcserial-add-new-usb-id-for-dell-branded-em7455.patch +revert-usb-fixup-for-merge-issue-with-usb-dwc3-don-t-switch-otg-peripheral-if-extcon-is-present.patch +revert-usb-dwc3-don-t-switch-otg-peripheral-if-extcon-is-present.patch +revert-powerpc-rtas-implement-reentrant-rtas-call.patch +revert-crypto-qat-reduce-size-of-mapped-region.patch diff --git a/queue-6.0/usb-serial-qcserial-add-new-usb-id-for-dell-branded-em7455.patch b/queue-6.0/usb-serial-qcserial-add-new-usb-id-for-dell-branded-em7455.patch new file mode 100644 index 00000000000..7a76a81d1bf --- /dev/null +++ b/queue-6.0/usb-serial-qcserial-add-new-usb-id-for-dell-branded-em7455.patch @@ -0,0 +1,29 @@ +From eee48781ea199e32c1d0c4732641c494833788ca Mon Sep 17 00:00:00 2001 +From: Frank Wunderlich +Date: Mon, 26 Sep 2022 17:07:39 +0200 +Subject: USB: serial: qcserial: add new usb-id for Dell branded EM7455 + +From: Frank Wunderlich + +commit eee48781ea199e32c1d0c4732641c494833788ca upstream. + +Add support for Dell 5811e (EM7455) with USB-id 0x413c:0x81c2. + +Signed-off-by: Frank Wunderlich +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/qcserial.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -177,6 +177,7 @@ static const struct usb_device_id id_tab + {DEVICE_SWI(0x413c, 0x81b3)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */ + {DEVICE_SWI(0x413c, 0x81b5)}, /* Dell Wireless 5811e QDL */ + {DEVICE_SWI(0x413c, 0x81b6)}, /* Dell Wireless 5811e QDL */ ++ {DEVICE_SWI(0x413c, 0x81c2)}, /* Dell Wireless 5811e */ + {DEVICE_SWI(0x413c, 0x81cb)}, /* Dell Wireless 5816e QDL */ + {DEVICE_SWI(0x413c, 0x81cc)}, /* Dell Wireless 5816e */ + {DEVICE_SWI(0x413c, 0x81cf)}, /* Dell Wireless 5819 */ -- 2.47.3